Search This Blog

Thursday, January 31, 2019

How Huawei planned international robot espionage via email

It’s 1 percent James Bond, 99 percent Mr. Bean.

Huawei began building its own phone-testing system, xDeviceRobot, in early 2012. The Chinese company hoped to improve the quality of its mobile hardware, which tended to fail far more often than competitors’ devices in third-party trials. In May 2012, Huawei China asked T-Mobile if it could license or flat-out buy the company’s phone-testing robot, Tappy, which served as a standard for much of the industry. T-Mobile said no.So, Huawei decided to steal Tappy.
After installing a handful of employees at T-Mobile’s headquarters in Bellevue, Washington, federal prosecutors claim Huawei USA and China employees attempted to illegally collect information on Tappy in a year-long espionage campaign that culminated in actual theft. Huawei was found guilty of misappropriating T-Mobile’s Tappy intellectual property in a 2014 civil lawsuit, and federal prosecutors in Seattle this week unsealed an indictment that brings new, criminal charges against the Chinese company.
The following activities and email exchanges were compiled from the indictment signed on January 16th, 2019 (unsealed on January 28th). All bolded messages presented below are direct quotes from Huawei emails, as described in the indictment, while the supporting text has been compiled from the document’s surrounding information.
What follows is a real-life, bumbling, corporate-tinged, international spy drama that played out over internal Huawei emails between 2012 and 2013, as related by US prosecutors:

Date: May 2012
From: R.Y. (Huawei USA Director of Technical Acceptance)
To: engineers@huawei
Subject: License TMO robot
Asked about licensing or purchasing Tappy, but TMO said no. They have no plans to sell the robot system to any phone manufacturer, including Huawei.

Date: July 2012
From: H.L. (Huawei USA employee at T-Mobile)
To: engineers@huawei
Subject: Progress report
Per request for photos and technical specs of TMO robot (i.e. component serial numbers, hardware and software details) we were unable to gather relevant information. They say it is because of information security regulations. We were reminded that all Huawei employees signed non-disclosure agreements.

Date: September 2012
From: H.P. (Huawei China Director of Device Testing Management Department)
To: usa@huawei
Subject: Goals
The main point is to figure out the Robot’s specifications and functions. These are the benchmarks of products developed by ourselves.

Date: September 2012
From: R.Y. (Huawei USA employee)
To: hp@huawei, engineers@huawei
Subject: checking in
T-Mobile is not willing to share the detail of robot tech/docs with Huawei or any manufacturers. They refused to provide us the details of robot hardware and software specifications.

Date: November 2012
From: J.Y. (Huawei China engineer)
To: ry@huawei
Subject: Reminder
This email is just a kindly reminder for the information we need to build our own robot system and kindly feedback the information we need in the attachment…
TappyTechSpecsRequest.ppt

Date: November 2012
From: R.Y. (Huawei USA employee)
To: A.X. (Huawei USA engineer), engineers@huawei
Subject: FWD: Reminder
See message from J.Y.
[…]

Date: November 2012
From: R.Y. (Huawei USA employee)
To: jy@huawei
Subject: Re: FWD: Reminder
Huawei USA engineers have accessed the robot lab… They know how TMO robot work and system info. I asked them to write down the info in detail and then send to Huawei China.

Date: November 2012
From: A.X. (Huawei USA engineer)
To: jy@huawei
Subject: Re: Re: FWD: Reminder
I am sorry we can not get more information from TMO and we can’t finish the whole PowerPoint as we talk about. And as you know, we can take some pictures of test procedure and setting. Hope it is useful to HQ R&D.

Date: November 2012
From: A.X. (Huawei USA engineer)
To: jy@huawei, engineers@huawei
Subject: pictures
Pictures of Tappy robot and software interface attached.
tappy1.jpg
tappy2.jpg
tappy3.jpg
tappy4.jpg

Date: December 2012
From: R.Y. (Huawei USA employee)
To: jy@huawei, engineers@huawei
Subject: Follow up
We got not much information from TMO on these questions that you guys asked. Again, TMO won’t want to share any more information about their robot system with us. However, we still try to find more information during our test in TMO robot lab. But it won’t expect any time soon.

Date: December 2012
From: J.Y. (Huawei China engineer)
To: ry@huawei, ax@huawei, usa@huawei, engineers@huawei
Subject: xDeviceRobot issues
We are still working on the Robot system and we had some issues with the system at the moment. More information on Tappy is needed. Are software test strips optimized for each device? What is Tappy’s touch speed? How is the rubbed tip installed? Is there air space in the rubber tip?

