Incoming Cyber Security minister Kris Faafoi is being warned the security of New Zealand's future 5G networks will be hard to ensure if "high-risk" vendors are allowed a place in the rollout.
That suggests New Zealand's security intelligence establishment may be pushing for a ban on vendors such as Huawei from taking part.
A heavily redacted briefing from the security and intelligence group within government was posted earlier this month, highlighting that 5G network architectures make it difficult to mitigate security risks when a "high-risk vendor" is involved.
"Some vendors of telecommunications equipment are considered high risk, given their relationship with their domestic governments, and the likelihood that the vendor will be subject to extrajudicial directions from governments other than New Zealand’s," the briefing, from September, stated.
The rest of the advice on the topic was redacted on grounds of national security, free and frank expression of opinion and confidential advice.
Australia and some other Five Eyes security partners have already banned Huawei and other Chinese vendors from supplying equipment to their rollouts.
However, GCSB minister Andrew Little told Reseller News in September that while officials are looking at how other countries are approaching 5G technologies, "New Zealand develops its own, independent security policy based on inputs from a range of sources."
"As you’d expect with any change in technology of such significance as 5G, officials are considering whether the existing framework will remain fit-for-purpose in the new environment," Little said, referring to the governing legislation.
While everyone is measuring their words carefully, Faafoi's statements since becoming minister could be interpreted as indicating he is more open to a ban.
“We’re obviously cognisant of the concerns the Australian authorities have had. It’s a pretty crucial piece of infrastructure for the future of the mobile network,” Faafoi told Newsroom at the end of October.
As the time drew closer to make a decision the Government would be presented with “options”, he said.
“One of those might be similar to what the Australians have done," he added.
Earlier this month, Spark boss Simon Moutter went into bat for Huawei playing a role, arguing the company should not be ruled out unless there was "incontrovertible evidence" it was a security threat.
Both Spark and 2 Degrees have warned the cost of the 5G rollout could rise significantly if a highly competitive vendor such as Huawei is removed from contention.
Spark is keen to ensure Huawei's gear can be considered at the edge of the network. Huawei provides to Spark's Radio Access Network or RAN, the equipment located at cell sites to transmit and receive cellular signals.
"We use other partners such as Cisco and Ericsson for processing and customer authentication technology within our mobile network core, which is often regarded as the 'brains' of the network," Moutter said.
This week Spark and Huawei demonstrated an architecture they say can separate that core 5G network from the edge, potentially addressing some the the concerns.
"We've emphatically proved our critics wrong," Huawei New Zealand deputy chief executive Andrew Bowater said.
One issue of concern is that 5G networks are likely to be used to connect Internet of Things devices controlling other critical infrastructure such as electricity grids, water supplies and more.
Among other priorities for the new Minister flagged in the briefing are completion of a refreshed cyber security policy and action plan, work to join the Budapest Convention on cyber crime, responses to malicious cyber activity and enhancing the local cyber security workforce.
The Council of Europe Convention on Cybercrime, aka the “Budapest Convention”, is the first international agreement on cyber crime.
As of September, the convention’s 59 state parties included all of New Zealand’s Five Eyes partners, other like-minded counties, and countries such as Tonga, Sri Lanka, and Nigeria.
The convention standardises offences, provides powers and procedures for investigations, and improves processes for international cooperation among parties.
"Work is underway to assess the requirements for accession to the convention," the briefing stated.
Accession would allow operational agencies to better access and contribute to data flows on cybercrime; have significant reputational value for New Zealand; and enable New Zealand to better participate in mainstream international work on cybercrime.
Former Minister of Broadcasting, Communications and Digital Media Clare Curran, the minister of Justice and Minister of Police were recently briefed on the measures required to bring New Zealand’s laws and investigative processes into line with the convention - these were also to be provided to Faafoi.