Lithuania Recommends Throwing Away Chinese Phones 'as Fast as Reasonably Possible'

UPDATE 9/27: Xiaomi has now responded in greater detail to the claims being made against its handsets in Lithuania's "Cybersecurity assessment of 5G-enabled mobile devices" report. A spokesperson for the company said:

"We take the allegations made in the report seriously. While we dispute the characterization of certain findings, we are engaging an independent third party expert to assess the points raised in the report. We are confident in the integrity of our devices and compliance practices of our business, and we believe a third party will verify this for our users and partners."

The spokesperson went on to tackle two "major concerns" raised within the report:

Alleged Censorship

"Xiaomi's devices do not restrict or filter communications to or from our users. Xiaomi has never and will never restrict or block any personal behaviors of our smartphone users, such as searching, calling, web browsing or the use of third-party communication software. The NCSC report does not allege that we do so.

The report points to Xiaomi's use of advertising management software that has the limited ability to manage paid and push advertising delivered to devices through Xiaomi apps such as Mi Video and Mi Browser. This can be used to shield users from offensive content, such as pornography, violence, hate speech, and references that may offend local users. This practice is common in the smartphone and internet industry worldwide [1].

We review our advertisement management system policies from time to time to ensure they meet the needs and expectations of our users.

Xiaomi is committed to operating responsibly and transparently across all jurisdictions. We are committed to constant improvement and innovation, and welcome engagement with users, regulators and other interested stakeholders."

Data Processing and Data Transfer

"The report also wrongly suggests inappropriate data stewardship. In fact, Xiaomi is fully compliant with all requirements of GDPR, including handling, processing and transfer of end-user data. Our compliance applies to all systems, apps and services. Any use of personal data is contingent on the valid consent of the end-user and is always in accordance with local or regional laws and regulations of the European Union and its Member States.

Xiaomi operates in accordance with ISO/IEC 27001 Information Security Management Standards and the ISO/IEC 27701 Privacy Information Management System. Xiaomi has also received Enterprise Privacy Certification from TrustArc on a yearly basis since 2016. This ensures the best possible privacy and security protections for the end-user.

Xiaomi would like to emphasize once again, that we are committed to the privacy and security of our users. We operate with the highest standards and comply with all local and regional regulations."

[1] Xiaomi cites both Facebook's "Article 13 Controversial Content of Facebook Ads policies," and Google's "Political Content Clause of Google Ads policies" in reference to its advertising common practises for shielding users from offensive content.

UPDATE 9/23: Xiaomi has now responded to the directive given by the Defense Ministry of Lithuania to throw away Chinese phones. A Xiaomi spokesperson said:

"Xiaomi's devices do not censor communications to or from its users. Xiaomi has never and will never restrict or block any personal behaviors of our smartphone users, such as searching, calling, web browsing or the use of third-party communication software. Xiaomi fully respects and protects the legal rights of all users. Xiaomi complies with the European Union’s General Data Protection Regulation (GDPR)."

Unfortunately, the company's response fails to answer the question as to why censorship software and controls exist on phones being sold in Lithuania in the first place. We have requested clarification on this point specifically and will update if we hear back.

Original Story 9/22:
The Defense Ministry of Lithuania is recommending that smartphones from Chinese brands be thrown away as quickly as possible following the discovery of built-in censorship on some handsets.

As Reuters reports, the recommendation was made by Defense Deputy Minister Margiris Abukevicius, who said, "Our recommendation is to not buy new Chinese phones, and to get rid of those already purchased as fast as reasonably possible." It follows the discovery of "censorship capabilities" on phones offered by Xiaomi.

Recommended by Our Editors

The Best Android Antivirus for 2024

Apple Publishes Human Rights Policy, But Don't Expect It to Fight China's Censorship

FCC Prepares to Ban and Remove Huawei Equipment From US Networks

In particular, the Xiaomi Mi 10T 5G contains software that detects and censors terms including "Free Tibet", "Long live Taiwan independence," and "democracy movement." The software is present, but disabled on phones sold in the European Union, but the Defense Ministry's National Cyber Security Centre believes the software can be enabled remotely at any time.

The censorship controls can be used by any of the default system apps included on Xiaomi phones, including the default browser. A report released by the National Cyber Security Centre says there are 449 terms in Chinese that will be censored, but that the list is regularly updated by the company. Huawei was also flagged for a security flaw discovered on its P40 5G phone, but the company has responded, stating user data is not shared with others. Notably, OnePlus did not feature in the report.

Xiaomi was added to a US blacklist back in January, but by May the company had been removed from the list. This discovery in Lithuania could push the Department of Defense to take another look at Xiaomi to see if the same disabled censorship controls are included on phones sold in the US. Huawei, of course, has already been banned from the US market.

PCMag iPhone 13 Special: Apple Event Analysis