When Rio Tinto Met China’s Iron Hand
(Bloomberg Businessweek) -- For eight years, Stern Hu rose every morning at 6 a.m. in Qingpu Prison near Shanghai. He and the dozen men who shared his cell would blearily pull on their blue-and-white-striped uniforms and line up in front of their bunks for the day’s first duty: greeting the guards. “Good morning, officer!” they’d shout. “Thank you for taking care of us, officer!”
Everyone in Brigade No. 8, the foreign prisoners unit, knew Hu. The quiet 61-year-old stood a head taller than the rest. Chinese-born, with an Australian passport and a shock of white hair, he’d been a star at Rio Tinto Group, one of the world’s largest mining companies, before being sent to prison in 2010 for stealing trade secrets and taking bribes. The Chinese government said his actions had cost the country’s steel industry as much as $100 billion.
To the members of Eight Brigade, Hu was also the guy who ran the library. After a breakfast of rice gruel with a spoonful of pickled vegetables, he’d take his post at a small desk next to some bookshelves at one end of the common room. He was supposed to keep track of who borrowed the books, but a former fellow convict says he let people do as they pleased. Most of his day was spent translating things for the guards. At 9 p.m., when the automatic lock on his cell door clanged shut, he’d lie on a thin mattress and listen to his bunkmates snore or cry out in their sleep.
Hu also completed self-denunciation classes, writing out long scripts apologizing for his actions. His reward for this, combined with his library service and reputation for good behavior, was to have his sentence reduced from 10 years to eight. On July 4, Hu, one of the most senior Western executives to see the inside of a Chinese prison, was set free.
As Rio Tinto’s chief representative in Shanghai, Hu had once helped the company ride China’s economic miracle to record profits. Hundreds of millions of tons of iron ore, supplied by Rio and sold by Hu, were forged into steel for cars, bridges, and skyscrapers. Then, in 2009, the relationship soured, and Hu and three of his colleagues were arrested as part of what highly placed sources describe as a targeted campaign—one they say involved a major hacking operation and cost the company more than $1 billion.
What happened to Rio has never been reported in depth. The company declined to comment for this article, and the Chinese government denied any knowledge of a targeted campaign. Over the course of three years, however, more than 20 sources—including current and former government and intelligence officials, current and former Rio Tinto employees and executives, and private security consultants—revealed details of Hu’s incarceration, the company’s interactions with Chinese officials, and the hacking allegations. They asked not to be identified because of the matter’s sensitivity. Many said the experience had been unforgettable, even traumatic. One former executive called it the most nightmarish period of his career. Taken together, their accounts portray one of the first and most devastating instances of China’s now-famous hackers spying on a Western corporation, and a cautionary tale about the country’s ability to influence global trade.
Sixty years ago, Mao Zedong predicted China would become the world’s top steel producer. His plan to have rural communes build thousands of humble “backyard” furnaces produced some memorable propaganda but little steel worthy of the name. At the start of the 1950s, annual output in China was about 160,000 tons, sufficient for a few skyscrapers. But after economic reforms opened production to the private sector, the figure rose steeply. By 2003 the country was churning out 200 million tons of steel a year, enough to erect 3,000 Empire State Buildings.
This boom took place even though China has little quality iron ore, which is superheated, purified, and mixed with oxygen to make steel. Instead, it relied on a handful of exporters, especially Rio Tinto. Formed in 1873 by London financiers seeking to buy the Rio Tinto copper mines from the Spanish government, the company grew into an international conglomerate with operations in Africa and the U.S.—an apex predator of mineral deposits, selling everything from diamonds to talc. Its transformation was secured in 1966 by the opening of an iron ore mine in the Pilbara, a remote region of northern Australia where the dirt itself is the color of rusted metal.
By tradition, iron ore markets were orderly and only modestly lucrative. The biggest buyers and sellers in each region negotiated the price annually. This worked fine during the 1990s, when Japanese mills were the biggest customers and the price held steady at $10 to $15 per ton. But Chinese demand changed everything. In 2005 the global benchmark price doubled. When Rio sent negotiators to China to hammer out a deal, they found something very different from the market in Japan.
