What’s next for Canada now UK branded Huawei untrustworthy and banned ZTE?
Canada will finalize its its policy on whether to allow Huawei and ZTE, manufacturers known to pose security risks because of their ties to the Chinese system. The view of Canada’s Communications Security Establishment (CSE) appear similar to USA and the view of Canadian Security Intelligence Service (CSIS) appear similar to the United Kingdom’s National Cyber Security Center (NCSC).
This research note offers Strand Consult’s assessment based upon in-depth policy analysis, interviews, and other intelligence on this issue since 2005 and follows many Strand Consult research notes and reports on this theme. This new research note examines the situation for Canada.
Much has been written about the decision the recent UK government decision regarding the use of Chinese-made equipment from Huawei in UK mobile networks. The Chinese propaganda machine has leaked its response before readers of the free world press had a chance to process. Huawei spinned the UK decision as a victory and did not reveal that its options are increasingly limited. Regarding the facts:
1. The UK government has determined that Huawei is a high-risk vendor following the conclusions of its Telecoms Supply Chain Review. It’s expected that Canada would do the same.
2. The UK decision of the NCSC continues the total ban of ZTE placed May 2018 and puts significant restrictions on Huawei for the use of wireless and wireline networks. Canada could well follow the UK.
3. The use of Huawei equipment is prohibited in core networks in UK. This means that the backbone of UK mobile and fixed networks must not contain Huawei equipment. This policy demonstrates that UK authorities recognize the risk of equipment made by entities affiliated with the Chinese government. If Chinese-made equipment was safe, Huawei equipment would not be prohibited from the network core. Canada will most likely take the same view.
4. The use of Huawei in the radio access network (RAN) in UK is limited to 35 percent of the active equipment. This limits the amount that Huawei can sell in the UK. In practical terms, it will not be possible for an operator to use Huawei for more than 35 percent of the equipment and then use another Chinese or Huawei-white labeled product for the rest of the network, or a portion thereof. The goal of the policy is to limit equipment from Chinese owned and/or affiliated entities, even if it is not explicitly written. Canada can go for the UK model of high restrictions with the classification of untrustworthy or the US model which is an explicit and total ban. Some see the UK model favorably, and it would be easy for Canada to adopt it. Naturally the US would prefer that Canada adopt its model. Strand Consult described the situation in this research note: The UK new policy is a step in the right direction – UK restricts Huawei and bans ZTE
5. In UK and France, the use of Huawei equipment is expressly prohibited in sensitive geographical areas, areas selected for national security reasons. In France, Huawei is restricted in Toulouse, home of Airbus and the European aerospace industry. A similar policy exists for the Brest region where French nuclear submarines are located. Read more about the French decision. At a minimum, it can be expected that Canada will restrict Huawei and ZTE in sensitive geographical areas.
While there is broad agreement in Canada, UK, France, and US of the dangers posed by Chinese system and their associated Huawei and ZTE being high risk vendors, there are slight policy variations as to the number of restrictions which are placed on the companies and how they are delivered.
While policy can support restricting Huawei and ZTE from military installations and other areas of national security, the question then remains as to why commercial and civilian networks are less important. Indeed, all of these countries have growing privacy-rights based regimes which demand increasing and exacting standards of the firms participating in information networks.
In no way can Huawei and ZTE ever meet these standards because they are subject to China’s intelligence and cybersecurity laws which allow the Chinese Communist Party to inspect the data on Chinese made networks and equipment at any time and for any reason. Moreover, this Chinese made equipment, regardless of its location and installation, has the capability to send data back to China, violating local country privacy rules.
The logic is similar for intellectual property and valuable information; just as personal information can be transferred to China and subsequently processed as a consequence of using Chinese technology, so can valuable corporate data. Strand Consult believe that Canadian companies and citizens will likely demand higher standards, if the government does not. See Strand Consult’s research note The pressure to restrict Huawei from telecom networks is not driven by governments, but the many companies that have experienced hacking, IP theft, or espionage.
The UK policy is a step in the right direction, and it underscores the need for greater scrutiny of technology from firms owned or affiliated with the Chinese government. Security risks are real, and networks with Chinese-made products and services are vulnerable. Indeed, scrutiny should extend beyond the network equipment to other vulnerable products and services; systems can be compromised by devices attached to the network as well as from software running over it. See Strand Consult’s research note “The debate about network security is more complex than Huawei. Look at Lenovo laptops and servers and the many other devices connected to the internet.”
Strand Consult expects that the security standards required for public safety networks will be strengthened and translated to commercial telecom networks. It is likely that some operators will claim that the new policy will be unduly expensive. Strand Consult examines such claims in the report ”The real cost to rip and replace Chinese equipment from telecom networks.”
Notably 2G/3G/4G mobile network equipment must be replaced anyway in the move toward 5G. Huawei is not the only vendor, and alternatives are price competitive. Moreover, when it comes to 5G, network rollout policy is far more consequential than the choice of equipment vendor. The view that Huawei is necessary for 5G is a myth; indeed, the US and Korea has taken a leadership position on 5G without using Huawei equipment.
Looking at the historical facts, it is not difficult to find operators which have swapped their networks with a new supplier. This need not come as a premium for shareholders. Strand Consult reviews the financial data and case studies from the major network swap it observed in 2010 – 2016.
The Canadian government, with Justin Trudeau at the forefront, can improve the prospects for 5G in a meaningful way. In Canada, as in many countries, it is difficult and expensive to build mobile infrastructure. Strand Consult’s analysis show that the terms and costs associated with obtaining permits and leasing land for mobile masts and towers is artificially expensive.
In Denmark, on the other hand, Strand Consult has helped to create transparency so that authorities get the information they need to create the needed rollout policies. As a result, the total rental costs for mobile operators have fallen by over 20 percent, and it has become significantly cheaper and easier to upgrade and build existing and new mobile infrastructure. Learn more about the project here ”How to deploy 5G: Best practices for infrastructure, regulation and business models.”
Huawei claims that the UK decision doesn’t hurt its prospects, that is great. Today many countries are moving to classify the company as a high-risk vendor and restrict its installation. The UK makes clear that Chinese equipment is not allowed in the core network. Moreover, when it comes to RAN, there are also strict limitations. It is likely that Canada, at a minimum, will adopt the UK decision. Given that the Trudeau government has styled itself as so progressive and protective of Canadians’ rights, it would not be a surprise to see the country go even further.
If you want to know more, read Strand Consult´s research notes on China and cybersecurity or contact me at firstname.lastname@example.org.
About me: www.understandingmobile.com