July 24, 2020
Today, EU member states and the European Commission issued their preliminary report about fulfilling the so-called EU 5G toolbox. This is a set of tools representing a common approach by EU member states to securing future 5G networks specifically founded on the objective evaluation of risks associated with the coming of 5G networks and adequate measures with the goal of reducing these risks. According to the Commission, all member states took specific steps to raise the level of security, which demonstrates their willingness to move forward in a coordinated way on a pan-EU level while also stating it is necessary to immediately begin reducing the risks of dependence on a single vendor and to accelerate the setting of processes for screening direct foreign investments.
The EU 5G toolbox was published at the end of January and shows the agreement among the member states with the European Union Agency for Cybersecurity (ENISA) on the need for building secure 5G networks. Individual measures within this document are based on, for example, creating risk profiles of individual technology suppliers and the creation of specific measures that will prevent the participation of suppliers that are deemed to be highly risky. Another significant risk the toolbox identifies is being dependent on a single supplier. The specific form and speed of the measures are implemented is the responsibility of the individual member states.
The current report maps the advances the individual member states have made in adopting the necessary measures. The main advances came in increasing the powers of the national regulators so they can better assure the cybersecurity of 5G networks. The Commission sees similar advances in measures that will limit infrastructure suppliers’ access based on their risk profiles. Contrarily, more must be done to mitigate risks from a single supplier or in setting foreign direct investment screenings.
“From my point of view, it’s key that the European Commission is supporting an identical approach to what the Czech Republic has backed for some time. That means an approach based on risk evaluation while also advancing the implementation of the EU 5G toolbox as a clear signal of the efforts behind an EU-wide solution that the Czech Republic is also working towards,” NÚKIB Director Karel Řehka said of the European Commission’s report.
The Czech Republic is also not lagging behind in another area listed in the EU 5G toolbox: screening foreign direct investments, the oversight of which is the responsibility of the Ministry of Industry and Trade. “The ministry is intensively working on implementing a national mechanism for screening foreign direct investments. It has created a bill on its implementation that has already passed the first parliamentary reading. The legislative process will continue at the beginning of September. We are also working on joining a system of European cooperation in this field that will formally begin in October this year,” deputy head of the European Union and Foreign Trade Department at the Ministry of Industry and Trade Martina Tauberová said.
The toolbox is a fundamental EU document about 5G network security. The Czech Republic and France took the dominant role in preparing it. “Together with our colleagues within the French Agence nationale de la sécurité des systèmes d'information (ANSSI), we had the chief role in preparing the toolbox. I’m not exaggerating when I say it was thanks to the Czech Republic that the risk evaluation of technology suppliers for 5G networks including non-technical parameters, such as trust in the particular supplier, got into the final document,” said Czech Cyber Attaché at the National Cyber and Information Security Agency Lukáš Pimper, who was responsible for this process in Brussels.
In the conclusion to the report, the Commission also emphasizes that assuring the resilience of 5G networks is absolutely necessary for our society as this technology will have an influence on electronic communication and other important sectors, such as energy, transportation, finance, and healthcare. It will also allow for greater automation of industry than is possible today.