Hack of Hezbollah devices exposes dark corners of Asia supply chains

While supply chains and distribution channels for higher-margin and newer products are tightly managed, that is not the case for older electronics from Asia where counterfeiting, surplus inventories and complex contract manufacturing deals can sometimes make it impossible to identify the source of a product, analysts and consultants say.

The response from the companies at the centre of the booby-trapped gadgets that killed 37 people and wounded about 3,000 in Lebanon this week has underlined difficulties in discerning how and when they were weaponised.

Taiwan-based Gold Apollo put the blame on a Europe-based licensee of its pager, sparking investigations in Hungary, Bulgaria, Norway and Romania into the origins of the deadly device.

Japan's Icom 6820.T initially said it could not tell if the walkie-talkies bearing its name were real, in a market awash with fake products. It issued a statement on Friday saying it was highly unlikely that the exploded products were theirs.

Icom cited Lebanese telecoms minister Johnny Corm as saying the devices were not imported through a distributor and that counterfeit products of the same model number were being imported from other countries.

Physical examination of the devices that exploded would be needed to conclude they were not Icom products, but in light of multiple pieces of information that have been revealed, chances are "extremely low" that they were Icom's, the Japanese maker said.

"If the supply chain was compromised to put explosives inside ... it's incredible engineering to do that. But the actual supply chain compromise is not that hard. Probably the easiest part was the supply chain compromise," said David Fincher, a China-based technologist and consultant.

He said counterfeit products are prevalent, especially in big manufacturing centres like China where fake components can be easily produced, adding that it isn't a big leap to go from fake components to supply chain compromise.

"As the technologist I am, I can tell you getting a little explosive in a radio is not that hard."

Hezbollah acquired the devices around five months ago, according to a security source, who added that the armed group thought it was buying the pagers from Gold Apollo.

The hand-held radios, which the source said were purchased around the same time as the pagers, had labels bearing the name of Osaka-based Icom and the phrase "Made in Japan", images of one exploded device showed.

Both companies have ruled out the possibility that any of the deadly components were made in factories in either of their home locations.

Taiwan's Economy Minister Kuo Jyh-huei has also said the components used in the pagers that detonated in Lebanon were not made in Taiwan.

A preliminary investigation by Lebanese authorities into the devices found that the explosives were implanted before they arrived in the country, according to a letter to the U.N. Security Council by Lebanon's mission to the United Nations.

FAKE GOODS

But, for now, that's about all anyone is certain of. It's not clear how or when the pagers and walkie-talkies were weaponised so they could be remotely detonated.

Joe Simone, partner with Chinese intellectual property firm East IP, said part of the problem is that smaller brands tend to invest less in policing counterfeits, due in large part to costs that could impact their profitability.

"Authorities are happy to deal with low-tech counterfeits but the IP owners need to monitor, investigate and file complaints and that doesn't always happen as much as it might for high-tech and bigger technology brands," he said.

For Icom, one problem is that it stopped making the IC-V82 model in question a decade ago, around the time it started introducing holographic stickers as a protection against counterfeit products, the company said.

The company has long warned about imitation products, especially of its older models.

In fact, more than 7% of firms in Japan reported business losses from counterfeit products in 2020, according to the latest available report by the Japan Patent Office, with around a third of cases linked to China.

Icom has urged that customers only use its official distributor network to ensure they are buying genuine products.

But in China, there are dozens of shops selling Icom-branded walkie-talkies on e-commerce platforms such as Alibaba.com, Taobao, JD.com and Pinduoduo, including in some cases the IC-V82 model, according to Reuters checks.

Among three China-based vendors of Icom products on Alibaba.com, none of which were listed as official suppliers on Icom's website, Guangzhou Minxing Communications Equipment Co and Chengdu Bingxin Technology Co Ltd both said they sell authentic products, while Quanzhou Yitian Trading Co acknowledged selling "Chinese made imitations" in addition to original products.

Icom has said it makes all its products in its factories in Japan. It did not immediately reply to a request for comment on Icom-branded products sold in Chinese online sites.

The discontinued IC-V82 model is also sold in Vietnam on e-commerce platform Shopee, a Reuters check showed, indicating wide availability of such products.

For Gold Apollo, which licensed its brand to Budapest-based BAC, the supply chain devolved into a mysterious production trail that authorities in various countries are now trying to piece together.

"The widespread availability of cheap, second-hand manufacturing equipment meant counterfeiters were increasingly able to go beyond single components and even make full-fledged products," said Diganta Das from the University of Maryland's Center for Advanced Lifecycle Engineering, who studies counterfeit electronics.