Huawei equipment not a risk to national security says report

Huawei Cyber Security Evaluation Centre is working effectively says oversight board.

The unit charged with checking the security of Huawei equipment used in the UK's national critical infrastructure is working effectively, according to the board which oversees it.

Huawei is one of the world's largest telecoms infrastructure companies and first came to prominence in the UK in 2004, after successfully bidding for BT's major network upgrade. Since then it has also won contracts with Vodafone, EE, O2, Talk Talk, Virgin Media and Sky.

As Huawei's customer base in the UK expanded, concerns were raised about the potential national security risks of having equipment from a Chinese supplier at the heart of critical communications networks, and so the government decided to put in place a strategy to "manage any potential security risks associated with the prevalence of Huawei equipment in UK networks".

These concerns led to the setting up of the Huawei Cyber Security Evaluation Centre (HCSEC) in 2010. This centre, in Banbury, Oxfordshire analyses Huawei's equipment which is to be deployed in the UK to identify any potential vulnerabilities.

In December 2013 a report from the parliamentary Intelligence and Security Committee reflected ongoing anxieties about Huawei because of what it described as the firm's perceived links to the Chinese state - which the company had rejected.

"China is suspected of being one of the main perpetrators of state-sponsored attacks, which are focused on espionage and the acquisition of information," the report noted.

Following from this parliamentary report, the UK's National Security Adviser was asked to review HCSEC, and recommended stronger oversight of the installation by creating an oversight board for HCSEC.

It is this board, chaired by Ciaran Martin, an executive member of GCHQ's board with responsibility for cyber security, has just completed its first year's work.

It said: "The modern reality is that virtually every telecommunications network worldwide incorporates foreign technology. Most manufacturers have some of their equipment built in China and use technical components from a global supply chain, regardless of the location of their headquarters."

The oversight board said the technical assessments conducted by the HCSEC have been "of consistently high quality and have provided useful risk management information" to both the government and communications companies. It said the unit had also demonstrated "sufficient independence from Huawei headquarters and any other body" to perform effectively.

It noted: "The oversight board concludes that in the year 2014-15 HCSEC fulfilled its obligations in respect of the provision of assurance that any risks to UK national security from Huawei's involvement in the UK's critical networks have been sufficiently mitigated."

It did, however, say the relationship between HCSEC and the Huawei's Shenzhen based Product Security Incident Response Team needed to improve, and noted: "the current relationship has occasionally caused some tensions, the board is satisfied that this issue has not had a detrimental effect on the security of UK networks". The board also found that the unit had difficulties recruiting staff, particularly because of the security clearances they require.

Further reading

Huawei security centre needs stronger oversight, says UK's National Security Advisor

Huawei tech in UK networks: Tougher safeguards demanded by MPs