6 Matei Millo +40 31 432 6170

Compatibility of 5G cyber security measures with free trade

I. Context

At the beginning of year 2020, the NIS[1] Cooperation Group has published a set of cyber security measures as means to implement the 5G system (titled 5G Network EU Toolbox Risk Mitigating Measures) pursuant to article 14 and 15 of Commission Recommendation (EU) 2019/534 of 26.03.2019- Cyber security of 5G networks. As such, a set of technical and strategic measures were recommended to be taken by the member states of the European Union.[2]

Commission Recommendation (EU) 2019/534 of 26 March 2019 points to the fact that its goal is not: „to limit the power of states to exclude service renderers or suppliers from their markets for national security reasons” (Recital 29). On the contrary, the recommended measures include an evaluation of the risk profile of suppliers and the enforcement of restrictions for those considered a high risk for assets considered essential, restrictions that may ultimately lead to the supplier being excluded from certain projects.

In this context, on 17.05.2019, during the meeting of the Committee on Market Access[3], China argued that the measure taken by Australia to exclude two Chinese companies from the network construction procedure is a violation of The General Agreement on Tariffs and Trade (“GATT”).  Australia considered the measure to be justified having in mind the security exception enclosed in said Agreement. 

Through this article we intend to analyze to what extent the exclusion of a service provider or other supplier from the IT and communications field may be deemed as compliant with The General Agreement on Tariffs and Trade (“GATT”) and The General Agreement on Trade in Services (“GATS”) or, on the contrary, how it may be justified by (a) the security exception or by (b) the general exceptions enclosed in the above-mentioned agreements.

II. Possible violations of GATT and GATS

The GATT and GATS agreements require that member states grant other members the most favored nation treatment[4][5], including with regards to access on the market of the member states[6], to abstain from taking measures to protect internal production[7] or from establishing contingencies or quantity limitations for certain products, in a discriminatory manner.[8]

As such, a measure to partially or completely prohibit products and services of a member state can be deemed, by the state that has been harmed, as a violation of the GATT and GATS agreements, depending on the actual manner of enforcement and the reasons for which the measure was enforced.

Although the state may derogate from the obligations enclosed in the before mentioned agreements, invoking general exceptions (art. XX) or the security exception (art. XXI) – whose application must be proven- they must justify the restrictions are necessary to defend national security[9] or to protect public order and/or morality – if we are to refer to the general exception that could be invoked in the hypothesis subject to this assessment.[10] 

III. The security exception

Until recently, the security exception has not constituted grounds for the exclusion or the limitation of marketing of goods and products for the member states of these agreements. Although the World Trade Organization („WTO”) has created a mechanism for dispute resolution, this issue has not been subjected to a panel report[11] until 2019, when the Russia — Traffic in Transit[12] dispute was settled.

The reason being that, according to these agreements, the exception is rather limited in scope. According to art. XXI GATT and art. XIV bis GATS, the possibility of states to impose commercial restrictions, based on the security exception, is conditioned by the necessity to protect essential security interests in certain fields, such as: 

  • regarding fissionable and fusionable materials or the materials from which they are derived;
  • regarding traffic in arms, ammunition and implements of war and to such traffic in other goods and materials as is carried on directly or indirectly for the purpose of supplying a military establishment;

Also, the security exception covers measures taken in times of war or emergency in international relations.

However, in the present context of international commercial relations, the security exception has come to be of great importance as it is invoked in numerous disputes subjected to the panels of the Dispute Settlement Body. As such, for example, a new report is expected in the fall of this year in the US — Steel and Aluminium Products (EU)[13] dispute, where the security exception has been invoked by USA, in order to justify the tariffs charged for aluminum and steel imports. 

Until the panel report on Rusia – Traffic in Transit, there have been different opinions expressed in scholar writings regarding the possibility of a WTO panel to analyze the fulfillment of conditions that enable one to invoke the security exception. 

As such, part of the doctrine and practice of WTO[14] considered the security exception as being a self-judging clause that allows states to unilaterally assess the fulfillment of conditions to invoke the security exception and, as a consequence, the panel has no power in this regard.

On the other hand, it has been shown[15] that the Dispute Resolution Agreement -GATT 1994 does not contain any exception or limitation regarding the panels’ power to analyze the conditions to invoke a security exception. These authors[16] argue that this solution is to be applied according to the Kompetenz-Kompetenz principles and the principle nemo idex in sua causa (no one is a judge in his own cause).

The panel that analyzed the above-mentioned dispute, Russia — Traffic in Transit, has adopted the second opinion[17]. The panel’s decision confirms that the autonomy of states in establishing essential security interests is limited by the 3 situations mentioned by art. XXI (b) of GATT.

