More bad news for ZTE, United Kingdom's National Cyber Security Centre (NCSC) claims they're a security risk

ZTE, one of the world’s largest telecommunications companies, has been having a rough time over the last few days. The United States Commerce Department imposed a seven-year ban on US-based companies (e.g., Qualcomm, Dolby) from selling software and hardware to ZTE for allegedly not adequately reprimanding the staff involved in illegally selling US technology in Iran and North Korea, which are both under a trade ban from the US. More recently there is debate over whether this includes the free licence for Android, or perhaps more likely whether they could continue to use the open-source Android components but exclude all of Google's services including the Play Store.

Now the Financial Times is reporting that a letter from the United Kingdom’s National Cyber Security Centre (NCSC) claims that ZTE poses a national security risk and has warned British telecommunications companies against using ZTE equipment in their networks. The letter reads, “NCSC assess that the national security risks arising from the use of ZTE equipment or services within the context of the existing UK telecommunications infrastructure cannot be mitigated effectively or practically.” UK concerns regarding ZTE are similar to ones that the US Government has against Chinese equipment providers (including Huawei) and are mostly centered around claimed links to the Chinese government and new laws that allow them to pressure local companies in ways that could be used for foreign surveillance or penetration.

Most of the equipment used in British communication networks comes from Huawei, Ericsson (Swedish), and Nokia (Finnish) with the NCSC considering the latter two as having a much lower risk of “external interference.” They mention that the Huawei equipment is currently monitored by the GCHQ (signals intelligence) for interference, but that adding a second Chinese-based equipment provider would “render our existing mitigations ineffective.”

Since ZTE (and Huawei) equipment is used in telecommunication centers around much of the world, it is interesting to see another major government organization steering their country away from products from these manufacturers. While governments around the world would have done risk assessments on infrastructure providers, the timing of this announcement indicates the potential for this to be an act of solidarity between the UK and the US, either in dealing with ZTE or as a stance towards the Chinese government.