Chinese put hands on security scanners all across Europe

China’s national intelligence laws require Chinese companies to surrender data requested by state security agencies. Western security officials fear China could exploit the technology to access sensitive data.

By Associated Press

At some of the world’s most sensitive spots, authorities have installed security screening devices made by a single Chinese company with deep ties to China’s military and the highest levels of the ruling Communist Party.

The World Economic Forum in Davos. Europe’s largest ports. Airports from Amsterdam to Athens. NATO’s borders with Russia. All depend on equipment manufactured by Nuctech, which has quickly become the world’s leading company, by revenue, for cargo and vehicle scanners.

Nuctech has been frozen out of the U.S. for years due to national security concerns, but it has made deep inroads across Europe, installing its devices in 26 of 27 EU member states, according to public procurement, government and corporate records reviewed by The Associated Press.

The complexity of Nuctech’s ownership structure and its expanding global footprint have raised alarms on both sides of the Atlantic.

A growing number of Western security officials and policymakers fear that China could exploit Nuctech equipment to sabotage key transit points or get illicit access to government, industrial or personal data from the items that pass through its devices.

Nuctech’s critics allege the Chinese government has effectively subsidized the company so it can undercut competitors and give Beijing potential sway over critical infrastructure in the West as China seeks to establish itself as a global technology superpower.

“The data being processed by these devices is very sensitive. It’s personal data, military data, cargo data. It might be trade secrets at stake. You want to make sure it’s in right hands,” said Bart Groothuis, director of cybersecurity at the Dutch Ministry of Defense before becoming a member of the European Parliament. “You’re dependent on a foreign actor which is a geopolitical adversary and strategic rival.”

He and others say Europe doesn’t have tools in place to monitor and resist such potential encroachment.

Different member states have taken opposing views on Nuctech’s security risks. No one has even been able to make a comprehensive public tally of where and how many Nuctech devices have been installed across the continent.

Nuctech dismisses those concerns, countering that Nuctech’s European operations comply with local laws, including strict security checks and data privacy rules.

“It’s our equipment, but it’s your data. Our customer decides what happens with the data,” said Robert Bos, deputy general manager of Nuctech in the Netherlands, where the company has a research and development center.

He said Nuctech is a victim of unfounded allegations that have cut its market share in Europe nearly in half since 2019.

“It’s quite frustrating to be honest,” Bos told AP. “In the 20 years, we delivered this equipment we never had issues of breaches or data leaks. Till today we never had any proof of it.”

‘It’s not really a company’

As security screening becomes increasingly interconnected and data-driven, Nuctech has found itself on the front lines of the U.S.-China battle for technology dominance now playing out across Europe.

In addition to scanning systems for people, baggage and cargo, the company makes explosives detectors and interconnected devices capable of facial recognition, body temperature measurement and ID card or ticket identification.

On its website, Nuctech’s parent company explains that Nuctech does more than just provide hardware, integrating “cloud computing, big data and Internet of Things with safety inspection technologies and products to supply the clients with hi-tech safety inspection solution.”

Critics fear that under China’s national intelligence laws, which require Chinese companies to surrender data requested by state security agencies, Nuctech would be unable to resist calls from Beijing to hand over sensitive data about the cargo, people and devices that pass through its scanners.

They say there is a risk Beijing could use Nuctech’s presence across Europe to gather big data about cross-border trade flows, pull information from local networks, like shipping manifests or passenger information, or sabotage trade flows in a conflict.

A July 2020 Canadian government security review of Nuctech found that X-ray security scanners could potentially be used to covertly collect and transmit information, compromise portable electronic devices as they pass through the scanner or alter results to allow transit of “nefarious” devices.

The European Union put measures in place in late 2020 that can be used to vet Chinese foreign direct investment. But policymakers in Brussels say there are currently no EU-wide systems in place to evaluate Chinese procurement, despite growing concerns about unfair state subsidies, lack of reciprocity, national security and human rights.

“This is becoming more and more dangerous. I wouldn’t mind if one or two airports had Nuctech systems, but with dumping prices, a lot of regions are taking it,” said Axel Voss, a German member of the European Parliament who works on data protection.

“This is becoming more and more a security question. You might think it’s a strategic investment of the Chinese government.”

The U.S. — home to OSI Systems, one of Nuctech’s most important commercial rivals — has come down hard against Nuctech.

The U.S. Senate Committee on Foreign Relations, the U.S. National Security Council, the U.S. Transportation Security Administration, and the U.S. Commerce Department’s Bureau of Industry and Security all have raised concerns about Nuctech.

The U.S. Transportation Security Administration told AP in an email that Nuctech was found ineligible to receive sensitive security information. Nuctech products, TSA said, “are not authorized to be used for the screening of passengers, baggage, accessible property or air cargo in the United States.”

