[V]ermont’s 911 system will soon operate on a telephone network that relies on Huawei equipment, despite a directive issued earlier this year by the Scott administration banning state use of products made by the Chinese technology giant.
Vermont was the first state to ban equipment manufactured by foreign tech companies including Huawei, ZTE and Kaspersky from state systems, citing federal fears that those companies might plant bugs or malware in their products to enable the Chinese and Russian governments to spy on U.S. networks.
FirstLight was selected to carry 911 calls on its network by INdigital, an Indiana-based company that will operate Vermont’s E911 system for the next five years. INdigital will receive $12 million over the next five years under the contract. FirstLight also signed a new $3.5 million contract with Vermont in April to provide internet connectivity to state data centers through January 2022.
Both contracts say FirstLight must comply with the Agency of Digital Services’ directive 19-01, which bans the “the acquisition, renewal of contracts, or use for a new purpose” of equipment made by Huawei and a few other Russian and Chinese tech companies.
However, VTDigger has confirmed that FirstLight is still using old Huawei equipment in its Vermont network. A reporter this month was able to access two “co-location” sites in Montpelier and Stowe — secure facilities where telcos install network equipment like routers and switches.
In both cases FirstLight is using clearly labelled Huawei “multiplexers,” devices that take incoming traffic and direct it to outgoing lines.
One telecommunications expert said those particular devices expose the state to “zero” risk of espionage, however the state directive makes no exceptions for certain types of equipment or how it is used in networks.
The state directive allows for companies to apply for waivers on a case-by-case basis. But FirstLight has made no such request, said John Quinn, Vermont’s digital services secretary. Instead, FirstLight has certified in writing that the banned technology will not be used to service the state, avoiding any admission that it is using Huawei gear in Vermont.
FirstLight, a regional behemoth that absorbed Vermont provider Sovernet in 2017, did not respond to repeated requests this month to discuss its network. Maura Mahoney, FirstLight’s vice president of marketing and product management, said in an email on June 12 that federal rules prevent the company from discussing its customers, but then did not respond to questions about what rules she was referring to, and has not returned about a half dozen emails and phone calls since.
Quinn said he was not aware that FirstLight was still using Huawei equipment, but was concerned to learn about it.
“If we had a credible source saying there was Huawei equipment in their network at multiple locations, we would ask that they clarify to us how that isn’t relevant to us: How’s their traffic routed, how that is configured, what it’s touching,” Quinn said.
The secretary, who oversees state telecommunications contracts, said Vermont takes companies at their word on such matters, partly because of limited regulatory resources and also because the “co-location” sites are only accessible at the company’s invitation.
“The last thing we’d expect is someone to say we don’t have it and find out they do,” he said. “I’d think that would be a PR nightmare for them.”
Barbara Neale, executive director of the E911 board, an independent body that reports to the governor, said she was satisfied by assurances from INdigital and FirstLight that E911 calls would not be routed through Huawei technology.
“INdigital notes all services provided by INdigital are compliant with industry standards and security measures,” she added.
Asked how INdigital had vetted FirstLight’s networks to make sure state services were not dependent on Huawei equipment, Neale provided a statement from INdigital, which declined to be interviewed directly.
“Modern telecom networks are made up of many network elements,” the company wrote. “In addition to the certification documents that have been provided by FirstLight and INdigital, INdigital has requested design layout records from FirstLight to ensure that there are no network elements provided by Huawei that will be used in the VT NG9-1-1 project.”
Rural providers in a pinch
Even if INdigital is correct that its E911 plan meets today’s industry standards related to Huawei, the landscape is rapidly shifting, driven by rising tensions between China and the United States. Huawei went from a small player on the U.S. market to a dominant force in the past decade, largely by offering cutting edge equipment at cut-rate prices.
It’s already the world leader in telecommunications equipment sales, and is aggressively rolling out 5G technology for the next generation of networks. Together with its expanding smartphone division, the company brought in more than $100 billion last year.
Huawei’s positioning to dominate the world’s internet infrastructure has the U.S. worried. “5G will be, simply put, the central nervous system of the 21st-century economy,” said an April article in Foreign Policy, “and if Huawei continues its rise, then Beijing, not Washington, could be best placed to dominate it.”
As American policymakers panic over Huawei’s future expansion — and whether China’s government will see a parallel expansion of its international information gathering ability — rural providers who bet big on the company have been left in a lurch.
The John S. McCain National Defense Authorization Act for Fiscal Year 2019 includes language that bans executive agencies from procuring any service or equipment in which Huawei is a “substantial or essential component of any system.” President Donald Trump reportedly changed his mind on a Huawei ban during talks with Chinese President Xi Jinping this weekend.
What “substantial or essential” means in the McCain Act is still up for interpretation. Telecommunications networks include thousands of parts — from fiber-optic cables to antennas, routers and switches — which have varying levels of susceptibility to espionage or hacking.
Many companies are preparing for the worst and scrambling to replace Huawei gear to make sure they do not lose connectivity contracts at rural institutions like schools and hospitals, which rely on federal funding.
Other providers have taken a “wait and see” approach. Some rural providers, already operating on tight margins, say the cost of overhauling their networks to remove Huawei equipment could put them out of business, according to a recent article in the New York Times.
