Oral evidence: UK telecommunications infrastructure, HC 2200

Oral evidence, 10 June 2019.

Witnesses

Professor Rahim Tafazolli, Professor Andrew Martin and Professor Alf Zugenmaier.

Chair

Welcome to all three of you. Thank you for coming to give evidence this afternoon. I will ask you to introduce yourselves; could you also say whether you have any financial interests that you want to declare? First, do any members of the Committee want to declare any financial interests at this stage?

Darren Jones

I have a relatively long list. I used to advise BT, Three, O2 and EE as a lawyer and latterly worked as a legal counsel at BT. My wife also works there. I co-chair the all-party group on PICTFOR, a technology forum, which has Huawei as a sponsor, including at events in previous years. A couple of years before my election, I visited Huawei in China on a Foreign Office and British Council delegation, but I can confirm I am not employed by the Chinese state.

Chair

Thank you. Can I ask the panel to introduce themselves and offer any declarations? We will start with Professor Martin.

Professor Martin

My name is Andrew Martin. I am professor of systems security in the department of computer science in the University of Oxford. I do research on hardware and software security, and how you build secure systems out of components that may or may not be trustworthy. I also lead cross-disciplinary action activity in the university that looks at cyber-security in the round as a socio-technical problem, so I talk to lawyers, politicians, business people and a bunch of others. I do not think I have any relevant interests to declare. I told your researcher about all my funding sources, but I do not think they are very relevant.

Chair

But the funding sources are not relevant to this.

Professor Martin

I don’t think so.

Professor Tafazolli

Good afternoon. I am Regius Professor Rahim Tafazolli, director of the Institute of Communication Systems and founder and director of the 5G Innovation Centre at the University of Surrey. I have more than 30 years of experience in 2G, 3G, 4G, satcom and 5G. To declare my interest: I and my team work on research and innovation with everybody.

Chair

Are there any funding issues that you need to declare?

Professor Tafazolli

No.[1]

Professor Zugenmaier

My name is Alf Zugenmaier. I am a professor at Munich University of Applied Sciences. I believe I got invited because I consult for NTT Docomo in the 3GPP standardisation group in the security working group. There I was the rapporteur for 5G security specification and also for SCAS—at that time it was called SECAM: security assurance methodology. As I said, I do consulting for NTT Docomo, which is a Japanese cellphone operator. Other than that, there is nothing.

Chair

Thanks very much. By way of guidance, we have a lot to get through this afternoon. Don’t feel you all have to respond to every question if others have given an acceptable answer as far you are concerned. What is the damage that we are talking about in terms of the impact on national security resulting from an attack on a 5G network? What is the concern we are focused on here?

Professor Tafazolli

We need to bear in mind that 5G has been rolled out, with EE and others. It very much depends on the core technology that 4G has. It is bigger, faster and more powerful than 4G is, but it runs mainly on the core technology that 4G has. So if there is any security threat that 4G has, 5G will inherit that.

Chair

But is the potential damage greater with 5G than with 4G?

Professor Tafazolli

I do not see why it should be greater, because in the next three or four years the mobile broadband aspect of 5G is being introduced. In probably three or four years, when 5G will serve the mission-critical industry applications, the reliability and security resilience, mainly of the network, becomes more important.

Chair

Presumably an attack three or four years down the track could have more significant consequences than now.

Professor Tafazolli

Let me elaborate on that. I wrote an article for The House magazine published two weeks ago; the title was “5G is more secure than 4G”. and then in simple language I explained why. It is for a number of reasons: the 5G architecture is layered, the service layer, the network function architecture layer, the core network, and the radio access network. There are different layers where different security mechanisms can be applied and enforced. At the same time, it manages the services much more flexibly. The authentication from the users’ identification has a more enhanced version than 4G has. The network, for the next three or four years, will be operated as non-standalone, which means 5G has to ride on the back of the 4G network. When it is standalone, the security mechanism will hopefully be enhanced and will then be an end-to-end sort of security and resilience.

Chair

Professor Martin, you seemed to be nodding when I suggested that three to four years down the track, the potential damage could be greater with 5G compared with 4G.

Professor Martin

That would be my expectation, yes, in that if more and more applications use such a technology, our reliance on it will go up, whether in smart cities or autonomous vehicles.

Chair

Could you paint a picture of the sort of damage that could be done with an effective attack on a 5G network further down the track?

Professor Martin

Let us suppose we have a smart city full of autonomous vehicles. With the right kind of attack, I could inhibit their operation in some way, whether by causing them to stop, to go in the wrong direction or to collide with each other. Potentially, I could do that in a very targeted way if I had enough control of the network.

Chair

That is the sort of thing to fear if we get this wrong. Is that right?

Professor Martin

I would think so, yes.

Chair

If the information communicated over a 5G network is encrypted, what scope is there for equipment suppliers to enable espionage?

Professor Martin

That very much depends on who is doing the encryption and where it is.

Chair

Could you explain that?

Professor Martin

Many will be familiar with the concept of end-to-end encryption that you see in Signal, WhatsApp and other communications tools. There, you are relatively safe against bad behaviour by the network, because the encryption happens in your terminal and device and gets decrypted only at the other end. But many communications technologies and current mobile phone technologies involve point-to-point encryption, where nobody eavesdropping on your radio signal may be able to intercept it, but within the network itself, the signal may not necessarily be encrypted or it may be encrypted under the control of someone other than the end points, and so is much more subject to interception at that level.

Carol Monaghan

You said that autonomous vehicles, for example, may be affected. Is that because we are moving towards a situation where there will be more autonomous vehicles out there, or is it simply because it is going to be a different type of network?

Professor Martin

The intention is that we build more and more different applications that rely on this kind of network.

Carol Monaghan

So it is do with the applications rather than the network itself?

Professor Martin

I believe so—my colleagues here know more about 5G than me, but that is my understanding.

Professor Tafazolli

I would like to highlight that in the scenario where we have autonomous driving or a connected cars environment, they will not be operated only be one network. In the UK, we have four network operators, so each of them will be responsible for different aspects and different networks. It is not as though, if there is a security issue or attack on the network, the whole car and transport system on motorways will stop—that is impossible. In a way, it is security by isolation, so the surface attack on security is minimised by having more players running and operating the network.

Chair

So diversity is helpful?

Professor Tafazolli

Absolutely.

Stephen Metcalfe

Is the risk the same with 4G in the autonomous vehicle example? From what I am hearing across the whole piece, 5G is based on 4G; the risks are the same. Why was there such outcry when we were told that 5G might be underpinned by technology that we are already using, and was that just being whipped up by the media? On the ability to hack in to, say, a range of autonomous vehicles, presumably if we were still using 4G, the risks would be the same. Those are two separate points.

Professor Tafazolli

I believe that the risk will be the same as 4G in non-standalone operation of connected vehicles. When it comes to standalone architecture—when the core network is specific for 5G, which at the moment is being standardised but is not deployed yet—one of the aspects of the 5G core is reliability. There is a huge amount of emphasis on the connections being reliable and available in the order of 99.999%—five 9s at least—of the time. No system—no network—has ever been designed and operated with such high reliability. That reliability has to be tested so that, for example, when cars travel at 70 mph on the motorway, the connection does not break down.