China by then had some 4,000 steelmakers, from state-owned behemoths to scrappy family-owned mills. These ore buyers, it turned out, were acting like traders, snapping up shipments under one-year contracts and flipping them for a quick gain on the open market. Word spread among Rio executives that the son of iron ore head Sam Walsh had been approached in Australia, where he was working for a separate business. A Chinese classmate from his MBA program sat down in his office and offered the market price, plus a few million dollars, if he could arrange for a Rio shipment to be sent to a particular port. The offer was declined.
Throughout the mid-2000s, 2-kilometer-long trains loaded with iron ore rumbled to the Australian coast to fill cargo ships headed for Qingdao and Tangshan. In August 2006, Rio held celebrations at its global offices to mark 40 years of exports from the Pilbara. A marketing executive named Stern Hu arranged a fireworks display over Shanghai’s Bund waterfront district, watching in awe as the pyrotechnics danced with the skyline’s neon glow. That year, Rio announced a record second-half profit, driven, in part, by $1.8 billion in sales to China. But a crisis was coming that would threaten the company’s existence.
In May 2007, Tom Albanese became Rio’s chief executive officer. A New Jersey native, he’d gone to college in Alaska so he could devote his spare time to mountain climbing; he spent his school holidays carrying rocks down slopes for geologists. When he first started working for Rio in the ’90s, he turned up at its headquarters in London’s Aldermanbury Square wearing his best Alaskan jacket, a bold plaid. He was directed to the nearest tailor.
Within months of Albanese’s appointment as CEO, rumors began to circulate that Rio’s biggest rival, BHP Billiton Ltd., was planning a takeover bid. In November the talk became reality with a $150 billion offer, then the largest in corporate history. Rio rejected BHP’s overtures, the bid turned hostile, and Albanese’s focus shifted to survival.
A few months later, he was on a monthly call with about 100 employees when news flashed on computer screens that state-owned Aluminum Corp. of China, known as Chinalco, had staged an overnight raid on Rio’s shares. Without warning, the Chinese government had effectively acquired 9 percent of the company’s stock and become its biggest investor. The move was widely seen as an attempt to stop BHP’s takeover, lest the combined entity choke Chinese factories in a monopolistic grip. (Chinalco didn’t respond to a faxed request for comment.) That same afternoon, Albanese and another executive met Chinalco President Xiao Yaqing at Rio’s headquarters. After some stiff handshakes, Albanese welcomed Xiao to the company. Anyone who could help ward off BHP was a friend.
Around the same time as the Chinalco raid, however, Rio executives noticed their computers were acting strangely. Keyboard commands were taking a long time to register onscreen. Emails opened and closed by themselves. Alarmed, Rio’s board contacted MI5, Britain’s domestic spying agency.
The security service didn’t seem interested at first. Rio sold metal and rocks. But a few weeks later, according to two people familiar with the conversation, a company representative was summoned to an unmarked building near London Bridge. He was asked to surrender his phone, belt, and watch. Then he went upstairs to meet a man who didn’t provide his name.
Your communications are insecure, the official said.
What does that mean? the employee asked, incredulous. Data? Emails? Phone calls? Text messages?
Yes, the official replied. Six sovereign states can see them, he specified.
I presume you’re one, the employee said.
Most of the watchers are benevolent forces, the official responded, but you really need to worry about the Chinese.
MI5 recommended that Rio hire a British consultant. The company considered overhauling its IT infrastructure, but ultimately opted for what a government official describes as “whack-a-mole” fixes, such as using burner mobile phones. For discussions about the BHP bid, Rio executives decided to meet deep inside headquarters, in a windowless room dubbed “the bunker,” to prevent outsiders from listening in by shining a laser against a windowpane and measuring the vibrations. They also used a system of code names. Rio Tinto was referred to as Robert. BHP was William. The takeover defense was Manchester.
