What Does Huawei's Announcement of Exiting the U.S. Market Really Mean?

Last night, my Google Alert for Huawei captured an intriguing headline: "Huawei exiting US market: CEO". The article appeared in Global Times, a Chinese paper that's part of Peoples Daily. Here's the opening paragraph:

Chinese telecommunications equipment maker Huawei Technologies Co Ltd has exited the US market in order not to affect Sino-US relations, Ren Zhengfei, founder and CEO of Huawei, said in an interview in Paris, news portal 163.com reported Sunday.

Upon first reading, this raised a lot of questions in my mind regarding Huawei's current U.S. operations. It has offices in a number of U.S. cities and has already sold quite a bit of equipment to both U.S. corporations and the U.S. government. What would happen there, I wondered?

Fortunately, I was able to reach Bill Plummer, Huawei's VP of External Affairs by email and received the following clarification:

Huawei has prioritized markets that welcome competition and investment, such as Europe.  

That said, we remain committed to our customers, employees, investments and operations and more than $1 billion in sales in the U.S., and we stand ready to deliver additional competition and innovative solutions as desired by customers and allowed by authorities.

So basically what seemed like a radical change of strategy is actually something very practical. Huawei isn't pulling out of the U.S. physically nor is it abandoning its current U.S. customers. It is simply re-allocating its resources to increase sales in those parts of the world where it is welcome to compete.

Personally, as someone who has been a frequent critic of Huawei, I think it's a smart strategy. They're already the world's largest telecommunications hardware manufacturer. Why should they risk engendering more controversy by continuing to battle against U.S. government resistance when it will do nothing to improve their bottom line? In my opinion, Huawei's combination of low prices and quality manufacturing will eventually force adoption by U.S. corporations and government agencies. It might take years but I think that will be the inevitable outcome.

In the meantime, instead of hoping that the U.S. government will keep potential adversary states from selling them risky devices, U.S. companies should incentivize cyber security researchers to find ways to automatically test firmware updates for exploits. Currently, whether the hardware is made by Huawei, ZTE, or Dell, firmware updates are loaded automatically with no testing. If, down the road, a foreign intelligence agency (Chinese or otherwise) wants to compromise a strategically placed router made by a company that it has legal authorities over by adding a bit of malicious code, a firmware update is one of the easiest ways to do it.

As a side note I'm happy to say that both Bill Plummer and Andy Purdy (Huawei's CSO) will be at Suits and Spooks DC. Andy will be speaking on a panel that I'm moderating which will explore cyber security risks in the supply chain. We still have about 28 seats available if you'd like an opportunity to discuss Huawei and related cyber security issues with a couple of the company's executives face-to-face.

Add to Cart View detail

Huawei Claims Transparency But These Facts Say Otherwise

"(A)s the Deputy Chairman of the Board of Huawei and the Chairman of the Global Cyber Security Committee of Huawei, I would like to make our company’s position clear. We can confirm that we have never received any instructions or requests from any Government or their agencies to change our positions, policies, procedures, hardware, software or employment practices or anything else, other than suggestions to improve our end-to-end cyber security capability. We can confirm that we have never been asked to provide access to our technology, or provide any data or information on any citizen or organization to any Government, or their agencies. 

"Huawei will continue our open and transparent approach and responsible position to its operations and everything we do." 

- Ken Hu (Deputy Chairman of the Board of Huawei and Chairman of the Huawei Global Cyber Security Committee)

 Mr. Hu wrote the above statement in a web posting which announced Huawei's Cyber Security white paper "Cyber Security Perspectives: Making Cyber Security a part of a Company's DNA" (October, 2013).

This PR campaign is clearly mean't to take advantage of the Snowden leaks regarding NSA activities and data collection. Mr. Hu wants to paint a picture that Huawei, unlike U.S. companies named with supporting legal NSA requests, has not received any such requests from the Chinese government.

That's disingenuous at best, and purposefully misleading at worst.

The government of China is one of Huawei's biggest customers; primarily the State-owned telecommunications companies - China Telecom, China Unicom, and China Mobile. Those companies engage in State-mandated monitoring of all telecommunications inside the PRC using in part Huawei's equipment. In fact, China's State Security Law requires that companies and individuals comply with any request for assistance by the MSS or other state security organs up to and including technological means of surveillance.

If the MSS hasn't asked Huawei to provide access, it's because Huawei has already built that access in so that China Telecom can do its job of lawful intercept. And that's not just for telecommunications services. The law was updated in 2010 to include Internet traffic.

Regardless of how Mr. Plummer, Mr. Purdy, Mr. Hu and other Huawei executives try to spin their company's dedication to transparency and security, they work for a company whose equipment is used to surveil the communications of a country of 1.3 billion people, including all of the foreign-owned companies which have offices in China. Their white paper doesn't talk about that, nor does it reveal how Huawei hardware supports MSS collection efforts.

That's not being transparent, gentlemen.

Add to Cart View detail

Huawei's Cavernous Cyber Security Credibility Gap

Approximately one month before Huawei officials (along with ZTE officials) are supposed to testify before the House Permanent Select Committee on Intelligence (October 2012), the company's Global Cyber Security Officer and SVP John Suffolk released a white paper entitled "Cyber Security Perspectives: 21st Century Technology and Security - a Difficult Marriage".

I've been monitoring Huawei for several years and have given dozens of briefings on the security risks associated with the company, its management and its products. I've had several Huawei employees contact me privately about issues within the company and I've spoken to at least one of their senior executives last year about my concerns. I just finished reading Mr. Suffolk's white paper, which Andy Purdy, former Director of DHS National Cyber Security Division and now Huawei's Chief Security Officer, helped write. While it covered all of the usual bases regarding Huawei's commitment to security (I'm not going to recap these - read the paper if you must know), it addressed none of the issues that underscore the opinion of myself and others that Huawei is a security threat, such as:

• Madam Sun Yafang's past employment with China's Ministry of State Security and how she helped the young company secure loans form the Chinese government.
• Claims that Huawei benefited from Nortel's IP in 2004 including duplicating its instruction manuals.
• Claims that Huawei stole source code from Cisco and its settlement of those claims in 2004.
• Lack of full disclosure regarding Huawei's obligations to the Chinese government as a national champion firm and a provider of services and products to the State including the Peoples Liberation Army. 
• Lack of full disclosure regarding how many of its executives are members of the powerful Chinese Communist Party (CCP) and therefore bound to comply with directives from the CCP. After all, the CCP plays a dominant role in China's economy.

