In the second blow to U.S. national security interests this week, the European Union (EU) declined to take a stance for or against embattled Chinese telecom vendor Huawei. Instead, the EU will leave lingering national security questions to its member nations to assess and address.

Under the newly published EU "toolbox" on secure 5G networks, member states agreed to "strengthen security requirements, to assess the risk profiles of suppliers, to apply relevant restrictions for suppliers considered to be high risk including necessary exclusions for key assets considered as critical and sensitive — such as the core network functions — and to have strategies in place to ensure the diversification of vendors."

The toolbox stopped short of directing member states to take specific measures to prevent high-risk vendors (HRVs) — such as Huawei or ZTE — from participating in 5G build-outs.

The toolbox quickly drew praise from Huawei, which welcomed the EU decision. "This non-biased and fact-based approach toward 5G security allows Europe to have a more secure and faster 5G network," the company wrote in a statement.

"We will continue to work with European governments and industry to develop common standards to strengthen the security and reliability of the network," said Abraham Liu, Huawei chief representative to the EU, in a statement.

Despite the decision not to ban Huawei outright, the EU maintains that 5G networks could pose a greater cybersecurity risk than past technologies due to greater reliance on software to control functions and edge networking components to serve more use cases.

“With 5G networks increasingly based on software, risks related to major security flaws, such as those deriving from poor software development processes within suppliers are gaining in importance,” an EU 5G risk assessment report states. “They could also make it easier for threat actors to maliciously insert backdoors into products and make them harder to detect.”

The report found that some non-EU countries represented a greater cyberthreat to national interests "based on previous modus operandi of attacks by certain entities or on the existence of an offensive cyber-program of a given third state against them.”

U.S. allies in Europe have been under intense pressure from the U.S. to bar Huawei from participating in 5G rollouts. The U.S. government maintains that Chinese telecom vendors, Huawei and ZTE in particular, represent a threat to national security and it has taken steps to limit the vendors’ ability to compete for 5G contracts in the United States and other Western countries.

However, this pressure campaign seems to be faltering as several U.S. allies opened their arms to the Chinese telecom giant.

Earlier this week, the United Kingdom gave network operators the go-ahead to deploy a limited set of Huawei equipment including radio access network (RAN) elements. But to limit security risks, Huawei's network penetration will be limited to 35% of the network and leaves room for vendors like Ericsson, Nokia, and Cisco.

The decision was a result of Huawei's already considerable presence in U.K. networks. However, Huawei hardware won't be allowed in all aspects of operators' networks. The U.K. government's National Cyber Security Centre (NCSC) maintains that Huawei remains a cybersecurity risk, and notes that as a China-based company under China's National Intelligence Law of 2017, Huawei could be "ordered to act in a way that is harmful to the U.K."

In light of these concerns, the U.K. will bar equipment from HRVs in 5G core database functions; in a number of 5G core-related services including authentication server function, access, mobility management function, unstructured data storage function, network slice selection function, policy control function, and user plane function; and security edge protection proxy.

The U.K. isn't alone. After initially banning Huawei from German networks in 2018, the German government declined to ban any vendors from participating in the design and build-out of 5G mobile networks last fall. Three of the largest telecom operators in Germany have announced that Huawei would be a core part of their 5G rollouts.

Domestically, the U.S. has continued to enforce a ban on telecommunications equipment from China-based vendors. The move was bolstered by a new bill that would funnel more than $1 billion into 5G-related development in open RAN technologies that could elevate U.S. companies as an alternative to Huawei and ZTE. In response, Huawei has filed a legal petition against the Federal Communications Commission's move to bar rural operators from purchasing Chinese equipment based on national security concerns.

“Banning a company like Huawei, just because we started in China – this does not solve cybersecurity challenges,” Huawei’s Chief Legal Officer Song Liuping said at a press conference.