Therefore, interpreting art. XXI, in accordance with art.31 (1) of the 1969 Vienna Convention on the Law of Treaties, the panel has concluded that:  

  • In order to be deemed necessary, the measure to protect essential security interests must be based on one of the 3 situations mentioned in art. XXI (b).[18]
  • The members have a margin of appreciation/discretion in establishing the essential security interests but said margin is limited to the 3 situations mentioned in art. XXI (b).[19]
  • The existence of one of the situations mentioned in the subsections of art. XXI (b) is to be determined by the panel that settles the dispute.[20]
  • The member states determine what constitutes an essential security interest, but it is necessary for this consideration to be objectively based on the existence of one of the situations mentioned in the subsections of art. XXI (b).[21][22]

Following the analysis of the provisions related to the security exception and in light of the panel’s decision in the Russia — Traffic in Transit dispute, the conditions to invoke the security exception are: (i) the measure has to be necessary in order to protect an essential security interest (ii) the essential security interests need to be objectively based on one of the 3 situations mentioned in art. XXI (b).

It is also important to mention that, according to the above-mentioned panel decision, once the measure is justified by one of the 3 situations mentioned in art. XXI (b), the proportionality of the measure with the aim pursued would remain within the exclusive competence of the respective state. This conclusion was drawn through an historical and teleological interpretation of the GATT Treaty.[23]

Moreover, even though the provisions of art. XXI of GATT and art. XIV bis of GATS are similar, it must be pointed out that art. 2 of art. XVI bis of GATS provides an additional obligation for the party invoking the exception, to inform the Council for Trade of Goods about the measure taken and its duration.

In this context, to what extent the states could justify, based on a security exception, the prohibition of certain products and services for the 5G network construction?

The panel’s report,[24] defined the essential security interest as by representing “those interests which relate to functions of the state’s quintessence, namely the protection of the territory and the population from external threats, the defense of the law and public order internally”.[25]

As such, there are sufficient grounds to concur that the states are not allowed to extend the notion of essential security interests as to satisfy some economic interest or justified by provisions of other international conventions. Abiding by this rule would be sufficient to avoid abusive behavior.

With regards to 5G technology, according to findings 2-4 of the Commission Recommendation (EU) 2019/534, it can be deducted that the importance of cyber security is justified by the need to prevent the effects cyber-attacks might have upon “vital societal and economic functions – e.g. energy, transport, banking and medical systems, and industrial control systems. The organization of democratic processes, such as elections, will increasingly rely on digital infrastructure and 5G networks.”

Qualifying cyber security as an essential security interest has been previously analyzed in doctrine[26] and the arguments made include that unlawful use of cyberspace might endanger activities that are of national security. Even so, in the same paper, it is argued that the standards to be met in order to qualify an interest as an essential security interest require, more than just attesting said interest, minimum evidence justifying its assessment as essential.[27]

As such, it is of great importance for evidence to exist and to support the notion that the essential security interests might be harmed. The evidence should prove the fact that cyberspace might endanger national security activities as well as the fact that it will be unlawfully used by the same persons or entities that ensure its functioning an implementation. 

The protection of vital functions, as previously mentioned, might serve as justification for the existence of an essential security interest, to the extent that it would be proven that, by impairing these vital functions, there would be an impact also on the state’s ability to protect its territory and population. Equally, the essential security interest might be also justified by the need to protect the personal data of the population.

Of course, as shown in the panel’s report in the Russia — Traffic in Transit dispute, the existence of essential security interests needs to be objectively based on one of the situations mentioned in the subsections of art. XXI (b).

Therefore, it’s not enough for the states to consider, by applying subjective criteria, that the essential security interest in protecting cyber security exists, but it is necessary for the interest to be generated by: (i) fissionable and fusionable materials or the materials from which they are derived, (ii) traffic in arms, ammunition and implements of war and to such traffic in other goods and materials as is carried on directly or indirectly for the purpose of supplying a military establishment, (iii) state of war or international emergency in international relations.

Considering that, in the field of 5G technology, the products and services that might be prohibited are not fissionable materials and, also, do not regard traffic in arms, ammunition or goods and traffic in materials necessary for military needs, the only justification that remains for a state is the one mentioned by art. XXI (b) that is, more exactly, a state of war or international emergency in international relations.

But what constitutes an emergency in international relations?

By systematic interpretation of the provisions of art. XXI, the panel[28] observed that the existence of an emergency „ appear to refer generally to a situation of armed conflict, or of latent armed conflict, or of heightened tension or crisis, or of general instability engulfing or surrounding a state”.

