Image credit: ASSOCIATED PRESS

How Huawei planned international robot espionage via email

It's 1 percent James Bond, 99 percent Mr. Bean.

3533 Shares
Share
Tweet
Share
    Image credit: ASSOCIATED PRESS

    Sponsored Links

    Huawei began building its own phone-testing system, xDeviceRobot, in early 2012. The Chinese company hoped to improve the quality of its mobile hardware, which tended to fail far more often than competitors' devices in third-party trials. In May 2012, Huawei China asked T-Mobile if it could license or flat-out buy the company's phone-testing robot, Tappy, which served as a standard for much of the industry. T-Mobile said no.

    So, Huawei decided to steal Tappy.

    After installing a handful of employees at T-Mobile's headquarters in Bellevue, Washington, federal prosecutors claim Huawei USA and China employees attempted to illegally collect information on Tappy in a year-long espionage campaign that culminated in actual theft. Huawei was found guilty of misappropriating T-Mobile's Tappy intellectual property in a 2014 civil lawsuit, and federal prosecutors in Seattle this week unsealed an indictment that brings new, criminal charges against the Chinese company.

    The following activities and email exchanges were compiled from the indictment signed on January 16th, 2019 (unsealed on January 28th). All bolded messages presented below are direct quotes from Huawei emails, as described in the indictment, while the supporting text has been compiled from the document's surrounding information.

    What follows is a real-life, bumbling, corporate-tinged, international spy drama that played out over internal Huawei emails between 2012 and 2013, as related by US prosecutors:


    Date: May 2012
    From: R.Y. (Huawei USA Director of Technical Acceptance)
    To: engineers@huawei
    Subject: License TMO robot

    Asked about licensing or purchasing Tappy, but TMO said no. They have no plans to sell the robot system to any phone manufacturer, including Huawei.


    Date: July 2012
    From: H.L. (Huawei USA employee at T-Mobile)
    To: engineers@huawei
    Subject: Progress report

    Per request for photos and technical specs of TMO robot (i.e. component serial numbers, hardware and software details) we were unable to gather relevant information. They say it is because of information security regulations. We were reminded that all Huawei employees signed non-disclosure agreements.


    Date: September 2012
    From: H.P. (Huawei China Director of Device Testing Management Department)
    To: usa@huawei
    Subject: Goals

    The main point is to figure out the Robot's specifications and functions. These are the benchmarks of products developed by ourselves.


    Date: September 2012
    From: R.Y. (Huawei USA employee)
    To: hp@huawei, engineers@huawei
    Subject: checking in

    T-Mobile is not willing to share the detail of robot tech/docs with Huawei or any manufacturers. They refused to provide us the details of robot hardware and software specifications.


    Date: November 2012
    From: J.Y. (Huawei China engineer)
    To: ry@huawei
    Subject: Reminder

    This email is just a kindly reminder for the information we need to build our own robot system and kindly feedback the information we need in the attachment...

    TappyTechSpecsRequest.ppt


    Date: November 2012
    From: R.Y. (Huawei USA employee)
    To: A.X. (Huawei USA engineer), engineers@huawei
    Subject: FWD: Reminder

    See message from J.Y.

    [...]


    Date: November 2012
    From: R.Y. (Huawei USA employee)
    To: jy@huawei
    Subject: Re: FWD: Reminder

    Huawei USA engineers have accessed the robot lab... They know how TMO robot work and system info. I asked them to write down the info in detail and then send to Huawei China.


    Date: November 2012
    From: A.X. (Huawei USA engineer)
    To: jy@huawei
    Subject: Re: Re: FWD: Reminder

    I am sorry we can not get more information from TMO and we can't finish the whole PowerPoint as we talk about. And as you know, we can take some pictures of test procedure and setting. Hope it is useful to HQ R&D.