Stephen Metcalfe

Except that an autonomous vehicle—we are using that as an example—should not be dependent. It should be totally autonomous; it should not be dependent on being connected. If it feels that it is being hacked into, it should have a system that says, “I’m going to ignore all external information and just rely on my radar, sensors, sonar, lidar,” or whatever else is driving it. The danger is that if we put out this idea that the system or your car can be hacked, we will put the development of the technology back quite quickly.

Professor Tafazolli

Absolutely.

Professor Martin

Yes, that is a fair point. It is a straw man example here, but we shouldn’t put too much on to that particular example. The general sense of having lots of communicating devices and disrupting their operation is the more important point.

Chair

There is a lot of talk in the media about core and non-core parts of the system. Can we still make that distinction with 5G as we could with 4G? Alf, you are nodding.

Professor Zugenmaier

To use a technical term, you have the radio access network, which encompasses the radio link, and the connection that goes to what is called the core network, where the core functions are located. It is called the core network, but given what we will maybe see one day—mobile edge computing—the core network, as defined by the functions, may be moving out closer to the cell sites.

Chair

Does that mean that the distinction becomes more blurred?

Professor Zugenmaier

If you are talking about geographic location, yes, but if you are talking about the actual function, it is very clear what functions are core network and which are access network.

Chair

So in the future it would remain possible to exclude a particular company from the core, just as it is now possible? The blurring geographically does not prevent you from excluding particular providers from the core.

Professor Zugenmaier

Yes, and that depends on what you want to achieve by exclusion. We are now seeing a shift from boxes that you unpack, plug cables into and put somewhere, to virtual network functions that run on hardware that is sold decoupled from the function itself. Now you have the question, where do you want to exclude your manufacturers from? Do you want to exclude them from the hardware as well?

Chair

Suppose you want to exclude them from the bits that might cause concern in terms of national security.

Professor Zugenmaier

Okay. If you understand which bits those are, yes, you could mandate certain deployments.

Chair

Can you minimise risk by excluding any provider that one is concerned about from all those core functions with 5G?

Professor Tafazolli

Yes. There is a clear distinction between core and radio access networks wired through a unified interface, which is standardised in the 3GPP standardisation. We know where the boundary is between core and radio access technology. That is done purposely so operators have the option of buying the core from one vendor and radio access from other vendors. They can inter-operate with each other from that point of view. That flexibility has always been there in 4G and 3G—not so much in 2G, but from 3G onwards.

Chair

Under 4G, there has been advice to networks to protect the core from national security concerns. It has been, as I understand it, quite a varied picture about which networks include providers from China, for example. Do you think there should be a clearer ability, through regulation, to require networks to exclude any provider causing concern from recall?

Professor Tafazolli

There is already provision in the standards. As long as all the vendors—it doesn’t matter where they are or in which part of the world—follow and comply with the standards, their radio, core and mobile phones should be able to interwork with each other.

Chair

Bluntly, my understanding is that some networks have Huawei equipment in the core of their networks. Does that need to change? Do we need to be able to require networks to exclude from the core, if we have a particular national security concern?

Professor Tafazolli

Can I elaborate on that? We are talking about vendors. Vendors sell equipment, hardware and software, but most of the responsibility is on the shoulders of the network operators. When they buy their equipment and they deploy it, they have to make sure that each node as well as the whole network is secure and operated securely—

Chair

But should Government be able to require networks to exclude?

Professor Tafazolli

I think they have not met with operators, especially the four operators you have in the UK; most of them have been operating the networks for more than 30 years. They know how to manage the situation and to operate the system.

Chair

So we just leave it for the networks to determine our national security?

Professor Tafazolli

I believe so.

Chair

Is that you view, Professor Martin?

Professor Martin

That level of detail for 5G is outside my expertise.

Stephen Metcalfe

Back in 2010, the Huawei Cyber Security Evaluation Centre was established, with a view to checking and looking for major vulnerabilities in both the hardware and the software. In one of the early versions of the system there were 1 million lines of code; in the current system there are hundreds of millions of lines of code. How reasonable is it to expect an organisation to be able to evaluate that hardware and software?

Professor Martin

I looked up the numbers and I believe the evaluation centre has 38 staff. If a multi-billion pound business could improve its security to the point of not having any problems with 38 staff, I am sure they would all do it.

Stephen Metcalfe

Yes. Anything further? Judging by that comment, can anyone do it?

Professor Martin

Eliminating vulnerabilities is the stuff that all software and hardware vendors are endlessly trying to do; it is exceedingly difficult. Looking at someone else’s code to find vulnerabilities is particularly difficult. The report from the evaluation centre seems to say that in the case of the work they have been doing, it is—I have forgotten what the word used was; not chaotic, but something approaching that. Looking for vulnerabilities is like shooting fish in a barrel—there are plenty to find. Proving to yourself that there are none is hypothetically impossible anyway.

Stephen Metcalfe

Is it a pointless exercise?

Professor Martin

No, because the whole point of that centre, and other similar activities, is to build your level of assurance that you know what is going on.

Stephen Metcalfe

It is better to have some level of assurance than none.

Professor Martin

Yes, or to know that you should not have any assurance, but to rate it and to be able to make an informed decision.

Professor Tafazolli

I wanted to bring your attention to this: 3GPP, through a security assurance process, are defining each node and how it should be tested for 5G—we have similar specifications and processes for 4G but not for 5G yet; it is being developed—and what the processes are for each device in the network that needs to be tested for security assurance. Also, the GSMA is coming up with the verification test and certification of the network nodes to be tested through the independent test labs; that needs to be done. I am pleased to say that this process is being defined. It is not fully defined yet, but more than 50 operators are involved in that. More than five vendors are involved in that specification—helping 3GPP, which are global standards, as well as GSMA, to have a process of testing each piece of network equipment. But I cannot comment on the human factor.

Stephen Metcalfe

Once you have gained that security assurance yourself, through looking at code or whatever process you use, how do you ensure that what is deployed matches what you have evaluated?

Professor Tafazolli

That is the point I mentioned: it is not only the vendor’s responsibility; it is the network operator’s responsibility as well. In the UK we are quite fortunate in that most of our network operators have been in this business for more than 30 years, and security was as important in 2G as it is today.

Stephen Metcalfe

One final quick question. As you do this evaluation—as you go through the code and look at the process—how easy is it to distinguish between what may be the inclusion of an inadvertent security flaw and a deliberate backdoor? Are there very obvious differences? Not being someone who would be able to code in either of those, I wondered about that. Does it become obvious?

Professor Martin

I think if you were designing a backdoor, your very first task would be to make it look like a mistake. If you were halfway competent, that is certainly what you would do, and there would be no way to tell whether it was a mistake or deliberate.

Stephen Metcalfe

So that is the answer.

Professor Martin

A deliberate mistake would look like a mistake, yes. You could, I suppose, design something that was easier to exploit, but that would be almost the proverbial smoking gun, so I do not think you would do that. You would make it look like a mistake.

Stephen Metcalfe

Does anyone disagree or want to comment further on that? Professor Tafazolli indicated dissent. Professor Zugenmaier indicated dissent.

