Huawei-built data centre allowed undetected eavesdropping: report

Prime Minister Jacinda Ardern and Deputy PM Winston Peters (pictured) attended the Apec meeting in Papua New Guinea in 2018, for which the new data centre was commissioned. Photo / Jason Oxenham

A review into China's alleged spying activities in Papua New Guinea says Huawei left multiple security gaps when it built the country's National Data Centre - making it easy to eavesdrop on the Pacific nation, according to an AFR report.

"It is assessed with high confidence that data flows could be easily intercepted," the review says.

"Remote access would not be detected by security settings."

The 65-page review was commissioned by PNG's National Cyber Security Centre, written by a cyber security contractor hired by Australia's Department of Foreign Affairs and Trade (DFAT) in 2019 then subsequently handed to the Australian government.

According to the AFR, the report claims outdated encryption software and insufficient firewall settings used by Huawei to build PNG's National Data Centre exposed secret government files to being stolen.

The Port Moresby data centre was funded through a US$53 million development loan from China's Exim Bank and became operational in 2018, before PNG hosted that year's Apec leaders meeting.

Huawei said in a statement, "This project complies with appropriate industry standards and the requirements of the customer."

The report (by AFR's account), says "Core switches are not behind firewalls. This means remote access would not be detected by security settings within the appliances."

The Huawei firewalls in the data centre reached their "end of life" in 2016, two years before the facility was opened, AFR says.

As the Australian business paper frames it, "The report on Huawei is the first to document its complicity in Beijing's cyber espionage activities, after more than a decade of rumours and pointed remarks from security agencies."

An alternative narrative would be that the project for the impoverished nation was simply under-funded and poorly planned.

And its operation failure seems to indicate that there was little scope for snooping, regardless.

"While the report suggests a deliberate effort by Huawei to deploy lax cyber security, it noted this plan was partially thwarted by the centre quickly falling into disrepair, as insufficient money was set aside for maintenance and operations," AFR says.

Few PNG government departments actually shifted data to the new data centre.

The Australian government has refused to fund an upgrade, saying the facility requires a complete rebuild.

Huawei was recently blocked from 5G network upgrades in the UK. The Chinese telecommunications giant has already been barred from 5G upgrades in the US and Australia, and from Spark's 5G upgrade here.

Spark has tagged in Nokia Networks and Samsung to replace Huawei - at least for the time being - in its mobile network upgrade, and recently pushed ahead with its first mobile 5G service, in Palmerston North on July 29.

Huawei New Zealand deputy MD Andrew Bowater has at times been on the front-foot over what he has painted as baseless, politically-inspired criticism of his country, and has at times pushed for meetings with ministers.

However, he kept his powder dry when approached for comment on recent events.

"5G technology is a great opportunity for New Zealand," Bowater told the Herald.

"However, it is not the top priority as we come out of Covid, and we understand this and have no intention of making this an issue right now."