Telcos need to allocate specific roles within their organisation to deal with the TSA regulations laid out by the UK government.
In November 2021, the UK Government unveiled the Telecommunications (Security) Act (TSA), introducing a stronger security framework for public electronic communications network providers.
Since then, the Government has also released a draft regulation and new code of practice to address advanced security risks. This was due to our reliance on communications technology growing, but more worryingly the risks involved. With approximately 95 per cent of the UK population predicted to be using a smartphone by 2025, not to mention the wealth of other devices connected to the internet, the potential damage caused to the UK infrastructure should a Carrier network be breached is severe.
95% of the UK population are predicted to be using a smartphone by 2025
In principle, the regulations have been well received. However, although the requirements presented in this new security framework are clear, the implementation timescales and exact details of what is expected by when are vague.
The Government has requested ‘the most straightforward and least resource intensive measures’ be actioned by March 31st, 2024, and ‘the most complex and resource intensive measures’ be conducted by 2028 – with some ‘relatively low’ and ‘more complex’ measures to be completed in between – all of which leaves a lot to each individual organisation’s interpretation.
Whilst the exact definition of the least, relatively low, most complex and most resource-intensive measures remains up for debate, it is likely a great deal of work will be needed to achieve compliance with these new regulations.
TSA regulations in a nutshell and what this means for Telcos
In essence, the new regulations state that Telcos need to be able to identify the risks of security compromises, take measures to reduce these risks and consistently review their existing processes, preparing for the occurrence of a security compromise –defined as ‘anything that compromises the availability, performance, functionality or confidentiality of the network, allows unauthorised access or interference, or causes signals or data to be lost or altered without the provider’s permission’.
This sounds relatively straightforward in theory; however the secondary legislation provides far more detailed requirements, including:
Security by design – Networks must be designed, or redesigned (if necessary) to ensure security at all times
UK-based – Networks must be capable of operating without reliance on people, equipment or stored data from outside of the UK (though this may prove difficult in practice, given many Telcos have an international footprint)
Supply chain – Telcos must assess the impact of security compromise on third-party suppliers, reduce dependency on any single third-party providers and ensure there are written contingency plans in place should supply be interrupted
Patching – Security patches must be applied within 14-days of any risk of compromise (a longer period may be allowed if this can be proved to be necessary)
Board-level security officer – Security compliance must be managed by a person or committee with board-level responsibility (who must also be granted authority to effectively manage those responsible for the organisation’s security measures)
Testing – Regular penetration testing, security reviews and written assessments must be conducted to test both network security and staff awareness
Security logs – All logs relating to network access must be kept for at least 13 months, with systems in place to monitor unauthorised changes to sensitive parts of the network/services. (Whether or not those logs should be stored solely in the UK is an ongoing point of discussion)
Industry Co-operation – Telcos must share information with other providers, should that information be able to help mitigate risks caused by security compromise
Additionally, the ‘code of practice’ included alongside these regulations outlines how Telcos can achieve compliance and what good security looks like in the industry. Although not legally binding, the provisions included in the code of practice clarify what ‘appropriate and proportionate’ measures look like according to each tier – using a three-tier system based on the annual turnover of the telecoms provider.
Understanding where to begin
There is a lot to be achieved in order to comply with the new regulations and getting started on the extensive list of tasks may seem like a daunting prospect. It is therefore worth breaking these tasks down into smaller, easier-to-manage steps.
As a first port of call, Telcos need to allocate specific roles within their organisation to deal with the TSA regulations. For many, there will be a great deal of change required to bring security up to the level outlined in the regulations, and by creating a role responsible for achieving compliance within the appropriate timescales, companies can ensure the work is being managed.
For smaller Telcos that might not have the capacity to create a bespoke role, sharing the responsibilities between multiple members of staff can still ensure this work is picked up.
Telcos should begin testing and auditing their existing security infrastructure and staff’s cyber awareness
Additionally, Telcos should begin testing and auditing their existing security infrastructure and staff’s cyber awareness. Not only will this help to identify potential security gaps, both in their network environments and employee knowledge, it will also provide a base mark which can be used to show future progress.
Telcos can also start to identify which of the regulations fall into the different timescales. While the complexity of each security task may vary for different providers, depending on their existing infrastructure and the tools already available, identifying easy wins is something all can do to help to prepare for the first deadline, and to map out the dates needed to achieve security requirements for the rest.
