By Cassell Bryan-Low, Colin Packham, David Lague, Steve Stecklow and Jack Stubbs
CANBERRA (Reuters) – In early 2018, in a complex of low-rise buildings in the Australian capital, a team of government hackers was engaging in a destructive digital war game.
The operatives; agents of the Australian Signals Directorate, the nation’s top-secret eavesdropping agency. had been given a challenge. With all the offensive cyber tools at their disposal, what harm could they inflict if they had access to equipment installed in the 5G network, the next-generation mobile communications technology, of a target nation?
What the team found, say current and former government officials was sobering for Australian security and political leaders: The offensive potential of 5G was so great that if Australia were on the receiving end of such attacks, the country could be seriously exposed. The understanding of how 5G could be exploited for spying and to sabotage critical infrastructure changed everything for the Australians, according to people familiar with the deliberations.
Mike Burgess, the head of the signals directorate, recently explained why the security of fifth generation, or 5G, technology was so important: It will be integral to the communications at the heart of a country’s critical infrastructure – everything from electric power to water supplies to sewage, he said in a March speech at a Sydney research institute.
Washington is widely seen as having taken the initiative in the global campaign against Huawei Technologies Co Ltd, a tech juggernaut that in the three decades since its founding has become a pillar of Beijing’s bid to expand its global influence. Yet Reuters interviews with more than two dozen current and former Western officials show it was the Australians who led the way in pressing for action on 5G; that the United States was initially slow to act; and that Britain and other European countries are caught between security concerns and the competitive prices offered by Huawei.
The Australians had long harbored misgivings about Huawei in existing networks, but the 5G war game was a turning point. About six months after the simulation began, the Australian government effectively banned Huawei, the world’s largest maker of telecom networking gear, from any involvement in its 5G plans. An Australian government spokeswoman declined to comment on the war game.
After the Australians shared their findings with U.S. leaders, other countries, including the United States, moved to restrict Huawei.
The anti-Huawei campaign intensified last week, when President Donald Trump signed an executive order that effectively banned the use of Huawei equipment in U.S. telecom networks on national security grounds and the Commerce Department put limits on the firm’s purchasing of U.S. technology. Google’s parent, Alphabet, suspended some of its business with Huawei, Reuters reported.
Until the middle of last year, the U.S. government largely “wasn’t paying attention,” said retired U.S. Marine Corps General James Jones, who served as national security adviser to President Barack Obama. What spurred senior U.S. officials into action? A sudden dawning of what 5G will bring, according to Jones.
“This has been a very, very fast-moving realization” in terms of understanding the technology, he said. “I think most people were treating it as a kind of evolutionary step as opposed to a revolutionary step. And now that light has come on.”
The Americans are now campaigning aggressively to contain Huawei as part of a much broader effort to check Beijing’s growing military might under President Xi Jinping. Strengthening cyber operations is a key element in the sweeping military overhaul that Xi launched soon after taking power in 2012, according to official U.S. and Chinese military documents. The United States has accused China of widespread, state-sponsored hacking for strategic and commercial gain.
A THREAT TO CRITICAL INFRASTRUCTURE
If Huawei gains a foothold in global 5G networks, Washington fears this will give Beijing an unprecedented opportunity to attack critical infrastructure and compromise intelligence sharing with key allies. Senior Western security officials say this could involve cyber attacks on public utilities, communication networks and key financial centers.
In any military clash, such attacks would amount to a dramatic change in the nature of war, inflicting economic harm and disrupting civilian life far from the conflict without bullets, bombs or blockades. To be sure, China would also be vulnerable to attacks from the U.S. and its allies. Beijing complained in a 2015 defense document, “China’s Military Strategy,” that it has already been a victim of cyber-espionage, without identifying suspects. Documents from the National Security Agency leaked by American whistleblower Edward Snowden showed that the United States hacked into Huawei’s systems, according to media reports. Reuters couldn’t independently verify that such intrusions took place.