Dr Julian Lewis

Could I just ask you if I would be right to summarise the situation with self-driving cars, for example, as follows? Is it basically the case that we are building new systems that are more and more dependent on a technology that cannot really be safeguarded? Would it be anyone’s role in society to ensure that, if we were involved in some sort of conflict with an adversary that was able to exploit those vulnerabilities and close down those systems, we would have some sort of fall-back so that, if we did not have self-driving cars, we could still drive cars ourselves?

Professor Martin

Guided by the previous comment, I think we should be careful about using cars as an example. Indeed, my colleagues who work on autonomous cars say that they certainly need to design the safety so that the car is actually autonomous and not reliant on the network. But to the general point, yes, we are building a society that is more and more dependent on network functions. If we were ever in a situation of conflict, we might discover that all sorts of unexpected things stopped working.

Dr Julian Lewis

Whose responsibility is it to plan for that?

Professor Martin

I think it falls on a lot of people, but ultimately is it a matter of critical national infrastructure, I suppose, and for those who take responsibility for such things.

Dr Julian Lewis

I would have thought it was a Government responsibility rather than one of private companies. Talking of private companies, if we were in a conflict with an adversary, would there be any greater danger arising from our dealing with a firm like Huawei, for example, than from our dealing with a firm from another country with which we were in a less adversarial relationship? Or would the vulnerabilities be the same irrespective?

Professor Martin

That has a very complex set of answers, because we are talking about global supply chains. We may be dealing with one vendor, but they may get their components from another place. Indeed, the vulnerabilities within any particular piece of equipment may not be under the control of the management of the vendor in question anyway; there may be some other party who wants to sell them to a third party. It is going to be a very complex picture behind the scenes.

Dr Julian Lewis

Let me give one final example. We have just been talking about backdoors dressed up to look like vulnerabilities. Would there be a greater chance of an adversary knowing where these backdoors or exploitable vulnerabilities were if they had been involved in constructing the system than if they had not?

Professor Martin

The designer and constructor of a system is always in a much better position, yes.

Chair

Professor Zugenmaier, do you have any comments on that?

Professor Zugenmaier

Yes. In this discussion about 5G, people are ignoring that it is all happening on top of IP technology—the technology we use for internet routing, so you also have all the IP routers in your network, even in the core. So if you think of 5G as what is defined by the 3GPP, a lot of the functions are not really visible because they are underlying. Another thing that needs to be considered when discussing this, especially when looking at the complex supply chains, is that your supply chain is not just linear; you need all the compilers and so on and libraries at many different stages. So if you really wanted to subvert some function, there are many places where you could do so. There is also the question whether the label on the top of the box and the country of origin will give you assurance that what you are getting is actually what you hoped for—namely, a reliable product. Very often, it is also a matter of how much money you are willing to spend on your security functions and features. If you tell a manufacturer, “I would like to have a product which is next to free,” maybe you can get some functionality, but you have to ask yourself: what quality are you getting? Security is a quality of product. So if you are trying to save money, you have to consider where money can be saved.

Chair

I should have said that we are pleased to have Julian, the Chair of the Defence Select Committee, with us for this session. I apologise; I should have introduced you at the start, Julian. On Julian’s point about it ultimately being Government’s responsibility to protect the state from attack, should the Government require networks to exclude providers and suppliers from the core in 5G to improve protection in terms of national security?

Professor Zugenmaier

It depends. First, why would you have that only for the 5G core and not other places as well?

Chair

Potentially other places as well, but should Government play a stronger role in requiring networks to act in a way consistent with national security?

Professor Zugenmaier

I would take the stance that if there are smoking guns or evidence that certain products do not fulfil the requirements, it does not help you if you have bought something from, say, a US vendor and you find there is a hard-coded password in it as a backdoor as opposed to getting something from another country. So if Governments are worried about the security of networks, it would make more sense for them to have requirements on the quality of security than on a label on a box that says “shipped from”.

Chair

Understood. Thank you.

Bill Grant

I am very much a layperson, but I am sensing that somebody has to take responsibility for identifying the risks that will be known and the perceived risk. When you put out the specification to a contractor, and I believe there may be only three contractors capable of fulfilling the 5G roll-out, is it clearly the Government’s responsibility to identify the risk to the system and embed that in the specification put out to tender for the persons to install it? Is it wholly a Government responsibility?

Professor Martin

Wholly is a strong word but, certainly, Government sets regulations to make sure we cannot blow ourselves up with badly made engines. I do not see any reason why Government should not make similar regulations to make sure that someone else cannot blow us up with badly made networks.

Bill Grant

It seems to me that amount of traffic that would flow in 5G is far more significant than in 4G, and therefore the risks of being able to interfere with or damage that system rise in line with the traffic that flows.

Professor Martin

Yes. On one level, it is merely a commercial contract between the user and their network provider, but if we are going to rely on that network for all manner of public goods, as we seem to be, it surely is part of the function of Government to protect us all.

Bill Grant

To identify the risk and engineer that risk out in the specification.

Professor Martin

Yes.

Darren Jones

I want to go back a little to when we were talking about core and edge, to explore a little what weight would be given in a risk assessment to the physical security of a base station. My understanding is that in previous iterations in 2G, 3G and perhaps 4G, the base station might be physically secure in a locked exchange that someone such as Openreach might manage, and the access points will be external to that and connecting in. I think that we heard earlier is that in 5G capabilities, that base station technology is moving out towards the edge, into locations that might not be physically secure in the traditional sense of an exchange. If that is the case, what is the weight of a risk assessment of tampering access if the base station is somewhere else, compared with just the interface between the two?

Professor Zugenmaier

I think it is the other way around. In 4G, the base stations were moved out to the cell site, closer to the antenna, while in 5G there is the possibility of having a distributed central unit split where the distributed unit would be closer to the antenna, and the central unit can be moved further towards physically protected processing sites. We are slowly moving that point further in again. The interesting part is that the way that the encryption is specified is that it starts at the mobile and at least for the encryption that is specified for the 5G system, if you were to use it without anything on top, your encryption would terminate in the central unit of the radio access network. Afterwards, you would re-encrypt and have hop-by-hop security, as was mentioned earlier, to have an IP set connection to the core network. Within the core network, you can have those IP set connections. That is deployment-specific, whether you do that within one data centre or not. If it leaves your network, it is without any protection, unless the communicating party puts in a layer of encryption on top.

Professor Tafazolli

Bear in mind that there are two major parts to the edge. One is just the antenna—for us an amplifier—because we need more of those for the purpose of coverage. There is no intelligence there and each covers an area of 200 or 300 metres. If one of them goes down, only the coverage for about 200 or 300 metres goes down. Most of the intelligence aspect goes on inside the network. That could be in an area that manages a number of remote radio heads, which were referred to. Each of them cannot be responsible for all the network. There are many of them inside the network, and each of them is responsible for a geographical area. If there is an attack, it will knock down the coverage in a small area.

Darren Jones

That already happens in 4G, so we already have this—they are not all locked up in our exchange building.

Professor Tafazolli

Yes.

