Since 2014, CRRC has won four out of five major US contracts for new railcars, including ones for transit systems in Chicago, Boston and Los Angeles. Critics contend the company has been able to secure the deals by dramatically underbidding competitors due to subsidies from Beijing. In addition to Metro, the company is making a play for part of a more than US$4 billion contract with the New York Metropolitan Transportation Authority for railcars for that city’s subway. A story in O’Dwyer’s, a public relations publication, reported that the US division of CRRC is paying a public affairs firm US$25,000 a month in its bid to land a contract to build some of the more than 1,000 cars MTA needs.

The situation is complicated because there are no US transit railcar manufacturers and there is concern about the economic precedent of allowing a state-subsidised manufacturer into the US market.

Britain urges the West to be ready to flex military muscle in the Pacific

Other railcar makers who attended last month’s Metro event included Hyundai Rotem, of South Korea, and France-based Alstom, according to meeting documents. CRRC has bested Hyundai in the past, however.

Kawasaki Rail Car, the Japanese maker of Metro’s 7000-series railcar, which is built in Nebraska, has not made site visits for the 8000-series project, which calls for up to 800 new railcars. Observers say that is probably because the company is consumed with a contract to build an initial batch of new railcars for the New York subway.

CRRC was initially believed to be on the verge of securing that US$3.2 billion contract – which would have been the company’s largest US deal – but lost out in a joint bid with Canada’s Bombardier Transportation, according to media reports. A China-based rail expert said the decision reflected “political considerations”, among other factors, according to a summary of his comments in the Beijing-aligned Global Times. A spokesman for MTA did not immediately respond to a request for comment on whether the agency has heeded cybersecurity and economic concerns about CRRC.

Kawasaki, which had delivered about three-fourths of Metro’s 7000-series cars by the end of last year, is expected to have delivered all 748 by the end of this year, according to Metro projections.

Neither Kawasaki nor CRRC returned requests to multiple employees for comment.

The Southeastern Pennsylvania Transportation Authority awarded CRRC a US$137 million contract in 2017 for the construction of 45 regional rail coaches, to be built in Massachusetts. SEPTA said CRRC beat out two other bidders based on two factors: technical rating and pricing.

“SEPTA determined the CRRC proposal was the best value and most advantageous for the Authority,” agency spokesman Andrew Busch said in a statement. SEPTA said the next lowest bid was from Bombardier, for nearly US$172 million, followed by Hyundai Rotem at nearly US$185 million.

After cybersecurity concerns were raised, Metro updated its bid solicitation to address some of the issues. It also extended the deadline for bids to April from January.

Last week, the transit agency outlined several new procurement requirements for the contract, such as requiring the manufacturer disclose the country of origin of all railcar components, assert that any software-related “back doors” have been disabled and remove any communications ports that wouldn’t otherwise be needed for operations.

But some members of Congress are concerned any safeguards would not go far enough and want the transit agency to secure approval from the Departments of Defence, Homeland Security and Transportation before cutting any such deal. Meanwhile, they are considering whether federal legislation would be an appropriate next step.

University of California Berkeley bans new research projects with Huawei

“The broader challenges posed by China’s ambitions demand the attention of policymakers, and I’ve been engaging with my colleagues on how to appropriately respond to China’s cyber incursions and other malign actions,” Senator Mark Warner said in a statement.

Metro “needs to share a sense of urgency that I haven’t seen from their response so far, and I have requested that they hold a more detailed briefing for my office this week on their handling of this issue”.

Warner said the issue is “bigger than just this single procurement”.

Metro declined to say if it would seek DHS, DOD or DOT approval before awarding a contract, saying it could not disclose “specific arrangements” it has with the agencies for security reasons. It also said it was up to Congress to adopt legislation if it wanted to prohibit a foreign adversary from entering the railcar market.

Metro General Manager Paul J Wiedefeld said: “We are confident that these approaches will impose appropriate controls that limit any malicious actor’s ability to embed malware and for [Metro] to monitor and enforce security requirements,” Wiedefeld wrote in response to concerns raised by Senators Mike Crapo and Sherrod Brown, who serve as chairman and ranking minority-party member of the Senate Committee on Banking, Housing and Urban Affairs, which has mass transit as part of its oversight jurisdiction.

Metro noted, however, that it was ill-equipped to address one of the key issues the senators raised: Why not buy American, or otherwise protect against bids from foreign government controlled entities?

“We would welcome the opportunity for an American-owned company to participate in [Metro’s] railcar procurements, but unfortunately, there are currently no American-owned railcar manufacturers,” Wiedefeld wrote.

Metro said it plans to maintain a free and fair procurement process, adding that any actions to protect against foreign interference in the process should take place without “unduly restricting competition”.

Andrew Grotto, a former senior director for cybersecurity policy on the National Security Council, said Metro deserved praise for prioritising cybersecurity as an “explicit factor” in its contract decision.

He said it “is an impressive list of requirements that, if implemented, would certainly make it much harder for China or any other adversary to attack Metro”.

But if “China were determined to attack Metro, I would still put my money on them succeeding, no matter who supplies the cars in the end”.

“That is one of the hard truths about the risks of digitising our infrastructure,” Grotto said.