Antonia Bulfon and Lena-Sophie Drews published a policy paper at European Governance Lab. It is about how discussions of European digital dependencies often focus on U.S. software, but China’s role in European network infrastructure deserves equal attention. This paper analyzes why the EU has struggled to regulate the risks posed by Huawei and ZTE. Beyond technical threats such as remote access abuse and compromised supply chains, a non-technical risk is that Chinese law requires these vendors to cooperate with state intelligence services.
The EU’s non-binding 5G Toolbox produced fragmented results, because only 10 of 27 member states have imposed supplier restrictions. A comparison of Sweden, Germany and Austria shows that each state has a different relationship with China, which leads to divergent national interests. We conclude that the proposed Cybersecurity Act 2 would introduce a binding EU mechanism to phase out high-risk suppliers within 36 months, offering a promising path toward a harmonized European approach. Here you can read the paper.
Copyright: Mario Caruso (Unsplash)

