In 2018, many commentators pronounced the rules-based global order to be out for the count. This presents serious challenges for a country such as Australia, which has been an active contributor and clear beneficiary of that order. The government that we elect in 2019’s federal election will be faced with difficult strategic policy choices unlike any we’ve confronted in the past 50 years.
This volume contains 30 short essays that cover a vast range of subjects, from the big geostrategic challenges of our times, through to defence strategy; border, cyber and human security; and key emergent technologies.
The essays provide busy policymakers with policy recommendations to navigate this new world, including proposals that ‘break the rules’ of traditional policy settings. Each of the essays is easily readable in one sitting—but their insightful and ambitious policy recommendations may take a little longer to digest.
Previous Agenda for change publications are also available here: 2016 and 2013.
Launch Event
https://aspi.s3.ap-southeast-2.amazonaws.com/wp-content/uploads/2024/12/17220605/auParliamentHouse.jpg4491350nathanhttps://aspi.s3.ap-southeast-2.amazonaws.com/wp-content/uploads/2025/04/10130806/ASPI-Logo.pngnathan2019-02-26 06:00:002025-03-06 15:20:38Agenda for change – 2019
It’s January 2024. Does Australia still have the internet?
Introduction
Australia wants to create a future for cyberspace that’s open, free and secure, but that future is not assured. According to Dr Tobias Feakin, the Ambassador for Cyber Affairs, ‘Australia’s vision … and our ambitions across the broad spectrum of cyber affairs are impossible to achieve alone.’1 Key drivers are outside of the country’s control. The government can—and should—advance a positive vision, but Australia might not get its way.
What if the future of cybersecurity looks different from what we hope or expect? This is a hard question to answer. Day-to-day concerns demand our immediate attention, and, when we think about the future, we tend to extrapolate from current trends. As a result, we’re shocked or surprised by discontinuous change, and woefully unprepared to face new realities. The risk is particularly acute in cybersecurity, in which rapidly changing technologies combine with diverse social and political forces to create unexpected consequences. Therefore, as difficult as it is to rethink our assumptions about the future, failing to do so could be dangerous.
This report uses scenario analysis to examine one such future: a world where cyberspace is fragmented in the year 2024. Contrary to the ambition of Australia’s International Cyber Engagement Strategy, cyberspace is neither open nor free in this scenario. We analyse what that implies for cybersecurity. In particular, we examine the challenges and opportunities that Australian policymakers may face in the future and wish they had planned for in our present.
We conclude that Australia will be caught in the fray if the internet breaks apart. While this scenario isn’t all bad, Australia could be forced to fend for itself in an increasingly dangerous neighbourhood. The scenario isn’t a forecast or prediction. It’s a compelling narrative to provoke new thinking and critical discussion about what Australia must do now to prepare for different cybersecurity futures.
Our approach is as follows. First, we explain the methodology. Second, we identify the forces of change that drive this scenario. Third, we interact these drivers to describe one possible world in 2024. Finally, we highlight the strategic choices and challenges that this scenario raises for Australia.
Scenario analysis
Scenario analysis is a methodology for critical thinking about alternative futures. It was pioneered at RAND in the 1950s by Herman Kahn in his attempt to ‘think the unthinkable’ about thermonuclear war. The method was further developed by Pierre Wack and Ted Newland at Royal Dutch Shell, where scenario analysis was credited with anticipating the possibility of oil shocks during the 1970s.2 It’s now commonly used in industry and government. For instance, scenario analysis informs the US National Intelligence Council’s quadrennial Global trends report.3 It’s also applied by the Center for Long-Term Cybersecurity at the University of California, Berkeley, in reports on Cybersecurity futures 2020 and Asian cybersecurity futures.4
The goal of scenario analysis is to ask and, ideally, answer ‘what if’ questions about how different drivers of change—social, political, economic, technological—could combine to produce discontinuities and thus different possible worlds. This approach is forward looking. We apply it to imagine Australia’s cybersecurity environment circa 2024. It may be unsettling. Following best practice, we sought to simplify and then exaggerate the drivers of change in order to throw an alternative and perhaps undesirable future into sharp relief. Nevertheless, scenario analysis is still rooted in reality.
The propositions behind this qualitative analysis are plausible, the narrative is internally consistent, and the results reflect expert consultation.
This report breaks from the norm of scenario analysis by focusing on one of many possible futures.
Our focus is not predictive, however. We do not argue that internet fragmentation is probable or likely to play out as per this scenario. We do suggest that this kind of future is significant because it challenges Australia’s preferred vision for an open, free and secure cyberspace. Fragmentation is also a significant concern in internet policy.5 Furthermore, while it may be a single scenario, a fragmented world contains different environments or ecosystems, and analysing that diversity helps compensate for our focus on only one potential future. The challenges and opportunities of such a future therefore warrant special consideration (just as other scenarios warrant further research). Rather than fight the scenario, we encourage you to ask: What would Australia need to decide and do differently for cybersecurity if it confronts this world in 2024?
Drivers of change
Our scenario depicts the interplay or interaction effects of three hypothetical drivers for change: Asia online, tech giants, and great-power conflict. While none is certain, each premise is plausible. More importantly, the resulting scenario is not a linear extrapolation or forecast based on any single trend. It’s the combination of drivers that could contribute to internet fragmentation and result in a cybersecurity environment markedly different from today’s.
Asia online
First, the number of users, devices and applications in Asia grows substantially over the next five years. We imagine that internet penetration in the region grows faster than expected, jumping from less than 50% today to more than 80%, so that more than 3.5 billion people are online in Asia. As a result, there are as many people online in this region come 2024 as the total number of internet users around the world in 2019. By 2024, Asia is also home to more than 15 billion connected devices.
We assume that this rapid expansion of connectivity is unrivalled in other regions. It roughly correlates to Asia’s youthful and growing population, as well as its economic power as the new centre of the global economy. However, economic and political opportunities remain unevenly distributed over the next five years, as is the region’s digital transformation. Most web traffic in Asia is mobile, but connection speeds vary greatly across the urban–rural divide, and economic growth hasn’t reduced economic inequality.
Tech giants
Second, we posit large and locked-in technology platforms as another driver for change. Although new applications flourish over the next five years, we assume that the underlying technology stacks, layers or platforms upon which those applications are built resemble a few large tectonic plates. And those platforms are increasingly dominated by a handful of huge corporations.
Tech giants dominate the user experience, software development and hardware. For most people in 2024, ‘cyberspace’ is difficult to distinguish from megabrands such as Google, Apple, Facebook, Amazon and Microsoft, or, similarly, Alibaba, Tencent, Baidu, Sina Weibo and Huawei. These companies also dominate the marketplace for talent. Regardless of where they work, most software developers work with toolkits and application program interfaces that plug into a dominant platform. Proprietary software developed by tech giants enjoys a home-field advantage over apps built by third-party providers. Industry concentration shapes hardware and telecommunications infrastructure as well, including the ‘internet of things’ (IoT). On the one hand, we imagine that connected devices are ubiquitous and produced by a plethora of manufacturers in 2024. On the other hand, in many markets, many of these connections are mediated by platforms, hubs and bridges dominated by the ‘Big 10’ tech giants.
Great-power conflict
The third driver is strategic competition and conflict between great powers. We posit a multipolar world in 2024. No great-power concert has emerged to manage territorial conflicts or the myriad state and non-state cyber operations. The US remains the only superpower with global reach, but that reach is rivalled by China’s, especially in the Pacific and Indian oceans. US power projection into the region is further limited by budget constraints (accentuated by an ongoing recession), as well as costly commitments to fighting in the Middle East and deterring a weak but assertive Russia. While NATO endures, nationalism and populism have fuelled extreme swings in American and European politics, fraying the alliance. ANZUS endures as well, but the US lacks a coherent strategy towards Asia in 2024. As a result, the US military posture isn’t supported by consistent political and economic policies.
Meanwhile, China has continued to rise. The Middle Kingdom is a middle-income country in 2024, with a nearly $15 trillion economy. Its One Belt, One Road and Digital Silk Road initiatives have established Chinese infrastructure, standards and platforms in several neighbouring economies. However, this economic and strategic agenda is resisted by India in the south and Russia in the north, along with European and American interests in Africa and Oceania. We posit that the Chinese economy has not dipped into recession, although its officially reported growth rate of 3% in the last quarter of 2023 is viewed with considerable scepticism. In China, as elsewhere, economic angst and nationalism have increased variability in foreign policy and contributed to competition and conflict in the region.
2024: Fragmented world, fragmented internet
In this scenario, Asia comes online but cyberspace fragments by 2024. Years of mounting tensions between the US, China, Russia and Western Europe have combined with entrenched platform technologies to result in a world where the internet—singular—is a thing of the past. The ‘World Wide Web’ is anachronistic. Instead, there are several weakly connected internets, each of which contains content and services that are largely inaccessible from outside the same country, region or bloc. There are tunnels through these walled gardens, but few users beyond specialists, spies and criminals have the skill or inclination to use them. Most users’ online access and experience is mediated and monitored by whichever tech giants enjoy official sanction in their local market. In most places, ‘social media’ are just media, and the IoT is just things.
The world’s largest internets are American and Chinese. Access to each correlates with physical proximity to the US or China, coupled with the broader user base of their respective tech giants. In particular, the American internet is accessible in most of the Western Hemisphere (corresponding to the American and Latin American regional internet registries). It’s also accessible in Western Europe, but tensions across the Atlantic have combined with divergent data protection and antitrust regulations, fuelling the emergence of a continental internet in the remnants of the European Union. Russia’s national internet is effectively cordoned off by internal information controls (heightened following the death of Vladimir Putin), combined with external blocking of untrusted traffic (Russian IP addresses being equated with criminal or intelligence operations and rejected by most border routers). National networks have also emerged in North Korea, Saudi Arabia and Venezuela. In addition to indigenous applications, the governments that regulate these and similar shards of cyberspace typically contract with Chinese or American firms to build platforms that are closed and customised for local censorship and surveillance.
Figure 1: Internets of the region, 2024
Enter the dragon
Like the Belt and Road Initiative, or the Nine-Dash Line, geography is a notable feature of the Chinese internet in 2024, which is portrayed as several concentric circles. Domestic services and content sit at the centre, behind the Great Firewall. China’s ‘Social Credit’ system hasn’t proved particularly effective in regulating behaviour offline; a goth-like fashion trend dubbed ‘false negative’ has even emerged to frustrate facial recognition. Nevertheless, China has become a nearly cashless society, and both big data and artificial intelligence are used to effectively monitor most online activity. The incidence of malware has decreased dramatically, and domestic cyber incident response is well coordinated.
