Threats to U.S. Networks/Section 2

by by the Permanent Subcommittee on Investigations

Layout 2

II. FINDINGS OF FACT AND RECOMMENDATIONS

Findings of Fact

1. The Chinese government exercises control over China's telecommunications industry and carriers. The Chinese telecommunications market is the largest in the world, in terms of number of subscribers. The Chinese government views the telecommunications industry as critical and has set goals for the industry to "enter the ranks of powerful countries." To achieve this goal, the Chinese government exerts control over the domestic telecommunications market, including restraining foreign investment. Further, the largest domestic carriers are government owned; the Chinese government handpicks these firms' leaders, frequently shuffling the senior leadership between the companies. The carriers are also subject to "national service," requiring that they put State interests ahead of their commercial interests.
2. China does not provide U.S. telecommunications companies reciprocal access to the Chinese market and requires foreign carriers seeking to operate in China to enter into joint ventures with Chinese companies. These joint ventures often require U.S. companies to give their technology, proprietary know-how, and intellectual property to their Chinese partners. In the two decades since China acceded to the World Trade Organization, "not a single foreign firm has succeeded in establishing a new joint venture" to access China's basic telecommunications services market and "only a few dozen foreign-invested suppliers have secured licenses to provide value-added telecommunications services, while there are thousands of licensed domestic suppliers."
3. The Chinese government encourages Chinese companies to take advantage of more open international markets. Through its "Go Out" policy announced in 1999, the Chinese government provided financial support to state-owned companies to encourage expansion into global markets. Telecommunications carriers are among the companies that benefited, and they have since established operations across the world, including in the United States.
4. The Chinese government engages in cyber and economic espionage efforts against the United States and may use telecommunications carriers operating in the United States to further these efforts. The U.S. government has highlighted the Chinese government's cyber and economic espionage efforts against the United States. To carry out these efforts, the Chinese government frequently enlists the assistance of state-owned entities. Chinese state-owned companies are subject to an added layer of state influence in that they must comply with strict national security, intelligence, and cyber security laws regardless of where they operate. The U.S. National Counterintelligence and Security Center and the Director of National Intelligence have warned that the Chinese government is likely to use its state-owned carriers to assist in its espionage efforts because the carriers "provide valuable services that often require access to the physical and logical control points of the computers and networks they support." In fact, public reports allege that at least one Chinese carrier—China Telecom—and its affiliates have hijacked and rerouted data through China on a number of occasions since 2010. China Telecom and its affiliates, including its U.S. affiliate, China Telecom Americas, deny the public reports.
5. The FCC regulates foreign carriers seeking to provide international telecommunications services between the United States and foreign points, but historically relied on Team Telecom to assess the national security and law enforcement risks associated with a foreign carrier's proposed services. The FCC also seeks input from other Executive Branch agencies concerning other risks, such as foreign policy and trade implications.
6. The FCC is not required to review a foreign carrier's authorization after it has been granted. Authorizations effectively exist in perpetuity despite evolving national security implications. The FCC does not require a foreign carrier's authorization to be periodically reassessed to confirm the services continue to serve the public interest.
7. Team Telecom was an informal group, with no statutory authority. As a result, its review of foreign carriers' applications was ad hoc, leading to delays and uncertainty. Throughout its existence, Team Telecom operated under no formal legislative or regulatory authority. Instead, it reviewed foreign carriers' applications at the request of and under the powers of the FCC. The lack of statutory authority resulted in a disorganized, haphazard, and lengthy review process that has been heavily criticized and referred to as an "inextricable black hole." Team Telecom had no deadlines by which it needed to make recommendations to the FCC, meaning the review of an application could—and often did—last years.