If Huawei's white paper is an example of how Huawei intends to address the concerns of the House Intelligence Committee, it's not nearly enough - even with Andy Purdy's help.

UPDATE (06SEP12): According to Reuters, Huawei is negotiating terms for its testimony before the House Intelligence committee. The fact that they have to "negotiate terms" says a lot to me about how valid the scope and validity of the concerns that I mentioned above are, not to mention the ones that Huawei doesn't want to have discovered.

Add to Cart View detail

The Real Reason Why Symantec Sold Its Interest in Huawei Symantec

Finally the truth about why Symantec CEO Enrique Salem decided to sell Symantec's share of the Huawei Symantec joint venture is out, thanks to the New York Times:

Less than four years after Huawei Technologies and Symantec teamed up to develop computer network security products, the joint venture is being dismantled because Symantec feared the alliance with the Chinese company would prevent it from obtaining United States government classified information about cyberthreats.

However I'd like to point out that I called this on November 15th, 2011 in this blog post where I wrote:

My question is, what happened between May and October to make CEO Salem change his mind?
Could it have been this Washington Times article last August about how four Senators and a Congressman were asking the Departments of Defense and Energy to look into the sale of H-S parts to a government research lab at the University of Tennessee? Or perhaps it was the release of an Open Source Center report on Huawei's Chairwoman Sun YaFang's past with the equivalent of China's CIA, the Ministry of State Security?
Or perhaps it was that the ludicrous nature of the relationship between a Chinese company with State affiliations and a security company who's supposed to protect their customers from espionage activities from that same State finally sunk in to Salem's brain?  No, it probably wasn't that.

And while the joint venture may be over, remember that a lot of Huawei equipment has already been sold to the U.S. government including DOD and NASA by Huawei Symantec through channel partners like MPAK and Dell Force 10 Networks. To make matters worse, no one is testing for backdoors in firmware updates to any of the hardware manufactured in China; not just Huawei but Dell's servers as well.

Add to Cart View detail

Dark Cloud Rising: Cloud Services are Becoming the Attackers' Preferred Target

The largest Cloud providers today are Google, Microsoft, and Amazon; each offering multiple services and platforms for their respective customers. For example, Microsoft Azure, Google Apps, and Amazon EC2 are all hosting and development platforms. Google Docs, Acrobat.com, and Microsoft Office 365 all provide basic word processing, spreadsheets and other applications for individuals to use via the Web instead of on their individual desktop. Then of course there’s social networks, online gaming, video and music sharing services - all rely on a hosted environment that can accommodate millions of users interacting from anywhere on Earth yet all connected somewhere in cyberspace. While the benefits are many, both to individuals and to corporations, there are three distinct disadvantages from an individual and national security perspective:

• The cloud provider is not responsible for securing its customers’ data
• Attacking a cloud-based service provides an economy of scale to the attacker
• Mining the Cloud provides a treasure trove of information for domestic and foreign intelligence services.

No Security Provisions

A Ponemon Institute [1] study on Cloud Security revealed that 69% of Cloud users surveyed said that the providers are responsible, and the providers seemed to agree, however, when you review the terms of service for the world’s largest cloud providers, responsibility for a breach of customer data lies exclusively with the customer. For example:

• From Amazon [2]: “Amazon has no liability for .... (D) any unauthorized access to, alteration of, or the deletion, destruction, damage, loss or failure to store any of your content or other data.”
• From Google [3]: “Customer will indemnify, defend, and hold harmless Google from and against all liabilities, damages, and costs (including settlement costs and reasonable attorneys’ fees) arising out of a third party claim: (i) regarding Customer Data...” 
• From Microsoft [4]:“Microsoft will not be liable for any loss that you may incur as a result of someone else using your password or account, either with or without your knowledge. However, you could be held liable for losses incurred by Microsoft or another party due to someone else using your account or password.”

Not only do none of the three top cloud providers assume any responsibility for data security, Microsoft goes one step further and places a legal burden upon its customers that it refuses to accept for itself.

An Economy of Scale

NASDAQ’s Directors Desk is an electronic boardroom cloud service which stores critical information for over 10,000 board members of several hundred Fortune 500 corporations. In February, 2011 [5], an un-named federal official revealed to the Wall Street Journal’s Devlin Barrett that the system had been breached for more than a year. It’s unknown how much information was compromised as well as how or when it will be used. From an adversary’s perspective, this type of breach offers an economy of scale has never been seen before. In the past, several hundred Fortune 500 companies would have to be attacked, one company at a time, which costs the adversary time and money not to mention risk. Now one attack can yield the same amount of valuable data with a significant reduction in resources expended as well as risk of exposure.

An Open Source Intelligence Goldmine

China’s national champion firm Huawei is moving from selling telecommunications network equipment towards developing Infrastructure-as-a-Service software (the Cloud stack) needed to provide a highly scalable public cloud like Microsoft's Azure or Amazon's EC2. If it sells IaaS with the same strategy that it uses in selling routers and switches, Amazon, Google, and Microsoft can expect to begin losing a lot of enterprise business to Huawei who will cut pricing by 15% or more against its nearest competitor. Cloud customers can expect their data to reside in giant state-of-the-art server farms located in Beijing’s “Cloud Valley”; a dedicated 7800 square meter industrial area which is home to ten companies focusing on various aspects of Cloud technology such as distributed data centers, cloud servers, thin terminals, cloud storage, cloud operating systems, intelligent knowledge bases, data mining systems, and cloud system integration.

Cloud computing has been designated a strategic technology by the Peoples Republic of China’s State Council in its 12th Five Year plan and placed under the control of the Ministry of Industry and Information Technology (MIIT). MIIT will be funding research and development for SaaS (Software as a Service), PaaS (Platform as a Service), and IaaS (Infrastructure as a Service) models as well as virtualization technology, distributed storage technology, massive data management technology, and other unidentified core technologies.  Orient Securities LLC has predicted that by 2015, cloud computing in China will be a 1 trillion yuan market.

