Exploring the Dangers of Huawei’s Control of Communications and Data in Spain

August 26, 2025

By: Saul Montes-Bradley, Senior Fellow

Executive Summary

Through the efforts of high ranking Spanish politicians of both major parties, Huawei Technologies, a Chinese telecommunications giant, has been contracted by the Spanish government to manage critical systems, including judicially authorized wiretaps and the Sistema Integrado de Interceptación Legal de las Telecomunicaciones (SITEL), despite Spain’s alignment with European Union (EU) and NATO policies restricting Huawei’s role in 5G infrastructure although, ironically, the government of Pedro Sánchez has included Huawei in the Security Operations Center (SOC) 5G, a public entity in charge of the supervision and certification of security in 5G networks and services, joining representatives of NOKIA and Ericsson.

China’s involvement in sensitive communications and data systems raises significant concerns about US national security, cybersecurity, and geopolitical risks posed by Huawei’s role in Spain, with a particular focus on the potential threats to US personnel stationed at military bases and stations in Rota, Algeciras, Morón, Torrejón and elsewhere.

These bases are critical to US and NATO operations in Europe, the North Atlantic and North Africa, and Huawei’s access to sensitive data could compromise operational security, intelligence-sharing, and the safety of US forces.

Focusing specifically on the security implications for US military bases in Spain—Naval Station Rota, Morón Air Base, Torrejón Air Base, Algeciras (and other strategic ports),—given Huawei Technologies’ role in managing Spain’s sensitive communications, data systems, including judicial wiretaps, SITEL, and the proliferation of Chinese made EVs known to collect an abundance of data.

The presence of US personnel at these bases, which are critical to US and NATO operations, amplifies concerns about Huawei’s potential to compromise operational security, intelligence-sharing, and personnel safety.

This Report explores the specific vulnerabilities, risks to US base security, and mitigation strategies to safeguard US forces in Spain, and provides recommendations to mitigate these risks and strengthen Spain’s alignment with Western security frameworks.

Introduction

Huawei’s growing presence in Spain’s telecommunications and data infrastructure, particularly through contracts to manage judicial wiretaps and support SITEL, has sparked alarm among Spanish law enforcement, EU partners, and US officials.

While Spain has restricted Huawei’s role in 5G network cores, its continued reliance on the Chinese company for sensitive systems creates a paradox that undermines national and allied security. This is especially concerning given the presence of US military personnel at key bases in Spain, including Naval Station Rota, Algeciras (a frequent port for US naval operations), Morón Air Base, and Torrejón Air Base.

These bases support critical US and NATO missions, including missile defense, air mobility, and intelligence operations. This white paper analyzes the dangers of Huawei’s control over Spain’s communications and data systems, with a focus on:

1. National Security Risks:

The potential for Chinese government access to sensitive data under China’s 2017 National Intelligence Law.

2. Cybersecurity Vulnerabilities:

Technical risks in Huawei’s systems that could be exploited to compromise data.

3. Risks to US Personnel:

The specific threats to US military operations and personnel at Rota, Algeciras, Morón, and Torrejón.

4. Geopolitical Implications:

The impact on Spain’s relationships with the US, EU, and NATO

5. Case Studies and Precedents

Data breach cases in the UK, US, Africa and the Snowden case.

6. Chinese EVs:

The risk posed by Chinese electric vehicles’ increased use in Spain

7. Recommendations:

Policy measures to protect US personnel and align Spain with allied security standards.

Background

Huawei’s Role in Spain

In the context of the Socialist government’s increasing isolation in the world stage and an almost irrational and anachronic animosity towards the West, Spain has moved closer to Iran, Russia, China and terrorist organizations like Hamas. This is not dictated by any kind of affinity on the part of the Spanish people, but by the stubborn refusal of an unpopular government to move aside and, to the degree it is capable, create conditions to finance its permanence in power.

Thus, Huawei has been awarded contracts worth €12.3 million to provide storage systems (OceanStor 6800 V5) for judicial wiretaps and technical support for SITEL, a system used by Spanish law enforcement and intelligence agencies to intercept communications related to terrorism, organized crime, and espionage. Despite Spain’s exclusion of Huawei from 5G network cores—following EU and NATO recommendations, although the government included the company as an advisor in SOC-5G, —these contracts, awarded between 2021 and 2025, highlight a contradictory approach to cybersecurity. The Spanish government claims compliance with the National Cryptologic Center’s guidelines, but concerns persist about Huawei’s access to sensitive data, and the Spanish government continues to grant them almost unfettered access.