Some cybersecurity experts worry that foreign intelligence services are exploiting the backdoor access required by China’s regulation of commercial encryption, yet the government denies any such allegation.
Outside the Great Firewall, similar services and content are available to those individuals, organisations and countries that use the platforms provided by China’s tech giants (or their local affiliates). Many do, particularly in Asia. By default, users in this second ring give their data to Chinese service providers.
Most of that information is stored on servers inside China. The outermost ring consists of custom networks that China has built but for which—purportedly—it has handed information controls over to the client, such as for the heavily restricted mobile apps recently launched in North Korea.
The Western Front
For many users in the US, the American internet in 2024 appears similar to the World Wide Web in 2019. A similar set of tech giants from Silicon Valley and Seattle dominate the market. Their proprietary platforms seem to seamlessly integrate users’ digital lives. Toddlers are frequently reported to perceive voices such as Google Home and Amazon Echo as disembodied members of their families. Data breaches of personally identifiable information are so common as to rarely make news; occasionally, car fleets and wired housing developments that have been bricked by cyberattacks make headlines. Net neutrality remains contentious and partisan. Demands from law enforcement for data collected by bystanders’ wearable tech during the Denver bombing in 2022 have ignited another round of debate over encryption (a debate joined by lobbyists for fintech and cryptocurrencies).
Lobbying by tech giants, fractious domestic politics and anti-statist ideology limit US federal regulations on cybersecurity. One exception is wireless broadband. A government-sponsored, industry-led consortium has rolled out a mobile network called US5G. Chinese companies are banned from building this infrastructure. Likewise, Chinese and Russian cybersecurity software is banned from use on US Government computers. The Security and Exchange Commission has also imposed reporting requirements on cryptocurrencies and initial coin offerings. Domestic information sharing has improved modestly after years of concerted attacks against critical infrastructure, but individual users still have little recourse, and the quality of cyber insurance is variable. US diplomats pay lip service to ideas such as ‘internet freedom’ and ‘cyber norms’ when they criticise authoritarian regimes, but the promotion and practice of the American internet abroad is largely determined by the commercial strategies of its tech giants.
Figure 2: The US5G logo
Fault lines
Asia is a contested zone in 2024. The US and China vie for power in the region while Chinese and American firms compete for market share. Unfortunately, the US and China appear caught in the ‘Thucydides trap’, as the rising and ruling powers jostle near the brink of armed conflict.6 War was narrowly averted in 2022 following a naval skirmish in the South China Sea that killed 65 sailors and marines aboard American and Chinese warships. Patriotic hacking—both state-sanctioned and self-radicalised—during this incident was intense and occasionally destructive. Since then, submarines have been reported patrolling undersea cables in the Pacific. In addition, real and imagined instances of Chinese and American firms facilitating offensive cyber operations by military and intelligence agencies have driven yet another wedge between their rival internets.
On the one hand, countries in the Indo-Pacific enjoy more choice than those in the Western Hemisphere, since the American and Chinese internets are both viable options in this region. Some countries are choosing to bandwagon with China. In 2024, Alibaba, Tencent, Baidu, Sina Weibo and Huawei are providing a bundle of telecommunication, media, IoT and financial services called WeConnect. This bundle has proved remarkably popular in Malaysia, for instance, and among the Chinese diaspora across Asia. WeConnect has also increased internet access in Myanmar and Cambodia by an order of magnitude: millions of their people have leapfrogged from having no phones to using Chinese smartphones overnight. In contrast, Japan uses the American internet as a matter of policy, and most users in Indonesia and the Philippines remain locked into Facebook and Google. India is non-aligned (despite the prevalence of American platforms), and Pakistan is hedging its bets (despite widespread adoption of WeConnect). Competition and choice between American and Chinese internets are fuelling digital innovation across the region.
On the other hand, innovation in this scenario is not improving global integration. Choosing one internet increasingly means forgoing access to others. Chinese and American cybersecurity standards are not compatible. Nor is compatibility of much interest to the tech giants. Years of national tariffs, investment restrictions, divergent regulations and export controls have limited their sales in the others’ domestic markets. Combined with the US5G network, these policies have forced American firms to shift away from Chinese suppliers. Similarly, the ‘Made in China 2025’ initiative has made Chinese tech giants more self-sufficient. The US–China skirmish in 2022 accelerated the disintegration of once highly integrated supply lines and manufacturing. When competing for customers in Asia, the tech giants are incentivised to collude within their own internet and exclude foreign rivals.
Moreover, the range of choice in this region comes at considerable cost. While some aspects of cybersecurity have improved inside Chinese and American internets, those improvements are lost in the mixing zones between them. Cheap, outdated and counterfeit technologies are most vulnerable, enabling cybercrime in 2024 to cost Asia as much as $3 trillion per year. Ransomware, DDoS by IoT botnets, cryptocurrency fraud, industrial espionage, election interference—all are common, especially at the local level. Diverse technology limits the spread or scale of most attacks, but it also provides criminals with many smaller targets of opportunity outside the Great Firewall. Jumbled laws across different jurisdictions also provide safe haven for state and non-state actors to launch attacks and hide ill-gotten gains. In this scenario, data protection isn’t imagined to be a top priority for hundreds of millions of people who are coming online for the first time. Even more than the American internet, the Chinese internet in 2024 owes its success to users willing to forgo privacy in exchange for access and convenience. The appetite for adopting digital technologies in this contested environment is a recipe for legal and illegal innovation alike.
Moving forward: strategic choices and challenges for Australia
The world that we describe would have serious implications for Australian cybersecurity. At least three lessons stand out in our analysis.
Australia will be caught in the fray
In this scenario, China remains the primary pillar of the Australian economy and the US remains Australia’s security guarantor. Australia won’t want to take sides, and with good reason. But the digital economy may prove more sensitive to geopolitical tension than other markets, in which case Australia could face tough choices in cyberspace sooner rather than later.
The costs of choosing either an American or a Chinese internet could be significant, though not equal. Not choosing could be costly as well. While a mediating, brokering or hedging strategy may prove the lesser evil, it may also make Australia the target of intense pressure. Domestic affairs could become a microcosm of fierce regional competition. Potential outcomes include foreign surveillance, censorship and the manipulation of Australian markets, networks and politics. Chinese platforms are particularly suspect, but American technologies aren’t above reproach. How will federal, state and local governments respond in March 2024, for example, if mass student protests in Melbourne are manipulated through WeConnect? How much more difficult will whole-of-government policies and operations be, even at the federal level, if the tensions between cybersecurity and economics become increasingly pronounced?
29 November 2023
Australian Fintech Firm Shuttered: US Alleges Data Manipulated by China
The Sydney-based cryptocurrency exchange TransPacific Ledger (TPL) was forced to shut down last night, less than a day after the discovery of data irregularities in trading worth more than $1.5 billion.
TPL suspended operations after the firm was implicated in the crash of blockchain backed indexes in the United States. Trading data brokered by TPL may have been manipulated in high-speed transactions between the US and China.
A darling of the Sydney start-up scene, TPL had been seen as a trusted and profitable intermediary between American and Chinese financial markets. ‘We have a sales office in Hong Kong, we’re fully licensed in Australia, and we comply with all US regulations,’ said TransPacific CEO Ed Jones in an interview last month.
However, US cryptocurrency exchanges crashed on Monday when irreconcilable discrepancies were reported across several ledgers. ‘TPL appears to be the common link,’ according to the White House press secretary, ‘but China is behind the bad data.’ US intelligence officials point to recent advancements in Chinese quantum computing, claiming that these computers could hack the authentication protocols behind blockchain. ‘Maybe this was an experiment that got out of hand,’ said one anonymous source.
Beijing brusquely rejected these claims. ‘False accusations accomplish nothing,’ according to one government spokeswoman. Prominent voices in Chinese media are now blaming unnamed criminals in Australia and demanded their immediate extradition.
The Australian Securities and Investments Commission is working with the Australian Signals Directorate in its investigation. Neither agency was available for comment. The ASX lost 5% after news about TPL broke on Tuesday.
Please note: the above is a fictional article created by the authors for the purpose of this report.
By straddling both internets, both networks could be used to push and pull divisions in Australian government and society. Moreover, even if Australia tries to straddle the US and China, other countries in Oceania may decide differently. For instance, how will Canberra respond if Papua New Guinea, Bougainville and Solomon Islands bargain to adopt the Chinese internet in 2024 unless Australia increases development assistance to expand and maintain their undersea cables? In this scenario, Australia will have to decide how much it’s willing to pay for its preferred strategy, both at home and around the neighbourhood.
Internet fragmentation isn’t all bad everywhere
As costly as straddling or choosing between American and Chinese internets would be for Australia, this isn’t a doomsday scenario. Some aspects of cybersecurity stand to improve inside each network. Harmonised standards and coordination across like-minded jurisdictions could improve incident response, information sharing (including vulnerability disclosure), patching and attribution. Technological diversity may increase at the regional and global levels, limiting the scale of any given platform and thus the extent to which attacks spread beyond any given country, region or bloc. Trust inside these networks may improve as well. For example, this scenario imagines that the average American in 2024 is relatively confident about US5G (despite expert debate about whether this network is demonstrably more secure than the Chinese alternative). Real or imagined, these security gains may make joining one club or another an attractive prospect for Australia.
Granted, the security gains inside each network are offset by friction between them. Australian policymakers will also bristle at claims by China, Russia and other authoritarian regimes that strict censorship and surveillance improve the security of their respective internets. Nevertheless, fragmentation or disintegration need be neither chaotic nor absolute. For better or worse, cross-fertilisation and ideological hypocrisy will occur as well, with American companies mirroring some of the practices used by their Chinese counterparts and vice versa.
Thursday, January 4, 2024
Mastercard and Walmart introduce a Social Credit System
Dismissing comparison to China, Walmart claims new system will help its consumers “live better” and “save money” during the US recession.
Please note: the above is a fictional article created by the authors for the purpose of this report.
Australia lives in a dangerous neighbourhood
The concurrent great-power transition and digital transformation of the region could be more turbulent than in any period in recent history. Tech giants will shape this transformation, but their commercial interests diverge from the public interest in Australian cybersecurity. In contrast to powerful corporations, international organisations such as the International Telecommunication Union appear even less impactful than usual in this scenario. Even multi-stakeholder organisations such as ICANN could be coopted or captured by commercial and geopolitical interests.
