No pan-EU Huawei ban as Commission endorses 5G risk mitigation plan

Published January 29, 2020

The European Commission has endorsed a risk mitigation approach to managing 5G rollouts across the bloc — meaning there will be no pan-EU ban on Huawei. Rather it’s calling for Member States to coordinate and implement a package of “mitigating measures” in a 5G toolbox it announced last October and has endorsed today.

“Through the toolbox, the Member States are committing to move forward in a joint manner based on an objective assessment of identified risks and proportionate mitigating measures,” it writes in a press release.

It adds that Member States have agreed to “strengthen security requirements, to assess the risk profiles of suppliers, to apply relevant restrictions for suppliers considered to be high risk including necessary exclusions for key assets considered as critical and sensitive (such as the core network functions), and to have strategies in place to ensure the diversification of vendors”.

The move is another blow for the Trump administration — after the UK government announced yesterday that it would not be banning so-called “high risk” providers from supplying 5G networks.

Instead the UK said it will place restrictions on such suppliers — barring their kit from the “sensitive” ‘core’ of 5G networks, as well as from certain strategic sites (such as military locations), and placing a 35% cap on such kit supplying the access network.

However the US has been amping up pressure on the international community to shut the door entirely on the Chinese tech giant, claiming there’s inherent strategic risk in allowing Huawei to be involved in supplying such critical infrastructure — with the Trump administration seeking to demolish trust in Chinese-made technology.

Next-gen 5G is expected to support a new breed of responsive applications — such as self-driving cars and personalized telemedicine — where risks, should there be any network failure, are likely to scale too.

But the Commission take the view that such risks can be collectively managed.

The approach to 5G security continues to leave decisions on “specific security” measures as the responsibility of Member States. So there’s a possibility of individual countries making their own decisions to shut out Huawei. But in Europe the momentum appears to be against such moves.

“The collective work on the toolbox demonstrates a strong determination to jointly respond to the security challenges of 5G networks,” the EU writes. “This is essential for a successful and credible EU approach to 5G security and to ensure the continued openness of the internal market provided risk-based EU security requirements are respected.”

The next deadline for the 5G toolbox is April 2020, when the Commission expects Member States to have implemented the recommended measures. A joint report on their implementation will follow later this year.

Key actions being endorsed in the toolbox include:

Strengthen security requirements for mobile network operators (e.g. strict access controls, rules on secure operation and monitoring, limitations on outsourcing of specific functions, etc.);
Assess the risk profile of suppliers; as a consequence, apply relevant restrictions for suppliers considered to be high risk – including necessary exclusions to effectively mitigate risks – for key assets defined as critical and sensitive in the EU-wide coordinated risk assessment (e.g. core network functions, network management and orchestration functions, and access network functions);
Ensure that each operator has an appropriate multi-vendor strategy to avoid or limit any major dependency on a single supplier (or suppliers with a similar risk profile), ensure an adequate balance of suppliers at national level and avoid dependency on suppliers considered to be high risk; this also requires avoiding any situations of lock-in with a single supplier, including by promoting greater interoperability of equipment;

The Commission also recommends that Member States should contribute towards increasing diversification and sustainability in the 5G supply chain and co-ordinate on standardization around security objectives and on developing EU-wide certification schemes.

UK carriers warn over ongoing Huawei 5G uncertainty: Report

Published June 11, 2019

UK mobile network operators have drafted a letter urging the government for greater clarity on Chinese tech giant Huawei’s involvement in domestic 5G infrastructure, according to a report by the BBC.

Huawei remains under a cloud of security suspicion attached to its relationship with the Chinese state, which in 2017 passed legislation that gives authorities more direct control over the operations of internet-based companies — leading to fears it could repurpose network kit supplied by Huawei as a conduit for foreign spying.

Back in April, press reports emerged suggesting the UK government was intending to give Huawei a limited role in 5G infrastructure — for ‘non-core’ parts of the network — despite multiple cabinet ministers apparently raising concerns about any role for the Chinese tech giant. The UK government did not officially confirmed the leaks.

In the draft letter UK operators warn the government that the country risks losing its position as a world leader in mobile connectivity as a result of ongoing uncertainty attached to Huawei and 5G, per the BBC’s report.

The broadcaster says it has reviewed the letter which is intended to be sent to cabinet secretary, Mark Sedwill, as soon as this week.

It also reports that operators have asked for an urgent meeting between industry leaders and the government to discuss their concerns — saying they can can’t invest in 5G infrastructure while uncertainty over the use of Chinese tech persists.

The BBC’s report does not name which operators have put their names to the draft letter.

We reached out to the major UK mobile network operators for comment.

A spokesperson for BT, which owns the mobile brand EE — and was the first to go live with a consumer 5G service in the UK last month — told us: “We are in regular contact with UK government around this topic, and continue to discuss the impact of possible regulation on UK telecoms networks.”

A Vodafone spokesperson added: “We do not comment on draft documents. We would ask for any decision regarding the future use of Huawei equipment in the UK not to be rushed but based on all the facts.”

At the time of writing Orange, O2 and 3 had not yet responded to requests for comment.

A report in March by a UK oversight body set up to evaluate Huawei’s security was damning — describing “serious and systematic defects” in its software engineering and cyber security competence, although it resisted calls for an outright ban.

Reached for comment on the draft letter, a spokesperson for the Department for Digital, Culture, Media and Sport told us it has not yet received it — but sent the following statement:

The security and resilience of the UK’s telecoms networks is of paramount importance. We have robust procedures in place to manage risks to national security and are committed to the highest possible security standards.

The Telecoms Supply Chain Review will be announced in due course. We have been clear throughout the process that all network operators will need to comply with the Government’s decision.

The spokesperson added that the government has undertaken extensive consultation with industry as part of its review of the 5G supply chain, in addition to regular engagement, and emphasized that it is for network operators to confirm the details of any steps they have taken in upgrading their networks.

Carriers are aware they must comply with the government’s final decision, the spokesperson added.

At the pan-Europe level, the European Commission has urged member states to step up individual and collective attention on network security to mitigate potential risks as they roll out 5G networks.

The Commission remains very unlikely to try to impose 5G supplier bans itself. Its interventions so far call for EU member states to pay close attention to network security, and help each other by sharing more information, with the Commission also warning of the risk of fragmentation to its flagship “digital single market” project if national governments impose individual bans on Chinese kit vendors.