Why is the former head of the NSA convinced Huawei is a threat to the US?

The National Security Agency has been all over the news for the last couple months, thanks to multiple disclosures from whistleblower Edward Snowden. But now former NSA director Michael Hayden has been making news himself by claiming Chinese technology company Huawei represents an unambiguous national security threat to the United States as well as many other nations. Hayden has the distinction of being the only person to have run both the NSA (from 1999 to 2005, the era of warrantless wiretapping) and the CIA (from 2006 to 2009), and those capped a four-decade stretch in U.S. intelligence. In a surprisingly detailed interview with the Australian Financial Review last week, he asserted there is hard evidence that Huawei has engaged in espionage on behalf of the Chinese government.

Um, who? Most Americans who’ve heard of Huawei (pronounced WAH-way) probably think of it as an off-brand maker of Android handsets. MetroPCS offers a handful, and new parent T-Mobile’s got one. They’re not exactly in everyone’s hands, and Huawei isn’t a household name like other foreign companies such as Samsung, Sony, or even (dare we say) Nokia or RIM. How can Huawei possibly be a threat to U.S. national security? Are those handsets secretly spying on MetroPCS and T-Mobile customers?

The United States’ concern about Huawei isn’t about handsets. It’s about Huawei being the largest (or second-largest, depending how one counts) supplier of back-end telecommunications equipment in the world. Huawei makes switches, relays, routers, antennas, transmitters, and optical networks that power modern phone, Internet, and mobile networks. The company has relationships with most major telecommunications operators worldwide, providing gear, services, and software to keep their communications infrastructure up and running. By its own estimates, Huawei helps power communications for more than a third of the planet.

So does that mean the company represents a security threat to more than a third of the planet?

According to the former head of the NSA, yes.

Just who is Huawei?

For a company with an estimated 150,000 employees, Huawei is a bit of a mystery. It was founded in 1988 by Ren Zhengfei, a former major in China’s People’s Liberation Army who found himself unemployed when the PLA jettisoned half a million people in 1982. Ren moved to Shenzhen (immediately north of Hong Kong) to put his engineering and military technologist expertise to work in the communications industry, but got frustrated in a state-run enterprise. So, he figured a way to start his own outfit – and the details of how he did that are still a mystery. Huawei initially sold phone systems from Hong Kong to mainland China, but by 1992 had developed the largest capacity switching system on the market. Instead of focusing on major cities, Huawei took telecommunications to China’s rural markets and by the late 1990s it was offering backend gear for mobile phone networks and landing overseas contracts. Just 25 years after its founding, the company has products in almost every segment of the telecom industry from fiber to 4G wireless to video conferencing, and last year made about $2.4 billion on roughly $34 billion in revenue.

But Huawei is incredibly opaque – at least by Western standards. Ren’s still there (now about 70 years old) and still has veto power, but rarely makes public statements. He attributes Huawei’s success to collective leadership. That leadership? Huawei won’t say. It doesn’t talk about its organization and only got around to listing its current board members in 2010 as part of a “transparency” effort. Right now, a different top executive takes the CEO reins every six months; before that, separate management tasks were rotated between eight executives. Huawei isn’t a public company: it’s officially an employee-owned collective, although the workings are as murky as Huawei’s structure. Industry watchers and regulators speculate the bulk of Huawei is actually held by Ren and his management team, and employees don’t seem to be able to profit from shares without permission. Under Chinese law, non-Chinese employees can’t own shares at all.

Outside of China, Ren’s military background and active membership in China’s Communist Party have sometimes been (pardon the pun) red flags. Combine that with Huawei’s clear-as-mud organization and the fact there’s a Party Committee within Huawei’s global HQ (mandatory under Chinese law), more eyebrows go up. Perhaps more significantly, for well over a decade Huawei has been identified in China as a “national champion,” one of a handful of private companies that receive direct support from the Chinese government. National champions aren’t state-owned businesses, but they typically get market protection, financial support — sometimes as direct funding, but more often tax breaks, subsidies, low-interest loans, and government contracts — and even diplomatic help. That means the Chinese government could have a significant influence on Huawei, since so many purse-strings lead back to Beijing. And the company has a reputation for playing fast-and-loose with intellectual property: in 2003 Cisco accused Huawei of copying its source code and documentation – all the way down to typos. That was eventually settled out of court with both sides declaring victory, but the bad blood lingers.

So, if you’re suspicious of the Chinese government, you’re probably suspicious of Huawei, too.

Huawei or the highway?

In theory, companies like Huawei represent two kinds of threats. The sexiest is that Huawei (and/or the Chinese government) is capable of installing or activating backdoors or security bypasses in Huawei gear that could permit surveillance or even control of communications – perhaps they’re buried in the hardware, or perhaps they can be distributed in a firmware update. Last year, the CBS News program 60 Minutes made some hay of this possibility, with speculation that building a network with Huawei equipment was tantamount to giving China the keys to all their communications.

The second possibility is that by supplying gear, services, and software to a variety of telcos, corporations, and even governments, Huawei can learn a tremendous amount about the designs and operations of those organizations and systems … and it might pass that information along to others, including the purse-string holders in Beijing. Bear in mind China is generally believed to engage in widespread state-sponsored cyber espionage, so it could put that info to work.