Tough Choices
Australia isn’t helpless in this environment, but it should prepare to help itself. Looking back, policymakers in 2024 may wish that preparation had started in 2019. Options include redoubling Australian efforts to champion an open, free and secure cyberspace in order to avoid the future imagined here. Advancing regional leadership, investing in capacity building and taking assertive action on shared interests may prove helpful. At the same time, however, policymakers should consider tough choices about cybersecurity in a less benign environment:
Is Australia prepared to play hardball, not only with the US and China, but also with commercial tech giants, in order to advance its national interest?
If forced to take sides or straddle the great powers, how should Australia choose, and how can it mitigate the costs of doing so?
Even if there’s no defining moment (for example, President Trump or President Xi declaring ‘You’re either with us, or against us’), is muddling through on issues such as encryption in Australia’s national interest, especially if incremental decisions aggregate into a decisive choice?
What, if anything, can Australia do to help the next billion users in Asia come online in ways that improve rather than undermine critical aspects of cybersecurity?
And will a laissez-faire or, alternatively, compliance-driven approach to domestic cybersecurity suffice or prove lamentable in the years ahead?
These are important questions to answer, regardless of whether or not the scenario that we describe comes to pass. Scenario analysis doesn’t need to provide accurate predictions in order to provoke strategic thinking about the future of Australian cybersecurity.
Acknowledgements
This report was produced in collaboration between the Sydney Cyber Security Network and ASPI’s International Cyber Policy Centre. It was made possible thanks to a research grant provided by the Sydney Policy Lab. We also thank our research assistant Bryce Pereira, as well as the other experts and visionaries who provided helpful comments and feedback.
The ASPI International Cyber Policy Centre’s mission is to shape debate, policy and understanding on cyber issues, informed by original research and close consultation with government, business and civil society. It seeks to improve debate, policy and understanding on cyber issues by:
conducting applied, original empirical research
linking government, business and civil society
leading debates and influencing policy in Australia and the Asia–Pacific.
We thank all of those who contribute to the ICPC with their time, intellect and passion for the subject matter. The work of the ICPC would be impossible without the financial support of our various sponsors.
Important disclaimer
This publication is designed to provide accurate and authoritative information in relation to the subject matter covered. It is provided with the understanding that the publisher is not engaged in rendering any form of professional or other advice or services. No person should rely on the contents of this publication without first obtaining advice from a qualified professional person.
This publication is subject to copyright. Except as permitted under the Copyright Act 1968, no part of it may in any form or by any means (electronic, mechanical, microcopying, photocopying, recording or otherwise) be reproduced, stored in a retrieval system or transmitted without prior written permission. Enquiries should be addressed to the publishers. Notwithstanding the above, educational institutions (including schools, independent colleges, universities and TAFEs) are granted permission to make copies of copyrighted works strictly for educational purposes without explicit permission from ASPI and free of charge.
Department of Foreign Affairs and Trade, Australia’s International Cyber Engagement Strategy, Australian Government, October 2017, 7. ↩︎
For background, see Pierre Wack, ‘Scenarios: Shooting the Rapids – How Medium-Term Analysis Illuminated the Power of Scenarios for Shell Management,’ Harvard Business Review (1985), 139-150; Peter Schwartz, The Art of the Long View: Planning for the Future in an Uncertain World, Doubleday, New Your 1991; Naazneen H. Barma, Brent Durbin, Eric Lorber, and Rachel E. Whitlark, ‘“Imagine a World in Which”: Using Scenarios in Political Science’, International Studies Perspectives 17 (2016), 117-135. ↩︎
Center for Long-Term Cybersecurity, Cybersecurity futures 2020, online; Jonathan Reiber, Arun M Sukumar, Asian cybersecurity futures: opportunities and risk in the rising digital world, Center for Long-term Cybersecurity↩︎
Among others, see William J Drake, Vinton G Cerf, Wolfgang Kleinwachter, Internet fragmentation: an overview, Future of the Internet Initiative White Paper, World Economic Forum, January 2016, online; Scott Malcomson, Splinternet: how geopolitics and commerce are fragmenting the World Wide Web, OR Books, New York, 2016; Davey Alba, ‘The world may be heading for a fragmented “splinternet”’, WIRED, 7 June 2017 ↩︎
Graham Allison, ‘The Thucydides trap: are the US and China headed for war?’, The Atlantic, 24 September 2015 ↩︎
Over the course of 2018, ASPI staff and writers for The Strategistparticipated in a dynamic public debate about the participation of Chinese telecommunications equipment manufacturer Huawei in Australia’s 5G network.
Australia’s 5G network is critical national infrastructure and this was one of the most important policy decisions the government had to make this year.
ASPI felt it was vital to stimulate and lead a frank and robust public discussion, in Australia and throughout the wider region, which analysed and debated the national security, cybersecurity and international implications of Huawei’s involvement in this infrastructure.
In this report, in chronological order, you’ll read a range of views written up in The Strategist, The Australian and The Financial Times.
These articles tackle a variety of issues surrounding the decision, including the cybersecurity dimension, the broader Australia–China relationship, other states’ experiences with Huawei, the Chinese Government’s approach to cyber espionage and intellectual property theft and, importantly, the Chinese party-state’s view of state security and intelligence work.
When it comes to important national security, cybersecurity and critical infrastructure decisions, ASPI will continue to stimulate Australian public discourse and fill gaps in global debates.
We also encourage the Australian Government to take a more forward-leaning approach to its participation in public discourse so that the public and key stakeholders are as informed as possible when hard and complicated policy decisions like this need to be made.
https://aspi.s3.ap-southeast-2.amazonaws.com/wp-content/uploads/2024/12/15190418/huawei-in-australia-banner.jpg4511350nathanhttps://aspi.s3.ap-southeast-2.amazonaws.com/wp-content/uploads/2025/04/10130806/ASPI-Logo.pngnathan2018-10-10 06:00:002025-03-06 15:05:57Huawei and Australia’s 5G Network
Ananalysis of non-Australian government funded parliamentary travel between 2010 and 2018
This ASPI report uses the information Members and Senators disclose on the Federal Registers of Interests to analyse the top funders of our Federal parliamentarians’ overseas travel. It shows that, over the period 2010-2018 Federal parliamentarians received 102 sponsored trips to Israel, 63 to China and 49 to the United States of America. The largest sponsor of all non-Australian government-funded trips was the Australia/Israel and Jewish Affairs Council. The largest sponsor of trips to China was the telecommunications company, Huawei, while the largest sponsor of trips to the United States was the Australia America Leadership Dialogue.
The data shows that Federal parliamentarians are disclosing their interests, which is healthy for democracy, although the format and system of disclosure could be made more accessible to promote public transparency and analysis.
https://aspi.s3.ap-southeast-2.amazonaws.com/wp-content/uploads/2025/05/13091314/Who-funds-Federal-Parliamentarians-overseas-travel.jpg4501350markohttps://aspi.s3.ap-southeast-2.amazonaws.com/wp-content/uploads/2025/04/10130806/ASPI-Logo.pngmarko2018-06-26 09:06:002025-05-13 09:16:42Who funds Federal Parliamentarians’ overseas travel?
Thailand’s rapid ascent as a 5G leader in Southeast Asia has, in part, been powered by Huawei. While many Western nations excluded Huawei from their 5G rollout over security concerns, Thailand—like several regional neighbours—embraced the technology giant to enable its digital transformation. Yet this decision hinders Thailand’s ‘bamboo strategy’—maintaining the strength and flexibility to adapt to shifting international dynamics—and carries significant long-term security implications.
Huawei’s cost-effective solutions and deployment speed made it the preferred choice for major telecommunications operators AIS and True Corp, especially as they rolled out 5G to 158 hospitals during the Covid-19 pandemic, boosting connectivity for healthcare and digital business. Huawei cemented its dominant position by aligning its offerings with government priorities and expanding local capacity.
But this dominance risks vendor lock-in, stifling competition and innovation, making it harder for local or alternative providers to gain a foothold. This also reduces Thailand’s ability to negotiate better deals or diversify suppliers in the future. Over time, such dependency could undermine Thailand’s digital sovereignty and bargaining power, particularly as the technology and geopolitical landscapes shift.
Huawei has also embedded itself in Thailand’s digital infrastructure, operating three data centres, integrating with government cloud services and partnering in projects such as the Laem Chabang 5G Port and national rail systems. While these partnerships drive efficiency, they also create dependencies. As geopolitical tensions rise, Thailand could find itself exposed to vulnerabilities, especially if foreign technology becomes the target of sanctions or cyber operations.
Huawei’s reach extends to national projects, including fibre broadband infrastructure, smart hospitals, factories and e-government services. Through partnerships with the Office of the Eastern Economic Corridor and the National Broadcasting and Telecommunications Commission, these initiatives support Thailand’s ambition to become ASEAN’s digital hub. Simultaneously, it increases the risks of systemic disruption if bilateral relations deteriorate or technology supply chains are compromised. The growing complexity of digital supply chains, and the risk of shutdown or system compromise—whether from US or Chinese technology—cannot be ignored.
Huawei has reinforced its influence within Thailand’s digital governance through capacity building. It has trained around 96,000 government officials, tech professionals and students. These efforts have earned it high-level recognition, including awards from the prime minister and the royal family. While increasing Thailand’s workforce readiness, Huawei has entrenched its soft power, making future diversification or regulatory oversight more difficult.
Given its developmental imperatives, Thailand prioritises benefits such as cost-effectiveness, coverage and deployment speed over geopolitical concerns. Huawei’s competitive pricing and its unmatched investments strongly influence the vendor choices of Thai telecommunications operators. Although some operators are trying to diversify their vendors, affordability and speed favour Huawei.
Prioritising cost and speed over long-term resilience may deliver short-term gains but erodes Thailand’s ability to negotiate or pivot as circumstances change. Currently, Thailand can still negotiate better terms and build in safeguards for the future.
The government acknowledges the risks of monopolisation, with former minister Pichet Durongkaveroj stating that working with Huawei doesn’t mean neglecting security, citing efforts to strengthen cybersecurity due diligence. Huawei’s track record in the region remains relatively clean compared to competitors such as Ericsson, which faced corruption scandals in Vietnam, Indonesia and China. But the absence of major security incidents so far does not guarantee future safety.
Veteran diplomat Sihasak Phuangketkeow noted that Huawei’s success in Thailand stems from the need for rapid 5G development and economic pragmatism. However, the dominance of Chinese supply chains should not preclude Thailand from seeking better deals or building safeguards to protect its digital future.
