Cybersecurity agency a world-leader

The United Kingdom career civil servant Ciaran Martin belongs to that select group of highly influential public servants most of us have never heard of.

The 45-year-old steps down later this year as head of the National Cyber Security Centre, a branch of UK intelligence that he set up in 2015 and which last month effectively gave the green light to China's Huawei playing a "non-core" role in the country's 5G network.

Prime Minister Boris Johnson's decision to allow Huawei a onethird share in non-sensitive parts of next-generation networks reflected advice from the NCSC, published the same day.

Martin's agency sanctioned limited participation by so-called high-risk vendors, known as HRVs, such as Huawei; but said Huawei's share of the pie should be capped at 35 percent.

"This cap properly balances two different security and resilience risks; the first being the risk associated with HRVs, the second being the need for a diversity of supply in the market," according to the advice.

Granting even a limited role for Huawei amounted to a rebuff of United States pressure on its allies to impose an outright ban on the Chinese company on security grounds. Johnson was also under pressure from within his own Conservative Party to boycott Huawei.

US Secretary of State Mike Pompeo, on a visit to London right after the go-ahead for Huawei was announced, said Washington would try to work around its differences with London but insisted the US would never expose its own state secrets to networks it could not trust.

Under Martin's leadership, UK security experts have taken a more sober and technological view of cybersecurity than their counterparts in the US, where policy appears to have been driven by White House geopolitics.

As head of the NCSC, Martin has chaired the Huawei Cyber Security Evaluation Centre, a specialist agency that evaluates risks associated with the company's involvement in the UK's technology infrastructure.

The unit operates out of a business park in the county of Oxfordshire, with the full cooperation and participation of Huawei.

The UK assessors have been frank with their Chinese counterparts about perceived failings in Huawei's systems. Their concerns have focused more on technical issues than on any shadowy alleged plot by China to subvert Western communications.

Martin told a cyberconference in Brussels last year that his security unit ran probably the world's toughest and most rigorous oversight regime for Huawei.

He also noted that the NCSC had, the previous year, downgraded the assurances it provided the government about risks associated with the Chinese company because of serious problems with security and engineering processes.

"As we said then, and repeat today, these problems are about standards of cybersecurity; they are not indicators of hostile activity by China," Martin said in February last year. "The company have accepted these findings and have pledged to address them, acknowledging that this will be a process of some years."

After Huawei received Johnson's go-ahead last month, the NCSC's technical director, Ian Levy, wrote in a blog that the agency considered Huawei a high-risk vendor, but not the only one.

"Nothing we do can entirely remove risk in any telecoms network with any vendor," Levy wrote. "And so our intent is to get the risk down to an acceptable level in all the different networks using all the different vendors."

He wrote that this was an ongoing process.

"We don't get to say 'no core, 35 percent access, home in time for tea!'" he said.

The UK boffins lament that a highly consolidated market has failed to give telecoms providers a wider choice of suppliers. But they have accepted it as a fact and see their job as ensuring the country does not become reliant on any single provider.

Given that Huawei, as the overwhelming market leader, already plays a big role in the UK, it was almost inevitable that the government would end up defying the US pressure.

'Huawei: the indispensable telecoms company' was how the Financial Times headlined its account of the latest chapter in the saga.

"The most straightforward explanation for London's momentous decision is that Huawei－backed by the lobbying power of Beijing－is fast becoming an irresistible force," the Financial Times wrote. "The British government has risked the wrath of Washington over Huawei for the simple reason that it has little other choice."

Meanwhile, what has happened to Ciaran Martin? Well, he was granted a prestigious honor in the queen's New Year honors list, and will be taking up a visiting professorship at King's College London.

He said he had always planned to move on and it had been the privilege of a lifetime to set up the NCSC "and lead its brilliant people".

Since Martin set up the NCSC, it has taken on more than 1,000 employees and now has a yearly budget of more than 250 million pounds ($326 million). After dealing with more than 2,000 cybersecurity incidents in less than half a decade, it has made the UK, arguably, the global leader in the field.