Huawei: Why UK is at odds with its cyber-allies

After months of uncertainty, the UK appears set to allow Huawei's telecoms equipment to be part of the country's 5G networks - with some limitations.

The move would put the UK at odds with the US, which has been pressing other nations to ban use of the Chinese firm's kit on security grounds.

It could also cause tensions with Australia, which last year blocked its networks from using Huawei's 5G gear.

The country also barred another Chinese firm, ZTE.

While Theresa May is reportedly willing to give Huawei the green light, this would not mean the prime minister's cyber-advisers have disregarded the threat of a future Chinese cyber-attack.

That concern still preoccupies many security officials' minds, since much of our critical infrastructure - from power stations to automated transport - is likely to be dependent on the next-generation communications technology.

Rather, there is a belief that restricting Huawei's equipment to certain parts of the UK's network means that the risk can be managed.

At the heart of the matter, there seems to be a critical disagreement: Canberra and Washington believe that there are fundamental differences between 5G and 4G, which mean an outright ban is the wiser choice.

To make sense of all this, it is worth exploring first why Australia came to its conclusion.

But it is worth saying up front that, for its part, Huawei has denied it would ever compromise a client's network because it had been ordered to do so by Beijing.

It has said that it has been "targeted by a sustained campaign of ill-informed accusations that its involvement in 5G infrastructure somehow poses a threat".

Australia concluded in August that it was impossible to "mitigate" the national security risks involved in allowing Huawei to form any part of its 5G network, because next-generation networks would operate in a different way to their predecessors.

The reason for this, it added, was that the relationship between two distinct bits of the network would change.

The first part - "the core" - it said was where the "most sensitive functions occur", including device authentication, voice and data-routing and billing.

The second - "the edge" - referred to equipment including antennae and base stations that is used to capture the radio signals emitted by wireless devices and send them into the core.

The key phrase in a ministerial statement then explained: "The distinction between the core and the edge will disappear over time."

One of the country's spy chiefs, Mike Burgess, later expanded on this, saying that as 5G technologies matured, the expectation was that the distinction between the edge and core "collapses" because "sensitive functions" would begin to move outside of the protected part.

Part of the reason for this, he explained, would be to take advantage of the lower latencies 5G offers - the lag between issuing a command and getting a response. This, for example, could help make it safe to direct surgical robots or remote-controlled vehicles from afar.

But, Mr Burgess added, the consequences could be dire if the 5G kit was then compromised and used to mount an attack.

"Elements of the power grid may not work, water supply [and] sewage pumps may not work - it has the potential to impact our country greatly," explained the director general of the Australian Signals Directorate.

And Huawei was considered a company that could be "subject to extrajudicial directions from a foreign government that conflict with Australian law".

In other words, the fear was that it could be compelled to facilitate a Beijing-mounted cyber-attack.

The Australians' argument never convinced many senior figures involved in the UK's telecoms industry.

While they accept there are issues with using Huawei's kit in the core, they believe it would still be relatively safe to use its radio access network (Ran) equipment - which allows individual devices to wirelessly connect to mobile data networks via radio signals transmitted over the airwaves.

Huawei's Ran gear is seen to be more advanced than that of its competitors - Nokia and Ericsson - at doing things like maximising the amount of data that can be handled at once. The Chinese firm also has a reputation for being more willing to provide customised solutions.

But critically, there is also a belief that there is no reason for the distinction between the core and Ran to disappear over time, so long as the networks involved continue to respect standards that define a border between the two.

"One of the key features of 5G is the ability to... distribute [the core] more broadly across the overall network infrastructure," explained Vodafone UK's chief technology officer Scott Petty.

"However, that core network is still protected from the radio base stations by security gateways and capabilities."

There has, however, been some reluctance to openly contradict the Australians.

When BBC Panorama spoke to the technical director of GCHQ's National Cyber Security Centre earlier this year, he sought to suggest both views could be right.

"From a purely technical point of view, geography matters in 5G," Dr Ian Levy explained.

"Because you have these very, very quick turnaround communications, you are limited about where certain things can physically be - limited by the speed of light.

"UK and Australia have very different geographies - so our laydowns will be very different to Australia's laydowns. So, we may have exactly the same technical understanding, but come to very different conclusions."

Washington has been leading the campaign against Huawei, both in terms of making the case about the supposed security threat it poses, but also pursuing legal cases alleging the firm has engaged in systemic intellectual property theft and fraud - claims that Huawei denies.

Earlier this month, one of President Trump's top cyber-security officials made it clear that the US believes it is not safe to use Huawei kit in any part of a 5G network.

"We view there to be no relevant distinction between the core and the edge of a 5G network," said the US State Department's Ambassador Robert Strayer.

"That distinction had existed in 4G networks because you basically had a smart core - where the intelligence and the software ran - and the edge was dumb, because it was just for the transmission of data to the core.

"In a 5G network, much of the smart computing capacity... will move to the edge."

When the BBC asked him whether geographic differences might mean this would not be an issue for the UK, he made clear this was not a consideration.

"Due to the configuration of 5G networks with computing at the edge and reliance on those networks for the provision of critical services, untrusted equipment should not be allowed in any part of the network," he answered.

The UK, Australia and US are three members of an intelligence-sharing pact called the Five Eyes alliance.

The other two members are New Zealand - which has also barred one of its networks from using Huawei's 5G equipment while it continues to evaluates the risks involved - and Canada, which is still on the fence.

A decision by the UK to allow at least partial use of Huawei's kit could encourage New Zealand and Canada to do likewise, as well as sending a wider signal out to other countries that there is no reason for an outright ban.

But Washington has warned there could be repercussions.

"It would be very difficult for the United States to share information the way that we have in the past if we are having to rely on unsecure networks," Mr Strayer told the BBC.

"[As Secretary of State] Pompeo has said - if the risk exceeds the threshold for the United States, we simply won't be able to share that information any longer."

Some experts are not convinced, however, that the US would really stop sharing intelligence.

"I am surprised at some of the rhetoric from the US," commented Prof Alan Woodward, from Surrey University.

"If sensitive information is being passed across any public network, you have to assume someone is attempting to intercept it. Hence, you layer on your own security to a level appropriate to the sensitivity of the data being transmitted.

"The greater concern with 5G is the potential for disruption of the network, not necessarily espionage."

A formal UK decision on Huawei is still not expected until after the Department for Digital, Culture, Media and Sport shares the results of its own review into the matter with the country's National Security Council.

In the meantime, Huawei is not taking anything for granted.

"We welcome reports that the UK government is moving towards allowing Huawei to help build the UK's 5G networks," said a spokesman for the firm.

"While we await a formal government announcement, we will continue to work co-operatively with the government, Ofcom and the industry and their evidence-based approach to network security."