Euro Security Watch with Mathew J. Schwartz

Cyberwarfare / Nation-State Attacks , Endpoint Security , Fraud Management & Cybercrime

Britain's 5G Lesson: Choose or Choice Will Be Made for You

Delay in Decision-Making Left Government With Little Room to Maneuver
Britain's 5G Lesson: Choose or Choice Will Be Made for You

British leaders' failure to more quickly choose and pursue a specific path for the nation's 5G rollout meant that ultimately, the decision got made for them.

See Also: When Every Identity is at Risk, Where Do You Begin?

"The government seems to have been caught between a rock and a hard place," says Greig Paul, the lead mobile networks and security engineer at University of Strathclyde in Glasgow, Scotland.

"To some extent, this is the consequences of deciding too slowly," he says in a blog post. "Had the U.K. banned Huawei in 2018 like the U.S. and Australia, the mobile operators' 5G rollout plans would have been at an earlier stage. The U.S. also compensated some of its networks for the costs of equipment removal."

The so-called Huawei question is whether Chinese manufacturers can be trusted or if their technology might be used by the Chinese government to spy via other nations' networks. Other risks include essential equipment updates and security fixes getting held hostage by Beijing as part of trade disputes, as well as what many security experts say is a shoddy level of engineering in Huawei's products. In a worst-case scenario, adversaries might be able to exploit those flaws to crash parts of a nation's 5G infrastructure.

But Huawei is also the world's largest manufacturer of low-cost telecommunications equipment, thanks to its receiving substantial investment from the Chinese government. If the U.K. had completely banned the use of Huawei equipment, it would have left itself with only two other options - Finland's Nokia, which is the next cheapest option, followed by Sweden's Ericsson. Scant market competition would likely have driven up prices.

UK Allows 'Limited' Huawei

For now, Huawei will continue to be a part of the U.K.'s 5G rollout. Prime Minister Boris Johnson announced last week that his government will allow "limited" use of equipment from China's Huawei for the nation's emerging 5G networks.

The controversial decision arrived after the previous prime minister, Theresa May, commissioned a telecommunications supply chain review in 2018, which was delivered in July 2019. But a formal decision didn't follow until more than six months later.

Politically and economically speaking, British leaders' inaction left little room for maneuvering. Johnson risked angering China by banning Huawei. But he risked angering the U.S., which has banned Huawei, if he allowed the widespread use of its equipment. With Britain now having exited the EU and future trade deals in the balance, Johnson cannot afford to alienate neither nation (see: 5G Security in the Balance as Britain Navigates Brexit).

Johnson's decision follows advice from the U.K. government's National Cyber Security Center, which recommended capping at 35 percent the amount of Huawei gear that each of the country's four largest mobile network providers can use as part of their non-core 5G infrastructure.

Not having to replace all of their existing Huawei equipment was a win for service providers, because they could piggyback onto existing Huawei 4G base stations, which is easier and cheaper, Paul says. Vodafone had warned that ripping and replacing all Huawei gear would have led to a delay of two years or more and cost hundreds of millions of pounds. The British government doesn't appear to have wanted to foot that bill (see: BT and Vodafone Reportedly Want Huawei 5G Gear).

UK Seeks Alternatives

The government already signaled that it will attempt to reduce the 35 percent Huawei cap and try to further squeeze it out of British networks by finding new alternatives.

Nicky Morgan, the government's culture secretary, told the House of Lords on Jan. 28 that the government is pursuing a three-prong strategy to increase the diversity of its 5G supply chain, including "attracting established vendors who are not currently present in the U.K.," as well as "supporting the emergence of new, disruptive entrants to the supply chain" and pushing for open standards that will allow gear from more manufactures to work together.

"On established vendors, she may be referring to companies that make radio network equipment but don't compete aggressively in this space: Samsung, for example," the University of Strathclyde's Paul says. "As for new entrants, there may be a hope of enticing players who supply different types of networks, such as Cisco or Juniper."

The U.S. Congress and the White House are also looking for ways to bring established and new players to the 5G market. A bipartisan group of senators, for example, has proposed a $1 billion fund to drive alternatives (see: Senators Field Legislation to Build Huawei 5G Alternatives).

Larry Kudlow, an economic adviser to the White House, this week outlined a plan to get the technology sector to agree on common standards, so that 5G software could be run on commodity devices, thus potentially reducing the reliance on Huawei equipment. He says Microsoft, Dell and AT&T are part of the effort. "The big-picture concept is to have all of the U.S. 5G architecture and infrastructure done by American firms, principally," Kudlow tells the Wall Street Journal. "That also could include Nokia and Ericsson because they have big U.S. presences."

New Alternatives: Years Away

None of these activities will lead to alternatives appearing overnight. When they do, newer entrants may also have a tough time competing in what is an extremely cost-competitive market.

"From a technical perspective, it is likely it would take three-plus years for a totally new entrant, building from scratch without buying in external intellectual property, to have a market-ready product," Paul tells me. "It would then take a further year or more to 'compatibility test' the solution with existing network infrastructure. So from a tech perspective, I reckon four to five years would be good going."

Another challenge would be manufacturing costs, especially if western governments pushed for domestic manufacturing. Today, Huawei, Nokia and Ericsson all build their 5G gear in China. "Location of manufacturing would also be another concern, and as is widely known from other sectors, it's nigh-on impossible to compete on cost with China for manufacturing costs," Paul says.

5 Years to Comply With UK Restrictions

Britsh telecom firm BT estimates that it will take five years and $652 million to reduce its use of Huawei's radios and associated equipment to the U.K. government's 35 percent cap. The same goes for Vodafone. CEO Nick Read on Wednesday told reporters that Vodafone will apply the U.K. approach to its entire European operations and cap its use of Huawei equipment.

"We have now decided as a result of the EU toolbox and the U.K. government's decision to take out Huawei from the core," he said, Reuters reports.

Last week, building on ongoing efforts, Brussels released that 5G toolbox, although it's up to EU member states to choose what, if anything, they will do. German Chancellor Angela Markel, for one, says her government's decision won't be made until after an EU meeting about 5G scheduled for next month.

How nations go about securing 5G - and whether restricting suppliers will be part of their strategy - remains to be seen. But by the time other European governments finally codify their approach to telecommunications supply chains and procurement, will the choice, in effect, already have been made for them too?



About the Author

Mathew J. Schwartz

Mathew J. Schwartz

Executive Editor, DataBreachToday & Europe, ISMG

Schwartz is an award-winning journalist with two decades of experience in magazines, newspapers and electronic media. He has covered the information security and privacy sector throughout his career. Before joining Information Security Media Group in 2014, where he now serves as the executive editor, DataBreachToday and for European news coverage, Schwartz was the information security beat reporter for InformationWeek and a frequent contributor to DarkReading, among other publications. He lives in Scotland.




Around the Network

Our website uses cookies. Cookies enable us to provide the best experience possible and help us understand how visitors use our website. By browsing databreachtoday.co.uk, you agree to our use of cookies.