Darren Jones

You will have read and heard that a lot of the political concern is about the Chinese state’s ability to influence or direct Chinese-owned companies. Do we know whether the supply chains of non-Huawei competitors—Ericsson, Nokia and others—are free of any other Chinese companies?

Professor Tafazolli

It does not matter who the vendor is; most of the equipment comes from China on the hardware side. The supply chain comes from China, India and other countries where the human resources are not that expensive. It is a global business. It is not that vendor A only makes the products in their own country. That is why the supply chain is quite sophisticated and complicated. When everything is put together, which is the responsibility of the vendor, with their own brand on it, it needs to go through the process of security assurance as a whole. Once it meets the certificate, it can go to the next step. It does not matter what the supply chain that puts everything together do. That process of certification is being defined which will be in place before the end of this year.

Darren Jones

If our concern is that there could be interference at some point in the supply chain, it does not actually matter whether you end up going with Huawei, Nokia or Ericsson, because at some point, from the bottom to the top, that risk exists between all three. Professor Tafazolli indicated assent.

Professor Martin

I think it might be an overstatement to say that it doesn’t matter, in that, each of those vendors is ultimately responsible for the products that they sell and they are supposed to assure their supply chain. The question comes back to how much assurance you have that they are indeed exploring their supply chain correctly.

Darren Jones

Can you illustrate what that looks like?

Professor Martin

Hundreds of components or thousands of components.

Professor Zugenmaier

If you think about compilers, maybe it goes back 50 years, because one compiler is used to build the next one, which is used to build the next one. This is what I was alluding to earlier. It is not just a linear supply chain in which you extract ore, make chips and so on, but you somehow have to build on something that allows you to create a chip. You have to use development tools to create software, so your supply chain becomes more like a tree than a simple chain. In theory—it gets more difficult to put something in the further you are from the finished products—you could have problems anywhere along there. You may have heard that when Huawei was put on to the list of companies you could no longer export US technology to, people started saying, “Oh it could be that Huawei phones are now becoming less secure,” because they couldn’t get the software updates from Google anymore, to update the software that was on the phone—just to make clear how complicated the supply chains are these days. As you said, at the end the person who puts the label on at least they should stand for the quality with their name.

Darren Jones

It is hundreds of companies and it is built on legacy technology, so it is quite complicated, I suppose. All witnesses indicated assent.

Darren Jones

My last question for this section is trying to understand the difference between an unlawful interception from a technology company and a third-party attacker, whether a state or a terrorist group, whatever it might be. Is there any significant difference in terms of an attacker’s ability to interfere with the network, based on the fact that they have provided an aerial or a bit of technology, compared to a country, for example?

Professor Tafazolli

In the mobile networks, most of the cyber-security threats are denial of service attacks. It is not so much about stealing people’s information or whatever. They try to bring down the network by stealing some of the services. I think that amounts to about 70% of the total cyber-attacks—at least, a couple of years ago those were the sorts of numbers. The user data security is quite robust. It goes through encryption and different security mechanisms, which are managed by the network operators, because at the end of the day it is extremely important to the operator’s business to keep that security and the privacy of customers’ information. Attacks happen—we have seen attacks on the internet, for the denial of service. We saw the attacks to the NHS, because a different version of the software was not upgraded in time. That sort of thing is quite common. To minimise these attacks in 5G or 4G+, whatever is distributed, the functionality is not all in one place—not geographically and not even logically. There is a separation between the service architecture and network function architecture and between the core network and radio access network. In a way, it is security by isolation; and it is better in 5G than 4G was.

Chair

Do you conclude from that that the risks of using Huawei, in a controlled way, are manageable? That’s the critical question.

Professor Tafazolli

Everything is manageable, provided that the actors in the chain—the supply chain, the vendors and the operators—do their job properly.

Chair

Do you agree with that, Professor Zugenmaier?

Professor Zugenmaier

I think we are missing whoever is relying on the application. If our application relies on 100% availability of the network or on any sort of quality that the network does not provide, we will run into difficulties. If you think of this as network operations, we sort of understand where we are, but people may believe that the network has different qualities from what is actually in the contract and they may not provide for contingencies or for problems that can occur anytime. You could have major flooding somewhere and have a major power outage. It doesn’t matter what the availability was supposed to be before; suddenly it’s not there because there is no power. There are lots of other things that you may need to consider when society starts to depend on an infrastructure. The network may work as designed, yes, but in terms of the applications, society depends on the network in various ways. In terms of the resilience of the society, you would always have to think, “What would we do if this didn’t work?”

Chair

Taking all that into account, and given that in this country at the moment there is a big debate about whether we should follow what the Americans are arguing that we should do—exclude Huawei—or include them but manage the risk, what is your conclusion?

Professor Zugenmaier

I would always argue for trying to manage the risk, and if the outcome of the risk management study is to exclude certain vendors from certain points, that’s it, but I am more of a technologist; I’m not a politician, so I can’t really say that because there is a country of origin—

Chair

But your understanding of technology allows you to understand whether there is a threat to national security.

Professor Zugenmaier

There are threats to national security that are beyond technology. As long as it’s within the realm of technology, I think I can understand, but when it goes beyond that, it’s outside my area of expertise.

Chair

But your view overall is: manage the risk.

Professor Zugenmaier

Yes.

Chair

Professor Martin, you wanted to comment on the question that Darren had asked.

Professor Martin

Yes. This is an evolving situation. Historically, telecoms operators have been a little bit separate from the rest of the internet security cabal. Relatively few people—academics or hackers—have looked at the security of telecom networks, because the equipment is expensive and it’s just hard to get your hands on things. That is evolving very quickly, partly because these new technologies are much more software based, cloud based and so on and partly because more people are paying attention. It’s clear that when you do pay attention, you find all sorts of nasties in many products. That is perhaps a cause for alarm. On the question “Who should you trust?”, I was quite shocked by reading the report of the security evaluation centre and the rather damning words there about the quality of the software engineering in the products, because if you do expose those to a large number of hackers you will get a large number of vulnerabilities found by who knows whom. That may apply to other vendors, and you would have to ask those who do evaluations to comment on those vendors, but I would tread very carefully.

Martin Whitfield

I just want to explore another aspect of the transparency in this image of a tree that you have given, which is really about funding and the input of funding into academic research in the UK. I know that Oxford University expressed concern at the beginning of this year; they were not going to pursue new funding opportunities with Huawei and gave reason for it, principally over public concerns. So my opening question is this: how significant is Huawei’s funding to academic bodies with regard to 5G research in the UK?

Professor Martin

Well, it is not significant to us at the moment.

Professor Tafazolli

In the 5G Innovation Centre, Huawei is one of the industry partners among many; I believe that there are 25 different global industry partners. All the UK operators are investing in this; all of them are here. They are investing in research on 5G, together with Huawei, Samsung, Sony, Fujitsu and many other companies. So that money—the funding—is important and we use it not only for us to do research but to support UK small and medium-sized companies to come and use our test-bed that we have developed, in order for their product to be internationally competitive. This is extremely important; we have more than 55 UK SMEs that utilise the facility that we have to advance their products. So I would say research and innovation, short and medium term to long term, is extremely important for our own prosperity.

Martin Whitfield

It makes sense that the companies that are most interested in 5G are the ones that will invest in the academic research to drive their research and development.

