Written evidence submitted by Naomi McGill

What are the risks to the UK’s 5G infrastructure? How can these be mitigated?[i]

The direct risks to the infrastructure is IP Mapping, Unknown Unknowns with sim’s placed in the components that have capability to communicate directly with China

Scenario Number One:

An example to consider, as Russia and China have announced an 5G Huawei agreement.

I ask the committee to consider such an incident as a CyberDefence Scenario[ii] Incident accidental or intentional. Its stated that within 11 mins[iii] London could be reached with a hypersonic capability[iv] from the western sea region of Finland.

The scenario needs to include the direct instruction of Russia or consider a partnership of China requesting Russia to perform an action on their behalf. 

One must consider how the relationship with UK’s partners and 5 eyes and more specifically the plan for Goonhilly to provide vital back up for USA for the NASA’s Deep Space Network to back up the current Spain capability.

In this scenario consider that Spain would require Goonhilly to be up and running within 8 mins and 2 mins to test that cutover was successful if Spain had a warning of a sustained hypersonic attack from Russia was imminent?

Unknown Unknowns

The 5G Huawei network then enables Russia & China to observe all elements with leading to the perimeter of Goonhilly, through unknown unknown, Tunnels, Maps or Sim’s and now that vital backup service UK provides NASA is considered 100% compromised. 

Although a scenario such as this is 0.00001% likely to occurrence for the UK, USA, Australia and Spain as the collaboration in space is protected through the United Nations.

The scenario is still an important one to consider from how UK interact with Australia & USA. Both countries have the same policy for their core & entire 5G infrastructure to exclude Huawei in its entirety.

As providers of the Deep Space Network, they would then be communicating with UK, who have IP tunnelling risk, who have the IP Mapping risk and have an unknown unknown sim capability to communicate with the Chinese network.

Scenario Number Two:

A Range Rover or Land Rover Four Wheel Drive driving in London, that the owner or designated user of this car has synchronised their contacts from an apple phone devise.

The dashboard displays the contacts and for this scenario, connects the call when a driver or passenger calls a number from a stored set of contacts from the phone.

How secure is that set of synchronised set of contacts that the car displays. What are the vulnerabilities of the Huawei equipment to a driverless or physically driven car making a call?

Visible vulnerabilities in the security layer of the four-wheel drive vehicle that IP map’s can then be built, with the car’s movement, its routines, its location and the map of all known contacts that are contacted from the vehicle

Unknown Unknowns

Data, IP Maps, sent back to China or an offsite UK location for analysis.

A fatal interruption to the driverless car functions through IP tunnelling

Capture of the call, yet possible through IP tunnelling

Mitigation would include layers of quantum encryption that would have impact of UK’s police services and security and defence services to accurately offer the quality of services and levels of safety that are considered to be protecting the citizens of UK, and trusted allies and partners.

What is the role of government in 5G cyber security?

• In each of these scenarios that could be considered reasonable even with a small likelihood of ever experiencing them. The role of the government is to assess

1. Unknown Unknowns,

2. Downgrade them to known unknowns and

3. Ultimately provide a pathway to known knowns and

4. Avoid risk of opening the network, the public, its employees and its allies, trusted partnerships and special relationships.

To what degree is it possible to exclude Huawei technology from the most sensitive parts of the UK’s 5G network while allowing it to supply peripheral components?

There has long been a discussion in Telecommunications circles that as long as “Huawei switches” are “excluded” from the core a “network” is considered safe.

I have to refer to my personal experience of Huawei before the 5G days. During the Nepal Telecommunications integration with Alcatel with Huawei switches. That was initial testing during an integration of a billing system I worked with supplied with the new mobile network rollout for Nepal Telecommunications.

As a key milestone for this project, I personally visited ZTE for due diligence and spent time with Huawei, to integrate the billing system, including calculating how many billing records could be processed per second and held a class to a number of Huawei employees in Shenzen.

