    [Senate Hearing 116-582]
    [From the U.S. Government Publishing Office]

                                                            S. Hrg. 116-582

                           5G SUPPLY CHAIN SECURITY:
                             THREATS AND SOLUTIONS

    =======================================================================

                                    HEARING

                                   BEFORE THE

                             COMMITTEE ON COMMERCE,
                          SCIENCE, AND TRANSPORTATION
                              UNITED STATES SENATE

                         ONE HUNDRED SIXTEENTH CONGRESS

                                 SECOND SESSION
                                   __________

                                 MARCH 4, 2020
                                   __________

        Printed for the use of the Committee on Commerce, Science, and
                                 Transportation

                     [GRAPHIC NOT AVAILABLE IN TIFF FORMAT]

                    Available online: http://www.govinfo.gov

                                  __________

                        U.S. GOVERNMENT PUBLISHING OFFICE

    52-663 PDF                 WASHINGTON : 2023

           SENATE COMMITTEE ON COMMERCE, SCIENCE, AND TRANSPORTATION

                         ONE HUNDRED SIXTEENTH CONGRESS

                                 SECOND SESSION

                      ROGER WICKER, Mississippi, Chairman
    JOHN THUNE, South Dakota             MARIA CANTWELL, Washington,
    ROY BLUNT, Missouri                      Ranking
    TED CRUZ, Texas                      AMY KLOBUCHAR, Minnesota
    DEB FISCHER, Nebraska                RICHARD BLUMENTHAL, Connecticut
    JERRY MORAN, Kansas                  BRIAN SCHATZ, Hawaii
    DAN SULLIVAN, Alaska                 EDWARD MARKEY, Massachusetts
    CORY GARDNER, Colorado               TOM UDALL, New Mexico
    MARSHA BLACKBURN, Tennessee          GARY PETERS, Michigan
    SHELLEY MOORE CAPITO, West Virginia  TAMMY BALDWIN, Wisconsin
    MIKE LEE, Utah                       TAMMY DUCKWORTH, Illinois
    RON JOHNSON, Wisconsin               JON TESTER, Montana
    TODD YOUNG, Indiana                  KYRSTEN SINEMA, Arizona
    RICK SCOTT, Florida                  JACKY ROSEN, Nevada
                           John Keast, Staff Director
                      Crystal Tully, Deputy Staff Director
                          Steven Wall, General Counsel
                     Kim Lipsky, Democratic Staff Director
                  Chris Day, Democratic Deputy Staff Director
                          Renae Black, Senior Counsel

                                C O N T E N T S

                                  ----------
                                                                       Page
    Hearing held on March 4, 2020....................................     1
    Statement of Senator Wicker......................................     1
    Statement of Senator Cantwell....................................     3
    Statement of Senator Fischer.....................................    37
    Statement of Senator Rosen.......................................    39
    Statement of Senator Gardner.....................................    41
    Statement of Senator Thune.......................................    44
    Statement of Senator Lee.........................................    46
    Statement of Senator Peters......................................    47
    Statement of Senator Sullivan....................................    49
    Statement of Senator Scott.......................................    51
    Statement of Senator Johnson.....................................    56

                                   Witnesses

    Steven K. Berry, President and Chief Executive Officer,
      Competitive Carriers Association...............................     4
        Prepared statement...........................................     6
    Jason S. Boswell, Head of Security, Network Product Solutions,
      Ericsson North America.........................................    10
        Prepared statement...........................................    12
    Asha Keddy, Corporate Vice President and General Manager, Next
      Generation and Standards, Intel Corporation....................    17
        Prepared statement...........................................    19
    Michael Murphy, Chief Technology Officer, Americas at Nokia......    22
        Prepared statement...........................................    24
    Dr. James A. Lewis, Senior Vice President and Director,
      Technology Policy Program, Center for Strategic and
      International Studies (CSIS)...................................    28
        Prepared statement...........................................    29

                                    Appendix

    Letter dated March 3, 2020 to Hon. Roger and Hon. Maria Cantwell
      from Manoj Leelanivas, EVP & Chief Product Officer, Juniper
      Networks.......................................................    61
    Letter dated March 3, 2020 to Chairman Roger Wicker and Ranking
      Member Maria Cantwell from Robert Fisher, SVP Federal
      Government Relations, Verizon Communications and Tim McKone,
      EVP Federal Relations, AT&T....................................    62
    Response to written questions submitted to Steven K. Berry by:
        Hon. Amy Klobuchar...........................................    63
        Hon. Jon Tester..............................................    63
    Response to written question submitted by Hon. Amy Klobuchar to:
        Jason S. Boswell.............................................    64
    Response to written question submitted by Hon. Kyrsten Sinema to:
        Asha Keddy...................................................    65
        Dr. James A. Lewis...........................................    66

                           5G SUPPLY CHAIN SECURITY:
                             THREATS AND SOLUTIONS

                                  ----------

                            WEDNESDAY, MARCH 4, 2020

                                           U.S. Senate,
            Committee on Commerce, Science, and Transportation,
                                                        Washington, DC.
        The Committee met, pursuant to notice, at 10:03 a.m. in
    room SR-253, Russell Senate Office Building, Hon. Roger Wicker,
    Chairman of the Committee, presiding.
        Present: Senators Wicker [presiding], Thune, Blunt,
    Fischer, Sullivan, Gardner, Lee, Johnson, Young, Scott,
    Cantwell, Peters and Rosen.

                OPENING STATEMENT OF HON. ROGER WICKER,
                     U.S. SENATOR FROM MISSISSIPPI

        The Chairman. Good morning and welcome to the newly
    restored Committee room of the Commerce Committee.
        I want to thank Senator Blunt of the Rules Committee and
    the Architect of the Capitol for their effort in restoring this
    room and welcome all of you to a history-making hearing, the
    first hearing in the newly opened room.
        Today, the Committee convenes to discuss the security and
    integrity of the telecommunications supply chain. That is to
    say, the equipment and services that make up a communications
    network.
        I welcome our distinguished panel of witnesses and thank
    them for appearing. Today, we'll hear from Mr. Steven Berry,
    President and Chief Executive Officer of the Competitive
    Carriers Association; Mr. Jason Boswell, Head of Security,
    Network Product Solutions at Ericsson; Ms. Asha Keddy,
    Corporate Vice President and General Manager of Next Generation
    and Standards at Intel; Mr. Mike Murphy, Chief Technology
    Officer, Americas at Nokia; and Dr. James Lewis, Senior Vice
    President and Director of the Technology Policy Program at the
    Center for Strategic and International Studies.
        Closing the digital divide and positioning the United
    States to win the global race to 5G are priorities for this
    committee. Over the past several months, we have been
    discussing the wide-ranging economic and social benefits that
    broadband connectivity has delivered to communities across the
    country.
        We've also discussed the promise of 5G networks to build
    upon these past advances and create new opportunities.
        Our continued ability to connect all Americans and provide
    access to next generation technology will depend in large part
    on the security of the Nation's communications infrastructure.
        Over the past few years, the U.S. Government's intelligence
    officials and international allies have determined that
    telecommunications equipment from certain vendors, such as
    Huawei and ZTE, poses a national security risk.
        Foreign adversaries and enemies of the United States have
    the capability of using this compromised equipment to spy on
    Americans, steal our intellectual property, and otherwise
    disrupt our way of life and economic well-being.
        Today, both Congress and the Trump Administration have
    taken a number of actions to address these security threats and
    protect our networks and devices from hostile exploitation.
    These actions include banning the use of Huawei and ZTE
    components in government systems, prohibiting the use of the
    Universal Service Funds to purchase communications equipment
    and services from Huawei and ZTE, and other high-risk
    suppliers, and adding Huawei and its affiliates to the entity
    list.
        Most recently, Congress passed the Secure and Trusted
    Communications Networks Act. When signed into law by President
    Trump in just a few days, this law will establish a critical
    Rip and Replace program for small and rural telecommunications
    operators to remove compromised equipment from their networks
    and replace it with components from trusted suppliers.
        While this is a meaningful step forward in safeguarding the
    security of the Nation's communications systems, the
    unfortunate reality is that our networks have already been
    compromised by foreign adversaries.
        We are seeing more reports that Huawei can covertly access
    mobile phone networks around the world. At the same time, some
    of our close allies are granting Huawei access to their
    communications systems. These are troubling developments.
        We need to do more to shore up our own network defenses
    against hackers and state-sponsored actors, especially in our
    Nation's rural and underserved communities. This effort will
    require the development of a comprehensive strategy to secure
    the telecommunications supply chain.
        Currently, Huawei maintains the largest global market share
    of telecommunications equipment. The absence of a viable and
    affordable American or European alternative for end-to-end
    telecommunications components, including radios, chips,
    software, and devices, has enabled Huawei to increase its
    global influence.
        At a time of rising global demand for 5G equipment, I hope
    witnesses will discuss what more Congress and the
    Administration can do to support trusted suppliers, invest in
    new technologies, and expand the domestic market for 5G network
    components.
        There are a number of international standard-setting
    organizations, such as the Third Generation Partnership Project
    or 3GPP and the International Telecommunications Union that are
    developing technical standards for 5G. U.S. participation in
    these organizations is also key to a secure telecommunications
    supply chain.
        Today's hearing is an opportunity for witnesses to discuss
    how to increase U.S. engagement in the standards development
    process. This will help ensure American technical expertise and
    priorities are considered in the development of next generation
    technologies.
        Finally, I hope we will learn about how the
    telecommunications industry can improve its cyber hygiene,
    meaning what best practices companies could adopt to mitigate
    risks to vulnerable supply chains.
        I also hope we will learn about what more the FCC can do to
    secure legacy networks and manage security risks in the
    transition to 5G.
        Let me again welcome our witnesses and thank them for
    joining us, and I recognize my friend and Ranking Member
    Senator Cantwell.

                   STATEMENT OF HON. MARIA CANTWELL,
                      U.S. SENATOR FROM WASHINGTON

        Senator Cantwell. Thank you, Mr. Chairman, and thank you
    for holding this important hearing.
        I, too, want to thank Senator Blunt for his work in getting
    us back into our normal hearing room.
        Today's hearing, obviously, we have a lot of great
    witnesses here, and thank you for traveling to be here.
        We've heard a lot about 5G networks and how it's going to
    revolutionize everything from sectors of our economy to
    advancements, but none of this will happen unless we make the
    system secure.
        Yesterday, we had a hearing as part of our review of the
    budget for energy and we were focusing on our Nation's grid and
    the fact that just recently, an attack on our grid in the West
    was the first time an actor had actually brought down a power
    system for more than 12 hours.
        So it's no longer just people searching around and looking
    at our power plants. Now, actors are starting to bring what are
    essential services to a halt, and these are important issues
    for us to address throughout our system.
        So far, the discussion by policymakers about how to keep
    unsecure networks and equipment out of our domestic networks
    has been the focal point, but obviously eliminating the threat
    posed by this equipment is the highest priority. We can't just
    simply look at that issue. We need to make sure that we are a
    loud voice across the globe for no government backdoors to any
    security network.
        By mitigating this, we are helping to communicate what
    needs to be done. I believe it's an imperative that the U.S.
    and its allies foster a truly secure, diverse, and reliable
    supply chain for communications equipment. We need to assure
    the communications systems are secure and that the connections
    to those systems and software are also secure.
        To accomplish this, first and foremost, we need a broader
    strategic plan, and I know that recently our bill that we
    passed out by our colleague, Senator Cornyn, in July was about
    getting the President to send to Congress a much-needed
    strategy on 5G, and hopefully we'll see more details on that
    soon.
        But we must also build a forceful global coalition of
    countries to share our values and respect property rights and
    the Rule of Law, and we need a smart multinational approach to
    this. And so I hope that, Mr. Chairman, we'll continue to work
    with our colleagues on the Intel Committee and on the Foreign
    Affairs Committee to make sure that this is also being
    accomplished.
        We must create incentives for other countries to use
    communication equipment that does not contain a government
    backdoor access, and the United States should have a great
    source of allies to work with us on these issues.
        So again, appreciate this hearing this morning. I think
    it's important to continue to clarify U.S. leadership on this
    issue and how we move ahead, and I appreciate the fact that we
    have so many great witnesses to talk about what these immediate
    next steps are in the legislation that has gone to the
    President's desk.
        Thank you, Mr. Chairman.
        The Chairman. And thank you, Senator Cantwell.
        We have a vote on the Senate Floor scheduled for around
    10:30 and so we'll just do the best we can sharing the gavel
    and getting back and forth, but we are delighted to have the
    testimony.
        Your written statements will be included in the record in
    full and we recognize each of you for around five minutes to
    summarize your testimony.
        Mr. Berry.

      STATEMENT OF STEVEN K. BERRY, PRESIDENT AND CHIEF EXECUTIVE
               OFFICER, COMPETITIVE CARRIERS ASSOCIATION

        Mr. Berry. Thank you, Mr. Chairman.
        [Off microphone comments] for every American in Rural
    America, reliable broadband maps. I look forward to your
    successful completion of the Broadband Data Act and it's signed
    into law. So from everyone from rural America, big thank you to
    this committee.
        Chairman Wicker, Ranking Member Cantwell, and members of
    the Committee, thank you for the opportunity to testify about
    security and integrity of the telecommunications supply chain,
    both for existing wireless networks and for the Nation's future
    5G.
        CCA is the Nation's leading association for competitive
    wireless carriers as well as the vendors and suppliers serving
    that ecosystem. CCA and its members fully support efforts to
    protect networks from cyber and national security threats.
        I strongly commend this Committee's bipartisan efforts to
    send the Secure and Trusted Communications Networks Act to the
    President. This important legislation addresses many key
    concerns. It provides all carriers with clear direction and,
    importantly, creates a fund to help small carriers replace
    covered equipment.
        Since I last appeared at this Committee, there has been a
    lot of talk about what steps small carriers must take to secure
    their networks and your actions, as a matter of fact your
    legislation, will allow these carriers and government officials
    to not just talk the talk but actually walk the walk.
        Wireless networks are providing connectivity for
    innovations ranging from health, education, and public safety
    to economic and social transformations. All carriers are
    focused on providing secure connectivity against the ever-
    growing array of threats. The transition to 5G networks
    provides an opportunity for all carriers to build in security
    as a basic function.
        The challenge is heightened by carriers that have equipment
    in their networks from companies deemed by Federal agencies to
    pose a national security threat.
        Now let me be clear. Most CCA members do not have covered
    equipment in their networks. For those that do, often they
    provide service to their own rural communities, operating where
    other carrier providers don't provide service on the thinnest
    of margins to connect their neighbors. These companies are
    owned by and employ Americans in their local communities and I
    can assure you these patriots want to take whatever steps
    necessary to ensure our national security. Through your
    actions, these carriers will have a program to support
    replacing covered network elements.
        Chairman Wicker, I completely agree with your floor remarks
    when you said some things are worth paying and protecting
    America is worth paying for.
        The undertaking to replace existing equipment is
    unprecedented, historic, never been done. Networks in operation
    today were built over years, actually decades, and such a
    significant undertaking will be all-encompassing.
        Further, this task must be completed in a way that keeps
    rural Americans connected. For all the talk about Rip and
    Replace, carriers must actually create and execute individual
    plans that replace and then rip. They must maintain service
    before decommissioning. Anything less threatens the loss of
    connectivity in rural America, including access to 9-1-1 and
    public safety services.
        These carriers are essentially attempting to rebuild the
    airplane in midflight, and the challenge of securing networks
    does not end here. As we enter the 5G era, there are new
    opportunities for all carriers to build security into the
    networks from the ground up.
        There are three main factors for industry and policymakers
    going forward. Number 1, all carriers must have clear guidance
    and information from the Federal Government regarding security.
    You did this. Your legislation facilitates information sharing
    specifically for small providers.
        Number 2, secure trusted network equipment must be
    available for all carriers. The Act directs the creation of a
    list of suggested replacements that would allow carriers with
    and without covered equipment to confidently make the decisions
    that they will need. Flexibility will be the secret sauce to
    this success.
        And Number 3, new technologies hold the promise to enhance
    security, spur innovation, and save costs. We should explore
    virtual technologies. However, policymakers should not mandate
    technologies. If new technologies deliver on ther promise, they
    will compete successfully in the marketplace.
        And in closing, thank you again for the exceptional
    leadership in passing the Secure and Trusted Communication
    Networks Act. CCA is committed to working with not only all the
    shareholders, the stockholders, and stakeholders, as you would
    say, to accomplish the challenging task of securing our
    networks while we maintain communications services for millions
    of consumers in rural America, and so thank you for the
    opportunity to testify, and I look forward to your questions.
        [The prepared statement of Mr. Berry follows:]

