A Chinese telecommunications company considered a threat to U.S. national security was linked to an elite Chinese military cyberwarfare group, according to a House committee report made public Monday.
Information, including email messages, supplied to the House Permanent Select Committee on Intelligence reveals that the People’s Liberation Army cyberwarfare unit had sought research and development assistance from Huawei Technologies, a huge Chinese telecommunications firm that has been under fire for several years over its links to the Chinese military and intelligence services, as well as its illicit trade and business practices.
The bipartisan House report, based on both classified and public information, concluded that the U.S. government and private sector face cyber espionage or data theft from software or hardware sold by Huawei or another government-linked telecommunications firm, Zhongxing Telecommunications, known as ZTE.
According to the report, internal Huawei documents provided to investigators by former employees revealed "Huawei provides special network services to an entity the employee believes to be an elite cyberwarfare unit within the PLA."
"These documents suggest once again that Huawei officials may not have been forthcoming when describing the company’s R&D or other activities on behalf of the PLA," the report said.
The House report said Huawei told the committee in response to information requests from investigators that it engaged in some research and development work for the PLA, but sought to play down the connection as minor.
Huawei said in a statement that the committee report failed to substantiate the accusations against the company. "The report released by the Committee today employs many rumors and speculations to prove non-existent accusations," it said.
ZTE also said in a statement that its equipment poses no threat to U.S. telecommunications infrastructure.
The Intelligence Committee report was the result of a several-months-long investigation by the panel that was prompted by both companies’ requests for an investigation of the security risk charges, in what they had hoped would clear them of allegations of wrong doing.
Instead, the report said, "The investigation concludes that the risks associated with Huawei’s and ZTE’s provision of equipment to U.S. critical infrastructure could undermine core U.S. national-security interests."
A classified annex bolsters the committee’s concerns about national security threats posed by the companies, the report said.
Additionally, the committee uncovered evidence of illegal activity by Huawei and forwarded the information to the administration for further investigation.
Larry Wortzel, a former military intelligence officer who specialized in Chinese affairs, said the House report makes a convincing case for keeping both companies away from critical U.S. infrastructure, defense firms, and government communications systems.
"The report shows that private corporations that choose to use equipment from these companies leave themselves open to technology theft and penetrations of their systems to extract financial and proprietary data," Wortzel said.
No other details were provided in the report on Huawei’s links to PLA cyberwarfare efforts, a growing concern of the U.S. military because of frequent hacking traced to China’s military.
However, the congressional U.S.-China Economic and Security Review Commission stated in a recent report that one elite PLA cyberwarfare unit was set up last year and is called the Guangzhou Military Region Online Blue Force. The unit is a special cyber force used to train troops.
The commission’s report said Huawei has worked closely with the Guangzhou military region to train military personnel at PLA universities and through direct training by Huawei personnel inside military units.
Huawei and other Chinese firms serve as "sources of advanced technology for the PLA," the commission report said.
China’s military also operates seven electronic and cyberwarfare units located in regional military commands called Technical Reconnaissance Bureaus (TRB).
One TRB in Chengdu was linked by U.S. intelligence agencies to the worldwide cyber attacks conducted by hackers known as GhostNet.
A classified State Department cable from 2009 made public by Wikileaks stated that several Internet domains involved in cyber attacks code-named Byzantine Hades (BH) were traced to networks in China and showed some connection to the PLA’s Chengdu Military Region First Technical Reconnaissance Bureau (TRB), also known as Military Unit Cover Designator 78006.
Regarding illicit activities, the intelligence report said investigators found that Huawei engaged in bribery and corruption, violated immigration laws for its Chinese employees, and was found to have been involved in copyright infringement and workplace discrimination.
The fraud and bribery allegations were related to efforts to seek contracts in the United States and were referred to the Justice Department, the report said.
Much of the report is focused on the failure of both companies’ officials to answer questions about their relations with the Chinese government and military.
For example, the report said Huawei founder and president Ren Zhengfei at one time was a director of a unit under the Chinese military’s signals intelligence service and "that his connections to the military continue."
Ren also took part in a major Communist Party Conference in 1982 as an official representative and shortly after founded Huawei.
The report said a Huawei official denied that Huawei Chairwoman Sun Yaffang formerly worked for China’s Ministry of State Security, the political police and intelligence service, as was initially revealed on Huawei’s web site. The information was later removed.
Western consulting firms have also helped Huawei, the report said. They include IBM, Accenture, and Price Waterhouse Cooper.
The report warned that potentially subversive Chinese telecommunications equipment already has been purchased by U.S. companies, including Cricket Communications, Clearwire, Cox TMI Wireless, Hibernia Atlantic, Level 3/BTW Equipment, Suddenlink, Comcast, and Bend Broadband.
The report also stated that Huawei has used patented material from other firms. "Huawei has purposely used and marketed patented products of other companies," it said.
For example, Huawei illegally copied network gear made by the U.S. company Cisco Systems and agreed to remove illegally copied products from the market as part of a settlement with the U.S. equipment maker.
The report warned that Chinese spying against the U.S. government is increasing in both intensity and sophistication, including what it called an "ongoing onslaught" of computer attacks originating from China.
The attacks and data theft also provide opportunities for China’s cyber warriors to "insert malicious hardware or software implants into Chinese-manufactured telecommunications components and systems marketed to the United States," the report said.
"Opportunities to tamper with telecommunications components and systems are present throughout product development, and vertically integrated industry giants like Huawei and ZTE provide a wealth of opportunities for Chinese intelligence agencies to insert malicious hardware or software implants into critical telecommunications components and systems," the report said.
China’s communist government controls the companies through a political unit and "may seek cooperation from the leadership of a company like Huawei or ZTE for these reasons," the report said.
Chinese access to U.S. telecommunications infrastructure through equipment or software "also allows China to engage in undetected espionage against the United States government and private sector interests."
"China’s military and intelligence services, recognizing the technological superiority of the U.S. military, are actively searching for asymmetrical advantages that could be exploited in any future conflict with the United States," the report said.
"Inserting malicious hardware or software implants into Chinese-manufactured telecommunications components and systems headed for U.S. customers could allow Beijing to shut down or degrade critical national security systems in a time of crisis or war. Malicious implants in the components of critical infrastructure, such as power grids or financial networks, would also be a tremendous weapon in China’s arsenal."
Richard Fisher of the International Assessment and Strategy Center said the most critical contribution of the House report is "to make clear that Chinese companies like Huawei and ZTE are but a second order of concern."
"They pose a security threat to the United States because the Chinese Communist Party (CCP) makes them active weapons in service to the intelligence and military goals of the Party," Fisher said in an email.
The 60-page study, "Investigative Report on the U.S. National Security Issues Posed by Chinese Telecommunications Companies Huawei and ZTE, was produced by Committee Chairman Rep. Mike Rogers," (R., Mich.) and Rep. C.A. Dutch Ruppersberger (D., Md.) the panel’s ranking member.