UK and Europe at risk from Chinese tech, says security think tank

European telecoms and computer infrastructure is vulnerable to hostile state interference with Chinese equipment suppliers such as Huawei and ZTE deeply embedded in parts of Europe’s networks, a research report claims.

The study by defence and security think tank Rusi warns that Europe’s patchwork approach to assessing risks from equipment suppliers means the security of critical national infrastructure is at risk from espionage and cyber attacks.

The report comes after a warning from MI5 that China’s Ministry of State Security is using a front company to fund research at UK universities, allowing it to gain access to technology that could pose a threat to the UK’s national security.

According to Rusi, the lack of agreement over what constitutes a high-risk ICT supplier has resulted in an inconsistent approach in Europe and the UK to Chinese suppliers, with many governments lacking basic information what equipment is used in their networks.

This has led to widely different approaches by countries to using Chinese components in critical infrastructure, with Chinese suppliers accounting for nearly 60% of Germany’s 5G radio access network, compared with 30% in Spain and only 20% in the UK.

Spain, for example, awarded Chinese telecoms company Huawei a €12m contract for its OceanStor cloud storage servers, which were used to store recordings of judicial wiretaps.

The deal alarmed US lawmakers , who last year raised concerns that the Chinese government could gain access to highly sensitive data, including the ability to monitor Spanish investigations into Chinese spies.

Security risks posed by China

China’s National Intelligence and Counter-Espionage laws require private companies to supply data to the state on request.

There is deep coordination between Chinese businesses and the state, with Chinese firms legally required to host representatives of the Chinese Communist Party (CCP) on their premises.

China also compels companies operating in the country to report software flaws to the Ministry of Industry and Information Technology within 48 hours of their discovery, while prohibiting their disclosure outside of the country.

This gives China’s intelligence services early and privileged access to vulnerabilities that can be exploited by the state to hack into western companies and governments.

Security vulnerabilities

National security legislation in China enables Chinese authorities to control technology suppliers, such as telecoms supplier Huawei. It also provides a mechanism for the Chinese government to harvest security vulnerabilities that could be used to launch hacking attacks ( see box: Security risks posed by China ). There are also concerns that Chinese companies could withhold updates or maintenance for key services during political crises or conflict.

The report urges the UK to introduce legislation to protect the wider critical national infrastructure beyond telecoms and public sector procurement to give government powers to restrict the use of technology that could pose a risk more widely.

The UK has blocked Huawei from the 5G network and Chinese video camera suppliers from use by government departments, but has so far not intervened to assess and remove high-risk suppliers from other parts of the critical national infrastructure.

An amendment to the Cyber Security and Resilience Bill , if passed, will give the government powers to ban technology suppliers on national security grounds, without having to publicly designate the supplier as a national security risk.

Across Europe, the report identifies a gap between legislative ambition to restrict components that may cause a security risk and the implementation of measures to limit the deployment of Chinese technology in critical applications.

“Closing that gap will require not only stronger laws but also deeper institutional capacity, greater economic courage and a willingness to treat technology procurement as an instrument of strategic policy rather than a compliance exercise,” the report states.

MI5 warning to universities

Rusi’s report follows a warning by MI5 that more than 100 UK-linked academics have received funding from a research institute with strong ties to China’s Ministry of State Security.

UK academics have contributed to projects funded by the China General Technology Research Institute (CGTRI) on artificial intelligence, cyber security, covert communications systems and steganography, which actively support Chinese espionage.

Academics could be subject to criminal consequences under the National Security Act 2023 if they knowingly materially assisted a foreign intelligence service, or ought reasonably to have known they were doing so, according to the MI5 advisory .

How Europe and the UK have managed the risks of overseas suppliers

2005: British Telecom gives Huawei its first major contract in the UK.

2019: Political concerns are raised existence of backdoors that would allow Huawei to access data.

2020: The UK’s National Cyber Security Centre found that none of the vulnerabilities in Huawei equipment were the result of state control or influence .

2020: Sweden excludes Huawei and ZTE from 5G networks on national security grounds.

July 2020: UK announces plans, which became legally binding, to strip Huawei equipment from the 5G network by December 2027 following US pressure.

2020: EU introduces a voluntary ‘Toolbox for 5G Security’ giving guidelines for managing high-risk telecoms suppliers.

2021: Germany passes the IT Security law 2.0, which allows the Ministry of Interior to exclude components from critical national infrastructure.

2021: The UK introduces the National Security and Investment Act, giving the UK power to screen and block foreign investments from Chinese. companies.

2021: UK introduces the Telecommunications Security Act, which gives government powers to designate equipment suppliers as high risk.

March 2022: Germany warns against the use of Kaspersky anti-virus software following Russia’s invasion of Ukraine.

November 2022: UK instructs government departments to remove cameras and surveillance systems supplied by Chinese suppliers .

2023: The European Commission explicitly states that Huawei and ZTE represent materially higher risks than other 5G suppliers.

2023: UK introduces the Procurement Act, which allows suppliers to the public sector to be excluded for national security reasons.

July 2024: Germany opts to phase out Chinese suppliers from ‘core’ 5G network.

2025: A report by Reuters raises concerns the security risks of Chinese solar panel inverters .

2025: Germany announces it will not allow components from China in its 6G network .

2025: Germany implements the EU NIS2 Directive, which expands the scope of cyber security requirements to cover critical national infrastructure operators and large companies. It allows the German government to limit the use of critical components seen to pose a security risk.

2026: A review by the US Department of Energy found no evidence of backdoors in Chinese solar power inverters.

January 2026: The European Commission proposes amendments to the EU Cyber Security Act that, if enacted, will give the Commission powers to exclude high-risk suppliers, such as Huawei and ZTE, from critical sectors.

March 2026: UK government blocks a Chinese wind turbine manufacturer from building a factory in Scotland on national security grounds.

UK has ‘narrowing window’ to stay ahead of tech threats, says GCHQ chief Keast-Butler : UK needs to treat cyber security 10 times more urgently in the wake of threats from Russia, China and other adversaries, says GCHQ director Anne Keast-Butler

UK prosecution of alleged Chinese spies was ‘shambolic’ says Parliamentary committee : The Joint Committee on National Security Strategy reports that China was engaged in malicious cyber attacks against UK Parliament and democratic institutions

Hostile states launched nearly 200 attacks on UK infrastructure in 12 months, says NCSC chief : Hackers will use AI-enabled cyber capabilities to exploit known vulnerabilities in legacy technology at scale by 2028, says National Cyber Security Centre CEO Richard Horne.

Chinese IoT suppliers expose UK businesses to espionage and data theft By: Bill Goodwin

Swedish IT industry braced for China’s response to Huawei 5G ban

US senator implores UK legislators to ban Huawei from telecoms networks By: Joe O’Halloran

Huawei hits out at fresh UK network probe By: Joe O’Halloran