US Military Presence in Spain

Spain hosts several critical US military installations:

Naval Station Rota, is a joint US-Spanish naval base hosting US Navy destroyers equipped with Aegis missile defense systems, critical for NATO’s ballistic missile defense. NAVSTA Rota supports Naval Forces Europe Africa Central (EURAFCENT), 6th Fleet and Combatant Commander strategic priorities by providing airfield and port facilities, security, force protection, logistical support, administrative support and emergency services to all U.S. and NATO forces. Situated on a 6,100-acre Spanish Navy base, NAVSTA Rota provides cargo, fuel and logistics support to units transiting the region, supporting U.S. and NATO ships with three active piers; U.S. Navy and U.S. Air Force aircraft with a 670-acre airfield; and the largest weapons and fuels facilities in Europe, all located within a single, secure fence-line.

Algeciras, is a strategic port used by US naval vessels for resupply and operations in the Mediterranean. Alas, last year Spanish authorities refused entry to American flagged ships bound for Israel, and recently the Federal Maritime Commission excluded Algeciras from a key route, in favor of Tanger Med in Morocco.

Zaragoza Air Base,once an American base, was transferred to Spain in 1992, but remains a key hub for US Air Force mobility and logistics operations in Europe, same as Torrejón Air Base, once home to the US Air Force’s 16th Air Expeditionary Wing, and NATO’s Combined Air Operations Centre, now relegated to mostly for official visits. Zaragoza was used during the Gulf War, Operation Kosovo and the war in Afghanistan.

Morón Air Base, since 2015, has been home to up to 3,000 US military and civilian personnel and 40 aircraft of the Special Purpose Marine Air-Ground Task Force - Crisis Response – Africa.

These bases rely on secure communications, intelligence-sharing, and coordination with Spanish authorities and NATO to execute missions effectively. Huawei’s involvement in Spain’s communications infrastructure introduces potential vulnerabilities that could directly impact base security.

Global Concerns About Huawei

Huawei’s ties to the Chinese Communist Party (CCP) and its obligations under China’s 2017 National Intelligence Law have led to bans in the US, UK, Australia, and several EU countries.

This National Intelligence Law mandates Chinese companies to assist state intelligence efforts, raising well-founded fears that Huawei’s systems could be used for espionage or sabotage. Reports of vulnerabilities in Huawei’s equipment, including unpatched interfaces and potential backdoors, further heighten these concerns.

It is, therefore, naïve and irresponsible to consider Huawei as anything other than an instrumentality of the Chinese government and the Communist Party of China at the service of its intelligence services and military operations.

1. National Security Risks

Chinese Government Access to Sensitive Data

China’s National Intelligence Law compels Huawei to cooperate with state intelligence agencies, creating a pathway for the CCP to access data stored on Huawei’s OceanStor systems.

In Spain, these systems handle judicial wiretaps, which include communications related to national security threats. Unauthorized access by Beijing could expose sensitive intelligence, including data relevant to US military operations, movements of US military and civilians at US military posts not only in US bases but at all military installations, given Spain’s role as a NATO ally.

Compromised Intelligence-Sharing

The US has expressed concerns about Spain’s Huawei contracts, with lawmakers like Senate Intelligence Committee Chairman Tom Cotton warning that intelligence-sharing could be curtailed if vulnerabilities persist. In a letter to DNI Tulsi Gabbard on 17 July, 2025, Senator Cotton and Congressman Crawford wrote: “Since the first Trump administration, the United States has waged a whole of government effort to remove the threat Huawei equipment poses to American networks, infrastructure, and privacy. Until Spain follows suit, the U.S. Government should ensure that any information shared with the Spanish government is redacted of details that should not be shared with the CCP.”

The Five Eyes alliance (US, UK, Canada, Australia, New Zealand) and NATO rely on secure data exchange, and any breach in Spain’s systems could expose US and allied intelligence, compromising missions supported by Rota, Morón, and Torrejón.

For example, at Rota, where 4,000 US personnel and families reside, compromised data could facilitate foreign intelligence operations, including surveillance or recruitment attempts.

Technical Vulnerabilities in Huawei Systems

Reports, such as the 2019 UK National Cyber Security Centre Assessment, have identified flaws in Huawei’s software, including unpatched vulnerabilities and poor engineering practices. These weaknesses in the OceanStor systems or SITEL infrastructure could be exploited to:

· Install backdoors for real-time data access.

· Deploy malware to disrupt base communications or logistics.

· Manipulate data to mislead US or Spanish intelligence efforts.