Only a small number of executives and board members were told that Chinese hackers had comprehensively breached Rio’s systems. The company’s attention was focused on the more immediate problem of the takeover bid, which ended in late 2008 because of another crisis: the string of bank collapses that triggered a credit squeeze and spread through the global financial system. For a time, Chinese steelmakers stopped buying iron ore altogether. Some even breached their contracts by refusing to take shipments. Albanese and his colleagues spent that Christmas season trying to keep the company afloat while carrying $40 billion in debt. They flew around the world, into airports that seemed eerily empty, firing miners and sending thousands of employees home early for the holidays. Dozens of tankers sat parked off the Australian coast with nowhere to go.
Rio soon concocted two plans to escape the turmoil. Either it would go to the market and raise capital (code name: Glasgow) or it would get a bailout from Chinalco in return for a stake in key assets (code name: Colleen). Colleen won. On Feb. 12, 2009, Albanese signed an agreement with Chinalco for $19.5 billion in cash and convertible bonds. Rio’s shares swiftly fell, as non-Chinese shareholders complained they were being stiffed, and Australian lawmakers fretted about Beijing’s involvement in the country’s mines.
The uproar continued even as China announced a stimulus package, worth about $585 billion, that would jolt the iron ore market to life. Faced with this opposition, Rio’s chairman, Jan du Plessis, blinked. In June the company announced it was scrapping the Chinalco deal and issuing new shares instead—Glasgow, after all. Publicly, the Chinese were diplomatic. Privately, they were furious. Chinalco broke off contact with Rio, its executives refusing even to answer the phone.
Tensions or not, Chinese mills still needed raw materials, and Rio still needed customers. Predictably, the 2009 iron ore price negotiations hadn’t been going well. The steelmakers were being represented by the China Iron & Steel Association, a trade group with close links to the government. CISA had criticized Rio in the past, with one of its leaders saying, “Their brains are bloated, and their heads of full of water.” Rio’s negotiators, for their part, saw the head of CISA, Shan Shanghua, as a belligerent Communist Party hack.
In May, people familiar with the discussions say, Shan summoned the negotiators to CISA’s headquarters in Beijing, where he delivered a blunt message. “I will tell you what the price is going to be,” one source recalls him saying. “I will tell you how many tons we will get. Once you have accepted that, the deal is done.” The negotiators thanked him and walked out. (Shan, who was jailed in 2014 on unrelated corruption charges, couldn’t be reached. CISA officials declined to comment.)
Having been abandoned by Chinese customers during the financial crisis and with market prices beginning to rise, Rio needed to bounce back. In late June several executives met at the five-star Island Shangri-La hotel in Hong Kong. The subject: What to do about China?
Among those assembled was Hu. A graduate of Peking University, he’d become an Australian citizen in the 1990s while working for a tech company there. After joining Rio as a sales rep in 1996, he rose quickly through the ranks. His job in China was to meet with potential customers, sign them up, and manage supply contracts. Smooth and elegantly dressed, he was as comfortable dealing with the country’s biggest steelmakers as he was with his bosses in Melbourne and London.
Hu and the others spent a day and a night at the Shangri-La, without taking any special security precautions. They drew up a list of Chinese producers and divided them into the “good, the bad, and the ugly,” based on how fully they’d honored their contracts during the credit crunch. The team decided to cancel long-term contracts for the worst offenders and move others from one-year to three-month deals. Should demand and prices continue to rise, the move would cost Chinese buyers hundreds of millions of dollars.
Hu was sent back to Shanghai to refine the proposal for presentation to Rio’s executive committee. But a few days after he returned, on July 5, agents from the Shanghai bureau of the ministry of state security, whose aegis includes espionage, appeared at the company’s offices waving search warrants. The agents moved methodically into the workspaces of four employees, removing documents, computer disks, memory sticks, and laptops, leaving a signed receipt for each item they took.
