By Alexandra Alper
WASHINGTON (Reuters) – The U.S. Commerce Department and FBI are both investigating a little-known telecoms hardware firm founded by senior Huawei veterans in China more than a decade ago over possible security risks, sources and documents show.
Founded in 2014, Baicells Technologies opened a North American operation the next year in Wisconsin and has since provided telecoms equipment for 700 commercial mobile networks across every U.S. state, according to its website.
The Commerce Department is investigating Baicells on national security grounds and has sent subpoenas to the company while the FBI’s interest in its equipment and Chinese origins dates back to at least 2019.
Reuters is the first to report the existence of the two investigations and the FBI’s long-standing interest. This story is based on interviews with more than 30 current and former government officials, eight former Baicells employees and FBI emails obtained through a records request.
Reuters was unable to determine when the Commerce Department opened its investigation or sent the subpoenas, nor its specific concerns about Baicells or its products. Reuters also couldn’t ascertain the specific focus of the FBI’s probe.
The U.S. telecoms regulator, the Federal Communications Commission (FCC), is advising the Commerce Department on its review, two people said.
The FBI, the Commerce Department, the Justice Department and the FCC declined comment.
Sun Lixin, Beijing-based chairman of Baicells Technologies Ltd, told Reuters the company’s North American operation will cooperate fully with any U.S. government inquiries.
“Baicells does not believe there are any security risks associated with its radio products,” he said in a statement.
The investigations illustrate that years after sanctions decimated the U.S. businesses of fellow Chinese tech companies Huawei and ZTE, Washington’s fears that Beijing is using telecoms equipment to spy remain strong, experts said. “Reviewing this would be near the top of my list,” said John Carlin, the Justice Department’s former top national security attorney, when presented with Reuters’ findings, adding that it raises the same type of risks as Huawei.
This month, the Pentagon added Baicells to a list of 134 companies it says work with China’s military, without providing evidence or further comment. The listing does not have teeth but can deal a reputational blow to companies targeted.
“We strongly disagree with the Defense Department’s designation and intend to appeal,” Baicells said in a statement to customers on Tuesday.
‘OPEN INVESTIGATION’
The scrutiny of Baicells comes amid growing concerns in Washington about China’s ability to intercept sensitive data, by hacking into telecoms networks, remotely accessing hardware supplied by Chinese companies, or providing Americans with internet access.
In a statement to Reuters, China’s U.S. embassy spokesperson Liu Pengyu urged Washington to stop using cyber security issues to smear China.
Baicells supplies routers and base stations in the United States. Base stations provide mobile networks for local areas, much in the same way a router provides a WiFi signal in a home.
Anyone gaining remote access to a router or base station could be in a position to intercept or tamper with its traffic, disrupt its service, or launch cyber attacks, experts say.
Reuters has no evidence that any Baicells equipment has been misused. But the technique has been used by a wide variety of state-backed hacking groups around the world, including a high-profile Chinese group dubbed “Volt Typhoon”, according to U.S. officials.
Emails from an FBI intelligence analyst and sources show that federal agents approached a Baicells customer, the city of Las Vegas, in 2023 to warn it about its base stations – and the FBI’s interest in Baicells products dates back to at least 2019.
That year, federal authorities approached wireless internet service provider KGI Communications after it deployed Baicells base stations in King George, Virginia – one of which was near the Naval Surface Warfare Center Dahlgren Division where hypersonic weapons are tested, former county supervisor Ruby Brabo and KGI employee Juan Marte said.
Marte, KGI’s former CEO, told Reuters the officials were FBI agents and that they warned KGI about Baicells’ Chinese origins.
Asked for comment, the Navy referred Reuters to the FBI, saying the agency has an “open investigation” into the matter.
In 2023, FBI officials visited the chief technology officer for Las Vegas after the city signed a contract to expand an existing deployment of Baicells base stations with 82 more, two people familiar with the matter told Reuters.
The officials raised security concerns and asked to take one of the base stations away, according to the people and emails to the city from the FBI obtained through a records request.
“(We) wanted to know if you have any updates on removal or replacement actions,” states one email from an FBI counterintelligence division intelligence analyst in May, 2023.
