As 5G rolls out in Britain, it will not be possible to keep Huawei at a safe distance from sensitive data, writes Margaret McCuaig-Johnston.
By Margaret McCuaig-Johnston, February 4, 2020
Britain’s recent decision not to ban Huawei from its IT systems came as a surprise to many people in that field. That’s because the announcement described a 4G system configuration for the country’s new 5G system. But 5G simply doesn’t work that way.
A 4G system consists of a clearly defined “core” or hub that stores, processes and redirects the data, and an “edge” of towers and antennas closer to the user. Sensitive data is kept in the core where its security can be protected. In Canada’s 4G system, Huawei is allowed to sell equipment only to the part of the system described as the edge where data is not as sensitive.
But there is no distinct core and edge in 5G systems that must support extremely fast response times. Sensitive data for telemedicine, virtual reality and autonomous vehicles will be kept in thousands of places closer to users with Internet of Things services 10 times the speed of old 4G systems. And the carrier will calibrate and adjust across the system to ensure it is always working at maximum efficiency. IT vendors will have exposure across the network in a much more complex and nuanced system. There is no edge to which Huawei can be confined.
Britain’s attempt to let Huawei into a kind of souped-up 4G system is very instructive for the decision that Canadian ministers will make on the same question. The classic structure for a cabinet submission, of which I have seen thousands over 37 years in government, is to present three options for any given proposal: full acceptance; complete rejection; and a recommended compromise that does not completely satisfy any stakeholder but grants each some piece of it. Britain has gone with the third option and Canada should resist the temptation to do the same.
In the face of China’s pressure, Britain is allowing Huawei a role but is hoping that a 35-per-cent cap and a reference to keeping Huawei at the edge will satisfy the U.S., which has threatened to withhold intelligence-sharing if Huawei equipment is allowed in Britain’s 5G system.
The problem is that 5G doesn’t function as 4G does. Where the core in 4G has hardware to manage the routing of data and calls to the right equipment at the edge, and keep sensitive data secure, in 5G routing is done through software that is more vulnerable to attack. Encryption will help somewhat but cannot prevent attempts to interfere with the flow of data, insert bad code or shut down parts of the system. As 5G rolls out in Britain, it will not be possible to keep Huawei at a safe distance from sensitive data.
This matters because China’s 2017 National Intelligence Law compels Chinese companies to assist China’s intelligence services – and to keep that spying secret. Furthermore, if the spying is revealed, the law commits that the Chinese government will protect the company that has assisted its intelligence work. Beijing could alleviate the concerns of Western governments by rescinding the law, but it has not done so. Huawei Canada contends that the law does not apply to it, but the law as written and interpreted internationally says otherwise.
Britain’s National Cyber Security Centre designated Huawei as a “high-risk vendor” but has said that it believes it can manage the risk – despite having identified security holes in Huawei’s 4G in 2018 that the company said would take three to five years and US$2-billion to fix. How much security risk is Canada prepared to accept from a “high-risk vendor,” especially during a crisis of relations such as we have now?
Dominic Raab, Britain’s foreign secretary, said last week that the decision would not affect the country’s intelligence-sharing with the U.S. – but he will never know what the U.S. is not sharing with Britain. The other countries in the Five Eyes intelligence-sharing group do not want a sixth eye staring in at their exchanges.
Canada too has faced threats of retribution by China if we do not adopt Huawei. If it does that when it is trying to attract our business, it will certainly be under no constraint once it has our business and access within our 5G. We have to trust that our government will not give the Chinese state a role in our critical infrastructure while ignoring how 5G is actually designed to operate.
And certainly, no decision should be announced until Michael Kovrig and Michael Spavor – the two Canadians detained in China – are home. That doesn’t mean the 5G rollout needs to be delayed. Rogers has announced that it’s starting to install 5G in major cities across Canada – with a non-Huawei vendor.
Margaret McCuaig-Johnston is a senior fellow in technology and innovation at the China Institute, University of Alberta. She also writes frequently for MLI and is the author of Dealing with the New China: How Canada can reset its relations with Beijing.