A strong foundation for TSA
Given the ambiguity around the Government timescales, there is no doubt a temptation to identify all measures as highly complex and resource intensive, then wait until 2028 before enacting change.
This temptation should be avoided, not only because these measures will take time to enact, with adjustments and testing needed to determine which security solutions are right for each particular environment, but primarily because these measures are necessary for the security of our communications infrastructure. As we move closer to the rollout of 5G core and the new capabilities this enables, network security will become increasingly important and the consequences of a breach will become more severe – we only need to look at the Optus breach late last year to see the impact a data breach can have when telecommunications security is unregulated.
The TSA regulations have been heavily vetted and shouldn’t be seen as a simple ‘tick box’ exercise. They are crucial measures for Telcos to put in place, in order to ensure the success and robustness of the UK’s telecommunications networks.
Where traditional security structures falls short
Telcos need to assess their security infrastructures now, identifying any gaps and start making the necessary adjustments to ensure these are fixed.
We must take onboard the lessons learned from financial companies that missed taking early action in complying with MiFID II’s precision time regulations – causing a rush to achieve and report MiFID II adherence, which created high-pressure distractions for the trading companies and the supply chains supporting them. And when you factor in the TSA’s focus on supply chain security, the selection of suppliers to help with TSA delivery (amongst other needs), and the evaluation of security contingency plans, there will be numerous time-consuming distractions created that could risk further delays to achieving compliance.
With Telcos also set to upgrade their networks to 5G and 400Gbps over the next few years, these TSA mandates and the focus they require will also govern the evolution of the UK’s networks – further adding to the workloads of Telcos’ security and infrastructure teams.
Though the Government’s deadline (31st of March 2028) for full compliance may feel like some time away, Telcos should begin to take action now. It’s important that we view these requirements as a good thing, not as a cause for a heavy workload. As these networks become ever more intertwined into all our lives, we need to ensure they are protected, without underestimating the effect a security breach could have on every one of us.
###
European Commission Launches Investigation Into Viasat-Inmarsat Deal
By Andy Fry
The European Commission has opened an in-depth investigation to assess the proposed $7.3bn acquisition of Inmarsat by Viasat. The Commission is concerned that the transaction may allow Viasat to reduce competition in the market for the supply of broadband in-flight connectivity (IFC) services to commercial airlines.
The deal was first proposed around 18 months again and is already the subject of an in-depth investigation by the UK’s Competition & Market Authority. Commenting on the EC’s decision to follow suit, EVP in charge of competition policy, Margrethe Vestager said: “In-flight connectivity is a nascent and growing market in Europe. Viasat and Inmarsat are two leading suppliers of connectivity services during flights and they compete head to head to serve European airlines. With our in-depth investigation, we aim to ensure that the acquisition of Inmarsat by Viasat does not lead to higher prices and lesser quality for in-flight connectivity services on flights in Europe.
The Commission identified three concerns. Firstly, that the two firms are close competitors in the European Economic Area (EEA) and global markets for the supply of broadband IFC services. Secondly, there are currently few alternative suppliers, and the markets are characterised by high barriers to entry. Finally, the satellite market is undergoing a transition with operators of non-geostationary satellites having entered or planning to enter the IFC market. The Commission plans to further investigate whether those new players are likely to exert sufficient competitive pressure.
The Commission will now carry out an in-depth investigation into the effects of the transaction to determine whether its initial competition concerns are confirmed. It has 90 working days, until 29 June 2023, to take a decision. The EC stressed that the “opening of an in-depth inquiry does not prejudge the outcome of the investigation”.
Viasat and Inmarsat have said that will work with the regulatory agencies to address their concerns. Viasat, which faces competition in the IFC market from Panasonic and Intelsat, had hoped to complete the deal by the end of the year. The company claims that the merger would increase efficiencies and make IFC more affordable, faster and reliable.
When the CMA announced plans to launch an in-depth investigation the deal Viasat CEO Mark Dankberg argued that the transaction “will benefit the nascent, but rapidly growing IFC services available to airline passengers.”
In addition to this investigation, the EC is also looking at Vivendi’s proposed acquisition of Lagardere and Microsoft’s planned purchase of Activision Blizzard (among others).
