Pentagon Sees Giant Cargo Cranes as Possible Chinese Spying Tools

·         WSJ NEWS EXCLUSIVE

Equipment at U.S. ports could pose risk of surveillance or sabotage, officials say; China says concerns are ‘paranoia-driven’

Cranes made by a China-based manufacturer could potentially gather intelligence using software that tracks shipping containers. JUSTIN SULLIVAN/GETTY IMAGES

By Aruna Viswanatha, Gordon Lubold and Kate O’Keeffe

Updated March 5, 2023 11:30 am ET

 

WASHINGTON—U.S. officials are growing concerned that giant Chinese-made cranes operating at American ports across the country, including at several used by the military, could give Beijing a possible spying tool hiding in plain sight.

Some national-security and Pentagon officials have compared ship-to-shore cranes made by the China-based manufacturer, ZPMC, to a Trojan horse. While comparably well-made and inexpensive, they contain sophisticated sensors that can register and track the provenance and destination of containers, prompting concerns that China could capture information about materiel being shipped in or out of the country to support U.S. military operations around the world.

The cranes could also provide remote access for someone looking to disrupt the flow of goods, said Bill Evanina, a former top U.S. counterintelligence official.

“Cranes can be the new Huawei,” Mr. Evanina said, referring to the Chinese telecom giant Huawei Technologies Co., whose equipment U.S. officials have effectively banned after warning that it could be used to spy on Americans. “It’s the perfect combination of legitimate business that can also masquerade as clandestine intelligence collection.” Huawei has said its products aren’t a national-security risk.

A representative of the Chinese Embassy in Washington called the U.S. concerns about the cranes a “paranoia-driven” attempt to obstruct trade and economic cooperation with China. “Playing the ‘China card’ and floating the ‘China threat’ theory is irresponsible and will harm the interests of the U.S. itself,” it said.

Representatives of ZPMC, whose full name is Shanghai Zhenhua Heavy Industries Co., didn’t respond to requests for comment.

The recent tension over high-altitude balloons as an alleged means of Chinese surveillance has cast a spotlight on the changing nature of espionage and how nations keep tabs on each other, beyond the more conventional intelligence-gathering tools of spies and satellites.

A suspected Chinese spy balloon and three unidentified flying objects were shot down over the U.S. and Canada in recent weeks. An aeronautics historian explains the history of spy balloons and why countries still use them today. Graphic: Miki Katoni

In recent years, U.S. national-security officials have pointed to a range of equipment manufactured in China that could facilitate either surveillance or disruptions in the U.S., including baggage-screening systems and electrical transformers, as well as broader concerns about China’s growing control of ports around the world through strategic investments. China makes almost all of the world’s new shipping containers and controls a shipping-data service.

In that context, the giant ship-to-shore cranes have drawn new attention. The $850 billion defense policy bill lawmakers passed in December requires the Transportation Department’s maritime administrator, in consultation with the defense secretary and others, to produce an unclassified study by the end of this year on whether foreign-manufactured cranes pose cybersecurity or national-security threats at American ports.

National-security officials haven’t detailed any instances of cranes being used to nefarious ends. In the case of the high-altitude balloon shot down in February, U.S. authorities said the vehicle was made by a manufacturer with a direct relationship with the Chinese military and carried antennas and sensors for collecting intelligence and communications. Western law-enforcement authorities have identified the threat posed by Chinese espionage, including the theft of technology, as a priority.

A ZPMC facility for manufacturing heavy equipment in Shanghai.PHOTO: SHEN CHUNCHEN/VCG/GETTY IMAGES

ZPMC cranes entered the U.S. market around two decades ago, offering what industry executives described as good-quality cranes that were significantly cheaper than Western suppliers. In recent years, ZPMC has grown into a major player in the global automated-ports industry, working with Microsoft Corp. and others to connect equipment and analyze data in real time.

“We used to sell equipment, but now we are selling systems,” said Hailiang Song, ZPMC’s then-chairman, in a 2017 video on Microsoft’s website. In the video, then-President Qingfeng Huang added: “Through our main office in Shanghai, you can monitor all the cranes” to help troubleshoot. Microsoft didn’t respond to a request for comment.

ZPMC executives were often celebrated around the U.S., where no comparable cranes are manufactured. During a visit to the Charleston, S.C., port in 2018, Mr. Huang presented a model of a crane to a local middle school.

Hailiang Song, former chairman of ZPMC, has said the company is a seller of systems as much as of equipment.PHOTO: YUAN CHEN/VCG/GETTY IMAGES

Today, ZPMC says it controls around 70% of the global market for cranes and has sold its equipment in more than 100 countries. A U.S. official said the company makes nearly 80% of the ship-to-shore cranes in use at U.S. ports.

