Wednesday, January 4, 2023

National security, commercial insecurity


I was initially surprised to read about this incident.

Amid the growing threat of an invasion of Taiwan by Chinese forces, Taiwan's National Chung-Shan Institute of Science and Technology (NCSIST) has developed the Hsiung-Feng III anti-ship missile, which has been nicknamed the "Carrier Killer" due to its supersonic speed, range of up to 400 kilometers, and 225 kg warhead. However, Mirror Media on Wednesday (Jan. 4) cited sources as saying that the theodolites used to calibrate the missiles were sent by a Swiss company to China to make repairs due to malfunctions, potentially exposing sensitive data from missile tests and endangering Taiwan's national security.

According to the magazine, the theodolites used to make measurements on the Hsiung Feng III are made by the Swiss firm Leica Geosystems ... The NCSIST had recently discovered that the connector pins on two Leica theodolites had become loose. In early December of 2021 and late February 2022, a company distributor located in New Taipei City's Xindian District sent the products back to Switzerland for Leica Geosystems to carry out repairs. However, people familiar with the matter said that the repairs were very fast and after about three months, the two theodolites were sent back to NCSIST in February and May of 2022, respectively.

After the theodolites were repaired, their measurements of the Hsiung Feng missiles returned to normal. It was not until September of last year that NCSIST personnel checked the import declaration form and other materials returned by Leica Geosystems' maintenance center, and they noticed that something was amiss.

The documents revealed that the devices had actually been sent back to Taiwan from Qingdao in China's Shandong Province. This means the equipment was repaired in China or was sent to Taiwan via China, where secrets about the missiles or other parameters may have been seen by the Chinese military.

There's more at the link.

Thinking about it, it's the kind of security threat that must arise relatively easily in many countries.  In today's interconnected world, a precision instrument such as a theodolite, or a robot, or whatever, may be produced and sold by a firm in one country.  However, the components of that instrument may be assembled from many other countries.  Their origin isn't shown on product documentation;  all that says is that Company A in Country B produced the system.  Thus, when someone purchases that system, and later needs it checked or repaired, they have no problem sending it back to the manufacturer.  Unfortunately for them, they have no way of knowing where the manufacturer obtained all the parts;  and they can't control whether the manufacturer sends the parts back to the country of origin to have them repaired.  That's clearly what happened in this case.

I guess the USA has probably been caught in the same trap from time to time.  Remember last year's announcement that the F-35 contains metals from prohibited Chinese sources?  I bet the manufacturer (Lockheed Martin) subcontracted with another company to buy those parts, and the other company subcontracted with yet another to buy what it needed for them . . . and nobody put two and two together and came up with 3.14159.  I don't know whether it's possible to resolve this sort of conundrum without constant vigilance;  and if sophisticated technology originates in another country, where we can't exercise such vigilance, it's a permanent threat to security.

Food for thought.



HMS Defiant said...

Was once part of a consortium selling and installing a surveillance and security system to a far eastern government. One significant insight out of those meetings there was that they were only permitted to have component repairs to our systems performed by the regional prime vendor of said components and literally could not send things back to the manufacturer in the event repairs became necessary. The prime vendor in their region was on one of the potentially hostile powers list of nations and had a terrible rep for stiffing customers.

Jonathan H said...

This is the kind of thing that should have been covered in the contract but apparently wasn't, as mentioned above.
It is one of the glaring problems with both an interconnected economy and with losing all domestic production ability in many areas.
The flip side is export laws - I worked a military project many years ago where the US Army bought a product from a European country. It included a major subsystem from another European country. The second country required their subsystem to be shipped to the US and installed here instead of in the other European country as it usually would have been, which meant hosting 2 groups of foreigners in a sensitive US facility; it was quite the security hassle!