According to the US-China Council website [6], MIIT was created in 2008 and absorbed some functions from other departments including COSTIND (Commission of Science, Technology, and Industry for National Defense):

“From COSTIND, MIIT will inherit functions relating to the management of the defense industry, with a scope that covers the national defense department, the China National Space Administration, and certain administrative responsibilities of other major defense-oriented state companies such as the China North Industries Co. and China State Shipbuilding Corp. MIIT will also control weapons research and production in both military establishments and dual-role corporations, as well as R&D and production relating to "defense conversion"--the conversion of military facilities to non-military use.”

Clearly, the PRC has made a serious commitment to Cloud Computing for the long term. This doesn't portend well for today's private cloud service providers like NetApp or public cloud providers like Amazon, Google, and Microsoft; especially if buying decisions are made on price.

In Summary

The move to the Cloud is both inevitable and filled with risk for high value government employees, corporate executives, and companies engaged in key market sectors like energy, banking, defense, nanotechnology, advanced aircraft design, and mobile wireless communications, among others. To make matters more complicated, cloud providers may move data to different server farms around the world rather than keep it in the same country as the corporation or individual which owns it. That could potentially put the customer’s data at risk for being compromised legally under foreign laws which would apply to the host company doing business there. For example, Microsoft UK’s managing director Gordon Frazier was recently asked at the Office 365 launch: “Can Microsoft guarantee that EU-stored data, held in EU based datacenters, will not leave the European Economic Area under any circumstances - even under a request by the Patriot Act?” Frazier replied: “Microsoft cannot provide those guarantees. Neither can any other company.” 

The best advice for individuals and companies at this time is to insist that cloud providers build a measurably secure infrastructure while providing legal guarantees and without the use of foreign data farms. Until that occurs, and it's highly unlikely to happen without strong consumer pressure, there are significant and escalating risks in hosting valuable data with any cloud provider.

References:

1 The Ponemon Institute, “Security of Cloud Computing Providers Study” April 2011 

2 The Amazon Web Services (AWS) agreement available on Amazon.com 

3 Google Apps for Business Online Agreement 

4 Microsoft Information on Terms of Use, “Member Account, Passwords, and Security”, Microsoft.com 5 The Wall Street Journal, “Hackers Penetrate Nasdaq Computers” February 5, 2011 (online edition)

6 The US-China Business Council website, “12. Ministry of Industry and Information Technology (MIIT)”

Add to Cart View detail

Who's Selling Huawei Products To The U.S. Government?

The House Permanent Select Committee on Intelligence recently announced that it would be conducting an investigation into whether the expansion of Chinese telecommunications companies Huawei and ZTE into the U.S. represents a threat to national security. I'm in favor of the investigation and in my opinion, one of the things that the Committee should investigate is the Huawei Symantec (HS) joint venture and its "Wingmen"; i.e., U.S. companies that have signed up as partners to sell Huawei Symantec products to the U.S. government and associated entities. Symantec has recently announced that it's selling its 49% share of the joint venture to Huawei however that raises the question of who will be servicing those accounts. It seems to me that it'll be Huawei by default. At least two of those wingmen are Dell's Force 10 Networks and MPak Technologies who recently won a contract with the University of Tennessee SimCenter which, in turn, caused several U.S. Senators to ask the Departments of Energy and Defense to investigate the reasons for the sale.

MPak Technologies Founder and President Mike Kornblum has openly said that "the performance of the Huawei Symantec hardware combined with Symantec software helped Mpak win deals with the U.S. government and a large contract at the University of Tennessee SimCenter: National Center for Computational Engineering." Personally, I'd love to know who in the U.S. government has paid Mpak for equipment made by Huawei and sold by Huawei Symantec through its U.S. partner MPak Technologies. The same with Force 10 Networks and HS other "wingmen". The House Intelligence committee should as well.

Related Posts:
Symantec Sells Its Stake In Huawei-Symantec Joint Venture
Huawei's Chairwoman Worked For Chinese Intelligence Before Joining Huawei
Here are the Facts about Huawei and the Chinese Government
Taia Global's Report On Huawei's Bank Loan Controversy
Huawei Symantec Hardware Powers U.S. Critical Technology Research
Symantec CEO Salem Needs To Get His Priorities Straight
Look Out Azure and EC2, Here Comes The Huawei Cloud Service
The Cyprus-Vienna Connection In Huawei Bribery Case

Add to Cart View detail

Symantec Sells Its Stake In Huawei-Symantec Joint Venture

Huawei just announced that it's buying Symantec's interest in their joint venture Huawei-Symantec (HS). This is a very interesting turn of developments for a joint venture that I've been railing against for most of 2011. Six months ago, Symantec CEO Enrique Salem said he either wanted to increase Symantec's stake in HS or sell shares to the public via an IPO. Then in October, he added the additional option that Huawei may buy Symantec's shares. Today, that's precisely what happened. My question is, what happened between May and October to make CEO Salem change his mind?

Could it have been this Washington Times article last August about how four Senators and a Congressman were asking the Departments of Defense and Energy to look into the sale of H-S parts to a government research lab at the University of Tennessee? Or perhaps it was the release of an Open Source Center report on Huawei's Chairwoman Sun YaFang's past with the equivalent of China's CIA, the Ministry of State Security?

Or perhaps it was that the ludicrous nature of the relationship between a Chinese company with State affiliations and a security company who's supposed to protect their customers from espionage activities from that same State finally sunk in to Salem's brain?  No, it probably wasn't that.