That morning, the ministry also raided Hu’s villa in a wealthy Shanghai suburb, arresting him and removing files and electronic devices. The three other employees whose offices had been searched, all Chinese citizens who reported to Hu, were picked up at home. Soon, Rio’s global executive team was receiving urgent phone calls about the arrests, but no one had a clue what was going on. China wouldn’t even say where the four were being held because, Australian officials were told, the arrests were a matter of national security.
Only on July 8 did the Australian Consulate report that Hu had been arrested on suspicion of bribery and acquiring state secrets. Rio’s executives didn’t know what that might mean, save one thing: If Hu was convicted, he could face the death penalty.
Confronted with the opacity of the Chinese justice system, Hu’s colleagues also had to ask themselves what they knew of him. Publicly, Walsh, the head of the iron ore unit, told the media that the bribery charges were unfounded and that the company’s employees “acted at all times with integrity and in accordance with Rio’s strict and publicly stated code of ethical behavior.” Privately, executives had to wonder if Hu could have done what he was accused of doing. They knew he was married, with kids and a nice house, and that he was a classically trained violinist and teetotaler who drank pineapple juice at boozy dinners with the clients it was his job to court. Around the office, his nickname was “Vanilla.”
On the other hand, Rio’s executives were wary of the arrests’ timing and the involvement of the state security ministry. Some wondered whether it was retribution for canceling the Chinalco deal. Their suspicions only increased when the company’s security team discovered that a digital key Hu carried, which granted remote access to sensitive internal computer systems, had been used right after his arrest. His captors had uploaded and downloaded files, encrypting them so Rio couldn’t find out what they contained.
Ian Bauert, an Australian senior marketing executive who spoke fluent Mandarin, soon flew to Shanghai to learn more. He and his colleagues were followed everywhere by agents who made no effort to hide their presence. Men in dark suits sat next to them at lunch, then followed them down the street, an experience one member of the group likened to being in a bad spy movie. A Chinese-American employee in Shanghai became so terrified that he fled to Las Vegas.
Prosecutors hadn’t formally charged Hu and his colleagues, and they weren’t revealing any details about the case. An Australian diplomat who visited Hu in prison reported that he seemed to be in good health. Hu had been instructed by the Chinese not to discuss the case, but he told the diplomat he hadn’t been allowed to speak to a defense lawyer.
Within a month of the arrests, as tensions between Australia and China over the case were generating international headlines, Albanese and another Rio executive met in London with Chinese ambassador Fu Ying. “You embarrassed China and China’s people in front of the world,” Fu told them, according to two people familiar with the conversation. But she offered them a way forward, however vague: Show the people of China Rio Tinto’s human side, and build a more cooperative relationship. (In response to a request for comment, Fu’s office said that this didn’t sound like something she would say, and that she had no knowledge of, and couldn’t comment on, Hu’s case.)
In August, Hu and his colleagues were formally charged, with the accusations of state espionage downgraded to stealing commercial secrets. That at least took the death penalty off the table. Walsh told the press that Rio Tinto would stand by the men, even as the company was working to restore relations with the Chinese. After the arrests, it had shelved the “good, the bad, and the ugly” scheme and carried on using an outdated iron ore price benchmark instead. Executives were now seeking a distinguished independent figure who could break the impasse.
Late that year, Albanese and Mivil Deschenes, a former Canadian military officer who was Rio’s head of security, sat down in the New York office of one of the few people in the world with direct access to the highest levels of Chinese government: Henry Kissinger. The former U.S. secretary of state told the Rio executives he couldn’t do anything about the four people in jail, but Albanese and Deschenes hired him anyway, paying what Australian media reported was at least $5 million. (Kissinger Associates didn’t reply to emails requesting comment. Kissinger serves as honorary advisory-board chair for Bloomberg’s upcoming New Economy Forum.)
In the following months, Kissinger got Rio executives pondering the same question over and over: How much do you want to be China’s friend? The answer, it soon emerged, was very badly indeed.
The trial of Hu and his colleagues began on March 22, 2010, at the Shanghai First Intermediate People’s Court. No media were permitted to attend, but the occasional presence of consular staff and the later release of a 26-page decision allowed the public and the company to finally learn more about the charges. It would be too late to do much about it, though—the vast majority of Chinese criminal proceedings end in conviction.