    Date: November 2012
    From: A.X. (Huawei USA engineer)
    To: jy@huawei, engineers@huawei
    Subject: pictures

    Pictures of Tappy robot and software interface attached.

    tappy1.jpg
    tappy2.jpg
    tappy3.jpg
    tappy4.jpg


    Date: December 2012
    From: R.Y. (Huawei USA employee)
    To: jy@huawei, engineers@huawei
    Subject: Follow up

    We got not much information from TMO on these questions that you guys asked. Again, TMO won't want to share any more information about their robot system with us. However, we still try to find more information during our test in TMO robot lab. But it won't expect any time soon.


    Date: December 2012
    From: J.Y. (Huawei China engineer)
    To: ry@huawei, ax@huawei, usa@huawei, engineers@huawei
    Subject: xDeviceRobot issues

    We are still working on the Robot system and we had some issues with the system at the moment. More information on Tappy is needed. Are software test strips optimized for each device? What is Tappy's touch speed? How is the rubbed tip installed? Is there air space in the rubber tip?


    Date: January 2013
    From: A.X. (Huawei USA engineer)
    To: jy@huawei
    Subject: Re: xDeviceRobot issues

    See attached photos of Tappy.

    tappy5.jpg
    tappy6.jpg


    Date: January 2013
    From: J.Y. (Huawei China engineer)
    To: ry@huawei, ax@huawei, usa@huawei
    Subject: Tappy arm

    We need more technical information, specifically the response time accuracy of TMO's mechanical arm.


    Date: January 2013
    From: A.X. (Huawei USA engineer)
    To: jy@huawei
    Subject: Re: Tappy arm

    TMO will not give us this information.


    Date: January 2013
    From: R.Y. (Huawei USA employee)
    To: jy@huawei, engineers@huawei
    Subject: Re: Re: Tappy arm

    Once again, we CAN'T ask TMO any questions about the robot. TMO is VERY angry the questions that we asked. Sorry we can't deliver any more information to you.

    I think a Huawei China engineer should come to Seattle and observe Tappy directly. You will learn a lot in knowledge and experience.


    Date: March 2013
    From: F.W. (Huawei China engineer)
    To: hl@huawei, engineers@huawei
    Subject: xDeviceRobot update

    From the results of the recent xDeviceRobot system verification, there is still a definite disparity with T-Mobile.

    H.L., can you collect information about the TMO robot arm and tip? We need contact area, hardness and pressure.


    Date: March 2013
    From: H.L. (Huawei USA engineer)
    To: fw@huawei
    Subject: Re: xDeviceRobot update

    Gathering info from TMO is risky. I recommend contacting the robot manufacturer instead. Going through TMO would only backfire, especially after signing a confidentiality agreement at the TMO laboratory, the relevance of this information to us is very sensitive.


    Date: April 2013
    From: J.Y. (Huawei China engineer)
    To: ry@huawei, ax@huawei, usa@huawei, engineers@huawei
    Subject: xDeviceRobot - further difficulties

    We are still not on par with TMO robot. Please send more information about calibration standards, delay calculations and software.


    Date: April 2013
    From: R.Y. (Huawei USA employee)
    To: jy@huawei, engineers@huawei
    Subject: Re: xDeviceRobot - further difficulties

    First of all, I am glad that HQ R&D has been continuing to improve the Huawei robot system. Based on the test on TMO's phone we do see a big difference of test results between TMO robot and Huawei robot. I think we have a lot of work to improve our robot performance. The difference between two is not only the hardware but also (most importantly) the software. TMO has spend much more money on software than hardware.

    Once again, we can't get any further information about TMO robot system from TMO. They have complained to us a lot about this because we asked them too many questions of the robot based on HQ's request. TMO said to me that if we ask them again such questions, they don't allow us to use their robot Lab. TMO has set up a security system by putting camera into the robot Lab. I think everyone knows what this means. We can't provide any further information to HQ because we can't get anything from TMO.

