CANBERRA—In early 2018, in a complex of low-rise buildings in the Australian capital, a team of government hackers was engaging in a destructive digital war game.
The operatives—agents of the Australian Signals Directorate, the nation’s top-secret eavesdropping agency—had been given a challenge. With all the offensive cyber tools at their disposal, what harm could they inflict if they had access to equipment installed in the 5G network, the next-generation mobile communications technology, of a target nation?
What the team found, say current and former government officials, was sobering for Australian security and political leaders: The offensive potential of 5G was so great that if Australia were on the receiving end of such attacks, the country could be seriously exposed. The understanding of how 5G could be exploited for spying and to sabotage critical infrastructure changed everything for the Australians, according to people familiar with the deliberations.
Mike Burgess, the head of the signals directorate, recently explained why the security of fifth generation, or 5G, technology was so important: It will be integral to the communications at the heart of a country’s critical infrastructure—everything from electric power to water supplies to sewage, he said in a March speech at a Sydney research institute.
Washington is widely seen as having taken the initiative in the global campaign against Huawei Technologies Co Ltd, a tech juggernaut that in the three decades since its founding has become a pillar of Beijing’s bid to expand its global influence. Yet Reuters interviews with more than two dozen current and former Western officials show it was the Australians who led the way in pressing for action on 5G; that the United States was initially slow to act; and that Britain and other European countries are caught between security concerns and the competitive prices offered by Huawei.
The Australians had long harbored misgivings about Huawei in existing networks, but the 5G war game was a turning point. About six months after the simulation began, the Australian government effectively banned Huawei, the world’s largest maker of telecom networking gear, from any involvement in its 5G plans. An Australian government spokeswoman declined to comment on the war game.
After the Australians shared their findings with U.S. leaders, other countries, including the United States, moved to restrict Huawei.
Until the middle of last year, the U.S. government largely “wasn’t paying attention,” said retired U.S. Marine Corps General James Jones, who served as national security adviser to President Barack Obama. What spurred senior U.S. officials into action? A sudden dawning of what 5G will bring, according to Jones.
“This has been a very, very fast-moving realization” in terms of understanding the technology, he said. “I think most people were treating it as a kind of evolutionary step as opposed to a revolutionary step. And now that light has come on.”
A Threat to Critical Infrastructure
If Huawei gains a foothold in global 5G networks, Washington fears this will give Beijing an unprecedented opportunity to attack critical infrastructure and compromise intelligence sharing with key allies. Senior Western security officials say this could involve cyber attacks on public utilities, communication networks and key financial centers.In any military clash, such attacks would amount to a dramatic change in the nature of war, inflicting economic harm and disrupting civilian life far from the conflict without bullets, bombs or blockades.
However, blocking Huawei is a huge challenge for Washington and its closest allies, particularly the other members of the so-called Five Eyes intelligence-sharing group—Britain, Canada, Australia and New Zealand. From humble beginnings in the 1980s in the southern Chinese boom town of Shenzhen, Huawei has grown to become a technology giant that is deeply embedded in global communications networks and poised to dominate 5G infrastructure. There are few global alternatives to Huawei, which has financial muscle—the company reported revenue for 2018 jumped almost 20 percent to more than $100 billion—as well as competitive technology and the political backing of Beijing.
Huawei’s 74-year old founder, Ren Zhengfei, is a former officer in China’s military, the People’s Liberation Army.
For countries that exclude Huawei there is a risk of retaliation from Beijing. Since Australia banned the company from its 5G networks last year, it has experienced disruption to its coal exports to China, including customs delays on the Chinese side.
Tension over Huawei is also exposing divisions in the Five Eyes group, which has been a foundation of the post-Second World War Western security architecture. During a trip to London on May 8, U.S. Secretary of State Mike Pompeo issued a stark warning to Britain, which has not ruled out using Huawei in its 5G networks. “Insufficient security will impede the United States’ ability to share certain information within trusted networks,” he said. “This is exactly what China wants; they want to divide Western alliances through bits and bytes, not bullets and bombs.”
Washington argues that surreptitious backdoors aren’t necessarily needed to wreak havoc in 5G systems. The systems will rely heavily on software updates pushed out by equipment suppliers—and that access to the 5G network, says the United States, potentially could be used to deploy malicious code.
The Tech Threat
The West has long harbored concerns about Chinese telecom equipment. In 2012, a U.S. House Intelligence Committee report concluded Chinese tech companies posed a national security threat. Huawei denounced the finding.Despite such concerns, the U.S. government’s response to the threats posed by 5G only took shape more recently.
In February 2018, Malcolm Turnbull, then prime minister of Australia, flew to Washington D.C. Even before Australia’s eavesdropping agency had run its war game, Turnbull was already raising red flags in Washington. A former technology entrepreneur, he believed 5G presented significant risks and wanted to press allies to act against Huawei.
“He was warning about how important 5G networks would be and the security risks we all needed to think about around countries that had capability, form and intent, as well as coercive laws,” a senior Australian source told Reuters.
A spokesman for Turnbull declined to comment.
Turnbull and his advisers met U.S. officials, including Kirstjen Nielsen, then U.S. secretary of homeland security, and Michael Rogers, then head of the U.S. National Security Agency, the U.S. signals-intelligence operation. The Australians said they believed Beijing could compel Huawei to do its bidding and that this posed a threat should tensions with China rise in the future, said two of the Australian officials familiar with the meeting.
The U.S. officials were receptive to the Australian message, but imposing restrictions on the world’s largest maker of mobile network gear didn’t appear to be a high priority, according to the two Australian officials. “They didn’t share our concern with the same urgency,” said one.
