Cyber Security and Resilience (Network and Information Systems) Bill (Second sitting)
Q Thank you, Minister, for giving evidence this afternoon. I have a couple of questions. The first is about the definitions in the Bill, whether of MSPs or otherwise. All day long we have heard from representatives of different sectors of the industry, and pretty much everyone has talked about the importance of consultation on the definitions and when they are applied in secondary legislation. A certain amount of that stuff will be in primary legislation, so what consultation have you had with industry in setting up the definitions in the Bill in the first place?
Kanishka Narayan: Thank you for the question on definitions. I have two things to say on that. First, observing the evidence today, it is interesting that there are views in both directions on pretty much every definitional question. For example, on the definition of “incident thresholds”, I heard an expert witness at the outset of the day say that it is in exactly the right place, precisely because it adds incidents that have the capability to have an impact, even if not a directness of impact, to cover pre-positioning threats. A subsequent witness said that they felt that that precise definitional point made it not a fitting definition. The starting point is that there is a particular intent behind the definitions used in the Bill, and I am looking forward to going through it clause by clause, but I am glad that some of those tensions have been surfaced.
Secondly, in answer to your question on consultation, a number of the particular priority measures in the Bill were also consulted on under the previous Government. We have been engaging with industry and, in the course of implementation, the team has started setting up engagement with regulators and a whole programme of engagement with industry as well.
Cyber Security and Resilience (Network and Information Systems) Bill (Second sitting)
Q Thank you, Minister, but I am not sure that you answered my question. What engagement have you had in terms of consulting with industry in setting those definitions?
Kanishka Narayan: I have met a number of companies, but the relevant Minister has also had extensive engagement with both companies and regulators, including on the question of definitions. I do not have a record of her meetings, but if that is of interest, I would be very happy to follow up on it.
Cyber Security and Resilience (Network and Information Systems) Bill (Second sitting)
Q I assume that you are referring to the previous Minister, who you took over from?
Kanishka Narayan: I am referring to the Minister for Digital Economy, who is in the other place.
Cyber Security and Resilience (Network and Information Systems) Bill (Second sitting)
Q Do you not think that, as the Minister taking this through the Commons, you should have also had some of those meetings and consultations?
Kanishka Narayan: I have had some meetings but, as the Minister in charge of this Bill, she has been very engaged with businesses, so I think that is fitting. We have obviously worked very closely together, as we normally do, in the course of co-ordinating across the two Chambers.
Cyber Security and Resilience (Network and Information Systems) Bill (Second sitting)
Q What conversations have you had with the Secretary of State regarding guardrails on the extensive powers in this Bill that were referred to earlier?
Kanishka Narayan: I have spoken to the Secretary of State about the Bill, including the reserve powers, and we have agreed that the policy objective is very clear. I do not think I am in a position to divulge particular details of policy discussions that we have had; I do not think that would be either appropriate or a fitting test of my memory.
Cyber Security and Resilience (Network and Information Systems) Bill (Second sitting)
Q Do you think there is a potential need for guardrails?
Kanishka Narayan: I think the guardrails in the Bill are very important, absolutely. The Bill provides that, where there is an impact on organisations or regulators, there is an appropriate requirement for both deep consultation and an affirmative motion of the House. I think that is exactly where it ought to be, and I do not think anything short of that would be acceptable.
The IRGC navy is busy practising the rapid deployment of sea mines, presumably with a view to closing the strait of Hormuz, as it did between 1980 and 1988. What assessment have the Government made of the threat that that poses to our critical national interests? Has he considered the prepositioning of our autonomous mine-hunting capability, which entered service at the beginning of last year?
Universal Credit (Removal of Two Child Limit) Bill
Order. May I gently remind the hon. Lady that this is a very specific debate about the removal of the two-child limit and not a wider debate on tax policy?
Universal Credit (Removal of Two Child Limit) Bill
Order. I respectfully remind the hon. Gentleman not to use the word “you”. He was suggesting that he might like to have a fight with me, and that would not end well.
Cyber Security and Resilience (Network and Information Systems) Bill (First sitting)
Q Picking up on what Jen mentioned about FTSE and publicly traded companies being within scope, is there a view on ensuring g that privately owned companies of a particular scale are within scope, and if so, how will you determine that? Might it be based on things such as turnover or number of employees, or would it be some other identifiable characteristic?
