Weak link NZ urged to ban Huawei
New Zealand may be pressured to follow Australia and ban Huawei from rolling out new 5G networks, say security commentators.
Communications Minister Kris Faafoi made waves this week saying New Zealand could follow Australia and ban Huawei from rolling out the 5G network.
But Newsroom has learned the ultimate decision on 5G rollout might not even be made by Faafoi. Under the Telecommunications (Interception Capability and Security) Act or TICSA, it could be down to GSCB Minister Andrew Little to make the final call on Huawei.
Faafoi's remarks came after Australian spy chief Mike Burgess said his country’s electricity grid and water supplies would not have been adequately protected had Huawei or ZTE, another Chinese firm, been allowed to build the country’s 5G networks.
Burgess advised his government to exclude “high risk vendors” from the entirety of 5G networks, reported the ABC.
"A potential threat anywhere in the network is a threat to the whole network,” he said.
Huawei says Australia is different…
But Huawei has said security fears are overblown and that it has been unfairly scapegoated.
Deputy managing director of Huawei NZ Andrew Bowater told Newsroom there was “no point” targeting security fears at one company.
“It’s naive to target one company and think it’s going to protect New Zealand’s interest,” he said.
He said all technology providers were vulnerable to a certain extent to cyber-breaches, and targeting these concerns at Huawei was unfair.
He said Australia’s hawkish response was largely a symptom of its laws around cyber-security.
Under the TICSA legislation, which passed in 2013, New Zealand telcos have been required to work with the GCSB, our spy agency, when developing new networks This means Huawei’s technology is vetted by the spy agency for vulnerabilities before it is installed.
Australia’s legislation is looser. Bowater said the legislation in New Zealand gives politicians confidence in the security of the network.
GCSB Minister plays a role
The ultimate decision may not even be made by Faafoi.
GCSB Minister Andrew Little told Newsroom said the TICSA legislation could mean the ultimate decision was made by him, but there was a long process before such a decision could be made.
Under TICSA, the GCSB would make a security assessment of the new network. Following that assessment there would be a mitigations stage where the GCSB would work with the telcos to address any faults uncovered during the assessment.
“There’s a process laid out where any assessed risks are laid out and efforts are made to mitigate those risks,” Little said.
“That’s a process that is followed before there is any ruling on whether or not a particular proposal will go ahead,” he said.
He said that ultimately there was a role for the Minister who would give the final sign off on any new technology.
The GCSB is known to have lobbied the previous Government against using Huawei technology. It is likely this has continued under this Government.
Fears mount overseas
Confidence in Huawei is in short supply overseas, particularly amongst New Zealand’s Five Eyes partners.
The Five Eyes is an intelligence sharing arrangement between the United States, the United Kingdom, Canada, Australia, and New Zealand.
Alongside it’s outright ban from building 5G networks in Australia, Huawei has also been banned from buildings being used by government personnel in the United States.
Canada’s Centre for Cyber Security this year dismissed concerns about Huawei’s involvement in the 5G roll-out there. The dismissal prompted two senators from the U.S. Senate select intelligence committee to write a letter to Prime Minister Justin Trudeau urging him to block Huawei.
The letter, written by Republican Senator Marco Rubio and Democrat Senator Mark Warner said that, while Canada has strong telecommunication security safeguards in place, they had "serious concerns that such safeguards are inadequate given what the United States and other allies know about Huawei.”
The senators urged Canada to “reconsider Huawei’s inclusion in any aspect of Canada’s 5G development, introduction, and maintenance.”
The U.K. has not banned Huawei, but monitors cyber security through its National Cyber Security Centre to monitor possible security breaches.
However the Financial Times reported this approach did not appear to have worked. In July the Centre said that it was “less confident” it could provide “long-term technical assurance of sufficient scope and quality around Huawei in the UK” because of the “repeated discovery of critical shortfalls”.
Ban is political, not technological
Commentary so far has focused on the specific vulnerabilities of the 5G network. This is because the speeds that 5G promises means that more of the processing for the network is done at its fringes, where Huawei operates, rather than the core, which is run by other firms, like Cisco.
Huawei’s technology is currently used on the fringes of the 4G network. Both Spark and 2 Degrees make extensive use of their mobile base stations.
But security commentators suggest the main concern is political, rather than technological.
Independent security expert and former Pentagon advisor Paul Buchanan told Newsroom it has always been assumed Huawei built “backdoors” into its systems, but other telco firms did this too.
What had changed was the deteriorating security relationship with China.
“The geopolitical situation has changed,” Buchanan said, highlight the “increasingly aggressive foreign policy under Xi Jinping,” the current Chinese Premier.
“He’s become much bolder, much more assertive,” he said.
“They’re an emerging super power. They’re pushing the envelope.”
China “pushing of the envelope” leaves New Zealand vulnerable.
New Zealand is perceived as the “Achilles heel” of the Five Eyes partners. This means it could come under increased attack from China looking to extract Five Eyes Intelligence.
“If everybody else blocks Huawei and we don’t we’re the Achilles heel, we’re the back door into the Five Eyes,” Buchanan said.
“Hostile powers have always seen New Zealand as the way into the system.”
It also means New Zealand may come under pressure from its allies to lift its game when it comes to cyber-security.
Little told Newsroom he met his Australian security counterparts in August, shortly after their decision to ban Huawei.
“I’m certainly familiar with the decision and the reasons for it,” he said.
He rejected the suggestion New Zealand was a weak link in the Five Eyes alliance.
Part of this response could be increased development of offensive cyber weapons, rather than focusing on defence.
Buchanan likens cyber warfare to the Mutual Assured Destruction strategy that predominated during the Cold War. It held that the nuclear powers would never go to war with each other, because it would lead to the destruction of them both.
Cyber warfare was similar, he said. The most well-armed cyber states like Russia and the United States occasionally deployed small attacks on their enemies to signal the level of threat they posed. These actions work as a deterrent because it hints at the devastating extent of a nation’s cyber-capabilities.
“If you show the opponent that not only can you play defence, but you can play offence, that may deter him from trying to penetrate your infrastructure,” he said.
Huawei popular with New Zealand telcos
Spark and 2Degrees, the two New Zealand telcos who use Huawei on their networks reject Australia’s security concerns, and say the company has played a valuable role in slashing the price of mobile plans in New Zealand.
2Degrees head of corporate affairs Mathew Bolland said Huawei had provided technology for all of his company’s networks, beginning with the foundation of the telco in 2009.
Spark Boss Simon Moutter addressed the Huawei controversy in his address to the company’s Annual Meeting on Friday.
He urged the Government to be careful before barring Huawei.
“We would hope that our Government would not preclude them from being considered [for the 5G network] without incontrovertible evidence their technology presents security risks that the comprehensive security management tools we employ in our networks cannot mitigate,” he said.
But his remarks also seemed intent to assure the audience that Huawei was not allowed into the heart of the company’s 3G and 4G networks.
“We use other partners such as Cisco and Ericsson for processing and customer authentication technology within our mobile network core, which is often regarded as the 'brains' of the network,” he said.
Faafoi has confirmed that the 5G rollout, tentatively set for 2020, is on track.