EST0037

Written evidence submitted by Oxford Information Labs Ltd

1. The challenges for the UK telecoms industry in a global market;

There are a small number of telecoms equipment and network providers in the world today, making the market concentrated. The UK does not have a home-grown equipment provider, which means that components will be internationally sourced and long-term contracts with providers will need to be managed.

In the past, procurement decisions have been driven primarily by price. As a result, the Chinese company Huawei is now well positioned to undercut any other bid for network infrastructure in the UK, regardless of other factors such as quality, cybersecurity and resiliency of the product. Unless the importance of other factors such as security and quality are elevated in procurement processes, it is likely that purchasers (UK telecoms operators) will continue to purchase the cheaper product.

The next generation of mobile broadband, 5G, will sit on top of existing 4G infrastructure.  A significant proportion of 4G infrastructure in the UK continues to use Huawei equipment, which will make an ongoing, mutually beneficial relationship with Huawei inevitable. With 5G, these ongoing contractual relationships for network equipment will be even more important as not only hardware but software will need to be managed and updated as bugs and vulnerabilities are uncovered.

A challenge for the UK will be to act in a way that is appropriate and transparent within a globally connected marketplace and supply chains. An apparently operational decision to purchase technical infrastructure in fact raises sensitive financial, diplomatic and national security concerns. One way to ensure that the wider issues are taken into account before purchase and installation would be to require a security review and giving it appropriate weight in the procurement process – such as the need for multiple vendors, the management of vulnerability reporting, and patching for known bugs. The findings of such security reviews can help to provide a wider basis for telecoms operators’ procurement decisions, other than price alone.

2. The opportunities and risks involved in purchasing equipment and services for the UK telecoms sector from foreign suppliers;

The purchase of equipment and services for 5G will involve long-term contractual relationships required for the maintenance and support of the UK’s networks. The contracted parties will necessarily have an ongoing and detailed knowledge of – and access to – the UK’s 5G networks going forward. This is one reason why a line is emerging between the ‘hardware’ and ‘software’ of 5G networks.

Due to the physical amount of equipment required for and financial cost of building 5G networks, there will be a period of vendor lock-in after the initial deployment. This is a critical point as 5G networks are quickly evolving as are the services that will run on top of them. Neither are fully understood or developed at this point. Purchasing particular equipment today will lock in particular vendors for the contract or equipment life cycle. Importantly, it may also lock the UK into other markets of add-on services and offerings which will build on 5G’s capabilities and are currently being developed by effectively creating a walled garden where only those products and services provided by particular vendors may be used.

For these reasons, it is essential that the UK’s network should adopt a multiple vendor strategy, so that equipment reflects internationally recognised standards, and is as interoperable as possible. Only a multiple vendor approach can mitigate the risk of vendor lock-in, increase competition among equipment providers, and ensure that telecoms operators have a full range of choices for add-on services and equipment going forward.

It is impossible to understand today all of the opportunities that will be offered by 5G. In the UK this might include remote healthcare such as telemedicine and remote surgery, and dedicated services for manufacturing or agriculture. However, these opportunities for specialised and dedicated services also pose a risk as this makes networks less ‘cookie-cutter’ and more unique. The variety of deployment models will make network and equipment analysis, like that done by the Huawei Cyber Security Evaluation Centre (HCSEC), more difficult. This could in turn lessen the assurance we have of the network’s security and robustness.

An increasingly important factor in this space is the reputation and position of the equipment and software provider with respect to long-term customer support and trust. It is not only the product’s engineering and code that is important, but long-term health of the network relies on appropriate response to known vulnerabilities (i.e. timely patch and update process and responsible vulnerability disclosure), information sharing, and cooperation with relevant parties. A company’s proven technical capabilities and cybersecurity practices are therefore of critical importance to the security of the UK’s 5G networks. The 2019 HCSEC report identified ‘serious and systemic defects in Huawei’s software engineering and cyber security competence’, but this has not received nearly as much public attention as it deserves.[1] Independent reviews by researchers and the public sector have also come to similar conclusions[2]. Network operators and other customers should have a means of evaluating and taking into account the company’s security culture. 

A company’s legal environment is also a relevant factor to take into account during procurement and risk analysis. Engaging with entities based in countries lacking an independent judiciary, such as China, pose a risk to intellectual property and critical communications – which increasingly includes public utilities such as water and power management. Huawei has said it would resist information sharing orders from the Chinese government. However, international relations experts have repeatedly highlighted that ‘there are questions over whether it could really resist China’s stringent domestic legislation, which compels companies to share data with the government’[3].

