Huawei advice: what you need to know
In January 2020, the NCSC explained the work we do to help secure the UK’s telecoms networks. We also issued detailed technical guidance and risk assessments for UK telecoms operators, and a blog from the NCSC’s Technical Director that explained our thinking. However, recent international developments mean this guidance has now changed, as have our recommendations to the UK government.
What has changed now?
In May 2020, the US issued a new sanction (an amendment to the US direct product rule and to the Entity List) that further restricts Chinese technology company Huawei’s ability to produce important products using US technology or software. This means Huawei will need to make big changes to how it designs and build its telecommunications products.
Why does the US announcement affect the UK?
Huawei is the largest telecoms equipment manufacturer in the world. As well as producing smartphones and other consumer technology, Huawei has supplied UK telecoms providers for many years. Huawei equipment can be found throughout the UK’s telecoms networks. The NCSC (and its predecessors) has worked throughout that time to ensure that we make best use of Huawei technology, while keeping the UK safe and secure.
The new US sanction announced in May 2020 means that Huawei is very unlikely to be able to continue to use US technology and software in the design and manufacture of its products. The NCSC has looked very closely at the impact of these changes on the UK and no longer considers that the UK will be able to manage the security risks of using affected Huawei technology in our future 5G networks.
What does this mean for me?
The NCSC’s work on this topic relates purely to Huawei equipment in the UK’s telecoms network. It doesn’t directly affect the Huawei technology you use at home, such as smartphones, laptops and tablets. However, the May 2020 announcement from the US will have other consequences for your use of Huawei technology, that you may want to consider.
Following changes to the US sanctions on Huawei announced in August 2020, the NCSC is assessing the impact to owners of Huawei and Honor-branded devices. The change in sanctions may mean that services used by your device and software updates may, for some products, cease. Owners of devices manufactured by Huawei, such as a smartphones, tablets, laptops, or other connected consumer devices should continue to follow our Cyber Aware guidance:
- Update your devices while updates remain available.
- Turn on backup to ensure you can access your data from other devices.
If you use a personal Huawei device for work, you should talk to your employer about whether that should continue if your device ceases to receive security updates or access other services. Organisations where employees use personal Huawei devices to access business data and applications, such as email, instant messaging, and office applications, should read our guidance on BYOD. This will help you to understand the risks of employees using devices that are no longer able to receive security updates. Additionally, BYOD solutions may rely on a device having access to Google’s Mobile Services, if a device loses access to these then you may not be able to manage the device and its access to business data and applications.
Where can I find out more?
Have a look at the NCSC Technical Director’s latest blog post, for more detail on what’s changing and what this all means for the UK. For people who want to delve into the technical details in more depth, we have also published updated 5G guidance and an analysis of the US sanctions’ impact in the UK.
