The report notes that possible tampering could occur in hardware such as routers and switches from China. And it states, "Deliberate modifications of semiconductors upstream of final product assembly and delivery could have subtle or catastrophic effects. An adversary with the capability to gain covert access and monitoring of sensitive systems could degrade a system's mission effectiveness, insert false information or instructions to cause premature failure or complete remote control or destruction of the targeted system."
Collaboration between U.S. and Chinese information security firms, according to the report, "has raised concerns over the potential for illicit access to sensitive network vulnerability data at a time when the volume of reporting about Chinese computer network exploitation activities directed against U.S. commercial and government entities remains steady."
The report takes a dim view of partnerships between "U.S. or other Western information security firms and Chinese IT and high-tech firms," saying there are risks "primarily related to the loss of intellectual property and erosion of long-term competitiveness, the same threats faced by many U.S. companies in other sectors entering partnerships in China."
The report singles out the joint venture between Huawei Shenzhen Technology Company Ltd. and Symantec, under which for almost four years Symantec shared its security and storage technologies with Huawei to include in its telecom equipment. Symantec CEO Enrique Salem announced the joint venture had ended in November 2011, saying the two companies had decided it would be best to consolidate the venture under one owner. Huawei, which bought out Symantec for $530 million, still licenses Symantec's technologies.
"Partnering with an American or other Western anti-virus vendor does not necessarily allow the Chinese partner to obtain signature data earlier than legitimate participation in industry consortia such as the Microsoft Virus Information Alliance, but it may provide the Chinese partner with deeper access to U.S. markets over the long term," the report said.
Huawei is the large China-based telecom equipment and service provider which has been seeking to expand business in the U.S. the past few years even as the atmosphere has grown more tense as several U.S. companies, including Google, have spoken of cyber-espionage carried out by what appeared to be attacks out of China.