Moreover, having in mind what can be regarded as war, arms and fissionable materials, it has been stated[29] that political or economic disputes between states do not by themselves cause urgency in international relations in the sense of article art. XXI (b) (iii), except when the dispute will create certain defense, military or internal public order interests.

A similar interpretation has been previously suggested by doctrine[30] and a definition proposed for this term/title.  According to the definition suggested, an emergency in international relations is a situation that exceeds what can be construed as normal tension between states and that might involve some kind of military threat.

Also, states must take into consideration the fact that the measure may only be enforced as long as the urgency state in international relations lasts, as well as the fact that invoking the exception is subject to abiding to the principle of good faith established by the Vienna Convention on the Law of Treaties.

Considering the above mentioned, it must be concluded that each state will responsibly evaluate, in the context of implementing 5G technology, the possibility to invoke the security exception in reference to its relations with the country whose products and or services are about to be prohibited for cyber security reasons. Only if the situation falls under the provisions of art. XXI (b) (iii) GATT, respectively, if a state of war or emergency in international relations is proven, as previously explained, a state may enforce restriction or exclusion measures on commercial entities/suppliers/traders. 

Reiterating what has been previously stated, this represents the objective basis of invoking the exception, to be reviewed by the panel that could be vested by the state with the resolution of the dispute, and therefore the assessment is not at the state’s discretion.

As a result, the only element upon which the state may subjectively assess the situation is the proportionality of the measure taken with the need to protect national security, but, in our opinion, this step cannot be taken unless the situation that caused the exemption from free trade provided for in art. XXI (b) (iii) GATT has been analyzed and confirmed.

IV.         General exceptions

According to art. XX GATT and art. XIV GATS, the parties may take measures that are contrary to the regulations imposed by GATS and GATT, if: 

  • The measures are not applied in an arbitrary manner;
  • The measures don’t constitute unjustified discrimination;
  • The measures don’t constitute a disguised restriction on international trade.

At the same time, it’s necessary to analyze the proportionality between the goal pursued by applying restrictive measures in order to prevent member states to enforce protection measures under the pretext of a general exception.[31]

In addition, art. XIV GATS allows the enforcement of restrictions also for the protection of public order, but only in the situation in which there is a real and sufficiently serious threat against one of the fundamental interests of society[32].

According to the report in the Gasoline case, in which a general exception was raised by a state, a two-tier analysis is required:[33]

  • In the first stage, it must be analyzed if the measure falls under one of the situations mentioned by art. XX lit. (a) – (j) GATT or lit. (a)-(e) GATS – for the analysis at hand it may be relevant only the exceptions that refer to the protection of order and/or public morality;
  • In a second stage, the panel must establish if the conditions mentioned in the introductory clause of art. XX are met.

The process of analysis might therefore be similar to the one previously described regarding the security exception, in such  that the existence of a situation that requires the protection of national security cannot be assessed unless the measures are confirmed to be the one described by the exceptions.

According to the actual reasons invoked by the state in order to prohibit or restrict the access of certain goods and/or services, the panel will analyze, in case of a dispute, under which of the situations mentioned by art. XX lit. (a) – (j) GATT or lit. (a)-(e) GATS the current situation falls. 

In principle, doctrine has shown[34] that national security interests are covered exclusively by art. XIV bis of the GATS agreement, regarding the security exception and that art. XIV of GATS, regarding public order, may not be cited as reason for taking such a measure.

In any case, regardless of the cause that determines the enforcement of said measure, it is necessary, as shown above, that the conditions mentioned in the introductory clause of art. XX  („cheapeau”) are met. These conditions are summarized below.

Thus, a measure can be considered arbitrary (i) if that feature is derived from the norms/regulations establishing the measure itself, or (ii) if the norms/regulations laying down that measure were clear and fair, but the measure would be applied arbitrarily[35], as it was, for example, inflexibility and rigidity in the authorities’ assessment of licensing constitutes arbitrary discrimination.[36]

In this respect, returning to the situation in question, in order to avoid a measure to be considered as arbitrary, the states that are about to enforce the restrictions should establish clear and objective criteria in order to determine to what extent a certain product or service may endanger its cyber security.

Also, in a different dispute, the arbitrary nature of a measure was analyzed in correspondence with another condition, of discrimination between two states in similar situations but subject to different treatment.[37] 

Nonetheless, it was deemed as discriminatory the situation in which imported products were subjected to restrictions that were not applied to internal products as well.[38]

Moreover, measures were considered discriminatory when an analysis of the adequacy of the regulatory program for the conditions existing in the exporting countries concerned is not permitted.[39]

It has been shown that in order to avoid discrimination in such a case, the states must show flexibility that will allow exporters to apply similar policies, policies that in turn will lead to comparable results, and not to apply the same policies to all the other members.[40]

As such, in assessing the ability of some products or services to meet cyber security measures, states should take into account not only their own standards but also the rules imposed by the state of export for the provision of those goods and services, in determining whether the rules imposed by the exporter can or may not lead to the same level of safety.

