MARK R. WARNER si we URGANAFFARS United States Senate sunger WASHINGTON, DC 20510-4606 INTELUGENCE ULES AND ADMANISTRATION June 7, 2018 Larry Page Chief Executive Officer Alphabet Ine. 1600 Amphitheatre Parkway Mountain View, CA 94043 Dear Mr. Page, Luvrite you in the wake of reports that Facebook entered into data-sharing partnerships with at least 60 device makers, under which enormous volumes of non-public consumer data were made available to third parties, including in cases where Facebook users had restricted access from third party apps and websites. Facebook has now acknowledged that the social media company worked with Huawei, TCL, and other Chinese manufacturers to integrate their services onto these phones. There are indications that this practice of embedding social media sharing functions with Chinese OEMs may have been more widespread, potentially through agreements between Alphabet’s subsidiaries and these Chinese companies. In particular, it has come to my attention that Google pursued various strategic partnerships with Chinese mobile device manufacturers, including Huawei and Xiaomi, as well as with Chinese technology platform Tencent. In January 2018, Huawei built on its existing relationship with Alphabet (via its Android platform), striking a new “strategic partnership.”' Additionally, in September 2017, Xiaomi partnered with Alphabet to release the Mi A1 smartphone that runs on Google’s Android One operating platform.” And earlier this year, Google agreed to a patent licensing deal with Tencent in efforts to expand its products in China, granting both companies access to each other’s patent portfolios.’ Since at least October 2012, when the House Permanent Select Committee on Intelligence released its widely-publicized report, the relationship between the Chinese Communist Party and equipment makers like Huawei and ZTE has been an area of national security concern. Since then, numerous articles in the tech trade press have focused on concems by American and alli joogle and HUAWEI Form Stratezic Partnership on RCS Messaging,” Huawei Press Release (January 18 2018), available al: https//consumer huawei comen(press/news/20 8 zooele-huawei-form-stratewic-parinership- on-res-messagine! 2 Jamie Rosenberg, “Taking the next step with Android One,” Google Blog (September 5, 2017), available at: hips. biog poogleproduetsandroidtaking-nextstep-andsoid-one! * “Google announees patent agreement with Tencent amid China push,” Reufers (January 18, 2018), available a: hups:/www.ceuters.conartcle/us-china-goosle-tencent google-announces-patent-agreement-with-tencent-amide chinaspushsidUSKBNIFAODFintelligence agencies that products from Chinese device makers, such as Lenovo, have security vulnerabilities that could allow Chinese intelligence to access data stored on, or transmitted by, devices.” And the New York Times reported in 2016 that firmware found in low-end smartphone devices, such as those of Huawei and ZTE, continually transmitted local data to Chinese servers, potentially for foreign intelligence purposes.> Like Facebook, Alphabet's subsidiaries, including Google’s products, store the data of millions of American users. In 2016, Google's services served more than a billion users. The possibility of Chinese vendors with documented ties to the Chinese Communist Party having access to Facebook's private API (and potentially Atphabet’s) — particularly as China develops tools 10 hamess individual-level data for surveillance and social control” ~ raises serious national security concerns In light of these revelations, { respectfully request your response to the following questions: ‘+ Can you contirm whether Alphabet's subsidiaries had entered into similar agreements with mobile device companies? If so, please provide a full list of these vendors. © Including Huawei, Xiaomi, and Tencent, were any of the third party partnerships with vendors based in China? Were ZTE, Lenovo, and/or TCL among them? If so, please provide a full list of these vendors. ‘+ The New York Times story indicates that some of Facebook's partners stored user data on their servers, while others only stored that data client-side. If this is also true with Alphabet and its subsidiaries, can Alphabet provide information on which partners stored that information server-side? ‘+ [fapplicable, how would Alphabet and its subsidiaries know if its data initially held client-side was later transmitted to a vendor's (or other third party's} servers? ‘+ Did the agreements explicitly stipulate that user data must only be stored client-side, with prohibitions on third party partners from commercializing this data? What penalties did the agreements contemplate in the event a partner was found to have commercialized, or otherwise misused, user data? + Adj Robertson, “Lenovo Reportedly Banned by MI6, CLA, and Other Spy Agencies Over Fear of Chinese Hacking,” The Verge (uly 30,2013), available at: hips:fwww.theverge.com/2013/7/3041S70780vtenovo- ortediy-banyed:by-iniG-cin-over-chinese-hacknsctoars 5 Matt Apuza and Michael S, Schenidt, “Secret Back Door in Some U.S. Phones Sent Data to China, Analysts Say,” New York Times (November 15,2016), available at: Wips/iwww.n 201.61 /L6lusipolites/china: pphones-software-security. btn F Anne Vandermey, "Tech Companies Chase the Ukimate Milestone: A Billion Users,” Forttme (August 25. 2016), available i: Ws tMorwne eom/201608°2/facebook-yoosle-tech-companies-bllion-users! * SeeChina andthe Age of Strategie Rivals" Canadian Security Intelligence Service My 2018), avalae a -Outreach-China-report 20ls-on pat* Ifapplicable, what vetting did Alphabet engage in before providing access to the private API to third party device makers? ‘© What continuous auditing processes did Alphabet have in place to ensure that its partners, ot other supply chain actors, did not contravene terms in the agreements related to the use or commercialization of user data? To the extent that Alphabet finds that one of its partners, including any foreign device maker, has not complied with provisions governing use of user data, what legal remedies will Alphabet pursue against them? ‘Thank you very much for your serious consideration of these concerns. Sincerely, Mok © Mune, MARK R. WARNER United States Senator