Some industry practitioners estimate that Huawei now dominates around 70 percent of the market. This dominance limits future upgrade options, including the transition to 6G. Crucially, the foundation laid by 5G does not have to dictate 6G choices. Open standards such as Open RAN could allow Thailand to keep its options open and avoid repeating current dependencies—a point that should be emphasised as the country plans its telecommunications future.
Such risks extend beyond wireless networks to other critical infrastructure, including subsea cables, where interoperability becomes a major issue if Southeast Asian countries want to connect seamlessly with Western partners. Southeast Asia faces difficult choices due to bifurcation of the market, as well as US efforts to dissuade partners from engaging China in undersea cable projects. If Thailand doesn’t diversify its vendor base, this growing divide could leave the country isolated from certain global networks.
The challenge for Thailand will be balancing rapid 5G and 6G deployment with long-term security. This requires regional strategies, robust financing and partnerships that align with Thailand’s goals, while mitigating the risks of overdependence. Understandably, this is complicated by the lack of viable alternatives to Huawei and the absence of unified strategies comparable to China’s Belt and Road Initiative.
The push for competition and diversification is not just about security; it’s about ensuring Thailand can negotiate, innovate and adapt. Until such measures are in place, Huawei is likely to remain Thailand’s prime partner, at a growing cost to its strategic autonomy and future bargaining power.
https://aspi.s3.ap-southeast-2.amazonaws.com/wp-content/uploads/2025/05/12101128/Huawei-drives-and-dominates-Thailands-digital-ascent.jpg12961920adamhttps://aspi.s3.ap-southeast-2.amazonaws.com/wp-content/uploads/2025/04/10130806/ASPI-Logo.pngadam2025-05-08 15:31:002025-05-13 12:21:34Huawei drives and dominates Thailand’s digital ascent
Huawei dominates Indonesia’s telecommunication network infrastructure. It won over Indonesia mainly through cost competitiveness and by generating favour through capacity-building programs and strategic relationships with the government, and telecommunication operators.
But Huawei’s dominance poses risks. It constrains Indonesia’s digital sovereignty and limits its strategic autonomy. To remain in control, Indonesia must take the issue of dependence seriously and incorporate strategic considerations in telecommunications decision-making.
Indonesia’s digital transformation is largely driven by the private sector, especially telecommunications operators. These operators depend on network equipment from foreign vendors. So foreign vendors serve as the backbone of national connectivity—and Huawei has long been recognised as a major player.
In 2019, then Indonesian minister of communication and information technology, Rudiantara, acknowledged Huawei’s significant role in the country’s telecommunications sector. The CFO of telecommunications operator XL Axiata echoed this, estimating that 60 to 70 percent of the industry relied on Huawei.
However, while Huawei is omnipresent in Indonesia’s digital infrastructure, the level of its market share has long remained unclear.
ASPI now has evidence of Huawei’s extensive dominance in Indonesia’s telecommunication equipment market. Based on an overview of major capital expenditure by some of Indonesia’s key telecommunications operators—XL, Indosat and Smartfren—we have found that 70 percent of their network equipment in 2024 came from Huawei. Information from Telkomsel, Indonesia’s largest telecom operator, was unavailable, but our finding still confirms that Huawei is a dominant provider of telecommunications network equipment to Indonesia. It has gained this position at the expense of older suppliers, including Ericsson, Nokia and Alcatel.
Vendors’ market share of operators’ major capital expenditure. Source: XL Axiata, Indosat OH and Smartfren financial statements. ZTE data annualised from Smartfren financial statements.
Technical and commercial considerations determine vendor selection in Indonesia. On the technical side, factors such as product lifecycle and the use of artificial intelligence play a significant role. Commercially, operators focus on costs, including payment terms.
Huawei’s cost competitiveness stems from state subsidies from the Chinese government, including tax breaks and support for research and development. These allow Huawei to offer competitive commercial terms, undercutting rivals. It can also provide competitively priced network maintenance services, as shown in its outsourcing agreement with XL Axiata.
Beyond costs, Huawei has also been able to win influence by offering a wide range of extra support, especially in the form of capacity-building. For instance, it has supported key government agencies—including the presidential palace, National Cyber and Crypto Agency and the military—by providing them with cybersecurity training.
Huawei has also established training centres and organised cybersecurity workshops at major Indonesian universities and vocational schools. Furthermore, Huawei actively cultivates relationships with influential policymakers and politicians by inviting them to Huawei headquarters and signing capacity-building agreements. A prominent official frequently engaged is Luhut Pandjaitan, a powerful political figure in the cabinet of former president Joko Widodo who now serves as chair of President Prabowo Subianto’s National Economic Council.
The Indonesian government has minimal involvement in vendor selection. Although laws exist on personal data protection and cybersecurity, there is no regulatory framework for assessing vendor dependency risks in the telecommunications sector or for assessing risks of vendors to national or economic security. Under the Science Act, the Ministry of Research and Technology can audit strategic technologies such as energy and agricultural technologies. However, there is limited public evidence of such audits occurring. This regulatory vacuum leaves Indonesia vulnerable to overdependence on a single foreign telecommunications vendor.
At the macro level, Huawei’s dominance exposes Indonesia to geopolitical risk. As the tech rivalry between the United States and China intensifies, Huawei—as well as ZTE—remains subject to restrictions in many Western economies. So Jakarta’s access to technology from Western countries could be limited and exacerbated by Huawei’s entrenchment in existing 4G infrastructure. Simply, Jakarta’s dependence on Huawei jeopardises its strategic autonomy: it has no real options.
At the micro level, Huawei’s market power puts operators at a significant disadvantage in negotiations; they’re simply price takers. Being reduced to price takers strips operators of their bargaining power: they are left vulnerable to the prospect of inflated costs dictated by Huawei, as switching vendors is complex and financially burdensome, creating a lock-in effect for next generation digital infrastructure. This effect could result in higher capital expenditure for operators, with costs passed on to consumers. Ultimately, Indonesians may face higher service prices, as their access to digital services becomes increasingly dependent on a single company.
These risks will escalate with the rollout of 5G. Unlike previous generations, 5G will underpin critical applications at the enterprise level, where any security lapse could have severe consequences. Now that Indonesia is so involved with Huawei, real alternatives are scarce. This not only has technical or commercial consequences, but it will also have political ramifications, where Indonesia’s strategic autonomy could be compromised. Hence, it is essential for the government to take a more active role in overseeing vendor selection and managing the risks associated with dependency on a single supplier.
https://aspi.s3.ap-southeast-2.amazonaws.com/wp-content/uploads/2025/04/30100806/Indonesia-is-hooked-on-Huawei.jpg9601536markohttps://aspi.s3.ap-southeast-2.amazonaws.com/wp-content/uploads/2025/04/10130806/ASPI-Logo.pngmarko2025-04-29 10:06:082025-04-30 10:09:32Indonesia is hooked on Huawei
It is disappointing that the Brits are doing the wrong thing on 5G, having not exhausted other possibilities. Instead they have doubled down on a flawed and outdated cybersecurity model to convince themselves that they can manage the risk that Chinese intelligence services could use Huawei’s access to UK telco networks to insert bad code.
5G decisions reflect one of those quietly pivotal moments that crystallise a change in world affairs.
This is partly because the technology itself promises to be revolutionary, connecting not just humans but every device with a chip in it with super-fast, high-bandwidth and low-latency communications. That means if you have the keys to 5G networks, you will be trusted with the nervous system running down the backbone of every country which uses your gear and contracts you to service it. That includes critical infrastructure and safety-critical systems on which the lives and livelihoods of our citizens depend—traffic, power, water, food supply and hospitals. You get to be ‘The Borg’.
But 5G is also a touchstone for the coming age because it is the first in a line of revolutionary and highly intrusive emerging technologies in which China has invested heavily. Through means fair and foul, China has built world-leading companies with high-quality, competitive offerings for everything from video surveillance and industrial control systems to artificial intelligence and internet services via hyperscalers such as Tencent and Alibaba. So any decision to exclude Chinese companies from 5G is a threat to China’s economic and strategic positioning.
Having been caught off guard by BT’s decision to use Huawei equipment in the core of its network, in 2010 the UK government set up a Huawei-funded cybersecurity transparency centre ‘to mitigate any perceived risks arising from the involvement of Huawei in parts of the UK’s critical national infrastructure’ by evaluating Huawei products used in the UK telecommunications market.
Australia has taken a different approach and reached a different conclusion. I was part of the team in the Australian Signals Directorate that tried to design a suite of cybersecurity controls that would give the government confidence that hostile intelligence services could not leverage their national vendors to gain access to our 5G networks.
We developed pages of cybersecurity mitigation measures to see if it was possible to prevent a sophisticated state actor from accessing our networks through a vendor. But we failed.
We asked ourselves, if we had the powers akin to the 2017 Chinese Intelligence Law to direct a company which supplies 5G equipment to telco networks, what could we do with that and could anyone stop us?
We concluded that we could be awesome, no one would know and, if they did, we could plausibly deny our activities, safe in the knowledge that it would be too late to reverse billions of dollars’ worth of investment. And, ironically, our targets would be paying to build a platform for our own signals intelligence and offensive cyber operations.
Legally compelled access to 5G vendors is game-changing for Chinese intelligence agencies because hacking is an increasingly tough business. The cybersecurity industry has lifted its game mightily over the past decade, and—certainly at the high end—the advantage is currently with the defender.
The hardest part of hacking is the access problem. How can you get into the network? For that you typically need to find vulnerabilities in the way software operates, which can be weaponised into an exploit. Exploitable vulnerabilities are hard to find. Often they are specific to a piece of equipment or a particular network. Often you need to string a chain of exploits together. And if they are super great, the chances are Five Eyes agencies will need to disclose them, as the US National Security Agency did recently when it found a Windows 10 security flaw.
As a citizen, I’m glad that hacking is difficult and that Five Eyes agencies think it more important to protect their own national networks than to pursue those of their adversaries.
But Chinese intelligence agencies have a mortgage on Jack’s proverbial beanstalk—scaled and persistent access to hundreds of foreign telco networks via legally compelled Chinese suppliers of competitively priced, high-quality technology to these telcos.
Cybersecurity is all about raising the costs for the attacker. Network access through vendors—which need to be all over 5G networks to maintain their equipment—effectively reduces the access cost to zero.
Much of the 5G debate has been about whether the core of the network—where sensitive data and functions reside in a 4G format—can be protected in a 5G setting. Telcos currently protect the core of their 4G networks by maintaining a physical and logical separation between the core and the less secure, customer-facing edge of the network.
