China’s Digital Advance in Latin America

R. EVAN ELLIS

Source Link

This work examines activities by the People’s Republic of China (PRC) and its companies in digital technologies and associated economic sectors in Latin America, including telecommunications, surveillance, eCommerce, fintech, data centers, and smart cities. It finds that, despite obstacles arising from both resistance in the region and internal PRC politics, Chinese companies have made significant advances in these sectors, creating opportunities for them to leverage these positions to advance in other areas, while also giving them significant opportunities to collect intelligence on both government and commercial targets, putting at risk the ability of its governments to make sovereign decisions about the PRC and its companies, and to protect the intellectual property of the companies operating within its territory.[1]

Key Words: China, Latin America, eCommerce, digital, surveillance, telecommunications, Fintech, data centers

Introduction

As the People’s Republic of China (PRC) has worked to re-orient Latin America and other parts of the world to its economic advantage, the region’s digital economy and associated technologies have emerged as a key focus of its efforts. These areas received significant focus in Made in China 2025[2] and the PRC’s 2015 “Digital Silk Road” initiative.[3] Two of the 8 pillars[4] in China’s “Global Development Initiative”[5] the digital economy, and connectivity,[6] are tied to them. The China-CELAC 2022-2024 plan explicitly prioritizes China’s engagement with the region in a broad range of digital sectors, including “digital infrastructure, telecommunications equipment, 5G, big data, cloud computing, artificial intelligence, Internet of Things, smart cities, Internet+, universal telecommunication services,”[7] and “radio spectrum management.”[8]

Such digital technologies are particularly valuable for China’s advance both as the leading edge of current business innovation, while affording those who dominate them unparalleled leverage over the economic activities they support, and information about government and commercial processes and leaders using or otherwise touched by those networks. PRC dominance of digital technologies in Latin America and elsewhere thus provides the opportunity to know, compromise, and otherwise exploit the sovereign decision processes of those governments and competitors, in advancing Chinese interests.

The Structure of the Chinese Digital Opportunity and Challenge

The strategic opportunity for China arising from its pursuit of digital sectors and technologies in Latin America (as elsewhere) is based on a reinforcing dynamic. Chinese dominance in applied technologies (eg. solutions for companies such as Huawei in 5G) allows them to play a leading role in setting “standards” through international bodies like the International Telecommunications Union (ITU).[9] Setting standards, in turn helps the PRC to lock in competitive advantages in associated sectors and shut out the competition. The PRC recognized the strategic value of standards in its document China Standards 2035.[10]

Chinese dominance of strategic digital sectors, in turn, position them to favor PRC-based companies who are served by such systems. There is an inherent synergy, for example, between the spread of Chinese payment systems, and products and services which can either be bought by them or are designed to exclusively use them. The spread of the Digital RNB in Latin America, as elsewhere, will only expand this challenge.

With respect to intelligence, the opportunities available to the PRC from its growing presence in digital sectors in Latin America, is complemented by its intention, through its own laws and empirical past practice, to exploit it. The 2017 Chinese National Security Law obliges those subject to PRC jurisdiction,[11] to turn over information under their control if relevance to the “national security” of the PRC state, no matter how much Chinese companies might protest otherwise.[12] This creates a lever for the PRC to access the data on companies or individuals that may pass through the architectures of telecommunications companies such as Huawei and ZTE, eCommerce companies such as Alibaba, rideshare companies like DiDi, fintech firms like NuBank, and Chinese companies operating data centers, whose “clouds” may contain a vast quantity of sensitive, exploitable personal data, intellectual property, and/or government information.

While the question of what the PRC would do with the data accessible through digital technologies cannot be addressed with certainty, the PRC has a track record of permitting, or even enabling intellectual property theft in its own country,[13] as well as hacking and other forms of digital espionage abroad. In September 2020, the U.S. Justice Department indicted members of the Chinese group Apt41 for attempting to hack into 100 US companies.[14] In Africa, the Chinese group “Bronze President” used the information system the PRC government had donated to the African Union, to siphon off surveillance data from the organization’s security cameras.[15] With respect to Latin America, in December 2021, Microsoft exposed hacking by the Chinese group Nickel, whose targets included corporations in 16 Latin American countries.[16]

In pursuing the benefits that Chinese digital products appear to offer, it is not clear that local governments in Latin America are able to evaluate the risks of the compromise of their data, or information that can be gained through access to that data. Nor is it clear that civil society in Latin America or elsewhere has the technical knowledge or tools for evaluating the risks and working toward rational public policy positions to control the risks while securing the benefits of Chinese or other digital technologies.