In December 2020, the U.S. added Nuctech to the Bureau of Industry and Security Entity List, restricting exports to them on national security grounds.

“It’s not just commercial,” said a U.S. government official who was not authorized to speak on the record. “It’s using state-backed companies, with state subsidies, low-ball bids to get into European critical infrastructure, which is civil airports, passenger screening, seaport and cargo screening.”

In Europe, Nuctech’s bids can be 30 to 50 percent below their rivals’, according to the company’s competitors, U.S. and European officials and researchers who study China. Sometimes they include other sweeteners like extended maintenance contracts and favorable loans.

In 2009, Nuctech’s main European competitor, Smiths Detection, complained that it was being squeezed out of the market by such practices, and the E.U. imposed an anti-dumping duty of 36.6 percent on Nuctech cargo scanners.

“Nuctech comes in with below-market bids no one can match. It’s not a normal price, it’s an economic statecraft price,” said Didi Kirsten Tatlow, co-editor of the book, “China’s Quest for Foreign Technology.” “It’s not really a company. They are more like a wing of a state development drive.”

Nuctech’s Bos said the company keeps prices low by manufacturing in Europe. “We don’t have to import goods from the U.S. or other countries,” he said. “Our supply chain is very efficient with local suppliers, that’s the main reason we can be very competitive.”

Nuctech’s successes abound. The company, which is opening offices in Brussels, Madrid and Rome, says it has supplied customers in more than 170 countries and regions. Nuctech said in 2019 that it had installed more than 1,000 security check devices in Europe for customs, civil aviation, ports and government organizations.

In November 2020, Norwegian Customs put out a call to buy a new cargo scanner for the Svinesund checkpoint, a complex of squat, grey buildings at the Swedish border. An American rival and two other companies complained that the terms as written gave Nuctech a leg up.

The specifications were rewritten, but Nuctech won the deal anyway. The Chinese company beat its rivals on both price and quality, said Jostein Engen, the customs agency’s director of procurement, and none of Norway’s government ministries raised red flags that would have disqualified Nuctech.

“We in Norwegian Customs must treat Nuctech like everybody else in our competition,” Engen said. “We can’t do anything else following EU rules on public tenders.”

Four of five NATO member states that border Russia — Estonia, Latvia, Lithuania, Poland — have purchased Nuctech equipment for their border crossings with Russia. So has Finland.

Europe’s two largest ports — Rotterdam and Antwerp, which together handled more than a third of goods, by weight, entering and leaving the EU’s main ports in 2020 — use Nuctech devices, according to parliamentary testimony.

Other key states at the edges of the EU, including the U.K., Turkey, Ukraine, Albania, Belarus and Serbia have also purchased Nuctech scanners, some of which were donated or financed with low-interest loans from Chinese state banks, according to public procurement documents and government announcements.

Airports in London, Amsterdam, Brussels, Athens, Florence, Pisa, Venice, Zurich, Geneva and more than a dozen across Spain have all signed deals for Nuctech equipment, procurement and government documents, and corporate announcements show.

Nuctech says it provided security equipment for the Olympics in Brazil in 2016, during President Donald Trump’s visit to China in 2017 and the World Economic Forum in 2020. It has also provided equipment to some U.N. organizations, procurement records show.

Rising concerns

As Nuctech’s market share has grown, so too has skepticism about the company.

Canadian authorities dropped a standing offer from Nuctech to provide X-ray scanning equipment at more than 170 Canadian diplomatic missions around the world after a government assessment found an “elevated threat” of espionage.

Lithuania, which is involved in a diplomatic feud with China over Taiwan, blocked Nuctech from providing airport scanners earlier this year after a national security review found that it wasn’t possible for the equipment to operate in isolation and there was a risk of information leaking back to China, according to Margiris Abukevicius, vice-minister for international cooperation and cybersecurity at Lithuania’s Ministry of National Defense.

Then, in August, Lithuania approved a deal for a Nuctech scanner on its border with Belarus. There were only two bidders, Nuctech and a Russian company — both of which presented national security concerns — and there wasn’t time to reissue the tender, two Lithuanian officials told AP.

“It’s just an ad hoc decision choosing between bad and worse options,” Abukevicius said. He added that the government is developing a road map to replace all Nuctech scanners currently in use in Lithuania as well as a legal framework to ban purchases of untrusted equipment by government institutions and in critical sectors.

Human rights concerns are also generating headwinds for Nuctech. The company does business with police and other authorities in Western China’s Xinjiang region, where Beijing stands accused of genocide for mass incarceration and abuse of minority Uighur Muslims.

Despite pressure from the U.S. and European policymakers on companies to stop doing business in Xinjiang, European governments have continued to award tens of millions of dollars in contracts — sometimes backed by European Union funds — to Nuctech.