Professor Tafazolli

On R&D, we have many good UK SMEs that are developing games or applications, or simply making a beautiful antenna, for example, but they want us to test whether their solution actually works end-to-end for 5G and where they stand compared with other companies internationally. So from that point of view it is not just funding university research but many ecosystems within the country are important.

Martin Whitfield

I think it is right to say that Huawei, with regard to the University of Surrey, is a platinum-level funder, which I have read somewhere was $7.5 million. Would that figure be right?

Professor Tafazolli

Yes. It is £5 million sterling.

Martin Whitfield

£5 million sterling? Oh, well, there we go.

Professor Tafazolli

And they are platinum members, the same as Vodafone and EE are platinum members, and they are among many different platinum members, and we have many different gold members.

Martin Whitfield

Would it be right to say that the platinum members are the biggest players in the field, because obviously—?

Professor Tafazolli

Because they give us more money.

Martin Whitfield

They give you more money—yes, absolutely. The question that follows from that is: is there any pressure on academics to downplay any aspect? Obviously the aspect we are looking at today is security. Because of the funding source, is there pressure on academics to change their view or defend a position that they may not otherwise support?

Professor Tafazolli

It is important—extremely important—for us as an academic institute to be impartial. I have been in advanced research for more than 30 years and I work with all the manufacturers—the old ones, as well as the new ones—and all the UK operators, not only within the country but also in Europe and elsewhere. One important aspect to realise, which I always tell our guys and friends and colleagues, is impartiality. We are not religious about any particular technology. Our job in the 5G Innovation Centre is to tell the truth—the technical truth: what is the art of possibility? Then the industry will take it up, package it and shape it, decide whether it should be standardised or not. That is the mission that we cannot deviate from, and that requires funding.

Martin Whitfield

I presume, Professor Martin, that you would agree on academic independence—the right to say what is academically correct?

Professor Martin

Of course that is always our objective, but equally I am aware that there is nobody completely objective in this world. In other contexts, when I have had funding from vendors for particular work on particular technologies, I have become more familiar with their narrative around the technology, and that must affect the way I talk about it. Even if I am aiming to be objective, I can’t know that I am.

Martin Whitfield

I appreciate that.

Chair

Thank you all very much indeed for your time this afternoon; it is really appreciated. Examination of witness

Witness

John Suffolk.

Chair

Welcome. Thank you very much. I think you were here from the start, so you probably heard that we have a routine of asking about any financial interests. Is there anything you want to declare beyond your position representing Huawei?

John Suffolk

None whatsoever, Chair.

Chair

Thank you very much indeed. I will start the questions, if I may. What services are included in Huawei’s safe city projects?

John Suffolk

Safe city is just a generic term for cities in particular to look at how they can improve their efficiency or safety. It might include traffic light control or CCTV systems. It depends what the objectives of a particular city are. Safe city is not one standard set of tools, processes or outcomes; it is very variable, depending on what your objective is.

Chair

You will be aware of the Australian Strategic Policy Institute report, which suggested that Huawei’s products have often been deployed in countries with poor records of political stability, rule of law and corruption. It also stated that in some countries, public security technologies have “created a range of political and capacity problems, including alleged corruption; missing money and opaque deals; operational and ongoing maintenance problems; and alleged national security concerns.” Do you accept that?

John Suffolk

No. Our point on this is really quite simple. Our starting point in the 170 countries in which we operate is: what is the law, and what does the law define as acceptable and unacceptable? I think it is right for Governments to determine, in essence, their objectives and enshrine that in law.

Chair

So if it is a dodgy regime, you will go with it?

John Suffolk

I don’t think it matters whether it is a dodgy regime; it matters what is in the law. We do not create any moral judgments on what we think is right or wrong. That is for lawmakers to do. We execute within the law in 170 countries.

Chair

On that point about moral judgment, what products and services do you provide for local government in Xinjiang province?

John Suffolk

That is not actually one of our projects; it is done via a third party. Typically, what we would provide is a range of data centres or storage, and then it is for that third party to put that into whatever the package is that they are trying to offer for their particular customer.

Chair

But do you have products and services in Xinjiang province in terms of some sort of contractual relationship with the provincial government?

John Suffolk

Our contracts are with the third parties. It is not something we do directly.

Chair

I see. So there is an intermediary, but your products and services end up there?

John Suffolk

Yes. Typically on a safe city, as I said earlier, it is not one thing. You might find there are 100 or 200 different vendors in, all providing a little bit. While Huawei appears to be quite a large company, it is not possible for us to provide 100% of all technology solutions for all situations.

Chair

I understand, but I am interested in your involvement in Xinjiang at the moment. The Australian Strategic Policy Institute report alleged that Huawei supplies and assists the Public Security Bureau in Xinjiang, which has, in turn, been accused of surveillance and of human rights abuses, including, according to the report, “an estimated 1.5 million Chinese citizens and foreign citizens” being detained. How do you respond to those allegations?

John Suffolk

As I said, our job is to provide technology and services to partners. In this instance, that is what we have done. The—

Chair

Do you have no concern about being, in a sense, complicit with such outrageous human rights abuses?

John Suffolk

I do not think it is for us to make such judgments. Our judgment is: is it legal within the countries in which we operate? That is our criterion. It is for others—predominantly the Government—to make judgments about whether they think it is right or wrong.

Chair

But we are faced with a situation in which Huawei is involved in the provision of technology and services that has led to significant human rights abuses. Is that not something that concerns you?

John Suffolk

I do not know the specifics of whether they have or they have not, based on one report but—

Chair

Do you condemn those human rights abuses?

John Suffolk

We always condemn human rights abuse in any country in which it occurs.

Chair

Even where it involves your equipment and services.

John Suffolk

In any country in which it occurs. We believe, in essence, that our objective is to understand the law in the 170 countries in which we operate, and to operate within the law as defined by those Governments.

Chair

If Huawei co-operates with the Chinese Government on state surveillance in China, particularly in Xinjiang province, to what extent can it resist pressure from the Chinese Government to enable surveillance abroad? You have demonstrated a willingness to work with the Chinese Government in a province where there are, allegedly, gross human rights abuses, and that suggests a close working relationship with the Chinese Government. Should that cause us concern in terms of your work here?

John Suffolk

I would not accept that characterisation. I would say that, in essence, we understand the law. It is the Government’s role to set the law, whether in the East or the West, and it is our job as a supplier to work within that law. It does not matter to us what the name of the country is; it is whether it is lawful. Coming back to your question about whether we could be put under influence, we are quite clear, and it is quite proven, that we are an independent company. No one can put us under pressure. We have made it very clear that, regardless of the country, if we were to be put under any pressure by any country that we felt was wrong, we would prefer to close the business.

Chair

Should we do business with a company that is complicit in human rights abuses?

John Suffolk

I think you should do business with all companies that stick to the law.

Dr Lewis

There is a lot of law in China, isn’t there? Just like there was a lot of law in Nazi Germany. Some laws are good laws and some laws are bad. Some countries are totalitarian, repressive one-party states, and that includes communist China, doesn’t it?

John Suffolk

We do not make judgments about whether laws are right or wrong. It is for others to make those judgments.

