May to ban Huawei from providing 'core' parts of UK 5G network

Telecoms firm will still be able to supply some technology, but decision may anger Beijing

April 24 2019

Theresa May has ordered that Chinese telecoms supplier Huawei be banned from supplying core parts of the future 5G mobile phone network, following a meeting of ministers on the National Security Council (NSC).

Huawei will be allowed to supply some “non-core” technology to UK phone companies, insiders said, but several ministers in the meeting on Tuesday raised concerns even about that concession, arguing instead for a total ban on the supplier.

The ban risks agitating both China and the company – which is privately owned – and comes as concern grows in the UK, US and elsewhere about whether the company’s technology poses a long-term security risk.

Britain’s intelligence agencies have taken a cautious approach to Huawei, but not called for a blanket ban. Jeremy Fleming, the director of spy agency GCHQ, argued last month that the UK needs to understand “the opportunities and threats posed” by Chinese technology.

Other countries have taken a tougher stance. Chinese companies are banned from working on critical telecoms infrastructure in the United States. Mike Pence, the vice-president, called on “all our security partners to be vigilant” in February.

The leak of the Huawei decision came just days before Philip Hammond, the chancellor, is due in China this week to attend the country’s Belt and Road investment forum in Beijing and could cause problems for him.

In February, Hammond was forced to cancel a trade meeting with vice premier Hu Chunhua after the defence secretary, Gavin Williamson, had suggested the UK might deploy a new aircraft carrier into waters claimed by China on its maiden voyage in or around 2021.

Guardian Today: the headlines, the analysis, the debate - sent direct to you

Read more

Ministers said to have raised concerns about Huawei at the NSC meeting include Jeremy Hunt, the foreign secretary, Sajid Javid, the home secretary, Gavin Williamson, the defence secretary, and Penny Mordaunt, the international development secretary.

The decision came on the eve of a speech from Fleming in which he will pledge that indications that a cyber-attack is coming from China or Russiawill be shared in a matter of seconds with corporations as he seeks to demonstrate how the spy agency can benefit British business and consumers.

The GCHQ director is expected to promise to increase the agency’s collaboration with the private and public sectors to create “a whole-of-nation, automated cyber-defence system” across the UK.

He will say at a security conference in Glasgow on Wednesday that its National Cyber Security Centre (NCSC) has already “made it simple for our analysts to share time-critical, secret information”.

Intelligence the NCSC picks up – “whether it’s indicators of a nation state cyber actor, details of malware used by cybercriminals or credit cards being sold on the dark web” – will be declassified and shared promptly in the future, Fleming will add.

He is not expected to name any countries as a specific threat, but hackers from Russia, China, North Korea and Iran are generally considered by the intelligence agencies the most likely sources of danger to British cybersecurity.

Extracts from Fleming’s speech provided only limited detail as to how cyber intelligence would be passed on, but the GCHQ boss said it would be done in a matter of seconds and “just one click” based on existing systems.

The NCSC acts as a window for the spy agency’s normally secretive activities, already sharing information with British business and the public sector in an attempt to improve cybersecurity.

But the organisation has already said that, despite its efforts, the UK can expect to face what it calls a category one, or C1 cyber-attack, by the end of the decade, such as interference in elections or an attack on energy, banking or other vital infrastructure.

Serious attacks elsewhere include the Russian hacking of the Democratic party in the run-up to the 2016 US presidential election. The most serious cyber-attack on the UK so far was the WannaCry ransomware attack in May 2017 that disrupted hospitals, which was ranked as a C2 attack because there was no threat to life.

Last October, Hunt, accused Russian military intelligence of being behind a spate of “reckless and indiscriminate” cyber-attacks ordered by the Kremlin, including on the World Anti-Doping Agency.

To demonstrate progress in national cybersecurity, Fleming will claim that fraudulent attempts to obtain sensitive information using phishing emails sent via British computers have fallen markedly in the past three years.

He will tell an audience of security professionals at the start of the CyberUK conference that the proportion of such emails has dropped from 5.4% globally in 2016 – when the NCSC was launched – to less than 2% today.

A particular example of success, Fleming will say, is HMRC. “In 2016, HMRC was the 16th most phished brand globally, accounting for 1.25% of all phishing emails sent. Today it is ranked 146th and accounts for less than 0.1% of all phishing emails.”

Phishing is the attempt to fool individuals into handing over passwords, bank details or other sensitive personal information via email, typically by sending a message that falsely claims to be from an organisation.