The EU countries are making progress implementing new security regulations for mobile networks, according to a first report from a coordinating group on implementing European Commission recommendations. However, more urgent work is needed on ensuring they avoid dependency on high-risk suppliers for 5G networks, the report found. A majority of the countries said their networks are exposed to risky suppliers, while few see sufficient ways to mitigate the risk.
The report was ordered by the European Commission in January when it released a 'tool box' to help the 27 EU countries asses security risks in their mobile networks and prepare for the roll-out of 5G networks. While commercial 5G networks are active already in 12 EU countries, progress on identifying and mitigating the security risks has been mixed, the report found.
Most of the countries have strengthened the powers of national regulatory authorities to regulate 5G security and implemented basic security requirements for the networks. However, only a few have measures in restricting the involvement of risky suppliers in 5G network construction. While most of the countries are well advanced in preparing such restrictions, the report's authors called for more progress so the work is completed in the coming months.
The methods implemented or under consideration include pre-authorisation for operators procuring equipment, such as France and Italy have adopted, or the implementation of 'white' or 'black' lists of suppliers. The Commission has favoured the former approach, in order to avoid banning specific suppliers outright, such as the has UK has done with Huawei.
State interference in the 5G supply chain
As for identifying which suppliers should be considered risky, just over half of the EU states said they would be using 'non-technical' criteria (in some cases alongside technical factors). Potential state interference in the 5G supply chain was named by most countries as the biggest risk to network security. As a result, many are considering basing supplier restrictions on their country of origin or the risk of interference from third countries. This may take into account the legal and political system of the third country or threat intelligence.
Once certain suppliers have been ruled out, there remains the problem of transitioning existing networks and choosing new suppliers. Little work has been done so far to help mobile operators reduce their dependence on certain suppliers, risky or otherwise, the report found, and the European Commission said that "progress is urgently needed" on this front.
The recommendation is that each country, in addition to restricting high-risk suppliers, also promotes a multi-vendor strategy among operators. However, only two of the EU countries said they had implemented measures to ensure no operator is dependent on a single supplier, and the majority said they had no timeframe in place for implementing this. Many see the need for new legislation to impose such requirements on operators, as well as challenges in the face of a limited number of suitable suppliers on the market. They called for more work at the EU level to support 5G research and development of alternative suppliers.
Next-generation networks
The Commission announced separately the start of an independent study into the 4G and 5G supply chain, to aid work in implementing its security recommendations. The report will assess the existing market situation, look at expected market trends and suggest possible European and national policies for addressing the risks and opportunities. The one-year study will have a strong focus on stakeholder participation, with two workshops and many expert interviews, the Commission said. The first workshop is planned for the end of this year, and the first results can be expected for beginning of 2021.
The Commission also released a new draft proposal on the proposed 'Smart Networks and Services' research partnership. With support from the EU's Horizon R&D programme, the new partnership is expected to build on Europe's existing strong position in telecom network equipment to take the lead in the next generation of technology. The research work is expected to include the development of 6G and Open RAN systems.
The report on progress implementing the tool box was prepared by the NIS Cooperation Group, which helps coordinate security issues among EU member states. It called on the countries to share information and solutions on implementing the 5G tool box, in order to complete the implementation. The states are required to report back again by 01 October on how the Commission's Recommendation is working and whether more action is needed.