Prosecutors told the court that a Chinese steelmaker had given Hu a gray suitcase containing 1 million yuan (then about $150,000) in return for a long-term supply contract, and that the Rio executive had used a fake consulting agreement and a friend’s Hong Kong company to get $300,000 in kickbacks from another customer. Hu’s wife testified that he’d brought money home and put it in a safe.
Faced with this evidence, Hu pleaded guilty to accepting bribes. It’s unclear, based on the decision, whether all of his colleagues did the same; some of them challenged portions of the evidence. All four contested the charge of illegally accessing commercial secrets. That portion of the proceedings occurred in private across a few days, without Australian diplomats there to observe.
Albanese was in the country as his employees’ fates were being decided, but not because of the trial. Rio and Chinalco had just agreed on a $1.4 billion accord to jointly develop one of the world’s largest mineral reserves: Simandou, in the West African nation of Guinea, said to contain 2.3 billion metric tons, most of it iron ore. The move was part of a plan Rio and Kissinger had come up with to embrace China as a partner, not just a customer.
The CEO took the stage at the Great Hall of the People in Beijing alongside a group of visiting company leaders on hand to pay homage at the China Development Forum. Dwarfing them overhead was the emblem of the People’s Republic: Tiananmen Gate crowned by four small stars, representing the masses, and one large star, representing the party. After a Q&A session, the executives greeted the Chinese premier, Wen Jiabao, a paternal figure known as Grandpa Wen. When Albanese’s turn came, an aide whispered in Wen’s ear, and the premier’s eyes widened. Wen leaned in to shake hands and said something in Mandarin that was translated for Albanese afterward: “Let’s move forward.”
A few days later, the court convicted Hu and his colleagues of accessing commercial secrets, in addition to bribery. The decision said that he’d asked his staff and industry contacts to send him confidential information about BHP Billiton’s prices, CISA’s operations, and Chinese efforts to curb day-to-day ore trading. The judge blamed the defendants for the breakdown of the 2009 iron ore talks, saying it had “severely impacted and damaged the competitive interests of Chinese steel enterprises.”
The information Hu was accused of stealing seemed like the kind of thing an employee of a company involved in a commercial negotiation would reasonably be expected to research. But in the Chinese system, state secrets were what the government said they were. Hu was sentenced to 10 years in prison. The other defendants got terms of 7, 8, and 14 years.
Rio quickly fired them all. “I am determined,” Albanese said in a statement, “that the unacceptable conduct of these four employees will not prevent Rio Tinto from continuing to build its important relationship with China.”
As Hu was moving into Qingpu Prison, a new chapter in Rio Tinto’s relations with China began. The annual iron ore benchmark, the source of so much conflict, was finally killed off that year by Rio’s archrival, BHP Billiton, and the Brazilian company Vale SA, which moved to quarterly pricing based on market rates. Rio, no longer taking an active role in negotiations, followed suit.
In 2011, Albanese oversaw the creation of a joint company that would pass on Rio’s expertise in finding and exploiting mineral deposits to Chinalco. Rio also made symbolic gestures, sponsoring research into the metallurgical secrets of China’s iconic 2,200-year-old Terracotta Army statues. A feng shui master redesigned the company’s Shanghai office, decorating it with a 4-foot-tall jade horse in a pool of water for good luck. Albanese began visiting China as often as 10 times a year, speaking on one occasion at the Central Party School in Beijing, which grooms future Communist leaders. If the Chinese people couldn’t see Rio’s human face before, they were seeing it now.
The specter of Hu lingered, though. In the summer of 2012, MI5 Director-General Jonathan Evans gave a rare public lecture in London’s financial district to warn about the “astonishing” level of state-sponsored online spying. One attack, he said, had cost a British company an estimated £800 million ($1.3 billion) in lost revenue, “not just through intellectual property loss but also from commercial disadvantage in contractual negotiations.”
