Britain says Huawei Security Failings Pose Long-term Risk

China’s Huawei Technologies has failed to assure British security officials on the use of its products. It was unable to convince them that using its products in UK national infrastructure can be adequately managed. This was according to a government report released on Thursday.

Issues about the company’s engineering and security practices meant it could only give limited assurance. That is, if all risks to UK networks could be sufficiently mitigated long-term. This was a statement from a government-led board that oversees the vetting of Huawei gear in Britain.

The Chinese company had only made limited progress addressing issues raised last year. The board had no confidence in Huawei’s ability to complete a previously-announced cybersecurity overhaul. The board includes officials from Britain’s GCHQ signals intelligence agency.

The findings will increase pressure on the company. Huawei, the world’s biggest maker of telecoms networking equipment, was besieged by repeated rounds of U.S. sanctions and allegations. Its products are said to be possibly used by Beijing for spying.

The firm has repeatedly denied the allegations, though. Moreover, it said on Thursday the British assessment showed equipment vulnerabilities were not a result of Chinese state interference.

A company spokesman said, the report acknowledges that while their software transformation process is in its infancy, they’ve made some progress. They have improved their software engineering capabilities.

Initially, Prime Minister Johnson granted Huawei a limited role in the UK’s 5G infrastructure, then reversed that decision in July. He had ordered all of the company’s equipment to be purged from national networks by the end of 2027.

Chinese State Interference

The about-turn was due to the impact of new U.S. restrictions on chip technology. Britain’s National Cyber Security Centre (NCSC) said Huawei was no longer a reliable equipment supplier.

The latest report looked at events in 2019 and did not relate to the subsequent impact of the sanctions. This report is produced annually as part of the government’s procedure for vetting Huawei equipment used in the UK

Increased vetting meant the number of vulnerabilities identified in its equipment in 2019 rose significantly compared to the previous year. That includes one issue with the company’s broadband products that was deemed to be of national significance.

The board said it was not conscious of any of the vulnerabilities being exploited by nation-state hackers. Nevertheless, the weaknesses presented a serious risk.

If an attacker has knowledge of these vulnerabilities and sufficient access to exploit them, the report said. They may possibly affect the operation of a UK network. In some cases causing it to cease operating correctly, the report added.

The report further said, these findings are about basic engineering competence and cyber security hygiene. These give rise to vulnerabilities that are capable of being exploited by a range of actors.

NCSC does not believe that the defects presented are a result of Chinese state interference, the report said. 

Meanwhile, in other Huawei news, the company’s latest smartphones are already using just an open-source version of Android.  It is one that lacks the Google Mobile Services that power Gmail, Google Maps, YouTube, Google Play Store and YouTube.