But with 5G, all network functionality is virtualised and takes place within a single cloud environment. That means there is no physical or logical separation between the core and edge of the network.
A recent Financial Times editorial approvingly cites testimony to UK parliamentary hearings last year that ‘the distinction [between core and edge] would still be valid in Britain, however; geographical differences meant its networks would be designed differently from Australia’s’.
I struggle to understand what this means. It reminds me of the vague, faux authoritative language techies use to talk down to civilians with humanities degrees. If it means the relative size of the United Kingdom allows its telcos to avoid distributing sensitive data and functions right to the edge of the network, I’m still not convinced.
Geography is not a factor in how core–edge works. The reality is mature 5G networks actually require the collapse of the core–edge distinction. 5G can only reach its potential for speed and low latency if sensitive functions can happen at the edge of the network close to the customer. And 5G can only realise its cost-saving potential if any function can occur at the most efficient place in the network, wherever that is. In mature 5G networks, sensitive data and functions will be distributed throughout the network in a dynamic way which will be impossible to govern with certainty.
Sure, many telcos (including in Australia) are already operating networks branded as ‘5G’, on the basis that they deploy new, more efficient 5G radios at the edge of the network. But the hyperconnected, transformational 5G future marketed by the telcos can only be realised if there is no distinction between core and edge.
Telcos could limit their 5G offerings to smart radios at the edge, but that would be like a layer cake with one layer. Who would buy that?
In one sense, we should only be moderately concerned about the exposure of sensitive data which in a 5G world would no longer be protected in the network core. Even if an adversary had access to this data, implementation of strong encryption can theoretically protect its confidentiality (are my communications private?) and integrity (have my communications been altered?). This is not foolproof—adversary supercomputers would have direct access to all the ones and the zeros and exploitation of poor implementation of encryption is not uncommon in the signals intelligence game.
But we should be more concerned about the availability of our data and networks (can I continue to communicate?). Availability, after all, can be controlled by whoever has access to the radio network at the edge. This is a risk we face in 4G networks today.
The other argument reportedly put to the UK parliamentary committee was that a ‘diverse supply chain generally makes networks more resilient to technical and security problems’. The obvious question is, which parts of your network are you prepared to put at higher sovereign risk? And, if Huawei is limited to only 35% of the network, isn’t that an admission that there’s a risk which might not be able to be fully mitigated through cybersecurity controls?
While geography is immaterial in core–edge architectures, it is relevant to another Huawei argument. The company claims Australian farmers are missing out on the revolutionary benefits their Swiss counterparts are reaping from 5G.
But you don’t need to be William Farrer to work out that (a) 5G communications in cyberspace rely on a very expensive physical network of closely spaced antennae, and (b) Australia is about 188 times the size of Switzerland (our summer bushfires have so far burned an area equivalent to almost five Switzerlands).
That’s a lot of yodelling.
At the heart of Huawei’s proposition is the claim that it is cheaper than its competitors. An Oxford Economics report commissioned by Huawei last year claims that excluding the company from bidding for our 5G networks will cost Australia up to $12 billion in GDP out to 2035.
Leaving aside the obvious point that digital sovereignty and the integrity of critical infrastructure are priceless, I have not seen any independent analysis of the impact of excluding Chinese vendors from 5G. Beyond the market effects of restricting competition, any serious analysis would also need to consider the following factors:
whole-of-life costs versus up-front sticker costs
the risk that prices will rise once competitors are driven out of business
the cost of a serious suite of mitigations any responsible government would need to put in place to manage the security risks of using a high-risk vendor (even mitigations which cannot provide full confidence are expensive and create network inefficiencies)
the risk of ongoing US measures against Huawei to the operation of networks using its equipment.
The tools and language of traditional cybersecurity are ill-equipped to describe and manage a world in which the Chinese state entwines China’s tech giants. Old-style cybersecurity evolved to deal with threats from outside the network. The ecosystem itself was trusted, and cybersecurity’s job was limited to protecting that ecosystem from external bad actors. But none of this works if the threat is inside your network. In this new world, no number of impressive-sounding mitigation measures or cybersecurity standards can provide confidence that your networks are fully protected.
When you are one update away from being owned, a code review cannot provide any confidence that the code you checked reflects the code in your network. Even with expensive oversight by cleared personnel, it would be hard to spot malware developed by a top-notch intelligence agency, especially when the network is down and your customers are screaming.
By its own admission, the UK Huawei Cyber Security Evaluation Centre is not working as advertised. In its most recent report last year, the centre’s oversight board found that HCSEC ‘has continued to identify concerning issues in Huawei’s approach to software development bringing significantly increased risk to UK operators …; [n]o material progress has been made on the issues raised in the previous 2018 report; [and] the Oversight Board can only provide limited assurance that all risks to UK national security from Huawei’s involvement in the UK’s critical networks can be sufficiently mitigated long-term’.
And yet this is the model that the UK government touts to the world as providing confidence that the risks of Huawei’s 5G products can be managed.
While technology is the setting for this sliding-door moment, the fundamental issue is one of trust between nations in cyberspace. And over the past decade, the Chinese Communist Party has destroyed that trust through its scaled and indiscriminate hacking of foreign networks and its determination to direct and control Chinese tech companies.
China wants it both ways—to be treated by the same rules as other countries but to break those rules when it suits.
Although I remain sceptical about some of Huawei’s marketing claims, my concerns are not about the company or the quality of its products. They relate to the legal and political power of the Chinese state to compel the company to do its bidding. It’s simply not reasonable to expect that Huawei would refuse a direction from the Chinese Communist Party, especially one backed by law.
When I look at the risk to 5G networks as an intelligence professional would, it’s all about capability, opportunity and intent. The ability to compel Chinese vendors of 5G equipment is a strategic capability for China’s intelligence services. Huawei’s competitive offerings in a revolutionary technology like 5G are an unsurpassable opportunity. And, as I mentioned, China has demonstrated ample malign intent in cyberspace.
So, if your telcos have a 5G operation and maintenance contract with a company beholden to the intelligence agencies of a foreign state, and that state does not share your interests, you need to consider the risk that you are paying a fox to babysit your chickens.
https://aspi.s3.ap-southeast-2.amazonaws.com/wp-content/uploads/2025/04/10130806/ASPI-Logo.png00markohttps://aspi.s3.ap-southeast-2.amazonaws.com/wp-content/uploads/2025/04/10130806/ASPI-Logo.pngmarko2020-12-31 19:00:312020-12-31 19:00:31Editors’ picks for 2020: ‘5G choices: a pivotal moment in world affairs’
The United Kingdom’s decision to ban Huawei from its 5G networks has dealt a painful blow to China. Until recently, Beijing was still counting on the UK government to stick to its earlier decision to allow the Chinese telecom giant to supply non-core equipment for the country’s 5G networks.
But two recent developments made such a decision untenable. The first was the United States’ escalation of its war on Huawei. The US instituted a new sanction in May banning suppliers that use American technology from providing semiconductors to Huawei. Because US technology is used to manufacture the advanced semiconductors that Huawei’s products, including 5G base stations, require, the company’s supply will be cut off, making production of its 5G equipment nearly impossible.
The prospect that a key supplier of the UK’s 5G networks would no longer be able to build and maintain its system is a far more serious threat than potential Chinese snooping is. No responsible government can afford to take such a risk. So, Huawei’s days were numbered as soon as the US government pulled the trigger in May. The only question was when Prime Minister Boris Johnson would tell President Xi Jinping the bad news.
The second development, which made it politically easier for Johnson to embrace the Huawei ban, is China’s imposition of its new national security law on Hong Kong. This draconian legislation, which was proposed in late May and passed by China’s rubber-stamp parliament on 30 June, has for all practical purposes ended the autonomous status of the former British colony. From the UK’s perspective, China’s action is a blatant violation of the 1984 Sino-British Joint Declaration on Hong Kong, which includes China’s pledge to respect and protect the city’s legal system and civil liberties for 50 years after its reversion to Chinese rule in 1997.
Chinese leaders might think that the UK is too weak to fight back. Clearly, they are wrong. The UK has decided to take a stand on Hong Kong, and Huawei is an easy and obvious target.
China may be tempted to strike back, and would seem to have plenty of leverage. It can squeeze UK firms doing business in China. For example, the British banking giant HSBC is especially vulnerable to bullying, because its operations in Hong Kong account for slightly more than half of its profits and a third of its revenue. China may also want to cut down financial transactions it conducts through London and reduce the number of Chinese students it sends to UK colleges and universities.
But such retaliatory measures, however tempting, would ultimately boomerang. Driving HSBC from Hong Kong would surely ruin the city as a global financial centre, because China would be unable to find another global bank to take over its vital role. Given the spiralling tensions between the US and China, it is hard to imagine that China would favour Citi or JPMorgan Chase as a successor to HSBC.
Similarly, restrictions on studying in the UK would hurt China more. Currently, about 120,000 Chinese study in the UK. The challenge for China is that there are few good alternatives if it wants to send students elsewhere. The US is considering restricting Chinese students on national security grounds. China has threatened Australia that it will reduce the number of Chinese tourists and students. Canadian universities, which now host about 140,000 Chinese students, have limited capacity. With China and Canada embroiled in a diplomatic standoff over the extradition to the US of Huawei’s chief financial officer, Meng Wanzhou, it’s unlikely that China will send more students there.
This merely illustrates the daunting reality Xi now faces: China is fast losing friends just when it needs them most. In the past few months alone, China’s relations with India have suffered a devastating blow after a bloody border clash left at least 20 Indian soldiers (and an unspecified number of Chinese soldiers) dead. To punish Australia for daring to call for an international investigation into the origins of the Covid-19 pandemic, China imposed tariffs on Australian barley and threatened other punitive measures. On 14 July, China’s foreign ministry denounced Japan’s recent defence white paper in unusually harsh language, raising doubts about the rapprochement Xi has been trying to engineer with Prime Minister Shinzo Abe.
Chinese leaders have only themselves to blame for their growing international isolation. With an inflated sense of their power, they have overplayed a weak hand and driven friendly or neutral countries such as the UK, Canada, India and Australia into the arms of the US, now China’s principal geopolitical adversary.
So, as China’s leaders ponder how to respond to the UK’s ban on Huawei, they should heed the first rule of holes: when you are in one, stop digging.
It is disappointing that the Brits are doing the wrong thing on 5G, having not exhausted other possibilities. Instead they have doubled down on a flawed and outdated cybersecurity model to convince themselves that they can manage the risk that Chinese intelligence services could use Huawei’s access to UK telco networks to insert bad code.