     Prepared Statement of Steven K. Berry, President and Chief Executive
                   Officer, Competitive Carriers Association
        Chairman Wicker, Ranking Member Cantwell, and Members of the
    Committee, thank you for the opportunity to testify about the security
    and integrity of the telecommunications supply chain, both for existing
    wireless networks and for our Nation's 5G future.
        I am testifying on behalf of Competitive Carriers Association
    (``CCA''), the Nation's leading association for competitive wireless
    providers. CCA is composed of nearly 100 carrier members ranging from
    small, rural providers serving fewer than 5,000 customers to regional
    and nationwide providers serving millions of customers, as well as
    vendors and suppliers that provide products and services throughout the
    mobile communications ecosystem.
        CCA and its members fully support efforts to protect and harden
    networks from cybersecurity and other national security threats. Press
    reports and actions by the Federal Government continue to underscore
    the threats posed by certain companies and foreign adversaries. To
    address these threats, I particularly commend this Committee's
    bipartisan leadership in sending the Secure and Trusted Communications
    Networks Act to the President for enactment. This important legislation
    addresses several key concerns of competitive carriers that are working
    to secure their networks. In particular, the legislation provides
    certainty regarding what actions small carriers must take to modify
    their existing networks and establishes a fund to ensure that resources
    are available.
        Beyond the immediate attention on network security, we must also
    not lose focus on the economic security threats we face as a nation as
    we compete globally to provide the latest innovations, powered by
    wireless communications. Establishing American leadership for 5G
    network deployments, including the potential for a greater role in the
    5G supply chain, is an important goal, and one that can only be
    achieved by ensuring that all Americans have access to the latest
    services, both in urban population centers as well as rural America. In
    fact, rural areas stand to enjoy the most immediate and significant
    benefits through expanded access to the latest wireless services. No
    one will win the so-called ``race to 5G'' without connecting the
    millions of people living in rural America.
        While wireless networks are providing connectivity for innovations
    ranging from health and public safety advances to economic and social
    transformations, these connections must be secure. All carriers are
    therefore focused on ensuring that they are providing secure
    connectivity amidst an ever-growing array of potential threats. The
    transition to 5G networks provides an opportunity for all carriers to
    build in security as a basic function of network architecture and
    management.
        Security threats are particularly acute for carriers that have
    equipment or services in their networks from companies deemed by
    Federal agencies, including the Federal Communications Commission
    (``FCC''), to pose a ``national security threat to the integrity of
    communications networks or the communications supply chain.'' To be
    clear, most CCA members do not have covered equipment in their
    networks. Those that do often provide service to their own rural
    communities, operating where no other carrier will provide service and
    at the thinnest of margins to connect their neighbors. These companies
    are owned by and employ Americans in their local communities, and I can
    assure you that these patriots want to take whatever steps are
    necessary to ensure our national security.
        Whether or not a carrier has covered equipment in its immediate
    network, removing insecure network elements is a priority shared across
    the industry. Telecommunications networks provide value to all
    consumers through the network effects of connectivity, and networks
    must interconnect with each other. Further, through roaming and other
    arrangements between carriers, as you travel the country you have
    likely enjoyed service from rural carriers, whether you realize it or
    not. Accordingly, all networks must be secure.
        This hearing is timely, with actions being taken not only by
    Congress, but also by the FCC and an Executive Order from the
    President. While the challenge is significant, and the legislative and
    regulatory policy directions are unprecedented, I have confidence that
    appropriate policies from the Federal Government will provide all
    carriers with the guidance and certainty they need to secure
    telecommunications networks. Through cooperative efforts and flexible
    policies, and funds for replacement, the removal of covered networks
    elements, where necessary, can be achieved. Such action will support
    new technologies and innovations while allowing market forces to
    advance secure services and make the latest wireless technology
    available for all carriers, whether they serve customer bases that are
    rural, regional, or nationwide.
    All Carriers Must have Clear Guidance from the Federal Government
            Regarding Security
        As a foundational step, all carriers must have the information and
    guidance from the Federal Government to confidently make decisions to
    secure their networks. With respect to the need for clarity, I
    appreciate the clear message sent by Congress through the Secure and
    Trusted Communications Networks Act regarding what network equipment is
    deemed to be insecure and must be removed from existing networks. This
    clarity is particularly important for smaller carriers that may not
    have dedicated staff focused exclusively on security issues or may not
    have the necessary clearances to engage directly with the intelligence
    community regarding potential threats.
        I strongly encourage the Federal Government to continue to provide
    clear, unambiguous directions regarding the national security needs for
    communications networks so that government and industry can define a
    clear pathway for enhanced security and allocate resources to sustain
    these priorities. Such efforts help improve the security hygiene across
    the entire telecommunications industry, for small carriers and
    nationwide providers alike. Provisions in the Secure and Trusted
    Communications Networks Act that facilitate information sharing,
    specifically for smaller providers, will help advance this goal.
        CCA has taken several steps to ensure that our members have access
    to the information they need to make confident decisions regarding
    potentially sensitive issues. For example, nearly a year ago
    approximately three dozen CCA members, including members with and
    without covered equipment, participated in a bipartisan, classified
    briefing on wireless security issues with the U.S. Senate Select
    Committee on Intelligence. I would like to thank Senators Warner and
    Rubio for hosting CCA members and key leaders from the Intelligence
    community to ensure that all carriers are provided with the information
    they need to make decisions to provide secure telecommunications
    services to their customers.
        I am also very pleased that we were able to continue our
    educational effort by partnering last year with the U.S. Chamber of
    Commerce to conduct three Rural Engagement Initiative sessions. At
    these events we brought together numerous stakeholders, including
    representatives from Tier II and Tier III carriers serving rural areas,
    security experts from leading American and international vendors and
    suppliers, and key senior government officials from the Department of
    Homeland Security, Department of Justice, Federal Communications
    Commission, and Department of Commerce together in three different
    locations--Denver, CO, Jackson, MS, and Chicago, IL--to have frank
    discussions regarding current threats, potential solutions, and the
    roadmap for network operations in the years ahead. These conversations
    allowed both government and industry to gain a better sense of the
    strategic threats, and a clearer understanding that there is no one-
    size-fits-all solution to mitigating these threats. I truly appreciate
    our partnership with the U.S. Chamber of Commerce on this effort to
    bring critical information to all carriers. I also would like to
    particularly thank the Department of Homeland Security's Cybersecurity
    and Infrastructure Security Agency (``CISA'') for taking a lead role on
    behalf of the United States Government in these sessions, which brought
    tremendous value to competitive carriers and facilitated the direct
    flow of information between government and industry stakeholders.
    Building upon these conversations, I look forward to welcoming CISA as
    a keynote speaker at CCA's upcoming Mobile Carriers Show later this
    month.
    Congress has Provided Clear Authority and Established a Fund to Secure
            Existing Networks
        The Secure and Trusted Communications Networks Act not only
    provides clarity regarding what elements must be removed from existing
    networks, it importantly creates a fund to facilitate replacement for
    smaller carriers serving rural areas. I completely agree with your
    remarks, Chairman Wicker, on the Senate floor late last year that
    ``some things are worth paying for, and protecting America, protecting
    our electronic system, our broadband communications. . .is worth paying
    for.''
        I am encouraged that this sentiment shares bipartisan support not
    only in Congress but also at the FCC. As FCC Commissioner Geoffrey
    Starks noted last fall at CCA's Annual Convention, ``This is a national
    problem that deserves a national solution, and we shouldn't expect
    small carriers--who acted legally and in good faith--to replace their
    insecure equipment on their own.'' Recent Congressional action will
    provide needed resources for the replacement of covered equipment, an
    important step that is particularly needed for carriers who are unable
    to cover the costs of replacement without financial assistance from the
    Federal Government.
        As the new fund is established and administered by the FCC, I am
    hopeful that resources will be available so that carriers can move
    expeditiously to replace covered network elements. This means that
    after a carrier with covered equipment has established a clear plan for
    replacement and removal of networks elements, they will have access to
    funding both as the process begins as well as at specified benchmarks
    throughout the process. Such access to needed resources recognizes that
    networks that were not initially economical to construct absent support
    mechanisms are unlikely to be able to finance the project management
    process without resources available long before certification that
    covered elements have been completely removed. Additionally, as the
    removal process moves forward, policymakers should allow for carriers
    to triage their networks and focus on the most significant
    vulnerabilities first. Specifically, policymakers should consider
    prioritizing replacement of core network and routing elements first,
    and radio and edge network elements thereafter, in recognition of using
    available resources to prioritize the highest potential threats.
        While the legislation that recently passed establishes a swift one-
    year timeframe, I appreciate the inclusion of a waiver process to
    ensure that carriers that are unable to complete changes to their
    networks in such a rapid fashion remain eligible for support. Several
    factors, including available spectrum resources, equipment
    availability, limited windows to build in certain harsh geographic
    areas, permitting processes, the need for testing and configuration of
    new equipment, and even the availability of a properly trained
    workforce will all impact the time necessary for each impacted carrier
    to complete the transition process.
        Going forward, I would be remiss not to mention concerns from our
    carrier members that reverse auction procedures used to distribute
    support for providing service in rural areas can lead to a race-to-the-
    bottom where low costs are prioritized above all else. Several carriers
    that have covered equipment in their networks today made vendor
    selections a decade ago in order to meet the reverse auction structure
    of Mobility Fund Phase I, where winning auction bids were those that
    had the lowest cost to serve the greatest number of road-miles. Despite
    there being no prohibited vendor selections at the time, it is now
    clear that this mechanism led to undesirable consequences for several
    carriers. While the FCC now has rules in place prohibiting using USF
    support for specific vendors going forward, security priorities should
    be appropriately funded so that other unintended consequences of
    funding least-cost networks can be avoided in the future. All funding
    recipients must be good stewards of taxpayer funds, but we should not
    simply fund the cheapest possible networks at the expense of all other
    priorities. There should be some mechanism in the funding process that
    recognizes and rewards resiliency and security enhancements,
    prioritizing providing reliable and secure connectivity for consumers.
    Replacing Covered Network Elements Must Precede Decommissioning to
            Maintain Connectivity
        With clear guidance regarding network elements that pose security
    threats and a newly established fund available to replace them,
    carriers are eager to begin the work to transition their networks and
    continue to move forward to best serve their customers. To ensure that
    Americans in rural areas do not lose connectivity during this process,
    including to voice connectivity and 9-1-1 emergency services, important
    safeguards must be in place.
        While those inside the beltway often refer to the process as ``rip
    and replace,'' in practice carriers will typically need to ``replace,
    then rip'' to ensure that the consumers served by rural carriers do not
    lose service. This is a significant challenge for carriers, as a
    separate, standalone network must be established and stood up alongside
    current services before carriers can transition traffic to the new
    equipment and then decommission the covered elements. Networks in
    operation today have been built over years or even decades, and such a
    significant rebuilding will be all encompassing, including not only
    funding but also technical and logistical resources. Further, each
    carrier's network is unique, and accordingly there is not one plan or
    solution that can be followed by all carriers in this situation.
    Individual carriers' plans may be particularly challenging based on any
    given carriers' spectrum portfolio, which will need to support both new
    and legacy networks during the transition process, as well as the
    carrier's access to backhaul and other network characteristics. Again,
    only a few CCA carrier members have covered equipment in their
    networks, but all carriers understand the collective impact on their
    colleagues, and recognize that successfully addressing this challenge
    now will help everyone as we move to 5G.
        Additionally, some covered equipment is outdated technology that is
    no longer manufactured or supported for new construction by any vendor.
    Equipment manufacturers generally are no longer making 2G and 3G
    equipment, and it would make little sense for any carrier to deploy a
    2G or 3G network today. Accordingly, while the Secure and Trusted
    Communications Networks Fund should not create a windfall, resources
    should be available for carriers to provide like-for-like services that
    leave carriers more prepared at the end of the transition process to
    utilize other resources to upgrade networks to the latest generation of
    services in the future. For example, if a network with covered elements
    supports 2G and 3G CDMA voice products, the replacement should also
    support voice services, even if this means an enhancement in the
    network to support VoLTE voice services that could subsequently be
    upgraded as the carrier deploys 5G. This approach will ensure that the
    transition process does not leave a rural area stranded on legacy
    technologies while the rest of the industry advances. That is not a
    windfall but a reality reflecting the state of today's technology.
    New Technologies can Help Secure Networks; Mandates should not Stifle
            Innovation
        Removing covered network elements, as supported by the Secure and
    Trusted Communications Networks Act, is a critical step to secure
    today's networks, and several concepts included in the Act will also
    help secure the 5G networks of the future. For example, the Act
    requires the FCC to ``develop of list of suggested replacements of both
    physical and virtual communications equipment, application and
    management software, and services or categories of replacements of both
    physical and virtual communications equipment, application and
    management software, and services.'' Applied in a neutral fashion, this
    list can provide guidance to all carriers regarding secure equipment
    options for current and future network deployments, including end-to-
    end equipment used by most carriers today as well as increasingly
    virtualized and open source equipment and services.
        As 5G wireless services provide increased potential to transfer
    network services from physical equipment to software, new technologies
    are increasingly coming to the market, including Open Radio Access
    Network (``ORAN'') equipment. ORAN presents exciting new opportunities,
    with the potential to disaggregate functionality to increase efficiency
    and reduce costs. I encourage further research and development to
    explore virtualized solutions. ORAN may provide opportunities to
    increase security by breaking down the network stack and allowing
    multiple vendors to provide off-the-shelf components and services that
    when working together appropriately provide unified services. The
    potential for introducing American vendors into the ecosystem has
    tremendous benefits, but each layer must be sufficiently vetted for
    security. Particularly in greenfield network builds, ORAN can provide
    opportunities for new network designs that do not need to be integrated
    to legacy networks. For example, DISH, a CCA member, has announced
    plans to start deploying its standalone ORAN 5G network this year in
    the United States.
        However, policymakers should not mandate which technologies are
    used in wireless networks, but instead should encourage research into
    new, secure technologies to enhance customer choice, innovation, and
    cost savings. For carriers with existing network infrastructure,
    additional research may facilitate increased ORAN deployment as well,
    and it is important that all network operators are positioned to manage
    additional steps for interoperability across multiple vendors. Absent a
    secure deployment approach, the increased number of access points that
    can present opportunities for additional vendors can expose additional
    entry points for bad actors. While ORAN equipment may be designed for
    network efficiencies, these technologies are not necessarily designed
    with the specific goal of enhancing security.
        If new technologies like ORAN are successful, they will compete
    successfully in the marketplace. We must be mindful, however, that
    mandating using specific technology could require additional time for
    carriers seeking to replace covered elements from their networks,
    presenting a question of competing goals for policymakers. Smaller
    providers often rely on one or a small number of equipment providers
    for end-to-end services and do not have regular access to expansive
    test beds to vet all network elements. Carriers will continue to rely
    on existing trusted vendors, and may not be prepared for
    interoperability and system integration costs involved with multiple
    providers. They can ill afford to discover errors after deployment and
    operations are turned up to provide service and may have additional
    burdens to determine the cause of an error if there is a service
    outage. Further, smaller carriers depend on shared economies of scale
    for equipment with their larger competitors and are not in a position
    to drive the ecosystem. As previous technologies have been deployed at
    scale, smaller carriers can obtain economical access after deployment
    by larger carriers. Some smaller competitive carriers have also
    expressed concerns that an exclusive focus on new technologies that are
    not yet fully standardized or vetted could risk cannibalizing existing,
    trusted equipment providers.
        As we seek to advance technologies and innovate, policymakers must
    ensure that the United States telecommunications industry does not lose
    access to trusted suppliers in the pursuit of potential new and
    exciting technologies of the future.
        Additionally, I applaud inclusion in the legislation the creation
    of an information sharing program, led by the National
    Telecommunications and Information Administration and in cooperation
    with several other leading agencies, to share information regarding
    supply chain security risks with trusted communications providers and
    suppliers. This program can help ensure that all stakeholders have the
    information they need to continue to make decisions to secure networks
    into the future.
                                   * * * * *
        In closing, I would like to again congratulate this Committee for
    its leadership in passing the Secure and Trusted Communications
    Networks Act. As it is implemented, CCA is committed to working with
    Congress, the Administration, and all stakeholders to accomplish the
    unprecedented task of removing certain equipment out of
    telecommunications networks and ensuring network operations proceed
    using trusted vendors, all while maintaining communications services
    for millions of Americans in rural areas. Building upon these efforts
    to secure existing networks, we also have an opportunity to ensure that
    security is a pillar of 5G networks as they expand throughout our
    Nation.
        Thank you for the opportunity to testify at this important hearing,
    and I welcome any questions.

        The Chairman. Thank you very much, Mr. Berry.
        Mr. Boswell.

       STATEMENT OF JASON S. BOSWELL, HEAD OF SECURITY, NETWORK
               PRODUCT SOLUTIONS, ERICSSON NORTH AMERICA

        Mr. Boswell. Thank you. Chairman Wicker, Ranking Member
    Cantwell, members of the Committee, thank you for the
    opportunity to appear today on behalf of Ericsson.
        I'm Jason Boswell, Ericsson's Head of Security for Network
    Product Solutions in North America. Since my early days as an
    engineer, I've spent my whole career focused on security and
    advanced telecommunications, and I'm pleased to provide
    Ericsson's perspective on 5G supply chain security.
        Let me start by commending the recent passage of Chairman
    Wicker's bipartisan security legislation, The Secure and
    Trusted Communications Networks Act.
        We stand ready to assist small carriers replacing equipment
    from untrusted vendors. The U.S. led the way on 4G and reaped
    the economic benefits, $475 billion to GDP and four million
    U.S. jobs. 5G will accelerate innovation and deliver even more
    transformative benefits to consumers and businesses alike with
    the potential to bring $500 billion to the U.S. economy and
    three million new U.S. jobs.
        But this also brings new security challenges due in part to
    the increased potential attacks surface. We need networks that
    are trustworthy, resilient, and secure by design, enabled by a
    robust market of trusted suppliers, not just in the United
    States but worldwide.
        Ericsson is leading the way on secure 5G, supporting 65
    percent of the 5G deployments across the U.S., including in
    rural America. We have customers in over 180 countries, and I'm
    proud to say that the U.S. is our largest market, accounting
    for 30 percent of our global revenue and driving our R&D
    priorities.
        Ericsson has a longstanding and expanding commitment here.
    Our North American headquarters is in Plano, Texas, and we
    currently have over 7,000 employees in the U.S. We also have a
    tower technician training facility in Texas and we will soon
    open our $100 million 5G Smart Factory right here in the U.S.
        In fact, in some breaking news, this just came in this
    morning, today we announced our first 5G equipment rolling out
    from that factory manufactured right there in Lewisville,
    Texas.
        Security is intertwined with the successful deployment of
    5G networks and three key priorities will enable this 5G
    rollout. First, we need increased mid-band spectrum
    availability and we commend the FCC for allocating some mid-
    band spectrum for 5G. It is a good start but more is needed.
        Second, we need streamlined rules for small cell siting as
    provided in Senators Thune and Schatz's STREAMLINE Act.
        And third, we need to focus on developing a skilled 5G
    workforce. Senators Gardner and Sinema's Tower Infrastructure
    Deployment Act and Senators Thune, Tester, Moran, Peters, and
    Wicker's Telecommunications Skilled Workforce Act would do just
    that.
        Security is a top priority for Ericsson and our actions
    reflect our philosophy, both internally and externally.
        First, since 2018, we have been executing a supply chain
    regionalization strategy to place manufacturing and development
    as close to the customer as possible in order to reduce risks,
    regional disruptions, and dependence on one supply site or
    vendor, and in all of our manufacturing and software
    development, Ericsson secures our own supply chain with
    integrity checks, site audits, sign-in and sign-out for all
    software development, and cryptographic signing of hardware and
    software that helps provide routes of trust for all of our
    portfolio.
        Second, we take a holistic approach to building security
    into our systems from the start. Our own security and
    reliability model guides security assurance across all of our
    products and helps inform standards development.
        Third, we lead industry-wide endeavors to advance security
    across the whole 5G ecosystem, not just Ericsson products. This
    involves our standards activities and also the development of
    best practices for 5G security. We are active on the DHS Supply
    Chain Risk Management Task Force where I co-chair a working
    group on developing the standardized template for supply chain
    evaluation to minimize risk in the purchasing process.
        I'm also a member of the FCC's Security Advisory Committee.
    I am on a working group focused on managing security risk in
    the transition to 5G.
        We need to sustain a secure and robust marketplace of
    trusted suppliers in the U.S. and globally. To do so, it is
    important to continue to pass 5G security legislation, such as
    the thoughtful bill pending from Senators Cornyn, Sullivan,
    Blackburn, and others, and keep holding hearings like this one
    to highlight what industry and government agencies are doing to
    ensure a secure 5G ecosystem.
        Shining light on these efforts will make them even more
    effective and allow the U.S. to set the global example for 5G
    security.
        On behalf of Ericsson, I thank the Committee for its
    leadership. We look forward to working with you and I look
    forward to your questions.
        [The prepared statement of Mr. Boswell follows:]

       Prepared Statement of Jason S. Boswell, Head of Security, Network
                   Product Solutions, Ericsson North America
        Chairman Wicker, Ranking Member Cantwell, and Members of the
    Committee, thank you for the opportunity to appear today on behalf of
    Ericsson and to share our views on the important subject of supply
    chain security in the 5G world. Ericsson commends the Committee for its
    focus on these important issues, and we welcome the recent passage of
    Chairman Wicker's bipartisan Secure and Trusted Communications Networks
    Act. As Head of Security for Network Product Solutions in Ericsson
    North America, I advise Ericsson's technicians, engineers, partners,
    and customers on creating and maintaining secure Ericsson solutions
    across the country. I also represent Ericsson in numerous industry
    initiatives and collaborative efforts with government to develop and
    implement industry-wide practices and policies to make the 5G supply
    chain trustworthy, resilient, and secure. Since my early days as an
    engineer more than 20 years ago, I have spent the entirety of my career
    focused on security and advanced telecommunications. I am pleased to be
    able to describe Ericsson's perspective on the important topic of
    securing 5G and its supply chain.
    I. Introduction
        A Pivotal Moment for 5G. 5G will accelerate innovation, enhance
    productivity, and make our lives better through transformative use
    cases in manufacturing, telemedicine, agriculture, connected cars,
    smart cities, and the Internet of Things, to name a few, plus a host of
    applications and services that are still to come. 5G will deliver
    significant benefits to consumers and business alike.
        But this innovation brings new security challenges for the mobile
    ecosystem as well, with broader attack surfaces, more devices, and
    greater traffic. The United States is expected to account for 50
    percent of the data breached or compromised across the globe by 2023--
    we will be the lead target for cyberattacks. This is a clear call to
    action for the U.S. We need networks that are trustworthy, resilient,
    and secure by design--all on day one.
        In short, as we embark on the 5G future and usher in the next
    decade of telecommunications, we face a series of critical decisions,
    and we have an opportunity for the U.S. to set a global example in 5G
    network security across policy, technology, and standards. Whether we
    live up to this moment will depend on how industry and government
    together answer these questions:

       Will 5G be innovative and dynamic?

       Will 5G be secure and reliable?

       Will 5G support the rule of law and enable fair competition
            and the robust marketplace necessary to protect national
            security?

        I believe that with intentionality and foresight, the United States
    will provide an emphatic ``yes'' in response to each of these
    questions. This morning, I will share Ericsson's perspective on key
    priorities and key action items that will help guide us through this
    moment.
        Ericsson: Who We Are and What We Do. At Ericsson, we long ago
    embraced the idea of making communications available for everyone, and
    we have aggressively executed on that vision ever since. Today, we
    serve customers in the United States and more than 180 other countries.
        Ericsson is a global 5G leader. To highlight just a few
    accomplishments:

       We were the first supplier with commercial 5G live networks
            in four continents, and currently we support twenty-four live
            5G networks in fourteen countries.

       We now support the widest ecosystem of supported devices on
            5G live networks, with over forty.

       In every nation state that has conducted a national security
            5G assessment, Ericsson has been designated as both a secure
            and trusted 5G supplier.

       Since 2015, we have delivered more than five million 5G-
            ready radio units world-wide, which only need a remote software
            update to launch 5G; hypothetically, this number of radios
            corresponds to covering the entire U.S. and Europe with 5G.

       We led the way on 5G standards, with the highest share of 5G
            essential patent declarations--15.8 percent--of any
            organization in the world. And more broadly, we have one of the
            industry's strongest intellectual property portfolios, which
            includes more than 54,000 granted patents worldwide. Ericsson
            is the largest holder of standard essential patents for mobile
            communication. Our unrivalled patent portfolio covers 2G, 3G,
            and 4G, and we are the main driver of industry standardization
            for 5G.

        Our primary headquarters is in Sweden--a country with which the
    U.S. has a longstanding defense cooperation--but we have key
    development operations, as well as product, verification, and release
    activities, in North America. The United States is our largest market,
    and Ericsson has a longstanding and expanding commitment to the U.S.
    Our presence in the U.S. dates back nearly 120 years. Ericsson now has
    over 7,000 employees working in the U.S., and our North America
    headquarters is located in Plano, Texas. And, we are actively expanding
    our investment in U.S. manufacturing and U.S. jobs. Of note, we are
    opening our first 5G smart factory in the United States, in Lewisville,
    Texas. This facility will be a connected smart factory, producing
    Advanced Antenna System radios to enable rapid 5G deployments. In
    addition, our Lewisville, Texas Center of Excellence (CoE) is an
    enhanced tower technician training facility that provides best-in-class
    field services training and support for Ericsson's employees and
    partners. In 2019, 847 tower tech trainees completed training at the
    Lewisville CoE.
        Over the last two years, Ericsson has had other investments and
    achievements in the United States, including:

       Producing the first 5G radios in the U.S. in 2018, with a
            production partner in St. Petersburg, Florida;

       Supporting 65 percent of the 5G deployments across the
            United States, including efforts to close the digital divide in
            rural America;

       Opening a 5G ASIC Design Center in Austin, Texas, to help
            accelerate 5G product development; and

       Creating a new innovation hub at Ericsson's Silicon Valley
            facility in Santa Clara, California to enable our industry
            partners and customers to accelerate adoption of advances in
            artificial intelligence (AI) and machine learning.

        Apart from its direct investments in the U.S., Ericsson serves a
    broad and diverse U.S. customer base, which includes nationwide and
    regional communication service providers serving both rural and urban
    markets with all technologies (wireline and wireless
    telecommunications, cable, and satellite). We have partnerships and
    collaborations with rural Wireless Internet Service Providers (WISPs)
    and carriers--such as GCI Communications, Cellcom, Bluegrass Cellular,
    and many more--in furtherance of our commitment to bring 5G to rural
    areas. Ericsson also maintains strategic partnerships with NVIDIA,
    Intel, Qualcomm, Juniper, and many other U.S. companies. In fact,
    Ericsson's global sourcing of active components for Ericsson's 5G radio
    base stations relies up to 90 percent on U.S. technology suppliers.
    Finally, we participate in more than 100 industry organizations,
    standards bodies, and other technology alliance groups.
        As discussed further below, Ericsson employs a holistic approach to
    ensuring the security of its supply chain and its products, which is
    made more effective by an environment here in the U.S. consisting of
    pro-deployment public policies and 5G investment, combined with
    industry-led collaboration with government for a secure 5G ecosystem.
    II. Ericsson's View of the Priorities That Enable a Successful and
            Secure 5G Rollout
        Security is inextricably tied to the successful development of 5G
    networks--without one, you simply do not have the other. Before
    explaining Ericsson's approach to assuring 5G supply chain security,
    let me identify three key priorities for enabling a successful and
    secure 5G rollout.
        Accelerating 5G deployment in North America. The United States
    enjoyed first mover advantage in the 4G world, and it can win the 5G
    pole position as well. Indeed, the North American market is large
    enough to lead the world market, setting the global agenda for
    innovation and security and market competition. Conversely, any delay
    in 5G advancement policies could allow other actors that may pose
    national security risks to gain the first-mover advantage in the 5G
    investment cycle and set technology standards for global companies to
    adopt. In short, being first in 5G deployment is not merely an
    honorarium--it is a meaningful step toward a secure 5G ecosystem.
        As Ericsson has advocated, and as the members of this Committee
    have advanced, Congress can accelerate 5G deployment in the U.S. by
    taking the following near-term actions:

       Increase spectrum availability, especially mid-band;

       Put in place reasonable, streamlined small cell siting
            rules;

       Develop and deploy a skilled tower workforce; and

       Ensure effective incentives to encourage 5G deployment in
            rural areas.

        Below, I identify several measures before the Senate that can help
    accomplish these objectives.
        Strengthening and ensuring the long-term viability of a
    competitive, dynamic, diverse, robust global market of trusted and
    secure suppliers. Over the past two decades, the global market of
    wireless communications equipment suppliers has seen significant
    consolidation, but today there are a number of suppliers of 5G radio
    access network equipment in addition to Ericsson. Additional suppliers,
    including U.S. companies, provide different elements of core network
    equipment, and evolving innovations in open and interoperable
    networking and virtualization will allow new participants to compete
    with established global suppliers. In short, even with bans on Chinese
    vendors, the 5G ecosystem presently is diverse and competitive--
    attributes that are imperative not only for ever-advancing innovation
    but also to ensure security and resiliency throughout global networks.
        A key strategic goal for public policy aimed at a secure and
    trusted 5G supply chain is to maintain a global, competitive, diverse
    market of trusted suppliers. Network security is a global issue, not
    just a domestic one, and security on a global level only reinforces and
    enhances security here at home. We should therefore continue to
    encourage the adoption, without delay, of principles and guidelines
    favoring trusted suppliers and supply chains--on a global basis. We all
    have a mutual interest in such a competitive market--suppliers and
    service providers alike. And we agree with the principles that security
    and trust are two independent factors that need to be assessed to
    protect 5G networks. These principles are key to establishing an end-
    to-end view of risk across the multiple layers of telecommunications
    infrastructure.
        Supporting the important, ongoing work of standards processes and
    government-industry coordination. Ericsson is a leading participant in
    developing the standards for 5G security through the global 3rd
    Generation Partnership Project (3GPP), and we are engaged in an effort
    through the Alliance for Telecommunications Industry Solutions (ATIS),
    supported by the Department of Defense, to develop standards for
    securing the 5G supply chain. These technical standards are crucial for
    security because they give all suppliers and carriers a common--and
    open and transparent--technical understanding of interoperability and
    security. This allows for vetting and identification and correction of
    technical vulnerabilities. To be clear, 5G security standards and 5G
    supply chain standards are presently still under development, and
    Ericsson is helping shape them for long-term security.
        Once industry adopts standards, the next crucial step is effective
    network configuration and deployment. Here, I need to emphasize how 5G
    is different from previous generations of wireless communications.
    Unlike the steps from 1G to 2G to 3G to 4G, each of which constituted
    advances in both capability and security, 5G is a totally new and
    different technology and network architecture. When fully deployed, 5G
    will be ``virtualized'' across a service based architecture (SBA)--
    meaning that the core network functions will happen through a cloud-
    based and ``software defined'' network, which allow tailored security
    solutions for each different network function, also known as a network
    ``slice.'' Virtualized networking will allow for unprecedented
    capabilities for specialization in security for different isolated
    functions--for instance, separating mission-critical network instances
    such as connected medical devices from less critical devices and
    functions. These new architectures and technologies will also allow for
    more discrete control of access to data, topology obfuscation between
    network segments, greater requirements on inter-element encryption,
    provisions for extended authentication, enhanced privacy protections
    for subscribers, and many other new capabilities. Individual
    configurations in real-world deployments will be different in every
    case, but in all cases they should be based on the rigorous, open, and
    interoperable standards that Ericsson is helping develop now.
        We believe the role of the government in advancing the security of
    these deployments is to continue to put its attention and resources
    behind the robust government-industry collaboration efforts that are
    presently underway. In short, we must work together effectively and
    efficiently to ensure that these deployments are secure, as described
    below.
    III. Ericsson's Activities and Leadership That Advance These Priorities
        Security is a top priority for Ericsson, and our actions on
    security reflect our philosophy: Networks must, from the very start, be
    trustworthy, resilient, and secure by design.
        How does Ericsson ensure a secure supply chain? In all of our
    manufacturing and software development facilities globally, Ericsson
    relies on tight quality controls, traceability and integrity checks,
    regular site audits, tests, and verifications to ensure compliance with
    our own security standards and appropriate industry specification
    guidelines. All of Ericsson's software is verified, cryptographically
    signed, and distributed centrally from Sweden, and, when so required,
    under Swedish export licenses. We have strict software version controls
    with check-in/check-out security, meaning that both the Ericsson
    employee who wrote the code and the individual who reviewed/accepted
    the changes are logged. Binaries are provided via secure download from
    the Ericsson Software Gateway in Sweden, including a signature which
    provides a trust anchor that ensures the software originated from
    Ericsson and has not been tampered with in transit.
        Where are Ericsson products developed and manufactured? Ericsson
    has a global, flexible, high-integrity supply chain, with manufacturing
    established in several countries around the world--including a sizeable
    presence in the U.S., as I described above. Since 2018, we have been
    proactively executing a regionalization strategy for our supply chain,
    to place manufacturing and development as close to the customer market
    as possible in order to mitigate potential risks or regional
    disruptions and reduce dependence on one supply site or vendor. In
    general, all active ``intelligent'' 3PP electronics (e.g., digital
    semiconductors, silicon-based technology, application-specific
    integrated circuits (ASICs), field programmable gate arrays (FPGAs),
    etc.) for the Ericsson Radio System (ERS) are predominantly sourced
    from U.S. companies, with a minor part from Japanese, Korean, and
    European companies.
        How does Ericsson provide security assurance? Ericsson takes a
    holistic approach to ensure that security is built in from the start,
    across supply chain, software and hardware development, testing,
    implementation, and operation. For many years, Ericsson has worked
    systematically to incorporate security from the start (security by
    design) into all phases of product development, and we have a well-
    established internal governance framework for product security. This
    framework is how Ericsson is able to consistently deliver on our
    product security commitment. The framework's key characteristics
    include:

       Defining our product security and privacy ambition level;

       Ensuring the implementation of appropriate security and
            privacy;

       Following up and measuring actual product security and
            privacy status; and

       Enabling professional security services, such as security
            and privacy training recommendations, solution level
            integration guidance, and potential hardening activities that
            need to be included in customer delivery projects.