Dr Lewis

Do you have a view as to whether China is a one-party state?

John Suffolk

China is a one-party state, yes.

Dr Lewis

Do you have a view as to whether that Chinese one-party state is repressive of human rights?

John Suffolk

I don’t have a view on that, no.

Dr Lewis

You don’t have a personal view on that.

John Suffolk

I don’t have a personal view on that.

Dr Lewis

You are a moral vacuum.

John Suffolk

I don’t believe so, no.

Dr Lewis

Is there any country in the world with a repressive Government that you would be unwilling to take a job from if you were offered it?

John Suffolk

I have never given that any thought, so I cannot answer that question.

Dr Lewis

Well, here’s an opportunity—give it some thought. Is there any regime in the world that you would not be prepared to work for, as long as your work involved observing the laws in that country?

John Suffolk

As I said, I have not given that any thought. If you want me to answer the question with some thought, I cannot do that now.

Chair

That is a remarkable position you have stated.

Darren Jones

Mr Suffolk, you agree that there is a difference between ethics and law, correct?

John Suffolk

Yes I do.

Darren Jones

Does Huawei have any ethics regarding who it supplies to?

John Suffolk

Our starting point is always, in essence, that the law defines the ethics as far as we are concerned, because it is for Governments to define what is right and wrong, just as the UK defines what is right and wrong or what it will and will not allow. That is enshrined in law. That is our starting point.

Darren Jones

Companies are an entity in their own right, aren’t they, Mr Suffolk? They can make decisions about whether they want to do business with certain customers. Following on from Dr Lewis, have there ever been any customers that you have chosen not to supply to?

John Suffolk

I don’t think we do it on customers; we do it on products. We stay in the commercial space, for example. We don’t—

Darren Jones

But you do have customers.

John Suffolk

We have customers, but the customers—

Darren Jones

Can you answer my question, Mr Suffolk? Have you ever declined to supply to a certain customer?

John Suffolk

I am not in the sales, so I couldn’t answer that.

Darren Jones

If you could write to us with that answer that would be great.

John Suffolk

I am very happy to do that.

Darren Jones

My second question is about the third party in Xinjiang province. Do you have any controls over that third party’s behaviour with the Chinese state?

John Suffolk

Not that I am aware of, no.

Darren Jones

So, if the Chinese state asked that third party to interfere with equipment that you supplied to it with what we have understood to be poor quality programming, they could go ahead and do that without any oversight or control from you as a supplier. Is that correct?

John Suffolk

I have no knowledge of whether that is right or wrong.

Darren Jones

If you could write to us with the answer, Mr Suffolk, we would be obliged. John Suffolk indicated assent.

Carol Monaghan

I want to ask some more about the law in different countries. We are looking at a situation where the 5G network could be provided by Huawei. Would that be operating under the laws of China or the laws of the UK?

John Suffolk

Any operation of a network is always operating under the local law where it is deployed. In that context, it would be operating under UK law.

Carol Monaghan

So what access would your 5G equipment have to data that was being sent? In other words, would it be able to see the communications?

John Suffolk

We do not run networks; we provide equipment to telecommunications operators. They run the network. We have no access to any of the data that are running across that network.

Carol Monaghan

What about your equipment? Would it be able to track the motions of a certain individual?

John Suffolk

As I said, because we do not run the network, we have no access to the network. Whatever capability the operators are building in is purely under the control of the operator.

Carol Monaghan

What about the equipment itself? Would it be able to access the movements of a particular individual?

John Suffolk

Let us take, for example, mobile phones. If you turn on GPS on your mobile phone because you are using something like Google Maps, that sort of product can track where you are. Generally speaking, that information is then sent to the central telecommunications network.

Carol Monaghan

But that is my choice, whether I turn that on or not.

John Suffolk

That is your choice.

Carol Monaghan

If I decide to turn that off, will your equipment have the ability to track my movements?

John Suffolk

If you think about what telecommunications does, it tries to connect you with a base station, wherever you are, in order to connect you to the network. It therefore does know where you are, because it knows where the information is coming from. In that context, telecommunications networks from all vendors know where you are, so as to connect you to those networks. Huawei’s equipment is no different from anyone else’s equipment.

Carol Monaghan

Would Huawei be able to remotely access equipment that was supplied to the UK?

John Suffolk

We have no ability to remotely access anyone’s equipment unless the operators have granted that permission or even have that capability. Different operators around the world have different ways of accessing. Sometimes they want people physically on site, and sometimes they will ask for controlled remote access, but that is under the full control of the operator.

Carol Monaghan

So you would be able to remotely access if the operator gave you that permission.

John Suffolk

Only from Europe. We have a support centre in Romania, and that connection is turned on or off via the operators.

Carol Monaghan

So Huawei has an operations centre in Romania, so people in Romania would be able to access that?

John Suffolk

If the operators granted that from the UK, yes.

Martin Whitfield

To pursue that, if we look at the current 4G network that Huawei supports, also from Romania, the software in essence is updated from Romania remotely with the consent of the operators who grant that. Is that the same model that you expect or hope to use with 5G as well, so that you would have remote access from Romania for updates, rather than physically having to visit everywhere?

John Suffolk

That is not actually the way it happens. The upgrade of any software is under the control of the operator, and operators have different policies. Most will do it on site for the big central data. Where you tend to use somewhere like Romania, which is a pretty standard model around the world, is for fault identification, where you say, “We have a bit of problem. Can you look at what the data is telling us?” Once you have identified the problem, it might mean some upgrade, but that upgrade is done in situ. Typically, it is not Huawei employees who are involved in that upgrade. Again, that is down to the operators’ choice. They control all of that.

Martin Whitfield

But on the current 4G, it is Romania that monitors for the faults. That is where the little light goes on to say there is something wrong in the system. Would that be Huawei’s intention with the 5G, if the operators agree to that?

John Suffolk

The use of Romania is at the operator’s discretion, but as the previous panel said, 5G is building on 4G, so our plan would be to use broadly the same models unless the technology or the customer demanded something different.

Bill Grant

I am trying to understand Huawei. Who are the key shareholders or stakeholders in the company? Is it operated by a board? Can you pop along and put your hand on its ethical policy?

John Suffolk

It is employee-owned—it is owned by about 96,000 shareholders. There is a full governance structure, which we have published for many, many years, from the board down to all the supervisory committees. We have what we call a business conduct guideline, which I am very happy to send to the Committee if it would like to see it.

Chair

But you claim that you have no links to the Chinese state.

John Suffolk

That is true.

Bill Grant

One of your key themes is that you would enter into 170 or 171 countries and you make the clear statement that you would obey their laws. Would you turn a blind eye if they had wicked and bad laws in those countries? Is it simply that whatever their law says, you are happy to work with them?

John Suffolk

Our starting point and our end point—I am sorry to repeat this—is that we understand the laws in the country. That can be a difficult thing to do, but once we understand the law, we will operate within the law. We do not make judgments.

Vicky Ford

Before I ask my question, I have to make two declarations of interest. First, I co-chair PICTFOR with Darren; Huawei is one of a number of tech companies that are members of that organisation. Secondly, I am a PPS in the Foreign Office, so I will not ask any questions related to foreign policy. I want to ask a question about technology. An article in the Financial Times suggests that “Huawei could…use software updates to inject vulnerabilities between source code inspections.” Why would a company want to do that? More specifically, what safeguards are there to prevent that from happening?