    Once again, I suggested HQ to send an engineer to TMO for a hands-on experience by playing the robot system. I believe this would give HQ robot team a huge benefit in understanding TMO robot system from hardware and software, as well as operation.


    Date: April 2013
    From: Huawei USA employee
    To: jy@huawei, ry@huawei, engineers@huawei
    Subject: Re: Re: xDeviceRobot - further difficulties

    Here's why TMO will not share info with us, as far as I can tell:

    TMO is clear that those such as Huawei and Samsung are not only supplying TMO, but are also supplying their competitors such as Verizon, ATT, and other carriers.

    1. If every Vendor is helped to establish TMO testing environment and standards, it would certainly also improve the product quality, etc. of each Vendor's competitors, which is equivalent to TMO doing a good deed for the industry.
    2. TMO took about four years of time and lots of resource optimization to develop the Robot system, and it contains TMO's intellectual property rights.
    3. TMO can provide a free testing environment for each Vendor, and it can ensure that this system only services TMO products. This only enhances the competitiveness of TMO.

    Date: April 2013
    From: Huawei USA Executive Director of Technical Acceptance
    To: jy@huawei, ry@huawei, engineers@huawei
    Subject: Re: Re: Re: xDeviceRobot - further difficulties

    Access to Tappy by our engineers on the ground is strictly controlled. They are limited to usage of TMO's robot, and everything else is categorically denied.

    Due to answering headquarters' questions, our employees have had two complaints raised against them, and it was declared that if we inquired again, Huawei's credentials for using the TMO Robot Laboratory would end. I echo previous suggestions to send an engineer from headquarters to see Tappy in person.


    Date: April 2013
    From: F.W. (Huawei China engineer)
    To: Huawei USA Executive Director of Technical Acceptance
    Subject: Trip to Washington

    >There are a number of goals for my trip to T-Mobile HQ, but mainly-

    • Collect detailed technical data on Tappy hardware and software
    • Take photos and videos
    • For the mechanical arm issues, go to the laboratory for reconnaissance and obtain measurement data

    I expect to arrive in Washington on May 11.


    Date: May 2013
    From: F.W. (Huawei China engineer)
    To: engineers@huawei, usa@huawei, Director of Device Testing Management Department
    Subject: Reconnaissance

    A.X. has let me into the Tappy laboratory twice over the past few days. Both times we were discovered by a T-Mobile employee and I was asked to leave, since I wasn't allowed to be there. I observed the robot on both visits and took pictures on the second.

    I went once more today to TMO's mechanical arm testing laboratory and gained an overall understanding of the test environment. I summarized it, please take a look in the attached document and pictures.

    TMO has made it clear that I am not allowed to re-enter the robot laboratory. Going forward, A.X. will help you get a deeper understanding of the remaining information.

    Robot Environmental Information.doc
    tappypic1.jpg
    tappypic2.jpg
    tappypic3.jpg
    tappypic4.jpg
    tappypic5.jpg


    Date: May 2013
    From: T-Mobile partner relations
    To: usa@huawei
    Subject: Return all badges immediately

    Due to recent and repeated violations of T-Mobile's on-site rules, Huawei USA's access to the Tappy laboratory has been revoked. All Huawei USA employees must return their badges to T-Mobile, with the exception of A.X., who will be the only Huawei USA employee with access to the testing facilities. This is only so Huawei can complete limited testing on in-progress projects.


    Date: May 2013
    From: J.Y. (Huawei China engineer)
    To: ax@huawei, ry@huawei, hl@huawei
    Subject: Necessary information

    The engineering team needs more details about the TMO robot:

    • exact specifications, operations and a list of components used
    • how it calculates UI response time
    • shape, diameter and hardness of tip
    • how it handles force
    • sensors used to support the arm and camera
    • lots of photos and videos of test process

    Date: May 2013
    From: A.X. (Huawei USA engineer)
    To: jy@huawei
    Subject: Re: Necessary information

    We'll certainly help if we can; this period is very sensitive.