        In addition, all personnel and suppliers follow Ericsson's Code of
    Conduct and Code of Business Ethics. Ericsson places top priority on
    protecting our customers' networks and their customers' data, as well
    as our intellectual property, all of which are governed under internal
    policies, and certified by ISO/IEC 27001 and ISO 9001, which are
    recognized as international guidelines on Information Security
    Management and requirements for Quality Management Systems,
    respectively.
        Finally, we strongly believe in the principles of responsible
    vulnerability disclosure towards all parties involved. Accordingly, the
    Ericsson PSIRT (Product Security Incident Response Team) is responsible
    for our product vulnerability management process, coordination of
    customer product security incidents, and reported security issues
    affecting Ericsson products, solutions, and services.
        How does Ericsson promote and advise on industry-wide best
    practices in 5G and supply chain security? Our security efforts do not
    end with our products--Ericsson actively contributes to a number of
    U.S.-based industry initiatives organized around ensuring supply chain
    security. These include the Communications Sector Coordinating Council
    (CSCC) and its Cybersecurity Committee (where I participate directly as
    a member), the Council to Secure the Digital Economy (CSDE), and
    multiple working groups within the standard-setting organization ATIS.
        I also personally provide leadership in numerous government-
    industry initiatives convened to promote collaboration on supply chain
    security. I will cite three examples here, which are especially
    relevant to this discussion.
        First, it has been my privilege to participate in the
    groundbreaking work of the Department of Homeland Security (DHS)
    Information and Communications Technology (ICT) Supply Chain Risk
    Management Task Force. The DHS ICT Supply Chain Risk Management Task
    Force exemplifies how industry and government collaboration can quickly
    and effectively deliver useful, sharable, expert-driven guidance in
    complex areas like supply chain and 5G security. The Task Force
    represents a formal, action-oriented collaboration between industry and
    government that ties together various streams of activity. For example,
    in September 2019, the Task Force released an interim report with
    findings and recommendations from working groups that focused on:

       The timely sharing of actionable information about supply
            chain risks across the community (WG1);

       The understanding and evaluation of supply chain threats
            (WG2);

       The identification of criteria, processes and structures for
            establishing Qualified Bidder Lists (QBL) and Qualified
            Manufacturer Lists (QML) (WG3); and

       Policy recommendations for incentivizing the purchase of ICT
            from original equipment manufacturers and authorized resellers
            only (WG4).

        In 2020, I will continue Ericsson's work in the Task Force Threat
    Evaluation Working Group (WG2) by analyzing mitigations and risk
    determination across multiple areas of the supply chain and making
    recommendations on best practices and methodologies. I will also be co-
    chairing a new working group (2020 WG4) to develop attestation
    frameworks around various aspects of supply chain risk management. This
    will help make requirements such as the NIST security standards and
    other risk guidelines more understandable, predictable, and useful, and
    also will address gaps in risk management or visibility by providing a
    flexible template that can help guide planning and assessments and
    provide clarity for acquisition reporting and vetting processes.
        Second, I participate in the important work of the President's
    National Security Telecommunication Advisory Council (NSTAC). In
    particular, I serve on a subcommittee tasked by the NSTAC with
    examining the security impact of software-defined networking (SDN) on
    the U.S. government's National Security and Emergency Preparedness
    functions, identifying the challenges and opportunities provided by
    SDN, and assessing the use of SDN and other virtualization technologies
    in support of national security.
        Third, I represent Ericsson on the Communications Security,
    Reliability, and Interoperability Council (CSRIC), which makes security
    policy recommendations to the Federal Communications Commission (FCC).
    Ericsson is working across three working groups in the current
    iteration of CSRIC, CSRIC VII, notably:

       Managing Security Risk in the Transition to 5G (WG2), in
            which I am directly involved;

       Managing Security Risk in Emerging 5G Implementations (WG3);
            and

       911 Security Vulnerabilities during the IP Transition (WG4).

        Beyond these activities, we also work closely with other government
    departments and agencies, including the National Telecommunications and
    Information Administration (NTIA) and the National Institute of
    Standards and Technology (NIST), both within the Department of
    Commerce, as well as with the Departments of Defense and Energy.
        Standards work is another foundational component of good security
    assurance, as it supplies guidance and frameworks that ensure security
    and privacy requirements are met consistently. Ericsson has been a
    leading contributor in standards and frameworks groups such as 3GPP,
    ETSI, IETF, GSMA, IEEE, the O-RAN Alliance, the Open Network
    Foundation, and many more. As noted above, in total, Ericsson is a
    member of more than 100 industry organizations, standards bodies, and
    other technology alliance groups, as part of our mission to drive 5G
    forward.
    IV. Ericsson's Recommendations for the Committee to Support and Promote
            These Priorities
        At the beginning of my testimony, I listed three questions that
    mark this moment in the trajectory to 5G:

       Will 5G be innovative and dynamic?

       Will 5G be secure and reliable?

       Will 5G support the rule of law and enable fair competition
            and the robust marketplace necessary to protect national
            security?

        As noted above, I believe that with intentionality and foresight,
    the answer to these questions can be an emphatic ``yes.'' Now for the
    hard part: How do we get there?
        As a general matter, Ericsson urges the Committee to support the
    various efforts described above, with an eye toward ensuring that
    industry and government are coordinating efficiently and collaborating
    productively on 5G security and supply chain matters, both domestically
    and globally.
        More specifically, we recommend that the Committee take the
    following steps:

        (1) Pass, implement, and oversee 5G security legislation. As I
    noted at the outset, the Senate's recent passage of Chairman Wicker's
    Secure and Trusted Communications Networks Act represents a thoughtful
    and crucial step forward. We look forward to the President signing this
    bill and stand ready to work with the small operators who will have to
    replace existing equipment. As the Committee is well aware, further
    opportunities to build on the momentum of that legislation await, as
    several additional bipartisan 5G security-related bills have passed in
    the House of Representatives. These include the House companion bill to
    Senator Cornyn's Secure 5G and Beyond Act, co-sponsored by Senators
    Sullivan and Blackburn of this Committee and others, which would
    require the U.S. to develop a 5G security strategy. Passage of such
    measures in the Senate would help demonstrate the U.S. commitment to 5G
    security to countries around the world grappling with these issues.
        (2) Support actions to accelerate 5G deployment. As I discussed,
    Ericsson believes that accelerated U.S. 5G deployment will in turn
    protect the security of the 5G supply chain, a goal that can be
    achieved through (i) increasing spectrum availability, especially mid-
    band; (ii) putting in place reasonable, streamlined small cell siting
    rules; (iii) developing and deploying a skilled tower workforce; and
    (iv) ensuring effective incentives to encourage 5G deployment in rural
    areas. We commend the work being done in these areas and urge the
    Committee to take up proposals to advance 5G deployments in the U.S.,
    such as the STREAMLINE Act introduced by Senators Thune and Schatz,
    which would preempt certain state/local small cell deployment
    regulation; the TOWER Infrastructure Deployment Act introduced by
    Senators Gardner and Sinema, which would require the FCC to set up an
    Advisory Council to look at tower workforce issues; and the
    Telecommunications Skilled Workforce Act recently introduced by
    Senators Thune, Tester, Moran, Peters, and Wicker, which would require
    cooperation among various agency heads to develop recommendations and
    guidance that would empower the U.S. to catch up on the workforce
    demands of the 5G era.
        (3) Continue to enable a secure and robust marketplace of trusted
    suppliers in the U.S. and globally. As I have discussed, one of the key
    priorities for 5G is to strengthen and ensure the viability of a
    competitive, dynamic, diverse, and robust marketplace of trusted and
    secure suppliers on a global level, much like what we already have in
    the United States, recognizing that global and domestic security are
    intertwined. Such a marketplace, involving trusted and secure companies
    like Ericsson, can counter other potential players that may pose
    threats to national security. The Committee should remain attentive to
    factors that might promote--or undermine--the development of this
    global marketplace.
        (4) Continue to hold hearings on the subject of 5G security. In
    Ericsson's view, hearings such as this one provide an important vehicle
    for highlighting what industry is doing to ensure a secure 5G world--
    and for maintaining pressure on industry to stay true to its security
    commitments. Such hearings can have a similar motivating impact on
    government actors with security responsibility within their respective
    jurisdictions around the world. Shining additional light on all of
    these efforts will make them more effective in ensuring a secure supply
    chain.
                                     * * *
        On behalf of Ericsson, I thank the Committee for its leadership in
    this area. We look forward to continuing to work with you, other
    government actors, and our industry partners to ensure that the 5G
    world is a secure one. Thank you again for the opportunity to testify
    today, and I look forward to your questions.

        The Chairman. Thank you very much, Mr. Boswell.
        Ms. Keddy.

           STATEMENT OF ASHA KEDDY, CORPORATE VICE PRESIDENT

                  AND GENERAL MANAGER, NEXT GENERATION

                    AND STANDARDS, INTEL CORPORATION

        Ms. Keddy. Chairman Wicker, Ranking Member Cantwell, and
    members of the Committee, thank you for inviting me to speak
    about 5G and supply chain [off microphone comments] Intel
    Corporation.
        My responsibilities include our participation in industry
    standards and forums, including 3GPP, and driving the benefits
    of 5G to various other industries to fuel widespread
    innovation.
        Intel is a U.S. semiconductor manufacturer that employs
    more than a 100,000 people globally with more than half of
    those in the United States. Intel is the largest global
    semiconductor supplier with the vast majority for advanced
    manufacturing and R&D conducted in the U.S.
        It used to be Intel inside only in computers, PCs, and data
    centers, but now we are inside the network, as well. 5G runs on
    Intel. We are a leader in 5G and one of our roles is to supply
    high-volume and high-quality products to telecom equipment
    manufacturers, including Nokia and Ericsson.
        By 2021, we are expected to become the world's largest chip
    maker for 5G infrastructure. Intel takes a leading role in 5G
    standards and industry groups, including 3GPP, IEEE, and ITU. I
    also represent Intel at CTIA's Board of Directors and Intel is
    a member of the ORAN Alliance and the new ATIS 5G Supply Chain
    Working Group.
        For today's discussion on 5G supply chains, I would like to
    begin by discussing current developments regarding 5G networks
    followed by our work to improve supply chain security and some
    policy recommendations.
        5G marks the convergence of communications and compute
    capabilities which will fundamentally change our world. The
    U.S. was the first nation with widespread 4G coverage which led
    to the American app economy. 5G will enable benefits to
    businesses in many sectors, such as industrial and IOT
    manufacturing, transportation, agriculture, and health care.
        Virtualization is critical to enabling the transition to
    5G. As a part of this evolution, some of the network functions
    are being virtualized rather than being served by a turnkey
    solution, creating what we call a virtual radio access network
    or VRAN.
        Intel's product line supports various 5G network approaches
    ranging from the traditional telecommunications equipment
    manufacturers, like Ericsson and Nokia, so that they can
    continue to develop products to ensure continuity in the
    telecom industry to also new VRAN entrants, such as Altiostar
    and Mavenir.
        We recognize that security challenges exist. Intel will
    continue our proactive efforts to build a more trusted
    foundation for all computing systems. Intel's unique position
    in the technology supply chain has allowed us to take a leading
    role when it comes to transparency and security in partnership
    with our suppliers and customers.
        We have already developed a set of policies and procedures
    at our own factories to validate where and when Intel-built
    components were manufactured.
        In today's complex supply chain for information and
    communications technology, Intel is working with manufacturers
    across the supply chain to help them offer customers better
    transparency and visibility into manufacturing, support, and
    retirement of computing devices. Intel calls this effort
    Compute Lifecycle Assurance.
        The industry needs an end-to-end framework like this
    initiative that can be applied to improve integrity,
    resilience, and security during the entire platform cycle.
        The U.S. Government also has a valuable role to play in the
    5G supply chain by encouraging and supporting the emergence of
    a vibrant and trusted U.S. ecosystem. Given the potential of 5G
    to provide valuable benefits to American businesses and
    consumers, the U.S. Government should take measures, including
    investments and incentives, to help facilitate widespread 5G
    deployments in the U.S. and to accelerate new technological
    innovation.
        Thank you for the opportunity to highlight Intel's role in
    this 5G ecosystem and our approach to supply chain security. I
    look forward to your questions.
        [The prepared statement of Ms. Keddy follows:]

    Prepared Statement of Aysha Keddy, Corporate Vice President and General
           Manager, Next Generation and Standards, Intel Corporation
        Chairman Wicker, Ranking Member Cantwell, and Members of the
    Committee, thank you for inviting Intel to speak about 5G supply chain
    security. I serve as Corporate Vice President in engineering,
    responsible for next generation technology and standards at Intel
    Corporation. In this role, I am responsible for future products
    including the convergence of communications, compute and artificial
    intelligence and defining the future networks towards 6G. My
    responsibilities also include Intel's contributions to industry
    standards and the company's leadership in global forums including IEEE,
    3GPP and multiple industry fora. It is my job to drive the benefits of
    5G to various other businesses by fueling innovation for homes, cities
    and enterprise.
        Intel Corporation is a U.S. semiconductor manufacturer
    headquartered in Santa Clara, California that employs over 100,000
    people globally, with more than half of those in the United States.
    Intel is the largest global semiconductor supplier, with the majority
    of our advanced manufacturing and research and development (R&D) is
    conducted in the United States. Revenue earned in global markets
    contributes to Intel's Annual R&D and Capital Investments of 29.6
    billion dollars.\1\ Intel is one of the last integrated device
    manufacturers (IDM) in the United States. This means Intel owns
    production for most of its products from conception, through design, to
    manufacturing, all the way to delivery to a device manufacturer. Having
    most of our design and fabrication within the same company creates
    significant technology advantages for Intel in setting the highest
    standards for quality, consistency and security. And when we identify
    problems, the IDM model creates advantages for Intel in resolving
    problems rapidly.
    ---------------------------------------------------------------------------
        \1\ Source: 2019 Q4 10K filing from Intel Corporation, https://
    www.intc.com/investor-relations/financials-and-filings/earnings-
    results/default.aspx
    ---------------------------------------------------------------------------
        Intel's processors, memory, storage and other products power much
    of the world's computing capability. Intel is a leader in 5G and one of
    our roles is to supply high volume and high-quality products to telecom
    equipment manufacturers. By 2021, we are expected to become the world's
    largest silicon provider for 5G infrastructure. 5G runs on Intel. It
    used to be Intel inside computers and data centers, but now Intel is
    inside the network as well.
        Intel also participates in over 250 standards and industry groups
    worldwide including industry alliances, regional standards
    organizations, international industry standards groups and formal
    international standards bodies. For 5G standards involvement, Intel
    holds leadership positions in 3GPP, IEEE, and the International
    Telecommunications Union. Intel is also a board member of the Telecom
    Infra Project and a member of the ORAN Alliance. Intel also
    participates in the new ATIS 5G Supply Chain Working Group tasked by
    the Department of Defense with developing standards and evaluating
    certification options necessary to establish ``assured'' commercial 5G
    networks.
        For today's discussion on 5G supply chains, I would like to begin
    by discussing some developments regarding 5G networks followed by some
    important considerations regarding supply chains.
    5G networks:
        5G marks the convergence of communications and compute
    capabilities, a world in which 5G, Wi-Fi, artificial intelligence, the
    cloud, and edge computing combine to fundamentally change our world.
    The U.S. was the first nation with widespread 4G coverage which led to
    many innovations that many of us use every day on our smartphones from
    ordering rides to groceries to take-out dinners to checking in for
    flights to reading books or watching shows. 5G will enable these types
    of benefits to businesses in many different industries such industrial
    IoT in manufacturing, mining, agriculture, healthcare, etc.
        Virtualization is critical to enable to transition to 5G. Radio
    Access Network (RAN) architectures are evolving to support a diverse
    set of deployments. As part of this evolution, some of the network
    functions are virtualized rather than being served by discrete
    products, creating what are called virtual Radio Access Networks. An
    analogy would be if you previously needed one computer to do
    presentations, another computer to browse the internet, another
    computer for e-mail, etc. but now you can do all those functions on a
    single computer. This way you can use the processing power on the
    application that needs it the most at a specific point in time.
        Network virtualization has been a ten-year journey across the
    communications industry, which started at the core of the network to
    service provider metro and neighborhood central offices--and now out to
    the RAN, the last link between users and the network (e.g., cell tower
    to end user). Network virtualization enables the agility of software-
    based innovation. Just as this approach enabled the dot com companies
    of the 90s to provide new services to consumers, software innovation
    including Virtual RANs are intended to enable a breadth of service
    opportunity in telecommunications.

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

        3GPP is developing a global 5G standard which will be implemented
    in networks worldwide. These networks will include traditional cellular
    operators as well as new entrants. Different services providers will
    take steps in network virtualization on varying timelines, so different
    options will exist ranging from the traditional telecommunications
    equipment manufacturer model to the different flavors of Virtual RAN.
    Open RAN, such as the work within the Open RAN Alliance, is one version
    of a Virtual RAN. The Open RAN Alliance is working to develop an
    interoperable specification with open interfaces between the base
    stations and the radio which enables cellular operators to utilize
    different vendors.
        Intel's product lines support the various approaches ranging from
    traditional telecom equipment manufacturers (e.g., Ericsson and Nokia),
    so they can continue to deliver products to ensure continuity in
    telecom industry, to new entrants (e.g., Altiostar and Mavenir) through
    our rich software development kit, open source activities and reference
    platform designs.
    Technology Supply Chains
        We recognize there are security challenges to overcome. Worldwide,
    policymakers have begun to focus on supply chain risks in new ways. In
    August 2018, MITRE published the highly influential report, Deliver
    Uncompromised, which described the urgency and importance for supply
    chain risks to receive attention during product procurement. New U.S.
    laws, including the 2018 SECURE Technology Act, gave Federal agencies
    new authority to consider supply chain risks when procuring products.
    From Europe's ``digital sovereignty'' efforts to Japan's ``Cyber/
    Physical Security Framework'' efforts, there are signs of strong
    interest in shining a spotlight on the trust and transparency of supply
    chains for information and communications technology.
        Intel will continue our proactive efforts to build a more trusted
    foundation for all computing systems. Intel's unique position in the
    technology supply chain has allowed us to take a leading role, in
    partnership with our suppliers and customers, when it comes to
    transparency and security. Intel's supply chain depends on successful,
    consistent, and trustworthy relationships with roughly 14,000 companies
    who provide Intel with the raw materials, products and services
    required for us to supply technology to over 2,100 customers. The
    collaboration and commitment occur across the supply chain--from
    Intel's suppliers, through Intel internal production, and outbound to
    Intel's customers.
        Intel identifies four key stages in the compute supply chain:
    build, transfer, operate and retire. Each stage includes unique
    threats. Examples of these threats include:
    Build
       Injection of malicious code, logic or components during
            design or manufacturing

       Cyber-attack against a supplier resulting in denial of
            service (DOS), supply chain disruption, data corruption, data
            breach
    Transfer
       Counterfeit for profit, sabotage, or other reason

       Interdiction and tampering during manufacturing or transit
    Operate
       Compromising administrator credentials

       Installation of vulnerable code or components
    Retire
       Theft of components/data from retired system

       Appropriate of residual data left on systems

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

    Compute Lifecycle Assurance
        Addressing the gap between trustworthiness and `leap of faith' is a
    primary motivation for a new Intel initiative designed to help increase
    data available to end user customers about the supply chain that brings
    computing devices to your doorstep. Intel describes the effort as
    ``Compute Lifecycle Assurance,'' and it starts with the goal of making
    supply chains more transparent.
        Intel has tackled big, complex problems like this before. We
    actively led and collaborated with the industry to influence policies
    and processes concerning the use of conflict-free minerals--not only
    for Intel products--but across the industry. In addition, we have
    already developed a set of policies and procedures at our own factories
    to validate where and when every component of a server was
    manufactured. These examples represent an important beginning, and
    there is more that can be done.
        In today's increasingly complex supply chain environment, we want
    to provide our customers with a full range of tools and solutions that
    deliver assurances of integrity throughout the entire lifetime of a
    platform. This starts with a security-first approach to design. It
    continues as platforms change custody, ownership and physical location
    several times during their assembly, transportation and provisioning.
    Once operational, they may then require updates for optimal performance
    and security. Finally, upon retirement from service, platforms should
    ensure the confidentiality of data that was transmitted, erased or
    stored.
        The industry needs an end-to-end framework that can be applied
    across this multiyear life of any platform. And that is our goal with
    the Compute Lifecycle Assurance Initiative--to substantially improve
    transparency and to provide higher levels of assurance that improve
    integrity, resilience and security during the entire platform
    lifecycle.
        Today Intel is working to:

       Invest in tools and processes that improve the integrity of
            Intel computing products across every lifecycle stage, building
            on the Transparent Supply Chain tools we have today.

       Contribute best practices, learned from our decades of
            experience, for the collection, measurement, stewardship and
            reporting of platform data to meet our customers' evolving
            needs.

       Collaborate with the ecosystem to develop innovative ways
            that enhance access to platform data while maintaining
            confidentiality of that data across the platform lifecycle.
    Policy Considerations
        The United States government has a valuable role to play in the 5G
    supply chain by encouraging and supporting the emergence of a vibrant
    and trusted ecosystem. Intel commends the work done in 2019 by the
    Department of Homeland Security's Supply Chain Risk Management task
    force and sees this type of public sector-industry collaboration as
    vital to identifying and solving important questions about technology
    supply chain. Likewise, the work done by the Commerce Department's
    National Institute of Standards and Technology (NIST), has been
    extremely helpful in creating common goals and frameworks for progress
    among policymakers and industry. Intel has been active in these and
    other efforts to offer its expertise and insight in addressing supply
    chain risks and mitigations.
        Given the potential of 5G to provide valuable benefits to American
    businesses and consumers, the United States government should take
    measures to help facilitate widespread 5G deployments. Intel has
    advocated extensively for mid-band spectrum. Mechanisms to encourage
    increased investments in 5G infrastructure and to facilitate continued
    innovation throughout the 5G ecosystem will be critical. We appreciate
    Congressional and Executive Branch interest in areas such as potential
    broadband infrastructure deployment funding,), and ways to spur
    innovation and deployments in 5G such as the USA Telecoms Act, which
    serves as a good starting point for further discussion.

        The Chairman. Thank you very much, Ms. Keddy.
        Mr. Murphy.

