5/2020 Who Controls Huawei? Implications for Europe
←
→
Page content transcription
If your browser does not render page correctly, please read the page content below
5/2020
Who Controls Huawei?
Implications for Europe
—
Tim Rühlig
PUBLISHED BY THE SWEDISH INSTITUTE OF INTERNATIONAL AFFAIRS | UI.SE
Tim Rühlig Research Fellow The Swedish Institute of International Affairs © 2020 The Swedish Institute of International Affairs Language editing: Andrew Mash Cover photo: TT/Shutterstock
Abstract Europe faces pressure from both the US and China over the question of whether to exclude the Chinese technology giant Huawei from the rollout of the new generation of mobile infrastructure, better known as 5G. Proponents of a ban argue that Huawei is controlled by the authoritarian Chinese party-state and the inclusion of its equipment would provide the Chinese authorities with the ability to shut down European 5G networks and use the 5G network for political and economic espionage. Huawei counters that it is a private sector company that would not support the Chinese authorities in gaining access to European 5G infrastructure. The salience of the controversy lies in the fact that like electricity, 5G will be a critical enabler that makes possible new applications that revolutionise methods of production, and of the provision of healthcare and transport, to name just two. From a purely technological perspective, a ban on Huawei would not be effective at increasing 5G network security. China is capable of shutting down Europe’s 5G network regardless of whether Huawei equipment is included in it. Chinese cyberespionage presents a huge challenge but almost all economic or political spying is carried out by means of applications and phishing, rather than through infrastructure. Network redundancies coupled with vendor diversity and better end-to-end encryption are much more effective means of mitigating these risks. The idea of excluding Huawei instead follows a geopolitical logic at a time when states are using economic dependencies for political purposes. The fear is that the Chinese party-state could leverage technological dominance and dependence on Huawei equipment to gain political concessions from Europe. However, this would require that Huawei functions not as a normal corporation, but effectively be controlled by the Chinese Communist Party. This paper provides a very detailed analysis of how the Chinese party-state can exercise control over the company. Huawei is a fully privately owned company, but I contend that the owners do not have complete control over it. All this raises the question of what measures Europe should take. The United Kingdom (UK) and the European Union have drafted policies that are widely characterised as compromise proposals. This paper demonstrates that this assessment is misleading. The UK’s draft decision, which is to be adopted by parliament before the summer, provides far-reaching opportunities for Huawei to participate in the rollout of 5G. The EU’s “toolbox” – a legally non-binding document jointly developed by all member states, the European Commission and its cybersecurity agency, ENISA – provides a roadmap away from Huawei technology but remains open to interpretation. EU member states should adopt a unitary interpretation of the toolbox. A complete ban on Huawei from the rollout of European 5G might not be necessary, but the EU and its member states should strive for a significant reduction in Huawei’s market share. © 2020 The Swedish Institute of International Affairs
Introduction spheres of economic and social life.
Australian and US intelligence agencies
When the US delegation arrived at the (among others) warn that such risks could
Munich Security Conference in mid- materialise if Chinese technology is
February 2020, it had a rare bipartisan included in 5G infrastructure. The fear is
message for Europe: let us unite against that Chinese equipment could enable the
China! At its core was the US call to exclude Chinese party-state to spy on the users of
the Chinese technology giant Huawei from the infrastructure and to shut down the
the rollout of the new generation of mobile mobile network entirely. 4 This could provide
infrastructure in Europe, better known as China with political leverage. I refer to these
5G. US Secretary of Defence Mark Esper two challenges – espionage and sabotage
called on all European Union (EU) member through 5G infrastructure – as network
states to follow the US example and exclude security risks. Concerns over Chinese
Huawei. 1 The Democratic Speaker of the espionage and attacks on the availability of
House of Representatives, Nancy Pelosi, 5G infrastructure are well-grounded.
argued that Europe had a choice between
autocracy (by allowing Huawei in) or Apart from network security risks, concerns
defending democracy. 2 over the inclusion of Chinese 5G equipment
stem from the potential for technological
Like electricity, 5G is a critical enabler that dependencies to develop. Recent years
could bring with it new applications and have witnessed a “weaponisation of
opportunities that cannot yet be imagined; economics”. Trade, investment and
it has true revolutionary potential. Apart technology have not just been about
from increasing upload and download competition among commercial entities,
capacities, 5G comes with ultra-low latency but states considering whether and how
coupled with high reliability and offers the they can utilise technological dependencies
ability to connect a high number of devices. to press for political concessions. The basic
This will be necessary for a wide range of idea is that a state that relies on the
applications ranging from self-driving cars technology of another state will behave
to a new wave of automation of production more favourably towards that state because
by means of mass machine-to-machine it is aware of the dependencies that result
communication: 5G could permeate and from the need to maintain increasingly
change entire societies. 3 software-defined high technology and to
further build out its critical infrastructure. I
The enormous potential of 5G comes with refer to this as the geopolitical challenge of
risks. If a malign actor were to take control technology dependencies. For this
of the network, it would affect almost all geopolitical challenge to materialise, states
1 Mark T. Esper, "Secretary of Defense Speech. As 3 Edison Lee and Timothy Chau, Telecom Servies. The
Prepared Remarks by Secretary of Defense Mark T. Geopolitics of 5G and IoT. Jefferies Franchise Note,
Esper at the Munich Security Conference " U.S. Hong Kong, Jefferies, 2017; EMF Explained Series, "5G
Department of Defense, accessed: 2020-03-27, at: Explained – How 5G Works," EMF Explained, accessed:
https://www.defense.gov/Newsroom/Speeches/Spee 2019-04-16, at:
ch/Article/2085577/remarks-by-secretary-of-defense- http://www.emfexplained.info/?ID=25916; Matthew
mark-t-esper-at-the-munich-security-conference/. Wall, "What is 5G and What WIll It Mean for You?,"
2 Nancy Pelosi, "Speaker Pelosi Remarks at Munich BBC, accessed: 2020-03-27, at:
Security Conference," U.S. House of Representatives, https://www.bbc.co.uk/news/business-44871448.
accessed: 2020-03-27, at: 4 David Bond and James Kynge, "China Spying Risk
https://www.speaker.gov/newsroom/21420-1. Hits Huawei's UK Ambitions," Financial Times, 3
December 2018.
