The Washington PostDemocracy Dies in Darkness

U.S. allies differ on difficulty of containing Huawei security threat

Huawei Technologies, based in Shenzhen city in China's Guangdong province, is the world's biggest supplier of 5G telecommunications equipment. (Kin Cheung/AP)

A U.S. campaign to dissuade other countries from using Huawei equipment in their next-generation 5G networks is facing a chilly reception among European allies after federal officials argued that the Chinese firm’s telecommunications gear poses a grave security risk, according to several people familiar with the matter.

In bilateral meetings with Trump administration officials last week, international partners took a “skeptical” stance on U.S. claims that Huawei’s components present such a threat to cybersecurity and national security that it cannot be managed, said several participants in the meetings.

European officials were receptive to the Americans’ arguments that Huawei, by virtue of its close relationship with the Chinese government, could enable Chinese espionage or disruption to a network, but they disagreed with U.S. officials on whether that risk could be contained, the participants said.

“They understand there’s a security concern,” said Robert Strayer, assistant secretary of state for cyber policy, who took part in the meetings. “The issue is how you solve it. Our position is there’s no way to effectively manage it. In a 5G network that relies on millions of lines of code, it only takes one line of code to compromise the network.”

The disconnect between the Americans and the Europeans reflects the sharp challenge confronting the United States as it seeks to take a leadership role on the build-out of 5G networks that will support self-driving cars, smart cities and other new technologies around the globe. Last month alone, in defiance of the U.S. warnings, carriers in at least six countries, including U.S. allies Iceland, Saudi Arabia and Turkey, entered 5G partnerships with Huawei, the company announced.

Compounding the challenge are public signals from President Trump that he may be willing to aid Huawei in its battles with the Justice Department if that would advance his effort to win more favorable terms in trade talks with China. Notably, Trump has refrained from sounding the Huawei alarm, unlike other senior officials, including Vice President Pence, who warned of the “threat posed by Huawei and other Chinese telecom companies” in Munich last month.

Justice Dept. charges Huawei with fraud, ratcheting up U.S.-China tensions

Officials from the departments of State, Commerce and Defense, and the Federal Communications Commission and Federal Trade Commission made their pitches against Huawei’s equipment at a mobile industry conference in Barcelona last week. Despite the skepticism, U.S. officials said they made progress.

American officials pushed hard on the message that the risk of using equipment from companies like Huawei that have close ties to their authoritarian governments isn’t just espionage or intellectual property theft but also the potential disruption of key communications or control networks at sensitive moments.

“With the transformational critical services that 5G will empower, we cannot risk having those services being disrupted or manipulated by authoritarian regimes,” Strayer said. “Those concerns are in addition to the diversion of sensitive personal and business data that authoritarian regimes have already shown they have an interest in acquiring by cyber means.”

In Barcelona, Strayer gave a speech in which he stressed that “Chinese law requires these firms to support and assist Beijing’s vast security apparatus, without any democratic checks and balances on access to, or use of, data that touches the networks or equipment installed and supported by these companies around the world.”

But in Brussels, E.U. policymakers have been wary of embracing a blanket ban on Huawei amid a growing sense in Europe that Trump’s “America First” policies may mean that what Washington calls security threats are actually trade threats.

Huawei founder denies sharing secrets with China

In Germany, Europe’s largest economy, the government has ruled out a ban on Huawei as legally impossible. But top officials still are debating whether to enact strict security rules for 5G licenses that would make it more difficult for the company to compete. The process of issuing the licenses begins later this month.

The debate pits intelligence officials and others who fear Huawei presents security risks against those who worry that excluding the company would be costly for the German economy. That debate has echoes in the United States.

And in Britain, which has used Huawei equipment in its current commercial networks for more than a decade, the government has sought to manage the security risk with a Huawei-run center overseen by a British intelligence agency, GCHQ. The center reviews Huawei source code for vulnerabilities. GCHQ’s National Cyber Security Center last year found “serious” engineering problems with Huawei equipment, but NCSC director Ciaran Martin said that “strict controls” for deployment, including barring Huawei gear from any government or sensitive network, have limited those issues.

“Our regime is arguably the toughest and most rigorous oversight regime in the world for Huawei,” he said in a speech last month.