                     STATEMENT OF MICHAEL MURPHY,
              CHIEF TECHNOLOGY OFFICER, AMERICAS AT NOKIA

        Mr. Murphy. Chairman Wicker, Ranking Member Cantwell, and
    members of the Committee, on behalf of Nokia, thank you for the
    opportunity to testify today.
        First, a short introduction. Nokia's been the leader in
    every generation of wireline and wireless communications. We
    have 11,000 employees in North America, across 28 sites, with
    five innovation hubs, including Bell Labs, the recipient of
    nine Nobel Prizes. We are the sole telecom supplier on the
    Ethisphere Honoree List recognizing the most ethical companies
    in 2020.
        I'd like to address the FCC's decision requiring removal of
    equipment of certain vendors. Nokia completed 60 major swaps in
    the last 3 years, including the largest ever done, replacing
    75,000 base stations in Verizon and AT&T networks. We know
    swaps.
        Given the demand on crews for elevated 5G activity, rural
    customers might be challenged to complete their tasks in the 12
    months indicated in the Secure and Trusted Telecommunications
    Networks Act. As such, we recommend that usage of the 6-month
    extension or more be granted liberally.
        With respect to technology selection, we're at the
    confluence of 4G and 5G and thus many products now support both
    technologies. We believe rural carriers should be allowed to
    purchase those versus only like-for-like 4G systems. This would
    allow them to secure their networks and jumpstart 5G
    activities. The risk of gold-plating could be mitigated by
    employing like-for-like at the service level.
        Also, there is a Senate bill that proposes to restrict
    monies for replacement on a condition of ORAN Alliance
    certification within 7 years. However, fully compliant ORAN
    products are few and immature. Putting that burden on rural
    carriers, the least capable of being early adopters, is perhaps
    unreasonable and thus a technology-neutral approach might be
    more appropriate.
        Finally, there is some anxiety in this transition. However,
    the U.S. was the first country in the world to launch 5G
    networks, the first to utilize millimeter Wave, low-band
    frequencies, virtualized solutions, and more. These have been
    done by Nokia, Samsung, and Ericsson. So it is incorrect to
    suggest non-Chinese vendors cannot lead in the 5G or represent
    a reduction in capabilities.
        As for the 5G marketplace at large, it is challenging.
    China has made aggressive use of its Development Bank to
    support indigenous suppliers. Payment terms offered, while
    legal, are unavailable to competitors through commercial banks.
        The U.S. Export-Import Bank and the International
    Development Finance Corporation could potentially rebalance the
    situation. Also, the Chinese telecom market is massive,
    supporting significant R&D spend by domestic suppliers
    subsequently applied to foreign markets.
        R&D spending support in the U.S. through the National
    Spectrum Consortium, the U.S. Connect, and the Senate
    Intelligence Committee bill are excellent. However, more could
    be done to support 5G product development, local use cases, and
    especially 6G research.
        Finally, regarding 5G security, 5G will enable use cases
    supporting critical services across multiple industries. This
    makes the 5G attack surface larger than in 4G with the
    potential for catastrophic impacts should bad actors infiltrate
    networks.
        This was known during the creation of 5G and actions in
    3GPP standards have resolved many of the weaknesses in 4G.
    However, network breaches are still possible.
        Nokia does not support the view that either product or
    geographic isolation are effective. Rather, security is best
    served by using trusted suppliers. For example, in Nokia,
    ethics and reporting of unethical behavior is mandatory for all
    employees and is a prerequisite for employment.
        In product development, Nokia implements a design for
    security governance model that involves testing all products
    for vulnerabilities followed by structured resolution processes
    and rigid correction timelines. Transparency is mandatory.
        It should be noted that these activities are independent of
    country of origin and that is my final thought. Namely, that
    the governance, historical behavior, ethics, and security
    systems implemented by companies are the true definition of
    trust.
        In closing, thank you again, Chairman Wicker, Ranking
    Member Cantwell, and members of the Committee, for the
    opportunity to testify here today.
        [The prepared statement of Mr. Murphy follows:]

        Prepared Statement of Michael Murphy, Chief Technology Officer,
                               Americas at Nokia
        Chairman Thune, Ranking Member Cantwell, and members of the
    Committee, on behalf of Nokia, thank you for the opportunity to testify
    today.
        Nokia appreciates the leadership of this Committee, Congress, the
    Federal Communications Commission (FCC), and the Administration in
    securing U.S. communications networks. In this testimony, I want to
    discuss several topics.

       First, given recent congressional action regarding the
            critical need to move forward in assisting small carriers with
            removing untrusted vendor equipment in their networks, I will
            outline several issues Congress and the FCC must keep in mind
            to ensure that the removal occurs without a negative impact on
            carriers and the communities they serve.

       Second, an important element of ensuring a secure supply
            chain for communications equipment is guaranteeing that the
            trusted suppliers already providing equipment to the U.S.
            market can compete at a global scale and on fair terms. I will
            share Nokia's perspective on the current global marketplace and
            some challenges that are the result of advantages extended to
            Chinese suppliers that are not available to other suppliers and
            how that can be mitigated to ensure a level playing field for
            trusted suppliers.

       Finally, I will highlight several of Nokia's leading
            security and supply chain activities, including design for
            security and supply chain validation, and why we believe they
            result in trustworthy networks. I will also comment on how new
            U.S. actions on supply chain security should recognize
            practical timelines to ensure execution success.
    About Nokia:
        Nokia is the industry's only global supplier having an end-to-end
    portfolio of network equipment, software, services and licensed
    technology. Our customers include communications service providers
    whose combined networks support 6.1 billion subscriptions, and our
    enterprise customers have deployed over 1,000 industrial networks
    worldwide. We transform how people live, work and communicate. We are
    the only telecommunications equipment provider listed in Ethisphere's
    2020 Honoree list of ethical companies.
        Nokia has a massive presence in North America with more than 11,000
    employees, the bulk of those in the United States. We have 28 sites
    including five major innovation hubs of which four are in the United
    States: Sunnyvale, CA; Dallas, TX; Naperville, IL; and Murray Hill, NJ
    the site of the iconic Nokia Bell Labs, recipient of 9 Nobel Prizes.
    There are also two major Nokia data centers in the U.S., one in Plano,
    TX and the other in Chicago, IL. In addition, SAC Wireless, a Nokia
    subsidiary, has 21 sites in the United States. SAC offers turnkey
    services to support major network builds and upgrades for 4G, 5G, Small
    Cells and FirstNet. Those services include site selection and
    acquisition, engineering, construction, optimization, maintenance and
    end-to-end program management.
        Nokia has been a leader in every generation of wireline and
    wireless communications to date and continues that leadership in 5G.
    The race to innovate never stops. In fact, even as we continue to roll
    out the earliest 5G networks, our work on 6G has already begun at Bell
    Labs.
    Removal and Remediation of Equipment Provided by Untrusted Vendors in
            U.S. Rural Networks
        Throughout the FCC's secure supply chain proceedings, Nokia
    provided technical input on the strengths and weaknesses of networks
    with respect to their inherent security and how a secure supply chain
    could be created by using our own company's internal governance as
    examples.
        Now, given the FCC's decision to require removal of equipment from
    certain vendors, Nokia would like to offer additional perspectives on
    what the FCC and Congress should bear in mind before prescribing the
    final replacement guidelines and funding criteria. That advice, as I
    outline herein, is that flexibility in timing and technology neutrality
    will be essential if this effort is to be successful. Executed well,
    this effort can also help in the U.S.'s drive towards 5G leadership.
    Flexibility in timing:
        The FCC correctly recognized during its rulemaking process that a
    funded reimbursement program should be implemented before requiring
    recipients that receive universal service fund support to remove and
    replace covered equipment from their networks. Congress has taken the
    first critical step by passing the Secure and Trusted
    Telecommunications Networks Act.\1\ Nokia believes that several
    provisions of the Act are prudent, particularly the provision granting
    discretion to the FCC to extend the time allowed for impacted carriers
    to replace covered equipment from one year, by up to an additional six
    months, and the directive for the FCC to remain technology neutral in
    establishing the list of recommended replacement equipment. The
    following provides some detail on why we support those provisions.
    ---------------------------------------------------------------------------
        \1\ Protecting Against National Security Threats to the
    Communications Supply Chain Through FCC Programs, Report and Order,
    Further Notice of Proposed Rulemaking, and Order, WC Docket No. 18-89,
    FCC 19-121,  122 (rel. Nov. 26, 2019) (``Order and FNPRM'').
    ---------------------------------------------------------------------------
        Nokia completed more than 60 major swaps in the last three years,
    including the largest ever done, replacing 75,000 base stations in both
    the Verizon and AT&T networks following our acquisition of Alcatel-
    Lucent and the transition to a new product platform. Those projects
    required removal and replacement while also maintaining service
    continuity and service quality. That is--and should be--the expectation
    of swap activities for all impacted carriers in this context. Based on
    those past experiences, Nokia can attest that these efforts require
    careful planning, are network specific, and the times required vary
    significantly from project to project. Network size is not the only
    factor affecting timelines. For example, new product variants or
    features may be required for unique spectrum combinations or to match
    customized capabilities provided by the previous vendor.
        Beyond routine timelines, ongoing large 5G builds are creating a
    shortage of qualified tower crews. In fact, despite Nokia having the
    largest in-house field service team in the U.S., we still see a dearth
    of crews to meet 5G demands in 2020 and into 2021. Small rural markets
    covering vast rural landscapes with shortened climbing windows during
    winter months only exacerbate the issue. We appreciate the leadership
    of Senators Thune, Tester, Moran, Peters, and Wicker in introducing the
    Telecommunications Skilled Workforce Act to help address this gap.
        In short, our view is that flexibility in timelines are a necessary
    practical reality, and thus extensions to the current one-year proposal
    will likely need to be granted liberally.
    Flexibility in technology:
        During the rulemaking process, the FCC proposed ``to make available
    reasonable replacement costs for the equipment and services produced
    and provided by covered companies. . . .'' \2\ and asked whether
    recipients of universal service funding should be ``allowed to seek
    reimbursement for technology upgrades to their networks . . .'' \3\
    Nokia noted to the FCC that carriers replacing equipment need to have
    the freedom to buy solutions that are not just ``like for like,'' due
    to the unique times we are in (that is, in the midst of a 4G to 5G
    transition, the drive towards more open systems and virtualization).
    All of these play a role in what a rural carrier should, or should not,
    do in removing and replacing a supplier. The following provides Nokia's
    recommendation on these competing and complex topics.
    ---------------------------------------------------------------------------
        \2\ Id.  137.
        \3\ Id.
    ---------------------------------------------------------------------------
        Regarding ``like for like,'' Nokia is and will continue to offer
    such solutions to all impacted carriers when they are available,
    appropriate and cost-effective. However, a significant part of Nokia's
    portfolio sold today supports both LTE and 5G through software
    upgrades. Replacing impacted carriers' equipment with older generation
    ``LTE only'' hardware could burden rural communities with avoidable
    near-term high 5G upgrade costs. A potential way forward is to offer
    ``5G Ready'' hardware but costing only the LTE components. Putting it
    another way, supporting ``like for like'' at the service level, but not
    necessarily at the hardware level. This would help mitigate the risk of
    gold plating and potentially help accelerate 5G in rural communities,
    thus supporting the U.S. drive towards nationwide 5G leadership. In
    short, there are no downsides.
        In addition to avoiding being overly prescriptive on replacing
    ``like for like,'' the FCC should also not condition funds on any
    prescriptive technology mandates. No specific technology, network
    configuration, or other similar mandate will be a one-size fits all
    solution to all network deployments. For this reason, Congress was wise
    to direct the FCC to implement a list of potential replacements that is
    technology neutral. At the same time, a recently introduced Senate bill
    suggests restricting any money for replacement on the condition that
    the relevant carrier must develop and submit a plan certifying that it
    will migrate to an open solution within seven years. While the intent
    of that bill is to encourage U.S. based 5G entrepreneurship, its timing
    brings with it some practical challenges.
        The reality is that fully compliant open interfaces as specified by
    the ORAN Alliance, the most relevant in this context, have not been
    deployed anywhere in the world yet. These are new grounds for the
    industry. In fact, it is uncertain whether the most critical interface
    specified by ORAN will be deployed widely, as alternatives are already
    being proposed by several contributing, significant members. Likewise,
    virtualization, an orthogonal technology to ORAN, that can also
    facilitate open systems, has only been deployed by one carrier globally
    in a 5G Radio Access Network. In short, there is limited maturity in
    both ORAN and Radio Access Network virtualization. For this reason,
    Nokia believes that putting these burdens on rural carriers, the least
    capable of being early adopters, would be unreasonable and should not
    be a pre-requisite for Federal funding to replace their existing
    equipment, at this time.
    The Challenging Marketplace for 5G
        Speculation about ``the Race to 5G'' and anxiety about which
    countries will lead and which vendors will prevail has been a staple of
    public commentary for the last couple of years. Much of that commentary
    and anxiety has suggested that non-Chinese vendors are not capable of
    matching the breadth or quality of products offered by Chinese
    suppliers and, as a result, would not succeed. While that argument is
    incorrect, there are areas of concern that need to be addressed.
        The U.S. was the first country in the world to launch 5G in the
    fourth quarter of 2018, followed by more significant launches in April
    of 2019. The U.S. was also the first country in the world to launch 5G
    based on mmWave. The first to launch 5G on low band frequencies,
    nationwide. The first to deploy a virtualized solution. And the U.S.
    will also be the first globally to launch what is called a Standalone
    5G core network and the first to launch a technology called Dynamic
    Spectrum Sharing or DSS, allowing 5G and 4G to be deployed on the same
    spectrum. These firsts have and are being done by Nokia, Ericsson and
    Samsung. So, it is factually incorrect to say non-Chinese vendors are
    incapable of leading in 5G.
        That does not, however, mean that the marketplace is without
    challenges. Policymakers should note that the pressure on many global
    wireless operators to reduce capital and operations costs, if very
    high, even as they deploy 5G networks, is very high. Against this
    backdrop, government programs including export credit agencies play a
    very significant role in coloring the attractiveness of supplier
    pricing. China has made aggressive use of its development bank and
    other programs to support its indigenous suppliers. Other nations have
    been far more reserved. For example, the U.S. Export Import Bank has
    not focused on telecommunications infrastructure projects in many
    years.
        The payment terms being offered by Chinese suppliers suggest the
    underlying financing mechanisms, while legal, are neither consistent
    with commercial norms, nor available to competitors from commercial
    banks. We believe this is an approach that is common across many
    markets now based on requests from some of our customers to match these
    lengthy, low-interest payment terms. We raise these lawful finance
    mechanisms to ensure that Congress and the Administration know that
    they have tools available today to make a considerable difference in
    the competitive balance in the coming years through existing
    institutions.
        The U.S. Export Import Bank and the recently renamed International
    Development Finance Corporation could potentially provide billions of
    dollars of grants, direct loans, loan guarantees, and insurance to
    exporters of 5G technology with its origins in the U.S, including to
    Nokia. Fortunately, there is movement in this direction now that
    reauthorization has been completed and the Administration appears to
    support moving forward as well. I encourage Congress to express its
    support for using these important programs to support trusted suppliers
    and to help them compete on a more level playing field internationally.
        An additional challenge is that the Chinese telecommunications
    market is massive and dominated by domestic suppliers that collectively
    provide more than 70 percent of the equipment for LTE networks, a
    figure that is likely to go higher in 5G. That places Chinese suppliers
    in a position whereby they can spend massively on R&D and use that
    depth in foreign markets. Policymakers here in the U.S. and other
    nations that want to ensure a diversity of suppliers should work to
    coordinate their own R&D support programs might be utilized and
    coordinated to support a level playing field. To date, much of the R&D
    spending in the U.S. has been in support of foundational research
    through funding of incubators via the National Spectrum Consortium and
    U.S. Connect. The recent Senate Intelligence Committee bill authorizing
    significant funding for research on network virtualization is an
    additional opportunity to provide essential research support. These are
    well designed efforts showing the potential for promising returns, but
    they are ultimately insufficient in scope and resource level. The
    missing components are support for further 5G product development, 6G
    foundational research, and support generally for creating new
    manufacturing and industrial base development activities in the U.S.
    5G Security Planning and Nokia's Supply Chain Practices and Policies
        I would like to turn now to the topic of 5G readiness and security.
    It has become widely understood that 5G will enable advanced, new use
    cases supporting critical services such as autonomous driving, factory
    automation, connected healthcare and others. These, combined with an
    architectural approach that includes virtualization and distribution,
    increases the inherent risk and potential damage caused by bad actors
    on 5G networks. Putting it another way, as 5G expands beyond smartphone
    users, and IoT devices start to play a larger role, the network attack
    surface increases. This has given rise to concerns about whether 5G is
    ``ready'' from a security perspective. We believe it is for several
    reasons.
        First, learnings from LTE networks and the vulnerabilities
    encountered in them have been addressed by improved security mechanisms
    in 5G standards as specified by 3GPP. For example, in 4G networks, the
    identify of users is often transferred ``clear'' across the air
    interface. This has allowed ``IMSI hackers'' to capture user identities
    and use them maliciously. This has been corrected in 5G through
    encryption of user identities. At this level, 5G is a significantly
    more secure system. Second, in addition to improving interface level
    security, 5G also introduced network wide security through the concept
    of secure, virtual ``slices'' across networks that cannot be breached
    by users in other slices. Visualize a government ``slice'' across a
    public network, that is protected and unreachable by users in a public
    smartphone slice.
        However, even with these improvements, the reality is that bad
    actors could still infiltrate a 5G network. In other words, you still
    must trust suppliers to not act maliciously even with improved,
    standardized approaches to security. In that regard, Nokia does not
    support the view that either product or geographic isolation are
    effective. A breach in one part of a network could extend to other
    parts of the network. For this reason, Nokia believes the final and
    most important element of a secure system, comes from the governance
    models, ethical behavior and product development processes that
    suppliers demonstrate and apply. And here I would like to provide Nokia
    as an example.
        One of the reasons for Nokia being on Ethisphere's ethical honoree
    list comes from internal governance that mandates both corporate and
    personal ethical behavior. Training in ethics and reporting of
    unethical behavior is mandatory for all employees and is a prerequisite
    for employment with zero tolerance.
        At the product level, Nokia systemically ensures that the products
    we deliver are secure through a Design For Security (DfSec) governance
    model that involves security testing of all product releases and
    continuous monitoring of all software components used in our products
    for vulnerabilities. Product teams have structured processes and
    enforced timelines for how any uncovered vulnerabilities must be
    handled and communicated to affected customers. To ensure our own
    products are secure during this process involves strict guidelines
    related to coding, hardening, testing, and updates. Processes we expect
    of 3rd party suppliers as well. Transparency and a governance model for
    corrective action are part of how we deliver products.
        Finally, Nokia monitors a number of networks through a Threat
    Intelligence Lab. Results from that lab allow us to understand and
    deliver updates to customers to proactively prevent wider issues.
        I hope that this information provides a meaningful basis for U.S.
    consideration about future supply chain activities. It is critically
    important that policymakers understand what is actually done today to
    ensure component security, product security and post-sale security
    support before prescribing new regimes for testing or certification
    that could impose costs on your trusted suppliers without necessarily
    providing a security dividend. And that is where a supply chain
    security strategy really should begin, careful assessment of known
    risks and current industry practices. Actions the U.S. might consider
    should draw from areas only where gaps are perceived. In helping
    industry to be a constructive partner in this process, Nokia recommends
    the following:

       Identify best practices in design for security, supply chain
            validation and post-sale support and encourage the adoption of
            those practices;

       Rather than focus on countries of origin for component
            sourcing or manufacturing, specify the components or activities
            that give rise to the risk of exploitation or manipulation. Not
            all components and products create risk. Narrowing the focus to
            specific components or products with risk will assist suppliers
            in making critical and cooperative decisions with governments
            about supply chain activities.

        Thank you again Chairman Thune, Ranking member Cantwell and members
    of the Committee for the opportunity to testify here today.

        The Chairman. Thank you, sir.
        And Dr. Lewis.

                    STATEMENT OF DR. JAMES A. LEWIS,

                  SENIOR VICE PRESIDENT AND DIRECTOR,

            TECHNOLOGY POLICY PROGRAM, CENTER FOR STRATEGIC

                    AND INTERNATIONAL STUDIES (CSIS)

        Dr. Lewis. Thank you, Mr. Chairman.
        Mr. Chairman, Ranking Member Cantwell, thank you for the
    opportunity to testify.
        We hear that 5G is a race the U.S. cannot lose but if it is
    a race, we are not losing. Let's review some key issues.
        The U.S. has not been rebuffed in Europe. The U.K. decision
    is best seen as a partial ban. Europeans agree on the risk of
    using Huawei and the EU calls China a systemic rival.
        Where there is disagreement is over how to manage risk.
    Germany has a dilemma. If it bans Huawei, China has threatened
    to retaliate against German exports and China is Germany's
    largest market. German car companies have allegedly asked
    Chancellor Merkel not to ban Huawei and Germany is tempted to
    copy the U.K. partial ban.
        Those who advocate a partial ban argue that if properly
    implemented, it makes the risk of using Huawei equipment
    acceptable. A full ban is best, but if countries decide against
    it, the U.S. will need to help make partial bans effective.
        Spectrum is not an obstacle. Telecommunications companies
    say that the spectrum allocation process could be faster and
    cheaper, but spectrum decisions have not put the U.S. at a
    disadvantage.
        The key issue, as you know, is finding ways to share
    spectrum now held by DoD. Standards are a battleground but in
    5G, it is a battle where the U.S. is doing well. This could
    change if U.S. export controls handicap our companies. This is
    a self-inflicted wound we must avoid.
        Telecoms' technology is changing. The telecom supply chain
    will depend on technologies where the U.S. leads, like
    semiconductors. Blocking exports of semiconductor manufacturing
    equipment is the best way to preserve this lead.
        Huawei does not sell the best 5G equipment. A review by a
    European intelligence agency found that Huawei was the most
    vulnerable to exploitation. Nokia and Ericsson offer better and
    more secure 5G technology.
        U.S. companies are strong in the markets that 5G will
    enable. We face tough competitors but the chief risk to this
    U.S. strength in 5G innovation will be badly designed privacy
    rules.
        The doomsday argument is that because of the slowness in 5G
    deployment and the lack of spectrum, American entrepreneurs
    will not be able to take advantage of 5G, but the U.S. is not
    slow in 5G deployment and spectrum allocation is not an issue.
        5G is a symptom of a larger problem. We face a powerful
    opponent who is using espionage and predatory economic
    practices, including exploiting American patents to gain
    advantage. 5G is part of this contest.
        Our strategy is strength in America's technology base, work
    with allies, and hold China accountable, and many of the bills
    introduced recently by this Committee and others move us in
    that direction.
        To summarize, I believe America's 5G problem is over-
    stated. If we take the right steps, we can win this race. The
    larger issue is how to deal with an increasingly hostile China.
        Thank you, and I look forward to your questions.
        [The prepared statement of Dr. Lewis follows:]

