A senior U.S. State Department official said there is no need for President Donald Trump to sign an executive order to explicitly ban Chinese telecommunication company Huawei from taking part in the buildout of the U.S. 5G networks. Strayer spoke with Media about U.S. 5G policy and security concerns over Huawei.

Below is a full rush transcript of the press conference by Ambassador Robert L. Strayer, Deputy Assistant Secretary for Cyber and International Communications and Information Policy , BUREAU OF ECONOMIC AND BUSINESS AFFAIRS.

DAS Strayer:  The United States recognizes that we must maintain a secure cyberspace for future generations.  We and our partners recognize that cyber policy issues are critical to not just protecting our communications networks but also to our national security, our economic prosperity, and securing fundamental human rights all around the world.  

The security of Information Communications Technology, or ICT, is an essential element of national security.  The networks and services that comprise ICT play a critical role in the safety, security and prosperity of each nation.

The 5^th generation of wireless technology, or 5G, will be transformative by providing consumers and businesses with up to 100 times faster connections than 4G networks provide and they will be done with low latency, which is the time devices need to communicate with one another.  This will result in billions of new devices becoming connected to the internet, enabling what is called the Internet of Things.  And with these devices connected in what they call Mobile Edge Computing with low latency, we’ll begin to see a vast array of new critical infrastructure services being provided to the public on top of this 5G network.  We’ll see things like autonomous vehicles, autonomous transportation networks, telehealth and automated manufacturing.

As countries around the world expand and update their ICT infrastructure we are urging them to adopt a risk-based security framework.  An important element of this framework is a careful evaluation of the supply chain of equipment vendors.  In particular, this evaluation should result in the exclusion of equipment vendors that are subject to unchecked or extrajudicial control by a foreign power.  These vendors could be ordered to undermine network security, to skim personal information, conduct espionage, or to disrupt those critical services that are provided by the 5G network.

A significant cause for concern are a number of Chinese laws that compel their companies to cooperate with intelligence and security services without independent judicial controls.

The United States has sought to address this risk through its National Defense Authorization Act which prohibits our federal government from using services provided by Huawei or ZTE or other high-risk companies.

We also have commitments from our four largest wireless carriers not to use these high-risk vendors in their 5G networks.

I was very pleased to attend the Czech Republic’s hosted 5G Security Conference last Thursday and Friday.  That conference was organized into four main tracks on policy issues, technical issues, economic issues, and cyber security and resiliency considerations.  There was an active discussion among the 32 governments represented and more than 140 experts that participated in those four tracks.

At the end of the conference the Czech Republic published a set of guidelines or principles that can be used by countries as they start to think more deeply about how they’re going to secure their 5G networks.  Those principles cover a wide range of considerations from cyber security technical issues to considerations about third party influence over vendors that could result in the intentional intrusion or manipulation of 5G networks.

As countries around the world make their decision about how to build out 5G, we urge them to refer to these best practices that are embodied in the Prague Proposals, as it’s called, so that they can incorporate those security ideas into the critical networks from the very start, before they build them out.

Question:  A Huawei official recently said that the U.S. is undermining the political independence of Europe.  From your side, is the undermining intentional or not?

DAS Strayer:  We’re working very closely with our partner and allies all around the world.  I think over the last year we’ve all been on a shared path forward to better understand how security will be incorporated into 5G and to also understand the stakes of 5G.  What could be enabled by 5G, both in the ability to facilitate new types of critical infrastructure services, as well as the ability for data potentially from all the Internet of Things that surround us to be transmitted over those networks to other places in the world.

Our focus in all these discussions to have both a technical discussion as well as a policy discussion.  On the policy discussion, of course we are talking about how companies may not adhere to best practices and may be influenced by third parties including foreign powers that might have an adversarial interest to the interests of our citizens — citizens in Europe and citizens of the United States.  So we want to make countries very much aware of those concerns from the start.

This is in no way a political dynamic that’s playing out.  These are the best practices related to security and we are, like we do in all of our discussions about transnational concerns, we are very frank and forthright with our partners about this, and I would say that it is a mischaracterization really to say that this is in some way political.

Question: No single European country has gone ahead and banned Huawei as the U.S. has been asking, so is the campaign failing? 

