From Huawei to Cybersecurity: PNG’s digital dilemma in a contested Pacific

By Bernard Yegiora

PNG’s digital transformation is no longer just a development story. It is a strategic one.

In my earlier work on The Yegiora Files, I examined the Huawei debate in PNG at a time when it was framed largely as a telecommunications issue. Yet those discussions were never simply about infrastructure. They were early indicators of a deeper shift: the entry of geopolitics into PNG’s digital space. Today, that shift is unmistakable. Cybersecurity has emerged as a central concern, and the questions raised nearly a decade ago now sit at the core of PNG’s national security agenda.

In 2025, I invited Dr. Mengmeng Ge—now with Monash University—to deliver a Zoom guest lecture to my students, offering practical insights into cybersecurity, with a focus on social engineering and the exploitation of human vulnerabilities in digital systems.

The turning point came with PNG’s engagement with Huawei. In Australian Ignorance and the PNG Huawei Deal, I argued that traditional partners, particularly Australia, misunderstood PNG’s decision-making environment. Their response was reactive and delayed, while PNG prioritised immediate development needs. The issue was not simply the presence of Huawei, but the absence of timely and strategic engagement by external actors. Infrastructure decisions were being shaped in a geopolitical environment, even if they were presented as economic choices.

By 2019, in The Huawei Issue and Its Impact on PNG, the tension between development priorities and emerging security concerns became more apparent. Globally, Huawei had become associated with allegations of cyber espionage and data vulnerabilities. Yet PNG maintained its position, honouring its agreements and resisting external pressure. This revealed a structural gap: strategic infrastructure decisions were being made without a corresponding national security framework.

By 2021, in Huawei Behind PNG’s Digital Rise, the debate had shifted again. Huawei was no longer a contested entrant; it had become embedded in PNG’s digital ecosystem. The question was no longer whether PNG should engage with Huawei, but how it should manage the consequences of that engagement. This marked a transition from decision-making to structural dependency.

More recently, in PNG Must Tread Carefully Between China and…, I argued that PNG is now operating in a contested strategic environment shaped by intensifying competition between China and its Western partners. Infrastructure projects—particularly submarine cable networks—are no longer neutral investments. They are instruments of influence. PNG is not simply developing its digital capacity; it is navigating competing strategic interests.

This trajectory now finds formal recognition in PNG’s Medium Term Development Plan IV (2023–2027). MTDP IV places security—including cybersecurity—at the centre of national development, acknowledging that economic growth, governance, and state resilience are increasingly dependent on secure digital systems. It identifies law and justice, defence, and national security as priority sectors, while emphasising the importance of strengthening ICT infrastructure and institutional capability.

Excerpt from PNG’s Medium Term Development Plan IV highlighting cybersecurity as a national security priority, with government commitment to strengthen digital protection systems and reduce exposure to emerging cyber threats.

What MTDP IV does is make explicit what earlier developments had already implied: digital infrastructure is now a national security asset.

Yet the Plan also exposes a critical challenge. While it recognises the importance of cybersecurity, it does not fully resolve the structural constraints identified in earlier analyses and my recent article. PNG continues to face:

• Fragmented institutional responsibilities in ICT governance
• Dependence on external partners for critical infrastructure
• Limited domestic technical and cybersecurity capacity

These constraints create vulnerability. Infrastructure may expand, but without corresponding institutional strength, exposure to cyber threats, surveillance risks, and external influence also increases.

Cybersecurity therefore represents the convergence of multiple pressures. Submarine cable systems, data infrastructure, and telecommunications networks underpin economic and state functions, but they also introduce new risks. Control over infrastructure translates into potential leverage. Weak governance creates entry points for exploitation. External competition amplifies these dynamics.

For PNG, the challenge is structural rather than tactical. It is not a cyber power capable of shaping global norms or projecting influence. Instead, it must operate within a system defined by larger actors. This creates a familiar dilemma for small states: how to engage external partners to drive development while preserving strategic autonomy.

The answer lies in management, not avoidance. PNG must strengthen institutional coordination, particularly between agencies responsible for ICT planning and regulation. Infrastructure agreements must incorporate safeguards, including data protection provisions, technical oversight, and long-term risk assessments. Diversification of partnerships will also be critical to reduce overdependence on any single actor.

At the same time, PNG must recognise that cybersecurity is not a purely technical domain. It is embedded in broader geopolitical competition. The rivalry between China and Western partners is increasingly playing out in digital infrastructure, standards, and data governance. For PNG, this means that infrastructure choices will carry diplomatic and security implications well beyond the technical sphere.

Looking back, the warning signs were always present. The Huawei debate was not an isolated controversy. It was an early manifestation of a deeper transformation. What appeared to be a question of connectivity was, in reality, a question of control.

MTDP IV confirms that PNG now recognises this reality. Development and security can no longer be separated. In the digital domain, infrastructure decisions are security decisions.

The strategic question now is execution. Policy recognition without institutional capability will not be sufficient.