How Huawei got caught spying and lost $200 million 5G contract Bloomberg reveals

Huawei has consistently faced accusations that its equipment is used for spying. Now it grew into something bigger. Bloomberg made its own investigation into the case. 

This article is based on extensive internal documentation reviewed by Bloomberg Businessweek and interviews with a half-dozen people involved with or briefed about the probe and its results. The people who provided the information requested anonymity because they weren’t authorized to speak publicly about the matter.

It’s a previously unreported chapter in Huawei’s history and an example of the sort of practices that have sown suspicion about the company around the world. And it gives a sense of what life is like for businesses that get caught between the US and China in their escalating clash over technology.

At a hastily scheduled meeting on March 5, 2019, the bidding to upgrade Denmark’s cellular network crossed over into something strange. Negotiations for telecommunications infrastructure are high-stakes affairs; the deals, worked out in private, determine which companies are entrusted to embed their equipment and staff at the deepest levels of a country’s phone and internet systems. But the talks over the Danish contract, which had stretched through the winter, had been particularly fraught.

As it prepared to make the leap to a 5G wireless network, Denmark’s telecom sector had become the object of a backroom economic proxy conflict. Relations between the United States and China were growing worse, and officials from the US National Security Agency were making the rounds in Europe, warning companies to avoid working closely with companies tied to Beijing. The decision by TDC Holding A/S, Denmark’s dominant telecommunications company, would carry symbolic value beyond the contract’s roughly $200 million price tag. It would also be a test of the effectiveness of the Trump administration’s blunt diplomacy and its hawkish efforts to slow the growth of China’s influence around the world.

The March 5 meeting was between a TDC senior executive vice president named Jens Aalose and a young country manager named Yang Lan from Huawei Technologies Co., the biggest network equipment maker in the world. Huawei managed TDC’s existing network, which it had built under a 2013 contract that was due to expire. At 2:52 that morning, Huawei’s Danish arm had, without warning, submitted an emergency revision to its proposal on the 5G contract. That in and of itself was unusual: Weeks earlier, Huawei had made what was supposed to be its best and final offer. The new offer was similar to the old one. But whereas that had come in significantly higher than the offer of the Swedish company Ericsson AB, Huawei’s only competitor for the contract, this last-minute offer was lower.

This was particularly noteworthy. The competing bidders weren’t supposed to know anything about each other’s proposals; their terms were closely held secrets inside TDC, with access limited to about a dozen people. As a result, Aalose arrived at the meeting inclined toward wariness.

What happened there only intensified his suspicions. Lan, he noticed, had an atypical swagger that day: He was “very confident and had a more aggressive approach than usual,” the TDC executive said in a report later prepared by the company’s security team. Lan seemed to know something. Convinced that Huawei had found out the Ericsson bid details, Aalose cut the meeting short.

The resulting investigation by TDC would, over the next four weeks, take the company into a kind of paranoid twilight zone. Its senior management fell under suspicion; its offices were potentially compromised; and employees reported being tailed by shadowy strangers.

Huawei—the name means “Chinese achievement”—was founded in 1987 by a former People’s Liberation Army engineer named Ren Zhengfei, originally as a domestic reseller of telephone switches bought in Hong Kong. Many of China’s technology companies have really only thrived in their home market, where they’re protected from foreign competition by selective regulation and subsidies. Huawei, however, ventured overseas almost from the beginning. It began making its own hardware and found itself in the middle of the global communications revolution: the rise of cellphones, the convergence of voice and data and the arrival of the mobile internet.

At first the company mainly competed on price, selling at or below cost, thanks to generous Chinese government support. Over time the quality of its equipment improved, then became state of the art. Huawei makes the routers and cell-tower antennas that relay data, and it writes the software that manages the increasingly complex choreography required to squeeze it all onto the available bandwidth. Within the past decade, the company has seized a commanding lead in supplying telecom providers throughout Africa, Asia and Europe, far outpacing its closest rivals, Sweden’s Ericsson and Finland’s Nokia Oyj.

Lan’s own career traced that global rise. He joined Huawei in 2005, according to his LinkedIn profile, as an account manager in China’s Hebei province, and he worked there for three years before gaining his first international posting, on Ericsson’s home soil in Stockholm. A year later he was promoted to country manager for Denmark.