“At a minimum, Huawei would have shared with the Chinese state intimate and extensive knowledge of the foreign telecommunications systems it is involved with. I think that goes without saying,” said Hayden.

These concerns aren’t new. For years Huawei has been eager to get into the U.S. market, since companies like Verizon, AT&T, Sprint, and T-Mobile have all been rapidly upgrading their networks to support and expand 3G and 4G mobile services. Huawei would have loved to land some of those contracts.

But Huawei has struck out. Citing security concerns, U.S. regulators blocked Huawei from buying a minority stake in American networking company 3Com back in 2008; in 2010 federal officials urged Sprint to walk away from a deal to use Huawei gear on its network, and Sprint complied. In 2011 Huawei was forced to unwind a done deal to acquire some assets of American server company 3Leaf Systems after a federal committee raised unprecedented objections.

Huawei clearly has a reputation problem in the U.S., and Hayden noted that after leaving the NSA, Huawei approached him about a job, presumably hoping that a relationship with General Hayden The Civilian would help their credibility in the U.S. market.

“My conclusion was that, ‘No, it is simply not acceptable for Huawei to be creating the backbone of the domestic telecommunications network in the United States, period,'” said Hayden.

Hayden is now on the board of Motorola Solutions, the part of Motorola that wasn’t acquired by Google. Motorola Solutions makes telecommunications gear, and is both a partner and competitor with Huawei.

Who to believe?

It’s tough to evaluate claims when no one will put their cards on the table. Neither Hayden, the current U.S. intelligence regime, nor overseas intelligence agencies have ever offered up concrete proof that Huawei has engaged in espionage, or that there are secret backdoors in Huawei systems.

On the other hand, Huawei is almost inscrutable – to Western eyes, anyway – and the company has been less than forthcoming when asked how it operates, its financing, or about its relationship with the Chinese government and military. In 2011 Huawei volunteered to be grilled by the House Intelligence Committee to alleviate concerns about its gear and services being used in the United States. (The committee also looked at Chinese telecommunications company ZTE.) Almost a year later, the committee found no concrete evidence of wrongdoing, but its report concluded “Huawei, in particular, may be violating United States laws” and repeatedly slammed Huawei for not answering many direct questions. The committee even had internal documents from former employees claiming to show Huawei provided “special network services” to an elite cyber-warfare unit in the Chinese military – perhaps even the “Unit 61398” identified earlier this year by Mandiant.

Sounds damning, but a classified White House-ordered review of security risks posed by Huawei concluded there was no evidence Huawei was conducting espionage for China. However, that same report noted significant security vulnerabilities with some Huawei products – something that might give any potential customers pause.

Huawei has consistently denied all allegations that it’s involved in any sort of espionage or has any unusual connections with the Chinese government. Huawei’s current global head of cyber security, John Suffolk, has challenged critics to “put up or shut up” by showing their evidence publicly, and dismissed Hayden’s claims as “unsubstantiated defamatory remarks.” Suffolk’s name carries some clout: he was the chief information officer and chief information security officer for the United Kingdom from 2006 through 2011. At Huawei, he reports directly to company founder Ren Zhengfei. Suffolk has been offering his own theories on his personal blog about why the U.S. doesn’t want Huawei in its markets. Protecting American companies like Cisco, Juniper, and Motorola Solutions, and facilitating its own surveillance systems – like PRISM – are at the top of his list.

What’s going to happen?

For now, Huawei seems to be placing less importance on the U.S.: if being rebuffed on deals with 3Com, Sprint, and 3Leaf and being dressed down by a Congressional investigation weren’t enough, Sprint and Softbank had to promise U.S. lawmakers that Huawei gear wouldn’t be used on Sprint’s network once their merger is complete. It’s not like Huawei gear has never been in the U.S. – Clearwire, Cox, Comcast, Cricket and Level 3 are some of its customers – but it seems U.S. officials will never approve a major deal where Huawei plays a role. Heck, Deutsche Telekom had to agree to tell federal officials about all its equipment and inform the feds about any new suppliers to get T-Mobile’s acquisition of MetroPCS approved.

The U.S. isn’t entirely alone in being wary of Huawei. Although Huawei counts Canada’s Telus and Bell Canada as major customers, in late 2012 the Canadian government excluded Huawei from bidding on a secure government network on security grounds. Earlier that year Australia did the same thing. In 2010 Huawei set up a cybersecurity center in the UK to test its equipment: the UK government is now reviewing its operations after finding Huawei is essentially policing its own security (then again, UK Prime Minister David Cameron just endorsed TalkTalk – a company that uses Huawei technology – as part of his effort to implement mandatory porn filtering in that country).

But not everyone is wary. Two-thirds of Huawei’s business is outside China. Huawei is all over Europe, supplying Vodafone, France Telecom and Germany’s T-Mobile (which in turn each own half of Britain’s EE), and it landed a hefty deal with British Telecom to build out the UK’s 21st Century Network. Huawei also has major partnerships with telcos in Norway, Canada, India, Japan, Argentina, Chile, and Colombia, and has made major inroads getting its gear into Africa, Central America, and Asia. For many of these markets, Huawei represents first-world technology without the first-world price tag – and that’s very, very appealing.

So Huawei isn’t going away: it’s just not coming to American networks anytime soon.

[Huawei representatives declined to comment for this story.]

Top image courtesy of ollyy/Shutterstock