Telecommunications Sector

Huawei has played a role in the Latin American and Caribbean telecommunication sector since 1999.[17] As of 2019, Huawei operated in 20 countries in Latin America,[18] with market shares greater than 20% in four of them. In Brazil, Huawei has 50% of the telecommunications equipment market.[19] Auspiciously, the company’s greatest technical leaps are believed to have come from intellectual property that it stole from the Canadian firm Norte.[20] Much of the current participation of Huawei in Latin American telecommunications architectures is through the incorporation of its telephones, servers, routers and other equipment into the architectures and commercial offerings of retail providers such as Claro, Movistar,[21] Personal,[22] and Tigo,[23] although PRC-based companies also provide components and services directly to state-owned telecommunications entities there such as Antel in Uruguay[24] or Indodel in the Dominican Republic.[25]

Other Chinese companies also provide equipment to Latin America, including Oppo[26] and Xiaomi,[27] which opened its first physical store in Latin America in Buenos Aires in March 2022.[28] Lesser-known Chinese brands are often brought in as “white label” devices and marketed under the name of the company offering them.

Currently, Huawei is a leader in Latin America in providing equipment for 5G networks, often with advantages of cost and the breadth of the offering. Huawei equipment is positioned to be included in significant ways in Chile, Peru and Brazil,[29] which are currently leading the region in the implementation of 5G. Indeed, in Curitiba, Brazil, Huawei is seeking to set up a demonstration 5G “smart city.”[30] Huawei is also well positioned in Argentina[31] and Colombia,[32] among others, have made important progress with enabling steps such as defining and auctioning bandwidth.

Through design and standards in which each part of the Chinese offering works best (or sometimes only) with other Chinese products, PRC-based companies build off each other to dominate interdependent digital domains.[33] The President of Huawei’s cloud services in Latin America, Xiao Fe, emphasizes the competitive position from the power of the “convergence between the cloud, the AI, the 5G network, and the Internet of Things.”[34]

Surveillance Systems

Another digital sector in which PRC-based companies are making significant advances is surveillance systems. Chinese firms such as the camera companies Hikvision and Dahua first entered Latin American markets such as Mexico and Ecuador as early as 2007.[35] As their product offering has evolved, such companies, and integrators like Huawei, have leveraged technologies such as facial recognition and biometrics, in combination with big data, to develop capabilities in the PRC where individual privacy considerations are minimal, then provided those offerings to Latin America, where insecurity, the fight against corruption make Chinese solutions attractive. Indeed, in Mexico in 2022, China’s Hikivision acquired Mexico’s largest security systems company Syscom.[36]

The Chinese surveillance offerings installed to date in Latin America are diverse. They include security camera systems deployed in places like Mexico City, Georgetown Guyana, Jujuy Argentina,[37] and Colon, Panama.[38] They also include a system deployed on Uruguay’s border with Brazil,[39] as well as national-level architectures with broad monitoring, communication and other capabilities, such as the country-wide ECU-911 in Ecuador,[40] and BOL-110 in Bolivia. Even more importantly, beyond such high-profile projects, PRC-based companies such as Hikvision[41] are also making inroads in the corporate and home surveillance market in the region,[42] giving them access to a far broader array of information, depending on who has access to such information.

Health Architectures

With the Covid-19 pandemic, another area being actively exploited by the Chinese is digital health services. In Bolivia, obligatory monitors for alerting people to those with Covid-19 in their proximity was incorporated into the Chinese-built government monitoring architecture BOL-110 during the pandemic.[43] Health-related digital initiatives were also incorporated within PRC Covid-19 diplomacy under the branding “health silk road.”[44] During the pandemic, PRC-based companies such as Hikvision and Dahua[45] donated thermal cameras for identifying potentially “sick” subjects with elevated body temperatures were installed, often through Chinese government donations,[46] in a range of airports and other sensitive public buildings across Latin America.

As in other areas, a significant role for Chinese monitors and other devices in digital health architectures would give the PRC a significant ability to capture sensitive biometric, health and even genetic data on not only private individuals, but on personnel working in companies d governments of interest. The collection of such data could also contribute to the advance of Chinese monitoring technologies and algorithms globally, and even bioengineering for both health and military purposes.

Smart Cities

At the apex of the Chinese offering in Latin America is the concept of “smart cities.” PRC-based companies are behind half of the world’s “smart cities” projects,[47] and the concept has received considerable attention and support by Chinese President Xi.[48] According to US Southern Command,[49] there are currently 10 major “smart cities” initiatives underway in the region.

While the composition of smart cities varies widely, it generally involves the integration of numerous different digital services from surveillance architectures to transportation systems,[50] to smart pay devices, to public utility management, to emergency response and alerts against disasters, providing the operator unprecedented opportunities for gathering movement, financial, and other intelligence on the residents and others operating in the cities.

