Huawei equipment is exposing British broadband and phone networks to new security risks because of 'shortcomings' in the firm's supply chain, senior GCHQ officials warn

  • Assessment is made in an upcoming report, which has been leaked by insiders
  • It comes from the UK's intelligence and security organisation, GCHQ  
  • The finding looks set to intensify the espionage debate around the company
  • The Chinese firm has previosuly come under fire in the USA and Australia
  • Huawei says no backdoor vulnerabilities have ever been found in its products

Huawei equipment could pose a threat to national security, senior British security officials have cautioned.

Intelligence experts say they can only provide limited assurances that the Chinese company is not a risk to broadband and phone networks in the UK.

The recommendation will be made in an as-yet unpublished annual report signed off by the GCHQ spy agency, according to inside sources.

Huawei, one of the world's biggest producer of telecoms systems, is a major supplier of broadband and mobile telephone network equipment in Britain.

The latest finding will likely intensify the espionage debate around the Shenzhen-based company, which has come previously under fire in the US and Australia.

One US official has claimed Huawei is effectively an arm of the Chinese government, and is more than capable of stealing information by hacking consumer devices.

Scroll down for video 

Chinese firm Huawei's UK operations may pose a threat to national security, senior British security officials have warned. Intelligence experts say they can give only limited assurances that the firm is not a risk, downgrading their previous position, according to inside sources

Chinese firm Huawei's UK operations may pose a threat to national security, senior British security officials have warned. Intelligence experts say they can give only limited assurances that the firm is not a risk, downgrading their previous position, according to inside sources

'Identification of shortcomings in Huawei's engineering processes have exposed new risks in the UK telecommunication networks and long-term challenges in mitigation and management,' senior British security officials wrote in the report.

The report was produced by the Huawei Cyber Security Evaluation Centre (HCSEC), which was established in 2010 in response to growing concerns that BT and other telecommunication firm's use of Huawei equipment could pose a threat in the UK.

HCSEC reports to the National Cyber Security Centre which is part of GCHQ.

Huawei said it welcomed the thrust of the latest HCSEC report. 

'The report concludes that HCSEC's operational independence is both robust and effective,' a spokesman for the company said.

'The Oversight Board has identified some areas for improvement in our engineering processes.

'We are grateful for this feedback and are committed to addressing these issues. 

'Cyber security remains Huawei's top priority, and we will continue to actively improve our engineering processes and risk management systems.'

Huawei says no inspection has ever revealed a vulnerability in its equipment. It says it is a private company not under the control of the Chinese government and not subject to Chinese security laws when operating overseas.

The company is a major supplier of broadband equipment and mobile networks in Britain, meaning its products are used in critical national infrastructure which could be targeted by foreign adversaries.

This is the fourth annual report into Huawei by the GCHQ branch, with the previous three concluding any risks posed by the company 'had been mitigated'. 

The assessment, in a soon to be published annual report signed off by the Government Communications Headquarters (GCHQ) spy agency, will intensify the espionage debate around the company. This image shows its headquarters in Cheltenham, Gloucestershire

The assessment, in a soon to be published annual report signed off by the Government Communications Headquarters (GCHQ) spy agency, will intensify the espionage debate around the company. This image shows its headquarters in Cheltenham, Gloucestershire

WHY DO BRITISH INTELLIGENCE THINK HUAWEI'S PRODUCTS MAY POSE A SECURITY THREAT?

China's controversial telecommunications equipment maker Huawei openly supports the ruling Communist Party.

Ren Zhengfei, a former People's Liberation Army (PLA) engineer, founded the company in 1987 and it has risen to rank among the world's top manufacturers of network equipment.

But his PLA service has led to concerns of close links with the Chinese military and government, which Huawei has consistently denied. 

Ren Zhengfei, a former People's Liberation Army (PLA) engineer, founded the company in 1987 and it has risen to rank among the world's top manufacturers of network equipment. But his PLA service has led to concerns of close links with the Chinese military and government, which Huawei has consistently denied

Ren Zhengfei, a former People's Liberation Army (PLA) engineer, founded the company in 1987 and it has risen to rank among the world's top manufacturers of network equipment. But his PLA service has led to concerns of close links with the Chinese military and government, which Huawei has consistently denied

Huawei operates in 170 countries and the company says one third of the world's population communicate using its products in some way.

It is the world's second largest network equipment supplier behind Sweden's Ericsson, and has made a large push into consumer products such smartphones in recent years.

Fears around its capabilities to tap into sensitive information stem from rumours of backdoors in in the firm's software.

Although no such vulnerability has ever been found, allegations for their capabilities range from the ability to tap into encrypted data  to knocking out communications facilities.

The UK's National Cyber Security Centre, which is part of GCHQ, has not claimed to find evidence of such vulnerabilities.