Huawei was on the march in Europe, having won a 2004 contract to build a 3G network in the Netherlands, followed by another in the UK. According to a former TDC executive and two former senior Danish officials who worked closely with Lan, Huawei was working hard to win TDC’s business when Lan arrived in the country in 2009. It seemed a daunting task; TDC’s and Ericsson’s home countries are Nordic neighbors with strong diplomatic and cultural ties.

But TDC turned out to be open to persuasion. Its technical staff had become unhappy with Ericsson’s reliability, the three people say. Because TDC’s network handles classified data for the Danish government, officials there had influence over any potential Huawei partnership—and they, too, had reasons to entertain it. American intelligence agencies had begun lobbying their European counterparts to stick to European suppliers, according to the two former Danish officials who were involved in those discussions. In Denmark that campaign backfired.

China, after all, isn’t the only government with a history of using friendly telecommunications companies to spy on other countries. When American officials warned that Huawei equipment might contain so-called backdoors allowing Chinese intelligence to copy data or listen in on conversations, Danish officials worried that the US might do the same thing with equipment from its preferred vendors. The US was “not a fully trusted broker on discussions of Huawei,” one of the former officials says. “It’s not in Denmark’s interest to be locked in with a company approved by the US government.”

Those fears were rooted in Denmark’s intimate understanding of the reach of US espionage: In 2015 a Danish government investigation determined that the nation’s Defense Intelligence Service had been allowing the US National Security Agency to access data from fiber-optic cables transiting the country to spy on political leaders in France, Germany, Norway and Sweden. Last year the country’s former defense minister and intelligence chief were charged with divulging state secrets in connection with leaks to journalists about the government’s investigation. Both men have denied the allegations; their trials are scheduled for later this year.

TDC and its government partners did have security concerns about Huawei, but according to the former TDC executive and the two former Danish officials, Huawei ended up agreeing to an unusual deal. TDC would send its Huawei equipment to a special testing facility in the UK set up by Huawei and the Government Communications Headquarters, or GCHQ, the British signals intelligence and cybersecurity agency. There, the code would be examined for any unauthorized modifications before the gear could be cleared for use in Denmark.

In 2013, TDC announced a six-year, $700 million contract with the Chinese provider to build and manage TDC’s 3G and 4G wireless networks. Lan himself went on to a series of management roles in Ghana, Nigeria and Poland. Then, in 2016, he was sent back to Copenhagen to land a new TDC contract before the existing one expired.

By then, Huawei and its competitors were starting to build 5G networks, which operate on higher frequencies than their predecessors. The newer networks offer more bandwidth and faster speeds, but because the higher-frequency signals don’t travel as far, the systems require far more transceivers and much more advanced software to manage it all. The benefits of 5G for consumers and corporate customers remain the subject of debate. But for Huawei—and its competitors—it was an opportunity to lock in billions of dollars in global contracts. Denmark was one of the first European countries to roll it out.

Huawei has long been suspected of competing unfairly for business. Accusations of corruption and illegal or unethical business practices have followed the company as it’s opened markets in Asia, Europe and the Middle East. In Algeria, Huawei was banned in 2012 from bidding on public tenders for two years, and one of its executives was convicted and sentenced in absentia to 10 years in prison, over a $10 million bribery scheme involving a state-owned telecom company. A 2018 analysis by research firm RWR Advisory Group found that Huawei had secured more than $5 billion in deals that involved allegations of corruption or bribery.

By 2016, the year Lan returned to Denmark, the US Department of Justice had begun investigating the company for fraud, intellectual-property theft and sanctions evasion. Those probes would lead to federal charges, as well as the arrest in Canada of Meng Wanzhou, the company’s deputy chairwoman and the daughter of its founder—she was held in Vancouver under house arrest for almost three years, until her release in a deferred prosecution agreement with the US government.

Huawei has also consistently faced accusations that its equipment is used for spying. The company vehemently denies this, but there’s countervailing evidence. In 2012, as Bloomberg News reported, Australian officials informed their American counterparts of a sophisticated intrusion involving Huawei’s gear. Hackers from China’s spy services were copying large volumes of data from Australia’s telecommunications systems and sending it to China, according to the Australians. The incident was considered especially damning because the code used in the hack was delivered through Huawei software updates, suggesting that either the company had approved the operation or its technical staff had been infiltrated by intelligence operatives.

In response to the reporting, Huawei said it was never told by Australian authorities about a breach, but the incident confirmed suspicions at US and Australian intelligence agencies that China’s spies were using Huawei for access into customer networks. The discovery marked the beginning of a concerted diplomatic effort by both countries to slow Huawei’s growth.