However, blocking Huawei is a huge challenge for Washington and its closest allies, particularly the other members of the so-called Five Eyes intelligence-sharing group; Britain, Canada, Australia and New Zealand. From humble beginnings in the 1980s in the southern Chinese boomtown of Shenzhen, Huawei has grown to become a technology giant that is deeply embedded in global communications networks and poised to dominate 5G infrastructure. There are few global alternatives to Huawei, which has financial muscle – the company reported revenue for 2018 jumped almost 20 percent to more than $100 billion – as well as competitive technology and the political backing of Beijing.
“Restricting Huawei from doing business in the U.S. will not make the U.S. more secure or stronger,” the company said in a statement in response to questions from Reuters. Such moves, it said, would only limit “customers in the U.S. to inferior and more expensive alternatives.”
For countries that exclude Huawei there is a risk of retaliation from Beijing. Since Australia banned the company from its 5G networks last year, it has experienced disruption to its coal exports to China, including customs delays on the Chinese side. In a statement, China’s foreign ministry said it treated “all foreign coal equally” and that to assert “China has banned the import of Australian coal does not accord with the facts.”
Tension over Huawei is also exposing divisions in the Five Eyes group, which has been a foundation of the post-Second World War Western security architecture. During a trip to London on May 8, U.S. Secretary of State Mike Pompeo issued a stark warning to Britain, which has not ruled out using Huawei in its 5G networks. “Insufficient security will impede the United States’ ability to share certain information within trusted networks,” he said. “This is exactly what China wants; they want to divide Western alliances through bits and bytes, not bullets and bombs.”
Huawei’s 74-year old founder, Ren Zhengfei, is a former officer in China’s military, the People’s Liberation Army. “Mr. Ren has always maintained the integrity and independence of Huawei,” the company said. “We have never been asked to cooperate with spying and we would refuse to do so under any circumstance.”
In an interview with Reuters at the company’s headquarters in Shenzhen, Eric Xu, a deputy chairman, said Huawei had not allowed any government to install so-called backdoors in its equipment – illicit access that could enable espionage or sabotage – and would never do so. He said 5G was more secure than earlier systems.
“China has not and will not demand companies or individuals use methods that run counter to local laws or via installing ‘backdoors’ to collect or provide the Chinese government with data, information or intelligence from home or abroad,” the Chinese foreign ministry said in a statement in response to questions from Reuters.
Washington argues that surreptitious backdoors aren’t necessarily needed to wreak havoc in 5G systems. The systems will rely heavily on software updates pushed out by equipment suppliers – and that access to the 5G network, says the United States, potentially could be used to deploy malicious code.
So far, America hasn’t publicly produced hard evidence that Huawei equipment has been used for spying.
Asked whether the United States was slow to react to potential threats posed by 5G, Robert Strayer, the State Department’s lead cyber policy diplomat, told Reuters that America had long been concerned about Chinese telecom companies, but that over the past year, as 5G loomed closer, “we were starting to talk more and more with our allies.” Banning Huawei from 5G networks remains “an end goal,” he said.
THE TECH THREAT
The West has long harbored concerns about Chinese telecom equipment. In 2012, a U.S. House Intelligence Committee report concluded Chinese tech companies posed a national security threat. Huawei denounced the finding.
Despite such concerns, the U.S. government’s response to the threats posed by 5G only took shape more recently.
In February 2018, Malcolm Turnbull, then prime minister of Australia, flew to Washington D.C. Even before Australia’s eavesdropping agency had run its war game, Turnbull was already raising red flags in Washington. A former technology entrepreneur, he believed 5G presented significant risks and wanted to press allies to act against Huawei.
“He was warning about how important 5G networks would be and the security risks we all needed to think about around countries that had capability, form and intent, as well as coercive laws,” a senior Australian source told Reuters.
A spokesman for Turnbull declined to comment.
Turnbull and his advisers met U.S. officials, including Kirstjen Nielsen, then U.S. secretary of homeland security, and Michael Rogers, then head of the U.S. National Security Agency, the U.S. signals-intelligence operation. The Australians said they believed Beijing could compel Huawei to do its bidding and that this posed a threat should tensions with China rise in the future, said two of the Australian officials familiar with the meeting.
The U.S. officials were receptive to the Australian message, but imposing restrictions on the world’s largest maker of mobile network gear didn’t appear to be a high priority, according to the two Australian officials. “They didn’t share our concern with the same urgency,” said one.
