3rd Party Risk Management , Cyberwarfare / Nation-State Attacks , Endpoint Security
Britain's 5G Policy Failure: No Ideal Alternative to Huawei
Western Governments Have Failed to Counter China's Move for Technology DominanceBritain's U-turn on Huawei, announcing that it will ban the Chinese manufacturer's gear from its 5G networks, highlights this as yet unresolved problem: What are the alternatives?
See Also: How to Take the Complexity Out of Cybersecurity
Due to years of underinvestment in alternative technologies and domestic manufacturing capabilities, Britain finds that it has no access to trusted options that are as advanced or inexpensive as what Chinese manufacturers can offer. But the same can also be said of the U.S. and its other allies.
"The truth is, this is a failure of industrial policy in the West, dating back to the last decade of the last century, when we allowed China to become the monopoly supplier, effectively, of the best in 5G, and we ceded that territory," Robert Hannigan, who headed Britain's GCHQ intelligence agency from 2014 to 2017, told Britain's Radio 4 on Wednesday.
Belatedly, some countries are now trying to catch up. In the U.S., for example, lawmakers have proposed creating a $1 billion fund to accelerate the creation and adoption of trusted, Western-built options over the next 10 years. Britain and the EU, however, have yet to signal if they might pursue such measures as well.
But 5G is just part of China's bigger strategic technology agenda, which Beijing is already actively pursuing.
"My worry is that this is one particular tactical issue," Hannigan said. "What about all the other technology that China is investing heavily in - artificial intelligence, robotics? They will be world-leading, in many respects. And we need a sensible discussion in the West about: What do we really care about? What do we need to protect? What do we need Western manufacturers to be investing in? And how are we going to incentivize that? So that's the big picture."
The 'Huawei Question'
Britain's reversal on Huawei comes just six months after Prime Minister Boris Johnson announced that its equipment could be used for the country's 5G infrastructure. In January, based on advice from GCHQ's National Cyber Security Center, which runs a Huawei testing lab, the nation's four largest telecommunications carriers were allowed to use equipment from "high-risk vendors" - of which Huawei is one - for up to 35% of non-sensitive parts of their 5G and gigabit-capable networks for at least the next three years.
At the time, Johnson acknowledged U.S. pressure on its allies to ban Huawei, backed by threats that it might stop sharing intelligence with members of the trusted Five Eyes alliance - comprising Australia, Canada, New Zealand, U.K. and U.S. - if they failed to do so.
"If people oppose one brand or another, then they have to tell us what's the alternative," Johnson said at the time. "On the other hand, let's be clear, I don't want, as the U.K. prime minister, to put in any infrastructure that is going to prejudice our national security or our ability to cooperate with Five Eyes intelligence partners."
Huawei welcomed his decision, saying it showed a sensible blueprint for how the company's gear could be adopted in other countries.
Britain's plan appeared to provide a workable approach to the so-called "Huawei question," which is whether Chinese networking equipment manufacturers can be trusted, or if their technology might be subverted by the Chinese government to spy via other nations' infrastructure. Of particular concern is China's National Intelligence Law of 2017, which the nation could use to order a company to act in a manner that might harm other nations.
But intelligence experts have also warned that China could instruct domestic suppliers to halt software or hardware updates or replacements to foreign telecommunications firms, for example, as part of a trade dispute.
US Export-Control Move Changes Game
In May, however, the U.S. altered an export control rule, called the Foreign-Produced Direct Product Rule - aka FDPR - to prohibit companies from supplying chips to Huawei, if any aspect of the design or manufacture of those chips involved U.S. technology, including software.
NCSC has now concluded that those sanctions will leave Huawei unable to easily source the reliable, well-tested semiconductors that it needs for its 5G gear.
"So, it seems that Huawei's long-term ability to build products using state-of-the-art technology has been severely affected," Ian Levy, the NCSC's technical director, said in a Tuesday blog post detailing the NCSC's latest findings. "We think that Huawei products that are adapted to cope with the FDPR change are likely to suffer more security and reliability problems because of the massive engineering challenge ahead of them, and it will be harder for us to be confident in their use within our mitigation strategy."
'Updated Technical Advice'
The NCSC's revised assessment helped drive the government's National Security Council, chaired by the prime minister, to reverse its original decision on allowing high-risk vendors' technology to be part of the nation's 5G networks.
"Following U.S. sanctions against Huawei and updated technical advice from our cyber experts, the government has decided it is necessary to ban Huawei from our 5G networks," said Oliver Dowden, the government minister who leads the Department for Digital, Culture, Media and Sport, which oversees NCSC.
"No new kit is to be added from January 2021, and U.K. 5G networks will be Huawei-free by the end of 2027," he said on Tuesday. "This decisive move provides the industry with the clarity and certainty it needs to get on with delivering 5G across the U.K."
Telecommunications providers in Britain have warned that the move could delay 5G rollout by two years and make it more expensive. Equipment from other manufacturers is also available. Huawei's two biggest competitors are Sweden's Ericsson and Finland's Nokia. But analysts say the selling point of equipment built by Huawei, which is heavily subsidized by the Chinese state, is that it is much less expensive than rivals' offerings.
Huawei has also urged the British government to reconsider its latest decision, with a spokesperson telling Information Security Media Group that the move was driven not by security challenges, but rather U.S. politics and trade policy.
But some experts say otherwise. "The recent U.S. sanctions make Huawei opaque as well as untrusted," Hannigan told BBC Radio 4. "We've always thought they were untrusted and high-risk, but were confident that we could manage them with certain constraints and within a very limited role. But the recent sanctions on semiconductors on chips make that very difficult to do."
Trump Takes Credit
As Britain finalizes its exit from the EU and seeks to forge trade deals with the U.S. and China, of course its 5G supplier question may have a diplomatic impact, presaging blowback from Beijing.
The U.S., however, has signaled approval for Britain's reversal, with President Donald Trump claiming credit for single-handedly bringing it about.
"We confronted untrustworthy Chinese technology and telecom providers, we convinced many countries, many countries, and I did this myself, for the most part, not to use Huawei, because we think it's an unsafe security risk, it's a big security risk, and I talked many countries out of using it, if they want to do business with us, they can't use it," Trump said on Tuesday.
Update: On July 16, the U.S. secretary of state and British foreign secretary agreed that the two countries would work together to promote "trusted 5G solutions."
"Secretary of State Michael R. Pompeo spoke with U.K. Foreign Secretary Dominic Raab today and discussed the U.K.'s decision to prevent the use of unsecure technology in its 5G networks," Morgan Ortagus, a spokeswoman for the U.S. State Department, said on Thursday. "The secretary and foreign secretary agreed to work together to promote the development of additional trusted 5G solutions."