| |
|
FBI and Commerce investigating tech firm Baicells
17/1/2025 6:09
The U.S. Commerce
Department and FBI are both investigating a little-known
telecoms hardware firm founded by senior Huawei veterans in
China over possible security risks, sources and documents show.
Founded in 2014, Baicells Technologies opened a North
American business the next year in Wisconsin and has since
provided telecoms equipment for 700 commercial mobile networks
across every U.S. state, according to its website.
The Commerce Department is investigating Baicells on
national security grounds and has sent subpoenas to the company,
four people said. The U.S. telecoms regulator, the Federal
Communications Commission (FCC), is advising it on its review,
two of the people said.
The FBI's interest in its equipment and Chinese origins
dates back to at least 2019.
Reuters is the first to report the existence of the two
investigations and the FBI's long-standing interest, based on
interviews with more than 30 current and former government
officials, eight former Baicells employees and FBI emails
obtained through a records request.
The investigations illustrate that years after sanctions
decimated the U.S. businesses of fellow Chinese tech companies
Huawei and ZTE, Washington's fears that Beijing is
using telecoms equipment to spy remain strong, experts said.
"Reviewing this would be near the top of my list," said John
Carlin, the Justice Department's former top national security
attorney, when presented with Reuters' findings, adding that it
raises the same type of risks as Huawei.
Sun Lixin, Beijing-based chairman of Baicells Technologies
Ltd, told Reuters Baicells will cooperate fully with any U.S.
government inquiries.
"Baicells does not believe there are any security risks
associated with its radio products," he said in a statement.
Reuters was unable to determine when the Commerce Department
opened its investigation or sent the subpoenas, nor its specific
concerns about Baicells or its products. Reuters also couldn't
ascertain the focus of the FBI's probe.
The FBI, the Commerce Department, the Justice Department and
the FCC declined comment.
This month, the Pentagon added Baicells to a list of 134
companies it says work with China's military, without providing
evidence or further comment. The listing does not have teeth but
can deal a reputational blow to companies targeted.
"We strongly disagree with the Defense Department's
designation and intend to appeal," Baicells said in a statement
to customers on Tuesday.
'OPEN INVESTIGATION'
The scrutiny of Baicells comes amid growing concerns in
Washington about China's ability to intercept sensitive data, by
hacking into telecoms networks, remotely accessing hardware
supplied by Chinese companies, or providing Americans with
internet access.
In a statement to Reuters, China's U.S. embassy spokesperson
Liu Pengyu urged Washington to stop using cyber security issues
to smear China.
Baicells supplies routers and base stations in the United
States. Base stations provide mobile networks for local areas,
much in the same way a router provides a WiFi signal in a home.
Anyone gaining remote access to a router or base station
could be in a position to intercept or tamper with its traffic,
disrupt its service, or launch cyber attacks, experts say.
Reuters has no evidence that any Baicells equipment has been
misused. But the technique has been used by a wide variety of
state-backed hacking groups around the world, including a
high-profile Chinese group dubbed "Volt Typhoon", according to
U.S. officials.
While recent high profile Chinese attacks on U.S. telecoms
networks hinged on breaches of poorly secured Western equipment,
"allowing (China)-linked suppliers into our supply chains and
not exercising the necessary scrutiny is counterproductive,”
Democratic U.S. Senator Mark Warner, ranking member of the
Senate Intelligence Committee, said in a statement to Reuters.
"The whack-a-mole approach, focusing on the national security
risks posed by a single company at a time, is not nimble enough
to respond to the threats that we are seeing."
Emails from an FBI intelligence analyst and sources show
that federal agents approached a Baicells customer, the city of
Las Vegas, in 2023 to warn it about its base stations - and the
FBI's interest in Baicells products dates back to at least 2019.
That year, federal authorities approached wireless internet
service provider KGI Communications after it deployed Baicells
base stations in King George, Virginia - one of which was near
the Naval Surface Warfare Center Dahlgren Division where
hypersonic weapons are tested, former county supervisor Ruby
Brabo and KGI employee Juan Marte said.
Marte, KGI's former CEO, told Reuters the officials were FBI
agents and that they warned KGI about Baicells' Chinese origins.
Asked for comment, the Navy referred Reuters to the FBI,
saying the agency has an "open investigation" into the matter.