DAS Strayer:  Our campaign request is that countries include security practices into their consideration of 5G networks.  We’ve seen, of course, the European Union Commission’s recommendation, March 26^th, that said that countries as they roll out their 5G as a security consideration should think about other non-technical factors like the model of governance and the track record of the country where the vendor is located.  So we’ve seen the European Union Commission, we’ve seen Germany also announce that it has a set of principles that it will apply that include the reliability of a vendor to abide by data protection standards.

We know that privacy is very important to citizens in the European Union, it’s very important to citizens in the United States by the way, it’s part of our Constitution.  But we think that countries should think very carefully about a track record of a country and its vendor related to data protection.

We’ve also seen the French government move forward on a law that would apply additional security standards to the rollout of 5G networks there.

So we’ve seen a first very important step of countries move along this path of coming to a recognition that 5G must be part of decisions about the build-out of the technology.  While we have not seen bans on any particular company, I think that’s a little premature.  Over time if principles related to the influence of 3^rd party countries that are embodied in the European Commission recommendation and in these Prague Principles, that those are rigorously applied, as they should be, that should lead inevitably to the ban of companies that are subject to the type of control that they are in China.

Question:  Countries like Malta are developing Huawei’s Safe City Concept by planning advanced video surveillance inside crime-prone areas, but a facial recognition CCTV option was apparently discarded. What are the risks for European countries that use Huawei technology for advanced surveillance systems?

DAS Strayer:  As I just mentioned, we are very concerned in the United States about the privacy of our citizens, and we recognize as well that European countries and their governments are very concerned about the privacy of their citizens which is embodied in things like the General Privacy Protection Directive.

We see the use of surveillance technology by China within its own borders used for ends that include using it to assign social credit scores, to then surveil the movement of people, and to identify who they are interacting with, and then to cause more than a million Uighurs to be sent to reeducation camps.  We are very troubled by that kind of use of data by authoritarian regimes.  We know that suppresses fundamental human rights and civil liberties, including the right of free association, freedom of speech, and freedom to exercise religion.  So we’re very troubled by that.  We think that as technology used in [inaudible] cities is integrated into broader wireless networks, that would be a cause for concern because that data could end up back in places such as Beijing where it would not be used for the purposes that we want to see all of our data subject to which is protected uses, limited uses, and not to be exploited for authoritarian purposes.

Question:  You participated in a meeting with the UK networks the other day.  It seemed like an information gathering exercise rather than a sort of more sort of event warning.  I’m wondering what you heard from the UK networks to give you confidence that they either agree or disagree with you and your approach to Huawei.

DAS Strayer:  I can’t reflect on the exact discussions that we had because they were confidential.  But I will say that as we do in all of our engagements across Europe, we have very frank discussions about our concerns, many of which I’ve highlighted on this call today.  We highlight those for governments and for telecommunications operators, and we’re still having an active discussion with our partners both in the governments and in the private sector.

Question:  I wanted to ask about a distinction between core and non-core.  Have you considered if a telecom operator, let’s say like BT or KPN decides not to use Huawei on core networks, is that good enough?  And they just use them for peripheral non-core parts of their network.  Would that be sufficient?

DAS Strayer:  As we move to 5G, there will be increasingly a blurring of the lines between a core and the periphery.  What fundamentally people have looked at in 4G networks to say the core was different than the edge or periphery was that the computing, the major computing power occurred only in the core.  In a 5G network, we’re going to see computing having to occur closer to the user, whether that’s a business user or a consumer, because there has to be very low latency for things like autonomous vehicles, or for telemedicine, or for other uses that will have massive amounts of data that need to have computing power and what they call cacheing of that information near the user, near the radio access network at the edge.

So we don’t think that anywhere in the network we should have untrusted vendors.  High risk vendors at the edge could just as easily manipulate data and the overriding critical services that are being provided based on top of that infrastructure.  So we shouldn’t have untrusted vendors in any part of the networks.

Question: I was just wondering if you could be more explicit about the consequences if Britain and others do allow Huawei into their 5G network?  What will America do as a result of that?

DAS Strayer:  We have very closely integrated information sharing relationships with United Kingdom and a range of countries around the world.  In all of those relationships we rely on trust and protection of information.  We would, if a country had Huawei in its 5G network have to reassess how we are sharing information with those countries to ensure that we are protecting the information that we are sharing with them.

