European telecoms and computer infrastructure is vulnerable to hostile state interference with Chinese equipment suppliers such as Huawei and ZTE deeply embedded in parts of Europe’s networks, a research report claims.
The study by defence and security think tank Rusi warns that Europe’s patchwork approach to assessing risks from equipment suppliers means the security of critical national infrastructure is at risk from espionage and cyber attacks.
The report comes after a warning from MI5 that China’s Ministry of State Security is using a front company to fund research at UK universities, allowing it to gain access to technology that could pose a threat to the UK’s national security.
According to Rusi, the lack of agreement over what constitutes a high-risk ICT supplier has resulted in an inconsistent approach in Europe and the UK to Chinese suppliers, with many governments lacking basic information about what equipment is used in their networks.
This has led to widely different approaches by countries to using Chinese components in critical infrastructure, with Chinese suppliers accounting for nearly 60% of Germany’s 5G radio access network, compared with 30% in Spain and only 20% in the UK.
Spain, for example, awarded Chinese telecoms company Huawei a €12m contract for its OceanStor cloud storage servers, which were used to store recordings of judicial wiretaps.
The deal alarmed US lawmakers, who last year raised concerns that the Chinese government could gain access to highly sensitive data, including the ability to monitor Spanish investigations into Chinese spies.
Security vulnerabilities
National security legislation in China enables Chinese authorities to control technology suppliers, such as telecoms supplier Huawei. It also provides a mechanism for the Chinese government to harvest security vulnerabilities that could be used to launch hacking attacks (see box: Security risks posed by China). There are also concerns that Chinese companies could withhold updates or maintenance for key services during political crises or conflict.
The report urges the UK to introduce legislation to protect the wider critical national infrastructure beyond telecoms and public sector procurement to give government powers to restrict the use of technology that could pose a risk more widely.
The UK has blocked Huawei from the 5G network and Chinese video camera suppliers from use by government departments, but has so far not intervened to assess and remove high-risk suppliers from other parts of the critical national infrastructure.
An amendment to the Cyber Security and Resilience Bill, if passed, will give the government powers to ban technology suppliers on national security grounds, without having to publicly designate the supplier as a national security risk.
Across Europe, the report identifies a gap between legislative ambition to restrict components that may cause a security risk and the implementation of measures to limit the deployment of Chinese technology in critical applications.
“Closing that gap will require not only stronger laws but also deeper institutional capacity, greater economic courage and a willingness to treat technology procurement as an instrument of strategic policy rather than a compliance exercise,” the report states.
MI5 warning to universities
Rusi’s report follows a warning by MI5 that more than 100 UK-linked academics have received funding from a research institute with strong ties to China’s Ministry of State Security.
UK academics have contributed to projects funded by the China General Technology Research Institute (CGTRI) on artificial intelligence, cyber security, covert communications systems and steganography, which actively support Chinese espionage.
Academics could be subject to criminal consequences under the National Security Act 2023 if they knowingly materially assisted a foreign intelligence service, or ought reasonably to have known they were doing so, according to the MI5 advisory.
How Europe and the UK have managed the risks of overseas suppliers
2005: British Telecom gives Huawei its first major contract in the UK.
2019: Political concerns are raised about existence of backdoors that would allow Huawei to access data.
2020: The UK’s National Cyber Security Centre found that none of the vulnerabilities in Huawei equipment were the result of state control or influence.
2020: Sweden excludes Huawei and ZTE from 5G networks on national security grounds.
July 2020: UK announces plans, which became legally binding, to strip Huawei equipment from the 5G network by December 2027 following US pressure.
2020: EU introduces a voluntary ‘Toolbox for 5G Security’ giving guidelines for managing high-risk telecoms suppliers.
2021: Germany passes the IT Security law 2.0, which allows the Ministry of Interior to exclude components from critical national infrastructure.
2021: The UK introduces the National Security and Investment Act, giving the UK power to screen and block foreign investments from Chinese. companies.
2021: UK introduces the Telecommunications Security Act, which gives government powers to designate equipment suppliers as high risk.
March 2022: Germany warns against the use of Kaspersky anti-virus software following Russia’s invasion of Ukraine.
November 2022: UK instructs government departments to remove cameras and surveillance systems supplied by Chinese suppliers.
2023: The European Commission explicitly states that Huawei and ZTE represent materially higher risks than other 5G suppliers.
2023: UK introduces the Procurement Act, which allows suppliers to the public sector to be excluded for national security reasons.
July 2024: Germany opts to phase out Chinese suppliers from ‘core’ 5G network.
2025: A report by Reuters raises concerns about the security risks of Chinese solar panel inverters.
2025: Germany announces it will not allow components from China in its 6G network.
2025: Germany implements the EU NIS2 Directive, which expands the scope of cyber security requirements to cover critical national infrastructure operators and large companies. It allows the German government to limit the use of critical components seen to pose a security risk.
2026: A review by the US Department of Energy found no evidence of backdoors in Chinese solar power inverters.
January 2026: The European Commission proposes amendments to the EU Cyber Security Act that, if enacted, will give the Commission powers to exclude high-risk suppliers, such as Huawei and ZTE, from critical sectors.
March 2026: UK government blocks a Chinese wind turbine manufacturer from building a factory in Scotland on national security grounds.
Source: Rusi