Add to Cart View detail

Huawei's Chairwoman Worked For Chinese Intelligence Before Joining Huawei

Much has been made of the fact that Ren Zhengfei, Huawei's founder and CEO used to work as an engineer in the Peoples Liberation Army before he founded Huawei in 1988. However, lots of CEOs around the world are military veterans including me. What's much more significant is the little-known fact that Huawei's Chairwoman Sun Yafang used to work for China's equivalent of the CIA; known as the Ministry of State Security (MSS). The MSS was formed in 1983, about 4 years before Ren founded Huawei (1987). According to the U.S. China Business Council:

MSS conducts covert intelligence gathering operations overseas. It has established intelligence agencies in more than 170 cities and in nearly 50 countries and regions all over the world. These agencies are classified as general branches, branches, and sub-branches. MSS aggressively targets the United States, placing particular emphasis on California's high-tech sector. Cover for Beijing's espionage in the United States includes the 1,500 Chinese diplomats operating out of 70 offices, 15,000 Chinese students who arrive in the United States each year, and 10,000 Chinese who travel in some 2,700 visiting delegations each year.

The Federation of American Scientists (FAS) has a much more detailed description of its history and operations here.

Madame Sun's past with the MSS was first disclosed by a Financial Times article last April. Her Huawei biography neglects to mention that key affiliation, however it is commonly reported in many places on the Chinese Internet. One place in particular is the alumni page for her alma mater; at least it did until just recently when it was mysteriously corrected. Here is a table showing the original time line which included her tenure at MSS and the new "corrected" timeline.

The redaction occurred shortly after I posted two back-to-back articles about Huawei's questionable employee stock loans. Apart from the alumni website, similar information about Madame Sun's time at the MSS also appears in Baidu's version of Wikipedia. Considering how difficult a time Huawei is having convincing the U.S. government that it's just another technology company, I would think that the company would respond by releasing a verifiable resume of their Chairwoman which would end this controversy once and for all; similar to what President Obama did to resolve questions about his birth certificate.

UPDATE: I just learned about the Washington Times article of Oct 11, 2011: "Chinese telecom firm tied to spy ministry", which reports on essentially the same facts mentioned here (sans the attempted cover-up). Bill Gertz references an Oct 5 report by the Open Source Center: “Huawei Annual Report Details Directors, Supervisory Board for First Time,”

UPDATE (12 Oct 2012): Here's an archived copy of the web page that mentions Madame Sun's time with the MSS.

Add to Cart View detail

Here are the Facts about Huawei and the Chinese Government

Yesterday Huawei was blocked by the U.S. Government from participating as an equipment supplier for the Public Safety 700-MHz Demonstration Network, which is a first responders communications network that's part of the Commerce Department. Huawei VP William Plummer wants to know why. According to Plummer:

“Huawei has repeatedly and factually demonstrated its corporate independence,” Plummer said. “No one has ever factually demonstrated otherwise and playing Huawei as a pawn in some geopolitical game of chess is doing nothing more than threatening U.S. jobs, investment, competition and innovation.”

Well, that's not really true. Here are the facts regarding Huawei's affiliation with the Chinese government and why the U.S. as well as other nation states should be cautious about acquiring Huawei equipment.

1. The company's founder Ren Zhengfei was an engineer in the PLA prior to forming his company.
2. The company's chairwoman Sun Yafang worked for the Ministry of State Security and while there helped arrange loans for Huawei before joining the company as an employee.
3. The government of China is Huawei's biggest customer; specifically the State-owned telecommunications services. 
4. Huawei equipment is used to intercept communications in China for state-mandated monitoring.

So to recap, Huawei is considered a national champion telecommunications firm in a nation that monitors all telecommunications networks and engages in cyber-espionage activities using, at least in part, Huawei equipment. The company's Chairwoman used to work for the MSS, China's foreign intelligence service and its founder started the company after serving in the PLA. Those are the facts, and they should be sufficient to justify denying Huawei access to the U.S. market as well as shame U.S. companies like Symantec who have partnered with them.

I'm happy to debate these facts with any representative from Huawei in any venue at any time. My contact information is at my company website.

Add to Cart View detail

Taia Global's Report On Huawei's Bank Loan Controversy

Yesterday, I wrote about a little-reported story of how Huawei is under investigation by Chinese authorities for allegedly abusing its employees' stock purchasing program to effectively generate bank loans without having to report them to the government. My post surprised Huawei US VP for Government Affairs William Plummer who wasn't aware of the scandal but in a private email to me, Mr. Plummer expressed skepticism on the accuracy of the report. Consequently I've tasked some of Taia Global's China experts (all native speakers) to take a deeper look at Huawei's employee incentive plan and how it impacts the company's debt ratio, which depending upon the math involved could go as high as 82% rather than the very low 61% figure provided in Mr. Plummer's Huawei Overview .ppt deck.

Taia Global's Report on Huawei's Bank Loan controversy

Internal financing has been part of Huawei’s employee incentive plan since the 1990s, but this program has become an indirect method for Huawei to borrow money from banks. According to a blog on Tianya, an online community for Chinese overseas, before 2007, the amount of internal stock allocated to each employee was based on the number of years the employee had served and the economic contribution the employee had made in the corresponding year.

Internal stock was one of the three key benefits for employees, in addition to salary and stock dividends.  In recent years, each employee was allowed to purchase a higher proportion of internal stock shares with 15% down payment, and the remainder was paid via bank loans borrowed at a 6% interest rate in the name of the employee, who must pay back at least 20% of the loan’s net value each year.  The down payment ratio was increased to 40% in 2010.  Although dividends were high, most were used to pay back loans for internal stock purchase.  If an employee left Huawei, the employee would only sell the stock share at the original purchase price, with no capital gain for such an internal investment. 



Huawei’s approach (which has been in place since at least 2000 and perhaps earlier) has two consequences.  First, Huawei, as the company entity, received borrowed money in its employees’ names and avoided having to identify it as debt on their balance sheet, which enabled the company to polish its financial performance.  A Chinese blogger –Kuai Dao Hong Qi, whose real name is Chen Hui Min陈惠民, an influential media professional – listed financial data from Huawei’s financial statement from 2008 to 2010.  According to his blog, in 2010, the debt ratio (debt in 105.6 billion yuan/ assets in 160.8 billion yuan) of Huawei was 66%, a little lower than 70%, the financial warning line.  If Huawei added back 11.4 billion yuan, the accumulated borrowed money through this employee incentive plan, the debt ratio would be 68% (adjust debt in 117 billion yuan/adjusted assets in 172.2 billion yuan).