    In regards to photos and videos, after TMO gives back our badges, I'll send it back home. No need for home to keep reminding me.


    Date: May 2013
    From: engineers@huawei
    To: ax@huawei, jy@huawei, fw@huawei
    Subject: Robot arm

    The xDeviceRobot team needs specs on the arm. Specifically, the diameter of the end tip of the conductor stick.


    Date: May 2013
    From: F.W. (Huawei China engineer)
    To: engineers@huawei, jy@huawei, ax@huawei
    Subject: Re: Robot arm

    A.X. was able to remove the robot arm from the laboratory without being detected and I took exact measurements. However, TMO quickly discovered the arm was missing and A.X. was forced to return the part the following day. A.X. told them it was taken by mistake. Our access to the lab has been completely revoked and Huawei USA employees are no longer allowed inside the facility unsupervised.

    I've attached detailed measurements of the arm. See pictures for details.

    tappyarm1.jpg
    tappyarm2.jpg
    tappyarm3.jpg
    tappyarm4.jpg
    tappyarm5.jpg


    Date: >May 2013
    From: engineers@huawei
    To: ax@huawei
    Subject: exact tip measurements

    Can you measure the conductor stick with a caliper device?


    Date: May 2013
    From: ax@huawei
    To: engineers@huawei
    Subject: Re: exact tip measurements

    F.W. has already sent the pictures home.


    The criminal charges lodged against Huawei in the T-Mobile case are just part of the Chinese company's concerns at the moment. This week, the US filed 23 total charges against Huawei related to trade-secret and sanctions violations.

    The 13 sanctions charges stem from the company's dealings with Iran. Huawei CFO Meng Wanzhou is accused of committing fraud to bypass Iran sanctions and bring US-made technology into the country. She was arrested in Canada last month at the request of US authorities. Though she's currently out on bail, she faces extradition to the US.

    Regarding the T-Mobile situation, Huawei says the case has already been settled. And it has been, in civil court -- after hearing the story in 2017, a Seattle jury forced Huawei to pay T-Mobile $4.8 million in damages. However, that was all over breach of contract, not trade-secret violations. The jury said Huawei hadn't maliciously or willfully misappropriated the data it stole from T-Mobile, and no money was awarded for the trade-secret claim.

    A Huawei representative sent the following statement to Engadget this week:

    The allegations in the Western District of Washington trade secret indictment were already the subject of a civil suit that was settled by the parties after a Seattle jury found neither damages nor willful and malicious conduct on the trade secret claim.

    The Company denies that it or its subsidiary or affiliate have committed any of the asserted violations of U.S. law set forth in each of the indictments, is not aware of any wrongdoing by Ms. Meng, and believes the U.S. courts will ultimately reach the same conclusion.

    All products recommended by Engadget are selected by our editorial team, independent of our parent company. Some of our stories include affiliate links. If you buy something through one of these links, we may earn an affiliate commission.
    Comment
    Comments
    Share
    3533 Shares
    Share
    Tweet
    Share

    Popular on Engadget

    16-bit 'Aladdin' and 'Lion King' cartridges are returning in 2020

    16-bit 'Aladdin' and 'Lion King' cartridges are returning in 2020

    View
    Samsung's fix for Galaxy S10 fingerprint scanning will roll out soon

    Samsung's fix for Galaxy S10 fingerprint scanning will roll out soon

    View
    Apple Pay is more popular than Starbucks for US mobile payments

    Apple Pay is more popular than Starbucks for US mobile payments

    View
    Tesla turns a profit as it spins up trial production in Shanghai

    Tesla turns a profit as it spins up trial production in Shanghai

    View
    Four new 'Adventure Time' specials are heading to HBO Max

    Four new 'Adventure Time' specials are heading to HBO Max

    View

    From around the web

    Page 1Page 1ear iconeye iconFill 23text filevr