Question:  Do you think that the international conference in Prague was a step forward in Western coordination for 5G security?

DAS Strayer:  Yes, we definitely think it was a very important step forward to have 32 governments together and more than 140 experts to talk about these issues in a two-day set of meetings.  We think that as we all progress on this education and evaluation campaign for 5G it’s important that we continue to have close collaboration about our concerns about risk and also about opportunities in the 5G networks.  There’s things beyond security, of course, that we’re coordinating on, on talking about regulatory policies and freeing up spectrum that will be so important for 5G networks.  So this conference was an important step forward to put out country agnostic principles that should be rigorously applied to ensure that we have the highest levels of security in our 5G networks.

Question: Some of the countries gathered in Prague, including France and Germany, talked down it seems what was being discussed from principles to proposals.  Does that leave you short of the goal you sought going in? 

DAS Strayer:  I don’t really see a distinction between those two terms that characterize the overall effort.  It was a very active discussion among all the participants.  In the summation at the end, no one had any reservations about any of the principles that were tabled as far as, by the Czech government as part of their statement.

Question:  Italy has just signed agreements with China for the Belt and Road Initiative.  Has the United States spoken with Italy regarding the possible inclusion of 5G with agreements?

DAS Strayer:  Thanks for that question.  We’re talking with all of our partners and allies around the world about transparency in funding and financing related to the Belt and Road Initative.  I would also note that this Prague Conference highlighted the importance of having transparency about the funding mechanisms for finance deals related to 5G.  But more broadly, to have commercially reasonable terms in terms that are not predatory as the Secretary of State has mentioned previously.  

So we’re having conversations, all of our partners, allies, about the overall Belt and Road Initiative finance mechanisms related to 5G.  We’re also emphasizing the same points that I’m making here, maybe in a little more detail with partners.  But we’re continuing to engage actively with all of our partners about concerns about Chinese vendors and how that does not fit into, in our view, a rigorously applied set of principles about the potential influence by third party countries over vendors for 5G.

Question:  How Huawei has its European Regional Logistics Center in Hungary employing 2000 workers.  Hungary’s government made recent remarks that it is of strategic national interest to continue cooperation with them.  Is the U.S. concerned with Hungary’s position?  And what incentives can the U.S. offer in order for Hungary to revise its support for Huawei?

DAS Strayer:  As we continue to have our discussions with our partners out there about the national security implications, and indeed the economic implications over the long run because a foreign power’s control over the network could affect dramatically our economic futures if it disrupts critical infrastructure, results in a theft of intellectual property, or the derivation of private data, that could fundamentally affect our economies.  So we’re asking countries to think carefully about the overall economic proposition that they’re being offered by Chinese companies relative to their long-term economic futures.

So we think that a true assessment of technologies that are being provided such as by Huawei that contain, as the United Kingdom just found, hundreds of vulnerabilities in their software, would over the long term be potentially more costly than other alternative vendors that come from Finland or Sweden or South Korea.  We encourage them to carefully consider the life cycle costs of those vendors, as well as to the potential that down the road an untrusted vendor might be something that a country and its telecom carriers might have to find an alternative to after it’s already further embedded into their networks.

Question: We understand obviously that he is meeting with Theresa May today and it’s been reported in various media outlets that he will be issuing a warning to the UK stance on Huawei.  I just wondered if you could give us any sort of an insight into what exactly he may have, or will be saying during those talks. 

DAS Strayer:  I will let the Secretary speak for himself today.  I’m not going to comment further.  As you know, we have made a statement that in the past to a number of countries about our national security concerns, and indeed the potential impact that Huawei technology in any part of the network would have on our ability to share information in the same way that we do today.

The CIA warned an Arab activist in Norway that he faces a potential threat from Saudi Arabia, Norwegian Media reported Tuesday.

“Something crazy – concerning my personal safety – happened two weeks ago which I haven’t been at liberty to speak about, but is breaking today. The last two weeks have been very stressful, but I hope I’ve managed well given the pressure” Iyad el-Baghdadi wrote on Twitter.

U.S. intelligence contacted Norwegian authorities April 25 regarding the potential threat to el-Baghdadi‘s life from Saudi Arabia. He was taken by authorities to a secure location where he was warned of threat.

“The way I understood it was, the Saudis have a crosshairs on me, but there is no idea of what they are going to do,” el-Baghdadi told the Guardian newspaper.

“They assured me that they are taking it very seriously. They came prepared,” he said, explaining that a police squad transferred him to the safe location and another briefed him on the situation.

El-Bahdadi is a Palestinian-born writer and a pro-democracy activist who has been a vocal critic of Saudi Crown Prince Mohammed bin Salman. He was granted political asylum in Norway in 2015 after being arrested and expelled from the United Arab Emirates.

The pro-democracy campaigner is active on Twitter and has gained a large following because of his satirical and abrupt analysis on Middle Eastern governments, including the Saudi royal family and political issues in the region.

Following the murder last fall of Jamal Kashoggi, a Saudi journalist working for the Washington Post, el-Baghdadi warned that bin Salman would become more dangerous if he was not held to account by the West. 

“If they get away with kidnapping the next step will be assassinations in your capitals, and I’m not joking even a little bit,” he said on Twitter.

The outspoken activist further warned that bin Salman is still seeking to silence critics of the Saudi government outside the kingdom and the rising number of educated Saudis who are politically active and living outside the kingdom “is shaping up to be a long-term problem for MBS,” using the prince’s initials.

News of a threat comes months after Kashoggi’s torture and murder inside the Saudi Arabian Consulate in Istanbul last October. The high profile murder caused international outrage and saw widespread condemnation of bin Salman. 

Following the murder, the CIA fingered bin Salman as being behind the order to kill the Washington Post journalist who was also a U.S. resident. 

Despite the evidence, however, the U.S. administration of Donald Trump denied bin Salman’s role in the murder and continues to support the crown prince.

A US official has repeated his country’s threats against its allies over Huawei – stating that the US’s goal is a process that leads “inevitably to the banning” of the Chinese company’s products.

“We have encouraged countries to adopt risk-based security frameworks,” said Robert Strayer, speaking on a call with the world’s press on Wednesday, expressing the hope that such frameworks would “lead inevitably” to bans on Huawei.

Strayer, who is the American foreign ministry’s deputy assistant secretary for Cyber and International Communications and Information Policy, told journalists that his country may withdraw some co-operations with its allies on security matters if they install Huawei equipment on internet and phone networks.

Below is a full rush transcript of the press conference by Ambassador Robert L. Strayer, Deputy Assistant Secretary for Cyber and International Communications and Information Policy , BUREAU OF ECONOMIC AND BUSINESS AFFAIRS.

MR STRAYER:  The United States wants to maintain a secure cyberspace for future generations.  We and our partners recognize that cyber policy issues are critical to not just protecting communications networks, but also to national security, human rights, and economic prosperity around the world.  Because of its impact on these vital interests, cyber policy is a foreign policy priority for the United States.  The security of information communications technologies, or ICTs, is an essential element of national security.  These networks and services play a crucial role in the safety, security, and prosperity of each nation.  The fifth generation of wireless technology, or 5G, will be transformative by providing consumers and businesses with up to 100 times faster connections than 4G networks provide, and with low latency, which is the time devices need to communicate with one another.  Billions of new devices will become connected to the internet, enabling the internet of things.  And these connections will empower a vast array of new critical services, from artificial intelligence to autonomous vehicles to telemedicine and automated manufacturing.

Since 5G networks will begin to touch every aspect of our lives, the stakes could not be higher for its security.  As countries around the world expand and update their ICT infrastructure, we are urging them to adopt a risk-based security framework.  An important element of this is a careful evaluation of the supply chain and equipment vendors.  In particular, this evaluation should result in the exclusions of equipment vendors that are subject to unchecked or extrajudicial control by a foreign power.  These vendors could be ordered to undermine network security, to skim personal information, conduct espionage, distribute cyber attacks, and disrupt critical infrastructure.

A significant cause for concern are a number of Chinese laws that compel their companies to cooperate with intelligence and security services without independent judicial controls.  Responding to this risk, the United States enacted the National Defense Authorization Act last year, which prohibits the U.S. Government from using equipment or services from certain high-risk companies that are associated with, owned, or controlled by China.  And no major U.S. wireless carrier plans to use Huawei or ZTE equipment in the buildout of its 5G network.

