What the UK government’s Huawei decision means for 5G

Following a long awaited call-to-action, prime minister Boris Johnson announced at a meeting with the National Security Council (NCS) that Huawei will be given a limited go-ahead, despite pressure from the National Cyber Security Centre (NCSC) and the US government, which is currently embroiled in a trade war with China.

The decision will result in a ban from Huawei supplying equipment to any core “sensitive” parts of the networks, sensitive locations such as nuclear sites and military bases, and to be limited to “a minority presence of no more than 35 percent in the periphery of the network, known as the access network, which connect devices and equipment to mobile phone masts.”

This guidance follows the Telecoms Supply Chain Review, first published in July 2019 and conducted by the Department for Digital, Culture, Media and Sport with input from industry, international partners, and the National Cyber Security Centre.

The next step for the government is to take legislation to parliament to ensure that this new telecoms security framework is put in place.

Striking a compromise

The decision is essentially a compromise between assuaging security concerns surrounding the Chinese vendor and the need to maintain momentum with the UK’s 5G rollout plans.

It arrives this week after escalating rhetoric, largely led by the US, that painted Huawei as an existential threat to national security – but was contradicted by close cooperation between the British government and Huawei for more than a decade, where the vendor’s networking equipment and code has been under close scrutiny for security reasons.

Victor Zhang, vice president at Huawei, said in a statement: “Huawei is reassured by the UK government’s confirmation that we can continue working with our customers to keep the 5G roll-out on track. This evidence-based decision will result in a more advanced, more secure and more cost-effective telecoms infrastructure that is fit for the future. It gives the UK access to world-leading technology and ensures a competitive market.”

Huawei currently has its equipment present in three of the four major UK 5G networks: EE, Three and Vodafone.

“We have supplied cutting-edge technology to telecoms operators in the UK for more than 15 years,” Zhang added. “We will build on this strong track record, supporting our customers as they invest in their 5G networks, boosting economic growth and helping the UK continue to compete globally.”

To date, there has been little in the way of hard evidence that Huawei poses a security threat, but nevertheless, countries considering adopting its 5G infrastructure have been riven by debate on the matter. For example, although the German IT watchdog could not find any proof that the company was spying, the country has postponed a decision on the firm. But chancellor Merkel has acknowledged that a diversity of choice in the 5G market is critical for a successful rollout.

There has been no outright ban of Huawei anywhere in the EU to date, but countries are weighing their options and taking their own approaches. Partly state-owned telco Orange does not use Huawei in France, for example, but Reuters points out that it relies on the vendor for its operations in Spain and Poland.

What does the decision mean?

The guidance also calls for a ban on equipment from high risk vendors being present in all “safety related and safety critical networks in Critical National Infrastructure,” which includes any sectors related to chemicals, civil nuclear, communications, defence, emergency services, energy, finance, food, government, health, space, transport, and water.

That’s a wide range of sectors that will be prevented from working with the company, and could possibly introduce headaches in the public sector for network modernisation efforts, especially as they seek to take advantage of the potential benefits of 5G in the internet of things. 

The NCSC does not provide a list of what it considers high risk vendors (HRVs), instead encouraging telecoms operators “who are considering introducing new vendors into their networks to discuss that with us as soon as possible”.

It does however directly encourage companies “whose Huawei estates currently exceed the recommended level for an HRV, to reduce to the recommended level as soon as practical. We understand that this takes time, but consider that it should be possible for all operators to reduce their use of HRVs to the recommended levels within three years.”

Although its involvement remains limited, the potential of Huawei having any involvement in the UK network at all has caused months of controversy with concerns spreading as far as the US.

“Whilst the US has taken a more hard-line stance, the reality is that a lot of the major UK operators (Vodafone, EE and Three) have already purchased Huawei’s 5G infrastructure which means a ban would have more impact in the UK than the US,” Jimmy Jones, telecoms cybersecurity expert at Positive Technologies said.

Despite this, together with the NCS, Boris Johnson will hope that the new restrictions will mitigate any potential risks posed to national security and the supply chain.

“If Huawei was taken away as an option, this whole process – including testing – would have to be started all over again. Ultimately any country that does that is facing a more expensive network and a delay that could result in its national infrastructure being inferior compared to other countries,” Jones added.

The government has also committed to diversifying the supply chain when it comes to 5G and gigabit-enabled networks, which will commit further to “attract established vendors who are not present in the UK, supporting the emergence of new, disruptive entrants to the supply chain, and promoting the adoption of open, interoperable standards that will reduce barriers to entry.”

And the fact remains that Huawei is at present the leader in 5G networking technologies. There are other players out there, but in terms of capability and price, Huawei is ahead.

So the impact here is multifaceted, from forcing companies to reassess their next generation network architectures in light of the new guidance, to political and national security pressures.

Credit: Hannah Williams, Computerworld