The study by Charlie Parton, a leading expert on China with 37 years in the diplomatic service, warned that long-term reliance on Chinese-made IoT modules poses a greater risk than China’s 5G technology, which Huawei supplied – until it was banned in December 2020.
Parton said that in January, government officials discovered a Chinese cellular IoT module, used as a tracking device in a car used by senior ministers, that had been hidden in parts from Chinese suppliers.
China’s two dominant IoT module suppliers, Quectel and Fibocom Wireless, supply IoT modules to a range of Chinese technology companies. They include surveillance camera manufacturer HikVision; HiSilicon, which designs silicon chips; DJI, a drone manufacturer; and telecoms equipment supplier ZTE – each of which are subject to export controls in the US.
Fibocom has expanded into Canada and the US through acquisitions and has won contracts to supply PC manufacturers such as Lenovo, Dell and HP, which use Fibocom modules in their computers.
Qualtec is targeting the US and Latin America and is trying to break into the overseas automotive market.
Quectel and Fibocom are bound by China’s national security laws, which require them to comply with requests from the Chinese state.
This means that the Chinese Communist Party (CCP) could use IoT modules to harvest data for intelligence purposes to show how many spare parts and weapons systems have been delivered and to where.
Data from IoT modules could also be used to identify individuals susceptible to recruitment by Chinese intelligence agencies.
By combining data from a wide range of sources, it would be possible to identify key government workers and their potential vulnerabilities.
China’s industrial policy aims to ensure Chinese companies dominate new technologies and industries in what Parton calls “venture communism.” This encourages Chinese companies to buy out foreign firms, particularly startups which are not protected by the UK’s National Security Investment Act, to grow, obtain technology and intellectual property, or to reduce competition.
A malicious actor could use the information to “tune” their bids for infrastructure projects or bids for competitors, says Parton, or to gain other strategic advantages over their competitors.