Huawei: Critically assessing the 5G ban and commonly cited risks

^{Marko Aliaksandr / Shutterstock}

Colin Hawes, Associate Professor, University of Technology Sydney (UTS) Law Faculty; Research Associate, Australia-China Relations Institute, UTS

Download

Key takeaways

• Reports that Huawei is controlled by the government of the People’s Republic of China (PRC) are inaccurate. Huawei is a private, employee-owned corporation controlled by its senior management with input from an employee representative committee.
• The Communist Party of China (CPC) branch committees in private PRC corporations, including Huawei, have largely been co-opted by corporations to serve their own commercial interests.
• Contrary to many reports, the number of private PRC firms with CPC committees actually declined between 2017 and 2019 by some 400,000 (or 21 percent).
• There is no convincing evidence that Huawei is a military-backed corporation or has any deep ties with the PRC military, and claims that Huawei has been involved in espionage activities are vague and poorly substantiated.
• Banning Huawei’s equipment from 5G networks may be prudent, but it distracts from the real issue.
• Governments of the Five Eyes intelligence sharing network – Australia, Canada, New Zealand, the UK and the US – have intentionally prevented full encryption of network data, claiming that it would impede law enforcement and their own intelligence collection efforts, but this opens up networks to exploitation by hostile governments and criminal elements.

Introduction

In the recent political stoush in Australia over which party was ‘tougher’ on the People’s Republic of China (PRC), the name of information and communications technology company Huawei inevitably came up. The decision in 2018 to exclude Huawei from the 5G rollout was ‘one of the best decisions our government has made,’ opined Liberal Senator James Paterson in an interview in February. Former foreign minister Marise Payne would doubtless agree, having previously defended the Huawei ban as ‘aimed at solely protecting Australia’s national interests, and the protection of Australia’s national security.’ Mike Burgess, the Director-General of the Australian Signals Directorate (ASD), further clarified the reasons: ‘The distinction between core and edge collapses in 5G networks. … A potential threat anywhere in the network will be a threat to the whole network. … My advice was to exclude high-risk vendors from the entirety of evolving 5G networks.’ It is unlikely that the current Labor Government will alter this approach to 5G, as the previous ban on Huawei’s involvement in the National Broadband Network was introduced by a Labor government in 2012, and the ALP’s communications spokesperson confirmed that ‘on matters of infrastructure security, Labor will always take the advice of our security agencies.’[1][2][3][4]

Why is Huawei considered a ‘high-risk vendor’? 

Huawei is one of the PRC’s best-known corporations on the international stage. Yet despite its enormous success – as the world’s number one telecom networks equipment maker and number two smartphone seller, with reported revenues of over US$100 billion and operations in over 170 countries – it has become a poster child for the ‘China threat’ in the United States and many other countries. Australia’s 2018 ban of Huawei from supplying 5G networks was just one of many volleys against the firm in a lengthy campaign spearheaded by the US government.[5][6]

As early as 2012, after a lengthy investigation, the Permanent Select Committee on Intelligence of the US Congress (the ‘PSC’) expressed ‘deep concerns’ that Huawei and ZTE ‘cannot be trusted to be free of foreign state influence and thus pose a security threat to the United States and to our systems.’ This led to a chain reaction of increasingly severe sanctions against Huawei, including bans on both US government entities and telecom firms from using Huawei’s products and network equipment; a ban on US suppliers exporting components to Huawei such as advanced semiconductor chips, which threatens to cripple the firm’s business; and a complex, still unresolved, criminal lawsuit against the firm.[7][8]

Citing potential national security risks, several governments besides Australia, including India, Canada, and Japan, have fully or partially restricted Huawei from bidding on their broadband infrastructure or building their 5G networks. The US government has also exerted extraterritorial pressure on other countries to try to prevent Huawei from doing business in their territories.[9][10]

Yet when the evidence cited to justify these sanctions is carefully examined, it turns out to be surprisingly thin. The US Congress’ PSC Report provides the most detailed attempt to lay out the key ‘national security risks’ posed by Huawei and their evidential basis, which can be divided into four main points:

1. Ownership;
2. Communist Party branch;
3. Alleged military links; and
4. Espionage allegations.

Assessing the risks

1. Huawei’s ownership

The PSC claimed that Huawei had not provided enough clarity on its ownership to prove that it was free from PRC government control. Yet the documents provided by Huawei to the PSC and other widely available independent sources clearly demonstrate that almost 99 percent of Huawei’s shares are owned by its employees through the firm’s employee union share fund, and the other one percent are owned by Huawei’s CEO Ren Zhengfei.[11][12]

