50 basedontheirbehavior,that theyhavetheintent.”
It was in this atmosphere that CRRC emerged in late 2018
as a possible bidder on a contract to supply rail cars to the
Washington, D.C., subway system. Security hawks immedi-
ately started floating the prospect of China using secretly
implanted devices to watch and listen to policymakers as they
rode the rails near the Pentagon and Capitol. Congressional
hearings followed. The legislation that fell short last year
started moving again, and the Rail Security Alliance picked
up support from the Alliance for American Manufacturing,
the Railway Supply Institute, and other advocacy groups.
There have been no reports of CRRC trains being used to
snoop. “It’s a conspiracy theory right up there with Bigfoot,”
says Smolensky, the company spokesman in Chicago. “Once
a rail car is delivered to the transit authority, they have full
operational control. The manufacturer does not have access
to the rail car.” Robert Puentes, chief executive officer of the
nonprofit Eno Center for Transportation, says transit author-
ities carry out regular quality inspections and it’s “ludicrous”
to think a manufacturer could sneak surveillance devices into
trains. “If the federal government really wanted to be helpful,”
hesays, “instead of blocking CRRC, they could give people
more money to do better inspections.”
It’s not always that simple. The inspector general of
Washington’s transit authority found that third-party con-
tractors and vendors could unwittingly make the subway
system vulnerable to cyberattacks. In theory, as CRRC helps
to maintain the cars it built, the company could create back-
doors for intrusion via software updates. Those “could be
turned on and off as needed,” Adams says.
CRRC’s adversaries have seized on a federal indictment
charging a Chinese software engineer at an unnamed Chicago
locomotive manufacturer with stealing proprietary informa-
tion and taking it to China. Although CRRC wasn’t implicated,
the alleged theft “makes clear that the U.S. rail market is also
becoming a target” of China, says a recent report by consult-
ing firm Veretus Group.
Freight cars pose a somewhat different vulnerability than
passenger ones because they ferry economically valuable
items such as lumber and oil, and also because they’re cru-
cial to military mobilizations. “Rail networks are particularly
at risk because they are extensive, dispersed, and complex,”
says a recent report by management consulting firm Oliver
Wyman. The industry is rolling out a nationwide web of Wi-Fi,
GPS, and other technologies designed to smooth schedul-
ing and prevent crashes; that, too, could be a target for bad
actors, the report says.
“So much of the conversation about China is what we
think they might be up to but so far have no evidence for,”
says Bruce Dickson, a political science professor at George
Washington University. “You either are suspicious that they PHOTOGRAPHS BY TONY LUONG FOR BLOOMBERG BUSINESSWEEK (4)“If it isn’t CRRC, who’s
it gonna be? There is
no American rail car
manufacturer”CRRC’s Springfield plant, where cars for the orange line of the Boston T are being built