Falling behind means China controls the global 5G Market – that’s used to weaponize information networks – induces Taiwan War

China’s quest for 5G dominance has played out within a complex technological and geopolitical landscape.108 Indeed, different countries have their own security concerns and considerations, but not all share American assessments of the severity of these risks. Insofar as American policymakers see China as a great power rival and strategic competitor, allowing Chinese companies to play a key role in American critical infrastructure, or that of U.S. allies and partners, presents grave threats that are untenable and unacceptable for the United States, not only espionage but also outright subversion of this critical infrastructure.109 Yet Huawei has continued to expand its global presence, and the U.S. government has yet to present a viable and attractive alternative to working with Huawei. Many countries may have sunk costs and be “locked in” already to this choice based on earlier decisions, which raises concerns about not only security but also fair competition.110 However, it is encouraging to see emerging consensus among like-minded countries about potential principles and shared approaches to 5G security, particularly through the progress of a recent conference on 5G security in Prague.111 The age of 5G will present new risks and novel threats of disruption or exploitation. 5G involves far more than just new and faster wireless networks; it will be a vital component of future critical infrastructure. Consequently, the cybersecurity of 5G networks could prove uniquely challenging, considering the high levels of complexity and much greater potential for damage in the case of an attack. Not only the confidentiality of data on 5G networks but also questions of integrity and assurance will become urgent challenges. Whereas most cyberattacks to date have involved only data theft, an attack against future 5G networks could cause massive damage that might threaten public safety and critical industries in future smart cities.112 The often subpar security of IoT devices, of which there are an estimated 20 billion globally and growing, also presents serious reasons for concern. A high proportion of devices on the U.S. market have been made in China by companies with very poor track records on security.113 While vulnerabilities have been and remain a major concern in the telecom industry for 3G and 4G, the stakes will be even higher for securing 5G networks at all stages of their life cycles.114 In some cases, supply chains could be weaponized deliberately by adversaries that may prefer to “win without fighting.”115 The exclusion of high-risk vendors is an important measure to mitigate risk but does not constitute a complete solution. 5G must be designed and implemented with a holistic approach to security in mind from the start. The development of secure networks must entail more than simply excluding high-risk vendors, requiring rigorous, ongoing testing and screening. Indeed, careful scrutiny should be extended to all aspects of the production, construction, and management of these networks, involving screening of the security of all vendors and carriers. If an end-to-end approach to security is effectively implemented, 5G could prove more secure than our existing networks and critical infrastructure, but the consequences of insecurity would be far graver. In public debates on 5G security, the call and search for a “smoking gun” has been problematic. This framing of the issue has often distracted policymakers from thinking about the greater challenge of mitigating vulnerabilities that tend to be pervasive. Bugs can be just as problematic as backdoors. It is inherently challenging to differentiate an accidental vulnerability from one that is deliberately introduced. The primary difference is intent, which cannot be discerned from code alone. It is encouraging that the 3GPP’s SA3 working group is focusing on security, seeking to ensure that such security concerns will shape the development of standards.116 However, industry and government are just starting to grapple with the full range of issues in play. Given the gravity of these security challenges, the apparent centrality of Chinese companies in the global development of 5G has raised intense concerns. There is a very real risk that vulnerabilities in networks, whether the result of poor security practices or deliberate introduction of backdoors, could be weaponized for leverage or coercive purposes, particularly in a crisis or conflict scenario. Considering China’s history of IP theft and cyberespionage, there is also a real risk such networks could be exploited for purposes of espionage.117 As a Chinese company, Huawei also would be subject to a number of legal demands, regulatory requirements, and mechanisms of coercion that are often ambiguous and expansive.118 Regardless of whether Huawei’s leadership may wish to disregard an order from the Chinese government, China lacks an independent judiciary system for company leaders to plead their case against the government, as Apple did in the United States when it fought an FBI order to unlock an iPhone. Huawei’s claims that it would “say no” to the Chinese government are not credible without indications of the company’s actual ability to do so. Even if Huawei is given the full benefit of the doubt, despite its history and apparent involvement with the Chinese military and intelligence organizations, Huawei’s products and services have been assessed to be highly insecure, with a much greater prevalence of vulnerabilities relative to their primary competitors.119 Moreover, there are reasons to question whether knowledge of any bugs in its equipment could be shared more readily with China’s Ministry of State Security (MSS). This risk may be heightened given the influence of MSS in China’s vulnerabilities database, not to mention Huawei’s historical and continued linkages to the Chinese People’s Liberation Army, including military intelligence.120 For the United States, these risks and security concerns are inextricable from today’s geopolitical exigencies, insofar as the U.S.-China rivalry encompasses scenarios for which there is a nonzero probability of conflict, including over Taiwan. Consistently, Chinese military writings have highlighted the potential for cyberattacks on critical infrastructure as a prelude to outright warfare.121 The presence of equipment from high-risk vendors, such as Huawei, even in rural telecoms is concerning, considering that some of these networks are near military bases, which raises risks of espionage or exploitation. 5G security presents a global challenge that will demand creative and cooperative solutions. Huawei will likely remain a major player in 5G in a number of countries, including some U.S. allies and partners, that believe the benefits of partnering with it outweigh the risks. Although a criteria-based calculation of risk provides compelling arguments for exclusion of such highly risky players, many nations could still continue current collaborations with Huawei in ways that exacerbate global risks to this emergent ecosystem. Even if the United States were to succeed in fully securing its own 5G networks, U.S. data and entities may remain reliant, including for military and commercial activities, upon overseas digital infrastructure that could prove highly vulnerable.The presence of Huawei’s equipment in the critical infrastructure of U.S. allies and partners, whose support or location as a staging ground the U.S. military might require to fulfill its treaty obligations in the event of a crisis or conflict, also creates new risks, to an extent that could undermine U.S. capabilities for command and control and power projection. As Dan Coats, had warned during his time as director of national intelligence (DNI), “U.S. data will increasingly flow across foreign-produced equipment and foreign-controlled networks, raising the risk of foreign access and denial of service.”122