Rogers declined to comment. A Department of Homeland Security official did not elaborate on the meeting, but said the agency works closely with Australia on security issues and that “China will continue to use cyber espionage and bolster cyber-attack capabilities to support its national security priorities.”
5G technology is expected to deliver a huge leap in the speed and capacity of communications. Downloading data may be up to 100 times faster than on current networks.
But 5G isn’t only about faster data. The upgrade will see an exponential spike in the number of connections between the billions of devices, from smart fridges to driverless cars, that are expected to run on the 5G network. “It’s not just that there will be more people with multiple devices, but it will be machines talking to machines, devices talking to devices – all enabled by 5G,” said Burgess, the Australian Signals Directorate chief, in his March address.
This configuration of 5G networks means there are many more points of entry for a hostile power or group to conduct cyber warfare against the critical infrastructure of a target nation or community. That threat is magnified if an adversary has supplied equipment in the network, U.S. officials say.
Huawei said in its statement that the company does “not control in any way the networks in which our equipment is deployed by our clients. The US and Australian allegations are fanciful and are not rooted in any evidence at all.”
In July 2018, Britain delivered a blow to Huawei. A government-led panel that includes senior intelligence officials said it was no longer fully confident it could manage national security risks posed by the Chinese telecom equipment giant.
That panel oversees the work of a laboratory that was set up by the British government in 2010 and is funded by Huawei to vet the company’s equipment used in the UK. The facility was established because even then Huawei was perceived as a security risk. The oversight panel said serious problems it had identified with Huawei’s engineering processes “exposed new risks in the UK telecommunication networks and long-term challenges in mitigation and management.”
That report was a “bombshell,” shaping how the Americans viewed the Huawei 5G risk, said one U.S. official.
U.S. officials also point to Chinese laws enacted in recent years that they say could compel individuals and companies to assist the Chinese government in conducting espionage.
China’s foreign ministry called this portrayal by U.S. officials of Chinese legislation “a misreading and a wanton smearing of relevant Chinese laws,” adding: “Trying to smear others to wash oneself clean is futile.”
THE WEST AWAKES
Through the middle of last year, the Australians continued to apprise other countries of their worries about 5G. “We were sharing our concerns about security with many allies, not just the U.S. and not just the traditional partners,” said one of the senior Australian officials. “We shared our thoughts with Japan, Germany, other European countries and South Korea.”
In Washington, the administration began imposing restrictions on Huawei. In August, Trump signed a bill banning federal agencies and their contractors from using equipment from Huawei and ZTE Corp, another Chinese telecom equipment maker. Huawei has since filed a lawsuit in federal court in Texas challenging the ban.
In late August, the Australians went further: They banned companies that didn’t meet their security requirements, which included Huawei, from supplying any equipment for the country’s 5G network, whether run by the government or by private firms.
Australia’s decision, China’s Foreign Ministry said in a statement, “has no basis in fact, and is an abuse of ‘national security’ standards. China urges the Australian side to abandon Cold War thinking and ideological prejudices, and provide a fair, transparent, non-discriminatory environment for Chinese companies.”
In November, New Zealand’s intelligence agency blocked the country’s first request by a telecom service provider to use Huawei kit for a 5G network, citing national security concerns.
Like the Australians and Americans, British security officials had concerns over China’s potential use of Huawei as a channel for conducting espionage. But the options are limited. Huawei is one of only three major global companies that analysts say can supply a broad range of advanced mobile network equipment at scale. The other two are Ericsson and Nokia. And Huawei has a reputation among telecom operators for supplying cost-effective equipment promptly.
Nevertheless, British security officials were becoming increasingly frustrated with what they viewed as Huawei’s failure to fix software flaws in its equipment, particularly discrepancies in the source code; the programs’ underlying set of instructions. This problem means the laboratory near Oxford set up to vet Huawei equipment cannot even be sure that the code it is testing is exactly the same as the code Huawei deploys in its real-world equipment. This makes it difficult to provide safety assurances about the company’s gear.