© 2020 The Swedish Institute of International Affairs 4must control technological supply. 5 The review two recent developments: the UK’s
geopolitics of technological dependencies draft decision on the rollout of 5G
raise the question of whether and, if so, how technology, which is to be adopted by the
the Chinese party-state is controlling British parliament before the summer, and
Huawei, which claims to be a private sector the toolbox of recommendations jointly
company owned by its employees. developed by the EU member states, the
European Commission and its cybersecurity
Network security risks and the geopolitics of agency, ENISA. Both documents have been
technological dependencies are serious widely interpreted as compromises. I
concerns for Europe. However, the widely demonstrate that the UK’s decision leaves
discussed exclusion of Huawei does not plenty of room for Chinese vendors to
address the network security challenge. If participate in the rollout, and that while the
anything, the exclusion of Huawei instead EU toolbox recommends a restrictive
follows a geopolitical logic. approach, the toolbox contains some
vagueness that is likely to allow EU member
Since issues of network security have been states to interpret the document in different
discussed in depth elsewhere, 6 this paper ways.
only summarises this aspect and focuses
instead on party-state control over Huawei. This leads me to the final conclusion that if I
Given that the exclusion of Huawei is a am correct in my contention that the party-
geopolitical question, party-state control state can control Huawei and other tech
over technology companies is decisive for giants, this should remind the EU that the
the question of how Europe, be it the EU or issue is not just about network security, but
the United Kingdom (UK), should react to has a geopolitical dimension. The toolbox
US demands for a ban on Huawei. takes this into account by considering
strategic measures without ruling out the
First, I briefly summarise why network possibility that the geopolitical risks could
security risks are severe but not decisive for be mitigated without a full ban of Huawei.
the question of whether to ban Huawei This would require a unitary interpretation
from the buildout of 5G infrastructure in and implementation of the toolbox across
Europe. Next, I turn to the question of the continent, which is unlikely, coupled
whether Huawei is controlled by the with a diversification strategy. The latter
Chinese party-state and thus serves as a should generate strategic access to
potential political instrument of China. Not technology, reduce the EU's dependency on
least based on information provided by the Chinese technology and remove the risk of
company itself, I contend that the party- the EU having to accept political
state has mechanisms that allow it to concessions due to its technological
exercise control over Huawei. While dependency. I am sceptic of whether a
network security risks do not justify a ban complete ban on Huawei is desirable, but
on Huawei, the Chinese state’s control over EU member states should strive for a
the company could make such a decision reduction in Huawei’s market share.
reasonable from a geopolitical perspective.
Bearing these two perspectives in mind, I
5 Douglas Black, "Huawei and China. Not Just Technology Dependency in Europe," UI Paper 1/2020,
Business as Usual," Journal of Political Risk 8: 1, 2019, Stockholm, The Swedish Institute of International
pp. Affairs, 2020.
6 Tim Rühlig and Maja Björk, "What to Make of the
Huawei Debate? 5G Network Security and
© 2020 The Swedish Institute of International Affairs 5Huawei: a risk for the 5G target the whole of European society and its
economy. This “kill switch”, as it is
networks in Europe? commonly known, would essentially
undermine the availability of 5G networks
Over the past 18 months, a heated debate
that will be necessary for machine-to-
over 5G infrastructure deployment has
machine communication as well as for self-
developed in Europe with the Chinese tech
driving cars or interconnected medical
giant Huawei at its centre. At the core of the
devices, such as pacemakers.
discussions are concerns over network
security. While it is not clear that 5G is
The risk of Chinese espionage describes a
generally less secure than the current
scenario in which China uses its access to 5G
4G/LTE networks, the complexity of 5G
infrastructure for economic and political
networks poses a new security challenge.
espionage on European companies,
This complexity is the result of the
governments and individuals. China is
multitude of applications and devices that
already responsible for the lion’s share of
will be part of future 5G networks. This is
global cyber espionage. 8
made possible by the increased use of
software-defined virtualisation, which shifts
These two risk scenarios appear more
sensitive operations from the core network
feasible since a British evaluation centre
to the edge. This makes the attack surface
found significant software engineering and
larger and means that a distinction between
cybersecurity problems in Huawei
a sensitive core network technology and a
equipment and reported that the Chinese
less-sensitive edge and its radio access
company is failing to resolve these
network (RAN) no long applies. 7
challenges. 9 Despite all the reporting about
a “smoking gun”, however, there is no proof
The sensitivity and vulnerability of 5G
that China is using such vulnerabilities or
networks has led to fears that the
that Huawei is designing backdoors. 10 This
participation of Chinese vendors in the
assessment has not changed even after the
deployment of 5G could come with inherent
German newspaper Handelsblatt reported
security risks. At the heart of these concerns
that the US administration had presented
are two fears: Chinese sabotage of and
evidence of a smoking gun to the German
espionage through 5G infrastructure.
authorities.11 In the briefing, US officials
Sabotage is the most severe concern: China
argued that Huawei has had access to all
could gain access to European 5G
mobile communication since 2009 by
infrastructure that would allow it to shut
means of lawful interception interfaces that
down the entire network, and thereby
are included in the equipment for the
7 Tim Rühlig and Maja Björk, "What to Make of the 10 Reed Steveson, "How Huawei Became a Target for
Huawei Debate? 5G Network Security and Governments," Bloomberg, accessed: 2020-03-28, at:
Technology Dependency in Europe," UI Paper 1/2020, https://www.washingtonpost.com/business/how-
Stockholm, The Swedish Institute of International huawei-became-a-target-for-
Affairs, 2020. governments/2019/11/22/302af044-0d4f-11ea-8054-
8 Kadri Kaska et al., Huawei, 5G and China as a 289aef6e38a3_story.html.
Security Threat, Tallinn, NATO Cooperative Cyber 11 Reuters, "Huawei Denies German Report it Colluded
Defence Centre of Excellence, 2019. with Chinese Intelligence," Reuters, accessed: 2020-
9 Huawei Cyber Security Evaluation Centre Oversight 02-27, at: https://www.reuters.com/article/us-
Board, "Annual Report," HCSEC, accessed: 2019-08- germany-usa-huawei/huawei-denies-german-report-
09, at: it-colluded-with-chinese-intelligence-
https://assets.publishing.service.gov.uk/government/ idUSKBN1ZS197.
uploads/system/uploads/attachment_data/file/790270
/HCSEC_OversightBoardReport-2019.pdf.
