Second Report - The Security of 5G

We share the Government’s objective that the UK remains at the forefront of the 5G rollout as we move into the next technological era. It is imperative that the UK is amongst the first countries to benefit from the technological advances that 5G will bring. The Government’s ambitions for the rollout of 5G are laudable and cybersecurity policy should take into account the strategic value of the UK maintaining its position as a global market leader in this technology.

It is clear that the UK vendor market for 5G kit is not diverse enough. Even with the inclusion of Huawei the market was “sub-optimal” and the Government’s decision to remove Huawei completely from 5G by 2027 poses a risk that could potentially result in an even less diverse market, which could bring security and resilience concerns of its own.

This inquiry was launched in the context of a lively debate on the security of the UK’s 5G network in Parliament and across the country from late 2019 and through 2020 with a focus on the presence in our network of high-risk vendors, particularly Huawei. A significant Government announcement took place in January with restrictions placed on high-risk vendors followed by stricter rules announced in July, with Huawei to be removed from the UK’s 5G network by 2027. The UK Government has had to balance technical considerations with wider geopolitical considerations when formulating its 5G policy.

There is evidence that the UK, and our allies, face many malicious cyber- attacks both from rogue individuals and state-sponsored attacks from states such as Russia and China. These attacks are diverse in their nature and in their aims. Some attacks aim to steal individual data and state secrets whilst others seek to bring down the network in its entirety. (Paragraph 58) 75 The Security of 5G

It is important that the Government continues to call out cyber-attacks from adversaries on the international stage and works to find a deterrent to counter them. There is currently a lack of global rules regulating international cyber-attacks and the Government should work with allies to formulate a system to provide accountability for perpetrators. The Government should clarify why it is not deploying a cyberattack capability to deter aggressors.

There is no doubt that Huawei’s designation as a high-risk vendor is justified. The Huawei Cyber Security Evaluation Centre has consistently reported on its low-quality products and concerning approach to software development, which has resulted in increased risk to UK operators and networks. The presence of Huawei in the UK’s 5G networks therefore poses a significant security risk to individuals and to our Government. Whilst Huawei is a market leading company, we do not believe it to be higher in quality or more functional than its rivals, Nokia and Ericsson.

The establishment of the Huawei Cyber Security Evaluation Centre has resulted in the UK leading the world in understanding Huawei’s equipment. Despite the planned withdrawal of Huawei from our 5G networks, the Huawei Cyber Security Evaluation Centre should continue to operate to assess Huawei equipment in other areas of our telecommunications. The Government should consider assessing all equipment vendors in a similar fashion, given the vulnerabilities of all equipment.

Advice to Government was clear, that the presence of Huawei in the UK’s networks was a manageable risk. The UK has one of the most active and effective cyber-security regimes in the world, and, from our public and private conversations with Government, we are confident that GCHQ and the NCSC are able to appropriately manage any increased risk posed by the presence of Huawei or other high-risk vendors in the UK’s 5G.

Furthermore, whilst the risk remained manageable, it is important to remember the benefits in having a greater number of vendors involved in 5G network provision, despite the designation as high-risk, as this improves overall network resilience should a single vendor fail.

Prior to the US sanctions announced in May, the risk of Huawei products remaining in the UK’s 5G networks was, according to the Government, significant but manageable through monitoring and regulation. The situation changed when Huawei was deprived of reliable chip manufacturing capabilities. Following these sanctions, as discussed in the Government’s July announcement, it became much more difficult to 76 The Security of 5G guarantee and measure the quality of Huawei products. In principle, the Government has made the correct technical decision to ban the purchase and presence of Huawei products in the future.

We are content that Huawei has been, and continues to be, sufficiently distanced from sensitive defence and national security sites. The Defence Secretary has informed us that no Huawei 5G equipment is present on the defence estate and that sensitive communications are safe from compromise. The Government should ensure that Huawei continues to be distanced from sensitive networks until the complete removal of its equipment from 5G by 2027.

Huawei’s continued presence in commercial 5G networks does not impact on our ability to share sensitive information with partners. We have been told that Huawei is not present in our sensitive networks and that, due to encryption standards, even if adversaries were able to record information as it passes through systems, they would not be able to decipher it.

The Government has had to balance its own technical considerations with pressures from allies such as the United States. The UK’s closest allies, including the United States and Australia, originally embarked on a policy at odds to that of the UK. This had the potential to damage the UK’s close intelligence, security and defence relationship with them, although reassurances have been given by Ministers that this was not the case.

The framing of the issue by the United States as a technical concern about the presence of Huawei in our networks has generated disagreement between the two Governments, given the contrasting conclusions of technical experts on either side of the Atlantic.

In the end, the Government decision was taken because of the technical considerations resulting from sanctions; however the Government should have considered the potential damage to key alliances enough of a risk to begin to remove Huawei from the UK’s 5G network before the US sanctions were imposed.

It is clear that Huawei is strongly linked to the Chinese state and the Chinese Communist Party, despite its statements to the contrary. This is evidenced by its ownership model and the subsidies it has received. Additionally, Huawei’s apparent willingness to support China’s intelligence agencies and the 2017 National Intelligence Law are further cause for concern. Having a company so closely tied to a state and political organisation sometimes at odds with UK interests should be a point of concern and the decision to remove Huawei from our networks is further supported by these links. (Paragraph 103) 77 The Security of 5G

Concern about Huawei is therefore based on clear evidence of collusion between the company and the Chinese Communist Party apparatus. It is important that the West does not succumb to ill-informed anti-China hysteria and recognises the mutual benefits of Chinese involvement in our economy. The UK, and allies, should ensure that decisions taken around the involvement of Chinese companies are taken in an evidence-based manner, and only when risk is demonstrable should decisions around removal be made. The UK, and allies, should ensure that decisions taken around the involvement of Chinese companies are taken in an evidence-based manner, and only when risk is demonstrable should decisions around removal be made.

