The government-led committee set up to vet products made by the controversial Chinese firm Huawei has warned it has found new significant issues that could pose a risk to the British telecommunications industry.
The Huawei oversight board, which is chaired by the head of GCHQ’s National Cyber Security Centre (NCSC), said it had found further “significant technical issues in Huawei’s engineering processes leading to new risks in the UK telecommunications networks”.
The watchdog said in its annual report on Huawei that the company had made “no material progress” in addressing existing security flaws identified in last year’s assessment and raised serious doubts about the Chinese company’s ability to deliver a $2bn (£1.5bn) programme to address concerns previously raised by the UK oversight board.
The report said: “At present, the oversight board has not yet seen anything to give it confidence in Huawei’s capacity to successfully complete the elements of its transformation programme that it has proposed as a means of addressing these underlying defects.
“[Our] work has continued to identify concerning issues in Huawei’s approach to software development bringing significantly increased risk to UK operators.”
It also casts doubt on whether UK operators should be involved with Huawei over the future roll out of telecommunications networks. The problems included a concern related to a product called eNodeB, which provides a connection between the network and a user’s mobile phone.
The report said: “It will be difficult to appropriately risk-manage future products in the context of UK deployments, until the underlying defects in Huawei’s software engineering and cyber security processes are remediated.”
However, it did not call for a ban on Huawei’s equipment being used in the roll out of 5G networks. The US has put increasing pressure on the UK and other countries to stop Huawei from being involved in the deployment of future 5G networks. Countries including Australia have stopped Huawei from being involved, citing national security concerns.
The report said that last year “several hundred vulnerabilities and issues” were reported to UK operators to inform the risk management of their networks. Despite the scathing criticism, the report said the NCSC did not believe the defects identified in Huawei equipment “are the result of Chinese state interference”.
An NCSC spokesman said: “Huawei’s presence in the UK is subject to detailed, formal oversight. This report illustrates above all the need for improved cybersecurity in the UK telecoms networks.”
David Wang, Huawei’s executive director for research and development spending, said the hardware and software were “very complicated systems” that were subject to human error, but that there were “no maliciously planted back doors” in its systems.
The annual report did not suggest the UK networks were more vulnerable than in 2017.
“The report details some concerns about Huawei’s software engineering capabilities,” a spokesman for the company said. “We understand these concerns and take them very seriously. The issues identified in the report provide vital input for the ongoing transformation of our software engineering capabilities.”
Britain’s main mobile operators – BT-owned EE, Vodafone, Three and O2 – have started testing 5G technology using Huawei equipment. A complete ban on Huawei equipment could significantly slow up the roll out of 5G. It could also cost operators hundreds of millions of pounds to replace older Huawei equipment that might be incompatible with a rival supplier.
In December, BT confirmed it was removing Huawei technology from core areas of its 4G network, the sensitive parts potentially susceptible to cyber security breaches. The company said it was a continuation of its policy after the £12.5bn acquisition of EE in 2015.
Earlier this month, Huawei launched a lawsuit against the US over a government ban on its products, raising the stakes in a protracted diplomatic incident between China, the US and Canada, where a senior Huawei executive is facing extradition.
A final decision on Huawei’s involvement in the roll out of the UK’s 5G networks is likely to be part of a government review of the telecoms market and infrastructure, which is due to be published in coming weeks.