It was due to be presented on Wednesday 14 January, but the revision of the EU Cybersecurity Act (CSA) has been postponed for a week, and will not finally see the light of day until Tuesday 20 January in Strasbourg. Meanwhile, negotiations between the Commissioners’ offices are continuing, according to several sources.
The controversy centres on whether or not to ban certain Chinese telecommunications companies - Huawei and ZTE - from the European network. These have already been singled out as presenting significant risks to the security and independence of the Union’s networks following an assessment carried out more than two years ago.
At the time, the European Commission endorsed the decision of around ten Member States to ban Huawei and ZTE from their networks, as part of the implementation of the security ‘toolkit’ for 5G technology (see EUROPE 13202/3). At the time, it considered that these companies were ‘high-risk suppliers’ because they were subject to “highly intrusive national intelligence and data security laws of third countries”.
“We have encouraged Member States to adopt appropriate measures to exclude these two high-risk suppliers from connectivity infrastructures. The truth is that, to date, only a very limited number of Member States have adopted appropriate measures”, admitted a Commission spokesperson when asked about this.
Spain, in particular, which recently signed a major contract with Huawei despite European comments, is opposed to this supplier being de facto banned in the EU (see EUROPE 13711/12). Alerted last September, the Commissioner for Tech Sovereignty, Henna Virkkunen, had already expressed her concern about this contract, saying she was concerned about “the increased risk of foreign interference”.
This planned revision of the CSA was intended to enable the Commission to “examine more generally the security and resilience” of telecommunications infrastructures in order to “avoid critical dependencies and reduce risks”.
By moving its presentation to the same day as that of the future Digital Network Act, the Commission could kill two birds with one stone by presenting two texts designed to strengthen the security of European communications networks. (Original version in French by Isalia Stieffatre)