Conservative Party
Auto Added by WPeMatico
UK to toughen telecoms security controls to shrink 5G risks
Amid ongoing concerns about security risks posed by the involvement of Chinese tech giant Huawei in 5G supply, the U.K. government has published a review of the telecoms supply chain, which concludes that policy and regulation in enforcing network security needs to be significantly strengthened to address concerns.
However, it continues to hold off on setting an official position on whether to allow or ban Huawei from supplying the country’s next-gen networks — as the U.S. has been pressurizing its allies to do.
Giving a statement in parliament this afternoon, the U.K.’s digital minister, Jeremy Wright, said the government is releasing the conclusions of the report ahead of a decision on Huawei so that domestic carriers can prepare for the tougher standards it plans to bring in to apply to all their vendors.
“The Review has concluded that the current level of protections put in place by industry are unlikely to be adequate to address the identified security risks and deliver the desired security outcomes,” he said. “So, to improve cyber security risk management, policy and enforcement, the Review recommends the establishment of a new security framework for the UK telecoms sector. This will be a much stronger, security based regime than at present.
“The foundation for the framework will be a new set of Telecoms Security Requirements for telecoms operators, overseen by Ofcom and government. These new requirements will be underpinned by a robust legislative framework.”
Wright said the government plans to legislate “at the earliest opportunity” — to provide the regulator with stronger powers to to enforcement the incoming Telecoms Security Requirements, and to establish “stronger national security backstop powers for government.”
The review suggests the government is considering introducing GDPR-level penalties for carriers that fail to meet the strict security standards it will also be bringing in.
First policy response will be ‘soft’, common cybersecurity standards. Then regulations, with strict standards and #GDPR like fines. New powers allowing to compel telecoms to do something. And work to increase diversity. pic.twitter.com/nBLWneFUDK
— Lukasz Olejnik (@lukOlejnik) July 22, 2019
“Until the new legislation is put in place, government and Ofcom will work with all telecoms operators to secure adherence to the new requirements on a voluntary basis,” Wright told parliament today. “Operators will be required to subject vendors to rigorous oversight through procurement and contract management. This will involve operators requiring all their vendors to adhere to the new Telecoms Security Requirements.
“They will also be required to work closely with vendors, supported by government, to ensure effective assurance testing for equipment, systems and software, and to support ongoing verification arrangements.”
The review also calls for competition and diversity within the supply chain — which Wright said will be needed “if we are to drive innovation and reduce the risk of dependency on individual suppliers.”
The government will therefore pursue “a targeted diversification strategy, supporting the growth of new players in the parts of the network that pose security and resilience risks,” he added.
“We will promote policies that support new entrants and the growth of smaller firms,” he also said, sounding a call for security startups to turn their attention to 5G.
Government would “seek to attract trusted and established firms to the UK market,” he added — dubbing a “vibrant and diverse telecoms market” as both good for consumers and for national security.
“The Review I commissioned was not designed to deal only with one specific company and its conclusions have much wider application. And the need for them is urgent. The first 5G consumer services are launching this year,” he said. “The equally vital diversification of the supply chain will take time. We should get on with it.”
Last week two U.K. parliamentary committees espoused a view that there’s no technical reason to ban Huawei from all 5G supply — while recognizing there may be other considerations, such as geopolitics and human rights, which impact the decision.
The Intelligence and Security Committee also warned that what it dubbed the “unnecessarily protracted” delay in the government taking a decision about 5G suppliers is damaging U.K. relations abroad.
Despite being urged to get a move on the specific issue of Huawei, it’s notable that the government continues to hold off. Albeit, a new prime minister will be appointed later this week, after votes of Conservative Party members are counted — which may be contributing to ongoing delay.
“Since the US government’s announcement [on May 16, adding Huawei and 68 affiliates to its Entity List on national security grounds] we have sought clarity on the extent and implications but the position is not yet entirely clear. Until it is, we have concluded it would be wrong to make specific decisions in relation to Huawei,” Wright said, adding: “We will do so as soon as possible.”
