As the US mulls a full ban, following the Trump administration’s executive order banning contractors from using Huawei equipment, and banning Huawei and ZTE phones sales on US military bases, US telecoms are already acting.
AT&T and Verizon, two of the largest US telecoms, have stopped direct sales of Huawei phones as a result of government pressure. Canada faces severe pressure to follow with a ban of its own, but as of the beginning of February, the Trudeau government claims a decision has not yet been made.
In mid-April, the US Federal Communications Commission (FCC) chairman Ajit Pai announced plans to ban China Mobile, another flagship Chinese company, from being able to offer mobile services to Americans, citing security risks. The final decision will take place after a vote by the full commission, scheduled for May.
Five Eyes pressure presents a significant challenge for countries that have not formalized their decision with regards to Huawei, given that protecting their intelligence sharing relationships with FVEY countries outweighs considerations like lost profit for domestic carriers relying on Huawei equipment.
In France, a last-minute measure aimed at increasing security checks on telecommunications equipment and requiring companies to obtain approval for the use of certain equipment, failed to pass on February 6, 2019.
Though legislators claimed the issue of Huawei is highly sensitive, they felt unable to vote on such a measure without proper time to consider the matter, and debate has been reopened as of April 24th. Any future ban or additional measures would take months to implement, however, meaning Huawei can continue to operate there for the moment, and in any event, any bill will leave the door open for France’s national security agency to have a say in the matter.
Japan and Poland have also banned Huawei from involvement in their 5G networks, while Germany and Indonesia are considering bans. Italy, widely considered likely to ban Huawei, is now in the toss up column, as the industry ministry denies that special powers will be invoked to institute a ban.
The Czech Republic, a major buyer of Huawei tech, which even granted a contract to Huawei to support presidential communication requirements, as part of a larger push to attract Chinese investment, is facing a dilemma. Despite President Milos Zeman's high praise of the firm, the Czech Republic's cyber security agency, the Nukib, issued a directive warning of the dangers of using Huawei tech in the country's 5G network process, shocking the Chinese firm, which threatened to retaliate. The Nukib's main concern, like that of many other intelligence agencies is China's 2017 National Intelligence Law, which requires all Chinese companies to actively aid China's intelligence agencies, wherever they operate.
Telecoms struggling to find workarounds are lobbying their governments to introduce further security measures, instead of banning Huawei, but it is unclear where such measures would alleviate those governments’ concerns about risks to national security. Within the EU, the European Commission is continuing to debate a ban on Huawei throughout the EU, rendering some individual country’s debates null if it passes such a measure, and banning Huawei from all 5G rollouts. However, it is far more likely that, in the absence of truly damning evidence, the EU will simply continue to push members to share information about 5G risks, and create mechanisms to address any risks by the end of 2019.
How a Corporate Geo-Cyber Strategy Can Help Companies Pivot
Although smaller firms have limitations that larger firms can bypass, businesses of all sizes benefit from crafting a cohesive corporate geo-cyber strategy. Taking the time to design and deploy such a strategy allows businesses to not only understand their exposure to geopolitical events that may threaten operations, but also offer a range of tools to address such situations, and to find the opportunities that emerge from changes in the operating environment.
In the case of Huawei, it is vital for companies to acknowledge their dependencies on certain hardware providers, vendors, and anticipated ICT infrastructure rollouts, so that they may then plan for a range of scenarios, including those that are less probable but more likely to have a substantial effect on their ability to operate, expand, and profit.
In addition, it is crucial for firms of all sizes to have processes in place in the event that they suspect they are victims of Huawei’s efforts to steal technology, such as suspicious handling of samples, evidence that research has been stolen, or revelations that employees might be passing information to Chinese firms for money or under threat of blackmail. Such breaches could deal a fatal blow to a promising startup, or present a threat to national security if a major corporation’s newly developed dual use technology is stolen and weaponized. In addition, failure to properly disclose these breaches to authorities could result in further penalties and even incarceration, that would create financial losses and disruptions to operations, as well as extensive reputational damage.
These protocols are best developed in interactive simulations that allow employees at all levels to experience many different scenarios and test them of their ability to follow company protocol in identifying breaches, thefts, or other concerning events, and ensuring they respond effectively. By diagnosing how the organization currently addresses potential problems around corporate espionage, state-sponsored hacks, and other breaches, simulation facilitators can help companies identify the right workflows for helping employees report suspicions, collect supporting documents and artifacts, preserve a chain of custody, and correctly escalate and report the matter to the right executives. The chosen leaders can then ensure they have all the right information to pass on to authorities and aid in an investigation. Furthermore, by better understanding the issues with regard to a particular vendor, companies can be better informed as to whether to support bans or lobby their governments for added security rules and other measures which would limit financial losses and alleviate expected delays to major strategic initiatives.