[F]irstLight says its Vermont network is officially Huawei-free, as of the day before VTDigger published an investigative report on the issue, which included photographs taken in June showing the Chinese-made gear still in use.
Vermont was the first state in the country to ban Huawei products from government agencies and state contractors, a decision made out of security concerns. FirstLight has a contract to provide connectivity to state data centers and is involved with another company in creating a new E911 system.
Agency of Digital Services Secretary John Quinn wrote to FirstLight following the publication of VTDigger’s July 1 article asking how the Huawei equipment did not breach the state’s directive banning the gear, according to documents obtained through a public records request.
“In light of the July 1 article in VT Digger, we request that FirstLight confirms in writing to the State that it continues to be able to make this certification,” Quinn wrote to Gail Sperry, an account executive at FirstLight, in an email on July 8.
“In particular, FirstLight is invited to please clarify how the information asserted in the article is not relevant to the products and services.”
FirstLight sent a letter to INdigital, the Indiana-based company contracted to manage Vermont’s E911 network, on Feb. 4 certifying that it did not have any Huawei equipment in its network supporting state services. (INdigital needs to partner with a company that has an existing network in Vermont.)
Brian Kurkowski, principal member of FirstLight’s technical staff, clarified in an email to Quinn on July 12 that the company still had traffic on its Huawei platform in February, but not in parts of the network that would be used for state contracts.
“FirstLight has been migrating services and preparing for decommissioning of this equipment for the last 18 months starting in January of 2018 with budget approval for the project,” Kurkowski wrote.
“The migrations of the last remaining services on the Huawei platform took place on June 30, 2019,” he added.
FirstLight declined multiple interview requests for the VTDigger article published on July 1, and did not respond to detailed emailed questions. After the article was published, the company said it was factually wrong and inflammatory, and then pulled a $15,000 underwriting contract with VTDigger.
VTDigger photographed two Huawei “multiplexers” installed on FirstLight’s equipment racks, which were labelled “Sovernet,” a local company purchased by the hedge-fund-owned FirstLight about two years ago. The devices route incoming data onto outgoing channels around the state.
Kurkowski said the Huawei gear was physically removed from FirstLight’s network in the days after the article’s publication.
“After the decommission project was complete, the final step was to physically remove the Huawei devices and this took place between July 1 to July 3 of 2019,” he wrote. “There are no FirstLight Huawei devices installed or in use in any Vermont facility.”
Quinn also asked to tour “co-location” facilities where FirstLight equipment is stored — including the facilities seen by VTDigger in Montpelier and Stowe during the last two weeks of June.
Kurkowski said he “can” work with Consolidated Communications, which owns the shared facilities, to give Quinn or his staff access.
Quinn said in an interview Friday morning that he had a follow-up call with Kurkowski this week. The secretary said he was reassured that state traffic has not passed through FirstLight’s Huawei gear since the agency’s directive was issued in February.
Kurkowski explained that FirstLight stood up a new network in 2018 and has since been transferring customers away from the old network, which included the Chinese-made elements, according to Quinn. “Other customers or businesses may have been, but they said the Vermont network was not on that equipment,” he added.
Quinn said of his ongoing conversations with FirstLight: “I think it’s a trust and verify type of situation: we’re doing all we can to ensure that what they say is correct.”
He said FirstLight was still working out the details of his facility tour with Consolidated to verify the removal of Huawei gear, and could only speculate on what was causing the delay.
“The photos that showed up of a secure facility online have made Consolidated Communications hesitant to let outside people in,” he said.
FirstLight has said the photographing of its equipment in a secure facility posed a security risk to its network, and may have violated the terms of use of the facilities.
Vermont’s E911 Board has also asked for clarification about FirstLight’s use of Huawei gear. Barbara Neal, the board’s executive director, wrote to INdigital president Mark Grady and others on June 26, shortly after VTDigger shared the photos of Huawei equipment.
“The pictures provided yesterday by the VTDigger reporter (attached) create concern about the validity of the FirstLight certification provided to INdigital for the services they are to provide to INdigital in the Vermont 911 contract,” Neal wrote.
“I request that INdigital follow up with FirstLight to ascertain, in detail, if INdigital will be able to comply with the contract term outlined in Attachment D, item 19 ‘State of Vermont Cybersecurity Standard 19-01,’” she added, referring to the directive banning Huawei gear.
Neal notes that FirstLight is not currently involved in the E911 system, but is expected to be part of INdigitial’s “solution.”
Neal also communicated with Susanne Young, Gov. Phil Scott’s secretary of administration, about the issue.
“Read the Digger story … Thanks for the heads-up. Spoke with John Quinn this morning a bit,” Young wrote to Neal on July 2. “Once we know more, we should examine any contract issues that might arise.”
Scott’s office said it has not had any direct communications with FirstLight.
Those comments by Young were part of a back-and-forth with Neal over planning a replacement for E911 Board chair Gary Taylor, who is stepping down.