The EU members have approved a 'toolbox' of measures designed to help limit security risks on the new 5G mobile networks. These include adopting new security requirements for mobile operators, encouraging the use of multiple vendors to avoid reliance on single suppliers, and screening network suppliers for potential non-technical risks.
If risky suppliers are identified in the screening, it will up to the individual EU states to take measures to restrict their access to 5G network contracts. The EU states are expected to implement the measures by the end of April and report back to the European Commission on their progress by the end of June.
As expected, the European Commission has largely left the matter to the member states to handle, after coordinating a joint risk assessment by the 28 EU members last year. Several states have already adopted measures aimed at mitigating 5G security risks, such as France's tightened procurement rules for mobile operators, while others such as Germany are still working on their final policy.
None of the EU states have acted on the US advice to ban Chinese suppliers Huawei and ZTE entirely from building 5G networks, preferring instead to tighten security checks on all suppliers. European mobile operators and the industry group GSMA have warned against singling out suppliers like Huawei, saying it will slow the development of 5G and cost the industry billions to replace existing equipment already sourced from the Chinese company.
In addition to regulation adopted by the member states, the European Commission will use its powers to support increased security over the new networks. This includes supporting 5G development in Europe through its R&D and investment programmes, coordinating standardisation and EU-wide certification of hardware, implementing telecom and security regulations, enforcing trade and competition rules, and employing new rules on vetting foreign investments in areas strategic for the entire EU.
The Commission last year coordinated the joint risk assessment by EU states. It also supports network security coordination among the EU members through the NIS Working Group, named after the Networks and Information Security directive. The group published last October a report detailing the main threats and actors in the 5G supply chain and defined elements necessary for ongoing security checks of suppliers. The EU's cybersecurity agency Enisa also published a report in November mapping the 5G threat landscape.