The British are reviewing their approach to 5G security, with a report due later this spring. A key pillar, Martin said, is “diversity” in the supplier market. Analysts widely expect that the British, like the Germans, are unlikely to ban Huawei outright, but rather heighten standards to ensure greater security in the 5G network.

Meanwhile, in Barcelona, a Huawei executive, rotating Chairman Guo Ping, blasted the United States’ stance.

“The U.S. security accusation on our 5G has no evidence — nothing,” Guo said in a keynote speech. He suggested the Americans were hypocritical, saying that anyone concerned about government espionage “can go ask Edward Snowden” — a pointed reference to the former National Security Agency contractor who in 2013 revealed details of extensive NSA surveillance around the globe.

The tension is not just between U.S. security officials and their European counterparts. Trump last month told reporters at a White House trade meeting with a top Chinese official that he would speak to the attorney general, William P. Barr, about pending criminal charges against Huawei related to intellectual property theft and violating U.S. sanctions against Iran. He added that he “may or may not include” a resolution to the Huawei case in the talks.

And last month, Trump issued a pair of tweets calling for development of 6G networks and warning U.S. companies not to get “left behind.” He said: “I want the United States to win through competition, not by blocking out currently more advanced technologies.”

Trump’s “competition” remark gave the impression he viewed 5G through the lens of Chinese trade, said an industry official, which risked “confusing the issue” and undercutting the message pushed by U.S. officials in Barcelona. “That is only going to add to the skepticism of European officials this is not about security at all,” the official said.

The White House declined to comment.

The administration has had ready for nearly a year an executive order that would, if signed, have the eventual effect of banning Huawei from supplying components to the U.S. telecom system. Officials heading to Barcelona had hoped to have a signed order in hand to show that their push had backing from on high.

But the president has yet to issue the order. The White House declined to comment on the matter.

What was Trump expected to sign that would have barred Huawei equipment?

The first major public concerns about Huawei and another Chinese vendor, ZTE, surfaced in a 2012 congressional investigation after which two senior lawmakers, then-Rep. Mike Rogers (R-Mich.) and Rep. C.A. Dutch Ruppersberger (D-Md.) warned U.S. companies of “long-term security risks” associated with using those companies’ equipment.

Then, last year, Congress in the National Defense Authorization Act barred government agencies from purchasing equipment made by Huawei and ZTE. President Trump signed the prohibition into law. Late Wednesday, Huawei filed suit challenging the ban as unlawfully singling out a company for punishment without due process. The suit was filed in the Eastern District of Texas, home to Huawei’s U.S. headquarters in Plano.

Heeding government warnings and entreaties, all four major telecom carriers — AT&T, Verizon, Sprint and T-Mobile — have pledged over the years not to use Huawei components. As a result, Huawei’s presence in the American market is greatly diminished.

But smaller U.S. carriers have made use of Huawei gear, citing its dependability and lower costs. In December, the Rural Wireless Association, which represents carriers with fewer than 100,000 subscribers, urged the FCC not to restrict federal subsidies to carriers that use Huawei gear, unless the agency develops a plan to help cover the cost of replacing the equipment.

“RWA members have chosen Huawei and ZTE equipment, in large part, to keep equipment costs down and to be good stewards of [Universal Service Fund] support,” the trade association said in its filing.

In recent months, even as U.S. officials have stepped up their anti-Huawei lobbying, Huawei has found business partners among major European carriers. Replacing that equipment would add costs and delay the 5G rollout, according to GSMA, a trade group that counts European telecom companies among its members. The group said the firms already have relationships with national security agencies across Europe and believe that a “risk-based” regime is feasible.

Huawei has tried to bolster those beliefs, opening a cybersecurity center Tuesday in Brussels, the capital of the European Union, to offer for inspection and testing its source code, or what one company executive called “our crown jewels.”

But top Huawei officials also received mixed messages from senior E.U. policymakers.

“We have an open market. Everyone who complies with the rules can access it,” European Commission spokesman Margaritis Schinas told reporters after European Commission Vice President Andrus Ansip met with Huawei rotating CEO Ken Hu at Huawei’s request. “At the same time there are legitimate security concerns that need to be addressed.”

Griff Witte in Berlin and Michael Birnbaum in Brussels contributed to this report.