Pressure has been exerted by China on the UK Government to retain the presence of Huawei in its 5G infrastructure through both covert and overt threats. More recently, following the Government’s announcement for the long-term withdrawal of Huawei from its 5G network, China has threatened to withdraw from the UK’s economy, including in critical infrastructure such as nuclear.

Ending China’s involvement in the UK’s critical infrastructure would be a radical step with huge implications for the UK’s economy. If threats by the Chinese state to withdraw from the UK’s critical industries continue and worsen, the Government should carefully consider China’s future presence in critical sectors of the economy. The Government should make provision in its proposed National Security and Investment Bill to give it the power to intervene and stop investments in critical industries should threats or risks be present.

It is evident that the UK’s lack of industrial capacity in telecommunications is not unique, with China dominating the industry. In order to combat this dominance, we support the principle of proposals for forming a D10 alliance of democracies to provide alternatives to Chinese technology: however, it is not yet clear what the purpose of this alliance is. Following consultation with allies, the Government should set out exactly what the role of this alliance would be and seek to make progress as quickly as possible on formulating joint 5G policy. The Government should explore opportunities for joint network security standard setting across Five Eyes and perhaps more widely, through a D10 or NATO. Following consultation with allies, the Government should set out exactly what the role of this alliance would be and seek to make progress as quickly as possible on formulating joint 5G policy. The Government should explore opportunities for joint network security standard setting across Five Eyes and perhaps more widely, through a D10 or NATO. It should also develop a programme to create necessary industrial capacity. (Paragraph 120) 78 The Security of 5G

We recognise that a D10 alliance could become more than just an alliance to provide alternatives to Chinese technology. For security reasons beyond the remit of this inquiry we recommend that the Government takes steps to engage a D10 alliance of the most complete kind. For security reasons beyond the remit of this inquiry we recommend that the Government takes steps to engage a D10 alliance of the most complete kind.

Global standards are key to 5G and future telecommunications networks. China has been very active in the standard setting bodies whilst the UK and allies have stood back. This is not satisfactory. The UK should take a leadership role in shaping global standards to ensure that the future of mobile networks, and global technology more widely, matches with our interests and those of our allies.

The Government has faced pressure to remove Huawei more quickly than by 2027. The evidence we have received would suggest that a quicker timescale could result in signal blackouts, delay the 5G rollout significantly and cost both operators and the economy greatly. For the time being we consider the plan for a removal by 2027 to be a sensible decision. Should pressure from allies for a speedier removal continue or should China’s threats and global position change so significantly to warrant it, the Government should, however, consider whether a removal by 2025 is feasible and economically viable. The Government should also be alert to the fact that other factors may warrant an earlier removal despite the risk of costs or delays.

The issues surrounding Huawei’s removal and the UK’s consolidated vendor ecosystem illustrate the need for a coherent long-term strategy for the UK’s technical and technological ambitions. It is not clear to us that the Government has a cohesive strategy in this area. The Government should learn lessons from debates around Huawei and seek to formulate a long-term plan for tech in the UK, this should include, for example, the Government’s plan relating to OneWeb and the UK’s removal from the Galileo satellite system.

Despite being a longer timeframe than some have called for, the Government’s most recent restrictions on the use of Huawei in 5G networks will delay the 5G rollout and economically damage the UK and mobile network operators. The UK Government should take necessary steps to minimise the delay and economic damage. The Government should consider providing compensation to operators, whether direct or indirect, whose networks are currently reliant on Huawei if the 2027 deadline is moved forward, in order to minimise costs to, and delays for, consumers. They should also consider legislation to give networks the right of access to sites. (Paragraph 136) 79 The Security of 5G

The UK market for vendors is far from satisfactory. Whilst this reflects a wider consolidated ecosystem of global 5G vendors action must now be taken to ensure that 5G is in a more secure position in the years to come.

The Government should work with mobile network operators to bring in new suppliers to the UK, for example Samsung or NEC and also encourage the development of industrial capacity in the UK. This will not only improve market diversity but make our networks more resilient and lessen the potential security risks by removing Huawei and therefore leaving the UK reliant on Nokia and Ericsson alone.

OpenRAN presents an opportunity to move away from the current consolidated vendor environment to one in which operators no longer have to consider which vendor to source from. It will also improve network security in a number of other ways. Whilst it may not provide an immediate solution as the standard is not yet mature, it does present a long-term solution to the current situation. The UK Government and mobile service operators should continue investment in OpenRAN technology and work to make the UK a global leader, not just in technological development, but also in production. The UK Government and mobile service operators should continue investment in OpenRAN technology and work to make the UK a global leader, not just in technological development, but also in production.

The current regulatory situation for network security is outdated and unsatisfactory. The Telecoms Security Bill is required to bring regulations up to date and allow Government to compel operators to act in the interests of security. The current situation has led to commercial concerns trumping those of national security. The Government should not allow a situation where short-term commercial considerations are placed ahead of those for national security and defence. The Telecoms Security Bill is necessary in order to enhance the Government’s and Government bodies’ regulatory powers and should be published as soon as possible.

The House was promised a Telecoms Security Bill before the summer recess. This did not happen. There must be no further delay. The Government should introduce the Telecoms Security Bill before 31 December