Executive Summary 3

Overview 5

Part I. Parent Direction and Control of the U.S. Subsidiaries 8

A. Corporate Ownership 8

Figure 1: Ownership Diagram 9

B. Corporate Governance and Compliance Blind Spots 10

C. Parent-Directed Network Operations 12

Part II. Retention of Unregulated U.S. Infrastructure & Network Relationships 14

A. The Commercial Pivot to Unregulated Network Services 15

B. The Companies Retain a Physical Presence Inside U.S. Facilities 17

Figure 2: Unregulated Private Leased Circuit Architecture 17

C. Retained Chinese-Manufactured Network Hardware 19

Figure 3: Ruijie Involved Industries Screenshot 20

D. Trusted Network Connections and Routing Identities Tied to the PRC Parents 20

E. Acceptable Use Policy 22

Figure 4: Acceptable Use Policy 23

Part III. Routing Exposure Involving U.S. Traffic 24

Figure 5: A BGP Prefix Hijack 24

A. Large-Scale BGP Hijacking of American Networks 26

Figure 6: BGP Hijack Event Timeline (January 2018 – May 2025) 26

B. Case Studies of State-Sponsored Threats 28

Case Study 1: China Telecom Americas and Qihoo 360 28

Case Study 2: China Mobile and Salt Typhoon 29

Case Study 3: China Mobile USA and CloudRadium 30

Case Study 4: China Unicom and Integrity Technology Group 32

Recommendations 35

Classified Annex 37