Jen Ellis: For sure, it should not come down to whether you are public or private; it should be about impact. Figuring out how to measure that is challenging. I will leave that problem with policymakers—you’re welcome. I do not think it is about the number of employees. We have to think about impact in a much more pragmatic way. In the tech sector, relatively small companies can have a very profound impact because they happen to be the thing that is used by everybody. Part of the problem with security is that you have small teams running things that are used ubiquitously.
We have to think a little differently about this. We have seen outages in recent years that are not necessarily maliciously driven, but have demonstrated to us how reliant we are on technology and how widespread the impact can be, even of something like a local managed service provider. One that happened to provide managed services for a whole region’s local government went down in Germany and it knocked out all local services for some time. You are absolutely right: we should be looking at privately held companies as well. We should be thinking about impact, but measuring impact and figuring out who is in scope and who is not will be really challenging. We will have to start looking down the supply chain, where it gets a lot more complex.
Cyber Security and Resilience (Network and Information Systems) Bill (First sitting)
Q Two questions: first, for a bit of context, could the witnesses give us an idea of the objectives of cyber-attacks? Are we seeing objectives based around disruption or around extortion, either monetary or for intellectual property? Perhaps we could have a perspective on whether that differs depending on the origin of the organisation conducting the cyber-attack. Secondly, around the reporting model, is there a view on whether the model proposed in the Bill is beneficial, and whether it risks a fragmented approach, particularly if companies operate in a sector that is regulated under the jurisdiction of two regulators? Do you think that a more universal, singular reporting model would be beneficial in ensuring as strong a response as possible?
Dr Sanjana Mehta: May I weigh in on the second question first? It is good to note that the definition of reportable incident has expanded in the current legislation. One of the concerns that the post-implementation reviews had from the previous regulatory regime was that the regulated entities were under-reporting. We note that the Bill has now expanded the definition to include incidents that could have an adverse impact on the security and operations of network and information systems, in addition to those incidents that are having or have had a negative impact.
While that is clear on the one hand—some factors have been provided, such as the number of customers affected, the geographical reach and the duration of the incident—what is not clear at the moment is the thresholds linked with those factors. In the absence of those thresholds, our concern is that regulated entities may be tempted to over-report rather than under-report, thereby creating more demand on the efforts of the regulators.
We must think about regulatory capacity to deal with all the reports that come through to them, and to understand what might be the trade-offs on the regulated entities, particularly if an entity is regulated by more than one competent authority. For those entities, it would mean reporting to multiple authorities. For organisations that are small or medium-sized enterprises, there is a real concern that the trade-offs may result in procedural compliance over genuine cyber-security and resilience. We call on the Government for immediate clarification of the thresholds linked to those factors.
Jill Broom: I would like to come in on that point. Our members would agree with it. Companies need to be clear about what needs to be reported, when it needs to be reported and where they need to report it. A bit of clarity is required on that, certainly around definitions. As Sanjana said, it is good to see that the definition is expanding, but definitions such as “capable of having” a significant impact remain unclear for industry. Therefore, we need a bit more clarity, because again, it means that we could risk capturing absolutely everything that is out there, and we really want to focus on: what is most important that we need to be aware of? Determining materiality is essential before making any report.
In terms of the where and the how, we are also in favour of a single reporting platform, because that reduces friction around the process, and it allows businesses, ultimately, to know exactly where they are going. They do not need to report here for one regulator and there for another. It is a streamlined process, and it makes the regime as easy as possible to deal with, so it helps incentivise people to act upon it.
I have another point to add about the sequencing of alignment with other potential regulation. We know that, for example, the Government’s ransomware proposals include incident-reporting requirements, and they are expected to come via a different legislative vehicle. We need to be careful not to add any additional layers of complexity or other user journeys into an already complex landscape.
Cyber Security and Resilience (Network and Information Systems) Bill (First sitting)
Q Do the witnesses have a view on the benchmarks that, at the moment, do not appear to sit behind the scale of incidents that must be reported? Do you have a view on the absence of any benchmarks and the impact that they may have on smaller firms, or on the risk of over-reporting?
Stuart McKean: Under the designation of a critical supplier, the Bill says:
“any such disruption is likely to have a significant impact on the economy or the day-to-day functioning of society in the whole or any part of the United Kingdom”.
That is a pretty big statement. As a small business owner, how do I know whether what I do is going to have an economic effect on the UK? It will have an economic effect on my business, but whether it has a wider impact is a big statement. I am not sure that it is clear enough.
