Senate Estimates: Australian Signals Directorate debunks Bloomberg report on China spies

A Bloomberg news report that claimed Chinese spies used microchips to infiltrate several major US tech companies has been debunked.

Australian Signals Directorate, Mike Burgess, Picture: Kym Smith

The heads of the Australian Signals Directorate and Australian Cybersecurity Centre have debunked a Bloomberg investigative news report that claimed Chinese spies used microchips to infiltrate several major US tech companies, saying UK, US and Australian intelligence agencies have found “no evidence” to back up the story.

A Bloomberg BusinessWeek report on October 4 cited 17 unidentified sources from intelligence agencies and business claiming that Chinese spies had place computer chips inside equipment used by about 30 companies, including Apple and Amazon, as well as multiple government agencies.

ASD director-general Mike Burgess told a Senate committee on Wednesday night there was “no substance” to the article.

“Both the United States and the United Kingdom governments have said that’s the case, and the companies involved, Apple and others, have also said that there is no evidence of this, and so far we have not seen any evidence,” Mr Burgess said.

Head of the Australian Cybersecurity Centre Alastair MacGibbon said there was no evidence from any of Australia’s allies that the assertions in the Bloomberg article were correct.

“Our counterparts in the UK, the National Cybersecurity Centre, and our counterparts in the US, the Department of Homeland Security came out very quickly to say that they don’t believe the article was correct,” Mr MacGibbon told the committee.

However, Mr MacGibbon said the report did raise a broader question about the security of Australia’s tech supply chain.

“That is indeed a significant problem that has been increasingly identified over the last several years, and that relates to the security of our hardware supply chain, software supply chain, and the services we use, professional services that often deal with multiple touch points, organisations, departments, companies,” he said.

“So while we don’t believe the article to be correct, the notion in the article is indeed a true threat to cybersecurity generally.”