8. The lack of statutory authority also prohibited Team Telecom from conducting meaningful oversight of foreign carriers authorized by the FCC. Team Telecom's monitoring and oversight capabilities existed only when it signed a security agreement with a foreign carrier. But, it was limited to monitoring compliance with the particular terms of the agreement. The stringency of these agreements increased over time, but historical agreements—particularly those entered before 2010—were written broadly, such that Team Telecom had little to verify. Further, Team Telecom did not start to develop an interagency process for monitoring compliance with security agreements until 2010 or 2011.
9. Team Telecom had insufficient resources. DOJ and DHS historically dedicated fewer than five employees to reviewing applications and monitoring compliance with security agreements.
10. Nearly a year after the Subcommittee began its investigation, the Administration issued an executive order that formalized Team Telecom. Executive Order 13913 established the EO Telecom Committee, set deadlines by which the EO Telecom Committee must complete reviews, and provided for input from other Executive Branch agencies, including the Intelligence Community. While the Order is a positive development, it does not address all of the concerns the Subcommittee identified relating to Team Telecom, including resource levels and formal review procedures.
11. The FCC has authorized three Chinese state-owned carriers to provide international telecommunications services between the United States and foreign points. These three Chinese state-owned carriers have operated in the United States for decades: China Unicom Americas and China Telecom Americas obtained authorization in 2002; ComNet first obtained authorization in 1999.
12. Team Telecom has had no interaction with China Unicom Americas since the FCC's authorization. Team Telecom has never sought a security agreement with China Unicom Americas, despite having opportunities to do so as recently as 2017. As a result, Team Telecom had no oversight of the company's operations in the United States.
13. Team Telecom entered into security agreements with China Telecom Americas and ComNet, but conducted just two site visits in more than 10 years. Team Telecom entered into a security agreement with China Telecom Americas in 2007 and ComNet in 2009. Since entering into the agreements more than ten years ago, Team Telecom conducted only two site visits to each company—or four in total. Only one of those visits occurred before 2017.
14. The FCC and Team Telecom have recognized the national security risks posed by Chinese state-owned carriers operating in the United States. In particular, in connection with China Mobile USA's application, the FCC, Team Telecom, and other Executive Branch agencies cited three areas of concerns: (1) China Mobile USA could be exploited, influenced, and controlled by the Chinese government; (2) China Mobile USA could gain access to U.S. networks through interconnection arrangements with U.S. carriers; and (3) due to its Chinese government control and access to U.S. critical infrastructure, China Mobile USA could help the Chinese government in its cyber and economic espionage or other malicious activities. Team Telecom argued that, if authorized to provide international telecommunication services, China Mobile USA would have been able to monitor, degrade, and disrupt U.S. government communications. And, as a Chinese state-owned company, it must legally comply with requests made by the Chinese government and could not be expected to act against the interests of the Chinese government.
15. The national security concerns outlined with respect to China Mobile USA apply to the other Chinese state-owned carriers operating within the United States. The carriers are ultimately owned by the Chinese government, and therefore subject to exploitation, influence, and control by the Chinese government. They may be forced to assist in cyber and economic espionage activities targeted at the United States, as they are similarly bound by Chinese national security laws. Further, the carriers have established relationships with major U.S. carriers, including AT&T, Verizon, and CenturyLink—all of which serve government entities, as well as private customers. China Telecom Americas also provides services to Chinese government facilities in the United States.
16. Since the Subcommittee began its investigation, Team Telecom and the FCC took actions to address national security concerns posed by Chinese state-owned carriers. On April 9, 2020, Team Telecom recommended that the FCC revoke and terminate China Telecom Americas' authorizations. On April 24, 2020, the FCC issued a notice to each of the Chinese state-owned carriers requiring them to demonstrate why their authorizations should not be revoked.

