Recently, the topic of foreign investment and interference in Canada’s technological and telecommunication infrastructure has been the subject of wide debate. At its core, the debate has been centred on the benefits of lower cost 5G infrastructure manufactured by Chinese technology giant Huawei, versus the possible increased threats of cyber surveillance and espionage. These concerns are fuelled by the close relationship between Huawei and the Chinese government, and widespread claims of intellectual property theft by Chinese corporations and government.These claims have been well documented by governments and corporations around the world including the United States Department of Defence.
Connected to this fear of intellectual property theft is the concern that Chinese 5G technology increases the threat to North American security and military infrastructure, a topic that has been explored by Avneet Darred in relation to Canada’s continued relationship with the Five Eyes intelligence infrastructure. Likewise, the idea of a hostile state being able to access critical infrastructure is a topic that NATO and other institutions will have to grapple with in the near future. The economic threat of corporate intellectual property theft is just as real, costing the Canadian economy billions of dollars annually. The most prominent example of this is the former Canadian telecom heavyweight Nortel.
The Real Nortel Story
Most people believe that the failure of Nortel can largely be explained by poor management. In actual fact, a major factor in its demise was the theft of its intellectual property by Chinese hackers.
Up until the eventual bankruptcy of the company in 2009, Nortel was at the forefront of the North American telecom sector. However, at the time it was not known that in the year 2000, Chinese state sponsored hackers infiltrated the company’s networks and gained unlimited access to their data and patents. Subsequently it was found that the hackers were able to access the network by stealing a number of Executive usernames and passwords, including those of the Chief Executive Officer (CEO). Using these credentials, the hackers were able to access proprietary information such as business plans and patent information. Moreover, the hackers were able to plant spyware which allowed the hackers continued access to the network for almost a decade.
The problems surrounding the Nortel hack were exacerbated by the company’s limited appreciation for IT security and the severity of the threat. This is obviously quite ironic for a leader in building the internet. For example, an internal reportfound that the practice of changing executive passwords did little to counter the efforts of the hacker. When company executives were presented with evidence of unusual cyber activity consistent with a continued breach, they decided not to enhance the cyber security, allowing the problem to be perpetuated.This allowed the hackers unlimited access to research and design (R&D) and business strategies the company sought to employ over an extended period of time. Ultimately, it was found that malware was using executive accounts to transmit data to Beijing, but it was too late.
Surprisingly, even as the company’s assets were sold off in bankruptcy, company management continued to underestimate the threat associated with the hack and malware, refusing to disclose to buyers the hack and level of penetration achieved by the hackers. This prevented the buyers from preparing for the possible threats to their systems.
With all the evidence of malicious activity in regard to Nortel, the general public and academia continue to gloss over this problem. In 2014, a respected Canadian university published a report on the failures of Nortel. In this report the hack and theft of intellectual property was not mentioned as a factor in Nortel’s demise. Instead, the report mentions that the company failed to anticipate the rise of Chinese products and competition. Without the theft of the intellectual property, the Nortel story could have been a very different one, and they would have likely been better prepared and more competitive in the early 2000s.
Huawei: Friend or Foe
Many Canadians reading this will have a simple question, what does this have to do with Huawei? They are simply manufacturers. Well that is in not the whole story. Many people including Brian Shields, the cyber security expert who eventually found the deeply embedded malware in the Nortel systems, believe that Huawei was directly involved in the cyber espionage. Other news outlets including Forbes have noted that the growth of Huawei in the early to late 2000s coincides with the hack and that there appears to be little evidence of Huawei making the investments required to achieve that kind of growth and development.
In a 2019 Globe and Mail article, Huawei founder, Ren Zhengfei, denied his company’s involvement in the Nortel breach and revealed that Huawei had sought to buy Nortel. The deal between Nortel and Huawei eventually fell through, but Huawei continued to benefit from Nortel’s failure. They recruited many of Nortel’s employees including data scientists who were at the top of the field at the time. Some of these employees have been fundamental in the creation and deployment of new technologies including the new 5G networks.
In the end, it is likely that no one will ever completely prove the involvement of the Chinese state in the Nortel breach, or determine if Huawei was truly involved. Regardless, the example of Nortel demonstrates why Canadians, and the world in general, need to be cautious about allowing foreign investment in our cyber infrastructure. With new technologies allowing for unprecedented speed and download capabilities, it is not difficult to believe that in the future breaches like the Nortel example could be accomplished in seconds or minutes instead of years and will be even more difficult to detect. Soon Canadians will need to determine if there a lesson to be learned from the Nortel example, and if should we heed it in the development of our cyber infrastructure.
Photo: Image of hacker with coding (unknown), pixabay
Disclaimer: Any views or opinions expressed in articles are solely those of the authors and do not necessarily represent the views of the NATO Association of Canada.
