Spanish government cancels €10m contract using Huawei equipment

The Spanish government cancelled a contract that would have seen Huawei equipment deployed in the national academic and research network used to connect the country’s universities, research institutes and parts of the Ministry of Defense.

Last week, a contract worth €10 million ($11.7 million) had been awarded to the Spanish multinational Telefónica to use Huawei kit to upgrade the RedIRIS network, effectively more than 16,000km of infrastructure. On Friday, the government reversed course for “reasons of digital strategy and strategic autonomy,” as reported by El País.

The RedIRIS upgrade using Huawei equipment had been negotiated directly with Telefónica as the company had an existing €5.5 million contract from 2020 to boost the network. The Ministry of Digital Transformation argued the new upgrade was urgent due to the demands of new digital services, supercomputing projects and the network’s connections to Spain’s defense establishment.

It was partially driven by a need to improve the RedIRIS network’s resilience to cyberattacks, despite concerns that the use of equipment provided by Chinese vendors could increase the risk of cyberattacks to Western infrastructure. 

These fears are often expressed in the context of Beijing’s offensive cyber espionage activities and China’s National Intelligence Law of 2017, which allows the state to “compel anyone in China to do anything,” as summarized by Britain’s National Cyber Security Centre. Huawei has consistently argued that such criticisms are illegitimate.

The company is currently restricted from most 5G networks across the European Union, although Spain has opted out of imposing such restrictions, and faces varying levels of bans in networks of NATO allies such as the United States and the United Kingdom. 

Despite the apparent political hesitation regarding restricting Huawei equipment, Spain was among more than a dozen allies who last week warned about Chinese companies compromising global critical infrastructure.

The cancellation of the Telefoníca contract comes amid alarm from Madrid’s allies about the prevalence of the Chinese company’s equipment within the Spanish telecommunications infrastructure, including the core of Telefoníca’s 5G network.

In July, the chairs of the U.S. House and Senate Intelligence panels asked the country’s spy chief to scrutinize any intelligence information the U.S. shares with Spain after the disclosure the country’s wiretap system is underpinned by Huawei technology.

Spanish Prime Minister Pedro Sánchez, who has been among the EU’s most supportive leaders regarding Huawei, has pushed back against the bloc’s efforts to restrict it from 5G networks. Huawei has opened research facilities in Madrid and is a major employer as a technology contractor for a number of public administrations.

Natasha Buckley, a researcher at RUSI and lecturer in cybersecurity at Cranfield University, previously told Recorded Future News that Spain’s approach to the company stood in stark contrast to that of other NATO allies and many EU member states.

“Spain’s stance on high-risk technology vendors places greater emphasis on supply chain reliability than on geopolitical considerations, setting it apart from more restrictive approaches seen in countries like the UK, the Netherlands and Poland.

“While the EU’s 5G Cybersecurity Toolbox recommends limiting or excluding high-risk Chinese suppliers like Huawei, Spain’s implementation has been uneven. Huawei is restricted from some public 5G projects, yet its servers have been approved to store sensitive police wiretap data. The result is a case-by-case approach that falls short of a clearly defined policy towards high-risk vendors,” Buckley said.