Huawei has a detailed set of Articles that govern the rights of employee shareholders, and an elected employee shareholder ‘Representatives’ Commission’ (the ‘Rep Com’). The Articles also set out the criteria for employees to buy or redeem shares, and how they will be priced based on Huawei’s net asset value. The shares cannot be transferred or sold, but the company will redeem them when the employee leaves.[13]

Huawei’s Rep Com initially consisted of 51 elected employee representatives, but since January 2019, this number has been increased to 115 representatives. They are elected for five-year terms by Huawei’s 86,000-plus active employee shareholders, with a voting system based on one vote per employee share. Once the Rep Com is elected, its 115 members then attend the company’s shareholder meetings and make decisions on behalf of the employee shareholders and elect the Board of Directors and the Supervisory Board. Members of these two boards serve for five-year renewable terms.[14][15]

In practice, as with most large public companies elsewhere in the world, new candidates for Huawei’s Board of Directors are nominated by the existing Board and then approved by the Rep Com. All Huawei’s Board members are long-serving employees, having joined Huawei during the 1980s or 1990s. There has never been any credible evidence of involvement by external parties, whether government or otherwise, in the selection of Huawei’s senior management or Board members.[16][17]

While Huawei has only two formally registered shareholders, namely the Huawei Investment and Holding Corporation Trade Union Committee (‘Huawei TUC’, with approximately 99 percent of the equity) and Ren Zhengfei (with around one percent), the Trade Union Committee is merely a nominee shareholder holding those shares on behalf of Huawei’s employee shareholders, who exercise their powers through the Rep Com. Indeed, the Trade Union Committee has no members and no concrete existence except as a legal fiction conduit – in Chinese, a ‘community legal person’ (shetuan faren) – whose sole purpose is to hold shares on behalf of others.[18]

It is true that employees who have reached the level of senior management, and especially Ren Zhengfei, exert the most influence over the company’s managerial appointments and decision-making, but this is normal in the vast majority of business corporations elsewhere in the world. Allegations of some other external locus of control over Huawei’s ownership, such as the PRC government, lack any convincing evidential basis.[19]

2. Huawei’s Communist Party branch

The PSC also claimed that because the Communist Party of China (CPC) has a branch committee within Huawei, this is further evidence of PRC government control, because ‘experts in Chinese political economy agree that it is through these Committees that the Party exerts influence, pressure, and monitoring of corporate activities.’[20]

However, this characterisation of the CPC’s role in Huawei (and in most other private Chinese firms) is inaccurate. Several rigorous empirical studies have demonstrated that, in the words of George Washington University Professor of Political Science Bruce Dickson, ‘Party building in the private sector has been more successful at promoting the firms’ interests than exerting Party leadership.’ Likewise, Hong Kong academics Xiaojun Yan and Jie Huang found that ‘most Party branches within private enterprises just do what the business owners want, never what the owners don’t want,’ and the Party’s ‘organisational presence in private enterprises may have been expanded, but the benefits of its business-oriented party building tend to accrue to private entrepreneurs rather than to the party-state.’[21][22]

Private firms’ CPC Committee members are appointed by the firm’s management, not by the PRC government. To ensure there is not a competing CPC power centre within the business, in many private firms, the CEO/founder simply appoints him or herself as the firm’s Party Secretary. One national survey in 2010 found that almost 70 percent of private entrepreneurs with Party membership were also the Party Secretaries for their enterprises, a phenomenon known as the ‘familisation’ (or co-opting) of CPC branches by the controlling shareholders of private firms.[23][24][25]

Not surprisingly, this disjunction between personal/firm incentives and Party building means that short-term profits tend to be prioritised over Party initiatives like anti-corruption, environmental protection, and tedious study of the latest speeches of PRC President Xi Jinping issued by Party Central in Beijing. In most private firms, Party branches only hold meetings once every three to six months, and in 15 percent of firms, there are no regular Party meetings at all, with the Party branch being just an empty shell. Only 0.4 percent of private entrepreneurs in the PRC in one national survey thought that CPC branches were essential to the operation of their businesses.[26][27]

Contrary to numerous media reports that President Xi has expanded the Party’s presence in private PRC firms, the author’s own research reinforces the message of these empirical studies that the CPC’s role in private firms is anaemic and in decline. The author found that .[28]between 2017 and 2019, the number of private PRC firms with CPC committees actually declined by some 400,000 (or 21 percent)[29]

In contrast to many other firms, Huawei’s CPC branch is quite active, but its role is not a political one. Huawei’s management has effectively co-opted its CPC branch to serve as a motivational training centre, developing employees’ ethical values and psychological resilience, to enable them to contribute better to Huawei’s performance.[30]