Immediately after the aborted March 5, 2019, meeting with Lan, Aalose—the TDC executive—ordered an inquiry into the source of the apparent leak at his company. Since TDC’s top executives were all potential suspects, that investigation was exceptionally sensitive. It fell to the company’s security team. They worked out of a small operations center in the basement of a building adjoining TDC’s executive offices.

Investigators initially suspected a hack; a Huawei employee working inside TDC could have installed malware to open a door for hackers in China or hunted for information about the Ericsson bid on TDC’s network. There was precedent for Chinese government hackers working to help Chinese companies. In 2014, US prosecutors indicted in absentia five hackers from the People’s Liberation Army, accusing them of breaking into the computer networks of American steelmakers on behalf of Chinese competitors to take intellectual property and internal communications.

Taking care to keep the nature of the investigation a secret, the TDC team asked company executives to turn over their cellphones and laptops. A search turned up no evidence of a cyber intrusion, no malware or other signs that hackers had gained access. Someone at TDC, the security team decided, must have intentionally shared the information. The investigators started going through company email accounts to see who’d sent the Ericsson document or discussed it with others. They also sought to determine who’d been talking to Lan.

Within days of the start of the leak investigation, TDC management had decided they could no longer do business with Huawei. On March 7, TDC’s 5G strategy committee decided to accept Ericsson’s offer.

Meanwhile, the investigation was zeroing in on a suspect: Dov Goldstein, a mechanical engineer from Denmark who, according to his LinkedIn profile, had worked at TDC since 2005. He’d led the company’s negotiations during its 4G mobile network upgrade. In 2016 he was named head of special projects and cost optimization initiatives, reporting to Chief Financial Officer Stig Pastwa. Goldstein didn’t at first look compromised—he didn’t use a Huawei phone, nor was there any insinuation of a potential romantic dynamic with a Huawei employee. But going through his phone records, investigators found that he called and texted Lan often. He often helped Lan craft his pitches to TDC brass. The two dined regularly at the Hotel d’Angleterre, including a four-and-a-half-hour dinner the day after TDC received Huawei’s first bid on the 5G contract in October 2018.

On Feb. 26, 2019, a week and a half before the decisive breakfast meeting, TDC’s 5G committee had made a preliminary decision to give the contract to Ericsson. The next day, Goldstein called Lan twice, according to his call logs, and emailed Lan an invitation to coffee on March 4, which Lan accepted.

A forensic analysis of Goldstein’s Lenovo laptop provided clues about what happened at that meeting. Early that morning, Goldstein had opened a folder on his computer containing five PowerPoint presentations meant for TDC’s board and the 5G committee. Then he’d opened a file containing Ericsson’s final offer. Neither Goldstein nor his boss, Pastwa, were on the committee, but TDC’s security team found that Pastwa had the documents and had emailed them to Goldstein. When the investigators requested CCTV footage from the company’s physical security department, it showed Goldstein leaving the building for coffee with Lan, a laptop under his arm. Within 24 hours of that meeting, Lan had submitted Huawei’s emergency revised bid, its total just a shade lower than Ericsson’s.

It was at this point that the security team began to suspect someone was monitoring them, too. A sweep of the company boardroom turned up multiple long-range microphones that, while compatible with the existing audio conferencing equipment, were not part of the original system–no one knew who’d installed them or why. The investigators decided to relocate.

On March 18, the day TDC publicly announced that Ericsson had won the contract, the security team moved into the offices of one of the company’s law firms, Plesner, in a brown high-rise on Copenhagen’s northern harbor.
They took a corner space on the 15th floor. There were now more than a dozen investigators, including digital forensics experts from the international firm FTI Consulting, and multiple attorneys from Plesner. Most of their work entailed inspecting phones and laptops for signs of tampering. Every evening they boxed up the equipment in black military-style security crates, drove them to a Danske Bank branch downtown and wheeled them into a vault.

The day the TDC team set up in Plesner’s offices, the law firm’s IT systems came under a denial-of-service hacking attack. For a little more than a half-hour, “virtually no traffic could come out of Plesner’s network,” one internal report stated. The following evening, when one of the investigators was out with friends, he noticed a young woman taking photos of him. When he went to confront her, she hurried away. Then another woman sat down next to his group and appeared to listen in on their conversation. A few nights later he saw a man outside his apartment trying to peer inside. Around that time, Aalose’s vacation home was broken into. The security team assigned Kirkby and Aalose, who jointly oversaw the leak investigation, round-the-clock security details.

