Huawei approved for limited role in UK 5G infrastructure

Under pressure from the US government, which has banned the Chinese telecommunications giant from its own networks over security concerns, to deny Huawei any involvement, Baroness Morgan announced today the UK government will allow Huawei to supply up to 35% of the equipment for UK operators’ 5G networks. 

This announcement was delivered with a number of caveats, excluding high risk vendors from “all safety related and safety critical networks in Critical National Infrastructure,” in addition to exclusion from security critical network functions.

Moreover, Baroness Morgan announced additional “tight restrictions,” among which are exclusions from sensitive geographic locations.

The decision is a compromise between the government’s commitment to improving connectivity across the UK and security concerns around Huawei, particularly with respect to the risk of information leaking to the Chinese government.

The UK government assured however that it has firmly prioritised national security and the security of the Five Eyes alliance, and that nothing in the review has affected the UK’s ability to share sensitive intelligence.

Technical and security analysis has been undertaken by GCHQ’s national cyber security centre to inform the government’s decision.

By allowing Huawei limited involvement in the construction of radio access networks (RANs) but no involvement in their core, the government hopes to mitigate the security risks posed.

Baroness Morgan further listed the set of factors the government will evaluate vendors on to establish their risk.

• the strategic position or scale of the vendor in the UK network…
• the strategic position or scale of the vendor in other telecoms networks, particularly if the vendor is new to the UK market…
• the quality and transparency of the vendor’s engineering practices and cyber security controls…
• the vendor’s resilience both in technical terms and in relation to the continuity of supply to UK operators…
• the vendor’s domestic security laws in the jurisdiction where the vendor is based and the risk of external direction that conflicts with UK law…
• the relationship between the vendor and the vendor’s domestic state apparatus…

And finally, the availability of offensive cyber capability by that domestic state apparatus, or associated actors, that might be used to target UK interests.