While Huawei’s Party branch (and its CEO Ren Zhengfei) borrow revolutionary language from former Chairman Mao’s speeches and the CPC’s revolutionary history, they have radically reinterpreted this language for the corporate context. For example, the CPC branch has organised regular ‘self-criticism’ sessions, where the firm’s various divisions can meet and publicly reflect on the errors they have made, and how they should improve the effectiveness of the company’s products and systems. ‘Self-criticism’ was a harsh revolutionary technique promoted during political campaigns by Chairman Mao, but Ren Zhengfei claimed that the company’s version of self-criticism was much ‘gentler’. He likened it to ‘hitting employees a hundred times with a soft pillow.’ Even if the blows are soft, they will remind employees to keep improving their work.[31]

Of course, Huawei’s Party branch certainly promotes broader CPC policies within the firm, such as President Xi’s eco-civilisation campaign, and organises regular entertainment/propaganda shows to commemorate Party anniversaries, such as National Day. And like all other PRC organisations, Huawei needs to ensure that its employees do not rock the political boat by actively challenging the CPC’s rule, something that Ren Zhengfei has emphasised in his speeches to employees. Yet within this generally assumed political framework, there is a great deal of flexibility in how private firms like Huawei utilise their CPC branches.[32]

3. Alleged military links

The PSC also expressed its deep suspicion that Huawei may have hidden links with the PRC military, due to Ren Zhengfei’s previous career in the People’s Liberation Army. They claimed that the military continues to influence Huawei’s business both as an important customer and a financial backer of the firm. However, the evidential foundations for these alleged military links are shaky.[33]

It is true that Ren Zhengfei was once a relatively low-ranking officer in the PRC military construction corps. However, he left the army during a major military downsizing in 1983, and a few years later in 1987 set up a small private business selling simple telephone exchange switches imported from Hong Kong, which later grew into Huawei.[34]

In making its claims about Huawei’s continuing military influence, the PSC mainly relied on a 2005 report by the RAND Corporation, an American defence-focused think tank. This report claimed that Huawei was part of a new ‘digital triangle’ between the PRC state, military and commercial IT industry, and that ‘Huawei maintains deep ties with the Chinese military, which serves a multi-faceted role as an important customer, as well as Huawei’s political patron and research and development partner.’ However, a careful reading of this RAND report reveals that its only named source for these assertions is a brief and rather speculative magazine article by reporter Bruce Gilley from 2000, which is then massaged and misquoted to spin ‘deep ties,’ ‘military patronage’ and ‘R&D partnerships’. If this is the best evidence that a well-funded US congressional intelligence committee can dig out for Huawei’s military ties, the substance of the allegations is highly dubious.[35][36]

Huawei has never denied that it sells telecom and network equipment to the PRC military, making up less than 0.1 percent of the company’s overall sales. But this is a far cry from the military being an ‘important customer’ and ‘financial backer’ of the firm.[37]

4. Espionage allegations

Even if Huawei has no military links or direct PRC government control, the US government has alleged that Huawei’s network equipment could still be used to transmit sensitive information back to Beijing, and that Huawei would not be able to refuse demands by the PRC security and intelligence services to cooperate with such espionage activities, which potentially threatens US national security. This ‘potential threat’ argument is also the stated basis for Australia’s 5G ban on Huawei.[38][39]

Without access to classified information, it may not be possible to definitively answer the question whether Huawei’s network equipment poses a ‘potential’ national security threat. Yet none of the various public investigations of Huawei have uncovered any evidence of the company assisting the PRC government to engage in espionage or seeking to undermine the security of foreign governments. The UK government has conducted the most intense scrutiny of Huawei’s telecom and network equipment, with continuous testing by independent technical experts since 2003 through the Huawei Cyber Security Evaluation Centre (HCSEC). The Centre’s annual reports have certainly criticised technical vulnerabilities in Huawei’s products, and have required the company to remediate defects in its software engineering and cyber security processes to prevent potential breaches. Yet its 2019 report concluded: ‘NCSC does not believe that the defects identified are a result of Chinese state interference.’ In other words, the UK government’s National Cyber Security Centre, which has a duty to protect UK citizens from cyber risks, has not detected any PRC government/military ‘interference’ in any of Huawei’s hardware or software that is used in the UK.[40][41][42]

Likewise, in a detailed April 2019 investigation of Huawei by the Los Angeles Times, the reporters concluded: ‘None of the US intelligence officials interviewed over several months for this story have made information public that supports the most damning assertions about China’s control over Huawei and about Ren’s early ties to Chinese military intelligence. They have yet to provide hard evidence and, privately, these officials admit they don’t have any’ (author’s emphasis).[43]

