The UK’s Huawei Cyber Security Evaluation Centre (HCSEC) faces “challenges” because of US sanctions on 5G equipment, culture secretary Oliver Dowden has said.
He told the Science and Technology Committee that the centre, set up by GCHQ in 2010 to assess the security of the Chinese firm’s telecommunications equipment, will continue to operate in light of the UK’s recent ban on new Huawei 5G equipment from 2021.
However, the US sanctions – which limit Huawei’s access to 5G microprocessors and lead to the UK’s Huawei U-turn last week – could cause complications for HCSEC.
“The centre will continue. There are challenges for the centre given the impact of the US sanctions because strictly speaking, in legal terms, whilst the employees are determined and vetted by GCHQ it does form part of Huawei,” said Dowden.
“And the reason for that is to protect the intellectual property of Huawei. Given the access to Huawei equipment will be severely impacted by the US sanctions, that is something we are exploring as to how it can essentially continue to have access to the equipment that it needs.”
Huawei evaluation centre: Who pays for it?
For a decade HCSEC, located in Banbury, has scrutinised Huawei’s equipment and provided annual security reports on the company’s equipment.
In 2019 a damning report found “serious vulnerabilities” in Huawei’s 5G equipment. However, these were the result of “poor software development” rather than deliberately constructed security flaws for the purpose of cyber espionage.
The US has repeatedly said that Huawei poses a threat to national security because of its close ties to the Chinese state. Huawei denies these allegations.
HSEC, also known as “The Cell”, was created to provide assurances that Huawei does not pose a security threat. It is overseen by the National Cyber Security Centre (NCSC), but its operation is paid for by Huawei.
Asked if this would continue, Dowden said:
“Huawei has always paid for it in the past and there is no reason to believe that would change.”
However, he said the UK hadn’t had a “specific” conversation about whether that would continue.
When asked why there is no equivalent of the Huawei centre for other vendors, such as Ericsson and Nokia, Dowden said:
“There are risks inherent in all vendors… but there are heightened risks in respect of Huawei… and that’s why we’re reliant on the evaluation centre because of its status as a high-risk vendor.”
When asked about the future role of the Huawei evaluation centre, the NCSC told Verdict that it had nothing further to add to Dowden’s comments. Verdict has also contacted Huawei, but had not received a response at the time of publication.