What Germany’s new cyber security law means for Huawei, Europe, and NATO

The German government’s 5G security plan tacitly allows Huawei to embed itself in domestic telecom networks – with great implications for Europe’s defence and security

Headquarters Germany – Huawei Technologies Düsseldorf
Image by Kalligraf

After two years of deliberation, at the end of 2020 Germany’s interior ministry finally released its long-awaited proposal on the role high-risk companies like Huawei will be allowed to play in rolling out Germany’s 5G networks. The cabinet minister in charge, Horst Seehofer, hailed the draft IT Security Law 2.0 as a “breakthrough for Germany’s cyber security”. But the issue of vendor security remains: Berlin appears to have no desire to ban any individual supplier outright from Germany’s 5G networks.

The legislation has received harsh criticism for its bureaucratic approach to the Huawei problem. Rather than taking a firm political stance on the matter, Berlin has created a complicated two-part assessment mechanism for telecom vendors seeking access to Germany’s 5G networks. Along with a technical evaluation, the draft law requires a vendor to issue a declaration that its components cannot be used for “sabotage or espionage”. Once registered, the company enters into a 30-day period during which relevant ministries in Berlin must decide whether or not to allow it to take part in Germany’s 5G rollout.

This mechanism may appear to be a failsafe for blocking access to German networks should a ministry have doubts about any would-be supplier. But the law only allows for the exclusion of a vendor if all involved authorities are unanimous in their decision to enact a ban. If policymakers cannot come to a unified decision, the supplier would by default be allowed to participate in the network rollout after the 30-day period ends. For Huawei, this would be quite a victory – given that the 5G debate has already raged in Germany for two years, it is unlikely that future intergovernmental disputes about vendor security would be resolved within a month.

As Berlin continues to waffle over vendor security, domestic telecom companies are already incorporating Huawei equipment into their 5G networks. This is a gamble for them, as they may have to replace network components should Berlin ultimately make the unlikely choice to ban Chinese kit entirely, which is still possible within the scope of the current draft. But the risk may well be worth the reward – German telecom suppliers have longstanding partnerships with Huawei and decades’ worth of its equipment in their existing networks, and any replacement will be costly in terms of both time and money. While the IT Security Law is expected to pass parliament some time this year, the crucial 5G clause is buried within bulky text covering a wide array of changes, and the parliamentary scrutiny process is likely to take some time. This means the first test of the clause banning untrustworthy suppliers may not come until after Germany’s election this autumn. In the meantime, operators can continue to use Huawei components unchecked in their 5G rollouts, which could give industry leaders more leverage against future political efforts to ban Huawei from German telecom networks.

Germany’s ‘decision’, coming at the end of a European Council presidency focused on a stronger, more united Europe, puts it at odds with other European countries such as the United Kingdom and Sweden, which have blocked Huawei from their domestic rollouts, or France, whose Huawei policy amounts to an eventual ban on the company. It also ignores the wishes of the United States, which began raising the alarm about the national security threat from Huawei in 2018. Caught between the US and China, Angela Merkel has walked a fine line in balancing the demands of Washington against the economic pull of Beijing. Her time in power is now coming to a close, but the recent confirmation of Armin Laschet as the new leader of the Christian Democrats and his potential ascent to the chancellery suggests that the CDU’s position on China is unlikely to change. Laschet was Merkel’s preferred choice and is viewed as a “continuity candidate” closely aligned with her political priorities.

Germany’s stubborn refusal to ban Huawei places it in an awkward position when it comes to international efforts to cooperate on 5G.

And yet, as a leader within Europe and a supporter of democratic values and level playing fields in trade, Germany’s stubborn refusal to ban Huawei places it in an awkward position when it comes to international efforts to cooperate on 5G. Existing ideas, such as the UK’s D-10 club of democracies, the United States’ Clean Network Initiative, or the proposed Technology 10 alliance, each share the goal of reducing China’s dominance in 5G and tech infrastructure. The EU’s own 5G toolbox, which Germany supports, calls for “a coordinated approach” to 5G network security both domestically and across the EU. But Germany cannot easily advocate international cooperation on emerging tech if it forges its own path on Huawei. Berlin’s Huawei indecision will only embolden smaller nations with less robust economies to point to the German example in choosing the more budget-friendly Chinese kit for their domestic 5G networks.

Berlin’s choice will also have implications for NATO. With Germany seeking to shore up and encourage America’s recommitment to the organisation, the decisive indecisiveness it has adopted on Huawei is a step backwards in re-engaging with Washington. On 5G, leading NATO members like the US and Germany should be championing efforts to ensure uninterrupted interoperability through bloc-wide standards and minimum network security requirements. This coordination from the outset is necessary because 5G will give the alliance new opportunities for data- and intelligence-sharing as well as allowing it to take advantage of new technologies based on advances in artificial intelligence and machine learning. But with advanced network connectivity comes heightened network vulnerability, and NATO can only realise the full potential of 5G if there is coordination across all member countries.

With this draft law, Berlin has effectively punted down the road a definitive decision on 5G. How the legislation will look in its final form remains to be seen, but Berlin’s preference for Beijing’s tech over Brussels’ wishes is clear. Should the German government fail to take concrete action to block Huawei from its networks, the new law will put Germany at odds with key allies on an issue that has deep implications for security, defence, and the economy.

The European Council on Foreign Relations does not take collective positions. ECFR publications only represent the views of its individual authors.

Author

Visiting Fellow, German Chancellery Fellowship

Subscribe to our weekly newsletter

We will store your email address and gather analytics on how you interact with our mailings. You can unsubscribe or opt-out at any time. Find out more in our privacy notice.