Exclusive-Chinese tech company founded by Huawei veterans targeted by FBI Reuters

By Alexandra Alper

WASHINGTON (Reuters) – The U.S. Commerce Department and the FBI are both investigating a little-known telecommunications hardware firm founded by senior Huawei veterans in China over possible security risks, sources and documents show.

Founded in 2014, Baicells Technologies opened a North American business the following year in Wisconsin and has since supplied telecommunications equipment for 700 commercial mobile networks in every US state, according to its website web.

The Commerce Department is investigating Baicells for national security reasons and has issued subpoenas to the company, four people said. The US telecommunications regulator, the Federal Communications Commission ( FCC (BME:)), is recommended on its review, two of the people said.

The FBI’s interest in its equipment and its Chinese origins dates back to at least 2019.

Reuters was the first to report the existence of the two investigations and the FBI’s long-standing interest, based on interviews with more than 30 current and former government officials, eight former Baicells employees and FBI emails obtained through a record request.

The investigations illustrate that years after sanctions decimated the US businesses of Chinese technology companies Huawei and ZTE (HK: ), Washington’s fears that Beijing is using telecommunications equipment for espionage remain strong, experts said. . “Reviewing this would be near the top of my list,” said John Carlin, the senior attorney at the Department of Justice, when he presented the findings to Reuters, adding that it raises the same kind of risks that Huawei .

Sun Lixin, president of Beijing-based Baicells Technologies Ltd, told Reuters that Baicells would fully cooperate with any request from the US government.

“Baicells does not believe there are any security risks associated with its radio products,” it said in a statement.

Reuters was unable to determine when the Commerce Department opened its investigation or sent the subpoenas, nor its specific concerns about Baicells or its products. Reuters has not yet been able to determine the focus of the FBI’s investigation.

The FBI, the Commerce Department, the Justice Department and the FCC declined to comment.

This month, the Pentagon added Baicells to a list of 134 companies it says work with the Chinese military, without providing evidence or further comment. The list has no teeth but can deal a reputational blow to the targeted companies.

“We strongly agree with the Defense Department’s designation and intend to appeal,” Baicells said in a statement to clients on Tuesday.

“OPEN INVESTIGATION”

Baicells’ scrutiny comes amid growing concerns in Washington about China’s ability to intercept sensitive data, hack into telecommunications networks, remotely access hardware provided by Chinese companies, or provide Americans with Internet access.

In a statement to Reuters, China’s US embassy spokesman Liu Pengyu urged Washington to stop using cyber security issues to tear China apart.

Baicells provides routers and base stations in the United States. Base stations provide mobile networks for local areas, much in the same way that a router provides a WiFi signal in a home.

Anyone who gains remote access to a router or base station could be in a position to intercept or manipulate its traffic, disrupt its service, or launch cyber attacks, experts say.

Reuters has no evidence that any of Baicells’ equipment was misused. But the technique has been used by a wide variety of state hacking groups around the world, including a high-profile Chinese group called Volt Typhoon, according to US officials.

While recent high-profile Chinese attacks on U.S. telecommunications networks were based on breaches of poorly secured Western equipment, “it allows (China)-linked suppliers into our supply chains and does not exercise the necessary scrutiny is counterproductive,” Democratic US Senator Mark Warner, ranking member. The Senate Intelligence Committee said in a statement to Reuters “The strike approach, focusing on national security risks one company at a time, is not agile enough to respond to the threats we see.”

Emails from an FBI intelligence analyst and sources show that federal agents approached a Baicells client, the city of Las Vegas, in 2023 to warn of its base stations – and the interest of the FBI in Baicells products date from at least 2019.

That year, federal authorities approached wireless Internet service provider KGI Communications after it deployed Baicells base stations in King George, Virginia—one of which was near the Naval Surface Warfare Center Dahlgren Division where hypersonic weapons are testified, former county supervisor Ruby Brabo and KGI employee. John Mars said.

Marte, the former CEO of KGI, told Reuters that the officials were FBI agents and that they warned KGI about Baicells’ Chinese origins.

Asked for comment, the Navy referred Reuters to the FBI, saying the agency has an “open investigation” into the matter.