5G decisions reflect one of those quietly pivotal moments that crystallise a change in world affairs.
This is partly because the technology itself promises to be revolutionary, connecting not just humans but every device with a chip in it with super-fast, high-bandwidth and low-latency communications. That means if you have the keys to 5G networks, you will be trusted with the nervous system running down the backbone of every country which uses your gear and contracts you to service it. That includes critical infrastructure and safety-critical systems on which the lives and livelihoods of our citizens depend—traffic, power, water, food supply and hospitals. You get to be ‘The Borg’.
But 5G is also a touchstone for the coming age because it is the first in a line of revolutionary and highly intrusive emerging technologies in which China has invested heavily. Through means fair and foul, China has built world-leading companies with high-quality, competitive offerings for everything from video surveillance and industrial control systems to artificial intelligence and internet services via hyperscalers such as Tencent and Alibaba. So any decision to exclude Chinese companies from 5G is a threat to China’s economic and strategic positioning.
Having been caught off guard by BT’s decision to use Huawei equipment in the core of its network, in 2010 the UK government set up a Huawei-funded cybersecurity transparency centre ‘to mitigate any perceived risks arising from the involvement of Huawei in parts of the UK’s critical national infrastructure’ by evaluating Huawei products used in the UK telecommunications market.
Australia has taken a different approach and reached a different conclusion. I was part of the team in the Australian Signals Directorate that tried to design a suite of cybersecurity controls that would give the government confidence that hostile intelligence services could not leverage their national vendors to gain access to our 5G networks.
We developed pages of cybersecurity mitigation measures to see if it was possible to prevent a sophisticated state actor from accessing our networks through a vendor. But we failed.
We asked ourselves, if we had the powers akin to the 2017 Chinese Intelligence Law to direct a company which supplies 5G equipment to telco networks, what could we do with that and could anyone stop us?
We concluded that we could be awesome, no one would know and, if they did, we could plausibly deny our activities, safe in the knowledge that it would be too late to reverse billions of dollars’ worth of investment. And, ironically, our targets would be paying to build a platform for our own signals intelligence and offensive cyber operations.
Legally compelled access to 5G vendors is game-changing for Chinese intelligence agencies because hacking is an increasingly tough business. The cybersecurity industry has lifted its game mightily over the past decade, and—certainly at the high end—the advantage is currently with the defender.
The hardest part of hacking is the access problem. How can you get into the network? For that you typically need to find vulnerabilities in the way software operates, which can be weaponised into an exploit. Exploitable vulnerabilities are hard to find. Often they are specific to a piece of equipment or a particular network. Often you need to string a chain of exploits together. And if they are super great, the chances are Five Eyes agencies will need to disclose them, as the US National Security Agency did recently when it found a Windows 10 security flaw.
As a citizen, I’m glad that hacking is difficult and that Five Eyes agencies think it more important to protect their own national networks than to pursue those of their adversaries.
But Chinese intelligence agencies have a mortgage on Jack’s proverbial beanstalk—scaled and persistent access to hundreds of foreign telco networks via legally compelled Chinese suppliers of competitively priced, high-quality technology to these telcos.
Cybersecurity is all about raising the costs for the attacker. Network access through vendors—which need to be all over 5G networks to maintain their equipment—effectively reduces the access cost to zero.
Much of the 5G debate has been about whether the core of the network—where sensitive data and functions reside in a 4G format—can be protected in a 5G setting. Telcos currently protect the core of their 4G networks by maintaining a physical and logical separation between the core and the less secure, customer-facing edge of the network.
But with 5G, all network functionality is virtualised and takes place within a single cloud environment. That means there is no physical or logical separation between the core and edge of the network.
A recent Financial Times editorial approvingly cites testimony to UK parliamentary hearings last year that ‘the distinction [between core and edge] would still be valid in Britain, however; geographical differences meant its networks would be designed differently from Australia’s’.
I struggle to understand what this means. It reminds me of the vague, faux authoritative language techies use to talk down to civilians with humanities degrees. If it means the relative size of the United Kingdom allows its telcos to avoid distributing sensitive data and functions right to the edge of the network, I’m still not convinced.
Geography is not a factor in how core–edge works. The reality is mature 5G networks actually require the collapse of the core–edge distinction. 5G can only reach its potential for speed and low latency if sensitive functions can happen at the edge of the network close to the customer. And 5G can only realise its cost-saving potential if any function can occur at the most efficient place in the network, wherever that is. In mature 5G networks, sensitive data and functions will be distributed throughout the network in a dynamic way which will be impossible to govern with certainty.
Sure, many telcos (including in Australia) are already operating networks branded as ‘5G’, on the basis that they deploy new, more efficient 5G radios at the edge of the network. But the hyperconnected, transformational 5G future marketed by the telcos can only be realised if there is no distinction between core and edge.
Telcos could limit their 5G offerings to smart radios at the edge, but that would be like a layer cake with one layer. Who would buy that?
In one sense, we should only be moderately concerned about the exposure of sensitive data which in a 5G world would no longer be protected in the network core. Even if an adversary had access to this data, implementation of strong encryption can theoretically protect its confidentiality (are my communications private?) and integrity (have my communications been altered?). This is not foolproof—adversary supercomputers would have direct access to all the ones and the zeros and exploitation of poor implementation of encryption is not uncommon in the signals intelligence game.
But we should be more concerned about the availability of our data and networks (can I continue to communicate?). Availability, after all, can be controlled by whoever has access to the radio network at the edge. This is a risk we face in 4G networks today.
The other argument reportedly put to the UK parliamentary committee was that a ‘diverse supply chain generally makes networks more resilient to technical and security problems’. The obvious question is, which parts of your network are you prepared to put at higher sovereign risk? And, if Huawei is limited to only 35% of the network, isn’t that an admission that there’s a risk which might not be able to be fully mitigated through cybersecurity controls?
While geography is immaterial in core–edge architectures, it is relevant to another Huawei argument. The company claims Australian farmers are missing out on the revolutionary benefits their Swiss counterparts are reaping from 5G.
But you don’t need to be William Farrer to work out that (a) 5G communications in cyberspace rely on a very expensive physical network of closely spaced antennae, and (b) Australia is about 188 times the size of Switzerland (our summer bushfires have so far burned an area equivalent to almost five Switzerlands).
That’s a lot of yodelling.
At the heart of Huawei’s proposition is the claim that it is cheaper than its competitors. An Oxford Economics report commissioned by Huawei last year claims that excluding the company from bidding for our 5G networks will cost Australia up to $12 billion in GDP out to 2035.
Leaving aside the obvious point that digital sovereignty and the integrity of critical infrastructure are priceless, I have not seen any independent analysis of the impact of excluding Chinese vendors from 5G. Beyond the market effects of restricting competition, any serious analysis would also need to consider the following factors:
whole-of-life costs versus up-front sticker costs
the risk that prices will rise once competitors are driven out of business
the cost of a serious suite of mitigations any responsible government would need to put in place to manage the security risks of using a high-risk vendor (even mitigations which cannot provide full confidence are expensive and create network inefficiencies)
the risk of ongoing US measures against Huawei to the operation of networks using its equipment.
The tools and language of traditional cybersecurity are ill-equipped to describe and manage a world in which the Chinese state entwines China’s tech giants. Old-style cybersecurity evolved to deal with threats from outside the network. The ecosystem itself was trusted, and cybersecurity’s job was limited to protecting that ecosystem from external bad actors. But none of this works if the threat is inside your network. In this new world, no number of impressive-sounding mitigation measures or cybersecurity standards can provide confidence that your networks are fully protected.
When you are one update away from being owned, a code review cannot provide any confidence that the code you checked reflects the code in your network. Even with expensive oversight by cleared personnel, it would be hard to spot malware developed by a top-notch intelligence agency, especially when the network is down and your customers are screaming.
By its own admission, the UK Huawei Cyber Security Evaluation Centre is not working as advertised. In its most recent report last year, the centre’s oversight board found that HCSEC ‘has continued to identify concerning issues in Huawei’s approach to software development bringing significantly increased risk to UK operators …; [n]o material progress has been made on the issues raised in the previous 2018 report; [and] the Oversight Board can only provide limited assurance that all risks to UK national security from Huawei’s involvement in the UK’s critical networks can be sufficiently mitigated long-term’.
And yet this is the model that the UK government touts to the world as providing confidence that the risks of Huawei’s 5G products can be managed.
While technology is the setting for this sliding-door moment, the fundamental issue is one of trust between nations in cyberspace. And over the past decade, the Chinese Communist Party has destroyed that trust through its scaled and indiscriminate hacking of foreign networks and its determination to direct and control Chinese tech companies.
China wants it both ways—to be treated by the same rules as other countries but to break those rules when it suits.
Although I remain sceptical about some of Huawei’s marketing claims, my concerns are not about the company or the quality of its products. They relate to the legal and political power of the Chinese state to compel the company to do its bidding. It’s simply not reasonable to expect that Huawei would refuse a direction from the Chinese Communist Party, especially one backed by law.
When I look at the risk to 5G networks as an intelligence professional would, it’s all about capability, opportunity and intent. The ability to compel Chinese vendors of 5G equipment is a strategic capability for China’s intelligence services. Huawei’s competitive offerings in a revolutionary technology like 5G are an unsurpassable opportunity. And, as I mentioned, China has demonstrated ample malign intent in cyberspace.
So, if your telcos have a 5G operation and maintenance contract with a company beholden to the intelligence agencies of a foreign state, and that state does not share your interests, you need to consider the risk that you are paying a fox to babysit your chickens.
https://aspi.s3.ap-southeast-2.amazonaws.com/wp-content/uploads/2025/04/10130806/ASPI-Logo.png00markohttps://aspi.s3.ap-southeast-2.amazonaws.com/wp-content/uploads/2025/04/10130806/ASPI-Logo.pngmarko2020-01-29 04:25:142020-01-29 04:25:145G choices: a pivotal moment in world affairs
Taiwan is walking an increasingly fine line between its security and economic interests when it comes to major Chinese technology companies—and it’s about to get (even more) political.
Last Friday, the Taiwanese government announced an expanded crackdown on the use of Chinese technology. According to a spokesperson, the Taiwanese government is in the process of drawing up a blacklist of tech companies that pose a risk to national security. The ban will cover specific equipment such as servers, webcams, drones, cloud services, core network hardware, computer software and anti-virus software. Taiwanese government agencies, state-controlled companies and providers of critical infrastructure—including water, energy, telecommunications and financial services—will be prohibited from using equipment from companies on the list, which is expected to be released in a few months.