© 2020 The Swedish Institute of International Affairs 6purpose of law enforcement. These officials states are more hesitant and considering
declined, however, to provide any evidence. different measures. Such hesitation is well
Apart from the German Foreign Ministry, it justified because a ban on Huawei would
appears that none of the German officials not be an effective means of mitigating the
present at the meeting were convinced. 12 network security risks. Hackers and
The German operator Deutsche Telekom engineers agree that China will be able to
clarified that its legal interception interfaces shut down European 5G infrastructure
are not produced by Huawei but by a regardless of whether Huawei participates
German company.13 Moreover, the in the rollout. Moreover, most espionage is
accusations came at a time when the US not carried out through 5G infrastructure,
itself was under pressure because a US but through applications and phishing. 15
supplier, Cisco, had just closed
vulnerabilities in its own technology, and At the same time, more effective means are
both German and US intelligence were available for mitigating network security
facing pressure for having spied on allies for risks. The most effective are better end-to-
decades using an encryption manufacturer end encryption, which makes spying
they owned, Crypto AG. 14 difficult; and network redundancies that
increase the availability of coverage coupled
This lack of a smoking gun, however, should with vendor diversity. Vendor diversity
not reassure Europeans. In the light of the relies on the assumption that all 5G
wide variety of use cases mentioned above, equipment will contain vulnerabilities, but
5G will be a critical infrastructure. It would different suppliers’ equipment will come
therefore be reckless only to react to what with different kinds of vulnerabilities which
has already happened without considering will impose higher cost for attackers to
risks. The risks are real and severe. The identify and effectively exploit them. 16
question is how to mitigate them. These means could be combined with
improved evaluation and certification of
The US, Australia and Japan have decided products and processes, including source
to exclude Huawei altogether from the code reviews or network flow monitoring.
rollout of their 5G infrastructure. Other Such actions would be of limited value,
12 Patrick Beuth and Marcel Rosenbach, "Eine China's Elite Hackers Stole the World's Most Valuable
Hintertür, die nur die USA sehen," Der Spiegel, Secrets," Wired, accessed: 2020-03-28, at:
accessed: 2020-02-27, at. https://www.wired.com/story/doj-indictment-
13 Bojan Pancevski, "U.S. Officials Say Huawei Can chinese-hackers-apt10/; FireEye, "Mandiant APT1.
Covertly Access Telecom Networks," Wall Stree Exposing One of China's Cyber Espionage Unites,"
Journal, accessed: 2020-02-27, at: FireEye, accessed: 2020-03-28, at:
https://www.wsj.com/articles/u-s-officials-say- https://www.fireeye.com/content/dam/fireeye-
huawei-can-covertly-access-telecom-networks- www/services/pdfs/mandiant-apt1-report.pdf;
11581452256. Thomas Brewster, "Chinese Trio Linked to Dangerous
14 ZDF, "Operation Rubikon. Wie BND und CIA die APT3 Hackers Charged with Stealing 407GB of Data
Welt belauschten. Fontal 21 vom 11. Februar 2020," from Siemens," New York, accessed: 2020-03-28, at:
ZDF, accessed: 2020-03-28, at: https://www.forbes.com/sites/thomasbrewster/2017/1
https://www.zdf.de/politik/frontal-21/operation- 1/27/chinese-hackers-accused-of-siemens-moodys-
rubikon-100.html. trimble-hacks/.
15 Jan-Peter Kleinhans, 5G vs. National Security. A 16 Deutscher Bundestag, "Experten gegen Ausschluss
European Perspective, Berlin, Stiftung Neue von Anbietern beim Mobilfunkstandard 5G. 22
Verantwortung, 2019. Compare to reports on November 2019," Deutscher Bundestag, accessed:
previous Chinese hacks: PwC, "Operation Cloud 2020-03-28, at:
Hopper," PwC, accessed: 2020-03-28, at: https://www.bundestag.de/dokumente/textarchiv/201
https://www.pwc.co.uk/cyber-security/pdf/cloud- 9/kw46-pa-auswaertiges-5g-665414.
hopper-report-final-v4.pdf; Brian Barrett, "How
© 2020 The Swedish Institute of International Affairs 7however, since evaluation is made more the control of China’s authoritarian rulers.18
difficult by the need for extensive Huawei has countered this view by
maintenance work on the software through emphasising that the company is almost
regular and extensive updates and security fully owned by its employees and is not a
patches, as well as the large amounts of state-owned enterprise (SOE) like ZTE,
data flows. However, coupled with end-to- another Chinese technology firm. Are
end encryption, redundancies and vendor Huawei’s critics getting it right or is the
diversity, they could contribute to network company victim of an anti-Chinese witch
security, particularly if remote access for hunt?
maintenance work is made impossible. 17
While at first glance Huawei’s line of
In sum, a ban on Huawei would not defence appears convincing, there are also
effectively address the risks of sabotage or reasons for doubt. It is true that the
espionage. Instead, such exclusions company is privately owned by its
decrease Huawei’s technological influence employees, but there is reason to believe
in the world and reduce the company’s that ownership does not come with control,
global market share. From a purely network as I discuss below. While there is also little
security perspective this does not help. If reason to believe that the company has a
the geopolitical considerations of states particular interest in serving political
aiming to utilise technological purposes, Huawei has not only profited
dependencies to extract political from party-state support, but is operating in
concessions are taken into account, a a specific political, legal and economic
reduced market share could harm Chinese environment that makes it impossible for
global political ambitions. A precondition the company to be fully independent. At
for such a conclusion would be, however, least four aspects lead me to question
that Huawei is controlled by the Chinese Huawei’s independence: (a) the general
party-state and can be utilised by the level of independence of privately owned
Chinese Communist Party (CCP). companies in China; (b) the legal
environment, particularly China’s
Technical dependency and Intelligence Law; (c) party-state support for
Huawei; and (d) the governance structure of
the issue of party-state the company itself.
