Cybersecurity

Sure, Sell to ZTE—Just Don’t Buy From Them

By Nicholas Weaver
Friday, May 18, 2018, 7:00 AM

On May 13, the president tweeted:

President Xi of China, and I, are working together to give massive Chinese phone company, ZTE, a way to get back into business, fast. Too many jobs in China lost. Commerce Department has been instructed to get it done!

— Donald J. Trump (@realDonaldTrump) May 13, 2018

This was, to put it mildly, unexpected. ZTE is a Chinese telecommunications company that is effectively under a corporate death-sentence, recently banned from any purchases of U.S. goods for inclusion into their products. Days later, it’s still not entirely clear what shape U.S. policy on ZTE will take: While Trump’s later tweets suggested that negotiations over ZTE were linked to the possibility of a broader U.S.-China trade deal, both Commerce Secretary Wilbur Ross and Trump’s top economic adviser Larry Kudlow stated that the ZTE issue was a question of enforcement separate from trade.

As it now stands, the ZTE situation actually consists of two completely unrelated topics: Trump’s decision to reverse the Commerce Department’s ban on any sales to the Chinese manufacturer ZTE, and moves in Congress and the executive branch to prevent critical infrastructure from running on products bought from ZTE. It is critical to keep these two areas separate in analyzing the situation. And we also need to consider the elephant in the room—that the president’s decision making may have been compromised when he decided to override the Commerce Department’s decision.

Let’s start with buying ZTE. Any basic precautionary analysis should say that any infrastructure that the U.S. depends on should not be controlled by Chinese or Russian software—full stop. This is why I was so glad when the U.S. government finally began to purge their systems of Kaspersky software. Russia or Chinese governmental systems would not willingly run on Cisco or Symantec software for the same reasons.

So requiring that Pentagon telecommunications-providers not use Huawei or ZTE equipment is an obvious precaution. The biggest problem is that the U.S. didn’t impose such a ban a decade ago. About the only good thing coming out of this mess is that such a ban will now have a much smoother pass through Congress, as any sensible Republican should have already been for it, and now a handful of Democrats will likely go along to score some cheap political points against the president.

Selling U.S. equipment to ZTE is a far more complicated story. Although ZTE is a Chinese company, their products depend heavily on components purchased from U.S. businesses. Without American parts—ranging from Qualcomm’s cellular modems and a whole assortment of FPGAs (basically, programmable custom chips) from Xilinx or Altera, to Android software from Google—ZTE can’t produce any of its products.

In March 2017, ZTE agreed to a $1.19 billion fine for violating U.S. sanctions against Iran and North Korea by using these various U.S. components in systems it sold to those two countries. While the Commerce Department could have banned U.S. companies from selling components to ZTE as punishment, the company eventually reached an agreement with the U.S. government that it would admit guilt, agree to independent monitoring during a three-year probationary period and pay over $1 billion. In exchange, the Commerce Department suspended a decision to ban all sales to ZTE.

Unfortunately for ZTE, the company apparently lied both during negotiation and after settlement. ZTE had said that the executives responsible were disciplined or fired, but apparently they instead received substantial bonuses. So in April 2018, the Commerce Department decided that ZTE had breached the agreement and therefore put the deferred sanctions into effect. This effectively killed ZTE’s ability to produce anything—a corporate death-sentence for a technology company.

I personally believe this was an unwise and excessive punishment. ZTE is a bad actor, but killing the company has significant follow-on effects. Companies that only depend on European or Chinese technology can’t be killed this way, but those that depend on U.S. technology can. So when combined with the U.S. decision to unilaterally withdraw from the Iran nuclear agreement and to directly threaten European companies with sanctions for continuing to do business with Iran, this creates a direct incentive for European companies—not just Chinese ones—to avoid U.S. technologies whenever possible.

As such, the decision to rescind the death sentence on ZTE seems to me to be the right one on the merits. But the process by which the decision was reached worries me. President Trump is governed by whim, not deliberation. And since when does Trump care about “thousands of Chinese Jobs”?

I see two possibilities for what might have happened here. The first is a legitimate government-to-government or person-to-person communication. If President Xi called up Trump and asked Trump to remove the ban on U.S. sales to ZTE, perhaps Trump could easily be persuaded that this wasn’t in the U.S. interest. After all, Trump and Xi reportedly have a good personal relationship, as Trump noted in a tweet. Such communications should leave records, and the State Department or the White House would be well advised to release documentation concerning such a call. I hope this scenario is the case.

But the second possibility is more troubling. Reports have noted that Trump’s ZTE tweet came 72 hours after the Chinese government announced a $500 million loan package to help build an Indonesian theme park and resort that will contain Trump-branded property. The loan itself won’t include construction of the associated on-site Trump resort, golf course and residences, but the value of that development will come largely from its placement within the associated MNC Lido City theme park.

As the New York Times writes, “There isn’t any evidence that the agreement with the construction company was intended to sway the Trump administration on any matters.” But even the appearance of a potential conflict of interest is disturbing: It’s not clear whether Trump really made this decision based on what would be in the best interests of the United States versus what would be in the best interests of his companies. And that we even need to contemplate the possibility that the Chinese government indirectly bribed the President of the United States is frankly terrifying. Susan Hennessey put it well: Trump’s ethical compromises are a national-security risk.