The next great contest between states may not begin with missiles, sanctions or troops. It may begin with a packet of internet traffic quietly taking a detour.
That is the central warning contained in Stranger Pings: The Threat of CCP-Controlled Infrastructure in the U.S. Communications Backbone, a report by the U.S. House Select Committee on the Strategic Competition Between the United States and the Chinese Communist Party.
Rather than focusing on malware or individual cyberattacks, the report argues that America’s greater vulnerability lies in the architecture of its communications networks and the continued presence of Chinese state-linked telecommunications companies within that ecosystem.
For years, cyber security has been understood largely as defending computers against intrusion. The committee argues that this thinking is now outdated. The greater risk lies beneath the software layer, in the physical infrastructure, routing systems and trusted relationships that make the internet function. If those foundations are compromised, traditional cyber defences become far less effective.
The report builds its case around China Telecom, China Mobile and China Unicom. Washington had already revoked or denied these companies’ licences to provide regulated telecommunications services after concluding they were vulnerable to influence and control by Beijing.
Yet, according to the investigation, those regulatory actions did not force the companies to dismantle infrastructure, terminate network relationships or withdraw equipment from American data centres. Instead, they retained significant operational footprints inside the United States.
The committee likens the situation to revoking a trucking company’s operating permit while allowing it to keep its warehouses, trucks and logistics network intact. The business model changes, but the infrastructure remains. In the digital world, infrastructure often matters more than commercial licences because it provides continuing access to data flows, routing relationships and network management systems.
Whether every allegation ultimately withstands scrutiny is almost secondary to the report’s broader conclusion. It exposes a regulatory blind spot that many democracies share. Governments tend to regulate companies, while strategic competitors increasingly seek influence through infrastructure.
The report also challenges another widely held assumption—that overseas subsidiaries operate independently from their parent companies.
According to the committee’s investigation, the American subsidiaries of these carriers remained closely tied to headquarters in China or Hong Kong for compliance, provisioning, network operations and engineering. In several instances, witnesses described operational decisions, customer management and technical support flowing through parent-controlled systems rather than local management.
One particularly revealing admission came from a compliance witness who acknowledged, “We cannot guarantee the affiliate, specifically the CUG, to comply with U.S. laws.”
That statement illustrates the wider dilemma facing regulators. Corporate registration in a democratic country does not necessarily translate into operational independence if critical functions remain under the authority of a parent company subject to another state’s national security laws.
The report becomes even more significant when it shifts from ownership structures to internet architecture itself.
Most users imagine the internet as a decentralised network with countless alternative routes. In reality, the system depends heavily on trust. Border Gateway Protocol, or BGP, allows networks around the world to announce which routes they can carry. Those announcements are generally accepted without independent verification.
The committee argues that this trust can be exploited through false route announcements, potentially diverting internet traffic through networks where it can be monitored, copied or manipulated before reaching its destination.
Instead of attacking a computer, an adversary can manipulate the roads that digital traffic travels. And the network itself becomes the battlefield.
The report cites more than 108,000 high-confidence BGP hijack events involving PRC- or Hong Kong-associated carrier networks between 2018 and 2025, while carefully noting that not every anomaly necessarily represented deliberate espionage. Some may have resulted from technical errors or poor network management.
Yet the committee argues that the inability to distinguish accident from intent is itself a strategic vulnerability, especially when local subsidiaries lack sufficient logging to reconstruct what actually happened.
That measured approach strengthens the report’s credibility. Rather than claiming every routing anomaly was an act of Chinese espionage, the committee focuses on systemic risk. Infrastructure that cannot be independently monitored or audited creates opportunities for exploitation, whether intentional or accidental.
There is also a broader geopolitical lesson.
For much of the past decade, debates over Huawei and Chinese technology centred on hardware procurement. Governments asked whether certain vendors should be excluded from 5G networks or sensitive government contracts.
Stranger Pings argues that the conversation should have been wider all along. Strategic influence extends beyond hardware into routing agreements, data centres, cloud connectivity, peering arrangements and operational control.
This should resonate well beyond Washington.
India has spent years reducing dependence on Chinese telecom vendors while expanding indigenous digital infrastructure. Yet the report suggests that resilience requires more than trusted suppliers. It requires continuous visibility into who manages networks, who controls routing decisions, where operational authority resides and whether critical infrastructure remains exposed through commercial relationships that fall outside traditional licensing regimes.
That is not an exclusively American challenge. Every country building digital public infrastructure, cloud networks, AI ecosystems and smart cities will confront similar questions.
Ultimately, Stranger Pings is less an indictment of three Chinese telecommunications companies than a warning about the changing nature of strategic competition. The contest between major powers is no longer confined to naval fleets, satellite constellations or semiconductor supply chains. It increasingly runs through the invisible infrastructure that carries every financial transaction, government communication and military order.
The lesson is straightforward. In 21st century, sovereignty is measured not only by who owns the cables, but by who controls the pathways through which information travels.
Democracies that fail to understand that distinction may discover that their most critical networks were never fully under their control in the first place.