Evans didn’t identify the company or the attacker, but in 2015 the journalist Gordon Corera reported in his book Intercept that the spy chief had been talking about Rio Tinto and China. Several security officials confirm Corera’s account. According to them and other sources, MI5 attributes the breach discovered in 2008 at Rio to a unit of the People’s Liberation Army.
The case was unusual, one former U.K. security official says, in that it involved both the PLA and China’s state security ministry. The coordination, if true, suggested that a powerful political or industry figure had targeted the company. The identity of any such sponsor remains a mystery, but Rio’s executives came to believe that someone had learned about their plan to rip up long-term contracts and taken action to stop it. If so, it worked, costing the company hundreds of millions of pounds—the £800 million was its estimate, sources there say—by forcing it to sell ore at a benchmark that was less than half the peak price during that period. As for Hu and his colleagues, whether they were guilty or innocent, they were collateral damage. Asked about Hu, Rio Tinto, and the hacking allegations, a spokesman for China’s foreign ministry said, “I am not aware of the situation that you speak of,” adding that the country “adamantly opposes and cracks down on any form of cyberattacks and is a firm defender of cybersecurity.”
When a company comes under attack from the Chinese government, it has two options: Pack up and leave, as Google did after a censorship dispute in 2010, or suck it up, make allowances, and watch the profits roll in. Rio had opted for the latter, with a harsh lesson learned. In the wake of Hu’s imprisonment, it started to overhaul its information security protocols, hiring management consultants and buying new high-tech systems. At one point, consultants discovered an important, unguarded computer server inside a shed in Utah, where the company has copper mining operations. Another time, security staff and an expert dispatched by British intelligence watched as a Chinese hacker took control of Albanese’s computer; the team sought to gather information about the threat while keeping the intruder out of sensitive areas.
Total security would prove all but impossible to achieve, but profit was another matter. In December 2015, Rio published an article on its website celebrating its “extraordinary” growth in China, which by then accounted for 40 percent of global sales, about $19 billion annually. Andrew Harding, Rio’s head of iron ore, praised “the deep respect, the friendship and the reciprocity that has resulted from working very closely together.”
It was a strange friendship, with few boundaries. In meetings, Rio representatives smiled and shook hands with Chinese partners who, one executive joked in private, probably knew whether he scrunched or folded his toilet paper. In 2016 an executive preparing to fly to Beijing for talks about the Simandou partnership was told his entire inbox had been downloaded. The African project became a costly disaster. Months later, Rio agreed to sell its stake to Chinalco for about $1 billion, without having produced a single ton of iron ore in Guinea. Afterward, a series of private emails exchanged by Rio executives about payments totaling $10.5 million to a friend of Guinea’s president were leaked online. The company formally reported itself to authorities in the U.S., the U.K., and Australia, who opened bribery investigations that remain active. The source of the leak has never been identified.
Today, the latest generation of Rio executives can be seen on television talking up China’s economic prospects, which are inextricably linked to their own. But a person familiar with the company’s security arrangements says that whenever the relationship gets tense, Rio prepares evacuation plans for its employees in China. One time, the plan involved arranging a fake conference in Singapore as cover. Rio went so far as to book a hotel.
None of the television crews and newspaper photographers camped outside Qingpu Prison saw Hu leave on July 4. Bloomberg Businessweek couldn’t reach his wife or other family members during several visits to their former home in Shanghai. His health deteriorated during his eight years in Qingpu, a former inmate says—heart trouble, for which he had to be hospitalized.
The media reported that Hu’s first act as a free man was to meet his wife, and some speculated that he might visit his elderly parents’ home in northern China before flying to Australia. Once there, he’ll be free, after eight years, to talk about the case that changed his life, or to fade into obscurity if he prefers. His chair in the library of Brigade No. 8 will sit empty, but perhaps only for a while. There are plenty of executives willing to take a risk or two to tap into the world’s largest market. —With Simon Lee, John Liu, Michael Riley, and Martin Ritchie
©2018 Bloomberg L.P.