Can A 5G Network Really Be Secure?

The Australian government’s decision to ban ‘high-risk vendors’ from its 5G network build has made waves through the Five Eyes community but also in major markets where those high-risk vendors already have key customers. 

One such customer is Germany which, like Britain is grappling with multiple tensions when it came to opening the door to a potential 5G vendor that others had considered to be a risk. The decisions and deliberations of the Five Eyes countries have slowly become public.

The fifth generation of cellular technology known as 5G is the next great leap in speed for wireless devices. This speed includes both the rate mobile users can download data to their devices and the latency, or lag, they experience between sending and receiving information. 5G aims to deliver data rates that are 10 to 100 times faster than current 4G networks. 

Australia’s position on high-risk vendors is not new, neither are risk-based decisions about network operators. In 2012, the Australian government banned Chinese telecommunications company Huawei from taking part in building the National Broadband Network (NBN).  However, 2012 is a long time ago and the public narrative on restrictions on such vendors was quite different - there was no public statement and no Austaralian intelligence official publicly talked about the decision. 

The lack of a public narrative could be explained away in the context of a trade relationship. Or it could be explained in the context of a different time, when the government narrative on such issues tended to be less direct. The arguments about trust were often interwoven with reports of the theft of intellectual property and indictments against Chinese nationals accused of spiriting out highly sensitive US secrets, commercial espionage, or both.

A report from the US House intelligence committee at the time expressed concerns about Chinese legislation compelling its citizens to cooperate with requests, ‘Under Chinese law, ZTE and Huawei would be obligated to cooperate with any request by the Chinese government to use their systems or access them for malicious purposes under the guise of state security.’
For Chinese citizens and companies alike, participation in ‘intelligence work’ is a legal responsibility and obligation, regardless of geographic boundaries.

This requirement is consistent across several laws on the protection of China’s state security. For instance, Article 7 of the new Chinese National Intelligence Law declares: ‘Any organisation and citizen shall, in accordance with the law, support, provide assistance, and cooperate in national intelligence work, and guard the secrecy of any national intelligence work that they are aware of. ....The state shall protect individuals and organisations that support, cooperate with, and collaborate in national intelligence work.’

That could mean the Chinese government may influence, interfere with and have access to key assets of national interest, in this case, a telecommunications network.

The head of the Australian Signals Directorate, Mike Burgess, explained to the Sydney Morning Herald why assessing the security risks of critical infrastructure like the 5G network is a vital part of ASD’s work: “The stakes could not be higher. This is about more than just protecting the confidentiality of our information, it is also about integrity and availability of the data and systems on which we depend … Historically, we have protected the sensitive information and functions at the core of our telecommunications networks by confining our high-risk vendors to the edge of our networks. But the distinction between core and edge collapses in 5G networks. That means that a potential threat anywhere in the network will be a threat to the whole network”.

In Britian, the General Communications Headquarters (GCHQ) securty agency seems to have formed a different view which has been reflected in the UK government’s approach to 5G vendors. 

The UK agreed several years ago to having a Huawei ‘cell’ in the country that assesses Huawei code before it’s used. The 5G network build is a matter for the UK government alone, and it’s perfectly entitled to make a decision different from those of its Five Eyes partners. News reports indicate that the 5G decision was subject to heated debate in the British cabinet, in which there was no uniform view on the question of excluding high-risk vendors. However, the debate marked the start of the ‘core versus edge’ public narrative, which could be convenient nuance for justifying the UK government’s approach.

So, where did all of this leave Germany? In June 2019, it appeared to be landing somewhere between the Australian and UK approaches.

Germany didn’t seem to want to adopt the direct Australian approach. One organisation we visited said, ‘Germany would never directly exclude a company in a procurement process.’  Some German organisations labelled the Australian decision as ‘geopolitical’. Often, talk moved on to China being regarded as less of a threat because it was not geographically close to Germany, which is odd given that the conduit of cyber has no borders. Germany wanted to be in a position to ‘trust and verify’ and that it would prefer to be able to determine its vendors on that basis.  However, when pressed to explain how this approach could ensure network security, when Chinese companies can be subject to their domestic law, and when German companies may be none the wiser, our German colleagues struggled to respond. 

Some shifted uncomfortably when we asked why an outright ban on high-risk vendors could not occur. They also spoke of a broader European strategy and said that no one country could dictate the procurement process, even though these decisions are supposed to be made at the national rather than EU level.