Such vulnerabilities could directly affect the operational readiness of bases like Morón, where secure logistics are critical, or Torrejón, where NATO’s air operations depend on reliable command systems.

US shares sensitive intelligence with Spain through NATO and bilateral agreements, particularly for counterterrorism and missile defense operations at Rota and Morón. Huawei’s access to Spanish systems could lead to leaks, prompting the US to restrict intelligence-sharing. This would:

· Limit situational awareness for US personnel, increasing operational risks.

· Weaken joint US-Spain missions, such as those supported by Morón’s air mobility hub.

· Undermine NATO’s collective defense, particularly at Torrejón’s CAOC, whose primary mission is to “plan, direct, coordinate, monitor, analyse and report on the operations of Air Policing means assigned to it in peace time. The unit's area of responsibility comprises European NATO airspace south of the Alps. Hence Combined Air Operations Centre Torrejón is responsible for some of NATO's special Air Policing arrangements, such as Air Policing over Albania, Montenegro, North Macedonia and Slovenia.”

2. Cybersecurity Vulnerabilities

Technical Weaknesses in Huawei’s Systems

A 2019 UK National Cyber Security Centre report identified “significant” flaws in Huawei’s software, including poor engineering practices and vulnerabilities that could be exploited by state or non-state actors. The OceanStor 6800 V5 systems used for wiretap storage may contain similar weaknesses, such as unpatched telnet interfaces or embedded malware, as reported in other Huawei devices. A breach of these systems could allow adversaries to access or manipulate data critical to law enforcement and intelligence operations.

Insider Threats and Lack of Transparency

Huawei’s opaque governance, with reported ties to the CCP through its trade union committee and leadership (e.g., former chairwoman Sun Yafang’s Ministry of State Security background), raises concerns about insider threats. Employees or subcontractors could be pressured to install backdoors or leak data, compromising Spain’s surveillance systems and, by extension, US military communications.

3. Risks to US Personnel

Operational Security at US Bases

US personnel at Rota, Algeciras, Morón, and Torrejón rely on secure communications for mission planning, logistics, and intelligence coordination. Huawei’s access to SITEL and wiretap data could allow adversaries to intercept communications related to US operations, such as ship movements at Rota or air missions from Morón. This could enable adversaries to track US forces, predict operational patterns, or disrupt missions.

Espionage and Targeting of Personnel

Sensitive data stored on Huawei systems could include communications involving US personnel, such as intercepted calls or metadata related to military activities. If accessed by the CCP, this data could be used to target US service members for espionage, blackmail, or cyberattacks. For example, compromised communications could reveal personal details about personnel at Torrejón, increasing their vulnerability to foreign intelligence operations.

Impact on NATO Missions

Rota and Torrejón are integral to NATO’s missile defense and air operations. A breach of Spanish communications systems could undermine NATO’s ability to respond to threats, such as Russian aggression in Eastern Europe or missile launches from rogue states. This would directly affect US personnel tasked with executing these missions.

4. Geopolitical Implications

Strained US-Spain Relations

The US has urged Spain to reconsider Huawei’s role, with warnings from officials like Assistant Secretary of Defense Celeste Wallander about the risks to bilateral defense cooperation. Continued reliance on Huawei could lead to reduced US investment in Spanish bases or restrictions on joint operations, weakening the US-Spain defense partnership. In a hearing on US Military Posture and National Security Challenges in Europe, Dr. Wallader stated: “I think the areas of our greatest concern are when China is, largely through technology companies--Huawei is the kind of poster child for that--and so we work closely in sharing intelligence and our information about the risks that that creates for countries in Europe and, more broadly, globally, for them to be able to control their infrastructure, to control their communications. So that is one major line of

effort.

But the other major concern is when we see China seeking majority control of ports, and while there were some instances in Europe some time ago where countries did not take that seriously, they are now very much attuned to that and have taken steps to make sure that even if there is investment it does not allow...”

EU and NATO Misalignment

Spain’s permissive stance on Huawei diverges from the policies of 11 EU countries, including Germany and Sweden, which have restricted or banned Huawei (and ZTE) from critical infrastructure. Besides these eleven countries, 21 have implemented rules allowing their national authorities “to restrict or prevent suppliers considered as high-risk for 5G networks, when deemed necessary.”

Alas, a back door opened wide in Spain creates a potential “weak link” in the EU’s digital security framework, undermining collective defense efforts and exposing NATO operations to risk.

Continued use of Huawei could also embolden other NATO countries to relax restrictions on high-risk vendors, creating broader vulnerabilities for US forces in Europe.

