UPDATED: Aussie defence agencies ban Lenovo due to backdoor fears

Computers from Chinese company Lenovo have been banned from “classified” networks of the intelligence and defence services of Australia, the United States, Britain, Canada and New Zealand due to concerns that the machines could easily be hacked.

A report from the Australian Financial Review said that intelligence and defence sources in Australia and Britain have confirmed a written ban on computers made by Lenovo from being used in classified networks.

Lenovo said it wasn’t aware of the ban.

According to the AFR, the ban was introduced in the mid-2000s after testing of Lenovo equipment found “back-door” hardware and “firmware” vulnerabilities in the company’s chips.

Sources within the British and Australian defence and intelligence communities said that malicious modifications to Lenovo’s circuitry were found that could allow someone to remotely access the devices without the user’s knowledge, the AFR reported.

Lenovo has links to the State Council of China: the PC manufacturer is part owned by Legend Holdings Limited, which is in turn part owned by the Chinese Academy of Sciences - a State Council institution.

Despite this ban on classified networks, Lenovo is a supplier of computers for “unclassified” government networks in Australia and New Zealand’s defence departments, the AFR said.

“The fact that Lenovo kit is barred from classified networks is significant, and something the private sector should look at closely,” said James Turner, an analyst at IBRS.

Lenovo told The Register that: “Our products have been found time and time again to be reliable and secure by our enterprise and public sector customers and we always welcome their engagement to ensure we are meeting their security needs. … We are very open, transparent and accountable to our public shareholders and a wide range of other stakeholders globally and have always met and exceeded government regulations in the 100+ countries in which we do business.

“We’re surprised by this development as Lenovo continues to have a strong relationship with all Australian government departments. Customer data privacy is a top priority for Lenovo across all customer groups,” the company said.

UPDATE: The Department of Defence released this statement on 30 July in response to the AFR story:

On Thursday, 25 July 2013 The Australian Financial Review asked Defence:

“We wanted to confirm that Lenovo computer products are not permitted to be used on the Defence Secret Network and the Defence Top Secret Network.”

Defence provided the following response:

“Defence has an accreditation process for all equipment used on Defence networks. There has never been a request to Defence to accredit Lenovo computer products for the Top Secret and Secret Networks.”

Following this media enquiry, reports published on 27 and 29 July 2013 in The Australian Financial Review allege a Department of Defence ban on the use of Lenovo computer equipment on the Defence Secret and Top Secret Networks.‬‪

This reporting is factually incorrect. There is no Department of Defence ban on the Lenovo Company or their computer products; either for classified or unclassified systems.