In a press release accompanying the telecoms supply chain review the government said decisions would be taken about high risk vendors “in due course.”
Earlier this year a leak from a meeting of the U.K.’s National Security Council suggested the government was preparing to give an amber light to Huawei to continue supplying 5G — though limiting its participation to non-core portions of networks.
The Science & Technology Committee also recommended the government mandate the exclusion of Huawei from the core of 5G networks.
Wright’s statement appears to hint that that position remains the preferred one — barring a radical change of policy under a new PM — with, in addition to talk of encouraging diversity in the supply chain, the minister also flagging the review’s conclusion that there should be “additional controls on the presence in the supply chain of certain types of vendor which pose significantly greater security and resilience risks to UK telecoms.”
“Additional controls” doesn’t sound like a euphemism for an out-and-out ban.
In a statement responding to the review, Huawei expressed confidence that it’s days of supplying U.K. 5G are not drawing to a close — writing:
The UK Government’s Supply Chain Review gives us confidence that we can continue to work with network operators to rollout 5G across the UK. The findings are an important step forward for 5G and full fibre broadband networks in the UK and we welcome the Government’s commitment to “a diverse telecoms supply chain” and “new legislation to enforce stronger security requirements in the telecoms sector”. After 18 years of operating in the UK, we remain committed to supporting BT, EE, Vodafone and other partners build secure, reliable networks.”
The evidence shows excluding Huawei would cost the UK economy £7 billion and result in more expensive 5G networks, raising prices for anyone with a mobile device. On Friday, Parliament’s Intelligence & Security Committee said limiting the market to just two telecoms suppliers would reduce competition, resulting in less resilience and lower security standards. They also confirmed that Huawei’s inclusion in British networks would not affect the channels used for intelligence sharing.
A spokesman for the company told us it already supplies non-core elements of U.K. carriers’ EE and Vodafone’s network, adding that it’s viewing Wright’s statement as an endorsement of that status quo.
While the official position remains to be confirmed, all the signals suggest the U.K.’s 5G security strategy will be tied to tightened regulation and oversight, rather than follow a U.S. path of seeking to shut out Chinese tech giants.
Commenting on the government’s telecoms supply chain review in a statement, Ciaran Martin, CEO of the U.K.’s National Cyber Security Centre, said: “As the UK’s lead technical authority, we have worked closely with DCMS [the Department for Digital, Culture, Media and Sport] on this review, providing comprehensive analysis and cyber security advice. These new measures represent a tougher security regime for our telecoms infrastructure, and will lead to higher standards, much greater resilience and incentives for the sector to take cyber security seriously.
“This is a significant overhaul of how we do telecoms security, helping to keep the UK the safest place to live and work online by ensuring that cyber security is embedded into future networks from inception.”
Although, tougher security standards for telecoms combined with updated regulations that bake in major fines for failure suggest Huawei will have its work cut out not to be excluded by the market, as carriers will be careful about vendors as they work to shrink their risk.
Earlier this year a report by an oversight body that evaluates its approach to security was withering — finding “serious and systematic defects” in its software engineering and cybersecurity competence.
Powered by WPeMatico
Huawei 5G indecision is hitting UK’s relations abroad, warns committee
The U.K.’s next prime minister must prioritize a decision on whether or not to allow Chinese tech giant Huawei to be a 5G supplier, a parliamentary committee has urged — warning that the country’s international relations are being “seriously damaged” by ongoing delay.
In a statement on 5G suppliers, the Intelligence and Security committee (ISC) writes that the government must take a decision “as a matter of urgency.”
Earlier this week another parliamentary committee, which focuses on science and technology, concluded there is no technical reason to exclude Huawei as a 5G supplier, despite security concerns attached to the company’s ties to the Chinese state, though it did recommend it be excluded from core 5G supply.
The delay in the U.K. settling on a 5G-supplier policy can be linked not only to the complexities of trying to weigh and balance security considers with geopolitical pressures but also ongoing turmoil in domestic politics, following the 2016 EU referendum Brexit vote — which continues to suck most of the political oxygen out of Westminster. (And will very soon have despatched two U.K. prime ministers in three years.)
