Chinese firm at center of cyber fears

This past week, those lawmakers thought the Pentagon finally heeded their warnings. An email circulated within the Air Force appeared to indicate that Lenovo was being kicked out.

"For immediate implementation: Per AF Cyber Command direction, Lenovo products are being removed from the Approved Products List and should not be purchased for DoD use. Lenovo products currently in use will be removed from the network," stated the message. The apparent directive was generally welcomed as it circulated around Capitol Hill.

Then the Pentagon's press office weighed in. Not so fast, it said.

Ann Stefanek, an Air Force spokeswoman, said the message was mistaken, "not properly coordinated" and should not have been sent. Neither the Air Force nor the rest of the Defense Department has banned Lenovo products, she added.

In fact, the "Approved Products List" referenced in the Air Force message focused on communications equipment such as routers, rather than personal computers, for which Lenovo is known. Army Lt. Col. Valerie Henderson, a Pentagon spokeswoman, said Lenovo has never been on that list.

Those statements to The Washington Post did not go over well with lawmakers such as Rep. Robert Pittenger, R-North Carolina, who is working on two proposals that would severely limit the use of products from any Chinese company on U.S. government computer systems.

"My office received verifiable evidence that the Air Force intended on removing Lenovo as a supplier," Pittenger said. "However, the Defense Department is now claiming this Air Force directive was unapproved and inaccurate."

"Should the Air Force have legitimate concerns with Lenovo, I am troubled that the Defense Department would not take swift action in support of that evidence," he added.

The squabble comes amid heightened tension between the United States and China over cybersecurity. The Obama administration accused the Chinese of a massive hack in 2014 of the Office of Personnel Management, which exposed the personal data of 22.1 million federal workers, including some Defense Department personnel who had gone through background checks.

Meanwhile this week in China, Apple confirmed that its iBooks Store and iTunes Movies services were disrupted, just two months after they were launched there. The move, some analysts said, was part of a broader tightening of the country's control of the Internet.

"China's cyberespionage continues to grow and puts America's economic and national security in jeopardy," said Mike Wessel, a member of the U.S.-China Economic Security Review Commission who also saw the Air Force Cyber Command message. "Putting Chinese-produced and controlled equipment on some of our most sensitive networks is a recipe for disaster."

Worries over companies' ties to foreign governments have been aired before - other Chinese firms, including telecom equipment makers ZTE and Huawei, have been the subject of probes by the Treasury Department and Congress.

Lenovo has repeatedly denied any link to state-sponsored cyberespionage. In a statement, the company said: "Lenovo has been a trusted supplier of information technology in the US since 2005 when it bought the IBM ThinkPad PC business. Every single company selling technology to the US government - including HP, Dell, Cisco, Apple and Lenovo - use foreign components in their products. So it's critical that the US continue to follow a standards-based process that allows for procurement of technology that is both cutting edge and totally secure."

In 2004, when Lenovo bought IBM's PC business, the Committee on Foreign Investment in the United States (CFIUS) - a Treasury Department body that examines transactions and investments that foreign companies make with U.S. firms - launched a probe of Lenovo. Another followed when Lenovo bought IBM's server business in 2014.

One of the main concerns that surfaced in the 2014 review was over the maintenance of Lenovo servers. Lenovo had agreed to contract IBM to service U.S. government servers. Still, some questioned whether Lenovo workers would have to be called in for support either remotely or on-site, should the contract with IBM lapse - a scenario some U.S. officials deemed unacceptable.

The 2014 probe also looked into the state connections of Legend Holdings, which has a controlling share of Lenovo and is in turn partially owned by a Chinese state entity called the Chinese Academy of Sciences.

Both acquisitions were ultimately cleared by the CFIUS.

"U.S. officials have an obligation to defend our nation against all enemies, foreign and domestic. That vigilance should transcend borders, or a standard focused on the ownership shares of a company," said Nancy McLernon, chief executive of the Organization for International Investment. "Regardless of whether the government contracts with Amazon, Lenovo or Microsoft - it has the duty to ensure national security concerns are addressed on their merits, following objective standards and processes."

Still, the CFIUS rulings did not stop agencies from cutting off the company. In 2006, the State Department said it would not use on classified networks 16,000 computers it had bought from Lenovo. The reason was security concerns. There was also an effort in 2011 to remove Lenovo hardware purchased for use at the Tobyhanna Army Depot in Pennsylvania, which was a site for IT repairs.

The U.S. government also told consumers last year to uninstall from Lenovo's laptops preloaded advertising software, called Superfish, that altered which ads users saw. It warned that the software made the devices vulnerable to cyberattacks.

Besides facing turbulence in Washington, Lenovo has had to contend with a downturn in the overall PC market. The firm has pushed hard to make inroads in the U.S. market, tapping celebrities such as Kobe Bryant and Ashton Kutcher as spokesmen to broaden its appeal.