It is anticipated that major Chinese technology companies, such as Huawei, ZTE, Alibaba, Hikvision and Baidu, will be included in the list. According to Nikkei Asian Review, the government spokesperson said that ‘most’ Chinese (as well as Russian) companies are likely to be banned.
However, Taiwan’s high-tech manufacturing industry remains heavily reliant on Chinese demand—including from many of the very same companies which its government intends to ban.
Just days before the move was announced, March sales figures revealed that orders from Chinese technology companies played a crucial role in lifting Taiwan’s tech manufacturing industry out of a three-year record low in February 2019. The improvement is credited in particular to demand linked to a new flagship phone from Huawei.
‘Huawei’s parts orders on the supply chain grew some 45% from a year ago in the January–March period, according to our checks. Huawei is doing very well in China as the US crackdown drives the patriotism of Chinese consumers, and [the company] also delivers high-quality products’, Jeff Pu, an analyst at GF Securities, told Nikkei Asian Review.
As if this wasn’t complicated enough for one week, news also broke that Terry Gou, outgoing CEO of Foxconn and Taiwan’s richest man, intends to stand in the island nation’s upcoming presidential elections.
Gou—who ascribes his decision to run for the presidency to divine guidance from the sea goddess Mazu—is a controversial character with deep personal and business ties to mainland China. Gou has said he will step down as chair of Foxconn but will remain involved in the company’s major decisions. Foxconn is one of the world’s largest smartphone manufacturers and counts Apple and Huawei among its biggest clients. Gou is Foxconn’s largest shareholder, owning 9.4% of the US$40 billion company. He will be seeking to stand as the presidential candidate for the pro-Chinese Kuomintang party.
Gou’s potential candidacy has raised significant concerns among those who see a likely conflict between his business interests in China and his responsibilities to Taiwanese national interests if elected. Foxconn was expected to hire an additional 50,000 workers off the back of orders from Huawei alone in February.
‘That’s the million dollar question. Who is Gou loyal to? Taiwan? Foxconn? Both? If the answer is Foxconn or both, that puts Taiwan in a bad position with Gou as president because Foxconn’s success is tied to, coercively or not, the Chinese state’, says Lev Nachman, an expert on Taiwanese politics at the University of California.
So, the Taiwanese government intends to blacklist particular Chinese technology companies as threats to national security while simultaneously relying on those same companies to support a crucial part of the Taiwanese economy and at the same time as a powerful and high-profile candidate with ongoing business links to those companies may be running for president.
What this reflects is how seemingly mundane aspects of the technology industry, such as where devices are manufactured or the internal workings of government procurement, are increasingly politically and strategically significant.
Navigating between the dual facets of China’s technology companies as crucial commercial partners on the one hand and potential security risks on the other is a challenge which many countries face, but for Taiwan—long caught at the pointiest of pointy ends of China’s sharp power—the dilemma is particularly acute. Whoever wins in the upcoming elections will be faced with a series of difficult choices. When that time comes, the Taiwanese people will no doubt be hoping that the best interests of Taiwan are the only interests which that person has in mind.
It’s convenient to call the escalating geopolitical contest between the United States and China a ‘new cold war’. But that description should not be allowed to obscure the obvious, though not yet sufficiently understood, reality that this new competition will differ radically from the Cold War between the US and the Soviet Union.
The Cold War of the 20th century pitted two rival military alliances against each other. By contrast, the Sino-American rivalry involves two economies that are closely integrated both with each other and with the rest of the world. The most decisive battles in today’s cold war will thus be fought on the economic front (trade, technology and investment), rather than in, say, the South China Sea or the Taiwan Strait.
Some American strategic thinkers have recognised this, and now argue that, if the US is to win this cold war, it must sever its commercial ties with China—and persuade its allies to do the same. But, as the ongoing bilateral trade war demonstrates, this is easier said than done. Contrary to US President Donald Trump’s claim that it would be ‘easy to win’, that war has imposed such high costs, even as the US trade deficit continues to widen, that Trump now seems to be having second thoughts about further escalation.
If the US, with its strong geopolitical incentive, is struggling to bear the costs of an economic decoupling, its allies, most of which face no immediate Chinese security threat, will resist doing the same. Their reticence is obvious in their response to America’s aggressive campaign against the Chinese telecommunications giant Huawei.
So far, that campaign has included the arrest (in Canada) of Huawei CFO Meng Wanzhou and legal action against the company for violating sanctions against Iran and for stealing US technology. The Trump administration has also called on allies to keep Huawei—the global leader in next-generation 5G mobile technology—out of their wireless communication networks.
The case against entrusting Huawei to build 5G networks in Western countries is strong. Given the Chinese government’s unfettered power over the country’s companies, including Huawei technology in 5G networks could give rise to serious security risks. For countries that can’t afford the expensive equipment (and view Chinese domination as only a distant concern), those risks may be worth taking. But that is not the case for America’s wealthy allies.
Yet, so far, only Australia and New Zealand have complied with the US demand to ban Huawei. While Canada is considering joining them, European countries have defied the Trump administration, with the United Kingdom and Germany indicating that they would allow Huawei to participate in the construction of their 5G networks. South Korea and India have similarly resisted US pressure to exclude Huawei.
Despite the national security implications, the fact remains that banning Huawei would result in higher costs and significant delays. Yet the US has offered no rewards or compensation to its wavering allies.
This underscores a key challenge that the US will likely confront in the new cold war. Though America is likely ultimately to come out on top, victory will not come cheap. Isolating China economically—which is crucial to gaining the upper hand—will require the US not only to shoulder its own costs, but also to compensate its allies for the losses they incur.
Victory will not come fast, either, especially if the US remains so eager to secure short-term wins—such as Chinese promises to purchase large quantities of American soybeans and energy products—that it fails to encourage the systematic changes that would benefit it and its allies in the long run. Such opportunism makes US allies doubt America’s resolve in an economic confrontation with China, fuelling fear that they will shoulder high short-term costs for nothing.
The Trump administration has already displayed an utter lack of concern for its allies’ economic interests. It is chiefly US allies that have been hurt by the Trump administration’s tariffs on steel and aluminium imports, and now the administration is threatening to go further, imposing a tariff specifically on European and Japanese automobiles. Trump has reportedly even been considering demanding that America’s allies pay the full cost, plus 50%, of stationing US troops on their territory.
Trump’s approach reflects not just a lack of loyalty, but also a lack of vision for sustaining, let alone strengthening, America’s own economic leverage. Recall that, almost immediately upon entering the White House, Trump withdrew from the Trans-Pacific Partnership, a free-trade agreement that sought specifically to prevent Chinese economic domination in the Asia–Pacific region.
The new cold war against China will be won not through ideology or even weaponry, but through the deployment of economic incentives to wage a geopolitical struggle. The winning strategy will not be one that weaponises only America’s greed. By nickel-and-diming its allies, the US is effectively disarming itself.
https://aspi.s3.ap-southeast-2.amazonaws.com/wp-content/uploads/2025/04/10130806/ASPI-Logo.png00markohttps://aspi.s3.ap-southeast-2.amazonaws.com/wp-content/uploads/2025/04/10130806/ASPI-Logo.pngmarko2019-03-15 19:00:342019-03-15 19:00:34The high costs of the new cold war
The stoush between Beijing and Washington over Chinese telco Huawei shows that countries no longer compete only by using military or economic might. ‘Law enforcement power’—the use of a country’s internal law and justice systems to advance its foreign policy—is an increasingly visible tool of national power, and both China and the US are enthusiastic adopters. The way each country wields the tool has thrown into sharp relief the differences between the two countries’ justice systems and their broader national strategies. It’s also a development that Australia should be watching and seeking to learn from.
In recent months, China has shown an unprecedented willingness to co-opt its domestic law institutions to serve its foreign policy interests. Last December, in a tit-for-tat reaction to Canada’s arrest of Huawei finance chief Meng Wengzhou, Chinese law enforcement detained two Canadian citizens. Its courts then unexpectedly retried a Canadian drug offender and sentenced him to death. The message is clear: release Meng, or the safety of your citizens can’t be assured in China.
America is also using its law enforcement institutions to push back against China’s rule-flouting and economic aggression. Canada arrested Meng in response to an extradition request from the US. In late January, the US Department of Justice unsealed two indictments that allege serious criminal misconduct by Huawei, Meng and other senior Huawei executives. In over 50 pages of detailed, publicly available material, the DOJ laid a total of 23 charges, including theft of trade secrets, fraud and money laundering.
America’s open, fact-based and process-driven system of justice—and therefore the way it projects law enforcement power onto the world stage—is in stark contrast to the methods used by China. But it isn’t just China’s and the US’s tactics that differ; it’s also their broader strategies. China’s use of its domestic legal system in the Huawei affair is a textbook example of coercive behaviour—what’s been called ‘hostage diplomacy’. But the rationale for America’s law enforcement strategy is less clear.
Some have suggested that the US is using criminal prosecutions to deter China and its agents from engaging in economic espionage. Since 2017, the DOJ has issued a growing number of indictments against Chinese nationals and companies for offences related to intellectual property theft, and in November 2018 Attorney-General Jeff Sessions formalised this forward-leaning approach in his ‘China initiative’, which will focus on ‘priority Chinese trade theft cases’.
However, if deterrence is the US’s primary objective, indictments are unlikely to deliver. Many of those indicted under the China initiative will never face court (Meng being a notable exception) but will remain in China beyond even the long arm of American law.
China is also unlikely to cease a very lucrative part of its comprehensive, state-driven push for high-tech industrial advancement (that is, IP theft) because of the risk that a small number of individuals or companies may be penalised. For example, the DOJ’s 2014 indictment of five Chinese military members for cyber espionage was, at the time, seen as an effort to get China to curtail its IP theft. In 2015, presidents Xi Jinping and Barack Obama did sign an agreement to cease corporate cyber espionage. But China has not complied. Instead, Xi ensured that China’s cyber spies became better at avoiding detection and more focused on priority technologies.
So, if it hasn’t deterred Chinese wrongdoing in the past, what’s the purpose of America’s law enforcement strategy today?
Whatever the official motivations may be, arguably the greatest benefit from the US strategy isn’t the effect it will have on China’s behaviour. Rather, by using indictments to make information about Chinese wrongdoing public, and backing them with allegations of fact that meet a legal threshold, America is ensuring that decision-makers the world over better understand the nature of the China threat and can justify to their citizens the means to counter it.