control over Huawei
(a) The role of privately owned companies in
Underlying the geopolitical dimension of China. The widespread distinction between
the debate over Huawei is the fear that the privately owned enterprises (POEs) and
Chinese party-state could leverage state ownership is not decisive in China. It is
European dependence on Huawei not ownership but the issue of “state
technology to extract political concessions. capture” that is pivotal. If supported by the
This perspective implies that Huawei cannot party-state, SOEs and POEs enjoy equal
be treated just like any other private sector treatment with regard to access to the
company that seeks economic profit, but market, state subsidies, procurement and
should be regarded as a political tool under the exercise of political guidance. Milhaupt
17 for a
more detailed discussion of 5G network Stockholm, The Swedish Institute of International
security and adequate measures to mitigate the risks Affairs, 2020.
see Tim Rühlig and Maja Björk, "What to Make of the 18 Rick Umback, Huawei and Telefunken.
Huawei Debate? 5G Network Security and Communications Enterprieses and Rising Power
Technology Dependency in Europe," UI Paper 1/2020, Strategies. ASPI Strategic Insights 135, Barton, ASPI,
2019.
© 2020 The Swedish Institute of International Affairs 8and Zheng have rightly pointed out that companies in particular – regardless of
“Chinese state capitalism is closely ownership – as well as those in strategic
associated with state capture. That is, large sectors profit from state support, which
firms in China – whether SOEs, POEs, or comes with significant party-state
ambiguous state-private blends – survive influence. Huawei is a national champion
and prosper precisely because they have operating in a particularly critical sector.
fostered connections to state power and
have succeeded in obtaining state- Following an official request, Huawei has
generated rents. As a result, large firms in confirmed to the author of this paper that
China exhibit substantial similarities in their party organisations exist within the
relationship with the state in ways that company in accordance with Chinese law.
distinctions based on corporate ownership The company has provided assurances that
simply do not pick up”. 19 party organisations have no influence on
the company’s business operations and that
POEs and the party-state are interwoven. A it is run by an independent management
large proportion of the economic elite holds team. The party organisations are mainly
positions within the CCP. Based on publicly responsible for educating employees. The
available information, 95 of the top 100 general findings on the deep linkages
private sector firms and eight of the top ten between the economic and political elites,
internet firms have a founder or de facto however, call into question whether such
controller who is currently or was formerly a differentiation is adequate in the context of
member of a central or local party or party- China’s political economy.
controlled state organ. 20 These figures are
based on publicly available data, and are (b) The legal environment in China. China
thus likely to be a conservative calculation. lacks an independent judiciary. While the
The days when the CCP stood in opposition CCP government speaks of strengthening
to capitalism and entrepreneurs are long the role of law in its governance, it follows a
gone. POEs also directly profit from rule by law principle and does not intend to
subsidies. When the privately owned Geely implement the rule of law. The CCP has an
acquired the Swedish car company Volvo essentially instrumentalist understanding of
from Ford in 2010, for example, local law. Law is seen not as a constraint on
governments from north-east China and the power, but as a means of power. This means
Shanghai area financed a large proportion that legal certainty does not exist in areas of
of the $1.5 billion purchase. 21 There is crucial political importance. Hence, laws do
control over interest rates and the state- not provide reassurance against political
dominated banking sector at times provides interference in the business operations of
loans at below market prices, while Chinese companies.
preferential treatment in procurement and
public listings as well as the protection of In the context of the Huawei debate, several
regional or even national monopolies in laws, in particular China’s Intelligence Law,
combination with corruption and coterie raise even further doubts about whether the
preserve a high level of state control over law could shield private sector companies
the entire economy, including POEs. Large from political interference. Article 7 of the
19 Curtis J. Milhaupt and Wentong Zheng, "Beyond 21 Michael Wines,
"China Fortifies State Businesses to
Ownership. State Capitalism and the Chinese Firm," Fuel Growth," CNBC, accessed: 2020-03-28, at:
The Georgetown Law Journal 103: 3, 2015, pp. 665-722. https://www.cnbc.com/id/38910346.
20 Curtis J. Milhaupt and Wentong Zheng, "Beyond
Ownership. State Capitalism and the Chinese Firm."
The Georgetown Law Journal 103: 3, 2015, pp. 665-722.
© 2020 The Swedish Institute of International Affairs 9Intelligence Law enacted in 2017 and overlaps exist between US high-tech firms
amended in 2018 requires any organisation and the US intelligence services.
and citizen to “support, assist in and
cooperate in national intelligence work”.22 While there is no doubt that Huawei can
Confronted with this law, Huawei refers to a compete with Western technology
legal opinion that the company would not companies on both quality and price, a
need to cooperate with Chinese recent Wall Street Journal report indicated
intelligence. Not least in the light of the lack that the company has achieved its current
of the rule of law in China, but also given the position by receiving as much as $75 billion
clarity of the Intelligence Law, this legal in tax breaks, financing and cheap resources
opinion does not provide any substantial in the past 25 years. According to the
reassurance that Huawei could decline to report, Huawei profited from $46 billion in
cooperate with Chinese intelligence, even if cheap loans, credit lines and other support
the company wanted to do so. 23 from state lenders alone. Between 2008 and
2018, the company saved $25 billion in
(c) Party-state support for Huawei. taxes due to state incentives to promote the
Scepticism over Huawei’s independence tech sector. In addition, the company would
from party-state control does not just stem have profited from cheap loans for its
from the political, legal and economic customers provided by Chinese banks. The
environment in which it operates. An China Development Bank and the Export-
analysis of organisational and personal Import Bank of China are reported to have
linkages between the CCP and the Chinese lent $30 billion to Huawei customers. 26
security apparatus on the one hand and the Already in 2013, Nathaniel Ahrens was
company on the other indicates that pointing out the irony of the SOE ZTE
Huawei is no exception to the general rule. having to turn to the equity markets while
Huawei’s founder, Ren Zhengfei, is widely the privately owned Huawei relied on state
believed to have a past in China’s People’s funds. 27 Huawei has denied the accusations
Liberation Army. His daughter and the in the Wall Street Journal report.