Of course, there have been occasional media reports alleging Huawei’s involvement in espionage activities, but most are based on unverifiable tips by anonymous sources or speculation. A typical example is a December 2021 Bloomberg article alleging that ‘Chinese spies … infiltrated the ranks of Huawei technicians’ back in 2012, and installed a software update containing ‘malicious code’ on the network of a ‘major Australian telecommunications company,’ which sent information from the network back to the PRC for a few days before self-destructing. The report claims that this incident was a ‘core part of the case built against’ Huawei by several governments, who suspect that the firm has been a ‘conduit for espionage,’ but the evidence presented in the report is unconvincing for several reasons. First, it states that investigators of the alleged breach ‘arrived too late,’ and only ‘fragments of the malicious code’ still remained, so they had to ‘reconstruct the attack’ using ‘human informants and secretly intercepted conversations.’ The risks of relying on human informants in intelligence gathering are widely known. Second, Australia’s three major telecommunications firms all denied that any such incident took place: Telstra has never installed Huawei equipment in its networks, and both Optus and TPG Telecom rejected the claim that their systems had been compromised. This is problematic, because the report also cites a statement from the Australian Signals Directorate that ‘whenever ASD discovers a cyber incident affecting an entity, it engages the relevant entity to provide advice and assistance.’ Third, the reporters ‘didn’t find evidence that Huawei’s senior leadership was involved with or aware of the attack,’ and could not specify what information was taken, or ‘what, if anything, the attackers did’ with the information.[44][45][46][47][48]

Even if such an incident is taken at face value – as a foreign intelligence agency taking advantage of a flaw in Huawei’s software without the company’s knowledge – it is not clear why it differs from numerous similar incidents by state-backed hackers, criminals and fraudsters that have compromised US or multinational technology firms using phishing and other methods, such as Microsoft, Apple, Google, Cisco Systems, and many others.[49]

More broadly, the commonly cited argument that the CPC and its intelligence services could simply compel large PRC corporations to risk their whole businesses by handing over their source code for government exploitation ignores the fact that both private and state-owned PRC corporations do regularly resist CPC policies and orders when their commercial interests would be threatened. Part of the reason is that both the Central CPC and its security services are themselves riven by corruption and factional infighting, as is clear from thousands of recently prosecuted anti-corruption cases, including a minister and two deputy ministers of state security, and numerous senior public security officials. And much of this corruption involves the ‘capture’ of government officials by private corporations.[50][51][52][53]

Problems with the ‘potential threat’ test

Without convincing evidence of Huawei’s involvement in espionage or PRC government/military control of Huawei, the sanctions and bans of the firm by Australia, the US, and other countries must be justified based on the ‘potential’ rather than actual threat of harm.[54]

The problem is that the potential national security threat will not be overcome by restricting Huawei from critical infrastructure, even if this is a prudent approach. The networks and software operating systems of numerous technology and other firms are regularly exploited by criminal cyberhackers and state-backed actors. Serious disruption of public institutions, banks, and critical infrastructure has occurred in both the US and Australia, causing economic losses to businesses and consumers. The perpetrators are able to exploit those systems and cause major damage without using any Huawei network equipment. Banning PRC firms like Huawei only gives a false sense of security to Australian network users.[55]

Technology experts have identified one key reason for this cyber vulnerability: governments of the Five Eyes intelligence sharing network, led by the US, have intentionally prevented full encryption of network data due to their own law enforcement and intelligence collection concerns. They have promoted legislation requiring tech companies to leave ‘back doors’ to allow law enforcement and security service access. A 2019 Five Country ministerial communique declared: ‘Tech companies should include mechanisms in the design of their encrypted products and services whereby governments, acting with appropriate legal authority, can obtain access to data in a readable and usable format.’ Australia has already introduced such a legal mechanism in its Telecommunications and Other Legislation Amendment (Assistance and Access) Act (Cth 2018), ‘on a very short timetable, with little public consultation or parliamentary debate.’[56][57]

While law enforcement and national security concerns are important, unfortunately ‘there is no way to make a door that only the ‘good guys’ can open and the ‘bad guys’ cannot. Creating a back door weakens the security of the whole system and puts all its users at risk,’ making us ‘vulnerable to the crimes we collectively are trying to prevent.’[58]

Conclusion: A complex issue with no simple solution

To sum up, the evidence against Huawei is surprisingly weak, and banning the company from Australia’s networks will not protect the country from continued cyber-intrusions from ‘hostile powers’ and organised criminals. Difficult decisions are required to balance individual privacy with domestic law enforcement and national security access. This does not mean Australia should open its networks to Huawei’s 5G equipment, but it does mean that real protection will only come from the hard grind of continuous, long-term multilateral efforts to reduce tensions with the PRC and other authoritarian states, and to incentivise them to introduce further political reforms.    

Further reading

• Colin Hawes, The Chinese Corporate Ecosystem (Cambridge University Press, 2022).

Sources