EU’s “5G toolbox” has Huawei on the crosshairs

Even though it is considered a “high-risk vendor,” Huawei is still “in the game” in the European Union (EU) and Britain, with respect to participation in the rollout of the much talked-about 5G technology. This is despite the campaign and massive pressure mounted on the region (by the US) to do away with Huawei in matters of 5G. Thanks to Huawei’s strong portfolio in this technology area, the company’s own massive campaign in the region, and Britain’s apparent post-Brexit economic vulnerability to China!

The US, Japan, and Australia have effectively already blocked Huawei from participation in 5G rollout in their respective countries, and countries such as the Czech Republic, which otherwise had an excellent prior business relationship with Huawei, are becoming very hostile to the company in matters concerning 5G. As stated in this column in the 18 February 2019 article, “the reason for this is not far-fetched: the stakes in terms of national security are going to be exponentially high for a country because 5G will change the whole way that societies function.” I also pointed out in the article that “the 5G is not simply a matter of faster download speeds relative to 4G, the system is designed to be far more than that, linking everything from the cars you drive to the hospitals you visit, in a way that you probably still cannot imagine. The connectedness involved in IoT (Internet of Things) implies a potentially severe security risk for a country.”

In the referenced article, I mentioned that “against this backdrop is the widespread allegation of intellectual-property stealing by Huawei, coupled with China’s requirement that all Chinese companies be completely “accessible” to the Chinese government in terms of the data they keep.”

The EU’s guidance for their member countries on 5G, referred to as the “5G toolbox,” advises security matters and choosing between the US and China. On 29 January 2020, EU told its members to limit the participation of “high-risk vendors,” which is easily understood to mean the Chinese companies, particularly Huawei. In a plain language, EU recommends limiting but not banning Huawei in the rollout of 5G. On 28 January 2020, the British government said it would allow Huawei to develop part of its 5G networks, but that the company’s participation would be limited to a maximum of 35 percent of the network, and Huawei would be kept at an arm’s length from the more strategically sensitive infrastructure (and geographic locations), such as nuclear power (sites) and military (bases).

Specifically, Britain may allow high-risk vendors supply wireless infrastructure as antennas and base stations, which are not considered as posing a threat to safety of the network system.  That is, the allowed components will be limited to those that send data directly to consumer devices; while the protected components, considered to be the “nerve center of the network,” such as the servers, will route traffic within the system. British telcos, like Vodafone and BT, may need to look for alternative equipment suppliers to comply with the new limits on Huawei.

Britain appears to have some rationale for welcoming Huawei. Adam Satariano puts it this way (New York Times of 28 January 2020): “British officials have said the risk Huawei presents can be managed through oversight and by limiting its access to more critical areas of the network that handle sensitive data. Banning the company would delay the construction of its 5G network and cost billions to replace old equipment.” Specifically, both Vodafone and BT have reportedly expressed that “the rollout of 5G would be delayed by two or three years without Huawei, and the costs to consumers would be higher because Huawei’s equipment is cheaper than rivals.”

Some security experts do not agree with Britain’s decision to let Huawei in in any manner. Alan Woodward, a cybersecurity expert and visiting professor at the University of Surrey says “there is definitely a potential security risk. Is it manageable? That is the big question out there.” Dan Sabbagh in The UK Guardian of 30 January 2020 alludes to the statements by a senior Australian spy: “Britain has done the wrong thing in allowing Huawei to supply it with 5G equipment because China cannot be prevented from exploiting the technology for mass surveillance.”

Also, Simeon Gilding, a director of the Australian Signals Directorate until December 2019, is quoted as saying that “his country’s intelligence agency was unable to design cybersecurity controls that could prevent China from gaining backdoor access to Huawei. “We developed pages of cybersecurity mitigation measures to see if it was possible to prevent a sophisticated state actor from accessing our networks through a vendor. But we failed,” Gilding reportedly wrote in a blog for an Australian thinktank. Gilding is also quoted as saying that “the UK was relying on a flawed and outdated cybersecurity model to convince themselves that they can manage the risk that Chinese intelligence services could use Huawei’s access to UK telco networks to insert bad code”.

There is indeed some dilemma for Britain. Politically, it needs the US. But it also needs to foster relationships with China because of China’s large investments in Britain, and significant buying of British goods. Perhaps post-Brexit Britain may have to rely on China even more than before!  As they say, time will tell.