In 2023, FBI officials visited the chief technology officer
for Las Vegas after the city signed a contract to expand an
existing deployment of Baicells base stations with 82 more, two
people familiar with the matter told Reuters.
The officials raised security concerns and asked to take one
of the base stations away, according to the people and emails to
the city from the FBI obtained through a records request.
"(We) wanted to know if you have any updates on removal or
replacement actions," states one email from an FBI
counterintelligence division intelligence analyst in May 2023.
Spooked by the attention from the FBI - which eventually
took away a base station, according to one of the people - Las
Vegas canceled the contract and turned to a U.S. supplier
instead, documents show.
The FBI's inquiries about Baicells in Virginia and Las Vegas
have not previously been reported.
In 2021, two FBI agents from Dallas also interviewed Patrick
Leary, a former co-CEO of Baicells North America, he said.
"Their concerns were clearly wrapped up with national
security and China," Leary told Reuters, adding that Baicell's
origins and American business goals were a focus of questions.
SECURITY ALERTS
U.S. Cyber defense agency CISA, part of the Department of
Homeland Security, published an advisory in 2023 about a
vulnerability in Baicells Nova base stations that could allow a
hacker to hijack the devices.
An analysis carried out for Reuters in September by Censys,
an internet intelligence company, showed that between 28 and 186
Baicells base stations in the U.S. were still using vulnerable
firmware, potentially putting them at risk of hijack.
"We have taken affirmative steps to ensure the security of
our products and proactively address any security concerns,"
Baicells said when asked about base station vulnerabilities.
Terry Dunlap, a firmware security expert and former National
Security Agency official, said these types of vulnerabilities
often appear in devices such as base stations.
However, he said they were still a concern because they
could be used as jumping off points to access critical networks,
or be stitched together with other vulnerable devices to create
a botnet capable of carrying out broader cyber attacks.
CISA has a list of 16 critical infrastructure networks of
concern such as water, energy, financial services and telecoms.
Altogether, CISA has published two security advisories and
four vulnerability notices to the public since 2022 about the
risk of Baicells' routers and base stations being accessed
remotely, labeling at least five as "critical".
RUN FROM CHINA?
Baicells' original Chinese parent, Beijing Baicells
Technologies Co, was founded in 2014 by Sun, one of Huawei's top
12 employees, and senior Huawei veterans Scott Liang Xingang,
Zhou Mingyu and Ding Yingzhe. Liang and Ding have since left.
They did not respond to requests for comment.
They are among about 60 former Huawei employees who would
later join Baicells, according to a Reuters review of profiles
on LinkedIn and Chinese equivalent MaiMai. Reuters was unable to
independently confirm these numbers.
In 2016, Baicells set up an office in Plano, a suburb of
Dallas where Huawei's American R&D arm Futurewei was
headquartered.
In his statement to Reuters, Sun said Baicells had never had
any business relationship with Huawei and the number of current
staff hailing from the company represented a small percentage of
its workforce.
Since 2019, the U.S. has restricted Huawei's access to U.S.
technology, accusing the company of activities contrary to U.S.
national security, which Huawei denies.
Huawei declined comment.
According to Texas filings and a press release, Baicells
stopped belonging to its Chinese parent by 2019. But Baicells'
homepage in China still describes it as being headquartered in
Beijing's Haidian District, with a Dallas subsidiary.
Four former employees with direct knowledge of Baicells'
Chinese leadership describe the U.S. firm as being managed
currently from China.
A recent former CEO of the U.S. operation, Minchul Ho, was
"very micromanaged by the board" in China, which had to approve
anything he suggested, said one of the people, who was not
authorized to speak publicly.
Neither Ho nor Baicells responded to requests for comment on
this assertion.
To assuage U.S. customer concerns about Baicells' ties to
China, sales executives have been instructed in recent years to
say the gear was made in Taiwan, four former employees said.
Bills of lading collected by a commercial customs data
provider show 92% of shipments of Baicells equipment to the U.S.
from 2018 through July 2024 came from China or Hong Kong, with
the remainder from Taiwan.
Reuters could not determine where the equipment was made.
"We are aware of our Chinese roots and we know that is a big
issue for federal funding," Erik Randall, a Baicells sales
executive said in a January 2023 webinar for prospective clients
posted on YouTube.
"Our infrastructure is actually being built in Taiwan so
we're starting to move away from that Chinese culture that
everyone in North America is worried about."
|
|