Second, this plan is very risky for employees. In order to receive more dividends in the future, employees borrowed money to buy stock shares and then used received dividends to pay back loans, so they were giving up short-term benefits in pursuit of long-term rewards.  Their assumption is that Huawei will maintain high growth rates as they have had historically, which is not easy due to slow market expansion and high research expenses for exploring new business sectors.



Another potential and well-hidden problem about Huawei’s financial performance is the accelerated recognition of sales revenue. By 2010, Huawei had sold its account receivables of 84 billion yuan in total to banks so the company could recognize revenue quickly. However, Huawei is still liable for sustaining losses if banks fail to collect money back from Huawei’s clients. According to both Chinese and American accounting standards, this is a type of contingency and should be classified as debt. If Huawei also followed this rule, its adjusted debt ratio in 2010 would be 82%, much higher than the warning line of 70%.

No Chinese official media reports on Huawei’s financial issues, although some information can be found online. Meanwhile, according to a person working in Huawei, the employee incentive plan was approved by the Guangdong government, so most people inside Huawei do not think it is risky.

Add to Cart View detail

Huawei Under Investigation For Fraudulent Bank Loans To Its Employees

According to this article in the Philippine Star, the China Audit Commission and the China Banking Regulatory Commission ordered four banks to withdraw their loans to Huawei employees after discovering that the company forced employees to take loans in order to buy Huawei shares. By doing this, Huawei's leadership was able to bypass laws requiring that such fund raising be publicly listed and supervised by the government. The benefit to Huawei was that this practice, rumored to have been going on for four years, would show the illusion of financial strength thus enabling it to secure larger credit lines with better terms. Larger credit lines also helps the company beat it's competitors by offering rock-bottom prices on its hardware that no one else can afford to match; the most recent example being the sale of Huawei-Symantec hardware to the University of Tennessee Sim Center.

This story was also covered in China Business Daily, which states that wrong-doing on the part of Huawei may include the fabrication of contracts. Earlier this year, Huawei was involved in a bribery scandal in Austria. In spite of the past government affiliations of two of two its senior leaders, and these allegations of financial wrong-doing, Huawei has managed to hire John Suffolk the former CIO for the British government and John Bellinger, former chief attorney at the U.S. State Department. Then there's  William Plummer - Huawei's mouthpiece on Capital Hill who claims that any ties between Huawei and the Chinese government are either invented by its critics or stem from a mistake in a 2001 Wall Street Journal Asia article.

Finally, and worst of all in my opinion, is the fact that Symantec's board of directors had approved forming a joint venture with Huawei in 2008 and remains eager to increase their profit margins with a possible IPO this year. How can anybody take Symantec seriously when it sells security solutions to companies being attacked by China (among other states) while at the same is in bed with a company so closely allied with the Chinese government?

Add to Cart View detail

Rick Perry Welcomes Huawei To Texas - Security Be Damned

This is what happens when a politician's knowledge about nation state cyber capabilities and operations is only as deep as a headline or a sound bite. Governor and Republican Presidential hopeful Rick Perry was courted by Huawei for months, up to and including a trip to China where he dined with Huawei's founder and CEO Ren Zhengfei. 

Yesterday's Washington Post article described the history of Huawei in Texas, dating back to 2001. In June, 2010 the State of Texas sent Perry and a delegation to the Shanghai Expo to court Huawei, ultimately resulting in Perry's announcement in October that Huawei would base its U.S. headquarters in Plano bringing hundreds of jobs and tax dollars. The fact that Huawei has been viewed as a national security threat by the U.S. government for many years apparently mean't nothing to Perry or the State of Texas legislature. There's an almost willful ignorance on the part of Perry's campaign to this fact. According to the WaPo article, Perry campaign spokesman Mark Miner said that “if there are national security issues surrounding this company, they should be fully looked at.” 

Oh, really? "If" there are issues? If Perry is this ignorant about China in general and Huawei in particular, he has no business running for the office of President of the United States. 

And if the State of Texas has a Chief Information Officer*, here's a bit of free advice. If you're doing business with China, China is in your network. If Governor Perry and his staff took laptops with them to the Shanghai Expo and re-connected to their office networks when they returned, you've got a compromised network. 

------------

* The State of Texas CIO appears to be Karen W. Robinson and, as of July 25, 2011, she appears to be looking for a Chief Information Security Officer. The job posting can be read here. 

Related Posts:

Is Huawei A Security Risk?

Huawei's Chairwoman Worked For China's Ministry of Public Security

Huawei Symantec Hardware Powers U.S. Critical Technology Research

China's Silent Cyber Takeover

Add to Cart View detail

Huawei Symantec Hardware Powers U.S. Critical Technology Research

Huawei Symantec, a joint venture between China's national champion firm Huawei Technologies and U.S. security giant Symantec, has secured its first high performance storage cluster win - the University of Tennessee's National Center for Computational Engineering. Huawei Symantec is 51% owned by Huawei and they defeated U.S. firms NetApp, EMC, and BlueArc among others for the UT sale. Well, not exactly Huawei Symantec directly. It was their channel partner MPAK Technology out of San Diego who made the sale. This has been Huawei's strategy ever since it became clear that the U.S. government wasn't going to cave in on its security concerns as easily as the U.K. government did. Rather than trying to sell direct, it has established partnerships with U.S. companies like MPAK and Force 10 Networks to do it for them. What will their equipment be used for? This is from UT's website:

The SimCenter: National Center for Computational Engineering is a center for integrated research and education whose primary goals are to establish next-generation technologies in computational modeling, simulation and design, to educate a new breed of interdisciplinary computational engineer who can solve a broad range of real-world engineering problems, and to provide consequent leadership and national impact in critical technology areas affecting defense, sustainable energy, environment, and health.

Huawei priced themselves far below their competition and the University went with the lowest bidder. Did national security concerns factor in to the decision? I've sent the university an email with that very question. If they respond, I'll post it here. My guess is that security wasn't a factor at all.