However, intelligence experts say they can only provide limited assurances that the Chinese company is not a risk to broadband and phone networks in the UK.

Advertisement

However, the upcoming report by the HCSEC marks the first time the organisation has reduced the level of security assurance it can provide for the equipment.

'Whereas in previous reports there was a conclusion that HCSEC could give assurance that risks have been mitigated, this time they will say limited assurance,' said one source with knowledge of the soon to be published report.

'This is a big change, though understated,' the person said. 

All sources contacted for this report declined to be named because the government documents have not yet been published.

Britain's National Cyber Security Centre, which is part of Government Communications Headquarters (GCHQ) that provides the signals intelligence, had no immediate comment. 

It is not exactly clear why that conclusion had changed, what recommendations the oversight board had made, or what any consequences of the report would be.

Both sources said the change of assessment was related to routine issues with product engineering and that nothing 'sinister' has been found.

Technical issues are commonly found in all technology products and fixed by manufacturers, however, these can be exploited by hackers if ignored.

Huawei has been deepening ties in Britain over the last decade and now supplies broadband equipment to the country's largest telecoms provider, BT Group, and mobile networks for wireless giant Vodafone Group.

Huawei says no inspection has ever found any backdoor vulnerabilities in its equipment. It says it is a private company not under Chinese government control and not subject to Chinese security laws overseas. This stock image shows the firm's P20 Pro handset

Huawei says no inspection has ever found any backdoor vulnerabilities in its equipment. It says it is a private company not under Chinese government control and not subject to Chinese security laws overseas. This stock image shows the firm's P20 Pro handset

It is also a major supplier to other European telecom carriers including Deutsche Telekom and Telefonica.

The company employs 1,500 people in Britain and in February pledged to spend a further £3 billion ($4.01 bn) in Britain following a high-profile meeting between chairwoman Sun Yafang and British Prime Minister Theresa May.

That is in stark contrast to the United States, where lawmakers have stepped up efforts to completely eradicate Huawei equipment from the country's networks.

Huawei has been thwarted in its efforts to establish its US mobile handset business.

The largest US consumer electronics retailer, Best Buy, has stopped stocking Huawei products, and a potential breakthrough deal with carrier AT&T collapsed in January.

Australia is also preparing to ban Huawei from supplying equipment for its planned 5G broadband network, two sources told Reuters last week, after its intelligence agencies raised concerns that Beijing could force the company to hand over sensitive data.

WHY ARE HUAWEI AND ZTE CONSIDERED A ‘NATIONAL SECURITY THREAT’?

Huawei P20 Pro (pictured) is the latest flagship phone from the Shenzhen-based company, which is now the third largest smartphone manufacturer in the world

Huawei P20 Pro (pictured) is the latest flagship phone from the Shenzhen-based company, which is now the third largest smartphone manufacturer in the world

The heads of the FBI, CIA, NSA, and the director of US National Intelligence, have warned against the use of Huawei and ZTE smartphones.

Elsewhere, the Pentagon ordered all retail outlets on US military bases to stop selling Huawei and ZTE branded smartphones.

FBI director Chris Wray said the government was ‘deeply concerned about the risks of allowing any company or entity that is beholden to foreign governments that don’t share our values to gain positions of power inside our telecommunications networks.’

These concerns stem from the fact that both Huawei and ZTE have demonstrable links to the Chinese government.

Huawei founder and president Ren Zhengfei had a successful military career in China's People's Liberation Army (PLA), and ZTE has close financial ties to the Chinese government.

Other Chinese companies such as Lenovo, Xiaomi, and Oppo do not have the same ties and as such, haven't drawn the same scrutiny from US politicians.

‘Huawei is effectively an arm of the Chinese government, and it's more than capable of stealing information from U.S. officials by hacking its devices," Arkansas Senator Tom Cotton said earlier this year.

‘There are plenty of other companies that can meet our technology needs, and we shouldn't make it any easier for China to spy on us’.

However, there has yet to be any public evidence that Huawei or ZTE products could endanger the privacy or digital security of consumers.

Huawei and ZTE both dispute claims from the US government they pose a threat to national security.

A spokesperson for Huawei said: 'Huawei is aware of a range of US government activities seemingly aimed at inhibiting Huawei’s business in the US market.

'Huawei is trusted by governments and customers in 170 countries worldwide and poses no greater cybersecurity risk than any ICT vendor, sharing as we do common global supply chains and production capabilities.'

In a statement, ZTE said: ‘As a publicly traded company, we are committed to adhering to all applicable laws and regulations of the United States, work with carriers to pass strict testing protocols, and adhere to the highest business standards.

‘ZTE takes cybersecurity and privacy seriously and remains a trusted partner to our US suppliers, US customers and the people who use our products.’