Not least, it was considered that a disguised restriction exists not only when the measure itself is hidden or unannounced, but also when an arbitrary or discriminatory restriction in international trade is only formally taken as one of the exceptions permitted by art XX of the GATT Convention.[41]

Also, we must not overlook the fact that the measure must be necessary to accomplish the goal pursued. In this regard, the standard offered by the case law of WTO is that of the importance of the interests or values protected and that a restrictive measure is easier to accept if it protects a vital value.[42]

This standard is also relevant in the light of the burden of proof, which will be placed on the party invoking the general exception,[43] in which sense it will have to demonstrate that all the conditions of art. XX GATT or art. XIV GATS are fulfilled.

It is accepted in WTO practice that the author of the general exception is not compelled to prove that there is no other measure to achieve the purpose allowed by the conventions, but, in the event that the opposing party argues that a less restrictive measure would be likely to achieve the same goal, the author of the exception must demonstrate that the initial measure applied remains necessary, even in the context of the existence of those alternatives.[44]

 V. Conclusions

In conclusion, in the light of the case-law and doctrine examined above, each state will therefore have to assess, in accordance with its obligation of good faith, the extent to which one of the situations provided for in the subsections of art. XXI (b) GATT or art. XIV bis (b) GATS exists, so that a possible measure to exclude or limit certain products or services, in the context of protecting national security, is justified.

The panel in the Russia — Traffic in Transit dispute confirmed that the autonomy of appreciation of the states in establishing essential security interests is limited by the three situations provided for in art. XXI (b) of GATT, the fulfillment of which must be verified in advance.

Considering that, however, the Member States of the European Union are not in a state of urgency in international relations with any of the countries where 5G equipment manufacturers and suppliers reside (situations judged by the WTO practice to be covered by the security exception, together with war situations, specifically provided for in art. XXI (b) (iii)), it is difficult to argue, in our opinion, a possible security exception.

It could be reasonably argued that states cannot extend the concept of essential security interest to also satisfy certain economic interests or interests justified by the observance of other international conventions and that the finding of an essential security interest should be accompanied by minimum evidence, within the boundaries set by art. XXI (a) of GATT.

On the other hand, even if cyber security were to be assessed as not falling within the scope of the protection of an essential security interest (within the meaning of GATT art. XXI), and that, in fact, cyber security would constitute one of the situations of art. XIV GATS or GATT XX- of which, most likely, states could refer to the scope of protection of public order and/or morals – it should be possible to justify, against doctrinal views, that public order does not only concern social security, but also includes the field of cyber security.

It is important that states assess the appropriateness of a non-discriminatory measure that is necessary in order to achieve the desired goal.

The restriction of access to a given market for certain products and services must therefore respect a proportionality ratio with the value intended to be protected.

Even in the context of a highly important value, states should examine whether, even in the presence of alternative, less restrictive measures, such as the obligation to obtain certain licenses or the partial limitation of access to that market, they could still justify that the measure is proportional and necessary. 

Ion Dragne, Attorney at law

Alexandru Dragne, Attorney at law

Dragne & Asociatii

[1] The NIS Cooperation Group has been established by the 2016 Directive on security of network and information systems (the NIS Directive) to ensure strategic cooperation and the exchange of information among EU Member States in cybersecurity- https://ec.europa.eu/digital-single-market/en/nis-cooperation-group

[2] Available at https://ec.europa.eu/digital-single-market/en/news/cybersecurity-5g-networks-eu-toolbox-risk-mitigating-measures (visited 04.05.2020).

[3] Minutes of meeting available here (visited 04.05.2020).

[4] Art. I paragraph 1 and art. IX of the GATT Agreement.

[5] Art. II paragraph 2 of the GATS Agreement.

[6]  Art. XVI of the GATS Agreement.

[7] Art. III of the GATT Agreement and art. XVII of the GATS Agreement.

[8] Art. XI, art. XIII of the GATT Agreement and art. XVI of the GATS Agreement.

[9] Australia stated that excluding certain Chinese companies was not discriminatory as the measure regarded any supplier that is controlled by a foreign state and that the measure was necessary in order to prevent unauthorized access to the network- see Tania Voon and Andrew Mitchell –Australia`s Huawei ban raises difficult question for the WTO in East Asia Forum, available at https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3390675 (visited 04.05.2020).