John Suffolk

The whole debate that we saw in the first panel about vulnerabilities, patching and injection is an interesting one. Many of you have technology on your table here, and you will all be aware of the WannaCry ransomware last year and its significant impact on the health service, for example. That had nothing to do with the telecommunications vendors at all; in essence, it was about a faulty piece of software that had not been patched for the right period of time. The reality is that all software, regardless of whether it is new or old, has the likelihood of some vulnerability, and therefore everybody is going through a patching exercise. Let me give you an example. Mr Metcalfe, I think you asked about the value of the UK CSEC. The UK CSEC is there to find whether there are vulnerabilities that people can spot. We can argue about whether that is a good thing or a bad thing, but our model is quite simply this: we allow any country and any company to review and inspect our products. That is not because we expect them to find 100% of the issues—if we did that, we would be in the software engineering business, not the telecommunications business—but because we believe passionately that the more people you have looking, inspecting, poking and prodding, the more chance you have of finding something. Going back to your question, I would say that there is no point in anyone trying to inject something into software when, in essence, every week somebody is doing an announcement for a Microsoft Word patch or a Google patch. As you will know, you in Parliament have been subject to phishing attacks coming in through your email inboxes. That is a different way of breaking into software. As a good burglar would tell you, why break into a house with all the lights on, security and a dog barking, when you can go next door where no one is looking at you? Security is more than what people think. It is very hard to inject. From our perspective, we believe in full openness and transparency. We want people to find things—whether they find one or 100, we do not care. We are not embarrassed by what people find. People have talked about poor coding or poor engineering. We stand naked in front of the world; it may not be a pretty sight all the time, but we prefer to do that, because it enables us to improve our products, and we all benefit from that.

Vicky Ford

So no safeguards?

John Suffolk

We believe you have to put safeguards all the way along the line. We mentioned the supply chain earlier. In Huawei products, only about 30% of the components are Huawei’s; the rest come from a global supply chain. We inspect that global supply chain by taking apart and checking things coming in from manufacturing. We are building in segregation of duties so that one person does not have access to all of the products. We limit what engineers can do. So wherever we have a part of a process, we look to build a control into it. CSEC is one of those controls.

Stephen Metcalfe

Good afternoon. You talk about the CSEC set-up. It has an oversight board, and for the second year running it has commented on the poor cyber-security in your products as well as the lack of action being taken to address that. Can you expand on what the plan is to address those concerns? Perhaps you can take us through what that process is and how transparent it will be.

John Suffolk

The first thing to say is that we conform to all of the Government’s published standards and policies on security. We also conform—you can check with our customers later—to all their bid documents and contracts on security. So whatever we have been asked to do from Government policy to a security requirement in a customer’s perspective, we have fulfilled. The CSEC report has required that we do better in many areas. We accept that. I think, as was said earlier by one of the professional speakers, some of the software is quite old, and what was in our view good five years ago is not what we think is good today. I guarantee that if we are sitting here in five years’ time, we will not think that what is good today is still good. On what we are going to be doing, first, we have built up a lot of clutter in some of the code. We have multiple versions of the same piece of code. You might ask, “Why do you do that?” Let me explain. One thing we are incredibly proud of is that some of the countries we operate in are not rich countries, and they do not have rich customers. They do not have the ability to buy the latest shiny bit of tin; they want to sweat the asset and keep their equipment going for 10 or 15 years. One of the routes we have taken is always to ensure that we maintain code that we know will run on 10 or 15-year-old equipment. It is a bit like me saying, “Can you take your modern equipment here, take what is on there and make it run on something from 10 or 15 years ago?” Typically, that is not possible. We have to simplify that, but do so in a way that does not cause a resilience issue. We were talking about autonomous vehicles earlier. I think I would be sitting here for another reason if we ran too fast to change the software and the networks kept going down. So resilience for us is the No. 1 priority—keep those networks up. That means we have to be cautious. Any fool can drive at speed; it is whether they can do it safely. We are taking our time to get it right so that we do not affect carriers around the world who are supporting more than 3 billion of the world’s population.

Stephen Metcalfe

You are drawing up a plan about how to do that, and you will do that at a pace that maintains resilience so that you do not damage the system already in place, but when will that plan be in place? Will you share it with the oversight board to demonstrate how you will move from the current situation—I understand about the clutter in the code—to a simplified, easier set of commands to understand and spot where there may be any issues?

John Suffolk

First of all, we have already taken UK customers and the oversight board through the plan, and we have already agreed what is the first set of products to go through the upgrade process. Those products have gone through the upgrade process, and they are going through evaluation at the evaluation centre now. We do not determine the sequence of the upgrades; that is done via the oversight board. So some of the work has already been done. It is done on a priority basis set by the oversight board—the CSEC and the UK operators—and the first products are already in there.

Stephen Metcalfe

So the board, if we got them in front of us, would feel involved in this process?

John Suffolk

Yes, in essence, they are setting the agenda in terms of what the sequence will be.

Stephen Metcalfe

Finally, Ryan Ding, who I presume you are aware of—

John Suffolk

Yes.

Stephen Metcalfe

He told us that, in his view, this transformation process will take three to five years to see tangible results. First, do you accept that that is an accurate evaluation of how long this will take? Secondly, does that mean that equipment will continue to be potentially vulnerable and there will be no improvement in cyber-security on equipment until 2022?

John Suffolk

Where Ryan Ding was coming from was that to do all of the products that operate within the UK will take three to five years. As you can imagine, some products are really very important from an infrastructure perspective.

Stephen Metcalfe

Are they being prioritised?

John Suffolk

They are being prioritised. So the oversight board, with the UK operators, has set the priority. It is on the big projects that have the big difference. The ones that you sold only 500 of are at the back of the queue. To do the whole lot will take three to five years. But progress has already been made because the first set of products are already going through the evaluation centre.

Stephen Metcalfe

So it is slightly unfair of him to make that comment. Is that right? You have challenged it. It will be five years before we see any improvement in cyber-security.

John Suffolk

You will see improvements before five years, definitely. I am not sure whether the NCSC would be even less complimentary if it was going to take three to five years.

Chair

Why do you think the oversight board, two years running, has raised, in effect, the same concern? They are quoted as saying, “Huawei’s transformation plan could in principle be successful”. The board, however, “currently has not seen anything to give it confidence in Huawei’s ability to bring about change via its transformation programme and will require sustained evidence of better software engineering and cyber security quality verified by HCSEC and NCSC.” Why are they reaching that conclusion that no progress has been made?

John Suffolk

I think it is fair to say, Chairman, that we—Huawei—could have done a better job on communications.

Chair

Did you take your eye off the ball?