Huawei has also claimed that providing network equipment does not provide it access to the networks or the data as it is not the network operator. However, deployment of 5G will bring the ability to create bespoke networks which could, for example, incorporate cloud or other add-on services. Any company that wins a contract for 5G infrastructure provisioning will be well placed to vertically integrate that infrastructure with its own proprietary value-add products and services. Using cloud services as an example, if Huawei is the cloud provider it, and potentially the Chinese government through long-arm regulation, will have access to all the data that passes through that network.

3. The effectiveness of the Government’s past and current support to the UK telecoms industry and innovation within the sector;
    

[no comments on this question]

4. Areas of strength and innovation in the UK telecoms industry;

[no comments on this question]

5. The scope and implementation of key documents including, but not limited to, the 2015 National Security Strategy and the 2017 Industrial Strategy;
    

[no comments on this question]

6. The potential role of regulation and legislation including, but not limited to, the 2018 White Paper on National Security and Investment;
    

UK government and industry should work together to develop an appropriate security evaluation process for network equipment and services. A component of this should address national security issues related to critical national infrastructure and procurement of foreign goods and services. This security evaluation should be implemented in all procurement processes in an equitable and transparent manner and in accordance with industry norms. Although some European nations (e.g. Italy) are or will likely differentiate between European and non-European providers in this matter, as a minimum, a security review should be required prior to procurement decisions.

Government and industry should also work together to assess whether a distinction should be made between ‘core’ and ‘periphery’ components in procurement and rollout. Core components might include software or equipment particularly for data centres, network management or routing. Periphery components might include equipment for less sensitive parts of the network or equipment that cannot be remotely accessed and managed. 

7. The roles and responsibilities of the National Security Council and relevant Government departments and agencies;
    

[no comments on this question]

8. The extent to which policy-making in this area draws on cross-government science, technology and cyber security expertise;

Unlike its predecessor networks, 5G will bring a more intelligent, software-driven network. Millions of lines of code will manage networks in real-time and react to the ways in which networks are used[4]. As well as today’s services such as connection to the world wide web, 5G will enable dedicated or bespoke services such as autonomous vehicles, smart farming, remote health, and public events (i.e. sports or festivals). The UK needs to ensure the security and safety of the networks, devices, and users as more varied, numerous and poorly secured devices and services are connected to the internet.

The complexity and evolving nature of the 5G environment means that it is essential for government to draw-on relevant expertise across the fields of science, technology and cybersecurity on an ongoing basis. This includes cross-government expertise as well as industry, academic, and independent experts in these areas. As well as seeking advice on the security of its domestic networks, the UK should proactively participate in international processes to share best practices and set internationally recognised standards.

9. How the UK’s approach compares with that of allies and partners such as France, Germany, the US, Canada and Australia;

The approach of allies around the world has been low-key in comparison to that of the United States. Each country is navigating its own diplomatic relationships, particularly with China and the US. National approaches are also influenced by the extent to which Chinese parts are present in existing networks. Many of the UK’s allies have announced or completed technical security reviews of Huawei equipment since the media storm started in late 2018 while24 countries in the European Union have completed a national risk assessment.

Most responses are aimed at procurement process (e.g. policy or security reviews) and providing government more power in purchase decisions related to critical national infrastructure. There is also a division emerging between ‘core’ and ‘periphery’ equipment.

The complexity of 5G decision-making can be seen in the contrasting approaches of individual Five Eyes nations.

New Zealand has banned Huawei from a national infrastructure project based on national security concerns but has not made any blanket bans or public statements about its stance on the company or 5G procurement process.

Australia, like the US, has long been a sceptic of Chinese telecoms companies and in 2018 was the first Five Eyes nation to ban Huawei and ZTE from partaking in national infrastructure rollout. This is unsurprising because, like the US, it took the same position on 4G rollout and therefore has minimal Chinese infrastructure in existing networks.

The US has taken a hard line on Huawei and ZTE. This includes extending a ban which dates back to 2012, and in May 2019 adding Huawei to an Entity List – preventing US firms from doing business with the company.  The ban was immediately suspended for 90 days, and that suspension was continued for a further 90 days in August 2019, casting doubt on whether Huawei really did represent an immediate ‘national emergency’ as originally claimed. Currently, the US does not have Huawei equipment in its national infrastructure, however some smaller community networks use the equipment. Its position as a global superpower and non-reliance on Huawei equipment puts the country in a unique bargaining position. The bellicose rhetoric of ongoing US-China trade negotiations has drowned out the more measured, evidence-based concerns of the US’ close allies. Ultimately, this has prevented an effective and inclusive international dialogue to increase awareness of the issues and best practices related to 5G rollout and has resulted in scepticism of the US’ position by many.