        Prepared Statement of Dr. James A. Lewis, Senior Vice President
         and Director, Technology Policy Program, Center for Strategic
                        and International Studies (CSIS)
        Mr. Chairman, Ranking Member Cantwell, distinguished members of the
    Committee, thank you for the opportunity to testify. The fifth
    generation of telecommunications network technology is an important
    development and I hope my testimony can dispel some of the myths and
    offer a path forward for American prosperity and security.
        We often hear that 5G is a race the U.S. cannot lose. It sounds
    dramatic, but I am not sure what it means. I am sure, however, that if
    there is a race, we are not losing. The U.S. is well positioned to take
    advantage of 5G technology, just as it did with 4G. The difference this
    time is we have real competition, a competitor who is well resourced,
    with a strong technology workforce, and a long record of unscrupulous
    behavior. We face a dynamic competitor in China, and there are things
    the U.S. can do to strengthen both its security and its technological
    leadership. Congress can play an important role in this.
        The 5G issue has become politicized and this shapes reporting in
    unhelpful ways. Let's dispel some of the myths. First, the U.S. has not
    been rebuffed in Europe. In speaking to colleagues in the UK and
    Europe, there is broad agreement with the U.S. on the risks of using
    Huawei. The UK action is best seen as a partial ban on Huawei. The UK
    has blocked Huawei from two thirds of their network and from being used
    in sensitive areas around government and military installations. They
    and other European countries are committed to maintaining supplier
    diversity and avoiding Huawei dominance. The U.S. needs to find ways to
    benefit from these shared concerns to develop secure telecommunications
    networks.
        Where there is disagreement is in how to manage risk. The U.S.,
    Japan and Australia have banned Huawei technology in their networks.
    This is the only way to eliminate risk entirely. Those who advocate a
    partial ban argue that if properly implemented, it makes the risk of
    using Huawei manageable. Some European countries will copy the UK's
    decision. This provides the U.S. an opportunity to work with our allies
    to ensure that a partial ban reduces risk and there could be real
    advantages for the security of telecom networks and cybersecurity. The
    recently issued European Union 5G Toolbox provides a framework to guide
    policy in a way that, if implemented fully, would reduce China's use of
    telecom infrastructure for espionage and influence.
        A full ban is the best outcome for security. It is not, in the
    judgment of some of our allies, the best outcome for their economies.
    Germany, for example, faces a dilemma. If it bans Huawei, the Chinese
    have explicitly threatened to retaliate again German auto exports, and
    China is Germany's largest market--China is playing hardball. German
    car companies have reportedly asked Chancellor Merkel not to ban
    Huawei. However, if Germany uses Huawei, China's intent is to use
    espionage to hollow out the German industry, and in particular the auto
    industry. If countries ultimately choose a partial ban, we will need to
    work with them to ensure that it is well implemented.
        There is a larger debate over whether banning Huawei from the
    ``core'' of telecom networks and confining them to the ``edge,'' such
    as the Radio Access Network (such as the cell tower that connects your
    phone to the network) will actually work. U.S. and Australian agencies
    say no, the UK and others (including some American tech companies) say
    yes. Frankly, the issue is moot. The UK has chosen a partial ban,
    others will follow them. It would be best for security if countries
    adopted a full ban, but if they do not, the U.S. needs to help make the
    partial ban as effective as possible. There is concern about how
    Germany may implement a partial ban, but the way to persuade it and
    others to cooperate with the U.S. is not by using heavy-handed threats
    to cut intelligence sharing. All Europeans say this doesn't help our
    case and if we use a more deft diplomacy that focuses on winning
    European cooperation in the battle against Chinese espionage, we are
    more likely to be effective--the Europeans are already aware of the
    problems of doing business with China, having declared that China is a
    ``Systemic Rival.''
        The root of the 5G problem is Chinese espionage and Chinese
    predatory economic practices. Our European and Asian partners have
    realized the extent of the Chinese espionage campaign against them.
    Countries near China are eager to cooperate, but there is an
    ambivalence in Europe. China is not a military threat to them and there
    is a reluctance to admit that the China market that Europe depends on
    comes with real economic risk. Europeans say they want ``technological
    sovereignty,'' to be free of both China and the U.S., and they cite
    Snowden in an effort to show moral equivalence between the U.S. and
    China. Spying, illicit subsidies, and predatory pricing helped Huawei
    to drive western telecom manufactures from the market and other sectors
    of the European economy, such as aerospace and automobiles, are now at
    risk. Our task is to persuade European allies that it is better if the
    democracies stand together.
        Spectrum for 5G is not an issue. The FCC and NTIA have done a god
    job at supporting 5G deployment. In talking to major telecommunications
    suppliers, they say it would be nice if the spectrum allocation process
    was faster and less expensive, but most say that it is working well to
    meet their needs for 5G. Spectrum decisions have not put the U.S. at a
    competitive disadvantage. The U.S. has one of the most flexible
    regulatory frameworks that permits operators to migrate to another
    technology in a wide range of bands. The United States is one of the
    first deploying in high bands but we are also seeing deployment in
    other bands. 5G will be deployed in the low, medium and high bands in
    the United States. U.S. spectrum allocations have created demand for
    tech companies to develop solutions that will allowed for 5G rapid
    deployment.
        The complaint that the U.S. has mismanaged 5G spectrum allocation
    has led to a variety of strange proposals, such as a Federally-operated
    5G network or a Federally-anointed spectrum monopoly. All of these are
    silly and one way to explain this is that government monopolies were a
    good economic policy in the 15th century but have not worked as well
    since then. The best 5G policies rely on market forces. If there is an
    issue in spectrum allocation, it is one the Committee if very familiar
    with, and that is the process for deciding when the U.S. Department of
    Defense should retain spectrum or when it should be reallocated for
    economic purposes. NTIA has done a good job of balancing security and
    economics, but in the new international competitions, emphasis on
    economic benefit might better serve U.S. national interests.
        Standards are a battleground, but in 5G it is a battle where the
    U.S. is holding its own and retains the lead. This is not an easy
    fight. China is politicizing the standards process, flooding meeting
    with its experts, and is already leading in some bodies like the
    International Telephony Union (ITU). This is not the case for 3GPP, the
    standards body responsible for 5G. Its rules block efforts by one
    government to seize control and frankly, Chinese technology is in many
    cases inferior, making people reluctant to use it as a standard.
    Interviews with leading American 5G companies show that the 3GPP
    standards process is still led by western companies, not China.
        One crucial element for maintaining this advantage is to not see
    expanded export controls inadvertently damage the ability of American
    companies to participate in standards discussions. The U.S. Department
    of Commerce rules have created uncertainty. It is not good for U.S.
    companies to be sidelined in standards discussions by our own rules
    while Chinese companies are not.
        Huawei is not the only supplier of 5G technology, nor is it the
    best equipment available. In fact a review by a European intelligence
    agency found Huawei was the most vulnerable to intelligence
    exploitation because of engineering and software problems. Huawei has
    undeniable strengths, and of them is its public relations department.
    Which has had considerable success in persuading people of the
    necessity of buying from Huawei as it is the ``only'' supplier of 5G
    technology which they must buy if they are not to ``fall behind.''
    Nokia and Ericsson offer 5G technology that is better and more secure,
    and Samsung is also establishing a presence in the 5G market.
        The discussion of 5G has been shaped by the precedent of the
    internet, a technology that has reshaped corporate fortunes and
    national economies. People assume that 5G's economic effect will be the
    same, but this should come with a precautionary note. The Internet was
    created in the 1970s, commercialized in the 1990s, and began to rapidly
    reshape markets in the first decade of this century. Change is not
    instantaneous and the idea of falling behind unless you immediately
    install Huawei completely misrepresents the economics of digital
    economies.
        5G (and Wi-Fi) will enable connections between sensors, the data
    they create, and powerful Internet computing resources. Innovators can
    take advantage of this connection to create new services and
    applications. These will be new enterprise and industrial applications
    such as smart seaports, hospitals, or factories. Self-driving cars are
    part of this and 5G will speed their use.
        5G could be the start of another round of innovation and growth
    similar to what we saw with the arrival of the internet, but for this
    to happen, 5G must be accompanied by ``complementary investments.''
    These include the invention of new products and services that make use
    of 5G networks, and the development of new business models and
    processes that can profit from 5G. The U.S. is strong here, but so is
    China. The need for complementary investments and innovations put the
    ``race'' metaphor in context, because what companies and countries do
    with 5G is more important than how quickly they deploy or how ``much''
    5G they have.
        The doomsday argument is that because of slowness in American 5G
    deployment and the allocation of the wrong spectrum frequencies, U.S.
    inventors will not be able to come up with innovations that will take
    advantage of 5G. But the U.S. is not slow in 5G deployment and the
    spectrum issue is not a significant obstacle.
        China does not lead in 5G. China will have more 5G phones or cell
    towers simply because it has more people, but this is the wrong thing
    to measure. American and Chinese deployments are roughly equivalent,
    with 57 cities in China that have 5G as opposed to 50 in the U.S. The
    key metrics are revenue and market share from the ability to use 5G to
    create economic growth.
        Companies will use 5G services to be more efficient and innovative,
    and innovators will create new services and products that 5G can
    enable, but what ultimately counts is how people use 5G to make money.
        One way to make money from 5G is to sell the technologies that
    enable it. This is where much of the public attention has focused
    because of the security risks. There are five companies that sell
    telecom network technologies--Ericsson, Huawei, Nokia, ZTE, and
    Samsung--but they sit atop multinational supply chains that are largely
    American, Japanese, and Chinese companies that make hardware and
    software components used by the five major suppliers.
        Another way to make money is to sell 5G services--this is what
    telecom companies will do. The most ``disruptive'' way to make money,
    and the way that probably offers the best outcomes for economic growth,
    is to create applications (apps) that take advantage of 5G. Your
    smartphone is in effect a tiny computer. The change in how people use
    the internet, from desktops to smartphones and apps, helped American
    companies define the mobile Internet and create the ``app economy''
    that rapidly grew to be worth billions of dollars. 5G industrializes
    the app economy and expands it beyond games and other consumer
    programs, and this is where the opportunities for economic growth will
    appear. 5G will move the app economy from consumer applications (like
    Angry Birds) to industrial and enterprise applications.
        It is true that Europe and China announced they intend to dominate
    5G the way the U.S. dominates 4G, and American companies face new
    competition, but success depends on making products and offering
    services that appeal to the market. The most important market segment
    for 5G will be enterprise applications that allow companies to operate
    more efficiently and productively. Examples of these enterprise apps
    would include supply chain management systems, customer relationship
    management systems, and knowledge management systems. So far, the
    ``killer app'' for 5G has not been created, but U.S. companies are
    strong in these markets. It is not credible to expect the nimble, well-
    resourced, and entrepreneurial U.S. tech sector being squeezed out of a
    profitable market.
        The policies that promote success in each of these areas are
    different. For technology producers, the focus on competition is over
    5G's intellectual property, standards, and patents. Policy should
    encourage and support R&D, protect intellectual property, and ensure a
    level playing field in international standards and trade.
        Each competitor has different plans for 5G. Germany intends to use
    5G for industrial applications, part of its ``Industry 4.0'' plan, and
    its strong manufacturing sector may give it an advantage. 5G will play
    a central role in the development of smart and self-driving cars, and
    all countries with an automotive industry will compete in this. China
    already has valuable consumer apps (like WeChat), a strong developer
    base, and will also pursue industrial and enterprise applications.
    China had an advantage in developing apps for the Internet of things
    since its companies are the source of many of these products. But
    Chinese companies also face trust issues, since any Chinese-made device
    that connects to the Internet could be exploited by Chinese
    intelligence agencies.
        Telecom technology used to be somewhat static, changing slowly. It
    relied on specialized hardware, each generation providing incremental
    improvements over the prior in speed and reliability. New technologies
    like cloud computing were layered on top of established protocols and
    equipment. This is now changing. Telecommunications technology is now
    going through a transition similar to the effect of the commercial
    Internet on computing three decades ago. This has major implications
    for security and business.
        The move to an open, modular approach to telecom will change supply
    chain dynamics in ways that favor the U.S. (and Japan). The supply
    chain for telecom will depend on semiconductors, chipsets, and
    specialized software (including ``open source'' software), all areas
    where the U.S. has a substantial lead over China--in some cases there
    are no Chinese competitors. Estimates of how long this telecom
    transformation will take range from three years to a decade. The shift
    puts Huawei at a disadvantage. China will of course invest to catch up
    (accompanied by increased espionage), but money alone won't remedy
    China's lag in software and semiconductors.
        The most visible aspect of this change is Open Radio Access Network
    Alliance, an industry group developing architectures and software that
    will enable virtualized networks (e.g., those based on software rather
    than hardware), commodity computers, and standardized interface.
        The companies that make the modular components for new telecom
    technologies included both familiar names and new startups. Qualcomm,
    Intel and Samsung make chips. Microsoft (which has a huge 5G lab)
    writes operating system software. Cisco, Sienna, Xilinx, Nokia,
    Fujitsu, and NEC make other essential components, as do a number of new
    companies, such as Altiostar.
        These are all American, Japanese or Korean companies. In contrast,
    Huawei's strength in the new technologies is in RAN cell towers.
        It is much easier to tell a story of gloom and peril, but it's not
    a good guide for law or policy. There are, however, steps we need as
    part of a comprehensive approach to 5G. The three most difficult
    challenges are rebuilding the sources of American technology
    leadership, effectively partnering with allies, and resisting China's
    efforts to use espionage and predatory trade practices to attain
    dominance. These are not unique to 5G and it is important to see 5G as
    only a part of a larger technological competition.
        Some recommendations are things the Committee has heard many times,
    such as rebuilding the American tech workforce through investments in
    college education and spending more on R&D for the ``hard sciences.''
    It's worth noting that these steps would help with competing with China
    in the standards battle by expanding the tech and engineering workforce
    needed for the standards process.
        An implementable suggestion is to restore the STEM scholarship
    programs established by the Eisenhower administration in reaction to
    our last technological security threat in the 1950s. This means paying
    students to study engineering, math, sciences, coding, and languages.
    The Chinese are not reluctant to spend money to build their tech
    workforce and is this is one of their greatest advantages over us.
        The U.S. can safeguard the standard process not only by increasing
    the number of American participants, but by working with European and
    Japanese partners to ensure that standards bodies remain open and
    equitable, and with governance structure that remains able to resist
    efforts to politicize or capture them.
        A crucial element of maintaining a U.S. presence in standard bodies
    is to make clear that export control regulations do not prevent U.S.
    companies from participating in international standards discussions.
    The Commerce Department needs to immediately clarify that standards
    participation remains exempt from export regulations. This is a self-
    inflicted wound that the U.S. must avoid.
        R&D funding for the development of industrial apps and the Internet
    of things is important. While market forces will drive some of this, we
    can accelerate 5G deployment and the benefits to the U.S. economy by
    supporting additional research. DARPA has a program on 5G security. NSF
    and NIST have small programs in these areas, but they are dwarfed by
    what China spends. We cannot expect to maintain technological
    leadership when we are routinely outspent. An easy suggestion would be
    to double the funding now allocated to 5G and cybersecurity.
        There has been some discussion of whether to help Nokia and
    Ericsson, the two European 5G equipment manufacturers, ranging from
    support for R&D to outright purchases of the companies. An initial and
    relatively uncontroversial step would be to find mechanisms to support
    R&D by these companies. No option is off the table and there is
    perennial talk that one of the companies will be bought or merged. In
    the next decade, Nokia and Ericsson face the challenge of adjusting
    their business models to accommodate changes in telecommunications,
    since the proprietary ``stack'' that they and Huawei make will be
    overtaken by technological change. In the near term, it is in our
    interest to ensure that they continue to operate profitably and can
    compete on equitable terms with Huawei. One approach would be to
    instruct DOD to develop Cooperative Research and Development Agreements
    (CRADA) with both companies, to fund their R&D.
        Some recommendations may seem at first glance unrelated to 5G. 5G
    depends on semiconductors, and the U.S. is the leading source of
    supply. The Chinese government does not like this and intends to
    develop its own semiconductor industry to replace American firms both
    in China and in the global market. But to make chips, China needs to
    buy semiconductor manufacturing equipment (SME) which it cannot produce
    itself. The major sources of this SME are the U.S. and Japan, along
    with one or two European companies. One way to limit China's role in 5G
    is to limit exports of SME. Some of our allies have proposed augmenting
    existing controls to do this. We should develop a new SME export
    control regime with our Japanese and European partners, and Congress
    can help the Administration focus on this by mandating it, with
    timelines.
        I hesitate to make recommendations on spectrum, since the process
    is working well enough and since any effort at reform raises powerful
    antibodies to block change. Congressional interest in seeing the
    allocation process further streamlined and in reducing the ability of a
    single agency to block reallocation would be helpful for the mobile
    network world we have entered.
        We face a difficult challenge of managing the transition from the
    older model of telecommunications technology to the new, internet-based
    approach. Some say this transition will be here in three years, others
    say a decade, but the goal for now is to keep the two European
    suppliers viable and technologically sound. To some extent this can be
    left to the market, the customers of these companies will encourage
    them to evolve, but the U.S. can assist by emphasizing this in
    decisions with the governments of Sweden and Finland.
        Whether or not other nations follow the UK precedent of a partial
    ban, we and our security problem will continue to confront the
    challenge of how to communicate securely over networks with
    untrustworthy components. Finding a way to do this, and to help those
    countries that choose a partial ban make it as effective as possible,
    is a central strategic goal for the U.S. The Prague Principles for
    secure telecommunications networks produced last year are a starting
    point for this, and the U.S. can strengthen these principles at the
    upcoming second meeting, by aligning them with measure criteria for
    security. It is not enough to say that we should avoid a telecom
    ``monoculture.'' There must be an explicit commitment to buy from
    multiple venders and to give preference to suppliers from democracies
    even if the price is higher.
        Huawei is a symptom of a larger problem and 5G is a symptom of
    larger fears. We face, for the first time in decades, a powerful,
    unscrupulous, well-resourced opponent who has publicly declared their
    intent to displace us. We are not ready for this fight and do not have
    a strategy to respond to this challenge. It is likely that for some
    time we will be unable to develop such a strategy. This is not a
    reflection on American politics, messy as it can be. It reflects that
    we are in a different kind of competition. Increasing the defense
    budget will not help the U.S. win. This is a competition over markets
    and technology, things with which the foreign policy and defense
    establishment are still unfamiliar. Strategies that traverse the
    intersection of economics and security will not at first be easy for
    the U.S. to construct.
        China has strengths--a determined Leninist leadership willing to
    spend on strategic goals (and even though the U.S. is twice as rich as
    China, we are being outspent), an immense domestic market, and a plan
    to shield this market from competition while using it as a base to
    dominate a range of industries, assisted by predatory trade practices
    and a massive economic espionage campaign. China has weaknesses as
    well--the heavy economic costs of a repressive regime, the
    inefficiencies of state capitalism, clumsy diplomacy and, above all, a
    fear by the Party leaders of their own people. China is not our
    technological peer but they are making immense efforts to change this.
        The U.S. needs to act in response. We have seen some efforts in the
    last few years, but more needs to be done, including a revitalized
    science and technology base and a coordinated approach with our allies
    on how to respond to China's espionage, unfair trade practices, and
    efforts to reshape global rules to better accommodate authoritarianism.
        To summarize; the problems often attributed to 5G in the U.S. are
    often overstated or wrong; there are things we can do to speed up
    deployment and reduce risk, but the larger issue is to how to deal with
    an increasingly hostile China in a new kind of non-military
    competition. Thank you for the opportunity to testify and I look
    forward to your questions.

        The Chairman. Well, thank you. Thank you very, very much.
        Let me just make sure. Dr. Lewis, is your testimony the
    official position of CSIS?
        Dr. Lewis. CSIS doesn't take official positions because
    we're either a nonpartisan or bipartisan, I forget which one it
    is, but we're----
        [Laughter.]
        The Chairman. Well, I always thought you were bipartisan.
        Dr. Lewis. Well, and I always thought because I was a
    career officer I was nonpartisan, but in any case, it's the
    individual scholar's, not the entity itself.
        The Chairman. OK. So you don't think the sky's falling and
    we're doing just fine in the race. Everybody on the panel agree
    with that? Anybody like to comment or respond? Mr. Murphy?
        Mr. Murphy. As I indicated, I mean, factually, the U.S. has
    led in a number, first, for 5G, with the first deployments in
    the fourth quarter of 2018 followed by more commercial systems
    in April 2019, the first millimeter wave, the first to deploy
    low-band spectrum nationwide with T-Mobile, the first with
    virtual network solutions in Verizon.
        So it is factually incorrect to say that non-Chinese
    vendors are leading and there's a disadvantage [Off microphone
    comments]
        The Chairman. We may have a bit of a bug or two with our
    public address system.
        Let me put it this way and be careful how I choose my
    words. Many of us are concerned that we may lack in affordable
    and viable alternative for end-to-end communications equipment
    to compete effectively in the global market.
        What can the U.S. do to strengthen its supply chain
    security requirement and is there in fact, Mr. Berry, we'll
    start with you, a viable alternative to Huawei and ZTE
    equipment available in the market? Mr. Berry and anyone else?
        Mr. Berry. Thank you, Mr. Chairman. Well, first, what you
    did in the Secure Trusted Act, you know, was a monumental
    movement forward because you identified the need for the FCC to
    create a list of suggested replacement, i.e., providers,
    trusted vendors, that are available to everyone.
        Most of the smaller carriers don't have the technology, not
    the technology but the employment, you know, gravitas to do all
    the research to identify what is a trusted provider. So that, I
    think, is going to be a huge improvement on the supply chain.
        I think it will also lead to some of our members, and we
    not only have Nokia and Ericsson sitting at the table but some
    of the new entrants, like Mavenir and Parallel and others that
    are U.S.-based, looking for new technologies, and I think that
    requirement that the Federal Government identifies secured
    communication providers, equipment providers will help us move
    forward quickly on alternatives.
        I agree, I think we need to be ever vigilant on that, but I
    don't think it's an impossible task, and I think the bill that
    you just passed has done two things: provide information on a
    continuous basis and with creating a list, you have essentially
    directed the Federal Government to be involved.
        I don't think it's a one-shot pony. I think they're going
    to have to be involved every day providing good guidance to
    carriers throughout the United States.
        The Chairman. Ms. Keddy.
        Ms. Keddy. Thank you.
        The Chairman. If you would move that microphone? It's
    pretty long for a petite person.
        Ms. Keddy. Thank you. So I think the U.S. has been involved
    and I believe that the focus should be on innovation.
        If you look at 4G, we had many companies that didn't exist
    before, like ride-sharing companies, Airbnb and all. So the
    faster we have widespread roll-outs across the Nation and sort
    of just the first, the better off we are, and I thank you for
    many of the acts, including the Telecommunications Act, where
    R&D is invested and it's a starting point.
        We believe that the government can do more to help new
    entrants and while maintaining existing incumbents, so that we
    have a diverse supply chain. Virtualization is a key and the
    faster we have widespread deployments, including with spectrum
    and all, the better off we are because the innovation about 5G
    is really focused on other industries, like the power that we
    give to consumers in 4G. We would like to bring it to other
    industries, like aviation, agriculture, and other economies,
    and centers also are important.
        Thank you.
        The Chairman. Mr. Boswell, would you like to weigh in
    briefly?
        Mr. Boswell. Thank you, Chairman Wicker. Yes, I think
    Ericsson's been a leader in secure 5G not only in the U.S. but
    worldwide in rolling out networks and the reason is we've been
    planning for this for a decade. We've been building the
    standards and getting radios ready for what is coming right now
    for a long time.
        Going back to 2015, Ericsson radios that are in the field,
    of which we have several hundred thousand, are ready for 5G
    today with software upgradability. So that kind of foresight
    and planning has allowed us to actually kind of be ready to go
    full steam ahead on that race to 5G, given that other kind of
    accelerators line up, as well, such as spectrum and small cell
    siting and making sure our workforce is skilled and ready, as
    well.
        The Chairman. Thank you.
        Senator Cantwell.
        Senator Cantwell. Thank you, Mr. Chairman, and before I get
    into questioning, I would wonder if we could--I'm a little
    uncomfortable today not seeing a press table. I know that we
    have press in the room, and they look like a resilient bunch of
    people who are just writing away no matter what.
        But I would feel more comfortable if we asked Senator Blunt
    where the press table is supposed to be in the room. Then, we
    could accommodate both the press having a place to write and
    feel comfortable here and having some audience participation.
    So I'm sure he's working on it or something. Well, let's ask
    him when he comes.
        OK. To the 5G question, Ms. Keddy, I hate to say decades
    ago I was involved in trying to fight a past the Democratic
    Administration on the Clipper chip. I felt that was a bad idea,
    too. The notion that in the 1990s we thought the government
    should have a backdoor to ease our concerns about great
    encryption capability, and I kept thinking instead of saying
    Intel on inside, you were going to be saying U.S. Government
    inside.
        So it didn't work when we thought about it, and it
    shouldn't work today. And since you're a global company, and
    Dr. Lewis, your comments about we're not really that far
    behind, I don't know why we can't get parts of Asia, parts of
    Europe in a more unified voice around communications equipment
    that any company that has a government that is demanding access
    to that technology as a backdoor is just unacceptable.
        We need to just build this international alliance to just
    say it's just unacceptable. You want to be a mature economy.
    We're not against your companies. We're against the fact that
    you demand a government backdoor to them. That's what we're
    against. So I don't know why we can't build that international
    coalition and communicate.
        So, Dr. Lewis, Ms. Keddy, either one of you?
        Ms. Keddy. We look at information security in two ways,
    right, and so security has information security and supply
    chain security and we look at how do we have security
    constructs in both ways.
        As far as to your question on backdoors, I think that the
    government knows a lot more details than us and so we look
    forward to working with the government to support the requests
    that is provided versus being able to mandate it as a private
    company.
        Senator Cantwell. Dr. Lewis.
        Dr. Lewis. Thank you, Senator. First, the U.S. could
    benefit by making it clear to other countries that there are
    alternatives to Huawei.
        When I travel to Asia and to parts of Europe, I hear this.
    Well, Huawei's the only place we can buy from. That's complete
    nonsense, but we have to do a better case of getting the
    alternatives out there.
        Second, as I think some of my fellow panelists have
    mentioned, U.S. support for exports would be helpful. That
    would help us not match the Chinese but at least reduce what we
    used to call the Huawei premiums. So export support is a
    crucial part.
        Finally, we are starting to build an international
    coalition. It's been a little bumpy. It's not NATO. It's not
    ASIAN, but it has members of both, and we could perhaps be a
    little smoother in our approach sometimes. It doesn't help to
    threaten people, but I see an international coalition emerging.
        Senator Cantwell. Ms. Keddy, did you want to add something
    to that?
        Ms. Keddy. If I can add to Dr. Lewis' point on ensuring
    like a standard base but diverse supply chain that gives more
    choices, that will also help the options but in the case of
    these events do happen, I wanted to emphasize the notion of
    technology problems to technology solutions, so we can prevent
    and detect all of these.
        Senator Cantwell. Well, I think, Mr. Murphy, you're the
    CTO, right? So you're probably our most technical person here.
    I mean, Ms. Keddy, you probably have, but this is--look, we
    should just like--you know, there are lots of examples of where
    even if you had to put, you know, the crown jewels into some
    sort of repository or something just to get cooperation and
    interoperability, you could do that, but this notion that we're
    not fighting this on a big broad principle is just crazy.
        Like you've got to fight the principle. The principle is we
    shouldn't live in a world today where any government has a
    backdoor to technology. Like that's just not the way we want to
    deploy, and that has to be consistent. It might be 5G now but
    it will be something else later. And the more we communicate
    that--the reason why I bring up the Clipper chip is we made the
    same--well, we almost made the same mistake.
        You know, the U.S. Government started saying, oh, my gosh,
    don't want that level of encryption. I got to have a backdoor.
    We're like no, we're not having a U.S. backdoor.
        So I think this is the conversation that now needs to take
    place in Asia and hopefully because it has many ramifications
    for cloud and cloud services. That's one of the things they've
    been demanding. Oh, you want to do cloud business in Asia? This
    is what you got to do. Give us access. No, we're not going to
    give them access to that.
        So this is a global effort we need to communicate about.
        So thank you. I'm sorry. I think----
        Senator Gardner. Thank you, Senator Cantwell.
        Senator Fischer is next.