###
Abu Dhabi Fund For Development And IFC Sign A Cooperation Framework To Finance Sustainable Private Sector Projects
Abu Dhabi Fund for Development (ADFD) and the International Finance Corporation (IFC), a member of the World Bank Group, signed a Memorandum of Cooperation during the World Government Summit to support investments in emerging markets related to the clean energy transition, climate mitigation and adaptation, the adoption of clean technologies, and food security amongst others.
The cooperation framework aims to strengthen the strategic collaboration between the two organizations in several key areas, including through co-investing of up to AED5.5 billion (US$1.5 billion) to private sector-led projects.
The new cooperation also paves the way for an enhanced exchange of knowledge that leverages best practices and global expertise of both parties. The agreement was signed by His Excellency Mohamed Saif Al Suwaidi, Director General of Abu Dhabi Fund for Development; andMr. Managing Director of IFC, Makhtar Diop,.
H.E. Al Suwaidi stated that the strategic partnership with the International Finance Corporation presented promising opportunities for attaining the sustainable development goals of developing countries. “The cooperation framework will boost investment in climate and food security projects in crucial sectors such as renewable energy and food security. It will also help stimulate economic activity in both the national private sector and in developing countries, enabling countries to achieve their development goals and programs,” he said.
IFC’s Managing Director Makhtar Diop said: “To tackle climate change, ensure food security, and address unemployment, we need a strong private sector. We are joining forces with ADFD to co-finance private sector projects that address the most pressing challenges of our time.”
Through the Memorandum of Cooperation ADFD and IFC will work to enhance cooperation and exchange of experiences, especially in supporting small and medium enterprises to promote economic development by encouraging the growth of private business enterprises in developing countries.
###
Biden Pick For US Federal Communications Commission Faces Opposition
By David Shepardson
President Joe Biden’s pick for a key fifth seat on the Federal Communications Commission (FCC) on Tuesday faced harsh criticism from Republicans senators while Democrats said it was crucial the US telecom regulator have a full slate of commissioners.
Gigi Sohn, who was nominated in October 2021, had her third hearing before the Senate Commerce Committee, telling lawmakers industry opponents “fear a pragmatic, pro-competition, pro-consumer policymaker who will support policies that will bring more, faster, and lower-priced broadband.”
Republicans offered a sweeping denunciation of Sohn on a number of grounds and accused her of misleading Congress – something she rejected.
Ted Cruz, the top Republican on the panel, said Sohn “has shown herself to be an extreme partisan who lacks the impartiality and candor necessary to serve in a leadership position at a powerful independent regulatory agency.”
Many Democrats said Republicans were doing the bidding of powerful telecom companies who did not want to face regulation from the FCC.
Committee chair Maria Cantwell said that telecom firms were worried Sohn would push for lower-cost internet service.
“Somehow if affordable broadband gets deployed anywhere, then somehow more affordable broadband might get deployed everywhere,” Cantwell said. “So I think there’s probably billions of dollars at stake here, and that is why the vitriol is coming at you.”
Democrats since January 2021 have been unable to command a majority of the five-member FCC, stalling the party’s efforts to reinstate landmark net neutrality rules revoked under Republican former President Donald Trump.
In July 2021, Biden signed an executive order encouraging the FCC to reinstate the open internet net neutrality rules.
Republicans have questioned Sohn’s role as a board member of a nonprofit that operated a transmission service called Locast. It was ordered shut down after four broadcast networks filed a copyright infringement lawsuit.
If confirmed, Sohn has voluntarily agreed to recuse herself on some matters involving retransmission consent and TV broadcast copyright.
Democrats have a 51-49 majority in the Senate. Democratic Senator Jacky Rosen cited serious concerns raised by some law enforcement groups and she said that gave “her pause” about Sohn’s nomination.
Cantwell told reporters after the hearing she had not decided when to hold a vote on her nomination.
-Reporting by David Shepardson; Editing by Nick Zieminski
###
BBC Unveils Nordic Linear Channel And On-Demand Service
By Melissa Kasule
BBC Studios is set to launch the new linear channel BBC Nordic along with an on-demand service, BBC Nordic+, on 17 April targeted to viewers in Norway, Sweden, Denmark, Finland and Iceland
BBC Nordic will replace BBC BRIT and BBC Earth in the current channel mix, while BBC Nordic+ will deliver content on-demand from the studio that is curated around topics such as arts and culture, travel, history, documentaries as well as music to its Nordic audience.
