Estonia’s Nuctech Scanners Go Unexplained

Estonian customs and Tallinn Airport have been using X-ray screening equipment made by Nuctech, a Chinese state-owned company, for years (Postimees). What is publicly known does not prove espionage. It points to something more basic, and still serious: an accountability gap. Tender files, contract terms, security-risk assessments, and the rules for software updates and maintenance have not been disclosed. The question is whether this was ever treated as the security-sensitive procurement it clearly was.

The machine is not what you picture

A baggage scanner may look like a passive metal tunnel. It is better understood as a networked computer attached to an X-ray source. Modern CT-based airport scanners collect images from several angles, then software builds three-dimensional views that operators can rotate and slice to inspect what is inside (NIST). The machine records what it scans, flags suspicious objects, and needs regular software updates to keep detection reliable.

That is why the supplier relationship matters. Vendors often retain remote access so they can keep equipment running. In practical terms, that can resemble a master key to the building. It may be needed for repairs, but the buyer must know who holds it, when it is used, and what systems it can reach. Security guidance from ENISA and the UK’s NCSC warns that maintenance channels can become routes for unauthorised access or quiet changes to configuration.

For border scanners, the risk is obvious. Someone with deep system access could, in theory, view inspection images or adjust detection thresholds so the machine becomes less sensitive to certain objects, without the operator seeing anything unusual. These are known structural risks across the sector. They do not prove that any Nuctech machine has been compromised.

Brussels is asking about money, not espionage

The European Commission’s action against Nuctech is a competition investigation, not a security ruling. In April 2024, Commission officials inspected premises linked to Nuctech in Poland and the Netherlands under the EU’s Foreign Subsidies Regulation. That regulation, in force since 2023, allows Brussels to examine whether financial support from a non-EU government helped a company undercut rivals in European tenders (European Commission).

Nuctech challenged parts of the data handling from those inspections. The EU General Court rejected its interim bid in July 2024. No final decision has been published.

The distinction matters for Malta as much as for Estonia. Brussels is asking whether state-backed pricing distorted competition. That is not the same as asking whether the machines are safe to trust. The Foreign Subsidies Regulation can deal with unfair money. It cannot answer the security question.

A national purchase, a shared risk

Scanners at the EU’s external borders are bought nationally, by customs agencies and airports. But once goods clear Estonian customs, they can move across the single market, the 27-country area where products circulate without further border checks. Passengers screened in Tallinn can fly onward across Schengen. Every checkpoint depends on the integrity of the others.

Other member states treat that assumption differently. Nuctech has a production and service centre near Warsaw, so Poland’s exposure is physical: repairs and updates run through a local subsidiary of the Chinese parent company. Lithuania’s framework for protecting strategically important infrastructure would screen this kind of purchase for ownership and remote-access risks. The Netherlands frames Chinese technology through explicit espionage warnings from its intelligence service. Estonia is the case where Nuctech use is confirmed, but the governance trail remains out of sight.

EU rules such as the NIS2 directive push operators of essential services to manage supply-chain risk. Belgium recently blocked a Chinese-linked takeover of a helicopter operator on national-security grounds. But the key procurement decision, including who assessed the supplier and what access was granted, still happens inside the member state.

Brussels can make subsidised competition harder. It cannot go back and audit every scanner already operating at a border. The accountability question sits with the national buyers. Until Estonia discloses how this purchase was assessed, the debate will remain trapped between espionage fears and procurement silence, while the real governance gap stays unresolved.