The huge cranes are generally delivered to U.S. ports fully assembled on ships and are operated through Chinese-made software. In some cases, U.S. officials said, they are supported by Chinese nationals working on two-year U.S. visas, factors they described as potential avenues through which intelligence could be collected.

The Defense Intelligence Agency conducted a classified assessment in 2021 and found that Beijing could potentially throttle port traffic or gather intelligence on military equipment being shipped. U.S. officials didn’t say whether they had found any specific instances of ZPMC cranes being used for espionage.

“DIA’s analytic efforts assist the U.S. military in anticipating and mitigating threats to global mobility, which relies in part on commercial transportation and shipping,” DIA spokesman Lt. Col. Dean Carter said.

In the past two years, ports in Virginia, South Carolina and Maryland that are at times used by nearby U.S. military bases acquired new cranes from ZPMC, prompting concern within the U.S. national-security community and the Federal Bureau of Investigation, according to people familiar with the concerns.

In 2021, FBI agents searched a cargo ship delivering ZPMC cranes to the Baltimore port and found intelligence-gathering equipment on board, some of the people said. The Wall Street Journal couldn’t determine what action, if any, was taken as a result.

The Port of Baltimore, where intelligence-gathering equipment was found in a search of a ship delivering ZPMC cranes.PHOTO: EVELYN HOCKSTEIN/REUTERS

By one estimate, 80% of ship-to-shore cranes in use at U.S. ports are made by ZPMC.PHOTO: DAMIAN DOVARGANES/ASSOCIATED PRESS

William Doyle, executive director of the Maryland Port Administration, said the Baltimore port had purchased four cranes from ZPMC and hasn’t found any issues while assembling and testing them, and is continually scanning the networks for security. A spokesman for the port of Norfolk, Va., said the facility has deployed ZPMC cranes for two decades and uses its own employees to operate and maintain them. A spokeswoman for the Charleston port declined to provide comment.

ZPMC is a subsidiary of China Communications Construction Co., a leading contractor for Chinese leader Xi Jinping’s Belt and Road initiative to develop infrastructure and trade links across Asia, Africa and beyond. In 2020, U.S. authorities limited five CCCC units’ access to U.S. technology, citing its role in Beijing’s military-civil fusion program, among other factors.

“It wouldn’t be hard for an attacker to disable one sensor on a crane and prevent the crane from moving,” said Chris Wolski, who formerly ran cybersecurity for the port of Houston. “These systems aren’t designed for security, they are designed for operations.”

Some industry executives said while they didn’t think the cranes had access to sensitive data that wasn’t otherwise accessible, some ports have turned to software provided by Swiss company ABB Ltd. to operate ZPMC cranes. Other ports, including Savannah, Ga., the East Coast’s second-biggest cargo port, use cranes of Finnish provider Konecranes, which usually cost around a third more than their Chinese rivals, industry experts said.

Rep. Carlos Giménez (R., Fla.) introduced legislation last year to ban future U.S. purchases of Chinese cranes and encourage other manufacturers. The congressman, a former mayor of Miami Dade County, whose port has some ZPMC-manufactured cranes, said he proposed the legislation when he became aware that the software on ZPMC cranes could be used for nefarious purposes.

Rep. Carlos Giménez proposed legislation last year to ban future U.S. purchases of Chinese cranes.PHOTO: BILL CLARK/CQ ROLL CALL/ZUMA PRESS

“The physical and logistical technology infrastructure at ports is a critical area of vulnerability,” Mike Wessel, a member of the U.S.-China Economic and Security Review Commission, a congressionally-convened commission known for its hawkish perspective on China, said in a statement. The commission was briefed on the cranes-security issue last year by defense officials, according to people familiar with the matter. Mr. Wessel declined to acknowledge the briefing or comment on any specifics discussed there.

Early in the Trump administration, officials in the National Security Council’s strategic planning office came to consider cranes as a unique point of interest, said Sean Plankey, a former cybersecurity official who was involved in those discussions. “Where would someone attack first and how would they do it?” he asked, characterizing the discussion. He said the officials determined that if Beijing’s military could access the cranes, they could potentially shut down U.S. ports without drawing on their navy.

A National Maritime Cybersecurity Plan, released in December 2020, found that no single U.S. agency had responsibility for maritime network security, leaving port directors without enforceable standards on cybersecurity and generally free to buy equipment from any vendor.

Write to Aruna Viswanatha at aruna.viswanatha@wsj.com, Gordon Lubold at gordon.lubold@wsj.com and Kate O’Keeffe at kathryn.okeeffe@wsj.com

 

https://www.wsj.com/articles/pentagon-sees-giant-cargo-cranes-as-possible-chinese-spying-tools-887c4ade