Could a Chinese-made Metro car spy on us? Many experts say yes.

WASHINGTON — The warnings sounds like the plot of a Hollywood spy thriller: The Chinese hide malware in a subway rail car's security camera system that allows surveillance of Pentagon or White House officials as they ride — sending images back to Beijing.

Or sensors on the train secretly record the officials' conversations. Or a flaw in the software that controls the train — inserted during the manufacturing process — allows it to be hacked by foreign agents or terrorists to cause a crash.

Congress, the Pentagon and industry experts have taken the warnings seriously, and now the Washington, D.C.-area subway system, known as Metro, will do the same. The transit agency recently decided to add cybersecurity safeguards to specifications for a contract it will award later this year for its next-generation rail cars following warnings that China's state-owned rail car manufacturer could win the deal by undercutting other bidders.

Metro's move to modify its bid specifications after they had been issued comes amid China's push to dominate the multibillion-dollar U.S. transit rail car market. The state-owned China Railway Rolling Stock Corp., or CRRC, has used bargain prices to win four of five large U.S. transit rail car contracts awarded since 2014. The company is expected to be a strong contender for a Metro contract likely to exceed $1 billion for between 256 and 800 of the agency's newest series of rail cars.

ADVERTISING

CRRC's success has raised concerns about national security and China's growing footprint in the U.S. industrial supply chain and infrastructure.

"This is part of a larger conversation about this country and China, and domination of industries," said Robert Puentes, president of the Eno Center for Transportation. "We don't want to get trapped into a xenophobic conversation . . . but we also don't want to be naive."

No U.S. company makes subway cars, so China competes in that market against companies from Asia, Europe and Canada. But U.S. companies build freight rail cars, such as boxcars and tank cars, and they fear China will target them next.

That could cost U.S. manufacturing jobs. It also could increase the risk of a cyberattack that cripples domestic rail transportation in a military confrontation or other national emergency.

"China's attack on our rail system is insidious and ingenious," retired Army Brig. Gen. John Adams wrote in an October report distributed by the Rail Security Alliance, a U.S. industry group. "We must retain the know-how and technology to . . . safeguard against disruption of this strategically vital sector of our economy."

https://www.stripes.com/news/could-a-chinese-made-metro-car-spy-on-us-many-experts-say-yes-1.563551