                    STATEMENT OF HON. DEB FISCHER,
                       U.S. SENATOR FROM NEBRASKA

        Senator Fischer. Thank you, Senator Gardner. Thank you,
    Senator Cantwell.
        I am glad that the Secure and Trusted Communications
    Networks Act made it on to the President's desk last week, and
    I was proud to be a co-sponsor of that companion bill in the
    Senate last year.
        This legislation is critical to create a stable and secure
    foundation for America's communications networks. However, it
    will also set the stage for carriers' ability to meet timelines
    established in the legislation and how applicants can request
    reimbursement.
        Mr. Berry, are there still small providers who haven't been
    able to secure commitments from trusted vendors to assure that
    they can deliver the quantity of equipment needed for the
    networks within those timelines?
        Mr. Berry. Thanks for the questions, Senator. Yes, that is
    a difficult task for many small carriers.
        What we're seeing with this legislation, especially when
    you kick-started the concept of you may actually be able to
    replace that covered technology with new technology, our
    carriers are already out there getting vendors and getting
    equipment manufacturers to give us quotes and to give them
    estimates of what it's going to take.
        As a matter of fact, several on this panel have already
    been involved with detailed conversations with the small
    carriers. Our intent is not to let any moss grow on this stone.
    We want to make sure that we're out there trying to find the
    solution ASAP and, yes, new technologies could in fact create
    new security opportunities, but there is a time lag. There is a
    flexibility, a need for flexibility.
        Some of the technology may not be ready to deploy today. It
    may be ready in five-six-eight months, a year and a half. So we
    need to measure twice and cut once and I think that maybe the
    small carriers, especially with this Act, will get the
    information they need and they're certainly ready and willing
    to tackle the challenge.
        Senator Fischer. You know, that information is going to
    require them to have information on how to apply for the
    funding, as well. That's going to be a big deal as we move into
    this for any number of reasons, not the least being security.
        What are you hearing from your members? What are the
    questions you're hearing the most from your members who are
    going to have to Rip and Replace?
        Mr. Berry. I think the Number 1 issue is now that we have a
    goal, the goal is no covered equipment in your network. The
    next question is, OK, how do we prioritize that? Which elements
    do we take out first? Do we take out, you know, everything from
    the antenna back to the core? How do you do that? Do you go
    from a 3G to a 4G to a 5G solution?
        You know, part of the problem is many of the vendors are
    not making the 2 or 3G technology that may be in some of these
    networks. So how do you get to a 4G technology when you have 3G
    technology but you have voice?
        So it may be necessary to go to a 4G LTE VoLTE product so
    you replace old technology with a newer technology that
    actually has voice. So those things are real sort of in the
    weeds but they're very detail-oriented and it's what our
    carriers think about in terms of how do we maintain
    connectivity, and it is like building a separate network while
    you operate a network so you can transition on day one and
    actually you'll be able to make a call.
        Senator Fischer. Thank you. Dr. Lewis, you stated that the
    bans on Huawei network technology, such as in the United
    States, Japan, Australia, also, that that is the only way to
    eliminate risk entirely.
        A couple weeks ago, I was in the U.K. with a handful of my
    colleagues and we met with the government there and obviously
    we expressed some concerns about their recent action, as well
    as the influence that that may have on actions within the EU.
    Those are security concerns.
        The U.K. is a member of 5 Eyes. That causes us to take a
    step back and decide that special relationship we have with the
    U.K., how do we move forward on that when it comes to security
    measures.
        Can the core really be securely isolated in a way that some
    of these countries are talking about in theory? The Chinese
    don't like this. Some countries are talking about this core and
    how it's going to be secure and we don't need to worry and, you
    know, my comeback is we have to put national security above
    price. How would you answer that?
        Dr. Lewis. Thank you, Senator. I think that the politics
    and the commercial motives that our European partners have will
    probably drive them to adopt a partial ban. That's not in the
    best interests of their security. We have the discussion of a
    backdoor, but they will be motivated by China's economic power.
        That means for us, there are two things. First, we can help
    them do better at making sure the partial ban eliminates risk
    as much as possible. There's debate over this. I would defer to
    my more technologically astute colleagues, but there are some
    companies and some intelligence agencies that say a partial ban
    could be made to work in the near term.
        The second issue we need to bear in mind is this is not a
    finished deal. The British have said, perhaps they said it to
    you, that their opening position is limitation of 35 percent,
    but they're willing to move that back as we go forward. So we
    need to help them to make it work.
        Now we need to help them get to move in the right direction
    later on.
        Senator Fischer. Thank you very much. Thank you, Cory.
        Senator Gardner. Thank you, Senator Fischer.
        And, Senator Rosen, in a different time zone, you may begin
    your questions.

                    STATEMENT OF HON. JACKY ROSEN,
                        U.S. SENATOR FROM NEVADA

        Senator Rosen. Thank you. Thank you so much. Thank you all
    for being here and for this very important hearing.
        I want to talk about how we promote the U.S. and its
    wireless, how we really lead in this area because we are a
    global leader in wireless technology and performance and
    innovation, and the U.S. really is at the cusp of a
    technological evolution.
        Just as the 4G wireless industry created millions of jobs,
    ushering in an era of social media, the gig economy, mobile
    apps, 5G is going to fundamentally change the way that our
    industries operate.
        So for the U.S. to remain a leader in this space, our
    response must be one of coordination and cooperation. This
    means working with private sector, supporting R&D and emerging
    technologies, coordinating with the relevant agencies and
    participating, I believe really importantly, in standard-
    setting where much of the foundational technology that makes 5G
    possible.
        Homeland Security Chairman Ron Johnson and I actually
    recently introduced the bipartisan Promoting the United State
    Wireless Leadership Act of 2020. We want to ensure the U.S. has
    a seat at the table in the wireless standard-setting process
    because our global economic competitiveness depends on our
    participation in setting good standards for the next
    generation.
        So, Dr. Lewis, I'd like your opinion on how important it is
    for the U.S. Government to participate in these standard-
    setting bodies, including the International Telecommunications
    Union, the 3G Generation Project, and I'd also like you to
    comment on what is the impact of our participation or lack
    thereof on technologies, including telemedicine, our connective
    devices, our smart grids.
        Can you speak to that, please?
        Dr. Lewis. Yes, thank you, Senator. So there is a
    distinction between the ITU and 3GPP. One of the questions that
    is emerging is what the role of the U.S. should be in the ITU,
    which is dominated by powers that are hostile to us in many
    instances.
        3GPP, as you've heard from some of my colleagues, we are
    doing better. It's essential that we maintain a strong U.S.
    presence there and if that includes funding for U.S. Government
    participation, that would be valuable.
        The dilemma if we withdraw, and I'm sure my other
    colleagues will agree with this, the dilemma is if we withdraw
    is that China seeks to dominate the standards process. It seeks
    to politicize it and it seeks to have it pick China's
    technology even though that technology is not the best
    available.
        So it's crucial for us in all the markets that 5G will
    enable to maintain a strong presence in the standards bodies.
        Senator Rosen. Well, that's great because it really leads
    to my next question about telecom equipment manufacturing.
        So with the absence of a major U.S. alternative to foreign
    suppliers of 5G networking equipment, our wireless carriers
    rely on just a few companies to manufacture the next generation
    of 5G technology. Some U.S. companies, they sell switches and
    routers that reside in the innermost parts of the carrier's
    network but none actually build the wireless infrastructure
    that allows cell sites to connect with smart phones and mobile
    devices.
        So in light of the Coronavirus that we've been dealing with
    in the last few weeks or months, it's clear how dependent we
    are on goods and commerce from other countries. A breakdown in
    our supply chain highlights how interconnected we are and the
    impact it has on our economy and our security.
        So as we continue to discuss securing the 5G supply chain,
    can the U.S. regain a footing in 5G equipment manufacturing?
    What do you need from us to be able to do that or should we
    look to possibly 6G to regain our leadership position in the
    global markets? Anyone like to take that, please?
        Mr. Berry. Let me just tackle that a little. I mean, Number
    1, I don't think you can get behind on your Gs ever. We can't
    avoid engaging in the 5G solutions, but I think some of the
    technologies that our companies not only here at the table but
    the new companies in the United States are finding to not only
    replace those functionalities of equipment with software
    solutions, i.e., virtualization of the network, everywhere from
    the antenna back to the core and to the interface, you know,
    with the devices, I think we're on the cusp of finding
    significant opportunities for cost reduction and new
    competitors in the marketplace.
        And so I think that that is one of the areas that we need
    to maybe rethink how we provide, quote unquote, equipment and
    functionality to the network and I think some of the
    specialists here that are engineers could explain that also
    from their perspective.
        Senator Rosen. What can we do in Congress to help
    facilitate us being a leader in that?
        Mr. Berry. Well, I think what you've done in the bill, the
    Secure and Trusted, is a huge step forward, especially for the
    small carriers that don't have the engineering staff to know
    exactly the consequences of the technology, but there are a
    couple bills sitting around in the House and the Senate that
    recognizes this as a priority and I tend to concur that we need
    more government inclusion and involvement with the private
    sector as we move forward in the standard-setting bodies and I
    think that would be a priority for the Nation as a whole.
        Senator Rosen. I know I've exceeded my time, but can Ms.
    Keddy answer?
        Senator Gardner. Please.
        Senator Rosen. Thank you.
        Ms. Keddy. I just would like to add like incentives to
    enable a widespread deployment across like rural and urban is
    very important and also virtualization and open source efforts,
    very vibrant new entrants that can be helped so that we have a
    very diverse supply chain is important. So both these things,
    including other telecoms acts that have R&D as a starting
    point, which is good, but we'd like to see it much more toward
    the innovations and incentives and other things for deployment.
        Senator Rosen. Thank you.

                    STATEMENT OF HON. CORY GARDNER,
                       U.S. SENATOR FROM COLORADO

        Senator Gardner. Thank you, Senator Rosen, and seeing the
    Chairman has not returned, I'll move forward with the questions
    I was going to ask.
        Mr. Berry, Congress has finally succeeded in passing Rip
    and Replace or to some Replace and Rip legislation to ensure
    Huawei is removed from all U.S. telecommunications networks.
    I've got deep concerns about Huawei and the intelligence that
    we've received, which functions essentially as an arm of the
    Chinese Central Government.
        I'm thankful that your member companies are hard at work to
    transition their equipment and to seek new vendors and while I
    appreciate the dedication, I'm also hopeful that we can provide
    them certainty to make sure that we ensure this Rip and Replace
    model is not the default approach to network security in the
    future.
        Your members and other interested parties explored these
    ideas at a series of rural engagement initiative events and
    thank you very much for hosting one in Colorado, my home state.
        What more can Congress do? What more can Congress be doing
    to ensure better communication between the Federal Government
    and companies of all sizes in the telecommunications industry
    when it comes to long-term network security?
        Mr. Berry. Thank you, Senator, and thank you for
    recognizing the fact that our small carriers, as you may say,
    have spent a lot of time on the educational side and that's one
    thing, I think, that this Committee has made enormous progress
    on is creating the focus and creating the education about what
    are the security threats, what are the solutions, and I can't
    stress the fact that you have now directed some certainty in
    their lives going forward, not just for the carriers that have
    covered equipment in a network but if you're a small carrier,
    you can't afford to make the wrong decision and deploying your
    resources, especially when you have limited capital to invest.
        And so I think the industry and the vendors in our
    industry, at least those that are CCA members, are stepping up
    to the plate and I've seen a lot of activity internally with
    their companies to say this is a problem, we need to be part of
    the solution, and I can't congratulate them more on that.
        But thank you. The U.S. Chamber of Commerce joined us in
    those sessions. I must say that CISA was the specialist entity
    within the Homeland Security. We couldn't have been more
    pleased with the very frank discussions they shared with our
    members throughout all those meetings.
        Senator Gardner. Very good. Thank you, Mr. Berry.
        I have a question for both Mr. Boswell and Mr. Murphy. I'll
    start with Mr. Boswell. Obviously the concerns about Huawei and
    insecurity with Huawei made clear our country's
    telecommunications companies and many of our allies are rapidly
    seeking new physical network vendors. That will largely benefit
    non-Chinese companies, like Ericsson.
        You never mentioned Ericsson's presence in China in your
    testimony, but Ericsson's website talks about the company's
    long history in China, going back to the 1890s. In fact, it
    says, ``Ericsson has several joint venture companies in China
    and has invested heavily in research and training in China
    which provides a competitive advantage.''
        You've also opened a Joint Research Institute with the
    Beijing Institute of Technology.
        Is Chinese-sourced research incorporated into Ericsson's
    core network products? If so, what protections does the
    security team have in place, including hiring protocols, to
    ensure any Chinese Government-backed activities that might
    otherwise attempt to undermine the security of those products?
        Mr. Boswell. Thank you, Senator. I plan to address all of
    those points that you make. Of course, China is a large market
    and we can't and don't ignore that market or any other market
    around the world, frankly, but we don't have production in
    China for the U.S. market.
        In fact, back in 2018, we proactively before it was kind of
    a thing to be talking about, we started proactively executing a
    regionalization strategy for our supply chain to put
    manufacturing and development as close to the customer market
    as possible in the United States.
        Senator Gardner. Can I interrupt? Maybe we could follow up
    with written questions for the record.
        Is Chinese-sourced research incorporated into Ericsson's
    core network products?
        Mr. Boswell. So from a software standpoint, all of our
    software from a development standpoint actually funnels through
    Sweden and all of our software is scanned, verified, signed,
    and centrally distributed from Sweden. That gives us tight
    control and transparency----
        Senator Gardner. And the answer is----
        Mr. Boswell.--in chain of custody----
        Senator Gardner. The answer is yes, you believe it's
    properly filtered through other vendors and systems?
        Mr. Boswell. Actually most of the development items from a
    Chinese perspective would be for that Chinese market from a
    manufacturing standpoint. So we do manufacture things in China
    for the Chinese market, for example.
        The majority of our R&D and development is actually in
    Europe and North America.
        Senator Gardner. So none of that Chinese work research that
    you're doing at the Beijing Institute of Technology would find
    its way through to products in the U.S.?
        Mr. Boswell. I would have to follow up specifically about
    that, but we do maintain a tight chain of custody of our code
    with check-in/check-out policies to ensure that we can track
    back where specific things have been sourced from.
        Senator Gardner. Thank you. I'm going to quickly switch to
    Mr. Murphy. Nokia has nearly 50 offices across mainland China
    and China accounts for more than 10 percent of Nokia's sales,
    according to the company's website. Nokia also operates six
    research and development innovation hubs, three manufacturing
    facilities, and employs 7,000 people throughout China's
    footprint.
        Your customers include China Mobile, China Telecom, and
    China Railway, among other Chinese Government entities.
        How would you answer the same question that I just asked
    Mr. Boswell, how are you protecting the security infrastructure
    and what security protocols do you have in place in China to do
    so?
        Mr. Murphy. Thank you, Senator Gardner. So perhaps to
    divide that into two parts, one is manufacturing and one is
    R&D.
        On the manufacturing side, we have a number of
    manufacturing plants around the world and depending on the
    recipient of the product, we will make the best choice for
    that. So, for example, in the case of the U.S., there's no
    equipment that is manufactured in China.
        On the R&D side, as you noted, we do have research in
    China, but from my testimony, we apply the same standards for
    our Chinese employees as we do for other global employees,
    meaning they must sign ethical standards. It's a prerequisite
    of employment. Also, software goes through a design for
    security verification test. Vulnerabilities must be resolved
    and documented.
        So the fact that they're physically located in China kind
    of is a little bit irrelevant in terms of producing a secure
    product.
        Senator Gardner. Thank you, Mr. Murphy. I apologize. I
    cutoff others. I'm a minute and 30 seconds over. So I'm going
    to cut myself off and I believe the next--Senator Lee, are you
    ready--excuse me.
        Senator Thune is next. Sorry.

                     STATEMENT OF HON. JOHN THUNE,
                     U.S. SENATOR FROM SOUTH DAKOTA

        Senator Thune. Thank you, Mr. Chairman, and I want to thank
    Chairman Wicker for holding today's hearing on a very important
    issue and I think we all would agree that with increased speeds
    and greater capacity, 5G networks are going to unleash new
    innovations and enable breakthroughs in a variety of sectors,
    from agriculture to health care.
        There's a lot of promise with these new and advanced
    technologies, but the United States is only going to be able to
    deliver on those promises if we maintain the security of our
    communications networks, both here at home and abroad.
        The decisions that we make today with our trade partners
    around the world are going to impact our national security and
    economic outcomes for years to come.
        I intend to introduce legislation this week to ensure the
    security of our communications infrastructure as a clear
    negotiating objective of U.S. trade policy.
        Unfair trade practices of communications equipment
    suppliers owned or controlled by a foreign government should
    not be tolerated, period.
        Mr. Lewis, when we think about future trade agreements with
    the United Kingdom and other countries, should the security of
    our communications networks be at the forefront of those
    conversations?
        Dr. Lewis. Thank you, Senator. I think this legislation is
    long overdue. It is essential. Of course, it should be part of
    our discussions with our allies and partners and in fact in any
    trade agreement. So I think this is a great step forward. Thank
    you.
        Senator Thune. Thank you. Mr. Boswell, Mr. Murphy, 5G
    networks have potential to generate greater virtualization in
    software-defined functionalities.
        Can you talk about some of the security benefits as well as
    the challenges that exist with these new network elements? Mr.
    Murphy or Mr. Boswell, either one.
        Mr. Boswell. Sorry. Thank you, Senator. So, of course, 5G
    will become more virtualized and software-defined and what we
    mean by that is that the intelligence of the network will be
    located more in the cloud or in some cases closer to the edge.
        So distinctions between different parts of the network may
    become blurred. It also actually gives us some distinct
    advantages as we bring in new security technologies.
        Now 5G will be built on what is already a very secure 4G
    infrastructure, but it does bring new tools to the toolbox, so
    to speak. The new architectures that we will roll out and the
    types of technologies we will use allow us to do things like
    additional encryption across the network, enhanced
    authentication and more granular data access control for
    enhanced privacy protection for subscribers. I think we would
    all agree that's very important.
        In addition, we'll have greater in-network segmentation
    that can provide real-time prioritized network defense and
    improved resilience. The availability of the network is
    actually that's a key cornerstone of security, as well,
    availability, in addition to confidentiality and integrity.
        So there are new technologies that we'll see here, but
    ultimately it's about how we design and build in, implement,
    and operate those networks, as well, on top of what we see in
    standards.
        Senator Thune. Mr. Murphy.
        Mr. Murphy. Thank you, Senator Thune. So 5G raises the bar
    and lowers the bar at the same time. So it raises the bar in
    the sense that 3GPP specifications have resolved many of the
    vulnerabilities that used to exist in 4G. At the same time,
    we're moving toward distributed and virtualized networks, which
    one could argue lowers the bar, meaning they're more
    vulnerable.
        So we still need to take action on the product side as both
    Mr. Boswell and myself have noted in design for security or
    integrity protections in the things that we produce, but at the
    end of the day, no matter what we do, there will always be a
    vulnerability that can be infiltrated and thus it always comes
    back to trust in the supplier themselves and this is where the
    behavior, the ethics, the historical performance and behavior,
    and the governance it puts on securing the products it produces
    is the most important.
        Senator Thune. Thank you. Mr. Berry, last week the Senate
    sent legislation by Chairman Wicker to the President's desk
    that would help rural telecommunications carriers remove
    equipment from high-risk vendors, like Huawei and ZTE, from
    their networks and replace it with secure telecommunications
    equipment.
        In your testimony, you suggested the lack of availability
    of a properly trained workforce may impact the transition
    process that these smaller carriers will have to complete to
    remove the compromised equipment.
        How will legislative efforts like the Telecommunications
    Skilled Workforce Act that I introduced with several of my
    colleagues on this Committee earlier this week help ensure the
    necessary workforce is in place?
        Mr. Berry. Thank you, Senator. Yes, S. 3355 is actually key
    to being able to stay up with the growth, the expansive growth
    of 5G. It would be a shame to lose the economic benefits that
    this new technology promises if we have a lack of trained labor
    force.
        I think it would be a great move. We support it. There's a
    lot going on in the wireless world. Not only do you have the
    600 megahertz that we're repurposing, that's finishing up,
    you've got a lot of carriers in rural America that they may
    only have access to their towers and to their facilities for
    maybe two or 3 months out of the year because of weather and
    other climate issues.
        So having a crew that's available and the technology to
    deliver, you know, the labor force is critical and without it,
    we'll not make that transition. So thank you so very much.
        Senator Thune. All right. Thank you, Mr. Berry. My time has
    expired. Thank you, Mr. Chairman.
        The Chairman. Thank you, Senator Thune.
        Senator Lee.

                      STATEMENT OF HON. MIKE LEE,
                         U.S. SENATOR FROM UTAH

        Senator Lee. Thank you, Mr. Chairman. Thanks to all of you
    for being here.
        There's what I think one could fairly characterize as a
    broad consensus that there are vulnerabilities in the network
    and that the use of Huawei equipment within the networks poses
    a risk of access by the Chinese Government certainly for
    espionage purposes and potentially for operational control
    purposes. Either way, this is troubling.
        It does seem, however, like there's some debate among
    experts as to whether or to what extent this vulnerability
    exists in equal parts throughout the network. There are some
    who would draw a distinction, based on where the equipment in
    question is located within the network. Some have suggested
    that this makes a difference and that depending on where the
    equipment is, you might be able to manage the risk through some
    work-arounds.
        So, Dr. Lewis, we'll start with you. Given your expertise
    and your experience in this area, can you clarify whether or
    not there is a distinction between the core and the periphery
    of the networks and is that a distinction that could make a
    difference for our security?
        Dr. Lewis. Thank you, Senator. There is a distinction. It's
    increasing under the development of 5G. What used to be done in
    the core in terms of processing can now be done in some cases
    at the edge, given the computing power that will reside in 5G
    networks.
        There is a debate over how to manage this risk, and there's
    a third element here that might involve the use of cloud
    computing as the backbone for some telecommunications
    functions.
        I think the debate is unresolved but if I had to speak, I
    would say if you don't want any risk, don't use Huawei. If you
    decide to use Huawei, you need to work hard to manage that
    risk, but I think it can be done.
        Senator Lee. Do you know that the FCC is having this
    discussion internally in connection with the Rip and Replace
    plan?
        Dr. Lewis. I think that the FCC has come to the conclusion,
    the correct conclusion that the best way to reduce risk in the
    U.S. is to eliminate Huawei equipment.
        Senator Lee. Right.
        The Chairman. And Congress has come to that conclusion.
        Dr. Lewis. Thank you, sir. Thank you, Mr. Chairman.
        Senator Lee. And so for similar reasons, then you would
    also say the same with respect to software. If you try to
    impose a software solution to it, it might mitigate your risk
    but it doesn't eliminate it. In order to eliminate it, you've
    got to rip it all out.
        Dr. Lewis. That's correct. You can reduce risk, but the
    only way to eliminate it is to remove the technology.
        Senator Lee. The FCC's NPRM to establish the Rip and
    Replace program has been criticized, according to some, for
    underestimating its costs, especially when you take into
    account the resulting equipment options, the resulting options
    that will involve less equipment being available. Fewer options
    do tend to increase the price tag and sometimes can produce
    additional costs and additional delays.
        Mr. Berry, is the Rip and Replace price tag of $1 billion
    accurate in your estimation?
        Mr. Berry. Well, Senator, thank you. It's a tough question.
    It's really difficult to actually know.
        Right now, our carriers are going out to the vendors and
    asking for bids and how can you actually replace the
    technology. It's hard to say. I mean, a lot of it is also
    timing and flexibility.
        For example, you mentioned availability of services, goods,
    and equipment, and the ability to actually, you know, build and
    put the new technologies in place. It's a matter of timing and
    the FCC, if you use a cycle of maybe a little longer than a
    year, I appreciate the wisdom of the Committee's legislation of
    a year to kick-start this but I also appreciate the fact that
    you have a flexible opportunity there for the FCC to give
    additional time, and I think with that, you can manage costs
    and I think we'll see as more carriers come in with, you know,
    verifiable cost estimates, as they apply their program to the
    FCC, we'll see if that amount of money actually covers it or
    not.
        Of course, the legislation also provides for unique ability
    to come back and identify additional resources.
        Senator Lee. Just to be clear, does the Rip and Replace
    price tag as we've got it now take into account the increased
    cost of equipment resulting from it?
        Mr. Berry. The increased cost of equipment for?
        Senator Lee. Resulting in fewer options when you're taking
    options off the table.
        Mr. Berry. Well, it's interesting. The timing may actually
    give you more options in the marketplace. Not only do we have
    the legacy of networks that are in place and you're replacing
    those legacy networks with probably existing, you know,
    vendors, suppliers that are in that work space, but you have
    new technologies coming onboard that, as time--if you can wait
    9-10 months or a year, you may be able to reduce your costs.
        So that's the unknown part and I think it's going to
    absolutely require a cooperative effort. We know what the goal
    is, to eliminate the equipment and the capability in the
    networks. How fast you get there will depend on how much cost
    it might cost.
        Senator Lee. Thank you very much. Thank you, Chairman.
        The Chairman. Thank you, Senator Lee.
        Senator Peters.