At 12:20 a.m. on March 20, a security guard patrolling the Plesner offices noticed lights floating outside the 15th-floor room where TDC’s team had been working. Peering into the glare, he saw a large drone. For 10 minutes it remained there, flying up, down and sideways. Then it descended out of sight. Upon learning of the incident the following morning, the TDC investigators realized they’d failed to close the shades in the office. There was a wall-size whiteboard facing the windows on which they’d been tracing all of their leads, and it would have been in full view.

The security team members were, by temperament and training, suspicious people. And as some of them will admit, the prospect of a mole near the top of the company had made them jumpy. Others at TDC were skeptical of the talk of eavesdropping and drones, and believed that the team had drifted into chasing ghosts. The prospect of corporate espionage was especially jarring in Denmark, whose national identity is tied up in being an open society. The social taboo around mistrust in the business world can strike outsiders as anachronistic. It’s strong enough that background checks, even in sensitive jobs, are less common than elsewhere.

On March 27, a little more than a week after publicly awarding the 5G contract to Ericsson, TDC announced that Goldstein’s boss, Pastwa, was stepping down as CFO immediately. TDC didn’t provide a reason. By June, Goldstein was out as well. Both declined to comment when reached by Businessweek.

The documents Businessweek reviewed included a timeline of events prepared by TDC investigators, detailed notes kept by members of the security team and updates about the investigation that were presented to TDC management and its board of directors. The people familiar with the investigation say TDC concluded that Goldstein had leaked the details of Ericsson’s bid to Lan and that Pastwa was likely aware that his subordinate’s relationship with Huawei had crossed a line. The security team, however, found no evidence that Pastwa knew Goldstein allegedly leaked the Ericsson bid, the people say.

Within weeks of Huawei’s losing the bid, Lan had left Denmark for a new Huawei posting in Shenzhen. By summertime, Ericsson had moved its engineers and equipment into TDC, and Huawei’s staff was out. That June, TDC shareholders approved a long-planned split into two companies—TDC Net and Nuuday. After the split was officially completed, two years later, several executives left the company, including Aalose, who oversaw the leak investigation. He declined to comment for this story.

In May 2019 the US Department of Commerce added Huawei to its so-called Entity List. The decision officially deems Huawei to be acting against US national security interests and sharply curtails its access to chips and other key technologies from American companies. In early 2020 the UK, one of Huawei’s earliest partners in Europe, announced that all Huawei equipment would be removed from its 5G network by 2027. Soon after, regulators in Sweden banned the company from that country’s 5G network upgrade. The company suffered a series of defeats across Europe, losing out on contracts in Belgium, Finland, France, Greenland, Italy, the Netherlands, Norway and Spain. Bloomberg News reported in March that Germany will likely forbid some Huawei products.

Still, Huawei remains by far the world’s biggest maker of telecom equipment, according to data from research firm Dell’Oro Group. With 29% of the market, it boasts twice the share that Ericsson and Nokia each have. Today, Huawei equipment is often deployed in the developing world as part of larger deals in which state-backed Chinese companies build everything from roads, bridges and ports to wireless networks. It’s part of a global infrastructure and influence initiative called “Belt and Road.”

In Denmark, the government enacted legislation in 2021 that gives intelligence officials the ability to block any domestic telecom deal involving suppliers from countries Denmark doesn’t have a security agreement with. Denmark has such agreements with Ericsson’s Sweden and Nokia’s Finland but not with China. And in April of this year, TDC Net announced that Danish intelligence authorities had ordered it to remove Huawei equipment from the fiber-optic cable portion of its network.

Kirkby declined to comment for this article. In October 2019 she announced she was bringing her 11-month tenure at TDC to an end to become CEO of Telia Co., Sweden’s largest telecommunications operator. A month before the announcement, she joined members of TDC’s security team for a dinner at a restaurant atop a former waterfront grain silo now transformed into a luxury apartment tower.

The investigation had been over for months, but the sense of unease lingered.

“So, where are the drones?” Kirkby asked, jokingly, as she entered. Minutes later, someone looked out through the floor-to-ceiling windows and noticed one making its way toward the restaurant. The drone hovered in the air for a few minutes, and a team member took a picture of Kirkby pointing at it.

Everyone got up and watched the drone descend to the street, where it was picked up by men in a white van, who then drove away.