Related Posts:
China's Silent Cyber Takeover
Symantec CEO Salem Needs To Get His Priorities Straight

Add to Cart View detail

Huawei, Ryan Cleary, and Why The UK Is Headed For A Cyber Disaster

While the British government is busy prosecuting a teenager for the DDOS attack against SOCA, they are embracing China's national champion firm Huawei with open arms. Last year, Huawei opened a Cyber Security Evaluation Centre in Oxfordshire where its source code and presumably the source code of other companies could be examined for  backdoors by representatives of Britain's Communications-Electronics Security Group (CESG). This is the same strategy that has worked to Huawei's benefit in India just a few days ago where it has been given the green light to set up a similar lab in Bangalore, much to the chagrin of members of India's cybersecurity community with whom I've spoken privately.

Not only is the British government contracting with Huawei for significant work such as providing mobile phone service for London's subway system for the 2012 Olympics, but they do so in spite of warning by their own intelligence services. While other nations like the U.S. worry about China's plans to launch a pre-emptive strike against the power grid in the event of an impending attack, Britain has sold over 50% of its power grid to a Chinese company, which pretty much makes concern about an attack against CI a moot point. But by God, they're going to prosecute anyone who dares take a government website off-line because they're SERIOUS about cybersecurity in the U.K.

Related Posts:
Huawei's Chairwoman Worked For China's Ministry of Public Security
The Cyprus-Vienna Connection In Huawei Bribery Case
Does Huawei Support China's Monitoring Laws?

Add to Cart View detail

Symantec CEO Salem Needs To Get His Priorities Straight

I just read that Symantec (NYSE: SYMC) CEO Enrique Salem wants to either increase Symantec's stake in Symantec Huawei Technologies Co. Ltd. or sell shares to the public through an IPO, with a decision to be made by year's end. It's bad enough that the joint venture was formed in the first place. Why Mr. Salem would think that a leading U.S. security software company should form a business partnership with a Chinese company with strong ties to the State Council and Peoples Liberation Army is beyond me; particularly when the U.S. government has been so resistant to agreeing to Huawei's attempts to acquire U.S. companies or to buy Huawei products.

There's no lack of information about the Peoples Republic of China when it comes to informatized warfare, corporate espionage, technology transfer, information acquisition and processing, etc. Besides my own work on the subject, there's stellar work being done by Dr. James Mulvenon and LTC (ret) Timothy L. Thomas among others. So it can't be a question that Symantec's CEO is not aware of the problem. That leaves only two possibilities:

1. That he doesn't believe it to be true
2. That he doesn't care

If it's the former, then I'd be happy to arrange a briefing for him. If it's the latter, then I hope that he'll reconsider his obligation as a citizen of the U.S. to not engage in business practices that could negatively impact the security interests of our nation. Mr. Salem, you clearly have an obligation to your company, your board, and your shareholders to maximize profits. I hope that when you celebrate Memorial Day on May 30th, that you'll consider how to balance that obligation with the one that you owe to your country.

Add to Cart View detail

Look Out Azure and EC2, Here Comes The Huawei Cloud Service

On a recent trip to Beijing and Shanghai to attend Huawei's analyst summit, Gartner analyst Lydia Long learned that Huawei is planning to become a one-stop-shop Cloud computing provider. In other words, Huawei will not only be making network equipment, it will be developing Infrastructure-as-a-Service software (the Cloud stack) needed to provide a highly scalable public cloud like Microsoft's Azure or Amazon's EC2.

If Huawei's strategy in obtaining market share for its hardware is any indication, Microsoft, Amazon, Google, and other public and private cloud providers should prepare to have their pricing model ripped to shreds. Furthermore, the executives of companies who intend to move their data to the Cloud would be well-advised to re-think their cloud service provider requirements; moving beyond who the lowest-cost provider is to include who will add security guarantees to their Service Level Agreement. On the other hand, I'd wouldn't be surprised if Huawei took the initiative to become the first Cloud provider to revolutionize SLAs with exactly that kind of provision, considering that Huawei Symantec LLC is developing secure data storage devices for just such a service.

Huawei is not the only Chinese company that's investing heavily in the Cloud. Cloud computing has been designated a strategic technology by the PRC State Council in its 12th Five Year plan and placed under the control of the Ministry of Industry and Information Technology (MIIT). MIIT will be funding research and development for SaaS (Software as a Service), PaaS (Platform as a Service), and IaaS (Infrastructure as a Service) models as well as virtualization technology, distributed storage technology,  massive data management technology, and other unidentified core technologies.  Orient Securities LLC has predicted that by 2015, cloud computing in China will be a  1 trillion yuan market.

According to the US-China Council website, MIIT was created in 2008 and absorbed some functions from other departments including COSTIND (Commission of Science, Technology, and Industry for National Defense):

From COSTIND, MIIT will inherit functions relating to the management of the defense industry, with a scope that covers the national defense department, the China National Space Administration, and certain administrative responsibilities of other major defense-oriented state companies such as the China North Industries Co. and China State Shipbuilding Corp. MIIT will also control weapons research and production in both military establishments and dual-role corporations, as well as R&D and production relating to "defense conversion"--the conversion of military facilities to non-military use.

Beijing has a dedicated 7800 square meter industrial area called Cloud Valley which is home to ten companies focusing on various aspects of Cloud technology such as distributed data centers, cloud servers, thin terminals, cloud storage, cloud operating systems, intelligent knowledge bases, data mining systems, and cloud system integration. Clearly, the PRC has made a serious commitment to Cloud Computing for the long term. This doesn't portend well for today's private cloud service providers like NetApp or public cloud providers like Amazon, Google, and Microsoft; especially if buying decisions are made on price.

Add to Cart View detail

Huawei CEO's Nepotism Strategy May Prove Fatal

There's been some discussion by Huawei watchers that the patriarch / CEO of the company, Ren Zhengei, has been pressuring Chairwoman Sun Yafang (whom I wrote about last week) to resign (his latest offer is YUAN$1Billion) so that his son Meng Ping, also called "Ren" Ping (see photo) can replace Sun as Chairman of the board. Unfortunately for the company, Sun Yafang is highly regarded both inside Huawei and in the industry in general while Ren's son hasn't been able to gain the respect of the company's employees. In fact, according to my sources, some Huawei employees call him "A dou"; a historical reference to a king's son who's an idiot.

