Huawei You GO! UK Green Lights Firm for non-Core Telecoms Kit

After a protracted period of uncertainty the UK Government has today confirmed that kit from Chinese technology giant Huawei and other “high risk vendors” will be banned from the “sensitive” core of future UK 5G and “gigabit-capable” fixed broadband ISP networks, although non-core 5G kit (antennas, street cabinets etc.) will be exempt.

The decision appears to uphold an unofficial ruling made by the former Prime Minister, Theresa May, last year (here). Some had been wondering whether the new PM, Boris Johnson, would take a tougher line, particularly given his close alignment to Donald Trump (President of the USA), although in the end he appears to have upheld May’s decision.

Part of the reason for today’s decision is likely to be because completely banning Huawei could make the rollout of new “gigabit-capable” 5G, and possibly also fixed broadband ISP networks, both much slower and more expensive to achieve. This in turn would have impacted Boris’s recent £5bn pledge to ensure that every UK home can access gigabit (1Gbps) speed broadband networks by the end of 2025.

On the other hand 5G networks do seem set to increasingly blur the lines between core and non-core components, especially with the rising adoption of cloud-based and software defined networking (SDN) methods. Policing the new non-core rule could thus prove to be quite a challenge as networks evolve.

The Prime Minister chaired a meeting of the National Security Council (NSC) today, where it was agreed that the National Cyber Security Centre (NCSC) should issue guidance to UK Telecoms operators on high risk vendors following the conclusions of the Telecoms Supply Chain Review.

The advice is that high risk vendors should be:

* Excluded from all safety related and safety critical networks in Critical National Infrastructure.

* Excluded from security critical ‘core’ functions, the sensitive part of the network.

* Excluded from sensitive geographic locations, such as nuclear sites and military bases.

* Limited to a minority presence of no more than 35% in the periphery of the network, known as the access network, which connect devices and equipment to mobile phone masts (this will be kept under review to determine whether it should be further reduced as the market diversifies).

The government will now seek to legislate “at the earliest opportunity” to put in place the powers necessary to implement this tough new telecoms security framework. However at first glance that 35% rule might force some mobile operators to diversify their supply chains more, which may be harder to do in the mobile than fixed line environment (Openreach already seem to be doing this – here).

Baroness Morgan, UK Digital Secretary, said:

“We want world-class connectivity as soon as possible but this must not be at the expense of our national security. High risk vendors never have been and never will be in our most sensitive networks.

The government has reviewed the supply chain for telecoms networks and concluded today it is necessary to have tight restrictions on the presence of high risk vendors.

This is a UK-specific solution for UK-specific reasons and the decision deals with the challenges we face right now.

It not only paves the way for secure and resilient networks, with our sovereignty over data protected, but it also builds on our strategy to develop a diversity of suppliers.

We can now move forward and seize the huge opportunities of 21st century technology.”

The government said they were “certain” that these measures, taken together, will allow them to mitigate the potential risk posed by the supply chain and to combat the range of threats, whether cyber criminals, or state sponsored attacks. “Today’s decision marks a major change in the UK’s approach that will substantially improve the security and resilience of our critical telecoms networks,” said the announcement.

The move follows an earlier report from the oversight board of the Huawei Cyber Security Evaluation Centre (HCSEC), which warned that “further significant technical issues” had been identified in Huawei’s engineering processes, leading to “new risks in the UK telecommunications networks” (full summary). At the same time it also said that “no material progress has been made by Huawei in the remediation of the issues.”

The board said it could “only provide limited assurance” that all risks to national security from Huawei’s involvement in the UK’s critical networks could be sufficiently mitigated long-term. Naturally Huawei has always denied accusations that they are a security threat and in a public letter said, “Huawei has never and will never use UK-based hardware, software, or information gathered in the UK or anywhere else globally, to assist other countries in gathering intelligence. We would not do this in any country.”

However, critics of the company often point toward China’s new National Intelligence Law, which was passed in 2017 and demands that organisations “support, co-operate with and collaborate in national intelligence work.” The absence of true democracy in China might thus, they argue, make it very difficult for any company to refuse such a request.

Meanwhile Donald Trump has taken a much stricter line and effectively banned companies around the world from working with Huawei, with some exceptions. The move has stunted the firm’s Smartphone and other consumer products, such as by removing access to Google’s popular Apps, although that aspect is less relevant to their mobile and broadband infrastructure business.

The difficulty for telecoms operators is that Huawei makes generally good and affordable kit. A lot of operators and broadband ISPs are already working closely with the Chinese firm in order to deploy new networks (e.g. 5G and fibre broadband) and any aggressively imposed restrictions would thus impact those plans. The alternatives from Ericsson, Nokia and Samsung are not as attractive to many operators (ZTE is another but they’ve already been effectively banned).

Meanwhile BT (EE) has already confirmed that they’ve removed related kit from their core mobile network (here) and Vodafone have “paused” similar deployments, albeit reluctantly, into their core (here). So far none of the operators have applied such measures to the less sensitive non-core part of their networks. For its part O2 has decided to skip the debate and go with 5G kit from Ericsson and Nokia.

Closing Thoughts

Operators have long warned that they can’t do 4G without 5G and any impact on the supply chain would thus have far reaching consequences. As such it looks like Boris, who was told by operators that his plans for “gigabit-capable broadband” might be in jeopardy if he didn’t show some flexibility, has blinked in the face of such a stark reality. Meanwhile many will be watching to see how the USA reacts.

At this point we haven’t really touched on the substances of the key security fears that surround Huawei and which are the trigger for all of this. One reason for that is because such issues are a matter for national security and intelligence agencies (i.e. they’re secret), which is virtually impossible for ordinary folk to judge. We wouldn’t be so bold as to assume we know better than they.

Furthermore it seems unlikely that so many countries would be creating such a fuss if there wasn’t a serious concern. At this point it’s worth remembering that such concerns have been around since long before Donald Trump came to power, although he has seemingly now linked much of it to the USA’s trading relationship with China, which adds a political dimension to what was once more of a debate about security.

UPDATE 2:12pm

Openreach has declined to comment but O2 (Telefonica UK) has responded.

An O2 Spokesperson said:

“Huawei kit makes up less than 1% of our owned network infrastructure. We will continue to develop our 5G network with minimum disruption with our primary vendors Nokia and Ericsson. Whilst we agree with the government that diversity of supply is the best way to serve customers, careful consideration must be given to the distinction between ‘core’ and ‘non-core’ as 5G networks develop and evolve. We’ll now take time to review the full report.”