[ISN] Looking at the Free Market, and Seeing Red

[InfoSec News]

http://www.nytimes.com/2006/04/09/business/yourmoney/09digi.html

By RANDALL STROSS
April 9, 2006

LOU DOBBS is a master of the sinister tease. Last month, he was in top 
form. Previewing a story, he told viewers of his nightly CNN newscast 
that when the State Department seeks secure network communications, it 
"turns to Communist China," and thus renders the United States 
"perhaps more vulnerable than ever."

The story turned out to be another Lou Dobbs exercise in bashing 
immigrants, or, more precisely, bashing a single immigrant: Lenovo, 
the PC maker originally based in China that last year acquired 
I.B.M.'s PC division and is now based in Raleigh, N.C. Lenovo recently 
won a competitive bid to sell the State Department $13 million worth 
of personal computers. Mr. Dobbs, like some politicians on Capitol 
Hill, suggests that those PC's could provide shadowy spooks in the 
Chinese government with an ideal means of conducting espionage.

Merely hinting at such a possibility is enough to hurt Lenovo's 
reputation. This is a potentially serious impairment in the highly 
competitive, commoditized PC business. What is happening to Lenovo, 
the most internationalized company in the industry, is a drive-by 
smearing. 

Mr. Dobbs is not the only practitioner of the hit-and-run attack. In 
his segment about Lenovo he called upon Michael R. Wessel, a member of 
the U.S.-China Economic and Security Review Commission, an advisory 
body to Congress. Mr. Wessel said that the State Department would use 
the Lenovo computers in offices around the world, potentially 
providing China access to "some of our deepest secrets," a "treasure 
trove of information they could use against us."

Mr. Wessel's segment was too brief to explain how China's agents would 
be able to grab hold of the machines to install the software for 
clandestine data transmission back to the party's Central Committee. 
The Lenovo desktops headed for the State Department will be assembled 
in facilities in North Carolina, not a People's Liberation Army 
compound in China. Also unexplained was how infected machines would 
meet General Services Administration security standards and get past 
the State Department's two computer security groups, which oversee the 
administration of their own test suites and install firewalls and 
other security software. 

Last week, I spoke with Mr. Wessel to learn more about the basis for 
his alarm. It turned out that he was not able to describe how Chinese 
agents could gain access to the Lenovo machines, undetected, while 
they were being assembled. 

When I asked why he thought the State Department's security procedures 
were inadequate, he suggested that he could not say because the State 
Department had been less than forthcoming with him. "We don't fully 
know" what the procedures are, he said. But when I asked him if he had 
requested information from the department about its protocols before 
he publicly voiced his concerns about the Lenovo deal, he said he had 
not.

Larry M. Wortzel, the chairman of the security review commission on 
which Mr. Wessel serves, was even more animated in asserting that 
there were security risks in the Lenovo sale to the State Department. 
When I spoke with him, he professed to be mystified as to "why the 
State Department would take the risk." What had the State Department 
told him about its security procedures? He, too, had yet to speak with 
anyone there; the commission's request for a briefing had been drafted 
but not yet sent.

Both commissioners assume that Lenovo is managed by puppets whose 
strings are pulled in Beijing. Mr. Wessel said he was certain that "a 
major portion" of Lenovo was "controlled by the Chinese government." 
State enterprises are placed in the hands of "princelings," who are 
the children of government leaders, he began to explain before I 
interrupted. 

Princelings installed at the meritocratic Lenovo? When I asked Mr. 
Wessel to identify a Lenovo princeling, he said, "I haven't done a 
research of Lenovo." He said he had merely "raised questions" and had 
"never purported to have answers." This was similar to the reply from 
Mr. Wortzel when he was asked to substantiate his allegations with 
details.

The fact is that Lenovo is a living repudiation of the system that 
these critics assume it represents. It was born in 1984 from 
un-Communist entrepreneurial impulses among a group of Chinese 
computer scientists who wanted to start their own company. Their 
employer, the Chinese Academy of Sciences, gave them $25,000 in 
venture capital, and off they went. It was among the first Chinese 
companies to issue employee stock options. 

The Academy of Sciences retains a minority ownership position, but so 
do I.B.M. and three American private-equity firms. The largest block 
of shares is owned by public shareholders. (Its shares are traded on 
the Hong Kong exchange.) Lenovo is headed not by a princeling but by 
an American, William J. Amelio - a former senior vice president for 
Dell, as it happens.

Perhaps the security concerns could be validated by an authority on 
China's military. I spoke with James C. Mulvenon, deputy director of 
the Center for Intelligence Research and Analysis, which is based in 
Washington and run by Defense Group Inc.

Dr. Mulvenon said he had many concerns about China's state-sponsored 
espionage activities, but Lenovo was not on his list. He described the 
controversy about Lenovo as "xenophobia and anti-China fervor dressed 
up as a technology concern." 

Rob Enderle of the Enderle Group, a technology consulting firm in San 
Jose, Calif., said he also saw the criticism of Lenovo as lacking in 
substance. With an executive staff split between Chinese and 
Americans, Lenovo is the most global company in the PC industry, he 
said. The real story, he said, was that these critics were "really 
torqued that China is out-executing the U.S."

Lenovo is an inviting magnet for all sorts of free-floating American 
anxieties about global competition. The visceral nature of these 
concerns can be seen in other remarks by Mr. Wortzel of the U.S.-China 
Economic and Security Review Commission. He said, "As a taxpayer, I 
have a serious concern about why my tax money is spent on a computer 
made by a company owned by the government of the People's Republic of 
China." Why, he asked, couldn't the State Department place its order 
with a "100 percent American-owned company"? 

The cold-war template of us versus them, capitalist versus Communist, 
does not fit the geography of the globalized supply chain that 
underpins the computer industry. All players, even the "100 percent 
American-owned" vendors, have a major presence in China. Roger L. Kay, 
the president of Endpoint Technologies Associates, a consulting firm 
in Natick, Mass., said China had attracted so many companies based in 
the United States that the PC ecosystem there had reached a critical 
mass. Low-cost production is not the draw. "Now the reason you want to 
be in China," he said, "is because that's where everyone else is."

Wishing wistfully for a return to the past - in which I.B.M. was still 
in the PC business — is not likely to improve American competitiveness 
here and now. Mr. Enderle said that ignoring the discomfiting fact 
that technology companies based in the United States are losing 
leadership positions to their counterparts in east Asia — not just 
China, but also Taiwan and South Korea - does not make the problem go 
away. "It's still going to hit us," he said.

NEVERTHELESS, Mr. Dobbs and members of the U.S.-China Economic and 
Security Review Commission have tarred Lenovo with suspicion of 
espionage - and the State Department with being their willing dupe. 
Mr. Kay says the damage to Lenovo has been done, even if the State 
Department purchase proceeds. 

"The next time," Mr. Kay predicted, "the government bureaucrat will 
say: 'Do I want to go through this? No, I'll go with the company that 
is perceived as American.' " 

The smears will linger, he fears. "Facts don't matter," he said. 
"Perception matters." 

-=-

Randall Stross is a historian and author based in Silicon Valley. 
E-mail:ddomain @ nytimes.com