Ecommerce

In eCommerce, the Chinese company Alibaba plays an important role in the sourcing of Chinese products in Latin America. It is strongest in the region in the business to business (B2B) role that propelled its original expansion, although it has made some progress in the business-to-consumer (B2C) market, particularly in Brazil.[51] The company continues to face challenges in the expansion of its B2C business due to poor infrastructure for delivering to consumers, and strong competition from the more established players Amazon and Mercado Libre.[52]

China’s eCommerce also includes the ride-share company DiDi Chuxing,[53] which expanded its presence in the region significantly through its 2018 acquisition of the Brazilian rideshare company 99.[54] Prior to the Covid-19 pandemic, DiDi had by some estimates half of the rideshare market in Latin America,[55] with a particularly strong presence in Mexico and Brazil, but also operating in Colombia, Chile, and the Dominican Republic. As with other Chinese companies in the digital space, the services provided by DiDi are also integrated into other digital architectures. DiDi lists itself as integrated with some 30 Chinese smart cities projects and proposals worldwide, and is working toward being a service provider in such cities including through self-driving cars.[56]

Such integration will only expand the risk of data collected by Didi on the trips of its users which can provide insights into important meetings between government figures of interest to China, commercial competitors, and personal activities of Didi users that could be used as a basis to blackmail them. Reflecting concerns over DiDi’s data, in 2022, the US Defense Department acknowledged an ongoing investigation into DiDi regarding such data related issues.[57]

PRC-based companies have further begun to build a position in Fintech, although their focus has to date been on digital payment systems such as advances by Alipay in Mexico.[58] Nonetheless, Chinese companies continue to struggle to advance in that space in part due to the weakness of local banking architectures as a vehicle for conducting direct payments, circumventing the networks by the established credit providers such as Mastercard and Visa.

Latin American use of the Digital RNB, which the PRC is currently rolling out,[59] could expand the attractiveness of its Chinese payment systems. Experts consulted for this work note, however, that in the short term, such potential is limited by the linkage of the Digital RNB to the PRC government; Latin Americans prefer the anonymity of non-government digital currencies such as Bitcoin,[60] most famously adopted in 2021 as an official currency by Nayib Bukele’s government in El Salvador.[61]

Beyond payment systems, PRC-based companies have had some success expanding into consumer loan-oriented Fintechs. In 2018, for example, Tencent acquired a $180 million stake in the Brazilian Fintech NuBank.[62] The PRC-based finance company FoSun similarly operates in Brazil,[63] although it has had challenges there. Although offering “banking services to the traditionally unbanked” is a major growth area for Fintechs in general,[64] the importance of local knowledge of the populations being targeted has been an obstacle for the Chinese advance in the sector. Nonetheless, to the extent the PRC advances in loan-based Fintechs, its market penetration potentially gives the PRC insights into the financial status of millions, including lower-level personnel working in companies or areas that may be of interest to the Chinese.

Big Data and Cloud Computing

Data Centers are another domain providing significant opportunities for the Chinese. Huawei, for example, currently operates data centers in multiple Latin American countries,[65] supporting eight “data availability zones” across the region.[66] Its footprint includes cloud storage facilities in Santiago, Chile, Sao Paulo, Brazil, and two facilities in Mexico,[67] with plans for more. Huawei’s data center concept integrates with its cellular and other communications capabilities, and a range of service offerings from supporting corporate communications and processes, to health sector applications.[68] Perhaps more ominously, Huawei offers a program in Latin America for subsidizing start-ups to locate their intellectual property and processes in the Huawei cloud,[69] giving the company access to some of the most leading-edge technology in Latin America.

Chinese data centers in the region are driven in part by the storage needs of Chinese eCommerce platforms such as Alibaba. Alibaba affiliated Tencent, for example, set up a data center for its operations in Brazil.[70] Such data centers highlight the risk that both vendors and purchasers are incentivized or obliged to maintain sensitive data about their products, processes and finances on such sites, where the Chinese owners have access to them. In 2021, the Chinese company Aisino almost won a contract for managing,[71] and thus giving it access to virtually the entire Chilean civil registry.