That appears to be the approach being taken by FirstLight, which went on a buying spree of rural providers in the Northeast in recent years as part of the private equity fund Oak Hill Capital Partners, which is based in New York City. It now boasts 14,000 miles of network in six Northeast states.
The company was sold last year to Antin Infrastructure Partners, an infrastructure-focused hedge fund with offices in Paris, London and Luxembourg.
In its aggressive acquisition of rural providers, it’s likely that FirstLight also ended up with millions of dollars worth of Huawei gear purchased by the local companies — such as Sovernet in Vermont — before they were bought up, said Michel Guite, president of Vermont Telephone Company, or VTel, which pulled Huawei gear from its own networks a few years ago.
“They paid $1.2 billion to buy this and they probably don’t want a $250 million charge to remove it all,” Guite said of old Huawei equipment now in FirstLight’s regional network. “I can see why they would be motivated to say ‘don’t worry about it.’”
Vermont gets serious
Gov. Phil Scott’s administration decided in February to ban the use of Huawei technology — and a handful of other Chinese and Russian products — by Vermont state agencies and its contractors. It asked agencies to review their technology assets and begin phasing out the foreign technology.
The Agency of Digital Services directive cites the federal government’s concern “about the potential for Chinese intelligence and security services to use Chinese information technology firms as routine and systemic espionage platforms against the United States and allies.”
“Looking at the action at the federal level, the Administration felt a state directive was warranted,” Scott’s spokesperson, Rebecca Kelley, said in an email Tuesday. She added: “Vermont was among a number of states taking a range of proactive steps regarding this type of software and following federal action.”
Meredith Ward, a senior policy analyst at the National Association of State Chief Information Officers, said Vermont was the only state she was aware of that had issued a public directive banning Huawei, though other states have taken smaller steps, like limiting their contracts with companies using Huawei.
However, Ward said that might change as the federal government cracks down on the company. “I would not be surprised to see more states follow the lead” of Vermont, she said.
It’s unclear if other providers in Vermont currently rely on Huawei equipment. VTDigger did not see any other companies using Huawei gear in the Stowe and Montpelier buildings. Quinn said most state contractors, including FirstLight, have certified that state traffic is not moving through Huawei technology.
However, FirstLight has avoided having its networks inspected by an outside entity, or even answering questions about its network.
FirstLight’s use of Huawei equipment was at the center of a dispute with VTel in 2018 that ended up before the quasi-judicial Public Utility Commission. FirstLight was attempting to force VTel to interconnect, which would make it easier for customers to switch between the providers without changing their phone numbers.
Guite said his company became aware that FirstLight was using Huawei equipment simply by looking at their gear at co-location sites. But FirstLight denied having Huawei technology in its network, he said. “We said that’s crazy, not only do we know you do, we have photographs,” he said in an interview last week.
The Huawei gear raised concern that the interconnection agreement would expose VTel to associated security risks and the potential of losing federal funding, according to a transcript of a PUC hearing in which the dispute was discussed. FirstLight argued the Huawei issue was immaterial to the interconnection agreement and said “number portability is a fundamental instrument fostering local telephone competition.”
When the PUC opened a path to evidentiary hearings — in which FirstLight might have to disclose the role of Huawei equipment in its networks — FirstLight withdrew its petition to interconnect. FirstLight’s lawyer did not respond to a call seeking comment about that hearing.
Weighing the risk
Experts are conflicted over the security risk posed by Huawei, particularly on the global stage. The U.S. has been lobbying European allies to stop investing in equipment from the company with limited success — both Germany and France say they will allow Huawei to be involved in their national 5G networks.
In the U.S., there has been bipartisan support behind efforts to curb Huawei’s expansion domestically. Sens. Marco Rubio, R-Fla., and Mark Warner, D-Va., both spoke in favor of Huawei restrictions in a series of interviews with technology website The Verge.
“I am not sure we can trust an audit on Huawei any more than we can trust the Chinese government to hand over intelligence showing they do not steal intellectual property from American companies,” Rubio told The Verge. “No audit can reveal a future order from the Chinese government to turn over data to them.”
However, Fred Goldstein, a telecommunications expert with the Interisle Consulting Group, who has worked in Vermont, said the fears were overblown and politically motivated.
“The entire Huawei thing is a made up scare — it’s just like ethnic scares of the past, there are people of ‘x’ race living in your community you have to lock them up — no one has ever demonstrated meaningful vulnerability from Huawei that doesn’t exist from American gear,” he said, adding that companies like Ericsson were helping stoke the fears because they were losing out to Huawei on the open market.
Goldstein said the Huawei multiplexers used by FirstLight in Vermont — devices that transmit and receive data signals — posed a security risk close to zero.
“It’s not the type of gear that if someone was looking to find spyware implanters — there’s nothing you could do to spy on it,” he said.
Goldstein said it’s possible that FirstLight is able to direct traffic through other devices in its network made by other companies. “They may well be able to keep it separate,” he said, noting that FirstLight has purchased a number of companies in the Northeast that use a “dog’s breakfast of equipment.”
Quinn said the most important thing — once his agency becomes aware that outside providers are using banned technology — is to determine whether state traffic is moving through the banned devices. “And if we felt it was too big of a risk, we wouldn’t use them,” he said.