4.3 Human Rights Concerns

Huawei’s technologies have been linked to the CCP’s surveillance of Uyghurs in Xinjiang, raising ethical concerns about their use in democratic countries. Spain’s reliance on Huawei for surveillance systems risks normalizing technologies associated with human rights abuses, potentially eroding public trust in government institutions and complicating US-Spain cooperation on democratic values.

Case Studies and Precedents

United States

The US banned Huawei from its networks in 2012 and added it to the Entity List in 2019, citing espionage risks. In 2022, the Biden administration prohibited Huawei equipment in telecommunications, labeling it an “unacceptable risk.” These measures reflect concerns about Huawei’s potential to compromise military and intelligence operations.

United Kingdom

The UK’s 2020 decision to remove Huawei from 5G networks by 2027 followed a National Cyber Security Centre report highlighting software vulnerabilities. The UK’s experience underscores the risks of relying on Huawei for critical systems, particularly in a NATO context.

African Union Data Breach In 2018

Le Monde reported that Huawei equipment at the African Union headquarters was linked to data breaches allegedly orchestrated by the Chinese government. This incident illustrates the risks of Huawei’s involvement in sensitive systems, with direct relevance to Spain’s wiretap storage.

Snowden

In 2013, Edward Snowden’s leaks exposed US intelligence-sharing vulnerabilities, impacting operations at bases like Rota. A Huawei breach could have similar consequences, exposing NATO and US plans.

4. Chinese EVs in Spain

The impact of Chinese electric vehicles (EVs) in Spain, particularly near US military bases, raises their own significant concerns about national security, data privacy, and geopolitical implications, especially in light of the Israeli investigation into potential spying and data collection by Chinese EVs.

Chinese EV brands like BYD, MG Motor, and Chery have gained traction in Spain due to their competitive pricing, and the Spanish governments commitment to expand its relations with China. The global electric car market is projected to reach 22 million sales by 2025, with China leading in adoption and manufacturing. In Spain, Chinese brands dominate the affordable EV segment, with models like the BYD Atto 3 being particularly popular.

If the use of these EVs near military bases were not a matter of serious concern, their adoption by the Spanish armed forces brings a new level of risk to the fore. The Spanish Army has acquired 170 Chinese-made electric vans for military use, at a cost of €2.5 million (U$S 2.9 million). These vehicles are used in sensitive areas, including near US military bases, such as those in Rota and Morón.

In August 2025, the Israeli Defense Forces (IDF) implemented a comprehensive ban on Chinese-made vehicles entering military bases, citing fears of data leaks from onboard cameras, sensors, and connected systems. This followed an initial restriction in July 2025 at the Gideonim Communications Corps base and was expanded due to concerns that Chinese EVs could record audio, video, and geolocation data, posing a threat to military operations. The IDF also suspended a tender for BYD Atto 3 vehicles after cybersecurity warnings.

But Israel is not alone in its concerns. The UK banned Chinese EVs from military sites in April 2025, citing espionage risks, and instructed personnel to park these vehicles at least two miles from sensitive sites like RAF Wyton. The US has also proposed regulations to prohibit Chinese tech in connected vehicles due to concerns about data collection and potential remote manipulation.

Indeed, Chinese EVs are equipped with advanced sensors, cameras, and connectivity features that collect vast amounts of data (e.g., up to 1400 GB per hour, though only a fraction is transmitted). Under China’s National Intelligence Law, Chinese companies may be compelled to share data with the government, that is with the Chinese Communist Party, raising fears of espionage, especially near sensitive military installations.

As a former MI6 boss (Ian Williams) so poignantly put it: “EVs are also the perfect tools for sabotage, surveillance and espionage – as well as targeted assassinations.”

5. Implications for US Personnel in Spain

Compromised Operational Security

A breach of Huawei-managed systems could expose communications related to US naval operations at Rota or air missions at Morón and Torrejón, enabling adversaries to disrupt logistics, missile defense, or intelligence operations.

Reduced Intelligence-Sharing

US concerns about Huawei could lead to restrictions on intelligence-sharing with Spain, limiting the information available to US personnel at Spanish bases. This could hinder mission planning and situational awareness, increasing risks to personnel.

Economic and Strategic Dependencies

Spain’s increasing reliance on Huawei risks creating long-term dependencies on Chinese technology, potentially limiting US access to alternative, secure systems for joint operations. This could complicate US efforts to maintain secure communications at its, and NATO’s bases.