Companies such as Huawei, however, are taking the services available through data centers far beyond eCommerce, with cloud computing and artificial intelligence operating on “big data” stored there, some captured from the “internet of things” taking to a new level both the attractiveness of such services, and the level of personal, corporate and government data that can be compromised. Recently, Huawei began promoting its data center in Chile as a place where start-up firms could locate their operations and data, subsidized by Huawei thus giving the Chinese access to the potential cutting edge technology and innovations of those firms.[72]

Helping Chinese Authoritarian Friends

The support that the PRC provides to its non-democratic, typically anti-US friends through digital technologies, compliments the help it provides them through purchasing their commodities, providing them loans and investments,[73] and selling them security equipment, to sustain the life of those regimes.[74]

In Venezuela, Chinese electronics company CEIEC helped the de facto Maduro regime spy on de jure President Juan Guaido and his supporters.[75] The “fatherland identity card,” implemented for the Venezuelan regime by China’s ZTE, is a digital mechanism for tracking the population and distributing scarce resources from the state,[76] similar to prototype “social credit systems” in China. The card is obligatory for everything from everything from voting to receiving gasoline at state-subsidized prices and scarce rations (the infamous “CLAP” boxes),[77] to Chinese and Russian Covid-19 vaccines,[78] and also acts as a “digital wallet” for certain types of payment.[79] Likewise, in Cuba, the technology provided by Huawei to help that nation’s communist government implement its cellphone and telecommunications architecture,[80] was used[81] to shut down communications[82] among protesters[83] during the July 2021 nationwide uprising against the Cuban government, similar to the use of such technologies in the PRC.

In Ecuador, the nationwide surveillance system ECU-911, built by PRC-based companies for the populist former regime of Rafael Correa,[84] helps the government to survei,[85] and according to his successor Lenin Moreno, even spy on, the Ecuadoran people.[86] Additionally, in Bolivia, the similar system BOL-110, built by the Chinese for the populist regime of Evo Morales, includes facial recognition and license plate verification.[87] It has also been used to help the regime monitor the Bolivian population. Indeed, it was used in April 2020 to help the government digitally track those suspected of having Covid-19 through obliging them to wear reporting bracelets connected to the system.[88]

Challenges to China’s advance

While PRC-based companies have made impressive advances in digital technologies and sectors in the region, their dominance of those sectors and ability to exploit them is not a fait accompli. Latin American governments are increasingly aware of the threats that their participation in digital architectures poses to their ability to make sovereign decisions. The difficulty of partners such as the United States to share intelligence and other sensitive information with partners with such compromised architectures, and the potential reluctance of Western investors to invest in operations involving sensitive intellectual property arguably increases host government interest in the reliability of their digital architectures, including which companies and technologies participate in them.

At the same time, the advance of Chinese companies in the digital space is in some ways being hampered by the PRC’s own battle for control over those technologies and to ensure that the wealthy company heads associated with them do not become a threat the President Xi’s leadership. The Chinese government’s move to block the $300 billion initial public offering of billionaire Jack Ma’s Ant Group in November 2020,[89] and the July 2021 investigation and move to control the data of rideshare company DiDi Chuxing are two such examples.[90] Indeed, the targeting of Jack Ma’s companies by the PRC government has slowed the advance of the international portion of the company. The PRC attention to DiDi, on the other hand, appears to have hurt its domestic expansion more than its international business.[91]

Recommendations and Conclusions

There are a number of steps that the governments of the region and the U.S. can take to help manage the associated risks:

Latin American governments must increase the sophistication of their threat assessment for the implementation of digital technologies in sensitive areas by companies whose governments, such as the PRC, pose an empirically demonstrated credible threat of not protecting the intellectual property, and privacy of that data. Similarly, the U.S. and like-minded Western partners must respectfully make clear to partners the consequences of allowing untrusted vendors in architectures in such a way that put sensitive government, personal, or corporate information at risk. This may include explaining that the U.S. or other Western partners may not be able to supply intelligence data or other forms of cooperation over such compromised networks. Where the U.S. should also work together with its like-minded democratic partners, to provide reasonable alternatives to those partners.

To better make the case for the justification behind its warnings, the U.S. must better collect and make available examples showing past incidents of Chinese hacking, cyberespionage, or other relevant wrongful activities by the PRC government and its companies. In a similar fashion, the U.S. must better communicate with Latin American publics in an effective way regarding the nature and magnitude of the threat coming from the information the Chinese can capture from those digital architectures.

The U.S. and other Western governments must also do more to work with the private sector to both educate and learn from them regarding the risks to their intellectual property and competitive position arising from the ability of the Chinese to access their data, to more effectively leverage them as partners and advocates in the countries in which they operate and enable them to continue to securely create jobs and opportunity in the countries where they invest. As a compliment, the US must increase coordination with and support for leading private sector firms in digital sectors, should help partner nations evaluate threats and develop effective policies, standards formation processes, and investment screening mechanisms to protect the integrity of domains vulnerable to digital compromise.

Finally, in looking to the future, the U.S. must work with partner governments must work with those private sector companies and other interested parties to advance an alternative vision of digital architectures that are both competitive with the Chinese offering, while yet also assuring the protection of the individual and groups (including corporations) from the intelligence that can be gained by exploiting that data.