Outgoing PM Theresa May, whose successor is due to be selected by a vote by Conservative Party members next week, appeared to be leaning toward giving Huawei an amber light earlier this year.
A leak to the press from a National Security Council meeting back in April suggested Huawei would be allowed to provide kit, but only for non-core parts of 5G networks — raising questions about how core and non-core are delineated in the next-gen networks.
The leak led to the sacking by May of the then defense minister, Gavin Williamson, after an investigation into confidential information being passed to the media in which she said she had lost confidence in him.
The publication of a government Telecoms Supply Chain Review, whose terms of reference were published last fall, has also been delayed — leading carriers to press the government for greater clarity last month.
But with May herself now on the way out, having agreed in May to step down as PM, the decision on 5G supply is on hold.
It will be down to either Boris Johnson or Jeremy Hunt, the two remaining contenders to take over as PM, to choose whether or not to let the Chinese tech giant supply U.K. 5G networks.
Whichever of the men wins the vote, they will arrive in the top job needing to give their full attention to finding a way out of the Brexit morass — with a mere three months til an October 31 Brexit extension deadline looming. So there’s a risk 5G may not seem as urgent an issue and a decision again be kicked back.
In its statement on 5G supply, the ISC backs the view expressed by the public-facing branch of the U.K.’s intelligence service that network security is not dependent on any one supplier being excluded from building it — writing that: “The National Cyber Security Centre… has been clear that the security of the UK’s telecommunications network is not about one company or one country: the ‘flag of origin’ for telecommunications equipment is not the critical element in determining cyber security.”
The committee argues that “some parts of the network will require greater protection” — writing that “critical functions cannot be put at risk” but also that there are “less sensitive functions where more risk can be carried”, albeit without specifying what those latter functions might be.
“It is this distinction — between the sensitivity of the functions — that must determine security, rather than where in the network those functions are located: notions of ‘core’ and ‘edge’ ate therefore misleading in this context,” it adds. “We should therefore be thinking of different levels of security, rather than a one size fits all approach, within a network that has been built to be resilient to attack, such that no single action could disable the system.”
The committee’s statement also backs the view that the best way to achieve network resilience is to support diversity in the supply chain — i.e. by supporting more competition.
But at the same time it emphasizes that the 5G supply decision “cannot be viewed solely through a technical lens — because it is not simply a decision about telecommunications equipment.”
“This is a geostrategic decision, the ramifications of which may be felt for decades to come,” it warns, raising concerns about the perceptions of U.K. intelligence sharing partners by emphasizing the need for those allies to trust the decisions the government makes.
It also couches a U.K. decision to give Huawei access a risk by suggesting it could be viewed externally as an endorsement of the company, thereby encouraging other countries to follow suit — without paying the full (and it asserts vitally) necessary attention to the security piece.
“The UK is a world leader in cyber security: therefore if we allow Huawei into our 5G network we must be careful that that is not seen as an endorsement for others to follow. Such a decision can only happen where the network itself will be constructed securely and with stringent regulation,” it writes.
The committee’s statement goes on to raise as a matter of concern the U.K.’s general reliance on China as a technology supplier.
“One of the lessons the UK Government must learn from the current debate over 5G is that with the technology sector now monopolised by such a few key players, we are over-reliant on Chinese technology — and we are not alone in this, this is a global issue. We need to consider how we can create greater diversity in the market. This will require us to take a long term view — but we need to start now,” it warns.
It ends by reiterating that the debate about 5G supply has been “unnecessarily protracted” — pressing the next U.K. prime minister to get on and take a decision “so that all concerned can move forward.”
Powered by WPeMatico
UK sets out plan to spend billions on fiber and 5G broadband for all
The UK government has set out a package of measures it’s hoping will futureproof domestic networks and boost international competitiveness by supporting a nationwide rollout of full fiber broadband and 5G mobile technology.
