On 24 November 2020, the UK Government started the legislative process for a new Telecoms (Security) law which will, when passed into law, provide statutory backing for their already announced policy objective to exclude Huawei (and potentially other ‘high risk vendors’) from the UK’s 5G (and other) networks on the grounds on national security. This follows the USA’s summer 2020 exclusion of sales of chips using US technology to Huawei.
The proposed legislation does not itself ban particular vendors or set out detailed rules, but instead provides a framework, which will allow the Government and Ofcom to implement and update detailed rules. However, the Government has published details of its proposed restrictions on Huawei.
What is proposed?
The proposed legislation will update and enhance the existing (largely advisory) section 105 of the Communications Act 2003 to introduce a new statutory schema:
First, the bill places new statutory duties on providers of electronic communications networks and services to:
- take ‘security measures‘
- respond to and inform others (both affected users and Ofcom) about ‘security compromises’; and
- follow ‘codes of practice‘ set by the Government (interestingly, not Ofcom or GCHQ, although no doubt they will provide input).
Second, whilst Government sets the policy and codes of practice to be followed, Ofcom are given duties duties and powers to assess and enforce compliance, including reporting and sharing information with Government.
Third, the Government is given a wide new statutory power to give directions to operators regarding ‘designated vendors’ – with accompanying documents explaining its first intended use to be exclusion of Huawei from the UK’s 5G networks. Whilst Ofcom will monitor compliance, the Government will have a direct enforcement power.
Finally, the bill provides for fines of up to 10% of turnover and, for continuing contraventions, £100,000 per day.
What happens next?
On the legislative front, the bill has been introduced to Parliament and is currently passing through the various stages of the legislative process during which it may be amended. Given other urgent matters (e.g. COVID and BREXIT) it seems unlikely to become law until 2021.
The Government has announced its intention to consult on draft codes of practice, with the intention that these will be finalised once the bill becomes law.
Proposals in relation to Huawei
On 30 November 2020, the Government published a draft designation notice and draft designated vendor direction related to Huawei. These are not for formal consultation under the statutory process, but are instead for information, although there is nothing to prevent interested parties sharing their feedback with Government.
The draft designated vendor direction summarises its requirements on UK communications providers as follows:
- Not to make use of any Huawei equipment in 5G networks if such equipment was procured after 31 December 2020.
- Not to make use of any Huawei equipment, except for fixed fibre access equipment, in any network if the manufacturing process or supply chain for such equipment has been altered as a result of changes to the United States Foreign-Produced Direct Product Rule announced on 19 May 2020 and 17 August 2020.
- Not to make use of Huawei Managed Services in respect of any network after 31 March 2021, except for Huawei Specialist Maintenance Services provided in relation to Huawei equipment already installed in the network prior to 31 March 2021.
- Not to install Huawei equipment in 5G networks after 30 September 2021, except for directly maintaining Huawei equipment installed before this date.
- Not to make use of Huawei equipment or services in the execution of Core Network Functions after 28 January 2023.
- 35% cap on use of Huawei equipment in 5G access networks, FTTP networks, and other gigabit and higher capable access networks after 28 January 2023.
- Not to make use of Huawei equipment or services in parts of mobile access networks which could provide service to subscribers located at Sites Significant to National Security after 28 January 2023.
- Not to make use of Huawei equipment or services in any part of its 5G network after 31 December 2027.
- Ongoing compliance with the NCSC’s specific mitigation strategy for Huawei.