Canada has not publicly announced a position regarding Chinese firms and 5G rollout. This is most likely because Canada is in a unique diplomatic triangle between the US and China. Both trade partners threaten further action including tariffs if Canada takes a wrong step. At the same time, Canada is still detaining Meng Wanzhou and China has rejected key Canadian imports. Canadian citizens Michael Kovrig and Michael Spavor continue to be detained in China, apparently in retaliation against the arrest of Ms Meng. Both were formally charged with espionage in May 2019, some five months after they were detained. It is unlikely Canada will be able to make a public position or change policy until after tensions have subsided.

The European response has also been mixed, reflecting diverse attitudes among Member States. However, at the request of the EU, most Member States have completed a review and an EU joint security review is due 1 October.

Notably, Germany and Belgium are the only countries not to proactively restrict Chinese companies’ access to national 5G deployment – at least publicly – following a security review early in 2018.

By contrast, Norway has had new policies in place since 2018. These have reportedly strengthened the role of security reviews in the procurement process.

In France, industry is leading 5G procurement, while the government has not made any formal announcements. For example, the French telco Orange announced in December 2018 that it would not use Huawei equipment – although it did not impose a blanket ban.

Italy is in a unique position as it signed a Belt and Road Initiative deal with China in March 2019 – the first G7 country to do so. It was reported that telecoms was specifically left out of this deal due to sensitivities around critical national infrastructure, including 5G and Huawei. At the same time, the government increased its special powers with relation oversight of ‘strategic assets’ including national network infrastructure. The government extended its ‘golden share powers’, which require notification prior to purchase of technology from any non-European provider and grant the government final veto power over purchasing decisions.

Poland, a strategic partner for the US in security matters, recently signed an agreement to carefully review companies supplying parts for 5G networks to ensure they are not subject to control by a foreign government without independent judicial review.

Table 1 - National inquiries into network security and Huawei as of June 2019

Some non-western countries and territories are also taking action to restrict Chinese companies’ access to 5G markets. For example, Japan has blocked Chinese equipment, Taiwan renewed an existing ban on Huawei and ZTE equipment, and Israel has legal restrictions on Chinese equipment.

10. The potential for international cooperation with like-minded countries and multinational organisations in sustaining key industrial sectors, such as telecoms.

The controversy over 5G and Huawei threatens to strain long-standing alliances such as the Five Eyes.

The UK and its allies should take advantage of established and respected multilateral institutions with like-minded members to foster coordination and develop a united approach to 5G procurement. This may include institutions such as the EU and NATO. NATO in particular is well poised as it already convenes like-minded nations and is well versed in national security issues.

The 5G Security Conference[6] hosted by the Czech Republic in May 2019 is a step in the right direction. This conference brought together like-minded countries largely based on EU and NATO members and included 4 global mobile network operators. Following national security reviews, the EU is also due to release an EU-wide risk assessment on 1 October 2019. The UK should closely follow developments in this area and work with the EU to deliver a regional approach to 5G.

In addition, the UK has a unique resource in the Commonwealth which can be used to build wider understanding of the risks and best practices related to 5G procurement and rollout. Increasing engagement with this network of countries would benefit the UK and could help engage and increase awareness of 5G security risks among Commonwealth countries. More should be done to build capacity in Commonwealth countries in preparation for 5G so that operators and governments can make informed decisions and investments.

Engagement with the Commonwealth and other nations could create a more heterogeneous group of countries taking measured and effective steps to ensure 5G is safe and secure. Some countries and territories which have already voiced wary views of Chinese telecoms companies Japan, Israel, Taiwan, Czech Republic, Norway, and India. Current indications are that India may also adopt the approach of differentiating between ‘core’ and ‘periphery’ equipment[7].

Private industry including network operators, equipment providers, and service providers, will be integral to the roll out of and realising 5G’s full potential.  The risk of conducting key discussions in multilateral environments is that key stakeholders, such as industry and civil society, may be excluded from strategic decisions. Governments should reinforce their efforts in state-firm diplomacy. The UK sets good precedents in this respect, such as regularly reaching out to industry, overseeing the Huawei Cyber Security Evaluation Centre, and including industry on national standards development delegations in multilateral spaces like the ITU. The importance of (and the UK’s good practices in) state-firm diplomacy should be shared with its like-minded allies through networks such as the EU, NATO, and Commonwealth.   

12 September 2019