Why China hawks care so much about cranes

Driving the news: A new congressional investigation found that China-based Shanghai Zhenhua Heavy Industries, or ZPMC, installed cellular modems onto cranes operating at certain U.S. ports — creating a backdoor for easy information collection and nation-state spying.

• The yearslong investigation — conducted by the House Select Committee on the Chinese Communist Party and the House Homeland Security Committee — also showed that ZPMC has "repeatedly requested remote access to its [ship-to-shore] cranes operating at various U.S. ports."
• The committees worked with port administrators, tech vendors, cybersecurity specialists, equipment manufacturers, various U.S. military branches and key federal government agencies on the probe.

The big picture: ZPMC cranes account for nearly 80% of all cargo cranes at American ports, according to Congress.

• ZPMC doesn't face much competition. The U.S. doesn't have a homegrown alternative, and competitors across Europe offer similar cranes for much higher costs.

Threat level: If China does invade Taiwan in the next few years, officials highly anticipate Beijing will do anything it can to impede the U.S.'s ability to ship military equipment to the region.

Zoom in: Lawmakers found that the modems — which connected to Linux computers on port cranes — were not necessary for the cranes' operation and created "an obscure method to collect information and bypass firewalls."

• That level of access could be manipulated to disrupt operations at ports, the congressional report added, and port technicians believed the modems were supposed to be used only for diagnostic purposes.
• The modems were installed even if they weren't part of installation contracts and after administrators declined them at the time of purchase, per the report.
• The report also concluded that ZPMC is a subsidiary of a major Chinese construction company that provides equipment to help militarize the South China Sea.
• ZPMC USA did not respond to a request for comment.

Between the lines: Fears about a Chinese invasion of Taiwan have spurred lawmakers and national security officials to reexamine Beijing's potential influence over U.S. critical infrastructure.

• U.S. officials warned lawmakers in January of an ongoing hacking campaign that shows China's willingness to shut down American infrastructure and incite societal panic — especially if there's an invasion.

• Earlier this year, President Joe Biden signed an executive order that gave the U.S. Coast Guard new powers to toughen cybersecurity at U.S. shipping ports.
• The Federal Communications Commission has banned sales of Huawei and ZTE telecommunications devices in the U.S. due to similar concerns.

What they're saying: "We kind of sold our soul here," Egon Rinderer, chief technology officer at Shift5 and a former cryptologic technician at the U.S. Navy, told Axios.

• "Now, we have a real predicament because our critical infrastructure that allows us to move goods and material is incredibly vulnerable."

Yes, but: Rinderer argued that resolving the ZPMC security threat may not have to be as involved as ripping out every single crane.

• Cargo cranes aren't super technologically sophisticated, and it's possible the U.S. government could develop a patch to block a malicious backdoor.
• "We've done that with DJI drones," he said. "[Cranes], despite their size and cost, are much simpler than a drone even."

What we're watching: Congress urged the Coast Guard to provide guidance for all U.S. ports on how to disconnect any suspicious modems found on ZPMC cargo cranes.

• The report also suggested a Department of Commerce study on how to build and support a U.S. crane manufacturing base and on how to enhance competition among port construction companies.