[10] Art. XX and art. XXI -GATT and art. XIV and art. XIV bis – GATS.

[11] For a summary presentation of the WTO’s activity please see Shin-yi Peng „Cybersecurity Threats and the WTO National Security Exceptions” – Journal of International Economic Law, 2015, Oxford University Press, pg. 460.

[12] The panel’s report is available at: https://www.wto.org/english/tratop_e/dispu_e/cases_e/ds512_e.htm (visted 04.05.2020).

[13] The panel’s communicate available at https://www.wto.org/english/tratop_e/dispu_e/cases_e/ds548_e.htm (visited 06.05.2020)

[14] Stephan Schill & Robyn Brise – „If the State Considers”: Self-Judging clauses in International Dispute Settlement – Max Planck Yearbook of United Nations Law, Volume 13, 2009, pg. 97 and the doctrine enclosed within.

[15] Id. pg. 105.

[16] Id. pg. 119.

[17] Paragraphs 7.59 -7.103 of the panel’s report in the Russia — Traffic in Transit cause (WT/DS512/R).

[18] Id., paragraph 7.82.

[19] Id., paragraph 7.98.

[20] Id., paragraph 7.102.

[21] Id., paragraphs 7.130 – 7.134.

[22] See also Ion Gâlea – Urgency in international law. Justifying urgency based on clauses of treaties, available at https://www.juridice.ro/679916/urgenta-in-dreptul-international-justificarea-urgentei-in-baza-unor-clauze-in-tratate.html#_ftn12 (visited 05.05.2020).

[23] Paragraphs 7.146 and 7.92 of the panel’s report in the Russia — Traffic in Transit dispute (WT/DS512/R).

[24]  Id. paragraph 7.130.

[25] Ion Gâlea – work quoted.

[26] Shin-yi Peng, work quoted, pg. 469-470.

[27] Id. pg. 478

[28] Paragraphs 7.72 – 7.77 of the panel’s report in dispute WT/DS512/R.

[29] Id.

[30] Hannes L. Schloemann and Stefan Ohlhoff – Constitutionalization” and Dispute Settlement in the WTO: National Security as an Issue of Competence publicat în The American Journal of International Law Vol. 93, No. 2 (Apr., 1999), pg. 446

[31] Gisele Kapterian – A Critique of the WTO Jurisprudence on ‘Necessity’ published in The International and Comparative Law Quarterly Vol. 59, No. 1 (Jan., 2010), Cambridge University Press, pg. 127

[32] Note 5 of GATS version available at the webpage of WRO  https://www.wto.org/english/docs_e/legal_e/26-gats_01_e.htm (reviewed on 04.05.2020).

[33] The report of the appeal panel in dispute WT/DS2/AB/R – pg. 22, available at https://docs.wto.org/dol2fe/Pages/FE_Search/FE_S_S006.aspx?Query=(@Symbol=%20wt/ds2/*)&Language=ENGLISH&Context=FomerScriptedSearch&languageUIChanged=true# (reviewed on 06.05.2020).

[34] Thomas Cottier, Panos Delimatsis, Nicolas F. Diebold – Article XIV GATS: General Exceptions, with reference to US Gambling, WT/DS285/AB/R, available at https://www.researchgate.net/publication/228157509_Article_XIV_GATS_General_Exceptions (reviewed on 06.05.2020).

[35] Panel’s report G.3.11.7 US — Shrimp, para. 160 (WT/DS58/AB/R).

[36] Id., para 177.

[37] Panel’s report G.3.12.11 Brazil — Retreaded Tyres, para. 226–228.

[38] The report of the appeal panel in dispute WT/DS2/AB/R.

[39] Panel’s report G.3.12.3 US — Shrimp, para. 164–165 (WT/DS58/AB/R)

[40] Panel’s report 21.5 – Shrimp para 144 (WT/DS58/AB/RW)

[41]The report of the appeal panel in dispute WT/DS2/AB/R – pg. 23

[42] Panel’s report in dispute G.3.6.2 Korea — Various Measures on Beef, para. 162, as well as the presentation of Prof. Dr. Ion Gâlea in the debate „Urgency in law” – part II – available at https://www.youtube.com/watch?v=GQ8TS0lHlEA&feature=youtu.be, ref. to Thailand – Cigarettes and EU – Asbestos.

[43] Panel’s report in dispute G.4.3.1 US — Gambling, para 309–310

[44] Panel’s report in dispute G.3.3A.15 China — Publications and Audiovisual Products, para. 318–319 (WT/DS363/AB/R)