European 5G cybersecurity study

˙ Telcoswarned of greater reliance on equipment makers in 5G world

˙ Software,virtualisation, network slicing bring their own vulnerabilities

˙ Single-vendorapproach highlighted as a security threat

Given that the European Commission’s new 5G security report referencesstate-backed security threats and interference from non-EU countries, it isunderstandable that industry watchers have largely concluded that it is athinly-veiled warning about Huawei. And to a certain extent, it probably is.But there’s a lot more to the report than that, and there’s a lot more to 5Gnetwork security than keeping out the Chinese.

5G will make telecoms operators more dependent on equipment makers ingeneral and that brings with it a raft of potential security issues, the EU coordinated risk assessment of the cybersecurity of 5G networkswarns. The report, published on Wednesday, is designed to help EU member statesprepare what they describe as “a toolbox of possible risk mitigationmeasures” by the end of this year.

In addition, the new technical features of 5G ? including the move tosoftware and virtualisation, network slicing, and mobile edge computing ? willalso raise new challenges, both in terms of changing vulnerabilities andinvolvement from new players.

“In particular, they will give additional prominence to thecomplexity of the telecoms supply chain in the security analysis, with variousexisting or new players, such as integrators, service providers or softwarevendors, becoming even more involved in the configuration and management of keyparts of the network. This is likely to intensify further the reliance ofmobile network operators on these third-party suppliers,” the reportstates.

With greater reliance comes greater potential for attack. “Amongthe various potential actors, non-EU states or state-backed are considered asthe most serious ones and the most likely to target 5G networks,” itexplains. “In this context of increased exposure to attacks facilitated bysuppliers, the risk profile of individual suppliers will become particularlyimportant, including the likelihood of the supplier being subject to interferencefrom a non-EU country.”

With Ericsson, Huawei and Nokia hoovering up many of the world’s mobilenetwork contracts between them, it’s all too easy to point the finger at theChinese company here. But there are many other equipment makers to take intoconsideration. The report, which doesn’t specifically name Huawei, other thanas a vendor with a sizeable market share, lists Cisco, Samsung and ZTE as otherlarge suppliers, none of whom are EU-headquartered.

Further, the report also highlights the risk of dependency on a singlesupplier on the part of telcos, the implication being that relying one vendorfor everything ? whichever vendor ? increases the risk of problems both fromthe point of view of interruption in service resulting from a commercial failureand from the malicious attack angle.

While many telcos are talking up their intent to adopt a multi-vendorapproach for 5G, some of Europe’s smaller players are reportedly looking atsingle-vendor contracts, which tend to be cheaper and easier to manage. WhileHuawei is often the vendor of choice for small, budget-conscious operatorslooking for a single vendor partner, you would have to do a lot of readingbetween the lines to come to the conclusion that the Commission is cautioningagainst the Chinese firm specifically; the message really does appear to bethat telcos should avoid putting all their 5G eggs in one vendor’s basket.

Liberty Global to take part in capital increase

Swiss operator Sunrise announced that Liberty Global will invest up to CHF 500 million in a combination of tradable rights and subsequent subscription of newly issued shares in the capital increase to finance the acquisition of UPC Switzerland. This was a demand of some Sunrise shareholders, who found the price of the takeover too high, and called for Liberty Global to share in the risk of merging the two operators.

As a result of the new terms, Liberty Global will hold a 7.8 percent stake in Sunrise at current market prices, and Sunrise will provide Liberty Global with the right to propose a representative for election to its board of directors at the next AGM. The terms of the takeover of UPC worth CHF 6.3 billion remain unchanged.

Mike Fries, CEO of Liberty Global, believes that the combination will create a challenger to Swisscom in the market, while Sunrise is convinced that investment in the rights issue by Liberty Global will lessen the financial commitment needed from its shareholders. Sunrise’s shareholders will vote on 23 October to approve the capital increase.

The Swiss regulatory authority, WEKO, has approved the deal without conditions, citing the fact that it will create the second largest telecommunications carrier in Switzerland and that the combination will stimulate competition.

Meanwhile,proxy advisors Glass Lewis, Ethos and zRating have announced their support for the proposed capital increase to finance the acquisition of UPC Switzerland.

Last week, proxy adviser ISS recommended that shareholders of Sunrise should reject the proposal for a capital increase. ISS noted that the “fair value”of UPC ranges from CHF 4.6 to CHF 5.2 billion, making the current valuation of CHF 6.3 billion excessive. Sunrise replied in a statement that the ISS report is misleading because of valuation inconsistencies and factual errors that misrepresent the long-term benefits to Sunrise shareholders. Liberty Global said that the report issued by ISS is “flawed” and the adviser”demonstrated a surprisingly poor understanding of the telecom industry”.

X