Cyber Security and Resilience (Network and Information Systems) Bill (First sitting)
Q How might we glean some clarity on that?
Stuart McKean: It needs more detail, even if that is about providing some boundaries so that we have something to say, “If it is going to do the following, what is a ‘significant economic impact’?”. I would like to think that none of our services would have a significant economic impact, but they may well affect a person, so I would bring it more on to the citizen and the impact on people. We heard this a number of times in relation to the JLR incident: the impact on the supply chain was huge, it was economically very costly and directly impacted people’s lives. Anything that can provide more clarity in the definition of an impact at that level can only help.
Jill Broom: I agree. More clarity is needed. The Bill should be tighter in terms of defining that sort of systemic risk.
Dr Sanjana Mehta: The Bill as it stands requires competent authorities and regulators to designate an organisation as a critical supplier rather than the regulated entity. Organisations work with complex multi-tier supply chains, and the concern is that competent authorities that are one step further removed from those complex supply chains, and have even less visibility, transparency and control over those supply chains, might find it difficult to determine true criticality and risk within the supply chains. We ask for greater collaboration and co-ordination between the regulated entities and the competent authorities in designating an organisation as a critical supplier.
Cyber Security and Resilience (Network and Information Systems) Bill (First sitting)
Q I have two questions. First, on the topic of cross-border control, how do you think we can get definition around the resilience obligations and how they apply to foreign-hosted systems, particularly given that your networks will be quite widespread? My second question is more broad. Given that you are all responsible for operating networks that are strategically important, and that you are also commercial companies, how do you think we strike the right balance between growth in AI, proportionate regulation and not stifling commercial innovation?
Dr Ian Levy: I will start with that one.
Cyber Security and Resilience (Network and Information Systems) Bill (Second sitting)
Q What additional resources will you need in order to implement and enforce the requirements of the Bill?
Ian Hulme: Again, to contrast the ICO’s position with that of other colleagues, we have a much larger sector, as it currently exists, and we will have a massively larger sector again in the future. We are also funded slightly differently. The ICO is grant in aid funded from Government, so we are dependent on Government support.
To move from a reactive footing, which is our position at the moment—that is the Government’s guidance to competent authorities and to the ICO specifically—to a proactive footing with a much expanded sector, will need significant uplift in our skills and capability, as well as system development in order to register and ingest intelligence from MSPs and relevant digital service providers in the future.
From our perspective at the ICO, we need significant support from DSIT so that we can transition into the new regulatory regime. It will ultimately be self-funding—it is a sustainable model—but we need continued support during the transition period.
Cyber Security and Resilience (Network and Information Systems) Bill (Second sitting)
Q Are you able to quantify that in any way?
Ian Hulme: At the moment, to give you a few broad numbers our teams are around 15 people, and we anticipate doubling that. In the future, with self-funding, we will be a bit more in control of our own destiny. It is a significant uplift from our perspective.
Natalie Black: The challenge is that the devil is in the detail. Until that detail has worked through secondary legislation, we will have to reserve our position, so that we give you accurate numbers in due course. From Ofcom’s point of view, it is about adding 10s rather than significant numbers. I do not think we are that far off the ICO.
But I want to emphasise that this is about quality, not necessarily quantity. Companies want to work with expert regulators who really know what they are doing. Ofcom is building on the work we are already doing under the Telecommunications (Security) Act 2021. It will be a question of reinforcing that team, rather than setting up a separate one. We want to get the best, high-quality individuals who know how to talk to industry and really know cyber-security, to make sure people have a good experience when engaging with us.
Ian Hulme: To add to that, the one challenge we will face as a group is that we are all fishing in the same pond for skills. MSPs and others will also be fishing in that pond from the sector side. There needs to be recognition that there is going to be a skills challenge in this implementation.
Stuart Okin: To specifically pick up on the numbers, we have a headcount of 43 who are dedicated within cyber regulation. That also includes the investment side. We also have access to the engineering team—the engineering directorate—which is a separate team. There is also our enforcement directorate, as well as the legal side of things. The scope changes proposed in the Bill are just the large load controllers and supply chain, so we are not expecting a major uplift. These will be small numbers in comparison. Unlike my colleagues, we are not expecting a big uplift in resourcing.
Cyber Security and Resilience (Network and Information Systems) Bill (Second sitting)
Q For the avoidance of doubt, I will put on the record that I am a member of the IPAC caucus in this Parliament. Thank you for coming in to see us. You have spoken about the threats from hostile and adversarial states. Given the scope of what we are talking about, can you give us any insight on what comparable western nations are doing to protect themselves?