“We at BBC Studios want to show audiences in Norway, Sweden, Denmark, Finland, Iceland that we care about what you love to watch. We have delved into Norwegian/Swedish/Danish/Finnish/Icelandic viewing habits and handpicked shows that we know our audiences love with exciting new additions in the entertainment and lifestyle space, broadening our content mix and the opportunity to appeal to a wider and diverse audience. The introduction of BBC Nordic+ will also mean that viewers have one BBC branded destination both on their television and on-demand” says Arran Tindall, senior vice president Key Markets at BBC Studios
BBC Nordic and BBC Nordic+ will launch 10am CET on 17 April.
###
Moldova Telecoms, Mobile And Broadband Market Statistics And Analyses Report 2022: Moldova Seeing Steady Decline In Telecom Revenue
The “Moldova – Telecoms, Mobile and Broadband – Statistics and Analyses” report has been added to ResearchAndMarkets.com’s offering.
The report includes all relevant research data and analysis. Covering trends and developments in telecommunications, mobile, internet, broadband, infrastructure and regulation.
Moldova seeing steady decline in telecom revenue
The Moldovan telecom market has been affected by a combination of high unemployment and economic difficulties which have led to constraints on consumer spend. In turn this has resulted in telecom revenue having fallen steadily in recent years. This decline continued into 2020, with a 6.3 per cent in revenue from the important mobile sector alone, year-on-year.
Moldova’s aspirations to join the EU have encouraged the government and regulator to adopt a range of measures to bring the country’s telecoms sector into line with EU principles and standards. In July 2017 the Electronic Communications Act was amended to accommodate the 2009 European regulatory framework, while further amendments were adopted in December 2017 and additional changes were proposed in 2019.
Moldova is also part of the Eastern Partnership group of countries, and as such has set in train a glidepath to reducing roaming charges, effective between 2022 and 2026. The country’s broadband strategy through to 2025 has been supported by the ITU and industry counterparts from Korea.
The internet market is developing rapidly, and though the penetration rate is well below the average for most European countries there are many opportunities for further development. The market is highly competitive, with 101 active ISPs as of early 2021, though Moldtelecom and Starnet between them account for most connections. The number of cable broadband subscribers is increasing steadily, though fibre is now by far the strongest sector. By the end of 2020 fibre accounted for about 72.3per cent of all fixed broadband connections.
The mobile market has also grown rapidly, and the sector accounts for the majority of total telecoms revenue. The triopoly of operators is dominated by Orange Moldova, while the launch of LTE services has opened up a new revenue growth opportunity centred on mobile broadband. The near comprehensive geographical reach of their mobile networks, market brand recognition and existing customer relationships will make for steady subscriber growth in coming years.
Key developments:
Fintur Holdings sells its stake in Moldcell to CG Cell Technologies;
Regulator preps for multi-spectrum auction with licenses valid to 2029, issues mobile license to IDC;
Orange Group acquires the cableco Sun Communications, secures additional licences in the in the 800MHz and 900MHz bands;
Moldcell expands the reach of LTE services;
Regulator suspends 3.4GHz auction after no bids are offered;
Report update includes regulator’s market data to March 2022, telcos’ operating and financial data to Q1 2022, updated Telecom Maturity Index charts and analyses, recent market developments.
Companies mentioned in this report:
Moldtelecom
Orange Moldova
Moldcell
IDC
Key Topics Covered:
Key statistics
Regional Europe Market Comparison
Market characteristics
Market Leaders
Market Challengers
Market Emergents
TMI versus GDP
Mobile and mobile broadband penetration
Fixed versus mobile broadband penetration
Country overview
Telecommunications market
Market analysis
Regulatory environment
Historical overview
Regulatory authority
Fixed-line developments
Mobile network developments
Mobile market
Market analysis
Mobile statistics
Mobile infrastructure
Mobile voice
Mobile data
Mobile broadband
M2M
Major mobile operators
Mobile content and applications
Fixed-line broadband market
Introduction and statistical overview
Broadband statistics
Fixed-line broadband technologies
Fixed network operators
Moldtelecom
InterDnestrCom (IDC)
Telecommunications infrastructure
Overview of the national telecom network
International infrastructure
