The European Commission has stopped short of calling for a ban on Chinese suppliers for 5G networks. Instead, it wants EU members to carry out a joint assessment of security risks for 5G networks, based on existing network and cybersecurity legislation, and then will decide by year-end whether any mitigating action is needed. The decision follows pressure from the US to act against suppliers such as Huawei and ZTE, which the Americans believe could use 5G network equipment to share intelligence with the Chinese state.
The European Council at its meeting 22 March and the European Parliament earlier this month called for the European Commission to coordinate action on the matter, following lobbying from the US and countries such as Australia banning Huawei. Several EU states have already been assessing the security risk and stepping up their own requirements for operators developing 5G networks, such as Germany ahead of its spectrum auction.
The European Commission wants the EU members to take a coordinated approach on the matter and laid out a plan to ensure action by the end of 2019. By June, each EU country is expected to conduct its own national assessment of 5G security risks and update any national security regulations as necessary. The Commission and the European Agency for Cybersecurity (Enisa) should receive the national assessments by 15 July.
At the same time, the Commission will work with the states and Enisa through the NIS Cooperation Group, a mechanism set up by the Network and Information Systems (NIS) Security directive which took effect last year in the EU. Enisa will complete a 5G threat landscape report that will support EU states in the delivery by 1 October of the EU-wide risk assessment. By year-end, the NIS Cooperation Group should agree on any mitigating measures needed to address the cybersecurity risks identified at national and EU levels.
The Cybersecurity Act, which is expected to come into effect in the coming weeks in the EU, offers an additional tool, to set up an EU-wide certification framework. The Commission called on the EU members to make setting up such a scheme for 5G networks and equipment a priority. The work would be coordinated by Enisa and the Commission.
The actions would be assessed by October 2020 to see whether they are having the desired effect and if further measures are needed.
'Fact-based' approach welcomed by industry
The Commission's recommendation was welcomed by ETNO, the association of European telecom network operators, which said it supports a "harmonised and fact-based approach to security of digital networks". Some of ETNO's members had cautioned against an outright ban on Chinese suppliers, saying it could set back the pace of 5G roll-out and innovation.
ETNO noted that telecoms networks and services are already subject to high security standards and strict regulation, and this has led to a 5G ecosystem designed to be "trustworthy" and offering new opportunities to secure networks, including network slicing, network virtualisation, authentication and encryption. With the significant investment planned to deliver 5G, "a crucial enabler of socio-economic growth for all sectors of economy and society", ETNO said it was important to agree quickly a harmonised European approach and provide predictability to the market.