                    STATEMENT OF HON. GARY PETERS,
                       U.S. SENATOR FROM MICHIGAN

        Senator Peters. Thank you, Mr. Chairman, and to all of our
    witnesses today, thank you for some excellent testimony here
    today.
        Mr. Boswell, this question is posed to you. With 4G, we
    have hardware choke points to check, maintain, and improve
    system security, but as we push to move from hardware to
    software in order to allow more U.S. companies to participate
    and take control of our supply chain, a question is can you
    describe how companies will have the same ability to check the
    cyber hygiene of software if there is no hardware choke point?
        Mr. Boswell. Thank you, Senator. Yes, I would be happy to
    describe that, what we feel is a process certainly of top
    priority for Ericsson and my area of responsibility is security
    of our network products and integrity of our supply chain, and
    I believe that it focuses on three key pillars: transparency,
    traceability, and trustworthiness. I'll talk a little bit about
    each one, if that's OK.
        Senator Peters. Yes.
        Mr. Boswell. From a transparency standpoint, so we do at
    the beginning code testing, vulnerability scanning, a privacy
    impact report, hardening guidelines, and other things on every
    release of code, and then we're very transparent in the process
    of how that and how we do that and those results are shared
    with the customers for all of those products, as well. So we're
    very open there.
        On the traceability aspect, all of our software is scanned,
    verified, signed, and distributed in and from Sweden and that
    actually gives us a lot of tight control over our software
    development life cycle and the traceability of that supply
    chain with things like check-in and check-out procedures at the
    software level, and it provides a chain of software custody
    that ensures authenticity and integrity of the code once it has
    left Ericsson.
        And then when it's deployed on a radio, for instance, with
    a customer and it boots up, they can be sure that that is
    verifiable and authentic code and it's going on secure and
    authenticated hardware, as well, because we put our
    certificates all the way down at the chip level of that radio.
    That gives us what we call a hardware route of trust all the
    way from the physical aspect of the radio to the software
    that's running on top of it.
        And last, from a trustworthiness standpoint, of course, the
    trustworthiness of the network is going to be more than just
    the security and integrity of products. It's also operational
    procedures and transparency, how you do deployments, but also
    are you operating under the Rule of Law and under an
    independent judiciary. All of these things factor into
    determining trustworthiness of a vendor.
        So we try to convey some of that information through things
    like the DHS Supply Chain Risk Management Task Force and giving
    guidance from a government and industry perspective to
    customers and carriers and enterprises and the rest of the
    world on here's things that we think make us secure and high-
    integrity supply chain.
        Senator Peters. All right. Thank you. Mr. Berry, certainly
    all the large network providers are building 5G and they're all
    committed to cyber and we hear that loud and clear.
        My concern is that some small-and medium-sized wireless
    ISPs have fewer than 10 employees. Some of them can't afford to
    have a full-time cybersecurity officer around the clock, as you
    know.
        So what recommendations do you have for Congress to
    incentivize small- and medium-sized wireless ISPs that serve
    our rural communities? How can we assist them so that they can
    have a robust cybersecurity program but maintain profit
    margins?
        Mr. Berry. Thank you, Senator. You're absolutely correct.
    That is a huge challenge for many of the small carriers
    serving, you know, isolated areas throughout the United States.
        I think the bill does a phenomenal job of saying let's
    share information. Let's make sure that that information is
    shared with small providers. So CISA--which is the Homeland
    Security, they also are putting field offices out there and
    saying, listen, here's your contact. I would recommend that
    every carrier, whether it's WISP or a small wireless provider,
    know who those contacts are and most states have contacts and
    talk to them on a regular basis.
        When the information gets out on this suggested list of
    providers and you have a Federal program through CISA, the
    Homeland Security, that can give you the data you need, you can
    get that, you should talk to them all the time and they will
    give you a head's up. They will let you know if this is a
    problem or if you are going to experience problems.
        I've been very impressed with the new CISA operation. I
    think it's only a year or so in operation and they're doing a
    phenomenal job.
        Senator Peters. That's good to get that assessment. Is
    there more that they can do?
        Mr. Berry. Yes, I think there's more they can do, but I
    think the U.S. Government, in conjunction with industry, are
    doing a much better job of bringing some transparency to this
    issue. I was at a conference out in Miter, which is, you know,
    quasi-public/private entity, huge attendance from U.S.
    Government entities, and I was really surprised at the quality
    of data exchanged and the quality of interest from every
    military operation to the private sector, including many of the
    companies represented here.
        Senator Peters. Great. Thank you for your answer.
    Appreciate it.
        The Chairman. Senator Sullivan.

                    STATEMENT OF HON. DAN SULLIVAN,
                        U.S. SENATOR FROM ALASKA

        Senator Sullivan. Thank you, Mr. Chairman. I want to thank
    the witnesses for this very enlightening hearing and testimony,
    thank the Chairman.
        Dr. Lewis, I want to talk a little bit about the issue of
    reciprocity with China. Senator Van Hollen and I last week
    introduced what is called The True Reciprocity Act of 2020, and
    as you know, in a whole host of areas, media, investment,
    economics, there's not a reciprocal relationship. They can do
    things over here that we can't do over there, and as you also
    know, Huawei, I mean, let's face it, I read the intel, they're
    clearly ultimately controlled by the Communist Party of China.
    Whoever says that's not the case doesn't know what they're
    talking about, and clearly subsidized.
        But let me give you something that I find very disturbing
    that relates to reciprocity or the lack thereof and I'm
    wondering how we can address it.
        Huawei has recently begun to file patent infringement
    lawsuits in the U.S. against its perceived or actual U.S.
    competitors, U.S. companies. So specifically they've filed a $1
    billion patent infringement case against Verizon claiming over
    $1 billion in damages.
        Could Verizon go to a Beijing court and file a patent
    infringement lawsuit against Huawei? I mean, everybody's
    laughing. What's the answer? Would they be treated fairly if
    they could? You can say no. I mean, I think I want to get to a
    broader point.
        Dr. Lewis. That's a quick answer. No.
        Senator Sullivan. OK. Hell no?
        Dr. Lewis. Sure.
        Senator Sullivan. OK.
        [Laughter.]
        Senator Sullivan. OK. But it's actually really an important
    question because in my view, they're using the openness of the
    U.S. society and our courts which are independent, theirs
    aren't, actually as a weapon against us.
        So I'm just wondering not just for you but the rest of the
    panelists, the bill that Senator Van Hollen and I tries to say
    essentially if we can't do it there, you shouldn't be able to
    do it here. It is a broad category.
        But should we look at, for example, maybe limiting
    discovery if--I mean, Huawei is going to try to use this not
    only to intimidate American companies but in the discovery
    process maybe try to get trade secrets, maybe try to get
    information from our tech companies, from our telecoms.
        How should we be trying to address this because to me, this
    is a really big problem? They wrote a Wall Street Journal op-ed
    as if they're some kind of, you know, non-controlled party by
    the Communist Party, but do you have any thoughts on that, any
    of the other panelists, and then I have a quick question for
    Mr. Berry.
        Dr. Lewis. Let me start first, Senator, and thank you
    because this is a crucial issue.
        Every time I open the Washington Post or last week's
    Economist and see an insert from China Daily, I feel like we
    are definitely being taken advantage of because the Times or
    even The Economist could not do that in China.
        Senator Sullivan. So that's one of my elements and Senator
    Van Hollen's bills on the media side, right? It essentially
    says we can't go do that in China. Heck. You walk out of the
    Senate and you do a vote, you have a Chinese journalist
    sticking a mic in your face. Can our journalists stick mics in
    Xi Jingping's face? I don't think so.
        Dr. Lewis. This has been a long struggle over Chinese
    espionage and one of the things we've discovered is that if you
    close one door, our opponent will look to find another, and
    unfortunately I believe they use patents and discovery
    associated with patent cases as a new venue for espionage.
        Senator Sullivan. And do you think it's threatening to the
    competitiveness of American companies to have to open up to
    broad-based discovery when there's no way they would allow us
    to do it in China?
        Dr. Lewis. I've only interviewed a few technology companies
    but all of them would agree with you that it's very damaging.
        Senator Sullivan. Well, I will ask the other witnesses if
    you have a view on that and you want to submit it for the
    record, please do. I think it's a really important issue and
    it's a loophole.
        Very quickly, I just wanted to ask Mr. Berry. I was part of
    the co-sponsorship of the Chairman's leadership on the Rip and
    Replace bill.
        Can you speak to some of the other challenges dealing with
    mostly rural and extremely rural and remote carriers that
    Congress or the FCC can undertake as we are looking to
    implement the legislation that the Chairman led and we recently
    enacted in the Congress?
        Mr. Berry. Thank you, Senator. Yes, we mentioned
    accessibility is going to be the key to whether or not we get
    this done in a rational, reasonable way.
        In Rural America, these carriers are literally working and
    operating on a shoestring and trying to keep connectivity while
    you're literally restructuring your entire network is going to
    require a lot of flexibility.
        The FCC, you know, the last Order they did on USF,
    essentially Mobility One, there was some concern whether or not
    there was authority in there to be able to maintain your
    network while you're transitioning. Some of us thought that
    some of the provisions that the FCC had were retrospective in
    nature instead of prospective.
        We all have to get on the same game card on this. If we're
    going to maintain the networks and provide services, especially
    in Alaska, it's so difficult in many areas, you're going to
    have to give a little flexibility to continue to maintain that
    network as you transition out.
        So prioritization of how you do it and I think we're going
    to--just because a generator goes out on a network doesn't mean
    that it's a Huawei product. Yes, that generator may actually
    allow that network to operate. That may have some Huawei, you
    know, goods and product in it, but that's not the reason you're
    maintaining the network and so I think it's going to take a lot
    of cooperative effort and the rural areas are going to be one
    of the most difficult to deal with.
        Senator Sullivan. Thank you. Mr. Chairman, I know that I'm
    the last witness. Can I just----
        The Chairman. Actually, we have Senator Scott here.
        Senator Sullivan. Oh, I'm sorry, Senator Scott. I'm not
    going to even finish my sentence then. I was going to ask for--
    I'll just have the witnesses, if you can submit additional
    comments on my earlier question about the lack of reciprocity
    and the----
        The Chairman. You're going to be given an opportunity to
    say that aloud when I take my second round.
        Senator Sullivan. Oh, well, maybe I'll hang out for that
    then. Great.
        The Chairman. Senator Scott.

                     STATEMENT OF HON. RICK SCOTT,
                       U.S. SENATOR FROM FLORIDA

        Senator Scott. Thank you. Thank you, Chairman Wicker. Thank
    you, Senator Sullivan, for giving me this opportunity.
        [Laughter.]
        Senator Scott. Mr. Berry, could you talk about what we need
    to do to encourage private industry to create alternatives to
    Huawei because if you just read the paper, what you're reading,
    and when you talk to Europeans, they say, well, there are no
    alternatives and so what do we need to be doing to help create
    alternatives?
        And then second, any of you can answer, if you're up here
    in D.C., we all understand the risk of Huawei, but the public
    doesn't get it. I mean, they don't hear it locally hardly at
    all and so on both these, what can we do to encourage and what
    can we do to get the public educated about the risk of Huawei?
        Mr. Berry. Thank you, Senator. I mean that's a tough one.
    What you can do to encourage is exactly what you did in the
    bill. You provided a fund for replacement equipment which means
    it got everyone's attention and, yes, everyone wants to find
    solutions now because there's a potential to pay for it.
        Small carriers don't drive the marketplace normally. They
    don't drive the technology development. This gives us an
    opportunity to recognize that there are some funds to actually
    reimburse.
        On the other side, I think the recognition that there's a
    nefarious, you know, network element out there that needs to be
    replaced gives everyone thought that maybe there's a better way
    to do it, and I think our industry has the capability to
    respond in a very effective fashion very quickly.
        I think that's what we're seeing in the marketplace right
    now and many of those sitting at this table are providing that
    opportunity.
        I know that small carriers really appreciate being able to
    know if they make a decision to go with a certain technology,
    it's on the recommended list. They're not going to literally
    have to go wonder because they can't pay the bill.
        Senator Scott. And how can we educate people better?
        Mr. Berry. Well, it's a good idea. We did three nationwide
    sessions trying to educate our carriers to the risk and we had
    great response not only from Department of Justice, FCC,
    Homeland Security, NTIA, and the White House. Those are the
    types of things.
        The big issue is everything's connected to the Internet
    and, you know, it doesn't matter if it's a switch, a part of
    the RAM, or part of the core, eventually it connects to the
    Internet and just because it may happen in
        Washington, D.C., you could have a plant shut down in
    Florida because of that vulnerability. It's like the chain that
    breaks at the weakest link and I think that's what all these
    interesting discussions are trying to do right now is find that
    weakest link and fix it.
        Senator Scott. When you all were answering Senator
    Sullivan's question, you talked about Huawei using the patent
    process to take advantage of the American system and probably
    other countries.
        Is there anything that we should be doing to penalize
    Huawei for doing that? Is there anything through the patent
    process that we can do that would penalize them because
    companies like Ericsson and Nokia don't do that?
        Mr. Berry. For me, putting on my old hat as I used to be
    counsel to the House Intelligence Committee years ago, the
    nefarious thing about that is that open process, the best way
    to defeat that challenge is potentially through information
    that's classified and cannot be made public and that concerns
    me from my service on the Hill.
        I don't know exactly how you do that in a public fashion,
    but that's a good way anyone can test the knowledge that the
    U.S. intelligence community may have by bringing actions like
    that and I'm not so sure I have a good answer for you.
        Senator Scott. So is there legislation now that protects
    classified information like that that would----
        The Chairman. Well, will you yield to Senator Sullivan?
        Senator Scott. Absolutely.
        Senator Sullivan. Well, I mean, what we're looking at is
    not the classified aspect but just the reciprocal aspect and
    the reciprocal aspect to me is glaring, particularly in this
    case, because our companies can't do that. So one response
    that's pretty much in the bill that Senator Van Hollen and I
    put forward is that you would limit discovery to Chinese
    companies in American courts because we can't do discovery in
    their courts. It seems very fair. Most Americans would, I
    think, instinctively support it.
        If we get all of our allies to do the same thing, then you
    start to really leverage China to quit playing in a way that's
    non-reciprocal.
        Senator Scott. But there's nothing else that from
    classified side that you have a recommendation that we need to
    be doing?
        Dr. Lewis. Well, Senator, one of the issues that's come up
    in this discussion, and it's true, the one way the Chinese
    leaders really dislike is reciprocity and so in discussions
    with Chinese officials, if you say reciprocity as a threshold,
    they are very unhappy.
        We need to consider whether you can use some of the
    sanctions tools available, whether it's putting people on the
    entities list, whether there are other Treasury or Commerce
    sanctions that might offer an opportunity to close off this new
    avenue of espionage.
        Senator Scott. Thank you. I think I'll stop. I think my
    time's up.
        The Chairman. Thank you very much.
        Dr. Lewis, Huawei is on the entity list, it cannot receive
    information from U.S. persons and entities, but it can sue and
    try to get around that through discovery and you and Senator
    Sullivan had a lenghty exchange about that.
        Mr. Berry, is there anything more you'd like to say about
    this issue? Then I'll give our other three witnesses a chance
    to respond.
        Mr. Berry. No, sir. I think it's another way to glean
    information that would not otherwise have been made available
    and I agree with Senator Sullivan that it has to be addressed.
        The Chairman. Would anyone else like to weigh in on that? I
    don't see anyone raising a hand.
        Senator Sullivan. Chairman, can I just make one quick
    point----
        The Chairman. Yes.
        Senator Sullivan.--just to add to this discussion?
        So when I raised the issue of reciprocity with the Chinese
    at very senior levels, including with our Ambassador here but
    also with senior officials in Beijing, it's one of the issues
    where they pretty much acknowledged that there's no reciprocal
    treatment across a whole host of areas, but they say that it's
    still appropriate that it's non-reciprocal because they're a
    developing country. That's literally the answer. That's what
    they say.
        Obviously that's a debatable prospect, but I think true
    reciprocity in the relationship has to be the standard. We get
    our allies to do it, too, we can leverage China in a huge way
    because they don't have reciprocal relationships with hardly
    anybody.
        That's my comment.
        The Chairman. Thank you very much.
        Now as we conclude, let me see if we can cover the Federal
    Advisory Committee. The Communications Security Liability and
    Interoperability Council that the FCC works through, I think we
    call it CSRIC, its mission is to provide recommendations to the
    FCC to ensure, among other things, optimal security and
    reliability of communications systems.
        So, Mr. Murphy, can you discuss why 5G networks will
    require a different approach to communications network security
    compared to 4G and 3G, and then, Mr. Berry, I'm going to follow
    up by asking you concerning the security of the
    telecommunications supply chain. It requires diligence from
    operators to monitor their networks.
        While there's no one-size-fits-all approach to address
    vulnerabilities, what types of best practices are your member
    companies adopting?
        So, Mr. Murphy, would you care to help us on that issue?
        Mr. Murphy. Yes, thank you, Chairman Wicker. So 4G is
    largely dominated by smart phones. 5G will be dominated by
    smart phones and IOT devices and many different types of
    industries and some of those are critical industries.
        Ranking Member Cantwell mentioned the power issue earlier
    this morning. So the potential for catastrophic impacts are
    larger in 5G. Likewise, the network itself is changing in the
    way it's structured, moving toward a more distributed system,
    more virtualized system. So we cannot take what was done in 4G
    and say that was adequate for 5G. We need to look at 5G as
    something that is new and has a higher bar for the security
    processes we implement.
        So that's why we think, for example, this whole issue of
    trust of the supplier comes in to play. It has a more important
    aspect in 5G compared to 4G and likewise on the technical
    level, vendors, such as ourselves and Mr. Boswell with
    Ericsson, we also have to up our game in the security process
    we implement for 5G because it is not the same.
        The Chairman. Mr. Boswell, you are going to have to up your
    game?
        Mr. Boswell. Senator, thank you. Actually, I definitely
    would like to speak on this topic as I serve on the FCC's CSRIC
    that you had mentioned.
        All of our customers are going to be going through a
    transition of some kind as they move into 5G and with this FCC
    Security Advisory Council, we're working on two different
    working groups right now. One of them is focused on stand-alone
    5G security, the other is focused on--the one that I serve on
    is the transition from the other Gs into 5G and I think that's
    an area of extreme importance, especially for the smaller
    carriers.
        The reason is the work that we're doing there is very
    collaborative, colleagues from Nokia, there are many others,
    government and industry. The lessons learned out of what we can
    do and the transition of 5G will be applicable not only for the
    large carriers but also for those small carriers because all of
    them will be in this transition state between 4 and 5G for
    quite a while.
        It's important for us to provide consistent and predictable
    guidance on how do we update security policies and procedures
    to be ready for this new virtualized software-defined
    infrastructure.
        For the smaller carriers in particular, that may be a
    completely new thing for them. The larger ones have been
    virtualizing things and doing some software-defined networking
    stuff for a while.
        So they not only have the challenge of I've got to go put a
    radio on and figure out how to make that work and deliver new
    services but now I've got virtualized infrastructure, as well.
    That may be new for them.
        So we're trying to address this in the FCC Security
    Advisory Council that you mentioned and we appreciate the work
    and the backing from the government that's set that up.
        The Chairman. Mr. Berry.
        Mr. Berry. Thank you, Senator. I guess it's important to
    follow on that with its virtualized components or new portals
    are not inherently more secure in and of themselves. We learn
    how to make them more secure from actual experience and
    practices and that's where CSRIC and the engineers and the vast
    testing activities come in to play because you can share that
    information with carriers.
        Most of the small carriers are trying and still impact
    their networks but, for example, if you go down to C SPIRE in
    Jackson, Mississippi, you go in their NOC, their Network
    Operations Center, they can tell you literally to the minute
    how many adversarial attacks they've had on the network. They
    can tell you how many intruders attempted to get into their
    network and communicate with, you know, entities in their
    network.
        So some of our carriers are actually hiring outside third
    party entities that monitor through dark fiber and other types
    of scenarios everyone that's trying to touch their network. So
    it's a constant thing and without CSRIC and some of the other
    experience-oriented entities that are out there, our small
    carriers would have a very difficult time coming up with best
    practices because it changes, literally the threat changes
    literally every day in some respect.
        So that's a key component and I think not only do you have
    to continue it but I think we're going to have to be probably
    even more energetic in response in the coming years.
        The Chairman. Thank you. Dr. Lewis, something you said
    about partially using Huawei equipment might give someone the
    impression that you are somewhat relaxed about what the United
    Kingdom has done and so I'm just curious to learn what you
    really, really think there. I can handle the truth.
        Dr. Lewis. I am relieved to hear that, Mr. Chairman, and
    let me say that Congress has been the bedrock of the opposition
    to Huawei in the confrontation with China. So your work is much
    appreciated, and I think your comments about how I'm relaxed
    will please my friends in GCHQ. So we've got to look on the
    bright side.
        It's an open debate as to whether you can do the divide
    that the British have talked about and the architectural fix.
    My issue is you have to play the hand you're dealt and that's
    the hand we've been dealt.
        It would be better if they did what Australia did. They
    chose not to do that. They're our closest allies in the world.
    How do we work with them to make it a secure system?
        They might change their mind. We have some leverage points,
    but for right now, like partial ban, not like partial ban,
    that's not the game. The game is how do we make our
    communications with a key ally more secure?
        The Chairman. Three of our witnesses have said today that
    there are a lot of alternatives and apparently the U.K. is not
    convinced. They didn't get that message. Am I on to something
    here?
        Dr. Lewis. I would say that the U.K. received political
    direction possibly from the previous Prime Minister that it was
    important to maintain good relations with both China and the
    U.S., economic relations with China, security relations with
    the U.S., and the British are trying to craft a solution that
    will let them do both. That may not be possible, but I don't
    think the technical debate over whether their partial ban can
    work is over.
        There are even American tech companies that will say with
    the right architecture, with the right setup in the cloud, you
    could make this work. So it's a to-be-determined kind of
    question.
        The Chairman. Senator Johnson.