The Huawei indictments have injected an important evidential baseline into the global debate about the risks of working with Chinese tech companies. America has been warning of national security threats posed by Huawei for years, and more recently lobbying other countries to reconsider using the company’s equipment. Many countries—including Australia—have now effectively banned Huawei from participating in the rollouts of their 5G mobile networks.
Decisions to ban Huawei products will come with a cost to consumers, businesses and economies. In January, TPG Telecom cancelled its plans for a new $600 million mobile network in a decision that the company’s CEO claimed was a direct result of Australia’s Huawei ban. Making information about Huawei’s allegedly unlawful activities public, rather than keeping it cloistered within government agencies, can help bring citizens along with these decisions.
Using law enforcement power offers an important way to give the public insight into the nature of today’s national security environment. Relying on veiled assertions about security risks and foreign threats (the ‘just trust us’ brand of policymaking)—if it ever worked—will be increasingly inadequate when national security decisions have direct impacts on businesses and consumers, and isn’t a sustainable model for decision-making in a democracy.
Luckily, democracies have something China doesn’t: trusted and highly competent justice and court systems that can be relied on to assess evidence and prosecute cases using due process. Tensions over espionage and economic coercion between China and democracies are unlikely to abate soon, but we can use that difference to our advantage.
https://aspi.s3.ap-southeast-2.amazonaws.com/wp-content/uploads/2025/04/10130806/ASPI-Logo.png00markohttps://aspi.s3.ap-southeast-2.amazonaws.com/wp-content/uploads/2025/04/10130806/ASPI-Logo.pngmarko2019-02-04 03:30:572019-02-04 03:30:57Huawei and the long arm of the law
In our second episode for 2019, we hear from John Coyne about the recent drug fatalities at music festivals and what we should be doing about it. Danielle Cave and Tom Uren from our International Cyber Policy Centre discuss the latest ructions from Huawei, and Aakriti Bachhawat talks to Lisa Sharland about the future of international peacekeeping operations.
https://aspi.s3.ap-southeast-2.amazonaws.com/wp-content/uploads/2025/04/10130806/ASPI-Logo.png00markohttps://aspi.s3.ap-southeast-2.amazonaws.com/wp-content/uploads/2025/04/10130806/ASPI-Logo.pngmarko2019-01-31 05:15:192019-01-31 05:15:19Policy, Guns and Money: Episode 12
Last week, Greg Austin wrote in The Strategist that ‘those in Australia advocating for a ban on Huawei in the 5G network—mimicking the opinion of US intelligence chiefs expressed in February 2018—have not reviewed all of the available information and perspectives’. While I don’t agree with the article’s broader argument, Austin was spot-on in one area—we haven’t reviewed all of the available information.
In Addis Ababa, the gleaming 20-storey headquarters of the African Union (AU) rises above the dusty skyline as a testament to the China–Ethiopia and broader China–Africa relationship. The Chinese government, which announced the project in 2006, built and financed the entire US$200 million complex, from the attached 2,500-seat grand conference hall to the office furniture. According to the World Bank, around 12,000 to 15,000 officials and representatives from various entities visit the AU Commission for summits, meetings and other events each year.
In January 2012, the completed building was handed over at a public ceremony. At the opening, Jia Qinglin, then-chairman of the National Committee of the Chinese People’s Political Consultative Conference, delivered a speech in which he said:
The international community should provide support and help to the resolution of African issues. China believes that such help should be based on respect for the will of the African people and should be constructive. It should reinforce, rather than undercut, Africa’s independent efforts to solve problems. Interference in Africa’s internal affairs by outside forces out of selfish motives can only complicate the efforts to resolve issues in Africa.
The AU’s grand and sprawling complex was the focus of intrigue and controversy earlier this year—controversy that sheds light on reported ‘national security concerns’ in Australia about which companies should be involved in our 5G network and other critical infrastructure projects.
In January 2018, France’s Le Monde newspaper published an investigation, based on multiple sources, which found that from January 2012 to January 2017 servers based inside the AU’s headquarters in Addis Ababa were transferring data between 12 midnight and 2 am—every single night—to unknown servers more than 8,000 kilometres away hosted in Shanghai. Following the discovery of what media referred to as ‘data theft’, it was also reported that microphones hidden in desks and walls were detected and removed during a sweep for bugs.
The Chinese government refuted Le Monde’s reporting. Chinese state media outlet CGTN (formerly CCTV) reported that China’s foreign ministry spokesperson called the Le Monde investigation ‘utterly groundless and ridiculous’. China’s ambassador to the AU said it was ‘ridiculous and preposterous’. The BBC also quoted the ambassador as saying that the investigation ‘is not good for the image of the newspaper itself’.
One AU official told the Financial Times that there were ‘many issues with the building that are still being resolved with the Chinese. It’s not just cybersecurity’.
The Le Monde report also said that since the discovery of the data theft, ‘the AU has acquired its own servers and declined China’s offer to configure them’. Other media reports confirmed that servers and equipment were replaced and that following the incident ‘other enhanced security features have also been installed’.
Since the reported theft, the AU Commission has put out a variety of tenders and awarded contracts in relation to the headquarters’ information and communications technology (ICT) infrastructure, including bidding documents for a new WiFi system and a US$85,406 contract for the ‘supply, delivery and installation of firewalls for the AU Commission’.
This week an additional tender was published in relation to the AU’s data centre—the same centre that is referenced in Le Monde’s report. The tender invited organisations to bid for the ‘supply, installation, configuration, testing and implementation of next generation firewall data center for the African Union Commission’ and the bidding document explained that:
African Union’s Data Center is a very critical asset for the African Union. The data stored and systems hosted in this data center need to be protected from any form of internal or external threats and unauthorized access.
What seems to have been entirely missed in the media coverage at the time was the name of the company that served as the key ICT provider inside the AU’s headquarters.
It was Huawei.
The AU Commission signed a contract with Huawei on 4 January 2012. By the time the building hosted its first AU Summit on 29 January 2012, Huawei’s ICT solution—which included computing, storage sharing, WiFi and unified resource allocation services through cloud data centres—was in play. As explained on Huawei’s website:
As a top organization coordinating pan-African political, economic, and military issues, the African Union Commission (AUC) needed a robust information system to support a large number of conferences and the larger amounts of data that they entail. As most of this information is of a confidential nature, legacy PCs were proving too vulnerable to hackers, phishing, viruses, and other forms of compromise.
The AU needed a robust solution to streamline their conference operations and protect their data from a variety of security threats. They chose Huawei’s FusionCloud Desktop Solution, which offers computing, storage sharing, and resource allocation through cloud data centers.
According to Huawei’s website, part of this solution included providing equipment and resources to the AU’s data centre:
The [Huawei] solution deployed all computing and storage resources in the AU’s central data center where it seamlessly connects to the original IT system. Then, Huawei installed Wi-Fi hotspots and provided the industry’s first Thin Clients (TC) customized with Wi-Fi access …Traditional PC-based architecture exposes data to serious security risks. With Operating Systems (OS) and applications installed on individual machines, data is vulnerable to viruses and plain text transmissions are easier to steal. The FusionCloud solution moves the OS and applications to centralized servers in the AU’s data center to minimize information leakage while TC security measures such as authentication and encryption further secure data.
Huawei’s desktop cloud solution was central to the AU’s cybersecurity and data-protection efforts. Huawei listed ‘better security’ as one of its key benefits. Huawei described the provision of this better security as follows:
Centralized storage in the data center protects data from attack and prevents data leakage from PCs. The system further protects with terminal authentication and encrypted transmission.
There are several possible explanations for why the AU’s confidential data wasn’t protected and safeguarded appropriately from security threats. Let’s say that Huawei was in no way complicit in the alleged data theft. With this option placed to the side, what else is left on the table? There’s the possibility of a (very lengthy) insider threat, for example. There’s also cybersecurity incompetence. Or perhaps the company never discovered the alleged five-year data theft?
Could the reported theft of data have occurred from a set of servers that were outside of Huawei’s purview? While that’s possible, we do know that Huawei ‘deployed all computing and storage resources in the AU’s central data center’. Le Mondedescribed the data transfer as occurring from the AU’s servers—servers which were then replaced.
There was also another company that had some involvement in the AU headquarters’ ICT infrastructure: Chinese telecommunications company ZTE. A current bidding document states: ‘New Conference Center (China Building) uses ZTE and HUAWEI technologies.’ There’s little information, in open-source documents at least, about the services ZTE may currently or have previously provided. Nor is there information that suggests it had an overarching role in the provision of ICT services inside the headquarters. Job advertisements for telecommunications engineers inside the AU Commission do cite managing a ‘ZTE integrated business exchange device (IBX)’ as one of the role’s major responsibilities.
So let’s cycle back to the debate on whether Huawei should be allowed to participate in Australia’s 5G network. Let’s say you’re not bothered by the fact that Huawei regularly funds the overseas travel of our politicians (which is within the law). You’re also not convinced by the arguments that Huawei is too great of a technical and cybersecurity risk to our 5G network.
You’ve also decided to dismiss—although I don’t know how—China’s 2017 National Intelligence Law (and other legislation, such as the counterespionage law), which states that ‘all organizations and citizens shall, in accordance with the law, support, cooperate with, and collaborate in national intelligence work, and guard the secrecy of national intelligence work they are aware of’.
Now we have a startling piece of new information to add into the mix. Despite a very public commitment to cybersecurity and the provision of secure data protection, and despite promotional material that boasts of Huawei’s robust and enhanced information security services to the AU—it turns out the AU’s confidential data wasn’t secure at all.
This doesn’t mean the company was complicit in any theft of data from the AU headquarters. But it does mean it must answer some tough questions in relation to this incident. Why? Because it’s hard to see how—given Huawei’s role in providing equipment and key ICT services to the AU building and specifically to the AU’s data centre—the company could have remained completely unaware of the apparent theft of large amounts of data, every day, for five years.
But if in fact Huawei never discovered what appears to be one of the longest-running thefts of confidential government data that we know about, and if it remained completely unaware of this alleged theft for approximately 1,825 days in a row—what are we left with?
https://aspi.s3.ap-southeast-2.amazonaws.com/wp-content/uploads/2025/04/10130806/ASPI-Logo.png00markohttps://aspi.s3.ap-southeast-2.amazonaws.com/wp-content/uploads/2025/04/10130806/ASPI-Logo.pngmarko2018-12-26 19:00:352018-12-26 19:00:35Editors’ picks for 2018: ‘The African Union headquarters hack and Australia’s 5G network’