John Suffolk

No, I don’t think it is about taking your eye off the ball. It’s about talking to our other customers around the world. Our products are shared by all countries. While we are taking on board the ideas and suggestions from the oversight board, we need to go back and check with other customers whether those changes in some way have a negative impact on the other customers and countries. I don’t think we have done a particularly good job of explaining ourselves to the oversight board in terms of where we have got to in that thinking. It is not just about solving today’s problem. We have talked about autonomous vehicles; we have not really talked about autonomous robots. You have talked about, in essence, artificial intelligence. The issue for us is not just thinking about looking back and how we can improve to get ourselves to a reasonable position today. It’s about looking forward to understand how the technology and the threats might change, and to try to cater for some of those.

Chair

Are you saying it has just been your failure in communicating all the progress you have made to the oversight board, or that you have not made sufficient progress and you need to up your game?

John Suffolk

I think it is both, Chairman.

Damien Moore

In a previous answer, you said that Huawei did not have any links with the Chinese state. Has there been an opportunity when it has failed to comply with a request from the Chinese Government?

John Suffolk

We have never had a request from the Chinese Government to do anything untoward.

Damien Moore

Anything at all.

John Suffolk

Anything. Let me be honest here. We have to pay our taxes, so I want to be clear. They never speak to us, but in terms of the purpose of this Committee, we have never been asked by the Chinese Government, or any other Government, I might add, to do anything that would weaken security.

Damien Moore

Would there be anything for any other Committee that might give a different answer to that question?

John Suffolk

Our answer would be the same. Are we asked to do things or build things into our products? Our answer would be: we have never been asked to do those things.

Damien Moore

Liang Hua, Huawei’s chairman, has reportedly said that Huawei “are willing to sign no-spy agreements with governments, including the UK government, to commit ourselves to making our equipment meet the no-spy, no-backdoors standard.” What is that standard, and how would such an agreement work?

John Suffolk

There isn’t an international standard on this. It’s a request we received from one mainland European Government: would we consider signing a no-spy deal? It is fair to say that different Governments have different approaches to how they want to deal with security. If it is relevant for a Government to sign a no-spy deal, then we are happy to do that, but at the moment you would need to craft a deal. Our view would be that to make it worth while, you would need to link it to the contract of the operators that you are serving.

Damien Moore

To the best of your knowledge, do you know of any other provider that has had to commit to doing this?

John Suffolk

I am not aware of any, no.

Dr Lewis

You said the Chinese Government has never asked you to put any weaknesses in the system. Does that mean that you are saying that the Chinese intelligence and security agencies couldn’t get into your systems if they wanted to?

John Suffolk

If we remember Edward Snowden a few years ago, he amply demonstrated that Governments of capability can break into most things, including Huawei servers, so you can never say that a Government, whoever they are, if they have the capability, cannot break into systems. That is what Governments do.

Dr Lewis

But surely there is a law in China that requires Chinese companies to co-operate actively with the intelligence services, and surely that applies to Huawei in China, doesn’t it?

John Suffolk

Well, all laws in China apply to all companies in China, not just Huawei. That is point No. 1. Secondly—

Dr Lewis

Yes, but Huawei is the company we are considering. Why don’t you just admit the fact that Huawei is obligated to co-operate with the Chinese intelligence services in China?

John Suffolk

There are no laws in China that obligate us to work with the Chinese Government on anything whatsoever. We have looked at all of the Chinese laws. We have taken on board professors in Chinese law and we have had their views validated via Clifford Chance in London, and there is no requirement on us or any other company to undertake what you are suggesting.

Dr Lewis

So the law of 2017 doesn’t exist.

John Suffolk

No, the laws do exist, but it is the scope and context of what those laws enable you to do.

Dr Lewis

That law states very clearly that Chinese organisations and individuals are required to co-operate with the Chinese intelligence services, and you are saying that Huawei isn’t required to do that.

John Suffolk

I am saying our legal advice is that is not the case. That is not their interpretation, and it is not our interpretation.

Chair

When your company wrote to me, you focused on the fact that it didn’t have extraterritorial effect. Julian is asking about inside China. China’s national intelligence law appears to be very clear on its requirement on individuals and organisations.

John Suffolk

I think it is fair to say, Chairman, that many countries produce laws that are unclear, and we have had to go through a period of clarification with the Chinese Government, who have come out and made it quite clear that that is not the requirement on any company. We have had that validated by our lawyers and revalidated again by Clifford Chance. I believe there is no such obligation.

Dr Lewis

So you are saying that article 14 of China’s national intelligence law, passed in June 2017, empowering the agencies of the Chinese state to “request the relevant organs, organisations and civilians to provide necessary support, assistance and co-operation” to those intelligence agencies does not apply to Huawei.

John Suffolk

I am saying that what that means, according to our legal advice, is that it does not require Huawei to undertake anything that weakens Huawei’s position in terms of security.

Dr Lewis

And I am saying that that is entirely unbelievable. Can you tell us whether firms like Nokia and Ericsson are given the sort of access to Chinese critical national infrastructure that Huawei would like to have in the west?

John Suffolk

They follow me, but I will give my view and you can clarify with my friends. The telecommunications market in China is a very vibrant market, and Ericsson and Nokia have very good market share, and they compete with us head on in terms of China, so to answer your question, yes they do.

Dr Lewis

Finally, on 4 June it was the 30th anniversary of the Tiananmen Square massacre. How would you feel about equipment supplied by your firm enabling a similar exercise in suppression by a future Chinese Government?

John Suffolk

I am sorry. I didn’t quite understand the question.

Dr Lewis

How would you feel about equipment supplied by your firm enabling the Chinese Government, which is the direct descendant of, and absolutely continuously linked, in a linear fashion, with, the regime that killed thousands of people 30 years ago on 4 June in Tiananmen Square—how do you feel about being complicit in repressive actions of that sort?

John Suffolk

I do not think we are complicit in anything. I believe that our objective is to understand the law and comply with the law. It is for others to make judgments.

Dr Lewis

Like the people who manufactured the gas chambers, no doubt, in Nazi Germany.

John Suffolk

We comply with the law.

Dr Lewis

And so did they.

Graham Stringer

I was going to ask a similar question, actually. I listened carefully to your answers about following the laws. Do you think that when we come to write our report, it would be fair to compare your company with IG Farben, who manufactured Zyklon B and sold it to the German Government during the second world war?

John Suffolk

I would paint a different picture. If you are asking us, “Should we ignore the law?”, I am sure you would say, “No, you must not ignore the law.”

Chair

Basically, what you are saying is, “As long as we comply with the law, that is fine. We are amoral; we have no interest in what is happening”, like the one and a half million Chinese people who have been incarcerated in Xinjiang, for goodness’ sake. You do not care.

John Suffolk

It is not that we care or do not care; that is not our starting or end position.

Chair

Yes, but you continue to provide equipment and supplies to facilitate that surveillance state.

John Suffolk

I think it is for Governments to determine what is right and wrong. That is their sovereign duty.

Chair

But you will make money out of it.

John Suffolk

We are a commercial organisation.

Chair

Right, you would. Okay.

Graham Stringer

Can I have an answer to my question?

John Suffolk

My answer to the question is still the same as it was earlier: that, in essence—

Graham Stringer

Is it fair to compare you to IG Farben?

John Suffolk

I do not know the circumstances around that.

Graham Stringer

Are you technically qualified in the kit that we have been talking about in the systems, and if so, can you tell us your technical qualifications in that kit?