Date: January 2013
From: A.X. (Huawei USA engineer)
To: jy@huawei
Subject: Re: xDeviceRobot issues
See attached photos of Tappy.
tappy5.jpg
tappy6.jpg

Date: January 2013
From: J.Y. (Huawei China engineer)
To: ry@huawei, ax@huawei, usa@huawei
Subject: Tappy arm
We need more technical information, specifically the response time accuracy of TMO’s mechanical arm.

Date: January 2013
From: A.X. (Huawei USA engineer)
To: jy@huawei
Subject: Re: Tappy arm
TMO will not give us this information.

Date: January 2013
From: R.Y. (Huawei USA employee)
To: jy@huawei, engineers@huawei
Subject: Re: Re: Tappy arm
Once again, we CAN’T ask TMO any questions about the robot. TMO is VERY angry the questions that we asked. Sorry we can’t deliver any more information to you.
I think a Huawei China engineer should come to Seattle and observe Tappy directly. You will learn a lot in knowledge and experience.

Date: March 2013
From: F.W. (Huawei China engineer)
To: hl@huawei, engineers@huawei
Subject: xDeviceRobot update
From the results of the recent xDeviceRobot system verification, there is still a definite disparity with T-Mobile.
H.L., can you collect information about the TMO robot arm and tip? We need contact area, hardness and pressure.

Date: March 2013
From: H.L. (Huawei USA engineer)
To: fw@huawei
Subject: Re: xDeviceRobot update
Gathering info from TMO is risky. I recommend contacting the robot manufacturer instead. Going through TMO would only backfire, especially after signing a confidentiality agreement at the TMO laboratory, the relevance of this information to us is very sensitive.

Date: April 2013
From: J.Y. (Huawei China engineer)
To: ry@huawei, ax@huawei, usa@huawei, engineers@huawei
Subject: xDeviceRobot – further difficulties
We are still not on par with TMO robot. Please send more information about calibration standards, delay calculations and software.

Date: April 2013
From: R.Y. (Huawei USA employee)
To: jy@huawei, engineers@huawei
Subject: Re: xDeviceRobot – further difficulties
First of all, I am glad that HQ R&D has been continuing to improve the Huawei robot system. Based on the test on TMO’s phone we do see a big difference of test results between TMO robot and Huawei robot. I think we have a lot of work to improve our robot performance. The difference between two is not only the hardware but also (most importantly) the software. TMO has spend much more money on software than hardware.
Once again, we can’t get any further information about TMO robot system from TMO. They have complained to us a lot about this because we asked them too many questions of the robot based on HQ’s request. TMO said to me that if we ask them again such questions, they don’t allow us to use their robot Lab. TMO has set up a security system by putting camera into the robot Lab. I think everyone knows what this means. We can’t provide any further information to HQ because we can’t get anything from TMO.
Once again, I suggested HQ to send an engineer to TMO for a hands-on experience by playing the robot system. I believe this would give HQ robot team a huge benefit in understanding TMO robot system from hardware and software, as well as operation.

Date: April 2013
From: Huawei USA employee
To: jy@huawei, ry@huawei, engineers@huawei
Subject: Re: Re: xDeviceRobot – further difficulties
Here’s why TMO will not share info with us, as far as I can tell:
TMO is clear that those such as Huawei and Samsung are not only supplying TMO, but are also supplying their competitors such as Verizon, ATT, and other carriers.
  1. If every Vendor is helped to establish TMO testing environment and standards, it would certainly also improve the product quality, etc. of each Vendor’s competitors, which is equivalent to TMO doing a good deed for the industry.
  2. TMO took about four years of time and lots of resource optimization to develop the Robot system, and it contains TMO’s intellectual property rights.
  3. TMO can provide a free testing environment for each Vendor, and it can ensure that this system only services TMO products. This only enhances the competitiveness of TMO.

Date: April 2013
From: Huawei USA Executive Director of Technical Acceptance
To: jy@huawei, ry@huawei, engineers@huawei
Subject: Re: Re: Re: xDeviceRobot – further difficulties
Access to Tappy by our engineers on the ground is strictly controlled. They are limited to usage of TMO’s robot, and everything else is categorically denied.
Due to answering headquarters’ questions, our employees have had two complaints raised against them, and it was declared that if we inquired again, Huawei’s credentials for using the TMO Robot Laboratory would end. I echo previous suggestions to send an engineer from headquarters to see Tappy in person.

Date: April 2013
From: F.W. (Huawei China engineer)
To: Huawei USA Executive Director of Technical Acceptance
Subject: Trip to Washington
>There are a number of goals for my trip to T-Mobile HQ, but mainly-
  • Collect detailed technical data on Tappy hardware and software
  • Take photos and videos
  • For the mechanical arm issues, go to the laboratory for reconnaissance and obtain measurement data
I expect to arrive in Washington on May 11.

