Huawei and 5G: Why the UK ignored US warnings and said yes
The UK seems set to allow Huawei to provide at least some of the technology to power the country's next-generation 5G mobile networks, despite ongoing warnings from the US about the security risks of allowing the Chinese telecoms company to be involved.
Reports suggest that a review of 5G security by the UK government will allow Huawei technology to be used in the edges of these networks but not in the sensitive core, despite the reservations of a number of members of the UK cabinet.
5G sits at the heart of a complex web of considerations around technology, economics, national security - and international relations – all of which are likely to have played some part in the decision.
At the technology level, 5G is important because it will provide the invisible infrastructure for a vast number of future services, from self-driving cars to smart cities and the fast-growing Internet of Things.
SEE: IT pro's guide to the evolution and impact of 5G technology (free PDF)
All of these will rely on 5G's ability to connect up millions of devices to share information wirelessly. Using 5G to introduce new services or simply make existing ones more efficient could have substantial economic benefits – and significantly boost the countries at the forefront.
However, because these 5G networks are likely to become the core infrastructure on which digital services are built, security becomes an even more critical factor. The concern is not simply that hostile powers could snoop on data running over these networks but even that they could stop the services built on top from functioning smoothly.
As the advent of 5G networks has drawn nearer, the US in particular has grown increasingly concerned that a Chinese company would be providing much of the technology for these networks.
The US has long had concerns about the Chinese networking giant, banning Huawei from government contracts back in 2014. More recently it has been increasing pressure on countries, including the UK, to dump Huawei, even going so far as to warn allies that it would share less intelligence with nations that use Huawei networks. Australia has blocked Huawei from its 5G networks on national security grounds, and the New Zealand government late last year turned down a request from one operator to use Huawei kit in its 5G network. Europe is also worried about the security of 5G networks, too.
But the UK has had a very different relationship with Huawei. Its hardware has been used in UK telecoms networks for many years, and to mitigate security risks the UK government has for a number of years required the Chinese company to submit its products for review at a centre in Oxfordshire, which examines equipment for potential security flaws before it goes into service.
That doesn't mean everything is perfect – the latest report from the group which oversees the centre warns that it has uncovered "significant technical issues" in Huawei's engineering processes and "underlying defects" in its software engineering and cybersecurity processes, but said the problems it identified were not the result of Chinese state interference.
And this process has given the UK a frame of reference over 15 years for dealing with any security risk in Huawei technology. The UK's Nation Cyber Security Centre (NCSC) has said that the system is working and that the risk is manageable.
Indeed the agency has also warned that one of the other risks to network security would be a very small set of suppliers – a situation that could occur if Huawei was banned from the market.
Mobile operators have warned that banning Huawei from providing equipment would also hurt their plans. A ban would require them to to strip out equipment from their existing networks, costing hundreds of millions and also push their plans back by as much as 18 months.
Huawei itself has consistently rejected claims that it would allow the Chinese government to use its technology for spying, and has pointed out that the US itself has engaged in cyber spying, pointing to the revelations by NSA contractor-turned whistle blower Edward Snowden. For some, the row over Huawei is at least as much about the ongoing US-China trade battle as it is about national security.
SEE: A winning strategy for cybersecurity (ZDNet special report) Download the report as a PDF (TechRepublic)
Critics of Huawei, however, point to the well-documented cyber-espionage campaigns of the Chinese government to steal secrets, and to the power of the Chinese Communist Party over the nation's businesses as a reason for concern. Just today Rob Joyce, senior cyber security advisor, NSA warned: "There are nations who intend to come at our infrastructure and cause a threat. We're not going to use networks which pose a threat – we're not going to have Huawei in our sensitive networks," he said.
Part of the weakness of the US position, however, is that it has provided no strong evidence for its claims, and the head of the UK's NCSC recently said his agency also has had no evidence of deliberately malevolent activity by Huawei.
Allowing Huawei to provide the technology for the edge of 5G networks – the arrays of antennas which crowd the roofs of many office blocks is a compromise which allows the UK to keep close to the front of the pack with 5G, while not upsetting either the US or China too much.
Not everyone agrees with the decision; as well as the cabinet split, Tom Tugendhat, chairman of the Commons foreign affairs committee, warned: "Allowing Huawei into the UK's 5G infrastructure would cause allies to doubt our ability to keep data secure and erode the trust essential to #FiveEyes cooperation. There's a reason others have said no." And the issue isn't entirely settled either until the decision is formally announced, so there is still at least some room for it to change again.
Still, there are unresolved questions. First, it's not clear whether the differentiating between the core of a 5G network and the periphery is a real one from a security point of view, although network operators argue that limiting a vendor to something like the antennas means it's harder for a vulnerability to have a wider impact on the network. Second, it's not clear what affect this decision will have longer term on the relationship between the UK and its 'Five Eyes' intelligence partners who are taking a different approach.
"A flag of origin of 5G equipment is important, but it's a secondary factor. It's a hugely complex challenge and it's going to span the next few decades – how we deal with it will be crucial for our prosperity," said Jeremy Fleming, the director of GCHQ today.
The UK may have made one decision about the future of 5G but the implications are likely to be playing out for years to come.