Huawei Represents Massive Supply Chain Risk: Report

A new report from threat intelligence firm Recorded Future portrays Chinese technology giant Huawei as presenting a substantially bigger threat to US interests and organizations than currently perceived.

According to the firm, Huawei's enormous range of technologies and products and its global customer base has put the company in a position to access an unprecedented amount of information on organizations, governments, and people worldwide. Huawei's obligations to the Chinese government under various national security and related statutes puts that data at risk of interception and compromise, Recorded Future said.

"The position that Huawei occupies in China and its obligations under that government's laws and regulations cannot be minimized," warns Priscilla Moriuchi, director of strategic threat development at Recorded Future.

"Huawei, as a Chinese company, is not inherently malign," she acknowledges. "However, the people that compose Huawei will at some point likely be forced into making decisions that could compromise the integrity or corporate ambitions of their customers."

President Trump last month signed an executive order that effectively bans US government agencies from buying technologies that are owned by, controlled by, or subject to the laws of foreign adversaries.

The order cited concerns over the potential for foreign governments to force such vendors to use their technology to spy on US organizations and to conduct widespread espionage — via backdoors, for instance. The executive order also requires contractors that work with the federal government to jettison Huawei technologies from their infrastructure in a phased manner.  

The Trump administration's order did not explicitly name Huawei, or any other technology companies for that matter. But many see it as directed particularly at the Chinese technology vendor.

Over the past few years, US officials have openly expressed concern over what they perceive as Huawei's close ties to the Chinese government. The US has accused China of conducting widespread economic espionage for a long time. Last year, CNBC reported six US intelligence heads cautioning against the use of Huawei's phones in the US market because of such concerns. Recently, government officials and others have focused on the national security implications of Huawei's leadership in the 5G networking space. It has urged allies and governments around the world to stop using Huawei technology as well.

Huawei, for its part, has strongly denied accusations that it is working on behalf of the Chinese government or is supplying information to the government, as its critics have suggested. The company has described itself as a victim of a broader geopolitical battle between the US and Chinese governments. Huawei has suggested that at least some of the pushback from Western governments stems from its enormous success in the technology arena. The company is currently in the third spot behind Apple in the global smartphone market, and its technology is widely used across many parts of Asia.

"I would argue that we are beyond the point of needing specific evidence, and that we must address the question of Huawei risk comprehensively with the available data," says Moriuchi.

Broad and Growing Footprint
Huawei currently offers a broader range of technology products than almost any other company, including Western technology giants such as Microsoft and Apple. The company's portfolio includes broadband network components; cloud computing and storage technologies; infrastructure management software; network switches and routers; and mobile phones, laptops, and wearables. Many of these technologies are installed within organizations or are embedded in the networks of cloud service providers and other third parties, according to Recorded Future.

Huawei's technology is being used in so-called "safe city" surveillance programs in multiple cities around the world, and the company is aggressively expanding its presence in the core Internet routing space via undersea cables and fiber-optic technology.

Huawei's enormous footprint has given it access to more data than perhaps any single other organization. What makes that worrisome is that under Chinese laws passed since 2016, Huawei has a legal responsibility to provide access to and support the country's intelligence-gathering apparatus, Moriuchi says. "There is no legal mechanism in China for a company to challenge or contest a request by the intelligence and security services," she says.

Huawei has also benefited from government loans and received funding from China's military and intelligence agencies and over the years has benefited from government support and preferential treatment, Moriuchi claims.

For companies and individuals, the threat from Huawei can be distilled down to the risk to business and personal data, networks, intellectual property, and even long-term corporate viability. When deciding to use Huawei products, organizations need to figure out what their risk tolerance for monitoring, interference, or potentially sensitive data theft from China is. 

"If the risk threshold is low, we recommend that companies minimize the number of Huawei technologies and services within core or critical segments of their networks," Moriuchi advises.

Related Content: