cyber-security 23 May 2019

BIS publishes temporary general licence for transactions with Huawei

The US Bureau of Industry and Security (‘BIS’) has published a temporary general licence which, for a period of 90 days, authorises persons who would otherwise be prohibited from transacting with Chinese telecom company Huawei, to do so – to an extent.

Huawei, and 68 related entities, were added to the Department of Commerce’s Entity List on 16 May. The licence allows the following:

‘1. Continued Operation of Existing Networks and Equipment: BIS authorizes engagement in transactions, subject to other provisions of the EAR, necessary to maintain and support existing and currently fully operational networks and equipment, including software updates and patches, subject to legally binding contracts and agreements executed between Huawei and third parties or the sixty-eight non-U.S. Huawei affiliates and third parties on or before May 16, 2019.

‘2. Support to Existing Handsets: BIS authorizes engagement in transactions, subject to other provisions of the EAR, necessary to provide service and support, including software updates or patches, to existing Huawei handsets that were available to the public on or before May 16, 2019.

‘3. Cybersecurity Research and Vulnerability Disclosure: BIS authorizes, subject to other provisions of the EAR, the disclosure to Huawei and/or the sixty-eight non-U.S. affiliates of information regarding security vulnerabilities in items owned, possessed, or controlled by Huawei or any of the sixty-eight non-U.S. affiliates when related to the process of providing ongoing security research critical to maintaining the integrity and reliability of existing and currently fully operational networks and equipment, as well as handsets.

‘4. Engagement as Necessary for Development of 5G Standards by a Duly Recognized Standards Body: BIS authorizes, subject to other provisions of the EAR, engagement with Huawei and/or the sixty-eight non-U.S. affiliates as necessary for the development of 5G standards as part of a duly recognized international standards body (e.g., IEEE – Institute of Electrical and Electronics Engineers; IETF – Internet Engineering Task Force; ISO – International Organization for Standards; ITU – International Telecommunications Union; ETSI- European Telecommunications Standards Institute; 3GPP – 3rd Generation Partnership Project; TIA- Telecommunications Industry Association; and GSMA, a.k.a., GSM Association, Global System for Mobile Communications).

‘The licensing and other policies of the EAR regarding exports, reexports, and transfers (in country) to Huawei and sixty-eight of its non-U.S. affiliates that were in effect prior to their addition to the Entity List on May 16, 2019, are available for exports, reexports, and transfers (in-country) for transactions eligible for the temporary general license established by this final rule.’

The inclusion of Huawei on the Entity List is predicted to have considerable ramifications for the telecommunications industry given its reliance on US suppliers and parts. Shortly after the listing was announced, Google announced that it would be ending the agreement under which Huawei used its Android operating system in its handsets. On announcement of the publication of the temporary general licence, Google said it would rethink that policy.