The good news is that many other countries are also acknowledging this supply chain risk and strengthening their ITC security.  And last month, the European Union Commission released a set of recommendations to improve the cyber security of 5G networks, noting that evaluations of equipment suppliers should include the risk of influence by a third country, notably in relation to its model of governance.  These criteria must be rigorously applied.

Moving forward in early May, the Czech Republic is hosting an important conference on 5G security that is attracting scores of countries.  The United States welcomes their leadership and supports this initiative to create nonbinding principles on 5G network security that will drive global conversations on this issue.  At the same time, many countries are not yet focused on 5G, but it’s not premature for countries primarily using 2G and 3G networks to consider their strategies for ensuring future network security now.  Decisions about who builds and how you secure 4G infrastructure are crucial because they will affect the security of future 5G networks.  

With that, I would be happy to answer your questions.

Question:  What are the risks and opportunities for cyber security in the 5G era?  What is the speed and timeline of 5G expansion?  What is the role of new technologies like pseudo-satellite, e.g. Softbank and Loon?

MR STRAYER:  So a number of new technologies will be built upon the 5G infrastructure.  They will be empowered by the internet of things, they will be empowered by the very low latency and very high – up to 100 times what is current throughput on the networks.  So we’re going to see all kinds of not just new communications, but the ability for all kinds of critical infrastructure to ride over that infrastructure itself.  So there’s tremendous amount of economic growth that will occur in all the applications that ride on top of the actual infrastructure itself.  So unlike the 4G networks of today, where they’re relied on primarily for communications and the use of our smart devices, handheld smartphones, new types of direct machine communications will occur.

Question:  How does the U.S. view the UK’s reported decision to allow Huawei to build parts of its 5G network?  And what do you want to achieve at the 5G conference in Prague?

MR STRAYER:  Well, first I would note that the United Kingdom has not announced a final decision.  Like all of us, they’re on a path of having continued conversations about security of 5G networks.  I’d also point out that the United Kingdom, through their Huawei oversight board report, noted there were hundreds of vulnerabilities, including systemic engineering problems with Huawei technologies.  So we’re looking forward to continuing the conversations with them, and with a number of other countries at the Czech Republic-hosted conference that will occur later this week in Prague that will help define some nonbinding principles that all of us can apply to improving the security of our 5G networks, including with respect to the supply chain of the vendors.

Question:  Recently, you indicated that use of Huawei anywhere in a nation’s 5G infrastructure would harm cooperation between that nation and the U.S.  Britain will use Huawei equipment in parts of its 5G infrastructure.  Will cooperation between the U.S. and the UK be hindered?

MR STRAYER:  It’s premature to address that exact part of the question, but I will say this:  As our economies become more interconnected, including our digital economies, more data transmits between the United States and Europe than any other part of the world, which of course includes the United Kingdom, we know that a disruption to services or a disruption to the ability to store or access information that transmits between those routes across the Atlantic will impact all of us.  So indeed, it’s not just about the sharing of intelligence or the cooperation on information sharing, it’s about all the services that we’re providing across the Atlantic today that could be disrupted.  And it’s not just the disruption, but as well as the intrusion of – insertion of cyber vulnerabilities or the use of the networks for espionage.

Question:  What is the government’s planned course of action for the now likely case that European allies such as Germany allow Huawei to build their 5G networks, in some detail if possible?

MR STRAYER:  Well, it’s premature to assess that.  I mean, we have said that if the risk to – if other countries insert and allow untrusted vendors to build out and become the vendors for their 5G networks, we will have to reassess the ability for us to share information and be interconnected with them in the ways that we are today.  Exactly how that will be done will depend on the risk of the equipment that’s put into the new networks.

Question:  Can you please give us a sense, what is the strategy in alerting nations in Southeast Asia and Africa where Huawei is very popular?  

MR STRAYER:  All right.  So a year ago nobody was talking about the supply chain risks related to 5G networks, and there was a limited discussion related to 4G and 3G networks on the importance of supply chain security.  So we’ve continued to have discussions with governments around the globe about supply chain security and its importance for all types of telecommunications networks, both the current generations of telecom networks as well as future generations.  So we’re going to continue to engage with those governments.  We’re going to share our views and our understandings about what are the avenues, and what is really going to be an enhanced attack surface in 5G because of the ability for much more software that will drive the networks and build a – for a potential adversary to compromise that software in any part of the networks. 

