Start your day with intelligence. Get The OODA Daily Pulse.
Informing your decisions with actionable intelligence
Start your day with intelligence. Get The OODA Daily Pulse.
Informing your decisions with actionable intelligence
Editor’s note: This post is the second of a three part series based on a paper examining Chinese use of cellular technologies (including the threat to US interests) by Charlie Parton. For the full paper see: Cellular IoT Modules- Supply Chain Security -bg
The Chinese government is actively driving the adoption of NB-IoT standards, and companies involved in the NB-IoT market are implementing them.[1] The relationships between Chinese technology companies that are the suppliers of IoT devices and the companies that are the suppliers of the cellular modules that enable them is key. Often conversation on risk associated with Chinese companies exporting technology globally focuses on the visible companies, overlooking the many others that sit within their supply chains.
China’s two dominant players in the IoT module market are Quectel Wireless Solutions Co. Ltd. (Quectel) and Fibocom Wireless (Fibocom). Of the two, Quectel is significantly larger and is regarded as a market leader. Both companies develop products which have specific security applications. One of Quectel’s cellular IoT modules, the AG215S, for example, is described on the company’s website as “supports the global, US, EU and China National Security Algorithm, which can greatly boost security in vehicle communications.”[2] Fibocom, meanwhile, provides 5G cellular modules for police UAVs in China.[3]
Quectel, Fibocom and China Mobile are the key suppliers of cellular IoT to a Chinese ecosystem of technology companies which includes HikVision, HiSilicon, DJI, and ZTE (these four companies are already subject to export controls in the United States). Quectel and Fibocom are intimately connected with these companies, sharing R&D, funding, staffing and ownership (one board member at HikVision is listed as a major shareholder at Quectel).This ecosystem of technology companies contributes to the CCP’s Military Civil Fusion policy, playing an important role in the modernisation of the Chinese military and security apparatus.
Two Companies:
Quectel (上海移远通信技术股份有限公司) Founded in 2010 under the leadership of its current CEO and Chairman of the Board Qian Penghe. It develops modules on almost every chip platform available in the market. This makes it particularly popular for high end integrators, as it allows product designers and private consumers to choose the right module for their device. Two-thirds of revenue comes from China, but the company is growing in North American, European and Middle Eastern markets. Quectel has maintained revenue growth of over 50 percent in each of last four years, and the company has invested in s own production lines.
Fibocom Wireless (广和通) Founded in 1999, its co-founder and current CEO is Ying Lingpeng. Fibocom focuses more on bespoke collaborations with other market leaders. For example, through this strategy it has established itself as exclusive module partner of Intel for the mobile computing market, most recently on the Intel 5G Solution 5000 wireless chipset. Fibocom has cooperated with many well-known smart security IoT companies, such as Tuya Smart, Hikvision, Qingxin Internet, to offer IoT modules for security products.
Quectel and Fibocom, like all other Chinese companies, are bound by China’s national security laws. Recent state security laws, such as the 2017 Intelligence Law, have not changed the long-standing de facto practice of state power in the PRC, but have further codified the expectation that in the PRC everyone is responsible for state security.[5] PRC- based technology companies tend to acknowledge their own exposure to legal risks emanating from the current data security system being developed in the PRC in their privacy policies.[6] A Quectel privacy policy, for example, states the company does not share, transfer and publicly disclose personal data unless relevant laws oblige them to do so. It specifically lists as examples laws state security and national defence, public safety, public health and major public interest, criminal investigation. [7] Fibocom’s searchable privacy policy, which applies to website, says “all persons entering and using the Fibocom Platform shall comply with the terms herein and the laws of the People’s Republic of China. For any violation of these rules, Fibocom shall have the right to pursue legal and fair remedies.”[8]
Figure 4. China’s IoT Ecosystem
Beyond these general risks of exposure to the Chinese party-state’s demands, which apply to all PRC companies, both Quectel and Fibocom have links to other PRC companies that are suppliers for PRC IoT devices.