To get this to work at the time this was a crucial step for Huawei’s success for this and future projects. When testing switches in 2001 – 2003 some of the initial responses with the team working in Australia, Edinburgh and Montreal on this project were that TAP records fields could have the potential to have information inserted into blank fields.

It was raised as a concern during analysis and testing phases during the Nepal Telecommunications integration with Alcatel with Huawei switches. That was initial testing during an integration of a billing system I worked with supplied with the new mobile network rollout for Nepal Telecommunications.

• A few years later 2014 while I was working with Telstra Australia, with Raytheon and Accenture, the United States of America reached the conclusion that it could not reliably in any degree possible to exclude Huawei technology from the most sensitive parts of the core network. Again in 2018 & 2019 they could not reliably prove this statement and excluded Huawei for a second time.

At the time of this response, no evidence of a published open source topology of the 5G UK network design, is to review for obvious security reasons, the only reliable way of proving this conclusively is to review conclusions of testing as well as new tests.

The following robust testing or results is available on Huawei,

1. Clear network penetration use case results and test cases provided for the ability to isolate and remove any network element compromised and that your backbone can be cut over in seconds not hours or days when required. Demonstrating the solution to the UK National Cyber Security Centre

2. Teams in UK to design and create penetration tests cases where they can isolate and avoid elements of the 5G network and operate without them real time. Demonstrating the solution to the UK National Cyber Security Centre

3. Teams in UK to design and create scenarios where they can move load balance over to another secure site in Australia to communicate directly on behalf of UK to USA if a 5G incident on your network is detected and element are isolated and compromised. Demonstrating the solution to the UK National Cyber Security Centre

What credible alternatives are available to Huawei systems

A UK supplier from Oxford Park, Cable Free Wireless Excellence Limited that I have personally sourced for the capability of providing a UK manufactured equipment to create a Global Free Space Optical Networks for Space Ports, for a NASA Flight Opportunities program in 2018 and 2020 have full capability of providing UK

In addition to the Free Space Optical equipment’s they provide, 5G capability made in UK and immediately available

The following scenario, assuming an Ericsson core 5G network

A paid trial for London, for the committee to commence their own independent tests with a UK supplier and to invite USA & Australia to participate with IP Tunnelling, IP Mapping & Sim tests

Scenario : Paid Trial in London

Equipment for the test

1. One or More 5G base stations, to demonstrate roaming 2 or more base stations.
2. (Baseband Unit, plus radio heads and sector antennas) with a complete base station costs around £35k

3rd Party “network core” (Ericsson)

Kings College of London & Ericsson – work with CableFree to set up to connect to radio base stations to demonstrate how easily that this UK manufactured base station can be easily integrated

Typical lead times for scalable volume range between eight to twelve weeks.

A small lab demonstrator 5G base station with 1 sector costs £18k and can be used for early stage interoperability.

Integration with Ericsson

Equipment for the test

1. 5 Base Stations (each 3 sectors) and this could be deployed in eight to twelve weeks with a purchase order commitment.

Security Tests

During this trial suggested security tests could include

4. Verifying the solution is robust in all expected user use cases.
5. Demonstrating the solution to the UK National Cyber Security Centre

To what extent was the UK Government’s decision on Huawei driven by political rather than technical factors?

• This is a difficult response, as this question, contains many unknowns unknowns. What is the social and global political good of Huawei’s decision for the citizens of the UK.

I can answer from my personal experience during some of my volunteering activities in the UK, I was approached to attend a Chinese charity event held at the Houses of Parliament.

I was unable to attend, due to the nature of my professional international travel diary. After consideration of the level of “appropriateness” for me to attend an event such as this.

I sent the invitation on to a UK property developer that “China” was the main customer of the properties built in the UK. I thought that was the more appropriate person to attend an event such as this.

I still continued to received texts for some time and this brings me to an unofficial conclusion that UK members, their support staff, academics and various other roles in UK are being actively targeted directly or indirectly for official and unofficial lobbying.

In contrast, I have never been invited to a Swedish event at the Houses of Parliament or received texts from any Swedish person known to me or unknown to me in relation to attending a similar styled event.