6. Recommendations

To mitigate the risks posed by Huawei’s role in Spain’s communications systems and protect US personnel, the following measures are recommended:

· Conduct a Joint US-Spain Security Review

The US and Spain should jointly assess Huawei’s role in SITEL and wiretap storage, focusing on risks to US bases. The review should involve the US Department of Defense and Spain’s National Intelligence Centre (CNI).

· Phase Out Huawei Equipment

Spain should establish a timeline to replace Huawei’s OceanStor systems and SITEL support with equipment from trusted vendors (e.g., Nokia, Ericsson). This aligns with Germany’s 2026 deadline for removing Huawei from 5G networks.

· Strengthen Base Communications Security

The US should deploy independent, encrypted communications systems at Rota, Morón, Zaragoza and Torrejón to reduce reliance on Spanish infrastructure potentially compromised by Huawei, and harden its communications.

· Enhance EU-NATO Coordination

Spain should collaborate with the EU and NATO to develop a unified framework for excluding high-risk vendors from sensitive systems, ensuring alignment with allies and protecting US and NATO personnel.

· Increase Transparency and Oversight

Until Huawei is removed from Spanish communications altogether, Spain should mandate regular audits of Huawei’s systems by the National Cryptologic Center and share results with US and NATO partners to rebuild trust.

· Engage in Bilateral Dialogue

The US and Spain should hold high-level talks to address Huawei concerns, emphasizing the importance of secure communications for joint defense operations and the safety of US personnel.

· Ban Chinese-made electric vehicles

Chinese EVs should not be allowed in an area of at least five miles from any military base, and most certainly should not be permitted to enter any military installation.

· Deploy Independent Systems

It is imperative that, as soon as feasible, Spain move towards replacing Huawei technology with safe and reliable systems readily available in the West. In a rather incomprehensible statement outside of the context of the subservience of Spanish politicians to Chinese ambitions, Esteban González Pons, until recently EU Vice-President, and currently the Vice-Secretary-General of the main opposition party in Spain, declared: “Without Huawei, 5G is not possible.”

It should come as no surprise that there is an investigation in Belgium of over 15 European Parliamentarians, including González Pons, for alleged payments received from Huawei to promote it. Selling influence frequently falls into such absurd affirmations.

Operation “Follow the money” must be supported and corrupt politicians risking the lives of NATO forces must be rooted out of the European Parliament.

· Secure Satellite Communications

Expand use of US-controlled satellite networks for sensitive operations, particularly at Rota for naval coordination and Torrejón and Morón for NATO air operations.

The technology is available, trusted and ready to be deployed.

· Regular Cybersecurity Audits

Conduct frequent audits of base networks to detect and mitigate vulnerabilities, ensuring no integration with Huawei-managed systems.

Conclusion

Huawei’s control of sensitive communications and data systems in Spain, and Chinaa’s corrupt meddling in European affairs poses significant risks to national security, cybersecurity, and the safety of US personnel at Rota, Algeciras, Morón, Torrejón and, indeed, every post in the European and North African theater.

The potential for Chinese government access to judicial wiretaps, coupled with Huawei’s technical vulnerabilities and Spain’s divergence from EU and NATO policies, threatens operational security and intelligence-sharing.

By implementing the recommended measures—phasing out Huawei equipment, strengthening base communications, and enhancing allied coordination—Spain can mitigate these risks, protect US personnel, and reinforce its commitment to Western security frameworks.

Alas, phasing out Huawei equipment is no longer sufficient, without an effective control of an increasing number of Chinese EVs in circulation, even in use by the Spanish military forces.

It is imperative that the US move now to mitigate these risks and ensure the safety of our installations and security of our military personnel.

References

Huawei's paradox in Spain: No to 5G, but yes to wiretap storage

Spain under fire for contracting Huawei to store judicial wiretaps – POLITICO Fears over Huawei's use in Spain's intelligence and police systems

Spain’s Huawei Deal Is a Wake-Up Call for U.S. Federal Procurement Reform – War on the Rocks

Spain chooses Huawei for intelligence wiretaps despite risks –

Spain awards Huawei contracts to manage intelligence agency wiretaps | The Record from Recorded Future News

Spain denies security risk claims against Huawei following US criticism - Huawei Central

Spain’s Sánchez dodges backlash over Huawei deal amid EU and US concerns - Euractiv

Spain confirms using Huawei to store judicial wiretaps, denies security risk | The Straits Times

Spain awarded €12.3 million in contracts to Huawei

Spain: Huawei must not be allowed access to wiretap data in the EU - ARTICLE 19