5G Explained

Huawei began collaborating with U.S. companies in 2001, setting up U.S. offices and entering into the U.S. smartphone market through collaborations with Android and Alphabet (Google). The first legal dispute came in 2003, when Cisco accused Huawei of patent infringement for copying its router and network switch code. While the lawsuit ended in a settlement between Cisco and Huawei, U.S. concerns about Huawei continued. In May of 2013, unpublished documents, leaked by whistleblower Edward Snowden, revealed that the NSA had been spying on Huawei and its founder, Ren Zhengfei, since 2009, as part of “Operation Shotgiant.” The U.S. spying efforts did not find conclusive evidence that Huawei had been spying for the Chinese government, but U.S. concerns over Huawei continued and intensified. In August of 2010, eight Republican senators sent an open letter to various government departments and media organizations alleging that the company had been supplying telecom equipment to Saddam Hussein’s regime in Iraq, which violated UN trade sanctions. However, those accusations could not be substantiated at the time. But additional documents, leaked in July of 2019, revealed that, in 2008, Huawei had potentially violated a U.S. export ban by working with Panda International Information Technology to secretly build and maintain North Korea’s wireless mobile system. With concerns mounting, in 2012, the U.S. House Permanent Select Committee on Intelligence (HPSCI) declared Huawei and ZTE to be threats to national security. In 2014, Huawei again ran afoul of the U.S. legal system, as T-Mobile sued it over corporate espionage involving the theft of a robot design used to test touchscreens. A federal jury in Seattle ultimately awarded T-Mobile $4.8 million in damages, a small fraction of what T-Mobile had requested, but did not admit guilt.

Following roughly a decade of growing mistrust between the U.S. and Huawei, the U.S. has stepped up its legal action against the company, culminating in recent high-profile events that have dominated the national security headlines. In December of 2018, Canadian officials arrested Meng Wanzhou, who is Huawei’s CFO and the daughter of founder Ren Zhengfei, on behalf of the United States. The U.S. leveled charges that Huawei had violated economic sanctions imposed against Iran. The extradition proceedings is still ongoing, and, in February of 2020, Ms. Meng was personally indicted by the U.S. Department of Justice for trade secret theft. She remains in Canada under house arrest on C$10 million bail. In February of 2020, the U.S. charged Huawei with racketeering and conspiracy to steal trade secrets from American companies. The charges allege that Huawei conspired to steal trade secrets from five American firms (Cisco, Motorola, Quintel, T-Mobile, and CNEX) and the Japanese firm Fujitsu, including source code and manuals for wireless technology. The DOJ alleges that the criminal activity has been ongoing since at least 1999. Most recently, in June of 2020, the Trump administration designated Huawei as one of twenty Chinese companies it claimed to be backed by the Chinese military, and the FCC designated Huawei and ZTE national security threats. These actions prevent the use of federal funds for purchasing equipment from either company, while laying the groundwork for the administration to impose far-reaching financial sanctions.

The U.S. kept up its maximum pressure campaign against Huawei since early 2020, while other governments have wavered in their views of Huawei as an imminent national security threat. The British government, like the U.S., has raised security concerns about Huawei, and an internal report from the UK’s Huawei Cyber Security Evaluation Centre (HCSEC) concluded, in March of 2019, that Huawei equipment poses significant security risks. Initially, despite the report’s conclusions, the UK announced in January of 2020 that it would move forward with allowing Huawei equipment to be used in up to 35 percent of its radio access networks (RANs). As of today, the British government announced that it will bar all Huawei equipment from its 5G networks and set a deadline of 2027 for all existing Huawei equipment to be removed from its networks. The initial decision sparked immediate pushback from the U.S., as the UK is a key ally in intelligence sharing through the Five Eyes Alliance. However, the UK’s decision to ban Huawei is a major victory for the U.S. and puts increasing pressure on China, whose relationship with Europe is already facing increasing strain due to the outbreak of COVID-19. Experts disagree as to whether excluding Huawei from core networks will mitigate its risks, since 5G technology does not rely as heavily on a centralized core network to perform data-routing functions, but European countries have been increasingly excluding Huawei from their networks due to security concerns. Since mid-2020, France, Sweden, Poland, Slovakia, the Czech Republic, Hungary, Albania, Kosovo, Bulgaria, North Macedonia, Latvia, and Cyprus have all effectively banned Huawei, and Germany has enacted regulatory barriers that will effectively push Huawei out. Despite finding increasing success in Europe against Huawei, there are still key U.S. allies, such as Saudi Arabia and Brazil, that are continuing to work closely with Huawei on the development of their 5G networks, and Huawei is actively fighting back to regain access into critical European markets.

Update: Both the UK and Germany’s relationship with Huawei continues to evolve. For each country’s status as of publication, see our map in Part I.

Huawei’s Real Security Threat: Rushing Flawed Software to Market

While the security concerns surrounding Huawei’s 5G technology have predominantly concerned Huawei’s ties to the Chinese government, the potential for backdoors to be used for spying, and intellectual property theft, the most imminent security threat may actually be deficiencies in its software code. A 2012 White House review did not find any evidence of spying by Huawei, but it did find holes in Huawei’s source code, which made Huawei’s device software more vulnerable than its rivals. While Huawei denied that report, a 2019 review by the UK’s Huawei Cyber Security Evaluation Centre (HCSEC) backed it up. The HCSEC found that there were underlying defects in Huawei’s software code and security processes that could easily be exploited by governments or independent hackers. The report concludes that due to the number and severity of vulnerabilities, “if an attacker has knowledge of these vulnerabilities and sufficient access to exploit them, they may be able to affect the operation of the network, in some cases causing it to cease operating correctly.”

The HCSEC found that there were underlying defects in Huawei’s software code and security processes that could easily be exploited by governments or independent hackers.

Additionally, British officials concluded that Huawei has poor oversight of its supplier networks and does not have a clear process for reviewing the origin of component software and which suppliers are responsible for developing each piece of code. As a result, governments and companies installing Huawei equipment also do not have a clear understanding of where the code they are introducing into their networks originated from, thus handicapping their ability to isolate and trace potential threats. While the British government has explicitly raised these security concerns, as of this publication the UK has banned Huawei from participating in its 5G networks. While espionage and other security issues remain concerns, Huawei’s ability to quickly capture substantial market share has spread these vulnerabilities worldwide. That raises broader national security concerns in the development of 5G technology: 5G networks are likely to contain a wide range of general vulnerabilities, which could be exploited by any bad actor, not just the Chinese government.