← Operating System
F

HarmonyOS

Fail
Huawei · 🇨🇳 China
PolicyApp PermissionsNetwork TrafficFirmwareRegulatory
Technical details
App: com.huawei.hwid
Manufacturer: Huawei

⚠️ The bottom line

Ren Zhengfei told the world no Chinese law forces companies to install backdoors. He's technically correct — the law doesn't use the word "backdoor." It uses "support, assist, and cooperate with national intelligence efforts." NYU professor Jerome Cohen: "There is no way Huawei can resist any order from Beijing. The Party is embedded in Huawei and controls it." The law Ren says doesn't exist compels something potentially much broader than a backdoor. Huawei says it never conceals backdoors. The UK government spent nine years trying to verify Huawei's code and concluded it was "impossible to provide end-to-end assurance." Vodafone found backdoors in Huawei routers in Italy. They asked Huawei to remove them. Huawei agreed, hid them instead, then refused to take them out — calling it a "manufacturing requirement." A security professor confirmed: removed on complaint, then added back differently. That's not a bug. That's concealment.

Legal jurisdiction
🇨🇳 China (headquarters)
⚠National Intelligence Law read more →
Company must secretly hand data to Chinese intelligence on request
⚠Data Security Law read more →
State can classify any data as 'important' and demand access for national security
Spying
3/4 HIGH
Is someone spying on me?
Data Sharing
4/4 EXTREME
Who gets my data?
Security
4/4 EXTREME
Is it actually secure?
Honesty
3/4 HIGH
Can I trust what they say?
REPLACE Extreme risk. Look for alternatives or lock down hard.
Use Linux Mint instead
Zero telemetry, rejected Snap, community-funded
See report →
13Contradictions
5Critical
6High
2Medium
13Sources
Findings by concern
Spying 3/4 HIGH 3 findings
⚠️ criticalmarketing claims vs firmware analysis
Huawei said it only makes "general-purpose products." It tested a system that scans crowds for Uyghur faces and alerts police. They filed a patent classifying humans by ethnicity: "Han" or "Uyghur." The document was on Huawei's own website until journalists found it. You don't patent a test. Up to two million Uyghurs sit in internment camps. The World Uyghur Congress is suing Huawei for genocide. French soccer star Antoine Griezmann quit his sponsorship. "General-purpose" apparently includes ethnic sorting for police.

What they claim: Huawei response to Uyghur surveillance report: "Huawei only supplies general-purpose products."

What we found: In 2018, Huawei worked with Megvii to test an AI camera system detecting Uyghur faces in crowds, triggering a "Uyghur alarm" for police. A confidential document was hosted on Huawei's own European website — deleted only after IPVM contacted them. Huawei filed a patent (July 2018) with Chinese Academy of Sciences listing "race (Han, Uyghur)" as pedestrian attribute. World Uyghur Congress filed criminal charges in France for genocide, human trafficking, aggravated servitude. Antoine Griezmann terminated his sponsorship. Up to 2 million Uyghurs detained in camps.

⚡ highmarketing claims vs regulatory findings
Huawei markets HarmonyOS as a secure, open ecosystem. US lawmakers say it could enable "digital authoritarianism" with every update potentially carrying hidden surveillance. Huawei wants to put this OS in Toyota and BMW cars. American intelligence worries China doesn't need hardware backdoors anymore when it controls the operating system itself. No Western government has ever certified HarmonyOS as safe. The OS that wants to be everywhere can't be checked by anyone outside China.

What they claim: Huawei positions HarmonyOS as a "secure, open ecosystem" and trustworthy alternative to Android/iOS.

What we found: US Representatives Moolenaar and Krishnamoorthi (House Select Committee on CCP) warned HarmonyOS could "facilitate digital authoritarianism" — each update potentially containing "hidden backdoors or vulnerabilities deliberately designed for surveillance." Huawei expanding HarmonyOS to cars (Toyota, BMW partnerships) and PCs. Nikkei Asia: US concern China could use the OS for spying "instead of relying on chips." No Western government has certified HarmonyOS as safe.

⚡ highpolicy claims vs regulatory findings
Huawei called its Uyghur facial recognition "just a test." They filed a patent for it — you don't patent tests. The patent classifies humans as "Han" or "Uyghur" for police cameras. A dozen Chinese police departments already use this technology. Two million Uyghurs sit in internment camps. The World Uyghur Congress is suing for genocide. "Just a test" — while the patent office processes your ethnic sorting algorithm.

What they claim: Huawei regarding Uyghur facial recognition: "This is simply a test and it has not seen real-world application."

What we found: Huawei filed a patent (July 2018) with Chinese Academy of Sciences listing "race (Han, Uyghur)" as pedestrian identification attribute. Patents are filed for commercial implementation, not testing. IPVM documented Uyghur analytics deployed across PRC police networks — a dozen police departments confirmed using the technology. Up to 2 million Uyghurs detained in camps. World Uyghur Congress filed criminal charges in France for genocide.

