The European Commission wants to force EU member states to remove equipment from Chinese companies Huawei Technologies and ZTE from their mobile networks, as part of a sweeping new cybersecurity act. While the European Commission (EC) has recommended the removals from 5G networks since 2020, citing cybersecurity risks, only 13 of 27 member states have so far acted on it. This marks the first time the EU has attempted to make their removal mandatory.
The new proposal would force EU member countries to comply within three years of adoption, although the legislation itself would first have to be approved by the countries themselves. If approved, it could be the tip of the iceberg for Huawei, ZTE and other Chinese operators, should China be designated as a cybersecurity threat under criteria the Commission published last week. If a country is listed as a threat, its companies would then be considered off-bounds in sensitive sectors including connected vehicles, electricity and water supply and storage, cloud computing, medical devices, space services and semiconductors. Given Beijing’s focus on the promotion of “new productive forces”, many of which fall within those sectors, further frictions in the EU-China relationship could be expected.
Criteria for listing include whether the country has been linked to cyberattacks, hacking or organized cyber campaigns; whether EU institutions or EU-wide security assessments have raised concerns about risks linked to that country; and whether its laws force companies to secretly report software or hardware weaknesses to the state before those weaknesses are made public or fixed, especially if they may be exploited. Countries where there is no independent judiciary to challenge government actions or effective democratic oversight could also be punished, the draft legislation says. A country needs to meet only one of the criteria to be considered.
Huawei and ZTE are not named in the proposed regulation, just as they were not publicly named in the original 2020 5G toolbox that recommended their removal. In 2023, however, frustrated by slow progress, the Commission went public with their concerns about the vendors.
If excluded, companies would have a right to appeal. Member states who do not abide by the adopted law would face infringement procedures that could end up in court. But officials said that the act did not mandate compensation packages for countries who would be forced to replace Huawei or ZTE in their networks with providers considered to be more secure. Huawei said it would continue to provide secure and trusted products and services “as a legally operating company in Europe”. “A legislative proposal to limit or exclude non-EU suppliers based on country of origin, rather than factual evidence and technical standards, violates the EU’s basic legal principles of fairness, non-discrimination and proportionality, as well as its WTO obligations,” it said in a statement. “We will closely monitor the subsequent development of the legislative process and reserve all rights to safeguard our legitimate interests,” the South China Morning Post reports Huawei as saying.