Chung Ching Kwong: The US is probably a good example. It passed Executive order 14028 in May 2021, which requires any software vendor selling to the US federal Government to provide something called a software bill of materials—SBOM. That is technically a table of ingredients, but for software, so you can see exactly what components the software is made of. A lot of the time people who code are quite lazy; they will pull in different components that are available on databases online to form a piece of software that we use. By having vendors provide an SBOM, when anything happens, or whenever any kind of vulnerability is detected, you can very easily find out what happened.
That is due to a hack in 2021, in which a tiny, free piece of code called Log4j was found to have a critical vulnerability. It was buried inside thousands of commercial software products. Without that list of ingredients, it would be very difficult for people who had been using the software to find out, because, first, they may not have the technological capabilities and, secondly, they would not even know if their software had that component. This is one of the things the US is doing to mitigate the risks when it comes to software.
Something that is not entirely in the scope of the Bill but is also worth considering is the US’s Uyghur Forced Labour Prevention Act. That is designed to prevent goods made with forced labour from entering the supply chain. The logic of preventing forced labour is probably something that the UK can consider. Because the US realised that it could not inspect every factory in Xinjiang to prove forced labour, it flipped the script: the law creates a rebuttable presumption that all goods from that region are tainted, so the burden of proof is now on the importer to prove, with clear and convincing evidence, that their supply chain is clean.
A similar logic could be considered when it comes to this Bill to protect cyber-security. Any entities that are co-operating with the PLA—the People’s Liberation Army—for example, should be considered as compromised or non-trustworthy until proven otherwise. That way, you are not waiting until problems happen, when you realise, “Oh, this is actually tainted,” but you prevent it before it happens. That is the comparison that I would make.
Cyber Security and Resilience (Network and Information Systems) Bill (Second sitting)
Q With regard to ransom payments and extortion attempts, what do you typically see? Is it for monetary gain or intellectual property data—what is the split?
DCS Andrew Gould: That is another really good question. Generally, it is financial, but you will often get what is called the double dip, so there is the extraction of data as well as the encryption of it, so that you no longer have access to it. They might take that data as well, primarily personal data, because of the regulatory pressures and challenges that that brings. There is a sense among a lot of criminal groups that, if they have personal data, you are more likely to pay, because you do not want that reputation, embarrassment and all the rest of it, as opposed to if they take intellectual property, for example. But it is not that that does not happen as well. Primarily, it is financial gain.
Cyber Security and Resilience (Network and Information Systems) Bill (Second sitting)
Q Would the cyber-attacks on JLR and M&S that took place last year be in the scope of this Bill?
Kanishka Narayan: I am shy of making comments on specific incidents, but as a broad brush, clearly the food supply or automotive manufacturing sectors are not directly in scope of the Bill, for reasons I am very much happy to discuss.
Cyber Security and Resilience (Network and Information Systems) Bill (Second sitting)
Q Do you think they should be within scope?
Kanishka Narayan: Let me place the focus of this Bill in the global context. As we have heard, there is a range of legislative as well as non-legislative measures on cyber-security. It is deeply important that every organisation, whether in scope of the Bill or not, acts robustly, and we will look at that, not least through the cyber action plan, which I know industry welcomed earlier today and which we are looking forward to publishing very soon.
The particular focus of this Bill is on essential services, the disruption of which would pose an imminent threat—for example, to life and to our economy—in the immediate context. For reasons that we can dive into, if you look at a market such as food supply, the diversity, competitive nature and alternative provision in that market are so obvious that to designate it as fitting the definitional scope I have just highlighted would not be an evidence-led way of engaging.
Cyber Security and Resilience (Network and Information Systems) Bill (Second sitting)
Q But would you like to see a Bill that goes further and has broader scope?
Kanishka Narayan: As I have said, this legislative vehicle is focused on really high standards of rigour for essential services. I am very keen to ensure that, in the first instance, we are engaging with those companies through the cyber action plan and the National Cyber Security Centre’s framework and to ensure that, as a consequence of those, they are in a robust place.
Cyber Security and Resilience (Network and Information Systems) Bill (Second sitting)
Q With regard to skills, given the acute shortage and the growth of this industry, what do you propose to ensure that the public sector is adequately resourced, given what will undoubtedly be a very lucrative private sector appeal for that talent?