Now, there is  pressure on the Bundestag to reach a decsion and while the 5G build situation remains fluid, the Christian Democratic Union (CDU) has reportedly decided to allow Huawei to take part in Germany’s 5G bidding suggesting that Chancellor Angela Merkel has put Germany’s short-term economic interests first at the possible long-term expense of international security.

Germany’s decision to let Huawei take part in its 5G procurement process feeds into a broader EU issue about the degree to which collective security considerations should influence decisions made by national governments.

There does seem to be tension between the German and EU interests. It’s unclear whether there can ever really be a unified approach to building a 5G network, particularly because each EU member state may have different incumbent providers that in turn have relationships with overseas vendors like Huawei.

As Germany moves through the 5G procurement process, it will be interesting to see how it will or won’t be influenced by the different approaches of other nations and whether it will be influenced by a broader EU approach to national security.

Will Germany decide that it’s neither the ‘core’ nor the ‘edge’ that matters and that security risks can be managed by limiting the level of participation of foreign network operators, as suggested in the CDU document? Irrespective of which path Germany takes, it’s bound to attract attention and be closely watched.

ASPI Strategist:             Live Science:           Sydney Morning Herald:       Lawfare:

You Might Also Read: 

 5G Mobile Technology Poses An Espionage Risk:

Canada Is Suspicions Of Huawei:

A Looming US vs China Tech War Over Huawei:

 

 

« Travelex Ransom Demand Is Doubled
New York’s Albany Airport Pays Ransom »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

Watch this webinar to hear security experts from Amazon Web Services (AWS) and SANS break down the myths and realities of what an NGFW is, how to use one, and what it can do for your security posture.

Montash

Montash

Montash is an award winning, global technology recruitment business, specialising in the acquisitions of high-performing talent across a number of core disciplines including Information Security.

IOActive

IOActive

IOActive serves as a trusted security advisor to the Global 500 and other progressive enterprises, helping to safeguard their most important assets and improve their overall security posture.

IP Performance

IP Performance

IP Performance Limited is a leading supplier of customised network infrastructure and security solutions.

SecuTech Solutions

SecuTech Solutions

SecuTech is a global leader in providing strong authentication and software licensing management solutions.

Teramind

Teramind

Teramind provides a user-centric security approach to monitor employee behavior in order to identify suspicious activity, detect possible threats, monitor efficiency, and ensure industry compliance.

Seqrite

Seqrite

Seqrite offers a highly advanced range of enterprise and IT security solutions to protect your organization's most critical data.

CounterCraft

CounterCraft

The CounterCraft Cyber Deception Platform fits seamlessly into existing security strategies and delivers high-end deception for threat hunting and threat detection.

Arm

Arm

Arm delivers a complete IoT solution, from providing the IP for the chip to delivering the cloud services to securely manage the deployment of products throughout their lifecycle.

ABS Group

ABS Group

ABS Group provides risk and reliability solutions and technical services that help clients confirm the safety, integrity and security of critical assets and operations.

Industrial Defender

Industrial Defender

Committed to ICS Cybersecurity. Industrial Defender provides a fully automated solution to discover, track and report on assets across your ICS footprint.

3Lines Venture Capital

3Lines Venture Capital

3Lines Venture Capital invests in exceptional founders and startups working on broad disruptive themes of Future of Work, AI enabled enterprises, and Industry 4.0.

Techsolidity

Techsolidity

Techsolidity is an emerging e-learning platform that offers a wide range of upskilling programs worldwide in areas including cybersecurity.

SecurWeave

SecurWeave

SecurWeave's Configurable Hardware Enforced Safety and Security (CHESS) platform has been designed to meet the security and safety criticality needs of the evolving digital industry.

Xcelerate Solutions

Xcelerate Solutions

Xcelerate Solutions is a leading defense and national security company, providing integrated solutions in three service areas – Enterprise Security, Digital Transformation, and Strategic Consulting.

Mogwai Labs

Mogwai Labs

Mogwai Labs deliver cutting-edge penetration tests, security assessments and trainings, to safeguard your applications, networks and cloud environments from cyber threats.

Corix Partners

Corix Partners

Corix Partners is a Boutique Management Consultancy Firm focused on assisting CIOs and other C-level executives in resolving Cyber Security Strategy, Organisation and Governance challenges.