The Communications Act 2003 National Security Powers
Telecoms security risks can to a large extent be managed and mitigated through technical measures (detailed in the security framework and the code of practice as set out above). However, the Government considers that some risks relating to the use of high risk vendors’ goods, services and facilities are not able to be mitigated effectively solely through the requirements that will be imposed as part of the new telecoms security framework. Further measures are needed to enable the Government to manage the risks posed by those vendors. Such risks may arise from technical deficiencies or considerations relating to the ownership and operating location of the vendor.
	This Act will introduce new powers to enable the Secretary of State to designate specific vendors for the purposes of issuing designated vendor directions to public communications providers (see definition in Annex A). The designated vendor directions will place restrictions on the public communications provider’s use of the goods, services or facilities supplied by designated vendors. The restrictions that may be imposed include requirements that prohibit or restrict providers’ use of designated vendors’ equipment.
	Designations and directions may only be made in the interests of national security. When considering whether to designate a vendor, the Secretary of State will take into account a range of factors, including:
the strategic position or scale of the vendor in UK networks;
the strategic position or scale of the vendor in other telecoms networks, particularly if the vendor is new to the UK market;
the quality and transparency of the vendor’s engineering practices and cyber security controls;
the vendor’s resilience both in technical terms and in relation to the continuity of supply to UK operators;
security laws in the jurisdiction where the vendor is based and the risk of external direction that conflicts with the interests of national security;
the relationship between the vendor and the vendor’s domestic state apparatus;
the availability of offensive cyber capability by that domestic state apparatus, or associated actors, that might affect the national security of any country or territory.
	The Act will make it a duty for public communications providers to comply with any requirements specified in a designated vendor direction that follows designation, and will enable appropriate sanctions to be imposed for non-compliance. The Secretary of State will be responsible for taking forward any enforcement action as necessary, drawing upon information provided by Ofcom, who can be tasked under the Act’s provisions to gather information on telecoms providers' use of designated vendors’ goods, services and facilities in relation to their compliance with requirements imposed in a designated vendor direction.
	The Act will create a power for the Secretary of State to require information from public communications providers about their current or planned use of vendors’ goods, services or facilities, or about the future development of their networks or services. This power can also be used to gather information about goods, services or facilities that vendors propose to supply. The power will be used to ensure the Secretary of State is informed about the demand and supply side of the telecoms market, enabling relevant security assessments to be made.
	The Act will also enable the Secretary of State to require providers to prepare and provide a plan to the Secretary of State and Ofcom setting out how they intend to meet any requirements specified in a direction.