Kanishka Narayan: This is a great question. There are two things on my mind. One is that the Government have published a cyber action plan, the crux of which is to make sure that, from the point of view of understanding, principles, accountability and, ultimately, skills, there is significant capability in the public sector. The second thing to say is that we have a very broad-based plan on skills more generally across the cyber sector, public and private. For example, I am really proud of the fact that, through the CyberFirst programme, some—I think—415,000 students right across the country have been upskilled in cyber-security. It is deeply important that the public sector ensures that we are standing up to the test of hiring them and making the attraction of the sector clear to them as well. There is a broad-based plan and a specific one for the public sector in the Government context.
One of the areas causing the delays is the lack of defence barristers. It will clearly take time to train new barristers, but what incentives can the Minister offer to those qualifying in law to become defence barristers, rather than seeking other avenues in the law?
T5. To discourage ex-offenders from reoffending, it is crucial that on leaving prison they have a stable home, the opportunity of a job, and a stable network around them to stop them reoffending. However, with the advent of early release, there is a risk that those leaving prison are not given that support before they leave the prison gates. What action will the Minister take to ensure that those leaving prison after completing their sentences actually do not reoffend?
The IRGC and the so-called morality police have murdered 30,000 people on the streets of Iran. They pursued the wounded to their home, or to hospital, and murdered them. Given the length of time we have had to consider the proscription of the IRGC in its entirety, and given that we now have clear evidence of our own allies proscribing the IRGC in its entirety, why are the Government are not bringing forward such a proscription? Just before the weekend, I contributed to a cross-party letter to the Prime Minister, in which Members offered to support the fast-tracking of legislation through both Houses. The will is there on both sides of the House. Obviously the Minister cannot answer this at the Dispatch Box now, but will he go back to the Foreign Secretary and the Home Secretary, and ensure that this gets done?
The use of drones to bring contraband into prisons has become a significant issue. Last year there was an intra-year increase of 43% in the use of drones for illegal activity on the prison estate, and, as an MP with a prison in my constituency, HMP Littlehey, I find this surge in their use alarming.
Last month the Justice Secretary announced that he had
“tasked British prisons with learning from Ukraine’s drone expertise”
with a £6.5 million funding stream, but no tenders are currently out to develop that capability. The only specific competition from the Ministry of Justice has been November’s £60,000 counter-drone challenge. Can the Justice Secretary tell us what is the current counter-drone strategy for HM Prison and Probation Service, given the current delays in the installation of physical unmanned aircraft systems countermeasures, what specific projects are actually in flight to develop the counter-UAS capability across our prison estate, and by when that capability will be available?
I wholeheartedly agree that our most dangerous prisoners should be dealt with appropriately, but I will touch on an adjacent point around prison capacity. We are aware that the Government are in the process of rolling out more prison places—around 14,000—but we are also aware that none of those prison places are currently designated as category A. Looking at the most recent statistics for the beginning of the year, we see that of the available capacity in the prison system, only 12% is category A. Is the Justice Secretary confident that there is enough remaining capacity in the prison system at category A level, given that the remaining prison places planned are categories B to D? What is the number of available prison places remaining that will trigger a need for us to build out that capacity?
Draft Greenhouse Gas Emissions Trading Scheme (Amendment) (Extension to Maritime Activities) Order 2026
It is an absolute pleasure to serve under your chairmanship this morning, Sir Jeremy. The draft order affects the implementation of the UK emissions trading scheme, which replaced our participation in the EU ETS from 2021. As the Minister set out, the scheme was established under the Climate Change Act 2008 by the Greenhouse Gas Emissions Trading Scheme Order 2020.
In the draft order, the Department seeks to expand the scope of the UK ETS in line with the Secretary of State’s net zero agenda. We saw just last week an instrument brought with the effect of reducing the free allowances under the scheme, increasing the carbon tax on industry from 2027 onward. The increasing cost on industry per tonne of greenhouse gas emitted is a burden that weighs on the UK’s industrial competitiveness. Food manufacturers, oil refineries, power stations and more are all subject to this framework. As the levy on emissions increases, naturally prices paid by end consumers are also driven up. That is why we have said that when we are re-elected to Government in three years’ time, we will repeal the ETS framework and begin to undo the great damage to Britain’s industrial base being done by the actions of this Government. We only hope that it will not be too late.