Data Sharing 4/4 EXTREME 5 findings
⚠️ criticalmarketing claims vs firmware analysis
Huawei says HarmonyOS has "comprehensive security." Nobody outside China can check. The kernel is closed source. The development tools require a Chinese ID card. Security researchers say the device blocks them from even seeing the kernel code. An operating system running on 200 million devices that cannot be independently audited is not "comprehensive security" — it's comprehensive opacity. The US Congress asked the government to examine it. So far, nobody can.

What they claim: Huawei marketing: "HarmonyOS provides comprehensive security and privacy architecture." HongMeng kernel CC EAL 6+ certified.

What we found: HarmonyOS NEXT's HongMeng kernel is fully closed source. Security researchers at Promon cannot access the kernel binary — device blocks extraction. DevEco Studio requires mainland China residency and Chinese national ID card. OpenHarmony (open source) is NOT the same as HarmonyOS NEXT. HMS Core data collection is now bundled directly into the OS. US House Select Committee on CCP called for government to "fully examine HarmonyOS's architecture." No independent Western security audit exists as of 2026.

⚡ highmarketing claims vs regulatory findings
Huawei says it's an independent private company. It was founded by a PLA military engineer who told China's leader that telecom is national security. It built the military's first telephone network. The founder studies Mao and calls his management "commercial Maoism." His daughter was arrested for sanctions fraud. A law professor says "the Party is embedded in Huawei and controls it." The ownership structure is so opaque nobody outside China can determine who actually controls it.

What they claim: Huawei repeatedly asserts it is "an independent private company" with no state control.

What we found: Founder Ren Zhengfei served in PLA 1974-1983. Told General Secretary Jiang Zemin in 1994 that "switching equipment technology was related to national security." Built the PLA's first national telecom network. Communist Party member, studied Mao Zedong's writings, received awards for Maoist theory. Management philosophy is "commercial applications of Maoism." Daughter/CFO Meng Wanzhou arrested for fraud to evade Iran sanctions. NYU professor Cohen: "The Party is embedded in Huawei and controls it." Ownership structure described by researchers as opaque.

⚡ highpolicy claims vs app permissions
Huawei says you should have "complete control" over your privacy. Their OS collects your location, behavior, ambient light, nearby Bluetooth beacons, and tracks you across every app — all built into the system, not optional. Their privacy policy says they'll hand your data to "government agencies" when asked. Under Chinese law, that request cannot be refused. Complete control — unless Beijing disagrees.

What they claim: Huawei Privacy Statement: "Privacy is a basic right of yours, you should have complete control over your privacy."

What we found: HMS Core's Awareness Kit collects: time, location, behavior, audio device status, ambient light, weather, nearby beacons. Analytics Kit is a "one-stop user behavior analysis platform" across apps, web, and mini-programs. Ads Kit uses OAID for personalized ads. Dynamic Tag Manager reports to third-party analytics. All bundled directly into HarmonyOS NEXT — not optional. Privacy policy: "Huawei may disclose your personal data to law enforcement or government agencies." Under China's legal framework, these requests cannot be refused.

⚫ mediumpolicy claims vs regulatory findings
Huawei promises your data stays confidential. Their own policy says Chinese data stays in China and they'll comply with "binding" government requests. Under four Chinese laws, all government data requests are binding. There's no independent court to appeal to. "Confidential" means confidential from everyone except the Chinese state — and that exception swallows the rule.

What they claim: Huawei Cloud Privacy Statement: "We are committed to keeping your personal data confidential."

What we found: Huawei's own policy: data collected in China "will be stored in China." For EEA-to-China transfers, acknowledges "differences in legal frameworks, including laws relating to national security and government access." Reserves "right to question" government requests but must comply with "binding" ones. Under National Intelligence Law, Counter-Espionage Law, Data Security Law, and PIPL — all government data requests are binding. No independent judicial review mechanism.

⚫ mediumpolicy claims vs regulatory findings
Huawei called its CFO's arrest political. She admitted in court that she lied to HSBC about Huawei's Iran business. China's response was to grab two random Canadians — Michael Kovrig and Michael Spavor — and hold them for 1,019 days. Spavor was sentenced to 11 years on what governments called fabricated charges. Both were freed the exact day Meng's case ended. The fraud was real. The hostage diplomacy was also real. Two innocent people spent nearly three years in a Chinese cell because Huawei's CFO got caught lying to a bank.

What they claim: Huawei's position: "Meng Wanzhou's arrest was politically motivated."

What we found: 13-count indictment: bank fraud, wire fraud, conspiracy — Meng lied to HSBC about Huawei's Iran subsidiary Skycom to evade sanctions. In deferred prosecution agreement (September 2021), Meng conceded she misrepresented the Huawei-Skycom relationship. China detained two Canadians — Michael Kovrig and Michael Spavor — within days of Meng's arrest. Both held 1,019 days. Spavor sentenced to 11 years on charges widely seen as fabricated. Both released the exact day Meng's case resolved.

