EU to Recommend Restricting High-Risk Firms From 5G Networks

By Catherine Stupp
The European Union is set to recommend that member countries restrict companies from supplying sensitive 5G technology if they pose a high security risk, according to a draft of a guidance document viewed by WSJ Pro Cybersecurity.
The document, expected to be published Wednesday, didn’t name China’s Huawei Technologies Co., but suggested the EU could use trade policies against foreign firms that violate the bloc’s laws, such as by receiving illegal government subsidies or sharing consumer data with foreign governments.
The Trump administration considers Huawei a spying threat. It has prohibited federal agencies from buying Huawei equipment and has restricted federal contractors from using it.
Officials in some EU countries have also warned that the company could share data with the Chinese government. Huawei has said it would never hand network data to Beijing.
The U.S. and some European officials have also said China provides unfair subsidies to Huawei, which has become the world’s biggest maker of telecom equipment, such as the hardware that hangs on cellular towers. The company has received as much as $75 billion in assistance from the Chinese government, The Wall Street Journal reported last month.
The EU document isn’t legally binding because member states are responsible for their own national-security measures, but it gives countries a template for what to do.
Because the document doesn’t explicitly demand cutting Huawei from 5G networks, some countries could use it to justify decisions to allow the company’s technology, said Kaan Sahin, a research fellow for technology and foreign policy at the German Council on Foreign Relations, a Berlin-based think tank. Others might justify restrictions on Huawei by referring to the warnings, he said.
“They want to ensure they retain the ability to make autonomous decisions about what technologies end up driving their economy,” said Kevin Allison, an analyst for technology policy issues at Eurasia Group, a political-risk advisory firm.
A spokesman for Huawei declined to comment before the document was published.
EU countries are deciding about 5G equipment as they try to manage increasing political tensions with China, Mr. Sahin said. “The timing is crucial and sensitive,” he said.
The U.K., which is due to leave the EU on Friday, said this week that it would allow Huawei equipment in some parts of its 5G networks. Germany and other European countries are expected to decide about Huawei in the coming months.
Companies and government officials around Europe have eagerly awaited the EU strategy. New leaders of the European Commission who took office Dec. 1 emphasize that the bloc should seek independence from foreign technology and use local companies. Aside from Huawei, the biggest suppliers of base stations and other equipment needed for 5G infrastructure are Sweden’s Ericsson AB and Finland’s Nokia Corp.
EU countries may exclude high-risk companies from building “key assets defined as critical or sensitive” in 5G networks, according to the document. Each country will determine whether a company is high-risk. The European Commission, the EU’s executive body, recommends those decisions consider whether a foreign government might interfere with the company’s products.
High-risk suppliers should be left out of sensitive or critical parts of 5G infrastructure, such as components that deal with core network function and parts in the radio access network, according to the document.
The document says the European Commission could use defensive measures such as duties against 5G suppliers that break the bloc’s rules on state subsidies or dumping, the practice of selling products in foreign countries at prices below their production costs.
The EU document recommends countries use components from more than one company because “a lack of diversity of suppliers increases the overall vulnerability… in particular if a large number of operators source their sensitive assets from a supplier presenting a high degree of risk.”
Experts say diversifying suppliers will mean big changes in some EU members. Huawei’s involvement in European networks varies between countries, according to a study published in June by the Institut Montaigne, a Paris-based think tank.
European countries are eager to roll out 5G in part because it is expected to transform critical industries including health care and manufacturing, with speeds up to 100 times as fast as current 4G networks. But many European companies underestimate cybersecurity risks because they don’t understand how 5G will change their business, said Jean-Marc Grémy, president of Clusif, a French association of cybersecurity professionals.
“Maybe we won’t have local networks in our buildings anymore. We’ll use handsets, Internet of Things [devices] in companies and factories,” he said.