company’s Chief Financial Officer, Meng
Wanzhou, is suspected to have held a public In the light of the multitude of reports of
affairs passport. 24 A widely discussed and party-state assistance for the company, it
controversial analysis of the CVs of leading seems very likely that Huawei has profited
Huawei engineers found a large overlap from massive party-state support. All this is
with China’s security apparatus. 25 Anecdotal not to say that Western technology
evidence suggests, however, that similar companies do not receive financial support
22 Peking University Law Database, "National 25 Christopher Balding, "Huawei Technologies' Links
Intelligence Law of the People's Republic of China. to Chinese State Security Services," SSRN, accessed:
2018 Amendment. Effective," PKULaw, accessed: 2019-07-28, at:
2020-03-28, at: https://papers.ssrn.com/sol3/papers.cfm?abstract_id=
https://en.pkulaw.cn/display.aspx?cgid=313975&lib=la 3415726.
w. 26 Chuin-wei Yap, "State Support Helped Fuel
23 Donald Clarke, "The Zhong Lun Declaration on the Huawei's Global Rise," Wall Street Journal, accessed:
Obligations of Huawei and Other CHinese Companies 2020-02-09, at: https://www.wsj.com/articles/state-
under Chinese Law," SSRN, accessed: 2020-03-28, at: support-helped-fuel-huaweis-global-rise-
https://papers.ssrn.com/sol3/papers.cfm?abstract_id= 11577280736.
3354211. 27 Nathaniel Ahrens, China's Competitiveness. Myth,
24 Ashley Feng, "We Can't Tell if Chinese Firms Work Reality, and Lessons for the United States and Japan.
for the Party," Foreign Policy, accessed: 2019-02-15, Case Study: Huawei, Washington D.C., CSIS, 2013.
at: https://foreignpolicy.com/2019/02/07/we-cant-tell-
if-chinese-firms-work-for-the-party/.
© 2020 The Swedish Institute of International Affairs 10from their governments. Both Finland’s Huawei is not the trade union for Huawei
Nokia and Sweden’s Ericsson, for example, Technologies. 29 At first glance,
benefit from export credits. The scope of Balding/Clarke’s assessment is convincing.
their government support, however, falls far For the purposes of this paper, I reached out
short of Huawei’s. to the company to ask for clarification. The
results are surprising as the information
(d) Huawei’s governance structure. Huawei’s provided by Huawei gives an indication of
ownership and governance structures are how difficult it is to run an independent
highly complex. This has sparked rumour company in such a crucial sector in China.
and speculation across the West’s media as Balding/Clarke’s assumptions are refuted.
well as academic and policy debate over While this paper leaves open a few
who controls the company. Three reports in questions, it provides one of the most
particular have contributed to the present detailed analysis of the governance
understanding of Huawei’s governance structure of Huawei that to my knowledge
structure. Duchâtel/Godement and Seely et has been published so far.
al. claim that Huawei’s ownership structure
is based on a trade union. Both papers Most fundamental to the widespread
argue that since trade unions are under the confusion is that there is more than one
control of the CCP, it is the Party that has “Huawei” entity. Most of the technology
the ultimate say over the tech giant. Where discussed is produced by an entity known as
both papers fall short, however, is in terms “Huawei Technologies”, which is fully
of a detailed description how the CCP exerts owned by another entity, “Huawei Holding”.
its control over the company. 28 Huawei Holding, in turn, is owned by the
Balding/Clarke, in turn, reviews publicly Trade Union of Huawei Holding and the
available documents and concludes that founder of the company, Ren Zhengfei (see
control is not carried out through a trade figure 1).
union because the entity that formally owns
28Mathieu Duchâtel and Francois Godement, Europe 29 Christopher Baldingand Donald Clarke, "Who Owns
and 5G. The Huawei Case, Paris, Institut Montaigne, Huawei?," SSRN, accessed: 2020-03-28, at:
2019; Bob Seely et al., Defending Our Data. Huawei, https://papers.ssrn.com/sol3/papers.cfm?abstract_id=
5G and the Five Eyes, London, Henry Jackson Society, 3372669.
2019.
© 2020 The Swedish Institute of International Affairs 11Figure 1: Ownership structure of Huawei. Source: Author’s own graphic, based on information
obtained from Huawei
Of crucial importance is the status of the called Employee Stock Ownership Plan
Union of Huawei Holding, which is (ESOP) is run through the Union. Under the
registered with the Shenzhen Federation of ESOP, the employees of Huawei
Trade Unions and operated and managed in Technologies have – under certain
accordance with China’s Trade Union Law. conditions – the opportunity to purchase
Academic analyses of the official trade shares in Huawei Holding. Currently, around
union system (with the All-China Federation 97,000 employees hold more than 22 billion
of Trade Unions, of which the Shenzhen shares in Huawei Holding. It is important to
Federation of Trade Unions is a member, at note that only around half of Huawei’s
its core) have underlined that there are no 190,000 employees participate in the ESOP.
independent trade unions in China. 30 They Participation depends on work
are all controlled by the CCP and Article 4 of performance. Non-Chinese employees of
the Trade Union Law explicitly requires Huawei are not eligible to participate in
them to “insist on the leadership of the ESOP. Huawei justifies this with reference
Chinese Communist Party”. 31 The nature of to capital account controls. In addition,
the Union of Huawei Holding as the owner shareholders cannot sell their shares to non-
of the Huawei Company group has led Huawei employees.