The Future Telecoms Infrastructure Review, published today, follows the announcement of a market review last year as part of the government’s Industrial Strategy as it seeks to chart a technology-enabled course for growth and competitiveness.
Yet, at the same time, the UK seriously lags several European competitors on the fiber broadband front — so the strategy is also intended to try to reboot current poor performance.
The government says its telecoms plan emphasizes greater consumer choice and initiatives to promote quicker rollout — and an eventual full switch over — from copper to fiber.
It wants full fibre broadband to reach 15 million premises (up from the ’10M over the next decade’ set out in the Conservative party manifesto) by 2025, and also 5G mobile network coverage to reach the majority of the population.
By 2033, it wants full fiber broadband coverage to reach across all of the UK.
Currently the UK only has 4% full fiber connections, which compares dismally to 71% in Spain and 89% in Portugal. While France has around 28% — which the government notes is “increasing quickly”.
Included in the government’s strategy is public investment in full fiber for rural areas; and new legislation to guarantee full fiber connections in new build developments; as well as a series of regulatory reforms intended to drive investment and competition — which it says will be tailored to different local market conditions.
It’s also planning for an industry-led switch over from copper to full fiber — to avoid businesses being saddled with the expense and burden of running copper and fiber networks in parallel.
There’s no fixed timing for this, as the government says it will depend on the pace of fiber rollouts and take-up, but it suggests it’s “realistic to assume that switchover could happen in the majority of the country by 2030”.
To boost competition to drive commercial fiber rollouts, the government is proposing regulatory reform to allow for “unrestricted access” to Openreach ducts and poles — i.e. the wholly BT-owned company’s own physical infrastructure where fiber can be laid — for both residential and business broadband use, including for essential mobile infrastructure.
It also wants to open up other avenues for laying broadband fiber, saying other existing infrastructure (including pipes and sewers) owned by other utilities such as power, gas and water, should be “easy to access, and available for both fixed and mobile use”.
And it says it will shortly publish consultations on the proposed legislative changes to streamline wayleaves and mandate fiber connections in new builds.
Another key recommendation in the review, given that the expense of digs to lay fiber remains one of the biggest barriers to broadband upgrades, is for a new nationwide framework aimed at reducing the costs, time and disruption caused by street-works by standardising the approach across the country.
With its planned regulatory tweaks, the government reckons that market competition will be able to deliver full fiber networks across the majority of the UK (~80%) — leaving around ~20% which it’s expecting will require “bespoke solutions to ensure rollout of networks”. And for around half of that fifth it also expects taxpayer funding will be needed to deliver a fiber/5G upgrade.
It estimates that nationwide availability of ‘full fiber’ is likely to require additional (public) funding of around £3BN to £5BN to support commercial investment in the final ~10% of areas that would otherwise be overlooked — stressing that these “often rural areas must not be forced to wait until the rest of the country has connectivity before they can access gigabit-capable networks”.
So it’s planning to pursue an “outside-in” strategy, allowing network competition to serves commercially viable areas while laying down government support investment in parallel on what it describes as “the most difficult to reach areas”.
“We have already identified around £200M within the existing Superfast broadband programme that can further the delivery of full fibre networks immediately,” it notes on that.
Although it’s not clear at this stage how the government intends to fund the full proposals for a taxpayer-funded broadband bill running to multiple billions.
On the mobile connectivity front, it’s proposing increased access to spectrum for “innovative 5G services”, and says it will allow mobile network operators to make far greater use of government buildings to boost coverage across the UK.
“We should consider whether more flexible, shared spectrum models can maintain network competition between MNOs while also increasing access to spectrum to support new investment models, spurring innovation in industrial internet of things, wireless automation and robotics, and improving rural coverage,” it writes on that.
Over the longer term it says is expecting to see a more converged telecoms sector — so it’s leaving itself some ‘last mile’ wiggle room on the ‘full fiber’ push, for example by pointing out that: “Fixed fibre networks and 5G are complementary technologies, and 5G will require dense fibre networks. In some places, 5G may provide a more cost-effective way of providing ultra-fast connectivity to homes and businesses.”