British officials say the array of flaws could be exploited by China, as well as other malevolent actors. Ian Levy, a British security official who oversees the UK’s review of Huawei equipment, told Reuters the company’s software engineering is like something from 20 years ago. “The chance of a vulnerability with a Huawei piece of kit is much higher than other vendors,” he said.
The company said it has pledged to spend at least $2 billion “over the next five years” to improve its software engineering capabilities.
British ministers have agreed to allow Huawei a restricted role in building parts of its 5G network, but the government has yet to announce its final decision. The European Union has left it to individual governments to decide whether to ban any company on national security grounds. Some European security officials say banning one supplier doesn’t address the broader issue of the risks posed by Chinese technology in general.
HUAWEI FIGHTS BACK
As the tensions between the West and Huawei intensified through last year, they suddenly took a personal turn. U.S. law enforcement officials had for some time been investigating links between Huawei and Iran, including the involvement of Meng Wanzhou, Huawei’s chief financial officer, who is the daughter of the company’s founder. The probe followed Reuters stories in 2012 and 2013 that revealed links between Huawei, Meng and another company that allegedly attempted to violate U.S. sanctions on Iran.
When U.S. officials became aware that Meng would be traveling through Vancouver in December, they pounced, asking Canada to detain her on allegations of bank and wire fraud. Meng remains free on bail in Canada while the U.S. government tries to have her extradited. Huawei said in its statement that Meng “is not guilty of the charges she faces,” and that they are “politically motivated.”
The Huawei conflict isn’t only about U.S.-China superpower rivalry: The activities of Meng and Huawei were under scrutiny by U.S. authorities long before Trump began a trade war with China, according to interviews with people familiar with those probes. But there is no doubt the wider showdown with Huawei has now become intensely geopolitical.
In recent months, the U.S. has ramped up diplomatic efforts to urge allies to sideline Huawei. 5G is a “game-changing technology with implications across all aspects of society from business, government, military and beyond,” Gordon Sondland, U.S. ambassador to the European Union, told Reuters in February. “It seems common sense to me to not hand over the keys to your entire society to an actor that has … demonstrated malign conduct.”
Asked whether there is evidence of Huawei equipment having been used for espionage, Sondland said “there is classified evidence.” He declined to expand on the nature of the material beyond saying there was no doubt that Huawei had “the capability to hack a system” and “the mandate by the government to do so upon request.”
Pompeo has publicly gone further than most U.S. officials by directly linking the company to Beijing. “Huawei is owned by the state of China and has deep connections to their intelligence service,” he said in March. “That should send off flares for everybody who understands what the Chinese military and Chinese intelligence services do.”
Huawei has repeatedly denied it is controlled by the government, military or Chinese intelligence services. “U.S. Secretary of State Pompeo is wrong,” the company said in its statement, adding that it is owned by its employees.
While Huawei was initially muted in its public response, it too has become more combative. In late February, the company confronted the United States at a major annual gathering of mobile industry executives in Barcelona, where Huawei’s red logo was ubiquitous. Top American officials arrived intent on warning government and industry representatives off Huawei. But the company had flown in a team of senior executives to offer customers and representatives of European governments reassurance in the face of the U.S. accusations.
In a keynote speech, Guo Ping, a deputy chairman at Huawei, took aim at America’s own spying operations. “Prism, Prism on the wall. Who’s the most trustworthy of them all?” he said. Guo was referring to a mass U.S. foreign-surveillance operation called Prism that was disclosed by former NSA contractor Snowden. The barb drew laughter from the audience.
Europeans pushed back, too. During one closed-door session, senior representatives from European telecom operators pressed a U.S. official for hard evidence that Huawei presented a security risk. One executive demanded to see a smoking gun, recalled the U.S. official.
The American official fired back: “If the gun is smoking, you’ve already been shot. I don’t know why you’re lining up in front of a loaded weapon.”
(Reporting by Cassell Bryan-Low, Colin Packham, David Lague, Steve Stecklow and Jack Stubbs. Additional reporting by Charlotte Greenfield in Wellington; Yoshifumi Takemoto in Tokyo; Jonathan Weber; Sijia Jiang; Ben Blanchard and Gao Liangping in Beijing. Edited by Peter Hirschberg and Richard Woods.)