Date: May 2013
From: F.W. (Huawei China engineer)
To: engineers@huawei, usa@huawei, Director of Device Testing Management Department
Subject: Reconnaissance
A.X. has let me into the Tappy laboratory twice over the past few days. Both times we were discovered by a T-Mobile employee and I was asked to leave, since I wasn’t allowed to be there. I observed the robot on both visits and took pictures on the second.
I went once more today to TMO’s mechanical arm testing laboratory and gained an overall understanding of the test environment. I summarized it, please take a look in the attached document and pictures.
TMO has made it clear that I am not allowed to re-enter the robot laboratory. Going forward, A.X. will help you get a deeper understanding of the remaining information.
Robot Environmental Information.doc
tappypic1.jpg
tappypic2.jpg
tappypic3.jpg
tappypic4.jpg
tappypic5.jpg

Date: May 2013
From: T-Mobile partner relations
To: usa@huawei
Subject: Return all badges immediately
Due to recent and repeated violations of T-Mobile’s on-site rules, Huawei USA’s access to the Tappy laboratory has been revoked. All Huawei USA employees must return their badges to T-Mobile, with the exception of A.X., who will be the only Huawei USA employee with access to the testing facilities. This is only so Huawei can complete limited testing on in-progress projects.

Date: May 2013
From: J.Y. (Huawei China engineer)
To: ax@huawei, ry@huawei, hl@huawei
Subject: Necessary information
The engineering team needs more details about the TMO robot:
  • exact specifications, operations and a list of components used
  • how it calculates UI response time
  • shape, diameter and hardness of tip
  • how it handles force
  • sensors used to support the arm and camera
  • lots of photos and videos of test process

Date: May 2013
From: A.X. (Huawei USA engineer)
To: jy@huawei
Subject: Re: Necessary information
We’ll certainly help if we can; this period is very sensitive.
In regards to photos and videos, after TMO gives back our badges, I’ll send it back home. No need for home to keep reminding me.

Date: May 2013
From: engineers@huawei
To: ax@huawei, jy@huawei, fw@huawei
Subject: Robot arm
The xDeviceRobot team needs specs on the arm. Specifically, the diameter of the end tip of the conductor stick.

Date: May 2013
From: F.W. (Huawei China engineer)
To: engineers@huawei, jy@huawei, ax@huawei
Subject: Re: Robot arm
A.X. was able to remove the robot arm from the laboratory without being detected and I took exact measurements. However, TMO quickly discovered the arm was missing and A.X. was forced to return the part the following day. A.X. told them it was taken by mistake. Our access to the lab has been completely revoked and Huawei USA employees are no longer allowed inside the facility unsupervised.
I’ve attached detailed measurements of the arm. See pictures for details.
tappyarm1.jpg
tappyarm2.jpg
tappyarm3.jpg
tappyarm4.jpg
tappyarm5.jpg

Date: >May 2013
From: engineers@huawei
To: ax@huawei
Subject: exact tip measurements
Can you measure the conductor stick with a caliper device?

Date: May 2013
From: ax@huawei
To: engineers@huawei
Subject: Re: exact tip measurements
F.W. has already sent the pictures home.

The criminal charges lodged against Huawei in the T-Mobile case are just part of the Chinese company’s concerns at the moment. This week, the US filed 23 total charges against Huawei related to trade-secret and sanctions violations.
The 13 sanctions charges stem from the company’s dealings with Iran. Huawei CFO Meng Wanzhou is accused of committing fraud to bypass Iran sanctions and bring US-made technology into the country. She was arrested in Canada last month at the request of US authorities. Though she’s currently out on bail, she faces extradition to the US.
Regarding the T-Mobile situation, Huawei says the case has already been settled. And it has been, in civil court — after hearing the story in 2017, a Seattle jury forced Huawei to pay T-Mobile $4.8 million in damages. However, that was all over breach of contract, not trade-secret violations. The jury said Huawei hadn’t maliciously or willfully misappropriated the data it stole from T-Mobile, and no money was awarded for the trade-secret claim.
A Huawei representative sent the following statement to Engadget this week:
The allegations in the Western District of Washington trade secret indictment were already the subject of a civil suit that was settled by the parties after a Seattle jury found neither damages nor willful and malicious conduct on the trade secret claim.
The Company denies that it or its subsidiary or affiliate have committed any of the asserted violations of U.S. law set forth in each of the indictments, is not aware of any wrongdoing by Ms. Meng, and believes the U.S. courts will ultimately reach the same conclusion.

No comments:

Post a Comment

Note: Only a member of this blog may post a comment.