Recommendations

1. The FCC should complete its review of China Telecom Americas, China Unicom Americas, and ComNet in a timely manner. Team Telecom has recommended that China Telecom Americas' authorizations be revoked because of "substantial and unacceptable" national security concerns. The FCC should expeditiously review the authorizations of China Telecom Americas and the other Chinese state-owned carriers to ensure our national security and communications networks are not unnecessarily put at risk. As part of its review of China Unicom Americas' and ComNet's authorizations, the FCC should seek the recommendation of the newly established EO Telecom Committee as to national security and law enforcement concerns associated with the carriers' authorizations. The analysis should also include a decision as to whether risks can be mitigated—through the existing security agreements or new agreements.
2. The FCC should establish a clear standard and process for revoking a foreign carrier's existing authorizations. Currently, there is no clear standard or process for revoking a foreign carrier's existing authorizations. Telecommunications companies must understand the circumstances under which authorizations could be revoked and be afforded due process to challenge potential revocation. Team Telecom officials indicated that they do not know what the FCC considers a "sufficient" basis for a revocation. Thus, while government officials may believe revocation is warranted, they may not recommend revocation without additional guidance. A formal standard and revocation process would provide clear guidance to both the government and industry as to when revocation of an existing authorization is warranted.
3. Congress should require the periodic review and renewal of foreign carriers' authorizations to provide international telecommunications services. Currently, these authorizations can exist in perpetuity. Although the recent Executive Order allows the EO Telecom Committee to review existing authorizations, it does not mandate periodic review or renewal. Considering the limited resources DOJ and DHS dedicated to Team Telecom's review of foreign carriers' applications, it is unlikely that they will review many existing authorizations. National security and law enforcement concerns, as well as trade, and foreign policy concerns, however, are ever evolving, meaning that an authorization granted in one year may not continue to serve the public interest years later. Requiring a periodic review and renewal of authorizations would ensure that the FCC and the Executive Branch continually account for evolving national security, law enforcement, policy, and trade risks.
4. Congress should statutorily authorize the EO Telecom Committee. The Administration established the EO Telecom Committee, which formalizes Team Telecom, but the EO Telecom Committee still has no governing statutory authority. Team Telecom's historical lack of statutory authority led to a review process criticized by many as "opaque" and "broken." The recent Executive Order is a positive step, but formal legislative authority will provide for greater oversight over foreign carriers.
5. Congress should preserve the role of other relevant Executive Branch agencies. Team Telecom was comprised of DOJ, DHS, and DOD officials. These agencies are also the primary components of the newly established EO Telecom Committee. Historically, the FCC has sought input on a foreign carrier's application from other Executive Branch agencies, including the Department of State, Department of Commerce, and the U.S. Trade Representative. The recent Executive Order makes these agencies, and others, advisors to the EO Telecom Committee. These agencies provide invaluable input and their role in the review process must be accounted for in any formal legislation.
6. Congress should set deadlines by which decisions on FCC-related application reviews must be made. Team Telecom had no set deadlines by which it needed to complete its review of a foreign carrier's application pursuant to the FCC's request. Further, Team Telecom's already limited resources were often focused on actions related to the Committee on Foreign Investment in the United States ("CFIUS"). This resulted in protracted reviews and business uncertainty. Setting deadlines will imbue trust back into the review process. The recent Executive Order imposed certain timelines, but it allows for the EO Telecom Committee to seek extensions, which could draw out the review process, especially if resources remain limited.
7. Congress should provide sustained resources necessary for the EO Telecom Committee to effectively assess foreign carriers' applications and to monitor foreign carriers operating in the United States. The Foreign Investment Risk Review Modernization Act of 2018 provided CFIUS agencies specialized authority to hire staff to ensure agencies can manage CFIUS filings. EO Telecom Committee agencies should be provided a similar authority to ensure it is able to effectively and efficiently review foreign carriers' applications and monitor foreign carriers' operations.
8. Congress should require the EO Telecom Committee to formally coordinate reviews of foreign carrier applications with CFIUS. The EO Telecom Committee's component agencies are members of CFIUS. CFIUS's and the EO Telecom Committee's processes overlap when a foreign investor seeks to acquire control of a U.S. telecommunications operator or infrastructure owner. These applications already undergo extensive review by CFIUS. Requiring formal coordination between CFIUS and the EO Telecom Committee will streamline the regulatory clearance process while meeting national security, law enforcement, trade policy, and foreign policy objectives.
9. Congress should provide the EO Telecom Committee with authority to recommend revocation of a carrier's authorization, even where no security agreement exists between it and the carrier. Where no security agreement existed, Team Telecom did not interact with the foreign carrier. Although certain government officials believed that Team Telecom could review. an existing authorization, even where no agreement existed, there is no formal, legal basis for such review. Combined with a requirement to periodically renew authorizations, affording the EO Telecom Committee the authority to review and recommend revocation of existing authorizations, even without a security agreement in place, allows the EO Telecom Committee to better respond to the evolving nature of national security risks.
10. Congress should require the periodic review and renewal of security agreements between the EO Telecom Committee and foreign carriers. Team Telecom officials told the Subcommittee that, even if it believed that a security agreement was not comprehensive to address all risks associated with a foreign carrier's operations, it had little leverage to update the agreement. This means that certain risks, which could otherwise be mitigated, may go unaddressed. Requiring a periodic review and renewal of security agreements provides the EO Telecom Committee yet another tool to ensure that national security and other risks are regularly assessed and addressed.
11. The EO Telecom Committee should establish formal, written policies and procedures governing its monitoring of compliance with security agreements. Team Telecom had no formal, written processes governing its monitoring of a foreign carrier's compliance with a security agreement. It relied on written correspondence and site visits, but there was no clear method as to when these mechanisms were used or why. The EO Telecom Committee should document and formalize Team Telecom's processes, which will provide for more streamlined and consistent review of foreign carriers' operations in the United States.
12. Congress and the Administration should take steps to ensure reciprocal access to the Chinese telecommunications market for U.S. companies. In those aspects of telecommunications in which China officially permits foreign participation, China requires forced technology transfers and imposes discriminatory regulatory processes and burdensome licensing and operating requirements. This results in a highly asymmetric playing field in which U.S. companies face immensely restrictive policies in China, while Chinese companies are not equally restricted in the United States.