At the time, my PhD tutor[v] was actively conducting many of the significant trials for the Ericsson 5G centre[vi] at Kings College of London, nationally and internationally.

On a final point, since personally sourcing and selecting a UK manufacturer of telecommunications equipment for the NASA flight opportunities program. I have never been invited to a British Parliament charity event or received texts from any British, person known to me or unknown to me in relation to attending a similar styled event

I have also not received any invite to any American or Australian charity event at the Houses of Parliament or received texts from any American or Australian person known to me or unknown to me in relation to attending a similar styled event.

Using the economic principle of there is no such thing as a free lunch or charity event, yet there is such a thing as a free space optical network.

Why would you borrow money from a country only to pay that country back to supply your telecommunications network. Even if the network is heavily discounted, when there are UK based suppliers ready now.

Why risk relationships with Five Eye partners over infrastructure that the manufactures of that infrastructure refuse to have any other nation than their own supply their own network.

If there is one thing that UK and Five Eye Partners have uncovered and discovered during Covid, Corona crises[vii], the world is changing. The UK is changing and as such will have to discard arrangements that make the UK dependent on an overseas country for our survival.

A decision made in haste with a limited budget with long ranging lifecycles shows that in all circumstances a driver of a car with a flat tyre will always be at the mercy of the good will of the person who stops when you are stuck on the side of the road.

Yet the UK is not stuck on any side of the 5G road, there is no rush apart from a self-imposed time limit. I have not seen any timeline at the ITU that 5G must be implemented within a certain date.

Within days I sourced a UK supplier that already is one hundred percent vetted and validate to supply to the UK government with 5G equipment.

Why has no major broadcaster, no member of cabinet or elected highlighted this during parliament question time sessions siting this supplier as a credible alternative.

Let alone mentioned the extensive research and development funds invested in testing 5G centre Ericsson established with Kings College of London[viii] and successful trials with Vodafone UK.

Why is that Huawei gets the blanket statement they are they are the only ones ready to supply the network now.

How will the UK Government’s decision impact the UK’s geopolitical position?

Does the Huawei decision Galvanize[ix] our Geopolitical[x] position does it increase or decrease or Sovereignty of decisions and partnerships? Does it imply an unknown unknown set of conditions for UK citizens, politicians, and trade or security relationships now or in the future.[xi]

The geopolitical cost of 5G, is one that does include, sanctions, kidnapping, arrests, IP theft, and isolation[xii]. The world is in disorder, debt accumulation daily and the UK needs to be independent of any constraint obligation now or in the future in relation to the supply and maintenance of the 5G network.

It’s a new playing field, and it is no longer fair to assume that people will play fair, logically or honour the time hold assumption of gentleman’s agreements to uphold the world order.

One of the risks for GeoPolitical position[xiii] for UK is decoupling and the pressures that would create for barriers to be placed in the future for UK military trade and tech development as well as domestic commercial free trade agreements as a leverage point

Where is the scarcity, uncertainty thinking being generated from? Within hours this week all nations globally are having to become self-supporting and acutely aware that China have made statements in the last week that they would withhold key medical supplies to any nation that disagrees or is disruptive.

When a country, that is a key supplier of the nations telecommunications 5G network threatens another nation withing the Five Eyes partnership or indeed this nation with withholding key medical supplies, that would place the vendor, beyond the high risk category.

It would place them in a direct threat and would challenge those who feel very comfortable engaging with this vendor any further. Geopolitically speaking the risk is too large to consider further as safe or sound economic decision for the nation.

The technology is to be around for some time, its evolving, its growing and the word Sovereignty needs to be clearly understood in conjunction with the word Galvanized.

How will the UK’s allies, particularly those in Five Eyes, respond to this decision?

• Australia and the United States of America reached the conclusion that it could not reliably prove Huawei was a trusted network and this statement has shaped Sourcing Suggestions and recommendations to all of the partners in the Five Eyes network.[1]

• Meetings between Australia and UK in March 2020 were cancelled and pressure between Intelligence Agencies in USA, UK and Australia have been visible and well publicized, since the UK Huawei announced the decision this year.

