Brussels presents measures to exclude Huawei from strategic infrastructure in Spain and the rest of the EU

Ane Barcos/Eduardo González The European Commission presented a revision of the European Union's Cybersecurity Act on Tuesday with the aim of strengthening the bloc's resilience and cybersecurity capabilities in the face of growing cyberattack risks. The new proposal seeks to reinforce the regulatory framework for essential EU infrastructure, prioritizing the security of Information and Communication Technology (ICT) supply chains against increasing threats, and opens the possibility of excluding high-risk suppliers such as Huawei and ZTE from the development of key networks in the region. The Executive Vice-President for Technology Sovereignty, Security and Democracy, Henna Virkkunen, warned that “every day, critical infrastructure in Europe is affected by cyberattacks. These operations include espionage, pre-positioning, ransomware, and disruptive operations.” In this context, the European Commission proposed a series of measures to mitigate cyber threats, especially in the ICT supply chain. The review proposed by Brussels calls for the creation of an ICT supply chain security framework, establishing a harmonized, risk-based approach to identifying and mitigating threats in 18 critical sectors within the EU. This framework also addresses the vulnerabilities of third-country suppliers, such as Huawei and ZTE, which could result in restrictions on their participation in the development of key infrastructure in the region. Virkkunen explained that, “in the recently adopted Joint Communiqué on strengthening the EU’s economic security, the Commission highlighted areas where dependence on a single supplier could pose a significant risk.” In this context, the proposal transforms the 5G security toolkit into a mandatory approach to ensure a level playing field and prevent fragmentation of the European market. The proposal also aims to simplify the collection of data on ransomware attacks, a key measure for improving response and coordination to these incidents. As Virkkunen pointed out, “With the cybersecurity package, we are making it even easier to implement and enforce our rules, which will help the European single market function more efficiently.” The European Commission also recognizes that, in today’s digital world, “everything is digitized and our daily lives depend on secure and functional information networks.” The proposal reinforces the need for robust and efficient cybersecurity tools that enable seamless cooperation between Member States, since, as Virkkunen said, “A cyber threat to one Member State is a threat to all.” Once approved by the European Parliament and the Council of the EU, the Cybersecurity Act will enter into force immediately, with Member States required to implement national guidelines within one year. Huawei in Spain On September 17, the European Commission warned of the security risks stemming from the contract between the government of Pedro Sánchez and Huawei for the supply of servers for the SITEL system's judicial wiretapping, cautioning that it could increase the risk of foreign interference in Spain's technological infrastructure. In this context, on November 17, the People's Party (PP) asked the government "whether it considers the awarding of the wiretapping system contract to Huawei compatible with lines of action 14 and 15 of the National Security Strategy, which mandate strengthening intelligence capabilities against hostile actors and guaranteeing a secure framework for the protection of classified information." The People's Party also demanded explanations “regarding the risk assessment carried out by the Government, in coordination with the National Intelligence Center and the Joint Cyber Command, on Huawei's participation in the national judicial interception system, in light of the national intelligence law and NATO's warnings about high-risk suppliers,” and regarding “the receipt of any formal or informal communication from US authorities, NATO, or European partners warning of possible restrictions on intelligence sharing with Spain following the contract with Huawei.” The main opposition party also inquired about the measures adopted “to ensure that technological collaboration with Huawei does not compromise the principle of mutual trust between NATO and EU allies,” about the justification for maintaining “contracts with a supplier classified by the European Commission as ‘high-risk’,” about “the communications the Government has received from the European Commission regarding the contract with Huawei,” and about “the measures planned by the Ministry of the Interior to align with the European cybersecurity framework.” In its responses, issued on December 9, the Government asserted that “the Ministry of Defense has no contracts with the Chinese company Huawei for the supply of critical technology or devices” and that, “within the scope of the Ministry of the Interior’s responsibilities, it is reported that said Ministry has not signed any contract with the Chinese company Huawei.” It also affirmed that, “regarding the security of 5G networks and services, Spain fully implements the recommendations of the Council of the European Union and the 5G ‘toolbox’ adopted in 2020, within the framework of its responsibilities and in accordance with legally established procedures. In compliance with these regulations, Spain carries out the procedures, risk assessments, and mitigation measures stipulated,” it added.

Related Content

Sánchez denounces, without mentioning any country, the “attack on Spain’s territorial integrity” in Ceuta

Meloni suspends the Schengen Area with Spain, and Sánchez responds that Italy receives twice as many irregular arrivals

Ana Sálomon, dismissed as Ambassador to Israel amidst Netanyahu's crisis, new Consul General in Perpignan

Italy could close the Schengen Area with Spain over the Ceuta crisis, and Albares summons the Italian ambassador.

France reinforces controls with Spain, and Borrell reminds Italy that “no state” can close the Schengen Area to another