Nuctech says on its Chinese website that China’s western regions, including Xinjiang, are “are important business areas” for the company. It has signed multiple contracts to provide X-ray equipment to Xinjiang’s Department of Transportation and Public Security Department.

It has provided license plate recognition devices for a police checkpoint in Xinjiang, Chinese government records show, and an integrated security system for the subway in Urumqi, the region’s capital city. It regularly showcases its security equipment at trade fairs in Xinjiang.

“Companies like Nuctech directly enable Xinjiang’s high-tech police state and its intrusive ways of suppressing ethnic minorities. This should be taken into account when Western governments and corporations interface with Nuctech,” said Adrian Zenz, a researcher who has documented abuses in Xinjiang and compiled evidence of the company’s activities in the region.

Nuctech’s Bos said he can understand those views, but that the company tries to steer clear of politics. “Our daily goal is to have the equipment to secure the world more and better,” he said. “We don’t interfere with politics.”

Complex web of ownership

Nuctech opened a factory in Poland in 2018 with the tagline “Designed in China and manufactured in Europe.” But the ultimate responsibility for the company lies far from Warsaw, with the state-owned Assets Supervision and Administration Commission of the State Council in Beijing, China’s top governing body.

Nuctech’s ownership structure is so complex that can be difficult for outsiders to understand the true lines of influence and accountability.

Scott Kennedy, a Chinese economic policy expert at the Center for Strategic and International Studies in Washington, said that the ambiguous boundaries between the Communist Party, state companies and financial institutions in China — which have only grown murkier under China’s leader, Xi Jinping — can make it difficult to grasp how companies like Nuctech are structured and operate.

“Consider if the roles were reversed. If the Chinese were acquiring this equipment for their airports they’d want a whole variety of assurances,” Kennedy said. “China has launched a high-tech self-sufficiency drive because they don’t feel safe with foreign technology in their supply chain.”

What is clear is that Nuctech, from its very origins, has been tied to the Chinese government, academic and military interests.

Nuctech was founded as an offshoot of Tsinghua University, an elite public research university in Beijing. It grew with backing from the Chinese government and for years was run by the son of China’s former leader, Hu Jintao.

Datenna, a Dutch economic intelligence company focused on China, mapped the ownership structure of Nuctech and found a dozen major entities across four layers of shareholding, including four state-owned enterprises and three government entities.

Today the majority shareholder in Nuctech is Tongfang Co., which has a 71 percent stake. The largest shareholder in Tongfang, in turn, is the investment arm of the China National Nuclear Corp. (CNNC), a state-run energy and defense conglomerate controlled by China’s State Council.

The U.S. Defense Department classifies CNNC as a Chinese military company because it shares advanced technologies and expertise with the People’s Liberation Army.

Xi has further blurred the lines between China’s civilian and military activities and deepened the power of the ruling Communist Party within private enterprises. One way: the creation of dozens of government-backed financing vehicles designed to speed the development of technologies that have both military and commercial applications.

In fact, one of those vehicles, the National Military-Civil Fusion Industry Investment Fund, announced in June 2020 that it wanted to take a 4.4 percent stake in Nuctech’s majority shareholder, along with the right to appoint a director to the Tongfang board. It never happened — “changes in the market environment,” Tongfeng explained in a Chinese stock exchange filing.

But there are other links between Nuctech’s ownership structure and the fusion fund.

CNNC, which has a 21 percent interest in Nuctech, holds a stake of more than 7 percent in the fund, according to Qichacha, a Chinese corporate information platform. They also share personnel: Chen Shutang, a member of CNNC’s Party Leadership Group and the company’s chief accountant serves as a director of the fund, records show.

“The question here is whether or not we want to allow Nuctech, which is controlled by the Chinese state and linked to the Chinese military, to be involved in crucial parts of our border security and infrastructure,” said Jaap van Etten, a former Dutch diplomat and CEO of Datenna.

Nuctech maintains that its operations are shaped by market forces, not politics, and says CNNC doesn’t control its corporate management or decision-making.

“We are a normal commercial operator here in Europe which has to obey the laws,” said Nuctech’s Bos. “We work here with local staff members, we pay tax, contribute to the social community and have local suppliers.”

But experts say these touchpoints are further evidence of the government and military interests encircling the company and show its strategic interest to Beijing.

“Under Xi Jinping, the national security elements of the state are being fused with the technological and innovation dimensions of the state,” said Tai Ming Cheung, a professor at UC San Diego’s School of Global Policy and Strategy.

“Military-civil fusion is one of the key battlegrounds between the U.S. and China. The Europeans will have to figure out where they stand.”

BeijingChinaEuropeNanotechnologyRussiaUS China