Figure 5. Quectel and Fibocom in Supply Chains of Restricted PRC Technology Companies
| Restricted Entity | Restricted Entity Overview | Links to Quectel | Links to Fibocom |
| HikVision | Global market leader in Internet Protocol (IP) cameras used for surveillance and security. HikVision is facing allegations that its cameras are used in detention centres in Xinjiang. It may come under US sanctions for complicity in human rights abuses[9]. The US Treasury Department is considering placing Hikvision on its Specially Designated Nationals (SDN) list. | Quectel also had a major shareholder who was also at HikVision H, Wu Weiqi (邬伟琪)[10] | HikVision is listed as a target customer for Fibocom IoT modules, with specific reference to the production of CCTV products. [11]HikVision’s cameras are now coming under increasing scrutiny by the UK government and others over concerns regarding privacy and the companies role in the repression of Uighurs in Xinjiang. |
| HiSilicon | A is a subsidiary of Huawei which designs silicon chips. In May 2019, the US Department of Commerce’s Bureau of Industry and Security (BIS) placed HiSilicon on its Commerce Entity List[12], thereby barring its access to industry-standard chip design software, made by US company Synopsys. | Quectel has a long track record of working with HiSilicon. In February 2020 the two companies were working closely in the development of 5G industrial and consumer modules, particularly the NB-IoT module, based on the HiSilicon Boudica 150 chip.[13] The Quectel and HiSilicon collaboration has continued, despite US sanctions against Hisilicon. In May 2021, Quectel announced a module line of the first commercially available modules to use HiSilicon’s Boudica 200 modem chip[14]. | There is a regular interchange of key technologists between Fibocom and Huawei. Both companies share industry alliances and suppliers. It is a closely linked ecosystem as can be seen by the repeated overlap of memberships on special committees and alliances.[15][16] The HiSilicon Boudica chip is based on technology originally developed by Neul, a UK IoT research company, which Huawei purchased in 2014.[17]Its innovative, long-range radio technology intellectual property allowed Huawei, other cellular infrastructure vendors, chipset manufacturers, and mobile network operators, to promote a standard called Narrowband IoT (NB-IoT). Fibocom products have since been identified in Neul products[18]NB-IoT is a key standard for Chinese IoT manufactures with Quectel, Qualcomm, and HiSilicon jointly developing modules that use it.[19][20] |
| DJI | Leading drone manufacturer. DJI is subject to US investment and export restrictions, including the Entity List of the US Department of Commerce’s BIS. In other words, DJI is seen as engaging in activities contrary to US national security. | Quectel supplies IoT modules for DJI’s Mavic 3 4G Dongle.[21] Quectel is an industry alliance partner with DJI. The drone manufacturer is currently under significant restrictions in the US due to national security and human rights concerns. | is listed as customer for Fibocom IoT modules[22][23], demonstrating how China’s leading cellular IoT module designers and manufacturers cooperate in the development and deployment of strategically relevant products to the global and domestic markets. |
| ZTE | One of China’s two main exporters of telecoms equipment and services. In 2017 the US government placed ZTE on restrictive lists for violating sanctions. The company admitted the charges and paid a US$ 900 million fine.[24] A year later ZTE was found to be in violation of these conditions, and the Department of Commerce banned US companies from providing parts to ZTE for seven years. In a new settlement, ZTE paid a further US$ 1 billion fine, replaced its entire senior management in the US, and established a compliance department selected by the US Department of Justice.[25] The company is still barred from US government contracts. US telecommunications providers may not use government funds to purchase ZTE equipment.[26] | The founder of ZTE, Qian Penghe, is also one of the main private shareholders in Quectel. There is a regular interchange of employees. They are members of many of the same alliances including the 5G Terminal Innovation Joint R&D Centre[27]. Quectel supplies components to ASR Microelectronics which in turn is a key supplier to ZTE. |
Fibocom and Quectel products can remain sitting within the supply chains of the national defence ecosystem of the US and allied countries. Ironically, by highlighting two specific companies, Fibocom and Quectel, we can see that company-specific approaches to assessing risk is not, as it stands, adequate enough to address IoT supply chain security issues. Huawei’s relationship with Fibocom suggests a strategy which is to establish dominance in the NB-IoT market. In May 2022, Canada announced plans to ban the use of Huawei and ZTE equipment from use in 5G infrastructure, citing national security concerns Companies using equipment or managed services from the two Chinese companies have until 28 June 2024 to remove the equipment. The announcement said that the two companies ‘could be compelled to comply with extrajudicial directions from foreign governments in ways that would conflict with Canadian laws or would be detrimental to Canadian interests.’[28]
While Canadian policy addresses the de facto relationship with Fibocom, it does not change Fibocom’s significant presence in Canada. Fibocom has expanded into the vehicle IoT market by acquiring the Canadian company Sierra Wireless Automotive group in 2020 for UD$165 million, under the consortium Rolling Wireless. It subsequently hired Sierra Wireless management to run Rolling Wireless and overseas business, while also hiring from other module vendors to expand in the US. Fibocom is also expanding into Western markets through its relationship with Intel. The company has displaced other competitors to win designs with western PC manufacturers, such as Lenovo, Dell and HP, which now use Fibocom modules in their off the shelf computers. In the past year, Quectel launched a new original design manufacturer brand, Ikotek, targeting the US and Latin America. It is also trying to break into the overseas automotive market by placing its network access device modules in foreign electric vehicles.
References
About the Author
Charlie Parton spent 22 years of his 37 year diplomatic career working in or on China, Hong Kong and Taiwan. In his final posting he was seconded to the EU Delegation in Beijing, where, as First Counsellor until late 2016, he focussed on Chinese politics and internal developments, and advised the EU and Member States on how China’s politics might affect their interests. He has also worked in Afghanistan, Cyprus, Libya and Mali. In 2017 he set up his own consultancy, China Ink, and was chosen as the UK Parliament’s Foreign Affairs Committee Special Adviser on China; he returned to Beijing for 4 months as Adviser to the British Embassy to cover the Communist Party’s 19th Congress.
Informing your decisions with actionable intelligence
Informing your decisions with actionable intelligence