Furthermore, we’re talking to countries about the shared values that we have, our shared values related to fundamental human rights and civil liberties.  We want to talk about the importance of enabling the sharing of data in ways that are not going to be compromised that could result in authoritarian governments getting access to data and potentially compromising peoples’ ability to have free expression, to peacefully assemble, or to exercise freedom of religion.  We have, of course, seen that in China in recent years and we’re very concerned about the ability of a government to compel telecommunications providers to provide that type of data to a government that has that track record.

Question:  Do you believe that allowing Huawei to help build Britain’s or any country’s 5G telecoms network will risk national security even if it only applies to non-core parts of the network?

MR STRAYER:  It’s the United States position that putting Huawei or other untrustworthy vendors in any part of the 5G telecommunications network is a risk.  We are concerned that even at the edge of that network, where we’re going to see increasingly what they’re calling software-defined networks and the virtualization, the software virtualization of activities as part of the network that are done more today by hardware than software, but as they’re increasingly done by software there’s that increased attack surface.  Having potentially compromised equipment and software provided by vendors in any part of that network is an unacceptable risk.

Question:  Do you consider the distinction between core and radio networks a sensible approach to managing 5G security?

MR STRAYER:  It is our position in the United States that there is no way that we can effectively mitigate the risk to having an untrustworthy vendor in the edge of the network.

Question:  Is there anything that the U.S. Government and/or its allies could do to help Huawei’s rivals in America and Europe to become more competitive, or to shield them from potential retributions on the Chinese market?

MR STRAYER:  I need to be clear here.  The effort that we’re undertaking around the world, our global diplomatic effort, has nothing to do with trade.  It’s 100 percent about national security interests.  The conversations we’re having are about national security.  That said, it’s also important to point out that there is no U.S. provider for the wireless radio networks, so we’re not advancing a U.S. interest here.  The primary competition to the Chinese are a Finnish company, a Swedish company, and a South Korean company.

Question: How will the U.S. approach to the military cooperation and intelligence sharing with nations which use Huawei in some aspects of their 5G networks – for example, allies like the Philippines and Thailand – within the U.S.’s historically conducted military exercises, how will that change if those are both going ahead with Huawei 5G tests?

MR STRAYER:  Well, certainly we want to have the opportunity to continue to have engagement with those governments about the future buildout of the 5G networks.  They’re in 4G – have 4G networks they – like all of us do – that are – they’re now just starting to build out 5G networks.  So we hope to convince them that in their 5G networks they should not have untrustworthy vendors in the network.  That said, if there is an insertion of an untrustworthy vendor into a network, we’re going to have to evaluate our ability to share information and how we would share that information.

Question:  Despite U.S. pressure, Germany refuses to exclude Huawei’s 5G technology.  How is this step seen by you?  And is there a risk that Germany will lose access to intelligence sharing?

MR STRAYER:  So on the positive note, Germany has released a set of security standards related to 5G, which include looking at the ability for another country to undermine the data security laws in Germany and in the European Union.  Acknowledging that general standard, though, the actual implementation that would occur down the road is very important.  It’s crucial that that be – that particular element related to the supply chain and the ability of a third country to compel its vendors to act in the interests of that – of an authoritarian country be considered.  If that is actually applied in a rigorous way, then it should lead to the prohibition of Huawei and ZTE from networks in Germany and around the world.

Question:  Do Ericsson and Nokia have enough capacity to build the U.S. 5G network?

MR STRAYER:  Well, in our wireless carriers’ view – I’m here representing the U.S. Government, of course.  I cannot comment exactly on their internal supply chain issues.  But my understanding is that our carriers have no concern about the ability for Ericsson, Nokia, and Samsung to supply their networks.  Of course, they have said that they’re not going to use Huawei or ZTE technology in their 5G networks.

I think it’s also important to recognize that when we talk about 5G, there’s an entire ecosystem of component parts that will go into that well beyond just the wireless radio interface.  There will be all kinds of networking and rallying that go on.  There are American companies and companies around the world that supply that, including Cisco and Juniper.  There’s also going to be a very big importance too as we see more and more of the network virtualized – that is, software taking over the role that was previously performed by hardware.  There’ll be more data storage in effectively what is the cloud, a cloud environment.  So there’s many companies providing cloud infrastructure for that 5G ecosystem.