observers to argue that the CCP controls
Huawei Holding and by extension also Shareholders have the right to elect a
Huawei Technologies. Representatives’ Commission comprising
115 representatives, which in turn elects the
Huawei has rejected this claim. It argues Board of Directors and the Supervisory
instead that the Union of Huawei Holding is Board. Both these vote for their respective
a single legal entity with two completely Executive Committees. The Executive
separate roles. On the one hand, the Union Committee of the Board of Directors has
serves as a Trade Union with a Trade Union seven members and is particularly
Committee. On the other hand, and important since three of them take the role
completely separate from its first role, a so- of rotating chair (see figure 2). This complex
structure is necessary because China’s
30Mathieu Duchâtel and Francois Godement, Europe 31 International Labour Organization,"Trade Union
and 5G. The Huawei Case, Paris, Institut Montaigne, Law of the People's Republic of China. 2009
2019; Bob Seely et al., Defending Our Data. Huawei, Amendment. Effective," ILO, accessed: 2020-03-28,
5G and the Five Eyes, London, Henry Jackson Society, at:
2019. https://www.ilo.org/dyn/natlex/docs/ELECTRONIC/30
352/118793/F1165849917/CHN30352%202.pdf.
© 2020 The Swedish Institute of International AffairsCompany Law limits the number of
shareholders that non-listed limited liability
companies such as Huawei can have.
Graph 2: Huawei’s governance structure. Source: Own graphic, based on information obtained from
Huawei.
Huawei claims that, even though it governs though it is in charge of running the trade
the Union of Huawei Holding, the Trade union of Huawei Holding. They argue that it
Union Committee has no power over the is implausible that the governing body of an
Representatives’ Commission. Huawei is entity would control only part of the
explicit that both entities are governed by organisation.33
different laws (the Trade Union Law and
Chinese Company Law). If this is correct, While it is difficult to judge from the outside
the nature of the Union of Huawei Holding whether the company or its critics are
as a trade union does not give the party- correct, another element in the complex
state control over the company, as claimed governance structure is remarkable: the
by Duchâtel/Godement and Seely et al. 32 nomination process for the election of the
Representatives’ Commission. For the
Confronted with Huawei’s statements in process, the company is divided into nine
interviews conducted for this study, some sectors each of which “undergoes a
observers doubt the claims that the Trade democratic process of organising,
Union Committee does not have control discussing and agreeing on a proposed list
over the Representatives’ Commission even of members for their own nomination
32Bob Seely et al., Defending Our Data. Huawei, 5G Europe and 5G. The Huawei Case, Paris, Institut
and the Five Eyes, London, Henry Jackson Society, Montaigne, 2019.
2019; Mathieu Duchâtel and Francois Godement, 33 Author telephone interviews with experts
investigating Huawei, December 2019-March 2020.
© 2020 The Swedish Institute of International Affairs 13team”. This is a decisive loophole in and providing constructive Huawei’s structure. Following a request for recommendations and independent clarification of this process for this paper, assessment of Huawei’s future the company responded that formation of development”. Huawei also emphasises the nomination team, which usually has 7–9 that many senior managers in US tech members, varies across sectors. In some companies began as engineers and rose sectors, a group of 40 to 50 people discusses through the ranks. Sustained contributions the composition of the nomination team, to the company are assessed using such while in others it is just 12–13 members of factors as: a candidate’s contributions and the sector. Either way, only “key accomplishments since joining Huawei; a employees, experts and line managers who candidate’s dedication; and a candidate’s have worked at Huawei for many years” are willingness to develop and learn new involved, according to the company. business knowledge that can help gain the According to official statements to the “competency required to address the author of this paper, Huawei has no specific company’s future needs for business rules on who can participate or how the development”. process of forming the nomination team works in each sector. This is critical because In a next step, the nomination team narrows nomination teams have far-reaching the resulting list of more than 500 potential competences. First and foremost they candidates down to 109 names, based on select an initial list of 500 candidates based presentations and questionnaires. Again, on relatively vague criteria. Even though the assessment criteria are relatively vague this is not proof of party-state influence, the and similar to those used in the first round. fact that only some employees influence The questionnaires aim to assess the such a crucial nomination process and that determination and passion of the potential the company lacks clear criteria for the candidate and their intentions if elected, composition of nomination teams opens the and to obtain a summary of past door for political influence. achievements. It is not only the procedural criteria for the After the nomination process is completed, formation of nomination teams that are all the ESOP participants can elect 83 vague, so are the criteria the nomination representatives from a list of 109 candidates teams use to nominate candidates. nominated to the Representatives’ According to the company, candidates must Commission. A further 32 members of the be current ESOP beneficiaries, they must Commission are ex-officio, making up the have worked at Huawei for at least eight remaining seats of the 115-member years, they must have exhibited Commission. This clearly demonstrates that outstanding work performance and they the main control over Huawei does not lie must keep contributing to the company. In with the employees of the company, who addition, sectors may add specific criteria. can only choose 83 people from a pre- Work performance, according to Huawei, selected list of 109 candidates, but with the refers to an employee’s “spirit of nomination teams that hand-pick these dedication” and “passion and commitment people using vague criteria. Whoever wants to work” as well as to “tangible to control Huawei needs to control the contributions to the company through day- nomination teams. There are no adequate to-day work, including having an in-depth checks in place to ensure that it is not the understanding of business related to the Chinese Communist Party and its job, achieving the major goals of the job, © 2020 The Swedish Institute of International Affairs 14
organisations within the company that are fact that it is such an opaque and vague
the ones exercising such control. structure raises suspicion. What it makes
exceedingly likely, however, is that contrary
It is important to note that Huawei claims to Huawei’s claims, employees do not
that membership of the Chinese effectively control the company. They can
Communist Party “does not affect […] the only elect pre-selected candidates and are
chances of becoming a Representative” or not aware of how they are nominated.
the results of any other election in the Ownership and control are separate.