Security 4/4 EXTREME 4 findings
⚠️ criticalpolicy claims vs regulatory findings
Ren Zhengfei told the world no Chinese law forces companies to install backdoors. He's technically correct — the law doesn't use the word "backdoor." It uses "support, assist, and cooperate with national intelligence efforts." NYU professor Jerome Cohen: "There is no way Huawei can resist any order from Beijing. The Party is embedded in Huawei and controls it." The law Ren says doesn't exist compels something potentially much broader than a backdoor.

What they claim: Ren Zhengfei (2019): "No law requires any company in China to install mandatory back doors."

What we found: China's National Intelligence Law Article 7 (2017): "All organizations and citizens shall support, assist, and cooperate with national intelligence efforts." Article 14 grants intelligence agencies authority to "demand" cooperation. US DHS: law "compels all PRC firms to support, assist, and cooperate with PRC intelligence services." NYU law professor Jerome Cohen: "There is no way Huawei can resist any order from the Government or the Chinese Communist Party. The Party is embedded in Huawei and controls it."

⚠️ criticalpolicy claims vs third party research
Huawei says it never conceals backdoors. The UK government spent nine years trying to verify Huawei's code and concluded it was "impossible to provide end-to-end assurance." Vodafone found backdoors in Huawei routers in Italy. They asked Huawei to remove them. Huawei agreed, hid them instead, then refused to take them out — calling it a "manufacturing requirement." A security professor confirmed: removed on complaint, then added back differently. That's not a bug. That's concealment.

What they claim: Huawei spokesperson: "There is absolutely no truth in the suggestion that Huawei conceals backdoors in its equipment."

What we found: UK HCSEC 2019: build environments "could not uniquely produce the binary deployed in UK networks" — "impossible to provide end-to-end assurance." Vodafone Italy (2009-2012): discovered backdoors in Huawei routers — 26 vulnerabilities, 6 critical. CISO Bryan Littlefair: "What is of most concern is that Huawei agreed to remove the code, then tried to hide it, and now refuses to remove it." Professor Stefano Zanero confirmed: "undocumented telnet service with hardcoded credentials, removed upon complaints and then added again in a different way."

⚡ highpolicy claims vs third party research
Huawei calls cybersecurity its "top priority." The UK spent nine years auditing their code through a dedicated security center. Every year: serious problems. In 2019, they couldn't verify the software on UK networks was the same software Huawei showed them. Huawei promised $2 billion to fix it but produced no evidence of action. After a decade of "top priority" that never improved, the UK said: rip it all out by 2027.

What they claim: Huawei Trust Center: "Cyber security and privacy protection are Huawei's top priorities."

What we found: UK HCSEC (2010-2019): Nine years of auditing found persistent engineering failures. 2019 report: Huawei promised $2 billion to fix software engineering but "had not supported this claim with any material and verifiable actions." Build process so broken HCSEC couldn't verify deployed software matched source code. Identified vulnerabilities that could "affect the operation of the network" or allow "access to user traffic." UK ultimately decided to remove Huawei entirely.

⚡ highpolicy claims vs firmware analysis
Vodafone found secret entry points in Huawei equipment across Italy — routers, fiber nodes, broadband gateways. Twenty-six vulnerabilities, six critical. They asked Huawei to remove one backdoor. Huawei agreed, then hid it, then refused to remove it. The security professor confirmed: removed on complaint, then added back differently. Vodafone says nobody used the backdoor. If a locksmith installs a door in your house and refuses to remove it, "nobody broke in yet" is not reassuring.

What they claim: Vodafone regarding Huawei backdoors in Italy: "We have no evidence of any unauthorised access."

What we found: Vodafone discovered telnet backdoors with hardcoded credentials in Huawei routers, optical service nodes, and broadband gateways (2009-2012). Internal audit: 26 vulnerabilities — 6 critical, 9 major. Professor Zanero confirmed: "undocumented telnet service with hardcoded credentials, removed upon complaints and then added again in a different way." Vodafone CISO Littlefair: Huawei "agreed to remove the code, then tried to hide it, and now refuses to remove it."

Honesty 3/4 HIGH 1 finding
⚠️ criticalpolicy claims vs regulatory findings
Ren Zhengfei said he'd shut Huawei down before harming customers. Five separate intelligence agencies — representing the US, UK, Australia, New Zealand, and Canada — each independently concluded Huawei is a national security threat and banned it from their networks. A 2026 study confirmed these weren't copycat decisions. When five allied democracies independently ban your company, "customer interests" may not be the priority. The UK alone is spending billions to rip Huawei equipment out by 2027.

What they claim: Ren Zhengfei: "We would rather shut Huawei down than do anything that would damage the interests of our customers."

What we found: All Five Eyes nations — US, UK, Australia, New Zealand, Canada — independently banned Huawei from telecom networks on national security grounds. UK ordered all Huawei 5G equipment removed by 2027. Canada: 5G by June 2024, 4G by 2027. A 2026 academic study confirmed these were independent decisions — each intelligence agency reached the same conclusion through its own assessment. US lawmakers warned HarmonyOS could "facilitate digital authoritarianism."

Sources