Question:  Can you elaborate on how the U.S. is defining, quote-unquote, ‘sensitive networks’ for 5G infrastructure?  And is that definition different from the UK’s current definition?

MR STRAYER:  Well, I don’t really want to get into how we would define what are more sensitive networks and less sensitive networks.  I would just revert back to the point I was making earlier, which is that in our view, because of the interconnectedness and the dramatic changes we’re going to see in what 5G enables, that underlying infrastructure affecting the entire value stack of applications above it, that there are truly critical services that will be provided that we cannot see undermined in any part of a 5G network.  We should be concerned about all parts of the 5G network going forward.  And so therefore, no part of a 5G network should have parts or software coming from a vendor that could be under the control of an authoritarian government.

Question:  Huawei and the Chinese Government have repeatedly denied U.S. allegations that Huawei equipment poses a security risk, claiming that the U.S. has not offered any concrete evidence.  What is your strategy in countering those claims?

MR STRAYER:  Well, I think it’s important to recognize that there’s been a number of allegations that Huawei and ZTE over the years have been involved in intellectual property theft.  In fact, there’s currently an indictment against Huawei in the United States for the theft of intellectual property from T-Mobile, and that indictment notes that there was a campaign within the company to provide bonuses to employees who stole intellectual property.

It’s also important to recognize that it’s not just the intellectual property theft.  It’s the ability for the government under their national intelligence law to compel that company to act in any way that is in the interests of the Chinese Communist Party.  So in the future, they could be asked to do things they’re not asked to do today.  The way we look at it is there is a combination of intent, capabilities, and opportunity.  With regard to intent, we’ve seen that China has a history of intellectual property theft that has occurred over the years that resulted in a statement in the Rose Garden in 2015 with President Obama that it was not lived up to.  

We noted last December, on December 20th, that China was behind the global hacking of what are called managed service providers, including global cloud providers around the world.  And what China did is they used that data that it stole from some of the biggest companies around the world to provide to its own companies for their economic benefit.  So we know there’s a history of intellectual property theft.

We also know there’s a use of data in China that’s contrary to the values that we have in the West.  We’ve seen data used to assign social credit scores to then conduct surveillance against citizens, and then to use that information to put more than a million Uighurs into re-education camps.  So those uses of data are completely contrary to the West’s view, so we know there’s an intent to use data in different ways than we would ever want to see used under our views about fundamental human rights.

Secondly, we come to the capabilities.  With regard to capabilities, we know there’s the national intelligence law in China, the counterterrorism law, and then a number of other laws that come together to provide the Chinese Government complete control over their private sector and state-owned companies.

And then lastly, opportunity.  As I mentioned before, the attack surface in a 5G network is greatly expanded.  Some have asked, “Where is the smoking gun?”  Well, it’s hardly appropriate to ask for the smoking gun evidence when we don’t even have 5G networks built out yet, we don’t have a history of 5G, and the – especially as U.S. cases get built out to provide massive amounts of new data, the temptation will be there to come after that data and use it for illicit purposes.

So that all combined – the intent, the capabilities, and the opportunity – what we really have here is a loaded gun, is something that Western democracies who value human rights should think very carefully about if they want to give that to an authoritarian regime with very different values about the uses of data. 

Question:  Was the EU commission’s decision to ask member-states to carry out a risk assessment of the security risks posed by 5G technology rather than to ban Huawei sufficient from a U.S. point of view?  And what should Ireland, which is currently undertaking such an assessment, consider as part of that exercise?

MR STRAYER:  We think that the European Commission’s recommendation to conduct assessments by the end of June and then come up with a European-wide policy is a positive first step.  Of course, it’s very important that this analysis, this evaluation, be done in a very rigorous way, particularly as it relates to the supply chain.  As I mentioned earlier, the European Union’s recommendation is set to consider the governance of third countries where vendors are located.  So it’s very important to look at the laws in that country, the legal regime, the ability for companies there to seek independent judicial redress, to object if they are compelled to do something by the government.  That, of course, does not exist in China.  There is not an independent judiciary and there is an inability for companies to say that they do not want to comply with Chinese Communist Party direction.  So with that in mind, we are hopeful that countries in Europe apply that type of framework and evaluation as they think about what kind of vendors they want in their 5G networks.  

