5G security risk may result in equipment ban, restrictions

The Portuguese government on Monday clarified to Lusa that the Security Assessment Committee’s conclusions on the risk of using 5G equipment may result in its exclusion or application of restrictions and it is up to telecoms regulator Anacom to enforce the deliberation.

Last week, the Security Assessment Committee, in the scope of the Supreme Council for Cyberspace Security, released a deliberation on the “high risk” to the security of 5G networks and services of using equipment from suppliers that, among other criteria, are from outside the EU, NATO or OECD and that “the legal system of the country in which it is domiciled” or connected “allows that government to exercise control, interference or pressure on its activities operating in third countries”.

The deliberation does not mention the names of companies or countries, but the case of Huawei comes to mind, namely because the Chinese technology company was banned from 5G networks in other countries, including the United Kingdom and Sweden.

Contacted by Lusa, the office of the secretary of state for digitalisation and administrative modernisation said that, taking into account the conclusions, these may result in the exclusion, application of restrictions or termination of use of equipment or services.

“It is important to bear in mind that the conclusions of the risk assessment carried out by the Security Assessment Committee take into consideration the specific risks of using equipment in the various asset groups that comprise the 5G networks considered for this purpose, and may consist in the exclusion, application of restrictions on the use or termination of use of equipment or services in some of these asset groups, but not necessarily in all of them or equally”, clarifies Mário Campolargo’s office.

It also adds that “the Security Assessment Committee’s deliberation taken based on the risk assessment carried out must be complied with and enforced by Anacom [the national communications regulator] within the period granted for this purpose”, according to article 62 of Law 16/2022, of 16 August, which approves the Electronic Communications Law (LCE).

“The content of the resolution taken following the risk assessment was classified at the grade Reserved of the national label because its content contemplates information whose knowledge or disclosure by unauthorised persons may contend with the high interests of the country and economic agents,” the office points out.

The classification “was made under the terms of the instructions for national security, safeguarding and defence of classified material, abbreviated as SEGNAC 1, approved by Cabinet Resolution No. 50/88 of 3 December, amended by Cabinet Resolutions No. 13/93 of 6 March and 70/2019 of 17 April,” the government recalls.

Also contacted by Lusa, Huawei says it knows that “the Portuguese government has published information regarding the risk assessment of telecommunications networks,” but that the company “had no prior knowledge of the publication and is seeking to gather more information from the relevant authorities regarding the nature of this assessment.”

It recalls that “over two decades, Huawei has worked with Portuguese operators to develop communications networks and provide high quality services that serve millions of people”, and that “Huawei has been several times recognised by the Portuguese government, as well as by public and private entities, for its role in the creation of qualified employment, innovation capacity and contribution to innovation and digital transition, having invested more than one million euros in training digital talent”.

In this sense, “we will continue to comply with the Law and regulations in force, in order to serve consumers and Portuguese companies that rely on our products and services”, concludes the company.