company. Huawei states that it “never
checks whether or not employees are In the light of these four factors – the
members of the Chinese Communist Party; general level of independence of the POEs,
nor do we need to do so. The Chinese the legal environment and Intelligence Law,
Communist Party organisation does not state support for Huawei and the company’s
participate in the nomination or election governance structure – it is very difficult to
process of the Representatives’ reject the claims of Huawei critics that the
Commission, or extend any influence over company is more than just a privately run
this process”. The challenge is, however, company striving for economic profit. This
that Huawei has no mechanisms in place to is, however, nothing specific to China or to
guarantee that the party does not interfere. Huawei. State influence over private sector
In the light of the close interlinkages companies exists in Europe too. France is
between the economic and political elites in famous for such linkages, and even
China more generally, as briefly Volkswagen is effectively governed by the
summarised above, it appears improbable German public authorities by means of a
that the nomination teams are not specific law (often referred to as the “VW
dominated by party members. Given the law”). What makes Chinese party-state
widespread congruence of the political and control over Huawei distinct is not the
economic establishment in China, it might control as such, but that the Chinese tech
not even appear unnatural or remarkable to giant produces equipment for critical digital
anyone within Huawei or in China that party infrastructure.
membership and nomination team
participation should strongly correlate. Europe reacts to the “Huawei
Some room for speculation remains, but the
loopholes are obvious. challenge”
What sparks further suspicion of the process The complex picture of network security
is that none of the Huawei employees I have risks coupled with geopolitical concerns
talked to was aware of the nomination over technology dependency and party-
process, even though it turns out that real state control raises questions about what
power of selection lies with the nomination Europe’s response should be. Analytically, it
teams. Their composition was also is possible to differentiate between two
apparently unclear to all the Huawei different types of response. 34 One approach
employees I asked about it. Some did not focuses on national security and geopolitics
even know that there were nomination using political criteria. This is what underlies
teams. While this does not prove that the “Prague Proposals” developed in 2019
Huawei is controlled by the party-state, the by a group of Western states. 35 The second
34Tim Nicholas Rühlig et al., 5G and the US–China 35 Government of the Czech Republic, "Prague 5G
Tech Rivalry – a Test for Europe’s Future in the Digital Security Conference Announced Series of
Age. SWP Comment 29, Berlin, SWP, 2019. Recommendations. The Prague Proposals," Czech
© 2020 The Swedish Institute of International Affairs 15approach focuses on network security and such as nuclear power plants and
instead considers technical measures to military bases;
contain primarily technological risks. This a reduction in Huawei’s share of the
distinction helps to understand the remaining market to 35%.
responses of different states. In reality,
however, most states adopt a combination The British decision to reduce Huawei’s
of both perspectives, while leaning towards market share to no more than 35% is a
either national security/geopolitics or response to the risk of technology
network security/cybersecurity. Two recent dependency. Hence, the UK is also
and particularly important examples leaning considering geopolitics to some extent.
in opposite directions are the decision taken
in the UK and the EU’s toolbox. The distinction between Core Network and
Radio Access Network, however, is puzzling
In the absence of evidence of network and can only be a temporary solution. In this
security challenges, the UK published its respect, it is important that 5G will be rolled
decision at the end of January 2020, mainly, out in two phases. In a first step, 4G/LTE
but not exclusively, adopting a network networks will be “updated” to “non-stand-
security/cybersecurity perspective. Initially, alone 5G”. The full range of 5G applications,
the adoption of the government decision by however, requires “stand-alone” 5G that
the parliament was scheduled for early requires replacement of the existing Core
summer 2020; in wake of COVID-19, not Network technology. In stand-alone 5G, the
only the timetable is questionable, but distinction between Core and Radio Access
support among members of the British Network becomes irrelevant since more and
parliament is dwindling as negative more functions carried out in the Core
perception of China in the context of the Network of 4G/LTE will be performed at the
coronavirus is on the rise. In fact, British edge of the Radio Access Network (see
officials claim that they believe they can above). For this reason, the British
mitigate the network security risks. The distinction between Core Network and
Economist assessed the decision in a similar Radio Access Network appears antiquated
way to most media outlets, writing “to little and will allow Huawei to deliver sensitive
surprise, a compromise”. 36 However, this parts of the stand-alone 5G network in the
misrepresents the British decision, which UK. Commenting on the British decision,
essentially grants far-reaching access to Simeon Gilding, a former Australian signals
Huawei. The British government draft intelligence official, noted that:
comprises:
But with [stand-alone] 5G, all network
an exclusion of high-risk vendors’ functionality is virtualised and takes place
(read: Huawei) technology from the within a single cloud environment. That
Core Network; means there is no physical or logical
an exclusion of high-risk vendors’ separation between the core and edge of the
technology from the Radio Access network. A recent Financial Times editorial
Network close to critical facilities approvingly cites testimony to UK
parliamentary hearings last year that ‘the
Republic, accessed: 2019-09-10, at: 36 The Economist,"Britain Takes a Third Way on 5G
https://www.vlada.cz/en/media- with Huawei," The Economist, accessed: 2020-02-27,
centrum/aktualne/prague-5g-security-conference- at:
announced-series-of-recommendations-the-prague- https://www.economist.com/britain/2020/01/28/britai
proposals-173422/. n-takes-a-third-way-on-5g-with-huawei.
© 2020 The Swedish Institute of International Affairs 16distinction [between core and edge] would although it leaves some room for
still be valid in Britain, however; geographical interpretation.40
differences meant its networks would be Most crucially, the EU’s toolbox explicitly
designed differently from Australia’s’. I states that not only technological, but also
struggle to understand what this means. […] strategic (read: geopolitical) concerns
If it means the relative size of the United should drive the European approach, which
Kingdom allows its telcos to avoid requires a combination of technological and
distributing sensitive data and functions right non-technological means to mitigate.