So as I said, the European Commission’s recommendations highlighting security related to 5G and including the fact that supply chain security is important is a positive first step, but it’s going to be – the truth, the sort of – it will be borne out in how the – those standards and those evaluations are done in the months ahead.  So we’re in a very critical time for discussions with the European Union in the next few months.

Question: Can operators maintain a multi-vendor policy to manage their cyber security risks without having access to Chinese vendors?

MR STRAYER:  Certainly.  I think that question probably refers to who’s managing the networks themselves.  There’s a number – a wide number of Western companies providing cybersecurity threat intelligence and cybersecurity management tools.  If you just go to the RSA cyber conference, there’s tens of thousands of companies that are there.  There’s no reason that one would have to necessarily turn to a Chinese company.

Question: Has the U.S. approach to 5G shifted away from Huawei and towards calling for increased security standards across the board?  If so, why the shift?

MR STRAYER:  There has not been a shift.  Our entire diplomatic effort has always started with the premise that we need a risk-based security framework that includes looking very carefully at the supply chain.  We think that an evaluation of the supply chain for a risk-based approach – that includes looking at the insertion of intentional vulnerabilities – must require – requires someone to look at the countries where those vendors are located and the laws of those countries, particularly as it relates to authoritarian regimes, their ability to compel companies to act in that country’s interest.  

So we’ve started from that general framework and we look at the laws that are in place and then the vendors that are subject to those laws are the ones that we say should be excluded from providing 5G infrastructure.  So we’re not targeting a particular country.  I know there’s been a number of questions about different countries, companies within countries.  We’ve answered those questions, in our view, about those companies’ activities and some concerns about them, but the overall framework that we’re applying here is a security framework that does – that has been applied to a particular country and particular vendors.

Question:  Zimbabwe was doing deals with China.  What are the next steps that would ensure emerging markets with U.S. 5G technology infrastructure?  Is the U.S. open to establishing a working group with the diaspora?

MR STRAYER:  Well, I will say more generally, the Chinese One Belt, One Road program has been offering countries in Africa and around the world what are basically loan terms that you would never find in any type of Western development bank, but what we have the countries thinking about is the strings that are attached to that.  These are essentially predatory loans.  They often ask for collateral to be attached to those loans.  As we see in some cases, it’s required countries to give up the ownership of their ports when they weren’t able to make payments.  They’ve also done these deals in many cases in non-transparent ways.  It’s very hard for the public and others to have knowledge of what kind of deals are being struck in these deals.  They’re not in – done in the best practices that we would consider in the West to be ways that countries and companies should be doing business.

So we would like to have a very close dialogue with countries like Zimbabwe about how we can potentially assist them in financing their infrastructure.  There’s a number of development banks around the world who are able to invest in that type of infrastructure.  So whether it’s all sorts of important infrastructure, including telecommunications infrastructure, we seek to be very engaged with them and look for opportunities to make that economic prosperity come about in ways that are transparent and will lead to the long-term prosperity of citizens in those countries.

Question:  Have you been satisfied with the draft Prague principles that you’ve seen so far?  What elements do you consider key for these non-binding principles to work?

MR STRAYER:  Well, I will say that I am very satisfied with our engagement with the Czech Republic and their very diligent work on these principles.  I don’t want to get ahead of them and the announcement of the principles that they are going to have at their conference.  I look forward to having discussions with them.  We really appreciate their leadership on this important issue and their drafting of the principles.

MR STRAYER:  Thank you.  Thank you very much for having me, and I appreciate everyone who’s been on in the online world, participating and asking all these great questions.  This really comes to a fundamental question about values, about entrusting in your data with countries, and those that share values with you.  And in important ways, we’ve seen the compromise of those values and the violation of fundamental human rights and civil liberties with regards to the freedom of expression, freedom of assembly, and the freedom to practice religion as one chooses.  So we urge countries to think very carefully as they implement requirements related to 5G infrastructure, including related to the supply chain, and think very carefully about the values of the companies and the countries that they are being asked to do business with and receive offers from countries that have a track record that is checkered at best.