Currently, Huawei's board includes three family members – CEO Ren Zhengfei, CFO Meng Wanzhou (Ren Zhengfei's daughter), and Xu Wenwei (Ren Zhengfei's son-in-law and spouse of Meng Wanzhou).  Ren Shulu (Ren Zhengfei's younger brother) sits on the Board of Supervisors of Huawei. In addition to his brother and his children by Meng, Ren Zhengfei also has three sisters in Huawei.  His son-in-law Xu Wenwei divorced his wife to marry the CEO's daughter Meng Wanzhou. This was a strategic move by Xu to fortify his position in the company and enter Ren Zhengfei’s inner circle.  Xu is someone to watch because he's responsible for Huawei’s research and has a reputation for being quite competent.

Ren Zhengfei's preference for installing family members in high level company positions regardless of merit is understandable considering that he got his start by marrying Meng Jun, the daughter of the Deputy Governor of Sichuan Province Meng Dongbuo.  Besides being ambitious, he’s said to be a womanizer, especially favoring company secretaries.  His wife divorced him, and he married one of the secretaries, with whom he has a daughter.  Then he divorced again and married another company secretary.

Professor Chen Shengjun said, “If you put Mr. Ren Zhengfei and Mrs. Sun Yafang together, all Huawei employees think Mr. Ren Zhengfei is the Number one boss despite Mrs. Sun Yafang’s position as Chairman. Mr. Ren Zhengfei tried a lot to choose his successor from professional managers but failed. From Mr. Ren Zhengfei’s aspect, he probably has to leave Huawei to his children in consideration of the backwardness of China professional manager market especially lack of loyalty. Huawei probably has to become a family enterprise although this is a danger for Huawei.”

Add to Cart View detail

Huawei's Chairwoman Worked For China's Ministry of Public Security

Huawei's 2010 annual report included, for the first time, information about its Board of Directors in an apparent bid to demonstrate increased transparency into its operations. The bio for its Chairwoman Sun Yafang failed to mention that she once worked for the Ministry of Public Security, which is the national law enforcement agency for the Peoples Republic of China. Part of its remit is Information Security which in China means information monitoring - precisely the area that Huawei is working hard to change U.S. perceptions about. According to this article, Huawei had no comment on why this very relevant part of Sun Yafang's resume had been omitted.

Two other important facts emerged from the company's annual report:

1. Huawei appears to be a family-run business and there's every indication that it will continue as such (source).

2. The company's strategy of under-pricing its competition by 10-15% is working. It's net profit in 2010 rose 30% from the previous year and it is closing in on Ericsson as the world's market leader in telecommunications. (source)

UPDATE: I incorrectly identified Sun Yafang as Ren Zhengfei's daughter in my original post. It's been fixed with this update (26 April 2011).

Add to Cart View detail

The Cyprus-Vienna Connection In Huawei Bribery Case

This post is a follow-up to last week's article on Austrian government's investigation into Huawei paying bribes for Telekom Austria business. FORMAT broke the story with its own investigation which was available only in the Austrian language. I've had it translated into English and have reproduced it below. At last report, the Vienna prosecutor's office is investigating.





The Hochegger Lobbying Affair: New Multi-Million Dollar Deals

- Secret Strasser-Hochegger Connection


- Crackdown on Former Telekom Executives

Prosecutors are uncovering a new multi-million dollar lobbying deal made by Peter Hochegger. Two former Telekom executives are being investigated for dubious business transactions with Hochegger.

Lu Hongwei and Peter Hochegger had a shared passion: doing business with Telekom Austria. The Austria boss of the Chinese conglomerate, Huawei, and the well-connected lobbyist decided to fuse their interests into a special “Marketing Promotion Agreement” in August of 2007. The resulting contract was made between Huawei Technologies Investment Limited, based in Hong Kong, and Hochegger's Astropolis Investments Consulting Limited, based in Nicosia, Cyprus.

In the “Agreement,” to which Format has gained exclusive access, Astropolis guaranteed the procurement of Telekom contracts valued at a minimum of 60 million euros. In return, Huawei was prepared to pay 10 percent commission for every secured contract.

Going purely by these numbers, Astropolis was able to take in six million euros over the course of two years. The payment procedure was always the same: after Telekom had settled its balance with Huawei, Lu Hongwei would contact Hochegger via email, reminding him to write an invoice. Hochegger's fee would then be transferred to an Astropolis account (Acct. #: 155-40451087448) with the Bank of Cyprus.

The question remains why China's largest telecommunications equipment supplier–with a turnover of 16 billion euros and a revenue of 1.9 billion euros–would need a small time PR-adviser like Peter Hochegger to do business with a partially state-owned company like Telekom.

Lu Hongwei, who is now head of Huawei's office in Serbia, was not available for comment. His successor, Sun Zhengyang, doesn't know anything about Hochegger or any commission-based contracts. Hochegger isn't making any statements, due to pending court cases.

His silence, however, doesn't change the potential volatility of the Astropolis contracts. The fact that Hochegger, who as an adviser to Telekom earned roughly 25 million euros over 10 years (see: “Hochegger's Biggest Assignments”), was able to secretly collect additional millions of euros in commissions from Huawei is an explosive revelation. For years, Telekom had been astounded with Huawei's unexpectedly high market share. One Telekom employee said of Huawei: “They were getting successive contracts that once went to Nokia and Ericsson.”

State attorney Hannes Wandl, who is investigating the Telekom affair (Case # 614 st 3/10m), sees many parallels to the recent Buwog scandal. A key connection is that Immofinanz's dubious lobbying-related commissions first went to Astropolis–as reported in Format 38/09–before eventually finding their way to Walter Meischberger. The central question here is whether Hochegger shared his commissions from Huawei with a third party.

General suspicion falls on all Telekom managers who were in some way affiliated with contracts that went to Huawei between August 2007 and September 2009. These employees are likely to receive unwelcome attention from the BAK, Austria's federal office for the prevention of corruption. The agency has already compiled a long list of suspects based on witness testimony and the opening up of several bank accounts in Cyprus. The starting date for what promises to be a lengthy examination falls after Easter.

