Defense Innovation Board of the Department of Defense

“ Since then, new generations of technology and wireless standards have been introduced every decade or so, culminating in our present state of transition between 4G and 5G capabilities. The value of each generation has increased exponentially, as each has enabled a host of other technology advancements across the commercial sector and military. All existing generations work within the low- to mid-band spectrum (less than 6GHz, or sub-6) , but 5G has opened the door for millimeter wave (mmWave) spectrum use as well. ”

“ The compromised supply chain issue poses a serious threat to national security by introducing vulnerabilities into networks and systems, which can be leveraged by a hostile actor to disrupt DoD operations. The spread of these vulnerabilities creates an increasingly unstable environment by lowering barriers to offensive action while weakening defensive positions. The proliferation of security vulnerabilities creates incentives for all nations to take offensive action in a conflict, as the barrier to offense decreases while the difficulty of defense increases. ”

“ However, if Chinese policy does require backdoor access embedded in devices sold in China for internal security purposes, this compromised code applied to such a large market increases the risk that these vulnerabilities will spill over into the rest of the world. If China dominates the market for 5G devices, both as a manufacturer and as a large and attractive market of users, then this potential for vulnerabilities will only continue to spread and put the larger 5G ecosystem at risk. ”

“ DoD must prepare to operate in a sub-6 5G ecosystem, which will require a shift in strategy and a consideration of where DoD is willing to share bandwidth in the sub-6 realm.
This shift may come with some inherent benefits. The anonymity that comes from utilizing the same infrastructure as any other company or country provides an industry-standard form of security all its own. Integration of government and civil use may provide a layer of security by allowing military traffic to “hide in plain sight” as traffic becomes more difficult to see and isolate. ”

“ For spectrum availability, there is ongoing debate on the merits of sub-6 versus mmWave and how to allocate spectrum in either of those categories, and in the United States there is a larger concern about allocating or sharing government-owned spectrum to the commercial sector. For infrastructure, carriers can take a “non-standalone” approach, which leverages existing 3G and 4G infrastructure as a stepping stone to get to full 5G capability, or a “standalone” approach, which requires a large up-front investment to build out new infrastructure for a 5G network. ”

“ Given the gap in 5G advancement between the first tier and everyone else, the rest of the world will likely be driven to implement the 5G network design and infrastructure of whichever country leads 5G. China is the current leader, and U.S. allies have taken different stances on how to respond to the Chinese drive to set 5G standards. Some are wary of Chinese influence because of security concerns and are actively working to push back on China’s 5G roll-out. ”

“ While much of the discussion around 5G revolves around the commercial sector as the driving force behind its rollout, 5G ecosystems of technology can equally revolutionize DoD operations, networks, and information processes. ”

“ In the near term, 3 and 4 GHz spectrum will likely serve as the dominant global bands that drive volume in infrastructure and device deployments. In the current state of 5G development and spectrum usage, it is unlikely that the United States will be able to leverage such technology, much less lead the rest of the world in that band of spectrum deployment as it did with 4G almost a decade ago. ”

“ However, other countries have been less enthusiastic about ousting China from their 5G markets, given the price and quality of China’s offerings. Germany has refused to ban Huawei, despite U.S. threats to cut off intelligence-sharing, and the United Kingdom appears likely to take the same approach. Both Germany and the United Kingdom have pushed back on U.S. claims that Huawei and other Chinese telecommunications companies represent an unacceptable risk to national security, claiming that their security organizations could take measures to limit vulnerabilities in their networks. ”

“ Social stability and economic growth are the CCP’s top priorities because failures in those two areas are seen as direct existential threats to the regime, and 5G has the potential to transition China from a capital- and labor-intensive manufacturing economy to an innovation-led, consumption-driven economy with reduced dependence on foreign investment. In light of China’s slowing growth and its ongoing trade war with the United States, the CCP likely feels pressured to pursue technological advancement initiatives like 5G more aggressively. ”

“ Commercial companies can supply any and all of the above inputs, but this comes with the risk of inadvertent or malicious security vulnerabilities that put DoD systems and networks at risk. The 5G ecosystem will especially run the risk of including security vulnerabilities if China becomes the global leader supplying 5G infrastructure from the subcomponent-level to the integrated system-level, for even if the United States limits sales of Chinese products into the United States, DoD will still have to operate on foreign networks overseas that will likely be built with a Chinese supply chain. ”

“ Even if the security of a particular release of software for a 5G base station may be secure and well-implemented, there is no guarantee that future releases will continue to be equally secure. Bugs will inevitably be found and require software patches, and these fixes may need to be fielded quickly without fully considering new security issues that might be introduced with the patch. It will become increasingly challenging to validate continued security with each iteration. ”

“ China plans to deploy the first widespread 5G network, with its first set of sub-6 services becoming available in 2020. First-mover advantage will likely drive significant increases in their handset and telecom equipment vendors market along with their domestic semiconductor and system suppliers. As a result, Chinese internet companies will be well-positioned to develop services and applications for their home market that take advantage of 5G speed and low latency. ”

“ DoD must be able to communicate, engage, and operate faster to keep up with the changing environment. 5G will enable this new concept of operations, allowing larger volumes of data to be shared in close to real time across geographically dispersed systems. Currently, data sharing at that scale cannot be completed effectively with legacy communication networks. Existing networks will benefit by leveraging lower latency and higher capacity data transfer capability, but 5G’s true potential will be in its impact on the battle network of the future. ”

