US Software Firm Accuses Huawei of Installing ‘Back Door’ to Spy on Pakistan

People arrive to attend the Huawei keynote address at a trade fair opening day in Berlin on Sept. 3, 2020. Sean Gallup/Getty Images

A U.S. software company is accusing Chinese tech giant Huawei of pressuring it to build a data “back door” into a government security project in Pakistan, according to a recent legal filing submitted at the Central District Court in California.

California-based Business Efficiency Solutions (BES), in a lawsuit filed on Aug. 11, also accused Huawei of stealing its trade secrets while the software company worked as Huawei’s contractor for a safe-city project in Lahore, the capital of Pakistan’s Punjab Province.

BES said in its lawsuit that Huawei used “one of BES’s software systems to establish a ‘backdoor’ from China into Pakistan that allowed Huawei to collect and view data important to Pakistan’s national security and other private, personal data on Pakistani citizens.”

The current legal dispute was born out of a partnership between the companies that started in 2016. That year, Huawei and Punjab Safe Cities Authority (PSCA), a provincial government body, entered an agreement for the Chinese company to implement a high-tech surveillance system, including more than 8,000 cameras, in Lahore, according to Pakistani media.

At that time, Shehbaz Sharif, former chief minister of Punjab, said that the safe-city project would turn Lahore into a crime-free city.

The system would be available to the Punjab Police Integrated Command, Control, and Communication Center (PPIC3) of Lahore.

Huawei has heavily promoted its surveillance technology worldwide, sometimes under its “Safe City” or “Smart City” solutions promising to make cities more secure. In 2019, U.S. Sens. Marco Rubio (R-Fla.) and Ron Wyden (D-Ore.) wrote a letter to then-Secretary of State Mike Pompeo, urging him to update U.S. travel advisories to warn Americans about traveling to countries with Huawei’s surveillance apparatus.

“These technologies could expose their personal data to foreign governments, including potentially China,” the senators wrote.

In Pakistan, at least nine cities have signed up for Huawei’s Safe City systems since 2015. However, some cities, including Islamabad, have reported increased crime rates after adopting the systems.

The agreement between PSCA and Huawei was signed after a bidding process. According to the complaint, Huawei topped competitors, including Nokia and Motorola, with a bid of $150 million.

The logo of Chinese telecom giant Huawei is pictured during the Web Summit in Lisbon on Nov. 6, 2019. Patricia De Melo Moreira/AFP via Getty Images

Additionally, BES stated in the filings that it was courted “aggressively” by Huawei to be the latter’s contractor because the Chinese firm “lacked the capacity to undertake such a technically advanced project on its own.”

BES said it created eight different software systems for the safe-city project, including a system to monitor buildings and another to monitor social media, the complaint said. Another system, formally called the data exchange system (DES), could collect data from different Pakistani government agencies, including customs, taxation, immigration, and registration.

In 2016, Huawei “threatened to terminate all agreements” with BES if the U.S. software company didn’t comply with its demand to have all eight systems tested in China.

“As of the filing of this complaint, Huawei-China has yet to return BES’s LLDs for the eight systems, or allow BES to uninstall any software, including the DES system, from Huawei’s facility in China,” the complaint said, referring to BES’s proprietary “low-level designs” (LLDs) for systems.

Low-level design is a general term used to describe the component-level design process, often involving designers and developers. By contrast, high-level design means the overall design architecture.

A year later, in 2017, Huawei allegedly demanded that BES install DES in Huawei’s laboratory in China—“this time not merely for testing purposes but with full access to data at the Lahore Safe City project.”

“We want to insure [sic] that PPIC3 has no objection in [the] transfer of this technology outside of PPIC3 for security reasons,” BES CEO and founder Javed Nawaz responded in an email, which is attached to the lawsuit, to Huawei officials. “Please get an approval from PPIC3, in writing, prior to us performing this function.”

According to the complaint, Huawei initially said there was no need to get such approval, while “threaten[ing] to withhold payments owed to BES.” Later, Huawei said it had received “approval from the Pakistani government,” BES alleged.

“In light of Huawei’s affirmative representations that they had the approval of the Pakistani government, the duplicate DES system was installed in China,” the complaint stated.

BES argued that PPIC3’s network could be compromised by Huawei.

“On information and belief, Huawei-China uses the proprietary DES system as a backdoor from China into Lahore to gain access, manipulate, and extract sensitive data important to Pakistan’s national security,” according to the complaint.

BES also alleged that Huawei “has used and will continue to use” the stolen trade secrets for other similar “Safe City” projects in at least seven other Pakistani cities, as well as those in other countries including Qatar, Dubai, the United Arab Emirates, and Saudi Arabia.

The U.S. software company is seeking damages and permanent injunctive relief against Huawei.

To bolster its claims, BES cited two U.S. court cases—both indictments against Huawei for trade secrets theft in 2019 and 2020—in its complaint.

Huawei, PSCA, BES, and BES’s attorneys didn’t immediately respond to requests for comment. According to The Wall Street Journal, BES currently isn’t operating or generating revenue.