Secret services warn of threat from supply chain dependence on China

By John Manners-Bell

Whilst the threat to Europe’s economic autonomy from a reliance on Chinese technologies has been evident for some time, many are now fearing that this dependence has created significant vulnerability in terms of national security. The ability to control or subvert critical infrastructure through unauthorised ‘back door’ software attacks has become a major concern. The issue is a particular worry for supply chains in which Chinese companies hold a position of dominance, such as green energy generation and port infrastructure.

Some of the concerns stem from the fear – especially amongst security services – that as governments across the region rush to meet net zero targets, proper checks and controls of green energy equipment are not being followed. Security services are fearful that sensors embedded within the hardware could collect data, control assets or even be used to monitor shipping and submarine activity if attached to wind turbines, for instance. As Chinese businesses dominate renewable supply chains in the green energy sector, there are limited options to source equipment from Western suppliers.

This has led for an urgent review by military intelligence. In the UK, a project of immediate concern is the ‘Green Volt’ offshore wind farm installation. Although managed by Norwegian and Japanese developers, there are fears that a Chinese supplier of turbines, Mingyang, will be used. Since coming to power, the new UK government has sought to reset relations with Beijing and ministers are keen on Chinese investment – awarding a contract to the company would bring investment and jobs, something sorely needed in a stagnant economy. However, this enthusiasm is being tempered by warnings from the secret intelligence service, MI5, over the potential for interference by the Chinese military.

Concerns over Chinese companies embedding malign sensors in critical infrastructure are not new. In February 2024, USA’s President Biden issued an executive order which gave the US Coast Guard, “the express authority to respond to malicious cyber activity in the nation’s MTS [Marine Transportation System] by requiring vessels and waterfront facilities to mitigate cyber conditions that may endanger the safety of a vessel, facility, or harbor”.  According to US media outlet, CBS News, 80% of the ship-to-shore cranes at US ports have been built by Shanghai Zhenhua Heavy Industries Company or ZPMC. An investigation by US Congress claimed that control systems included unauthorised cellular modems which could bypass cyber security measures. Politicians feared that, in an extreme scenario, the cranes could be rendered useless, causing immeasurable damage to the US economy. The report also asserted that the sensors would be able to read and record the origin and destination of containers, potentially providing important intelligence to the Chinese authorities. The allegations raised by Congress (vigorously refuted by ZPMC) have failed to gain much traction and even US ports have continued to buy and install cranes from this Chinese-government owned supplier. All of the ship-to-shore cranes in the Port of Virginia are supplied by ZPMC and in 2024 management ordered 8 more. They claimed that each crane undergoes a forensic cyber-analysis and a vulnerability assessment. Even so, this has failed to satisfy many US security analysts.

ZPMC cranes are widely used throughout Europe and the rest of the world and are installed in over a 100 of the largest ports. As well as Rotterdam, Antwerp, London Gateway, Felixstowe, Hamburg and Singapore (amongst many others), the company has also installed cranes at ports on the Suez and Panama Canals. The European Commission is aware of the concerns but in a written statement said it had no legal basis to mandate the use of European cranes in European ports. Whilst a number of directives are in place, the protection of both physical and digital aspects of critical infrastructure in the EU, including ports, remains an issue for national governments.

There are also wider concerns about the ownership of European terminals by Chinese companies, such as in Hamburg and Piraeus in Greece. One research paper commissioned by the European Commission’s Directorate-General for Internal Policies suggested that not only should Chinese investment in critical infrastructures be reviewed (and potentially blocked) at a European level, but that ports using Chinese software should be identified as well as the data being transmitted. It was also suggested that all EU members should put in place laws, ‘…to retake control of ports/terminals and other maritime infrastructures ownership and/or considered contingency plans in case that is required in a scenario of conflict (kinetic or otherwise) with China, in co-ordination with EU and other Member States.’

Dependency on China is clearly a major concern for many policymakers and security services in the US and Europe, mindful of the potential implications for critical infrastructure. However, at an industry level many businesses think the risk overstated and continue to buy either Chinese-made green technologies or transport infrastructure. In fact, whether wind turbines or cranes, they have little option, a consequence of years of industry subsidisation by the Chinese government; its low cost labour and its success in developing manufacturing technologies. With governments in Europe particularly desperate for additional sources of capital and jobs and committed to net zero targets, Chinese businesses are in a strong to position to capitalise. This not only reinforces China’s economic advantage but, if security services are to be believed, may have the potential to provide the Chinese government with a mass of sensitive commercial and military data.

Author: John Manners-Bell

Source: Ti Insight 

Supply chain strategists can use GSCi – Ti’s online data platform – to identify opportunities for growth, support strategic decisions, help them stay abreast of industry trends and development, as well as understand future impacts on the industry.

Visit GSCI subscription to sign up today or contact Michael Clover for a free demonstration: [email protected] | +44 (0) 1666 519907