U.K. government opens narrow door to Huawei

After more than a year of intense internal study and deliberation, and pressure from both the U.S. and Chinese governments, London on Tuesday decided to allow carriers to include controversial Chinese telecom equipment maker Huawei as a vendor in portions of their next-generation 5G mobile telecommunications networks. The decision was a complicated one, and the details of how U.K. government policy will be carried out to implement the decision will be important to watch, both for the U.K. and the U.S., and for the rest of Europe.

The decision taken by the most senior levels of the U.K. government is to allow Huawei to participate in portions of the country’s radio access network (RAN) deployments, while carriers will not be able to use the firm’s equipment in the core portions of the network. It is one of the most charged geotechnology-related decisions we have seen to date.

Lots of restrictions but not a ban

Under the pressure of explicit and implicit threats from the U.S. and China, the U.K. government of Boris Johnson has chosen to thread a very delicate needle indeed, striving to avoid an outright ban that would anger Beijing, while at the same time raising the bar significantly on overall 5G security for both carriers and vendors. In addition, the National Cyber Security Center (NCSC) has also issued “advice” related to key vendors in particular that are regarded as posing a higher risk than others.

When the Secretary of State for Digital, Culture, Media, and Sport (DCMS), the Rt Hon Baroness Nicky Morgan, announced in a statement to Parliament that the U.K. would be allowing “high-risk” vendors to supply equipment to carriers for the U.K.’s 5G networks — she did not name Huawei explicitly — it marked a major watershed for Europe in the more than 18-month debate over how to treat Chinese vendors, as countries begin to ramp up deployments of critical 5G networks that will enable autonomous vehicles, smart factories, AR/VR, and faster streaming of high-definition movies to your smartphone. However, the announcement was deliberately accompanied by the release of very detailed analysis of the risk to telecommunications networks, plus new security requirements for both carriers and vendors as a baseline, along with those additional restrictions around high-risk vendors, such as Huawei. A longer blog posting by Dr Ian Levy, NCSC’s technical director, explains the thinking that went into the analysis and risk framework.

The U.K. decision was long in the making, and appears to have come from a more united ministerial-level cabinet group than that produced under Johnson’s predecessor Theresa May last spring — there was a considerable amount of dissent at that time, from the then minister of defense among others. Before the May government attempted to make a decision, it commissioned several reports on 5G supply chains and security issues. The deliberative approach favored by the U.K. government, including extensive consultations with and studies by its intelligence and cybersecurity organs, along with industry participants such as carriers, has led to a decision that attempts to strike a balance between economic and security concerns around 5G.

A mixed bag for Huawei

The U.K. announcement includes considerable detail about the major technical requirements for carriers and vendors under the Telecom Security Framework/Regulations, along with further geographical and other restrictions for “high-risk” vendors, a designation that includes but will not exclusively refer to Huawei, according to U.K. officials. Interestingly, the NCSC last year issued guidance to carriers stating that it had determined that it was not practical for the U.K. government to ensure the security of 5G networks that include Huawei rival and China’s number two telecom vendor ZTE. This guidance means that there is a more explicit ban on ZTE participation in U.K. 5G networks.

The U.K. approach to Huawei has some similarities to the French system, as the firm’s telecom gear will not be allowed in the core portions of carriers’ networks, and will also be restricted in some sensitive geographical areas. U.K. carriers will also not be allowed to depend on a single vendor’s equipment for more than 35 percent of their overall needs. Hence, the U.K.’s complicated 5G security framework represents not a full ban on any particular vendor, but at the same time also does not provide carriers with free rein to use high-risk vendor equipment wherever they would prefer in deploying 5G network infrastructure.

In addition to raising the bar overall with the new phased-in security standards around all aspects of 5G equipment and operational deployment, the NCSC and U.K. officials are also looking ahead for ways to bolster the diversification of 5G equipment and services vendors, particularly in the complex radio access network (RAN). Hence, the twin goal of the new regulatory framework is to use government guidance to foster diversity and interoperability in the RAN — this process, though, will take some time, and U.K. officials talk of a five-year timeline for developing a competitive market for the RAN.

For Huawei, the decision is a mixed bag, which will raise the costs of compliance, and circumscribe the firm’s role in the rollout of 5G networks in a major European market. The decision is also likely to reverberate throughout European Union member states, and influence the current heated debate about Huawei that’s underway in Germany, which has even seen Chancellor Angela Merkel’s own party push for a harder line on Chinese vendors. The European Commission will also release this week a “tool kit” for member states to use in deciding which vendors to allow into their national supply chains, after putting together an EU-wide and coordinated risk assessment of 5G security late last year.

The reaction from Washington

U.S. officials with the administration and Congress have already expressed concern over the decision — they are not happy that the action falls short of an outright ban. But it is unlikely that the U.S. will go as far as to curtail or throttle intelligence sharing between the two close allies, as U.S. officials such as Secretary of State Pompeo have threatened over the past year. In addition, it is unlikely that the U.S. would risk breaking up the Five Eyes intelligence partnership over this issue — another key member, Canada, has still not made a final decision on whether to ban Huawei, while Australia and New Zealand have in place legal and other processes that add up to a de facto ban. Instead, the U.S. is likely to seek to work with the U.K. government to ensure the security of both 5G supply chains and 5G deployments going forward.

U.S. efforts to encourage like-minded states to ban Huawei will continue, with the battleground now shifting to key and large developing country markets such as India and Brazil. India has allowed Huawei to participate in pilot deployments of 5G networks, but has not made a final decision on a ban, or how to adopt restrictions along the lines of the U.K. Brazil is not likely to ban Huawei, but could draw from the U.K. model to try to limit where carriers can deploy the firm’s equipment.

Meanwhile, the U.S. government efforts to tighten up export control regulations for U.S. suppliers to Huawei stemming from last May’s Entity List action continue. Two major rule changes to the regulations governing the Entity List action were put forward by the Commerce Department in mid-January, but the U.S. Department of Defense (DoD) has raised objections to the changes.

The DoD for the time being has accepted arguments made by some elements of the U.S. technology industry that cutting off U.S. suppliers from Huawei and the broader China market would adversely impact their ability to generate revenue for R&D, reducing their ability to innovate new products, including for U.S. national security and military systems.

Further interagency deliberations around the proposed rules will continue, as the U.S.-China tech cold war enters a new phase, which includes elements of the Great Decoupling, the Eurasia Group’s #2 Top Risk for 2020. The Geopolitics of 5G will remain complex and impact companies all along the supply chain well into 2020.