China’s ZPMC insists its US cranes present ‘no cyber security risk’

Stay informed with free updates

Simply sign up to the US-China relations myFT Digest — delivered directly to your inbox.

The world’s biggest maker of container port cranes, Chinese company ZPMC, has insisted it presents “no cyber security risk” after Republican members of the US Congress accused it of having installed suspicious equipment on cranes bound for US ports.

In a letter made public last week, 10 Republican members of Congress wrote that components including “cellular modems” had been installed on ZPMC cranes made in China before they were shipped to the US for installation.

Members of the congressional homeland security committee and the select committee on China wrote to ZPMC days after the White House announced plans to boost domestic US manufacturing of “ship-to-shore” (STS) cranes to improve security at ports.

ZPMC, based in Shanghai, is the world’s biggest manufacturer of ship-to-shore cranes, which are used to move containers on and off ships. According to the congressional letter, the company accounts for 80 per cent of cranes at US container terminals.

The company has become the dominant provider in recent years by supplying ports worldwide with the huge cranes needed for the latest generation of very large container ships. ZPMC is part of the state-controlled China Communications Construction Company.

The Congress members include the chairs of two subcommittees of the House of Representatives’ homeland security committee — Carlos Gimenez, chair of the transportation and maritime security subcommittee, and August Pfluger, chair of the counterterrorism, law enforcement and intelligence subcommittee.

No Democratic members of the committees signed the letter.

In a statement posted on its website over the weekend, the company said: “ZPMC takes these allegations seriously and considers that such reports, without a sufficient review of the facts, can easily mislead the public. The cranes provided by ZPMC pose no cyber security risk to any port.”

According to the congressional letter, an eight-month investigation had led the signatories to conclude the company had installed “certain components” on US-bound cranes that were “outside of any existing contract between ZPMC and US maritime ports”. The letter suggested the equipment would allow ZPMC or other Chinese entities to gather information about or control operations at US ports.

“These components do not appear in any way to contribute to the operation of the STS cranes or onshore infrastructure, raising significant questions as to their intended applications,” the letter said.

A White House announcement, on February 21, ordered the US coastguard to oblige ports to make additional checks on cranes that had been made in China. As part of the same programme, Paceco, a subsidiary of Japan’s Mitsui, will move production of STS cranes back to the US.

ZPMC’s statement did not directly address the claims about the installation of modems. The congressional letter gave the company until March 14 to provide a formal response.

But the company’s statement insisted its cranes were “designed, manufactured, transported, assembled, commissioned and delivered” strictly in accordance with international standards.

In January, Republican members of the same congressional committees wrote to Swiss industrial group ABB, saying it had failed to answer questions about the “alarming security vulnerability” of software it had supplied to ZPMC for use on cranes.

The congressional letter to ZPMC is part of a drive by some US legislators to highlight the risks of US links to China.

“The United States is alarmed by mounting evidence that [China] is solidifying its presence and exerting influence over an industry critically important to the US economy,” the letter said.