In 2023, FBI officials visited Las Vegas’ technology chief after the city signed a contract to expand an existing deployment of Baicells base stations with 82 more, two people familiar with the matter said. Reuters.

Officials raised security concerns and asked to take over one of the base stations, according to people and emails to the city from the FBI obtained through a records request.

“(We) wanted to know if you have any updates on the removal or replacement actions,” says an email from an intelligence analyst with the FBI’s counterintelligence division in May 2023.

Spooked by the attention of the FBI — which eventually seized a base station, according to one of the people — Las Vegas canceled the contract and turned instead to a U.S. supplier, the documents show.

FBI investigations into Baicells in Virginia and Las Vegas have not been previously reported.

In 2021, two Dallas FBI agents also interviewed Patrick Leary, a former co-CEO of Baicells North America, he said.

“His concerns were clearly wrapped up with national security and China,” Leary told Reuters, adding that Baicell’s origins and US business goals were a focus of questions.

SECURITY ALERT

The US cyber defense agency CISA, part of the Department of Homeland Security, published a warning in 2023 about a vulnerability in Baicells Nova base stations that could allow a hacker to hack the devices.

An analysis conducted for Reuters in September by Censys, an Internet intelligence company, showed that between 28 and 186 Baicells base stations in the United States were still using vulnerable firmware, potentially putting them at risk of hijacking.

“We have taken affirmative steps to ensure the security of our products and proactively address any security concerns,” Baicells said when asked about the base station vulnerabilities.

Terry Dunlap, a firmware security expert and former National Security Agency official, said these types of vulnerabilities often appear in devices such as base stations.

However, he said they were still a concern because they could be used as jumping off points to access critical networks, or be stitched together with other vulnerable devices to create a botnet capable of carrying out wider cyber attacks.

CISA has a list of 16 critical infrastructure networks of concern such as water, energy, financial services and telecommunications.

In all, CISA has issued two security alerts and four vulnerability alerts to the public since 2022 about the risk of remote access to Baicells’ routers and base stations, labeling at least five as “critical.”

RUNNING FROM CHINA?

Baicells’ original Chinese parent, Beijing Baicells Technologies Co, was founded in 2014 by Sun, one of Huawei’s top 12 employees, and senior Huawei veterans Scott Liang Xingang, Zhou Mingyu and Ding Yingzhe. Liang and Ding have since left.

They did not respond to requests for comment.

They are among about 60 former Huawei employees who later joined Baicells, according to a Reuters review of profiles on LinkedIn and its Chinese equivalent MaiMai. Reuters was unable to independently confirm these numbers.

In 2016, Baicells set up an office in Plano, a Dallas suburb where Huawei Futurewei’s American R&D arm was headquartered.

In his statement to Reuters, Sun said that Baicells had never had any business relationship with Huawei and the number of current staff coming from the company represents a small percentage of its workforce.

Since 2019, the United States has limited Huawei’s access to US technology, accusing the company of activities against US national security, which Huawei denies.

Huawei declined to comment.

According to Texas filings and a press release, Baicells has ceased to belong to its Chinese parent since 2019. But Baicells’ home page in China still describes it as being headquartered in Beijing’s Haidian District. , with a Dallas branch.

Four former employees with direct knowledge of Baicells’ Chinese leadership describe the American firm as currently run by China.

A recent former CEO of the US operation, Minchul Ho, was “very micromanaged by the board” in China, who had to approve everything he suggested, said one of the people, who was not authorized to speak. publicly.

Neither Ho nor Baicells responded to requests for comment on this claim.

To assuage U.S. customers’ concerns about Baicells’ ties to China, sales executives were instructed in recent years to say the equipment was made in Taiwan, four former employees said. .

Bills of lading collected by a commercial customs data provider show that 92% of Baicells equipment shipments to the United States from 2018 to July 2024 came from China or Hong Kong, and the rest from Taiwan.

Reuters could not determine where the equipment was made.

“We’re aware of our Chinese roots and we know it’s a big problem for federal funding,” Erik Randall, a Baicells sales executive said in a January 2023 webinar for potential customers posted on YouTube.

“Our infrastructure is actually built in Taiwan, so we’re starting to move away from that Chinese culture that everybody in North America is worried about.”