Could the PinePhone possibly have spyware? That was the concern raised by some Reddit users.
Those worries mostly come from the Android phone world. The joke writes itself: with modern phones you mostly get to choose whether a Chinese company or an American company watches you, while a huge chunk of the hardware is still made or assembled in China. As of 2022, Pine64 was registered in Hong Kong, which raised some eyebrows.
What people were suspicious about#
Pine Store Limited’s predecessor, “Pine Microsystems Inc”, was dissolved in California in 2020 and then registered in Hong Kong. The later “Pine Store Limited” says it is governed by Hong Kong and Malaysian law.
The Quectel modem used in the PinePhone runs closed firmware, so the vendor could theoretically sneak things in.
The third one is my own question: why does nobody in China seem to buy the PinePhone? At least get one for an unboxing, right?
Some evidence against that#
- According to Crunchbase, Pine Microsystems Inc. was founded in California in 2015 by Johnson Jeng and TL Lim, with TL Lim serving as CEO. It currently lists 5 employees.
It looks like “Pine Store Limited” was registered in Hong Kong on December 5, 2019 to avoid the “Legal Mafia”, followed by the dissolution of Pine Microsystems Inc. in California in January 2020. Products ship from warehouses in Hong Kong and Shenzhen, China. Judging from the PinePhone purchase page, they also have a warehouse in Poland for European customers.
Under the post “Pine Microsystems Inc in California is dissolved?”, TL Lim commented, and Reddit user fireTwoOneNine, a moderator of r/PINE64official, also confirmed with TL Lim that Pine Store Limited is a subsidiary of Pine64. In other words, this was a structural adjustment.
Besides the PinePhone, Pine64 also sells single-board computers, low-cost tablets, and laptops. The early A64 single-board computer was even sold through crowdfunding.
So why are their products so cheap? For example, compare the Purism Librem 5 with the PinePhone. Pine64 does not handle software development. Instead, devices ship with Linux systems developed by the community, and users may need to tweak things themselves or even reinstall the OS. So it is reasonable to assume they will not accept returns or exchanges unless the hardware itself has a problem. According to the wiki, their revenue goes toward creating new products. In practice, this company runs more like a nonprofit than a normal consumer gadget outfit.
- Because of that, whether the Quectel modem firmware contains spyware is really a vendor-side problem.
If you cannot trust it because it is closed source, do not forget that the PinePhone has hardware kill switches that can physically disconnect the 4G module.
Also, the Allwinner A64 chip is not only used in the PinePhone. Other Pine64-designed products use it too. If someone wanted to find a vulnerability, they probably would have found one already. For example, another Allwinner chip was found in 2016 to have a root-privilege backdoor, and that blew up fast. The PinePhone schematics are even published on the WIKI for anyone to inspect.
The OSes developed by the Linux community for the PinePhone may have vulnerabilities, but unless users randomly copy and paste commands into the void, they should not contain spyware by default.
- The PinePhone is cheap and ships from China, yet people in China cannot buy it directly. That is weird.
Is it really just too niche? Chinese tech sites have reported PinePhone news for years. One Zhihu user placed an order, but said, “as soon as they saw it was an order from within China, they canceled it.” That may also be because the phone lacks a “Network Access License” from China’s Ministry of Industry and Information Technology, roughly similar to NCC approval.
On Taobao, there are only some odd proxy-buying listings, and the prices are absurd.
Someone on the Pine64 forum asked, “Can I buy and use a PinePhone in China? Will it work out of China?” There was no real follow-up, only a note that the Pinebook and Pinetab are treated as export products.
From this, it is reasonable to infer that the PinePhone may be unavailable in China because of regulations. As of 2022, the Chinese-language unboxings of the PinePhone and Librem 5 that I could find online also seemed to be from people not living in China.