A Volatile Audit Report

Prosecuting attorney Wandl has had his sights on two former Telekom executives for a long time; Rudolf Fischer and Gernot Schieszler are both suspected of having misused Telekom funds. Last week Wandl commissioned a police raid. The official justification for this act, as it was presented to Format, was that Fischer and Schieszler had overseen “payments on behalf of Telekom Austria to Valora AG, totaling 9.08 million euros, with no service in return.” Valora AG, a consultancy firm, belongs to Hochegger. “Rudolf Fischer, Gernot Schieszler and Wolfgang F. are thus suspected of having committed the crime of perfidy.”

Fischer and Schieszler were high-ranking Telekom liaisons to Hochegger and his lobbying partner at the time, Walter Meischberger. The connection was so strong that Schieszler found immediate employment under Meischberger after leaving the company in mid-2009.

According to the official investigation, Telekom's internal auditing yielded the following results with regard to Fischer and Schieszler: “In the 16 recorded business transactions with Valora AG, which resulted in a total of 29 invoices, not one of the alleged 16 return services” was documented. The file states that: “In each case there exists only one contract, drawn up by the purchasing department, which took over invoicing duties and handled offers from Valora, which always matched the invoices. The above-named accused were the sole participants in all confirmed business transactions of this nature.”

Volatile Witness Testimonies

Numerous Telekom employees were questioned about the 9.06 million euros that went up in smoke:

“Telekom's Purchasing Manager, Brigitte Schüssler, claimed that during the time period in question Wolfgang F. was head of the purchasing department. She has no memory of the two specific cases in which her name came up.”

“Responding to claims that his department was implicated in a bill totaling 380,000 euros, Stefan Tweraser, former Retail Marketing Manager, stated that he had no memory of the indicated consultancy contract; neither Tweraser nor any of his colleagues in the department had commissioned such a contract.”

“Wolfgang Pastner, Telekom's incumbent Secretary General, stated that none of the cases referred to in the invoices were known to him . . . Similarly, Peter Michaelis, Chairman of the Board at Telekom, had no knowledge of said cases.”

Despite an inquiry from Format, Fischer and Schieszler–to whom both the presumption of innocence right now applies–have remained mum. The former Telekom top managers declined to comment on the allegations arising from the internal audit, as well any potential involvement in Hochegger's deals with Huawei.

The audit report, which has become Fischer and Schieszler's bane, throughly investigated business transactions between former Telekom heads and Hochegger's Austrian network. “We are fully cooperating with Vienna's public prosecuting office,” states Elisabeth Mattes, a speaker for Telekom. Mattes also vehemently refutes Hochegger's claim that Telekom had attempted to silence him. She states: “Of course we exonerated Mr. Hochegger from all confidentiality agreements.”

Up until now, Telekom had been unaware of the Huawei commissions that, as Format uncovered, were paid to Hochegger. Christopher Schnecker, TA Director of Audit, will soon be closely examining the transactions with industry giants Huawei; the total contract volume greatly exceeds 130 million euros. Evidence of questionable projects and all names affiliated therewith will be immediately handed over to the prosecuting office. This is the wish of Chief Executive Officer Hannes Ametsreiter. “We will turn over every leaf and every cost estimate,” says Ametsreiter.

Hochegger's Biggest Assignments: Millions with ÖBB, Telekom and KHG

Buwog Commission–9.6 Million Euros: During the selling of government-owned apartments, lobbyists Walter Meischberger and Hochegger took in 7.7 million and 1.9 million euros, respectively.

KHG Consulting–3 Million Euros: Between the years 2000 and 2003, the ministry of finance [i.e. the treasury] headed by Karl-Heinz Grasser assigned projects to Hochegger's agency.

Telekom–25 Million Euros: The largest sum of money was amassed through the partially state-owned company. The agency made 10 million euros solely in PR services, such as organizing events and drafting press releases. An additional million euros was paid to Hochegger when he advised management on a new corporate structure. Hochegger's plans for state-employed colleagues also garnered him one million euros, this despite the fact that those plans never came to fruition. Hochegger was also brought on board to be a cheerleader for broadband; for this task too he received one million euros, with an additional million for the purchase of e–tel.

Telekom/Novomatic–600,000 Euros: Together, they wanted to break into the online gambling industry. Hochegger was to help.

Porr–200,000 Euros: Walter Meischberger and Hochegger took in money for unspecified services in Romania.

ÖBB-PR–6.1 Million Euros: Hochegger's agency was also doing lucrative business with the national railway.

- END -

Source: http://www.format.at/articles/1113/525/292874/lobbying-affaere-hochegger-die-millionen-deals

Add to Cart View detail

Huawei Investigated For Bribery in Obtaining Telekom Austria Contracts

Huawei's meteoric rise to one of the top three Information and Communication Technology (ICT) companies in the world is due in large part to its ability to undercut bids by other companies thanks to its status with the Chinese government as a "National Champion" firm. However, in the case of its sales to Telekom Austria (A1TA) between 2007 and 2009, it may also be due to bribery. An investigative report by FORMAT.at reveals that Huawei Austria's CEO signed an agreement to pay a ten percent "marketing fee" to Peter Hochegger, a former Austrian government lobbyist and PR consultant for all the A1TA business that he could deliver. Hochegger's influence and Huawei's money resulted in sales of over 130 million euros for the Chinese company, beating out regular Telecom Austria suppliers like Ericsson and Nokia Siemens Networks. According to an investigative report by FORMAT.at, once A1TA paid Huawei, Huawei Austria's CEO transferred 10% to a bank account (No: 155-40451-87448) at the Bank of Cyprus. The account belonged to Astropolis, a company owned by Hochegger and his associates. 


A1TA is now investigating all of its transactions with Huawei for possible criminal prosecution against the company. Not surprisingly, no one at Huawei is talking. The former head of Huawei Austria, Lu Hongwei has moved to the top position at Huawei Serbia and is "unavailable". Sun Zhengyang, his successor, has no comment. 


Sources:
Heise online 5 Apr 2011: http://bit.ly/e8keHk
TT.com 31 Mar 2011: http://bit.ly/fBZF75
Format.at 04 Apr 2011: http://bit.ly/i4Nu5f

Add to Cart View detail