to the edge of the network, I’m still not “Technical measures” are supplemented by
convinced. Geography is not a factor in how “strategic measures” and “supporting
core–edge works. 37 actions”. In essence, the toolbox contains
Not surprisingly, Huawei welcomed the measures to strengthen network
British decision and the US voiced its security by means of imposing
disappointment. At the same time, the requirements on mobile network
Trump administration fell short of its operators, such as stricter access
previous threat to reduce intelligence controls, monitoring and limitations
cooperation with the UK, but instead on the outsourcing of sensitive
announced it would need to develop functions and maintenance work;
alternative ways of intelligence sharing.38 an assessment of the risk profile of
This could turn out to be disastrous for the vendors;
US since it calls into question its threats restrictions on suppliers considered
against other states. Observers discuss to be high risk, including their
whether Canada could follow the British exclusion from critical and sensitive
example. Other states, primarily in Asia, parts of the 5G network, which
such as India, Indonesia, Malaysia or explicitly includes more than just
Singapore, have already decided to allow the Core Network;
Chinese vendors to participate in their 5G a diversification policy to include
deployment. 39 several vendors, which aims to
avoid dependencies and lock-in
The European Union, by contrast, appears effects with single suppliers, in
to be adopting a more Huawei-critical particular high-risk suppliers.
position. The “toolbox” issued by the
Network and Information Systems (NIS) Between the lines, the toolbox goes even
Cooperation Group, which comprises further, particularly highlighting the
representatives of all member states, the effectiveness of non-technological
European Commission and the EU’s measures. This places the EU toolbox closer
Cybersecurity agency ENISA, reads like a to the national (or better, European)
roadmap away from Huawei technology – security/geopolitics perspective mentioned
37 Simeon Gilding, "5G Choices. A Pivotal Moment in 39 James Crabtree, "Asia Must Step Up Tech Security
World Affairs," ASPI, accessed: 2020-02-27, at: as it Hands Huawei 5G Green Light," Nikkei Asia,
https://www.aspistrategist.org.au/5g-choices-a- accessed: 2020-02-27, at:
pivotal-moment-in-world-affairs/. https://asia.nikkei.com/Opinion/Asia-must-step-up-
38 Nikos Chrysoloras and Richard Bravo, "Huawei tech-security-as-it-hands-Huawei-5G-green-light.
Deals for Tech Will Have Consequences, U.S. Warns 40 NIS Cooperation Group, Cybersecurity of 5G
EU," Bloomberg, accessed: 2019-04-11, at: Networks. EU Toolbox of Risk Mitigation Measures. CG
https://www.bloomberg.com/news/articles/2019-02- Publication 01/2020, Brussels, European Commission,
07/huawei-deals-for-tech-will-have-consequences-u- 2020.
s-warns-eu.
© 2020 The Swedish Institute of International Affairs 17above. Another indication that the EU takes and the role of the non-discrimination
a rather tough approach is that it is explicit principle (most-favoured national principle
about the fact that the sensitivity of the 5G and national treatment), rules on import
network – particularly standalone 5G – restrictions as well as exceptions on grounds
cannot be restricted to the Core Network of regional integration and national
but includes the Radio Access Network. This security. 45
technologically well-grounded line of
argument declares all essential parts of the While the toolbox has been developed by all
standalone 5G network sensitive and member states, making it difficult for them
subject to particularly restrictive measures. not to implement it in some form or
In a recent assessment, Janka Oertel another, the document is legally non-
concluded: “[The Roadmap] suggests that binding. Even though the toolbox reads as a
member states should consider exclusions rather tough statement, Huawei’s hopes
and restrictions within normal cycles of might not be unfounded. The member
replacement, thus creating a transition states participating in the NIS Cooperation
period to mitigate the economic impact of Group apparently do intend to adopt
replacing existing kit from Chinese different policies. 46
vendors”. 41
An exemplary case of ongoing controversial
Unsurprisingly, the US has voiced its discussions is Germany. The decision on
appreciation of the document, calling on whether effectively to exclude Huawei (it
the EU member states to treat the full 5G will never explicitly be called a ban) remains
network as critical infrastructure. 42 Huawei, open even after the conservative group in
for its part, has also reacted positively to the the German parliament adopted a
document. 43 Judging from private compromise paper. The conservative party
conversations with the company, this seems CDU remains split. 47 Other parties in the
not to reflect the fact that the company is German parliament, including the Social
particularly happy with the outcome, but Democrats which form a government with
the room that Huawei sees the toolbox as the conservatives, have adopted a more
leaving for EU member states to interpret Huawei-critical position.
the document.44 In recent weeks, Huawei
seems to acknowledge that the outcome is Other EU member states have clearer
negative for the company. In particular, it positions, although they differ. Poland and
considers legal means in response to the the Czech Republic are likely to effectively
threat of a ban, particularly drawing WTO ban Huawei. Portugal and Hungary are at
41 Janka Oertel, "On 5G, Brussels Is Up to the Job," 02-27, at:
European Council on Foreign Relations, accessed: https://www.scmp.com/news/china/diplomacy/article/
2020-02-27, at: 3048285/better-we-hoped-uk-eu-leave-door-
https://www.ecfr.eu/article/commentary_on_5g_brus partially-open-chinese-tech.
sels_is_up_to_the_job. 44 Author conversations with representatives of
42 Michael R. Pompeo, "United States Welcomes the Huawei, several cities, February 2020.
EU's Acknowledgement of the Unacceptable Risks 45 Thomas Voland and Michel Petite, "Cybersecurity
Posed by Untrusted 5G Suppliers," U.S. Department of Measures and WTO Law," Europäische Zeitschrift für
State, accessed: 2020-02-27, at: Wirtschaftsrecht 23: 8, 2020, pp. 218-229.
https://www.state.gov/united-states-welcomes-the- 46 Author interviews with EU officials, several cities,
eus-acknowledgement-of-the-unacceptable-risks- February 2020.
posed-by-untrusted-5g-suppliers/. 47 CDU/CSU Fraktion im Deutschen Bundestag,
43 Stuart Lau, ""Better Than We Hoped For", as UK, Deutschlands digitale Souveränität sichern. Maßstäbe
EU Leave Door Partially Open for Chinese Tech Firm für sichere 5G-Netze setzen, Berlin, Unions Fraktion im
Huawei," South China Morning Post, accessed: 2020- Bundestag, 2020.
© 2020 The Swedish Institute of International Affairs 18You can also read