“We want everyone in the UK to benefit from world-class connectivity no matter where they live, work or travel,” said the new Secretary of State for digital, culture, media and sport, Jeremy Wright, commenting on the review in a statement, and dubbing it a “radical new blueprint for the future of telecommunications in this country”.
“[The strategy] will increase competition and investment in full fiber broadband, create more commercial opportunities and make it easier and cheaper to roll out infrastructure for 5G,” he added.
The UK’s incumbent telco, BT, which owns and operates the country’s largest broadband network, has long pursued the opposite strategy to the one the government is here pursuing: i.e. by seeking to eke out its own ex-monopoly copper infrastructure, such as by applying technologies that speed up fiber to the cabinet technology, instead of making the major financial commitment to invest in substantially expanding full fiber to the home coverage (and thereby futureproof national network infrastructure).
For years competitors (and, indeed, frustrated consumers) have also accused the company of foot-dragging on providing access to its network — thereby undermining other commercial players’ ability to fund and build out next-gen network coverage.
Last year BT agreed with telecoms watchdog Ofcom to legally separate its network division Openreach — around a decade after a functional separation has been imposed by the regulator. Albeit, it’s still not the full structural separation some have called for.
“It is too early to determine whether legal separation will be sufficient to deliver positive changes on investment in full fibre infrastructure,” writes the government in its review, adding that it will “closely monitor legal separation, including Ofcom’s reports on the effectiveness of the new arrangements”.
“The Government will consider all additional measures if BT Group fails to deliver its commitments and regulatory obligations, and if Openreach does not deliver on its purpose of investing in ways that respond to the needs of its downstream customers,” it adds.
Commenting on the government’s strategy, an Openreach spokesperson told us: “We’re encouraged by the Government’s plan to promote competition, tackle red tape and bust the barriers to investment. As the national provider, we’re ambitious and want to build full fibre broadband to 10 million premises and beyond — so it’s vital that this becomes an attractive investment without creating digital inequality or a lack of choice for consumers and businesses across the country. As the Government acknowledges, the economics of building digital infrastructure remain challenging for everyone, and we believe a review of the current business rates regime is necessary to stimulate the whole sector.
“We’re already building full fibre to around 10,000 homes and businesses every week, and by 2020 we’ll have reached 3 million,” the spokesperson added. “We have a huge, world class engineering team and wherever we build, we’ll deliver the best quality network with the highest levels of service and built-in competition and choice.”
One aspect of the strategy the government is not trumpeting quite so loudly in its PR around the announcement is an intent to promote what it describes as “stable and long-term regulation” as part of its strategy to drive increased competition and unlock business investments.
On this it writes that the overarching strategic priority to “promote efficient competition and investment in world-class digital networks” should be “prioritised over interventions to further reduce retail prices in the near term, recognising these longer-term benefits”.
In the review it suggests moving to longer, five year review periods, for instance — saying this “could provide greater regulatory stability and promote investment”. It also writes that it wants Ofcom to publish guidance that “clearly sets out the approach and information it will use in determining a ‘fair bet’ return”.
It’s therefore possible that UK consumers could end up paying twice over to help fund national fiber broadband infrastructure upgrades; i.e. not just via direct subsidies to fund rural rollouts but also, potentially, via higher broadband prices too. Albeit, the government says that in its view “the interests of consumers are safeguarded as fiber markets become more competitive”.
Though in less commercially attractive areas, where there could be a greater risk of price inflation, the government’s small print does include the recognition that regulatory interventions — such as price controls — may indeed be required. Though of course any such controls would only come in after consumers had been being stung…
“For areas where there is actual or prospective effective competition between networks, Government would not anticipate the need for regulation,” it writes. “For other areas, we would expect the regulatory model for to evolve over time as networks are established. If market power emerges, regulated access (including price controls) may be needed to address competition concerns. These detailed regulatory decisions will be for Ofcom to take.”
This report was updated with comment from Openreach
Powered by WPeMatico