Spooked by the attention from the FBI – which eventually took away a base station, according to one of the people – Las Vegas canceled the contract and turned to a U.S. supplier instead, documents show.
The FBI’s inquiries about Baicells in Virginia and Las Vegas have not previously been reported.
In 2021, two FBI agents from Dallas also interviewed Patrick Leary, a former co-CEO of Baicells North America, he said.
“Their concerns were clearly wrapped up with national security and China,” Leary told Reuters, adding that Baicell’s origins and American business goals were a focus of questions.
SECURITY ALERTS
U.S. Cyber defense agency CISA, part of the Department of Homeland Security, published an advisory in 2023 about a vulnerability in Baicells Nova base stations that could allow a hacker to hijack the devices.
An analysis carried out for Reuters in September by Censys, an internet intelligence company, showed that between 28 and 186 Baicells base stations in the U.S. were still using vulnerable firmware, potentially putting them at risk of hijack.
“We have taken affirmative steps to ensure the security of our products and proactively address any security concerns,” Baicells said when asked about base station vulnerabilities.
Terry Dunlap, a firmware security expert and former National Security Agency official, said these types of vulnerabilities often appear in devices such as base stations.
However, he said they were still a concern because they could be used as jumping off points to access critical networks, or be stitched together with other vulnerable devices to create a botnet capable of carrying out broader cyber attacks.
CISA has a list of 16 critical infrastructure networks of concern such as water, energy, financial services and telecoms.
Altogether, CISA has published two security advisories and four vulnerability notices to the public since 2022 about the risk of Baicells’ routers and base stations being accessed remotely, labeling at least five as “critical”.
RUN FROM CHINA?
Baicells’ original Chinese parent, Beijing Baicells Technologies Co, was founded in 2014 by Sun, one of Huawei’s top 12 employees, and senior Huawei veterans Scott Liang Xingang, Zhou Mingyu and Ding Yingzhe. Liang and Ding have since left.
They did not respond to requests for comment.
They are among about 60 former Huawei employees who would later join Baicells, according to a Reuters review of profiles on LinkedIn and Chinese equivalent MaiMai. Reuters was unable to independently confirm these numbers.
In 2016, Baicells set up an office in Plano, a suburb of Dallas where Huawei’s American R&D arm Futurewei was headquartered.
In his statement to Reuters, Sun said Baicells had never had any business relationship with Huawei and the number of current staff hailing from the company represented a small percentage of its workforce.
Since 2019, the U.S. has restricted Huawei’s access to U.S. technology, accusing the company of activities contrary to U.S. national security, which Huawei denies.
Huawei declined comment.
According to Texas filings and a press release, Baicells stopped belonging to its Chinese parent by 2019. But Baicells’ homepage in China still describes it as being headquartered in Beijing’s Haidian District, with a Dallas subsidiary.
Four former employees with direct knowledge of Baicells’ Chinese leadership describe the U.S. firm as being managed currently from China.
A recent former CEO of the U.S. operation, Minchul Ho, was “very micromanaged by the board” in China, which had to approve anything he suggested, said one of the people, who was not authorized to speak publicly.
Neither Ho nor Baicells responded to requests for comment on this assertion.
To assuage U.S. customer concerns about Baicells’ ties to China, sales executives have been instructed in recent years to say the gear was made in Taiwan, four former employees said.
Bills of lading collected by a commercial customs data provider show 92% of shipments of Baicells equipment to the U.S. from 2018 through July, 2024 came from China or Hong Kong, with the remainder from Taiwan.
Reuters could not determine where the equipment was made.
“We are aware of our Chinese roots and we know that is a big issue for federal funding,” Erik Randall, a Baicells sales executive said in a January, 2023 webinar for prospective clients posted on YouTube.
“Our infrastructure is actually being built in Taiwan so we’re starting to move away from that Chinese culture that everyone in North America is worried about.”
(Reporting by Alexandra Alper in Washington; Additional reporting by Eduardo Baptista in Beijing, David Shepardson, Chris Bing, Idrees Ali and Raphael Satter in Washington, James Pearson in London, Joshua Schneyer and Karen Freifeld in New York; Editing by Chris Sanders and David Clarke)