• Diplomatic meetings although on the surface look cordial, there is growing concern, in security sectors that the Huawei network in the UK will have a long-lasting damage to permanent ability to share sharing of information based on the “Trusted Partner” ideal.

• An additional trusted source Free Space Optical Network solution[xiv] such as the one I have proposed to NASA to connect Space Ports globally[xv] could be considered as an additional communications network for Five Eyes, if the UK relationship did break down due to Huawei concerns.

• The question of how this network works within the nature of the work that Five Eyes really needs to be considered in terms of trade off’s. Indulge the idea of Five Eyes being the Formula One team, there is an assumption that its highly tuned, high maintenance, and requiring specialist precision.

• Some describe the sport taken out with the level of instrumentation and precision. When layers and layers of encryption need to be placed just to support a vendor that is not considered safe how do the other racing teams feel about that on the track?

• Especially when this response can be exploited through people that make it their business to exploit, countries, politicians, situations and people. The final point is for the committee to consider in its entirety for consideration. [xvi]

“The question in the government's mind, and this is vexing governments, is what happens when that social good, that is to say encrypted communication, is exploited by those who already have got a predilection to hide their communication, because they're terrorists, they're transnational criminals, they're involved in child exploitation and the like – what happens when they are put beyond the reach of our agencies in terms of highly advanced encryption.”

How will this decision impact the UK’s security and defence capabilities and the UK’s interoperability with allies?

• Although a scenario number one such as this is 0.00001% likely to occurrence for the UK, USA, Australia and Spain as the collaboration in space is protected through the United Nations.

• The scenario is still an important one to consider from how UK interact with Australia & USA. Both countries have the same policy for their core & entire 5G infrastructure to exclude Huawei in its entirety.

Scenario Number Three

International Broadcast of IP Addresses with Offshore Social Media Providers. IP Address tracking for GeoLocation activities or any other Medical Crises or Economic Crises or Law Enforcement or Government Regulation can be broadcast offshore.

Network address translation (NAT) allows multiple computers, phones, TVs, baby monitors, medical devices refrigerators to share a connection behind a single IP address.

record a one-to-one relationship between the ISP-assigned address and the account-holder's edge router.

Address space will make it hard to tie an IP address to an individual[xvii]

1. Law enforcement’s ability to attribute information to a particular person”, adding that “a person communicating on one social media platform may not necessarily use the same IPv6 address when browsing the internet,
2. or when communicating on another social media platform” (as already happens if someone uses devices on multiple networks for the same activities on IPv4 networks).
3. IPv6 addresses won't just be available to the ISP and the customer, but also “other foreign and domestic entities, such as social media providers”, and “IPv6 will potentially make record keeping more complex particularly in cases involving offshore providers”.
4. 5G networks pose a similar threat, apparently, because they also destroy a different one-on-one relationship.
   

How important it is for the UK, separately or with allies, to maintain industrial capability in this field?

The opening scenario number one demonstrates UK’s participation into Deep Space Network back up of Spain and the importance of the close co-operation with 5 eyes participants USA and Australia.

The ITU define 5G security priorities[xviii] as the following [2]

• Deploying malware,
• Denial-of-service (DoS)
• Distributed denial-of-service (DDoS) attacks,
• Man-in-the-middle attack,
• Surveillance and information theft, and
• Device hacking

Security aspects must be addressed as the top priority in order to protect infrastructure and transaction data for 5G based smart services and applications. [xix]

Research out of the University of Bristol indicate that Quantum encryption[xx] would be a step forward to maintain industrial capability in this field.

Layering Quantum Encryption[xxi] across the 5G network would assist against the security challenges for 5G based smart services and applications (for example, smart factories, smart cities, autonomous driving, e-health, and AR/VR)

With the capability to offer a protective layer to UK 5G infrastructure to more than one telecommunications provider in the UK at once.

27 March 2020