China’s ZTE a national security risk, UK telcos warned

The National Cyber Security Center (NCSC) is advising the UK telecommunications sector to avoid the use of equipment and services from ZTE in China.

NCSC technical director Ian Levy has written to telecommunications organisations to set out technical advice regarding the potential use equipment and services from the Chinese state-owned enterprise.

“It is entirely appropriate and part of NCSC’s duty to highlight potential risks to the UK’s national security and provide advice based on our technical expertise,” said Levy.

“NCSC assess that the national security risks arising from the use of ZTE equipment or services in the context of the existing UK telecommunications infrastructure cannot be mitigated.”

The NCSC letter states that new Chinese laws allow the state to exert influence over companies and individuals, with “wide ranging powers of compulsion”, according to The Financial Times.

The letter goes on to say that: “mitigating the risk of external interference with equipment supplied by a particular vendor depends in significant part on telecommunications equipment being present from other vendors who are not subject to the same risk of external interference.

“The UK telecommunications network already contains a significant amount of equipment supplied by Huawei, also a Chinese equipment manufacturer. Adding in new equipment and services from another Chinese supplier would render our existing mitigations ineffective.”

The NCSC said it would be “impossible” to manage risks to the telecommunications sector if ZTE equipment was deployed at scale and that using ZTE equipment and services would have a “long term negative effect” on the security of the UK.

“The result would be an unacceptable national security risk to the UK telecoms infrastructure environment,” said Levy.

As far back as October 2012, a US Congress committee report warned that Huawei and ZTE posed a threat to national security.

The latest NCSC warning about ZTE coincides with the announcement of a seven-year ban on US companies selling products and services to ZTE due to its alleged failure to act against personnel who sold sensitive US technology to Iran and North Korea, according to The Guardian.

In March, ZTE agreed to pay $1.2bn in fines after it pleaded guilty to criminal charges of violating US sanctions on North Korea and Iran, which the NCSC said was a “relevant factor” in its decision.