Rogers declined to comment. A Department of Homeland Security official did not elaborate on the meeting, but said the agency works closely with Australia on security issues and that “China will continue to use cyber espionage and bolster cyber-attack capabilities to support its national security priorities.”
5G technology is expected to deliver a huge leap in the speed and capacity of communications. Downloading data may be up to 100 times faster than on current networks.
But 5G isn’t only about faster data. The upgrade will see an exponential spike in the number of connections between the billions of devices, from smart fridges to driverless cars, that are expected to run on the 5G network. “It’s not just that there will be more people with multiple devices, but it will be machines talking to machines, devices talking to devices—all enabled by 5G,” said Burgess, the Australian Signals Directorate chief, in his March address.
This configuration of 5G networks means there are many more points of entry for a hostile power or group to conduct cyber warfare against the critical infrastructure of a target nation or community. That threat is magnified if an adversary has supplied equipment in the network, U.S. officials say.
In July 2018, Britain delivered a blow to Huawei. A government-led panel that includes senior intelligence officials said it was no longer fully confident it could manage national security risks posed by the Chinese telecom equipment giant.
That panel oversees the work of a laboratory that was set up by the British government in 2010 and is funded by Huawei to vet the company’s equipment used in the UK. The facility was established because even then Huawei was perceived as a security risk. The oversight panel said serious problems it had identified with Huawei’s engineering processes “exposed new risks in the UK telecommunication networks and long-term challenges in mitigation and management.”
That report was a “bombshell,” shaping how the Americans viewed the Huawei 5G risk, said one U.S. official.
The West Awakes
Through the middle of last year, the Australians continued to apprise other countries of their worries about 5G. “We were sharing our concerns about security with many allies, not just the U.S. and not just the traditional partners,” said one of the senior Australian officials. “We shared our thoughts with Japan, Germany, other European countries and South Korea.”In Washington, the administration began imposing restrictions on Huawei. In August, Trump signed a bill banning federal agencies and their contractors from using equipment from Huawei and ZTE Corp, another Chinese telecom equipment maker. Huawei has since filed a lawsuit in federal court in Texas challenging the ban.
In late August, the Australians went further: They banned companies that didn’t meet their security requirements, which included Huawei, from supplying any equipment for the country’s 5G network, whether run by the government or by private firms.
In November, New Zealand’s intelligence agency blocked the country’s first request by a telecom service provider to use Huawei kit for a 5G network, citing national security concerns.
Like the Australians and Americans, British security officials had concerns over China’s potential use of Huawei as a channel for conducting espionage. But the options are limited. Huawei is one of only three major global companies that analysts say can supply a broad range of advanced mobile network equipment at scale. The other two are Ericsson and Nokia. And Huawei has a reputation among telecom operators for supplying cost-effective equipment promptly.
Nevertheless, British security officials were becoming increasingly frustrated with what they viewed as Huawei’s failure to fix software flaws in its equipment, particularly discrepancies in the source code—the programs’ underlying set of instructions. This problem means the laboratory near Oxford set up to vet Huawei equipment can not even be sure that the code it is testing is exactly the same as the code Huawei deploys in its real-world equipment. This makes it difficult to provide safety assurances about the company’s gear.
British officials say the array of flaws could be exploited by China, as well as other malevolent actors. Ian Levy, a British security official who oversees the UK’s review of Huawei equipment, told Reuters the company’s software engineering is like something from 20 years ago. “The chance of a vulnerability with a Huawei piece of kit is much higher than other vendors,” he said.
The company said it has pledged to spend at least $2 billion “over the next five years” to improve its software engineering capabilities.
British ministers have agreed to allow Huawei a restricted role in building parts of its 5G network, but the government has yet to announce its final decision. The European Union has left it to individual governments to decide whether to ban any company on national security grounds.
As the tensions between the West and Huawei intensified through last year, they suddenly took a personal turn. U.S. law enforcement officials had for some time been investigating links between Huawei and Iran, including the involvement of Meng Wanzhou, Huawei’s chief financial officer, who is the daughter of the company’s founder. The probe followed Reuters stories in 2012 and 2013 that revealed links between Huawei, Meng and another company that allegedly attempted to violate U.S. sanctions on Iran.
When U.S. officials became aware that Meng would be traveling through Vancouver in December, they pounced, asking Canada to detain her on allegations of bank and wire fraud. Meng remains free on bail in Canada while the U.S. government tries to have her extradited.
The Huawei conflict isn’t only about U.S.-China superpower rivalry: The activities of Meng and Huawei were under scrutiny by U.S. authorities long before Trump began a trade war with China, according to interviews with people familiar with those probes.
In recent months, the United States has ramped up diplomatic efforts to warn allies about Huawei. 5G is a “game-changing technology with implications across all aspects of society from business, government, military and beyond,” Gordon Sondland, U.S. ambassador to the European Union, told Reuters in February. “It seems common sense to me to not hand over the keys to your entire society to an actor that has … demonstrated malign conduct.”
Asked whether there is evidence of Huawei equipment having been used for espionage, Sondland said “there is classified evidence.” He declined to expand on the nature of the material beyond saying there was no doubt that Huawei had “the capability to hack a system” and “the mandate by the government to do so upon request.”
Pompeo has publicly gone further than most U.S. officials by directly linking the company to Beijing. “Huawei is owned by the state of China and has deep connections to their intelligence service,” he said in March. “That should send off flares for everybody who understands what the Chinese military and Chinese intelligence services do.”
