Information released under the Official Information Act shows a list of network concerns audited by the GCSB in its Huawei decision, and casts doubt on the strategy used by the UK to mitigate the risk of network penetration.
The GCSB feared Spark’s 5G network, partly built by Chinese firm Huawei could possibly compromise things like the financial sector, and lead to disruption in energy, food, health and education.
The documents also cast doubt on Huawei’s claim security concerns could be mitigated by confining its technology to the “edge” of the network, which was the strategy approved last month by the British Government.
The spy agency eventually declined Spark’s request to build the network, citing “significant national security risks”.
Those concerns echo comments made by Australian spy chief Mike Burgess last year. Burgess told an Australian select committee that the electricity grid and water supplies would not have been adequately protected had Huawei or ZTE, another Chinese firm, been allowed to build the country’s 5G networks.
In New Zealand, the Telecommunications (Interception Capability and Security) Act or TICSA means new networks must be vetted by the GCSB before being allowed to proceed. That legislation asks the spy agency to consider whether the new network will compromise the public communications network, or lead to people being able to use the network for spying.
The legislation also asks the GCSB to consider whether the network will compromise eight other key services including central and local government, finance, energy, food, communications, transport, health, and education.
Information released under the OIA noted that all of these areas were looked at. The decision to block the network shows concerns were raised in at least one of them. However, the heavily redacted documents do not show which areas raised alarm and whether or not one, several, or all of these areas could have been compromised by the network.
The documents also assert that the GCSB did not face pressure from its Five Eyes partners to block Huawei from the network. Five Eyes is an intelligence sharing relationship between the United States, Canada, the UK, Australia, and New Zealand.
There has been some suggestion put forward internationally that the United States has been using faux security concerns with Huawei’s technology as a front in its trade war with China.
But the documents reiterate comments made by GCSB chief Andrew Hampton to Parliament’s Intelligence and Security Select Committee that the agency had not faced any pressure from other countries.
The documents say that while “relevant intelligence” had been received from the US and Australian security agencies, there was “no pressure to adopt a particular position”.
They also say that the the GCSB’s relationship with its Five Eyes partners could not have been a factor in the decision, as such a consideration is not outlined in the TICSA legislation.
The core and the “edge”
The documents also cast doubt on claims by Huawei that security concerns could be mitigated by keeping its technology on the edge of the network, rather than the core, which is typically thought of as the “brain” of a network.
This was the strategy adopted by the UK, which approved Huawei technology in its 5G networks last month. The US and Australia have effective bans on 5G networks featuring Huawei technology.
Huawei offered to keep its technology out the core of New Zealand networks, but a GCSB briefing to Minister Andrew Little suggests this offer did not sufficiently mitigate security concerns because in a 5G network, the functions of the core are distributed across the network.
“In the 5G context, many of the sensitive functions of a network will no longer be limited to the network core, but will be distributed through the network including within the RAN — the so-called network ‘edge’,” the briefing said.
“In other words, where the ‘brains’ of a network once resided in the core (hence why it was considered such a sensitive part of the network), those brains are now distributed throughout the network as a whole,” it said.
US President Donald Trump issued an executive order on Wednesday night (New Zealand time) that effectively bars US companies from using any telecoms equipment manufactured by China’s Huawei.
Back in New Zealand, the Commerce Commission has released a draft report on the mobile market, and said a 5G build excluding Huawei could increase the costs.