                    STATEMENT OF HON. RON JOHNSON,
                      U.S. SENATOR FROM WISCONSIN

        Senator Johnson. Thank you, Mr. Chairman. I've got a lot of
    questions, so succinct answers would be helpful.
        Mr. Lewis, I appreciate your testimony. I was in Munich.
    Microsoft was talking about a cloud-based solution that just
    basically leapfrogs the, no offense to Nokia and Ericsson, the
    equipment issue when it comes to 5G.
        I come at this from the standpoint of regardless what is
    best in terms of national security, the reality is Huawei's
    going to exist. There's 1.4 billion people in China, 400
    million in the middle class. They got a good market and they're
    going to have equipment and somewhere around the world that
    equipment is going to be installed and in a global network,
    we're going to come in contact with it. So we need to recognize
    that reality.
        Rather than, you know, trying to impose a policy that's not
    going to be accepted by everybody, we better accept the reality
    that we're going to have to come up with solutions that
    contemplate the reality that Huawei's equipment is going to be
    installed some places.
        Can you speak to that, Mr. Lewis? Then I want to start
    talking to Nokia and Ericsson about manufacturing capabilities
    and capacities and that type of thing.
        Dr. Lewis. Thank you, Senator. I think that's right,
    unfortunately, that when you look at some of the markets in the
    developing world where we have strong national interests, the
    Middle East, Africa, South America, Huawei will be a presence
    there, and so we need to learn how to operate on networks that
    are not perhaps trustworthy.
        We have an opportunity here, though, in the move toward 5G
    and to 6G to work with our allies, to work with our security
    partners to come up with standards and best practices that will
    make telecom more secure.
        So I don't see the British decision as a loss. I see it as
    an opportunity.
        Senator Johnson. Well, I view it as a reality. Speak to the
    cloud-based solution for 5G, you know, basically leapfrogging
    the equipment issue.
        Dr. Lewis. And I'll defer to my other colleagues, of
    course, but what I hear from interviewing many, many companies
    is that this is an alternative. It will lead to greater
    security, but it is somewhere between 3 years and 10 years out.
    So it would be nice if it was here sooner. It will fix our
    problems, make them smaller ultimately. Next year, it won't
    help.
        Senator Johnson. So often here, you can't defeat something
    with nothing, but we have something. We've got Nokia. We have
    Ericsson. How big of a capacity challenge is meeting the demand
    for 5G as it develops and is deployed? I'll speak to both Nokia
    and Ericsson here.
        Mr. Murphy. I'm sorry, Senator Johnson. Cacacity in what
    respect?
        Senator Johnson. Of the equipment that's needed to satisfy
    5G demand and deployment.
        Mr. Murphy. Yes, so it?s growing at a different pace in
    different countries across the world, but at the moment, we
    don't see a significant issue with meeting the equipment
    demand.
        There's a great demand on capabilities which is very
    challenging to meet. However, not so much on the equipment
    side.
        Senator Johnson. But we're always told that Huawei's
    equipment is substandard, is that true or not true? Are they
    advanced or are they ahead of Nokia and Ericsson in terms of
    technology or on par or behind?
        Mr. Murphy. I think it would be false--I mean, it's correct
    to say that Huawei is a formidable competitor. That's partially
    due to the massive research and development arm they're capable
    of supporting due to their domestic market as well as support
    on the sales side from the banks in China.
        However, when it comes from a technical perspective, if we
    go back to the earlier part of my testimony, if we look at
    first in the world, it's actually the U.S. was the first in the
    world to launch 5G back in the fourth quarter of 2018 and then
    more commercial systems in 2019 and we have many more firsts.
        So we do not feel we're at a technical disadvantage in
    being able to keep on par with Huawei.
        Senator Johnson. So China's predatory mercantilism, you're
    talking right now about being supported by, you know, Chinese
    banking. Is there a greater economic support from China? I
    mean, how large an economic disadvantage is Nokia and Ericsson?
    You know, how big a disadvantage is that to Huawei? I'll ask
    Mr. Boswell to answer that one.
        Mr. Boswell. Thank you, Senator. So we certainly believe in
    the security and integrity of our network products and our
    solutions and we think they're the best in the world.
        You asked about kind of a comparison to them. As Mr. Murphy
    said, they're a formidable opponent and certainly a competitor
    on the world stage. Here in the U.S. market, the U.S. enjoys a
    competitive and robust marketplace of secure and high-integrity
    and trusted suppliers, and I think it's important to uphold
    that as an example to the rest of the world.
        We can still go really fast on this race to 5G and do it
    with secure and trusted suppliers.
        Senator Johnson. No offense. You're not answering the
    question. I'm talking about what kind of cost disadvantage are
    you at, both your companies at because of China's mercantilism
    and their state-sponsored support. If it's just a matter of
    EXIM Bank financing this stuff, you know, that's not a big
    deal. If it's Russia or if it's China literally putting
    billions and billions of dollars into subsidizing the sale of
    the 5G equipment, that's a problem. So where are we at there?
        Mr. Boswell. So my apologies, Senator. The finance side of
    that thing is not really my forte. I'm on the security and
    engineering side of our practices at Ericsson.
        However, I would agree with what Mr. Murphy said about
    we're not facing restrictions in terms of our ability to meet
    manufacturing demand in terms of equipment and getting it out
    there and meeting the roll-out demands that our customers are
    asking for. That's both in the U.S. and in the rest of the
    world.
        So we're able to go kind of as fast as our customers are
    wanting us to right now.
        Senator Johnson. So if the Chairman would indulge me, can
    anybody answer that question in terms of the cost disadvantage
    we're at, anybody on the panel?
        Mr. Murphy. I can try. So ironically, 25 years ago, I moved
    to China at this time of the year, and I set up a research and
    development lab and in my lab were two companies called Huawei
    and ZTE, and they developed very rapidly obviously and they
    developed because of government support and the provinces
    purchasing their equipment and research and development done at
    a very low cost, if not free, by universities and government
    research institutes.
        So that at that point in time, I believe that continues
    today. They have very significant support from the government
    and different entities within China in the execution of their
    product developments and subsequently in the sales through the
    financing mechanisms.
        So we do have some disadvantages in that respect. We're not
    having equal level of support from governments to help us. So
    in a sense of what can be done to remediate that or mitigate
    that, I think it's to create a level playing field, both on the
    EXIM Bank-type things but also on the research and development
    side to support vendors like ourselves to have a more level
    playing field both in 5G and especially moving into 6G.
        Senator Johnson. Well, we're not going to steal your
    technology in this, so I can't get an answer that they're 30
    percent below you guys. I mean, I won't get that answer and
    again I've already taken more time.
        Mr. Lewis, I just would like to meet with you at some point
    in time.
        Dr. Lewis. OK. You know, just a quick one on the------
        The Chairman. Is that 30 percent accurate?
        Senator Johnson. No. I was just picking that number out of
    the air.
        Dr. Lewis. There's some evidence that at least in one case
    with the European company, it was at 30 percent discount. In
    other cases, you know, it's been much greater. So we can answer
    that in our question, if you wish.
        Senator Johnson. OK. So we'll do that offline. Thank you,
    Mr. Chairman.
        The Chairman. Go ahead, Senator Johnson. This is
    interesting.
        Senator Johnson. Oh, OK. So answer the question. We need to
    know that. If we're going to--and by the way, I mean, in the
    private sector, if you've got an incumbent supplier that has a
    monopoly that you want to get rid of, you start supporting
    alternative suppliers, and I think we're in the same situation
    here. We've got to--China has taken the wrong path. They're not
    a benign force. They're a malignant force. This is a national
    security issue. So we've got two suppliers here. We've
    obviously helped them here by saying we're not going to allow
    Huawei but we may need to do some support from the standpoint
    of competing against their predatory mercantilism, but we need
    to know what extent that is.
        So again, Mr. Lewis, if you've got some information that
    would be helpful.
        Dr. Lewis. Well, perhaps this is best answered in a
    question for the record, but in conversations with both U.S.
    and foreign law enforcement and intelligence agencies, and I
    don't know if my colleagues would agree, they would tell you
    that if there's a Chinese interest in getting into that market
    and having access to the national telecommunications system,
    they would spend whatever it takes. So it's in hundreds of
    millions in some cases, greater in others.
        Senator Johnson. By the way, that's the kind of competitor
    you don't like competing against. They'll buy the business at
    any price. OK.
        Well, again, we will talk offline and do some questions for
    the record. Thank you, Mr. Chairman.
        The Chairman. Thank you, Senator Johnson.
        So, Dr. Lewis, it's not accurate to say that our allies who
    made a decision that we wish they had not had no one else to
    turn to? That's really not an accurate statement, is it?
        Dr. Lewis. That's correct, Senator. As you've heard from
    our colleagues from Nokia and Ericsson, there are many
    alternatives.
        The Chairman. And I think that's an important take-away
    from this hearing and, Mr. Berry, do you want to have the last
    word?
        Mr. Berry. Thank you, Senator, appreciate it. To respond to
    Senator Johnson, this Committee sent a huge shot across the bow
    of every ally and friend to the United States. You said, this
    Committee said we are willing to share the cost and take the
    cost of ensuring our networks are secure. It doesn't matter
    what the covered equipment providers cost is or is not. They
    can't sell in the United States. They won't have a market in
    the United States.
        So I think what you did on the international front is far
    more important than you may think. What you were willing to do
    here is what you wanted Britain to do, what you wanted Poland
    to do, France, all of our allies.
        Now you have a barricade to stand behind and say can you
    follow our lead and I think that's what you've done here.
        The Chairman. Thank you. It was actually a statement by the
    House and the Senate as a whole on a bipartisan basis and I
    expect the President will be signing that legislation with some
    fanfare in the next few days.
        Thank you all, and I want to thank all of the members who
    have come and gone and I think helped us strengthen our
    understanding.
        The hearing record will remain open for two weeks. During
    this time, Senators are asked to submit any questions for the
    record. Upon receipt, the witnesses are requested to submit
    their written answers to the Committee as soon as possible but
    by no later than Wednesday, April 1, 2020. Cross your heart,
    hope to die.
        And so with that, I want to thank the witnesses and
    announce that this hearing is now adjourned.
        [Whereupon, at 12:02 p.m., the hearing was adjourned.]

                                A P P E N D I X

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

                                     ______

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

                                     ______

        Response to Written Question Submitted by Hon. Amy Klobuchar to
                                Steven K. Berry
        Question. The Federal Communications Commission (FCC) estimates
    that it will cost more than $1 billion for rural carriers to remove and
    replace equipment and services from companies that pose a national
    security threat, such as Huawei and ZTE. In your testimony, you
    emphasized the importance of Federal funding for rural carriers that
    cannot afford to cover these costs and of ensuring that rural
    communities remain connected during the transition to secure 5G
    networks.

       In your view, are additional resources needed to ensure
            rural carriers remain connected during the transition to secure
            5G networks?

        Answer. Congress created the Secure and Trusted Communications
    Networks Reimbursement Program in the recently enacted Secure and
    Trusted Communications Networks Act to provide the additional resources
    needed to transition carriers away from covered equipment. While total
    costs will vary by carrier and depend on how different networks are
    structured, I am pleased that the FCC has sought $2 billion in
    resources for this program, as well as administrative costs, in a
    recent appropriations request.
                                     ______

         Response to Written Questions Submitted by Hon. Jon Tester to
                                Steven K. Berry
        Question 1. As you testified, the issue of suspect
    telecommunications equipment disproportionately affects small carriers
    in rural areas like much of Montana. For financial reasons, these
    carriers sometimes chose to use equipment that we now know to pose
    national security risks. What is the range of credible estimates for
    the total cost of replacing covered communications equipment among
    regional carriers, both in the ``core'' network and overall?
        Answer. Each carrier's network is different, and accordingly
    resources needed to replace covered equipment will vary by carrier
    based on network architecture, current equipment in place, and size and
    density of each carrier's geographic footprint. The United States has
    never directed carriers to essentially remove all covered network
    equipment in one year or seek waivers, and the need for flexibility and
    ability to review new technologies that could reduce costs is extremely
    important. We hope the FCC recognizes this in their policy decisions,
    as technology advances and physical network components may differ in
    cost from virtual components. CoBank has estimated network costs to
    exceed $1 billion in network replacement costs, and the FCC recently
    sought $2 billion to fund the overall replacement program. To speak
    specifically to core costs, CCA carrier estimates approximate $3.7--$4
    million per core, with additional costs for space to accommodate an
    additional core, expanded HVAC capacity, and configuration costs.

        Question 2. Much of the covered equipment is obsolete, and will
    presumably be replaced by newer but functionally equivalent equipment,
    but the telecommunications market has only further consolidated in the
    short time since this equipment was installed. Are there proactive
    steps that could help ensure carriers have access to a robust and
    competitive market as they replace covered equipment? For example, do
    you anticipate that radio access network virtualization can play a role
    in replacement?
        Answer. As you note, there are certain covered network elements
    that support legacy technologies that are now obsolete and no longer
    available from any trusted supplier. Carriers who must replace covered
    network elements should be allowed to deploy equipment to support like-
    for-like services, particularly with equipment that can be upgraded to
    support future technologies. Virtualization, including through Open
    Radio Access Network (ORAN) technologies, has the potential to
    disaggregate functionality to increase efficiency and decrease costs.
    Further research and development on ORAN should be encouraged. However,
    policymakers should not mandate which technologies are used in wireless
    networks, but rather encourage research into new, secure technologies
    to enhance innovation, customer choice, and cost savings. Superior
    products will win in the market.

        Question 3. Are there currently enough skilled workers available to
    replace covered equipment in American networks within the specified
    timeline of one year after disbursement of funds? What steps can
    Congress take, if any, to help ensure the necessary workforce is in
    place in advance of the release of funds?
        Answer. A properly trained, local workforce will be essential for
    impacted rural carriers to complete the transition process to remove
    covered network equipment; absent an appropriately trained workforce,
    there will not be enough labor available to complete not only the
    replacement of covered equipment but also other demands to wireless
    service deployment. I thank you for your leadership in introducing S.
    3355, the Telecommunications Skilled Workforce Act, alongside Senators
    Wicker, Thune, Moran, and Peters to help meet the needs associated with
    bringing connectivity to rural America.
                                     ______

        Response to Written Question Submitted by Hon. Amy Klobuchar to
                                Jason S. Boswell
        Question. In your testimony, you state that the United States is
    expected to account for 50 percent of data breaches across the globe by
    2023, making our networks a target for cyberattacks. You also highlight
    the need for industry to develop 5G supply chain and security
    standards.

       Can you speak to how the industry is working together to
            develop 5G supply chain and security standards to ensure that
            all carriers, including small and rural carriers, remain
            competitive?

        Answer. Security is a top priority for Ericsson. Ericsson's
    philosophy is that networks must, from the very start, be trustworthy,
    resilient, and secure by design, and Ericsson employs a holistic
    approach to ensuring the security of its supply chain and its products,
    as detailed in my testimony. At the same time, Ericsson and other
    companies in the information communications and technology (ICT) sector
    recognize that ensuring security in the 5G era is a shared challenge
    that requires collaborative and inclusive solutions. Accordingly,
    Ericsson constantly works with a diverse range of relevant stakeholders
    in industry and government--both in the U.S. and globally--through a
    variety of complementary organizations and processes to address 5G
    supply chain and security standards. This multi-faceted approach
    ensures that all providers--regardless of their size, the nature of
    their customer base, or other differentiating factors--are able to
    participate in the problem-solving process and, in particular, that the
    interests of small and rural carriers are taken into account.
        Industry-led initiatives. Ericsson actively contributes to a number
    of U.S.-based industry initiatives organized around ensuring supply
    chain security. As described in my testimony, these include the
    Communications Sector Coordinating Council (CSCC), which meets
    regularly to review industry and government actions on critical
    infrastructure protection priorities in order to improve the physical
    and cyber security of sector assets, among other functions; and the
    Council to Secure the Digital Economy (CSDE), which brings together
    companies from across the ICT sector to combat increasingly
    sophisticated and emerging cyber threats through collaborative action.
        Standards-setting bodies. Standards work is a foundational
    component of good security assurance, as it supplies guidance and
    frameworks that ensure security and privacy requirements are met
    consistently. As described in my testimony, Ericsson is a leading
    participant in developing the standards for 5G security through the
    global 3rd Generation Partnership Project (3GPP) and serves on multiple
    working groups within the standard-setting organization the Alliance
    for Telecommunications Industry Solutions (ATIS), including a newly-
    launched effort through ATIS, supported by the Department of Defense,
    to develop standards for securing the 5G supply chain. These technical
    standards are crucial for security because they give all suppliers and
    carriers a common--and open and transparent--technical understanding of
    interoperability and security. This allows for vetting and
    identification and correction of technical vulnerabilities. To be
    clear, 5G security standards and 5G supply chain standards are
    presently still under development, and Ericsson along with many other
    companies is helping shape them for long-term security. In total,
    Ericsson is a member of more than 100 industry organizations, standards
    bodies, and other technology alliance groups, as part of its mission to
    drive 5G forward.
        Commercial partnerships. Ericsson further contributes to enhancing
    security through commercial relationships with its broad and diverse
    U.S. customer base, which includes nationwide and regional
    communication service providers serving both rural and urban markets
    with all technologies (wireline and wireless telecommunications, cable,
    and satellite). As described in my testimony, Ericsson has partnerships
    and collaborations with rural Wireless Internet Service Providers
    (WISPs) and carriers--such as GCI Communications, Cellcom, Bluegrass
    Cellular, and many more--in furtherance of its commitment to bring 5G
    to rural areas. Ericsson also maintains strategic partnerships with
    NVIDIA, Intel, Qualcomm, Juniper, and many other U.S. companies. In
    fact, Ericsson's global sourcing of active components for Ericsson's 5G
    radio base stations relies up to 90 percent on U.S. technology
    suppliers.
        Industry-government initiatives. Industry and government together
    have convened numerous initiatives to promote collaboration on supply
    chain security. For instance, as explained in my testimony, Ericsson is
    involved in the following:

       The Department of Homeland Security Information and
            Communications Technology Supply Chain Risk Management Task
            Force exemplifies how industry and government collaboration can
            quickly and effectively deliver useful, sharable, expert-driven
            guidance in complex areas like supply chain and 5G security.
            The Task Force represents a formal, action-oriented
            collaboration between industry and government that ties
            together various streams of activity. In 2020, its working
            groups will analyze mitigations and risk determination across
            multiple areas of the supply chain in order to make
            recommendations on best practices and methodologies, and
            develop attestation frameworks around various aspects of supply
            chain risk management to help security standards and other risk
            guidelines more understandable, predictable, and useful.

       The National Security Telecommunication Advisory Council
            (NSTAC) is an industry-comprised body that advises the
            President on national security and emergency preparedness
            issues.

       Similarly, the Communications Security, Reliability, and
            Interoperability Council (CSRIC) is an industry-comprised body
            that makes security policy recommendations to the Federal
            Communications Commission (FCC). Three of its current working
            groups are expressly focused on security issues: Managing
            Security Risk in the Transition to 5G (WG2); Managing Security
            Risk in Emerging 5G Implementations (WG3); and 911 Security
            Vulnerabilities during the IP Transition (WG4).

        Other engagement with government. Beyond these joint activities,
    individual companies work closely with other government departments and
    agencies. In Ericsson's case, these include the National
    Telecommunications and Information Administration (NTIA) and the
    National Institute of Standards and Technology (NIST), both within the
    Department of Commerce; the FCC; the White House, and more
    specifically, the Office of Science and Technology Policy (OSTP), the
    National Economic Council (NEC), and the National Security Council
    (NSC); and the Departments of State, Defense, and Energy.
        Collectively, these complementary vehicles and processes invite and
    permit the participation of all stakeholders, including small and rural
    carriers, and thereby facilitate holistic solutions to shared security
    challenges. In short, ongoing industry efforts are designed so that no
    stakeholder is left behind in the race to a secure 5G world.
                                     ______

       Response to Written Question Submitted by Hon. Kyrsten Sinema to
                                   Asha Keddy
        Question. As you know, the Intel Future Skills initiative works to
    address the effect of technological advancement on the skills needed
    for the jobs of the future.
        In order to compete and stay ahead of Chinese technologies, we must
    make significant investments in infrastructure, education, and
    workforce training. In Arizona, we are already working to cultivate a
    21st century workforce. For example, last year Arizona State University
    and Sprint partnered to create a new 5G connectivity and Internet of
    Things curriculum.
        How can we work to best prepare students for the jobs needed to
    build 5G equipment and networks in order to reduce provider dependence
    on cheap, Chinese components?
        Answer. Intel commends and supports efforts to increase investments
    in infrastructure, education and workforce training. In passing the
    CARES Act during March 2020, Congress took important steps to protect
    early momentum to focus on these needs, and Intel supports additional
    resources for these important areas in follow up COVID19 response
    measures. In these uncertain times, one certainty is that the U.S. has
    an opportunity to set priorities for success against the country's most
    important challenges.
        Today Congress has a rare opportunity to direct resources in ways
    that support the efforts of U.S. workers to develop new skills and
    begin building for the long term. Intel urges the Commerce Committee
    and Congress to learn from the example of Arizona's forward-looking
    plans. For example, in 2018 Arizona formed the Institute for Automated
    Mobility to advance readiness for automated vehicles. This effort will
    help advance technology readiness and regulatory frameworks for one of
    the most important applications of 5G technology. Especially during
    this time of pandemic, it is imperative to keep students and teachers
    connected to mitigate some of the disruption. That's why Intel
    announced the Intel Online learning initiative to support education-
    focused nonprofit organizations and business partners to provide
    students, without access to technology, with devices and online
    learning resources. In close partnership with public school districts,
    the initiative will enable PC donations, online virtual resources,
    study-at-home guides and device connectivity assistance. The Intel
    Online Learning Initiative builds on Intel's long-standing commitment
    to technology that improves learning. Although Intel's broad efforts
    were driven by a desire to support students, health care professionals
    and businesses of all sizes during the COVID-19 pandemic, Intel has
    strategically aligned its support with the goal of driving long term
    innovation against the world's greatest challenges (for more
    information on Intel's efforts, the press announcement is located at
    the website https://newsroom.intel.com/news/intel-commits-technology-
    response-combat
    -coronavirus/gs.3a0m7n.
        As a leading provider of technology to 5G infrastructure, an
    employer of tens of thousands of the engineers who are inventing the
    amazing experiences of the future, and as the world's leading
    semiconductor integrated device manufacturer, Intel Corporation
    welcomes the opportunity to advise and support efforts to ready
    infrastructure, education and workforce in the U.S. for success in the
    21st century and beyond.
                                     ______

       Response to Written Question Submitted by Hon. Kyrsten Sinema to
                               Dr. James A. Lewis
        Question. Arizona has led the way in developing and deploying the
    technologies of the future. In 2019, two major carriers launched 5G
    services in the Phoenix area, bringing Arizona families and companies
    enhanced networks, greater connectivity, and the economic opportunities
    that go alongside. However, greater connectivity also means greater
    access to Arizonan's private personal information and propriety data.
        There seems to be debate over the threats posed by equipment used
    in the core network verses non-core parts.
        Is there a security threat posed by Huawei and ZTE in non-core
    parts of U.S. networks? If so, how great is the threat?
        Answer. Chin is perhaps the most aggressive intelligence opponent
    the U.S. has ever faced. This means that any Chinese technology that
    connects back to a Chinese company could be exploited for espionage
    purposes. Chinese law makes any Chinese company a tool for Chinese
    espionage.
        Huawei, with its longstanding and close ties to the Chinese
    government, falls into an especially high category of risk. The only
    way to completely eliminate risk is to not use Huawei equipment. Some
    countries argue that for the next few years as we transition from 4G to
    5G networks, it is possible to manage the risk of using Huawei
    equipment through partial bans that limit the use of Huawei. These
    countries share the U.S. assessment of the risk of using Huawei, but
    argue that they can mitigate risk (but not eliminate it) to an
    acceptable and manageable level by restricting the use of Huawei
    equipment to limited part of the 5G network.
        The United Kingdom, for example, uses a partial ban to exclude
    Huawei equipment from ``sensitive'' areas and its use confined to the
    edge. There is much debate over whether this partial ban is enough to
    mitigate the risk of using Huawei equipment. 5G networks will perform
    many operations once done in the core at the edge, which will have the
    increased computing power. Edge computing is part of what provides 5G
    with higher speeds, and this also means that keeping high-risk
    suppliers out of the core does not end all opportunities for espionage
    and disruption.
        The UK argues that careful network architecting and greater
    attention to cybersecurity can overcome this risk. In the U.S., where
    many smaller networks still use Huawei equipment, there is less risk,
    as this is older technology, but since these companies did not design
    their network for security and may not have the best cybersecurity
    tools available, using Huawei create espionage opportunities. China
    will try to find ways to use this Huawei technology to collect
    information from the network on which it is installed and attempt to
    use it to gain access to other larger networks. The only way to
    eliminate risk is to eliminate Huawei technology.

                                      [all]