bbc.com
‘Long-term security risks’ from Huawei
By Gordon Corera Security correspondent
5-7 minutes
« The Chinese company Huawei has been strongly criticised in a report by the body overseeing the security of its products in UK telecoms.
The report, issued by the National Cyber Security Centre, which is part of GCHQ, says it can provide « only limited assurance that the long-term security risks can be managed in the Huawei equipment currently deployed in the UK ».
The report reflects what are said to be deep frustrations at the failure of the company to address previously identified problems.
Huawei supplies telecoms for telecoms companies operating in the UK and this report comes ahead of a decision by the UK over whether to allow the company to build next generation 5G networks.
Poor practices
The US has been campaigning for it to be excluded on the basis the company poses a national security risk.
There is no allegation in the latest report that the company is deliberately introducing backdoors or working to carry out any kind of espionage on behalf of the Chinese state.
Rather, the accusation is that poor practices by the company create vulnerabilities that in turn pose security risks.
The report describes « significant technical issues in Huawei’s engineering processes ».
It also says Huawei’s approach to software development brings « significantly increased risk to UK operators ».
Officials say the rigorous system of oversight means those risks can be mitigated and managed.
But the report also warns that the current arrangement « can only provide limited assurance that all risks to UK national security from Huawei’s involvement in the UK’s critical networks can be sufficiently mitigated long-term ».
Huawei’s kit is often cheaper than that of rivals but with that come concerns that the business model driving its fast growth can lead to sloppiness in its work.
And because the company offers different products to different customers, it has been hard for security officials to be able to confirm that the equipment is all secured to the same standard. »