Despite the US adding Hangzhou-based encryption chip maker Hualan to its Entity List in 2021, NASA, NATO, the DEA, and more still use chips from its subsidiary
The US government warns encryption chipmaker Hualan has suspicious ties to China's military. Yet US agencies still use … Mastodon: @agreenberg@infosec.exchange . Tweets: @wired Mastodon: Andy Greenberg / @agreenberg@infosec.exchange : Chinese firm Hualan is on a US government trade restriction list for its ties to China's military. But its subsidiary Initio's encryption chips are in products still widely used by Western government and military customers, raising fears of a backdoor. — https://www.wired.com/... Tweets: @wired : Thanks to the complexity of the hardware supply chain, Chinese-owned encryption chips have found their way into the storage hardware of military and intelligence networks across the West—and are raising security concerns. https://www.wired.com/... 📷: Bet_Noire/Getty Images [image]
Context & Ripple Effects
When the US placed Hangzhou-based Hualan on its Entity List in 2021 over suspected ties to China's military, it joined a blacklist campaign that has since widened to newer Chinese chipmakers like PXW — see the entity list's expansion to newer Chinese chip firms. Wired's reporting shows how porous that wall is at the component level: Hualan's subsidiary Initio still sells encryption chips that end up inside products bought by NASA, NATO, and the DEA.
The story lands amid a broader run of enforcement-and-infiltration coverage: Beijing-backed Huawei has rebuilt its own supply chain with state support (Huawei's state-funded supply-chain buildout), while the China-linked Salt Typhoon campaign showed what happens when hostile hardware-adjacent access reaches Western networks (the Salt Typhoon ISP breaches). A sanctioned firm's silicon sitting inside Western security equipment is the same problem one layer deeper.
First-order effects
- NASA, NATO, and the DEA are running encryption hardware from a company the US government itself flagged as a national-security risk, forcing their procurement offices and product vendors to audit whether Initio parts can be traced and replaced.
- Hualan gains continued revenue and design win persistence through a subsidiary structure the Entity List designation does not cover, undercutting the sanctions' intended chokehold.
Second-order effects
- Vendors whose products embed Initio chips face contract and clearance risk selling to Western government customers once agencies demand provenance disclosure, pushing them toward re-sourcing or dual-sourcing encryption components.
- Rival chip suppliers without China exposure gain a compliance argument in government bids, turning supply-chain provenance from paperwork into a competitive differentiator.
Third-order effects
- If subsidiaries can launder Entity List status through corporate structure, US export controls will have to shift from naming companies to mapping ownership and bill-of-materials lineage — an enforcement burden regulators like those behind the DOJ's chip-smuggling prosecutions (DOJ detention of Nvidia chip smugglers) are already straining under.
- Persistent backdoor fears in Western security hardware point toward mandatory component-level provenance standards for defense and government IT, formalizing the audit work this episode forces ad hoc.
The trend: US export controls are colliding with hardware supply chains too fragmented for blacklists to trace, as sanctioned Chinese firms reach Western government buyers through subsidiaries and component-level opacity.