“ Even if base station code is secure and well-managed over time, the business model of the wireless infrastructure providers is such that personnel from the vendor are typically involved in the commissioning, operation, and maintenance of network infrastructure. This requires vendors to access core management systems that operate the network, and allows vendors to deploy software to equipment in the system. ”

“ Since the rollout of LTE, these wireless competitive landscape has undergone many changes. Chinese telecommunications equipment giant Huawei grew global revenues from approximately $28B in 2009 to $107B in 2018, while other traditional market leaders like Ericsson and Nokia have declined in revenue over that same period. Chinese handset vendors like Huawei, ZTE, Xiaomi, Vivo, and Oppo have rapidly grown in global market share, and are still growing rapidly in adoption and influence despite minimal sales in the U.S. market. In 2009, all of the top 10 Internet companies by revenue were American. ”

“ DoD may have some initial growing pains as it begins to share parts of the spectrum, but the net gain in capability from 5G will ultimately make up for that inconvenience. If DoD does not begin to share the sub-6 spectrum, it will increase the risk of dependence on a compromised supply chain as U.S. companies will be blocked from developing and competing their own sub-6 5G offerings, and foreign providers will increasingly embed their offerings in networks and systems globally. ”

“ Historical shifts between wireless generations suggest that the first-mover country stands to gain billions in revenue accompanied by substantial job creation and leadership in technology innovation. First movers also set standards and practices that were then adopted by subsequent entrants. Conversely, countries that fell behind in previous wireless generation shifts were obligated to adopt the standards, technologies, and architectures of the leading country and missed out on a generation of wireless capabilities and market potential. ”

“ While DoD security typically focuses on vendor-installed backdoors that could be used to remotely control a system or exfiltrate information, a wide variety of security issues could also be introduced through poor software development practices both during and after the rollout of 5G. Many of these risks were mentioned in a UK report on the joint effort with Huawei and the UK government to manage security issues with Huawei deployments in the UK. [2] Security issues from poor software development issues are a universal problem, and are not restricted to only Chinese vendors. ”

“ Japan took the lead on 3G, and while the United States ultimately caught up to Japan, it took years to roll out 3G networks, which came at a huge cost to U.S. businesses as Japan sprinted forward with its 3G business model. ”

“ Verizon, AT&T, Sprint, and T-Mobile are all developing their own 5G networks and 5G devices, each with their own strategy and method. Verizon and AT&T are focused on developing high-band mmWave networks and are in the process of deploying small cells in various test cities for mobile and fixed applications, Sprint is taking a joint approach of mmWave and mid-band spectrum to build out its network, and T-Mobile is focused on mmWave and low-band spectrum. ”

“ Despite messaging from various marketing initiatives in the United States, very little U.S. territory has seen deployment of 5G infrastructure that can deliver 1 Gbps or even 100 Mbps service at the edges of coverage. Whereas LTE deployment resulted in 10x end user speed improvement across large parts of the United States, carriers to date have not demonstrated deployment capability that would deliver high speeds to large parts of the U.S. population. ”

“ Beamforming is a technique for identifying the most efficient data-delivery route to a particular user and reducing interference for nearby users in the process. These options can improve the propagation of mmWaves, but challenges remain with maintaining connectivity across a broader area using this part of the spectrum. Significant time and R&D will have to be devoted to solving the mmWave propagation problem before it can be deployed as a more universal wireless network solution. ”

“ Evidence of backdoors or security vulnerabilities have been discovered in a variety of devices globally. Many of these seem to be related to requirements from the Chinese intelligence community pressuring companies to exfiltrate information about domestic users. In a recent case, Nokia android handsets were discovered to have a backdoor that sent a variety of data to a network server located in the network of China Telecom. [4] Nokia had deliberately built this code into devices sold into China, but had then accidentally installed it onto all its other devices. ”

“ DoD should work to keep large amounts of data flowing on a constant basis so that increases in operational tempo will not be noticed. In addition to these security precautions, DoD must brace for cyber-attack and penetration by improving resiliency and building in layers of redundancy throughout its networks to ensure uninterrupted connectivity. DoD will need to consider options for defending against a compromised supply chain, where Chinese semiconductor components and chipsets are embedded across multiple systems. ”

“ If China is able to collect this data, DoD should consider discrete directives to defend against these vulnerabilities that fall outside the traditional DoD systems and platforms, such as training to limit inadvertent sharing of PII through personal device use. In addition to these efforts, DoD should initiate testing and experimentation on its bases for future generations of wireless technology beyond 5G. This testing and experimentation will occur over a longer timeframe to ensure that the United States is prepared to lead the next generational transition. ”

“ As a result, an operator may have difficulty choosing non-Huawei core infrastructure for Huawei base stations. Multi-vendor networks are typically configured as islands of common vendor equipment, and if a vendor is found to have serious security issues, replacing that vendor in the infrastructure may require a near-complete rebuilding of the network. ”

“ Today, four of the top 10 are Chinese. These trends are already in effect, and 5G has the potential to skew future networks even further in the direction of China if it continues to lead.
The shift from 4G to 5G will drastically impact the future of global communication networks and fundamentally change the environment in which DoD operates. While DoD will feel the impact of 5G, the rollout itself will be driven by the U.S. commercial sector. ”