The draft order requires maritime operators to participate in the scheme, enacting a requirement on ship operators to produce an emissions monitoring plan. The nominal purpose of this extension is to encourage decarbonisation in the maritime sector, which is a laudable aim—not that it will have any impact on global maritime emissions, given the fact that the USA, China, India and others have no plans to curb their emissions in the maritime sector. As a result, this mechanism will actually function purely as a carbon tax. To pretend otherwise would be this Government at their absolute abject worst. This is not a mechanism to decarbonise; it is a pernicious tax being levied on one of our most successful industries.
Access to alternative fuels is not sufficient to decarbonise at the level required by the scheme. The infrastructure that the UK maritime industry requires to transition to low carbon simply does not exist at the scale that will be required. Worse, the industry is expected to comply in three months’ time, while still awaiting guidance to be published on how they can implement it. Even for this Government, that is either incompetence of the highest order, a deliberate attempt to squeeze a hard-pressed industry even more to make up for the shortfall in Treasury receipts as businesses and individuals up sticks and get out of the United Kingdom.
The Department’s own impact assessment quotes an £85 million cost to British business as a result of this mechanism and we have not even turned to the burden that this mechanism is going to place on operators. This emissions monitoring plan represents a ridiculously onerous administrative burden on maritime businesses. Article 18 of the order details the facts to be logged on each voyage for ships completing fewer than 300 voyages per year, including:
“(a) port of departure;
(b) date and hour of departure;
(c) port of arrival;
(d) date and hour of arrival;
(e) total amount of each type of fuel consumed;
(f) emission factor for each type of fuel consumed;
(g) amount of each greenhouse gas emitted.”
The burden then falls on the maritime operator to produce a risk assessment to identify potential sources of error in data flows. I recite that content only to illustrate the extent of the burden that this regulation imposes on the sector.
This instrument extends the ETS burden to the UK shipping industry to the tune of £175 million in administrative costs alone. That is utterly absurd. This is without doubt one of the worst pieces of legislation I have seen come before us in three Parliaments and nine years on Government Front and Back Benches and now in opposition. For every £1 spent on decarbonisation as a result of the framework, £8 will be spent on bureaucracy. That is insane. That does not support businesses or growth. The only thing growing here is the burden of red tape—the Government’s favourite colour—on UK industry.
I take this opportunity to put on record my support for the specific exemptions made for fishing vessels and ferry services providing essential connectivity for Scottish islands. It is vital that they are exempt from the burden of the restrictions, albeit it is to be for only one year. One questions why the Isles of Wight and Man and the Scilly Isles are not afforded the same level of concern. 1 would argue, and I know my hon. Friend the Member for Isle of Wight East will argue, that the connections to those islands are just as vital as connections to the Scottish isles.
Believe it or not, Sir Jeremy, it gets worse. Although the extension is a major blow to the maritime industry and UK shipping competitiveness overall, it is another death knell for the oil and gas industry, which is yet again being totally shafted by this Government. This instrument includes in its definition of offshore vessels those that support the oil and gas industry, which are not protected by the 5,000 GT threshold. The Government estimate that more than 145 oil and gas support vessels will be impacted by this instrument, but we know they do not care, because most of the vessels sail out of the port of Aberdeen, which is already suffering job losses as a direct result of the Government’s policies on oil and gas. Aberdeen city and shire have no Labour MPs or MSPs, so we know the party does not care about the fate of that city, its industry, economy or people. Those of us who live there feel that every day.
What impact does the Minister think the extension will have on the north-east of Scotland and the UK oil and gas sector—a sector already suffering blow after blow from the Labour Government? What impact will that have on energy security? May I also ask the Minister what assessment he has made of the risk of carbon leakage in the maritime sector and whether he believes the safeguards under this instrument are sufficient? We do not simply oppose this instrument; we will vote against it. We oppose the UK ETS and carbon taxes that are crippling UK manufacturing and businesses and deindustrialising Britain at a criminal rate. On behalf of all those who this Government are harming by their reckless actions, we ultimately oppose this Government.
Draft Greenhouse Gas Emissions Trading Scheme (Amendment) (Extension to Maritime Activities) Order 2026
As somebody who served in the Royal Navy for four years after I left school, I have full awareness of maritime operations and of the importance of our United Kingdom. I was talking about the gross unfairness of this legislation and the impact it is having on some communities around this kingdom, whether on the Isle of Wight or in Northern Ireland. The Minister has the audacity to claim that CBAM is protecting British industry, when his Government’s policies are doing more to undermine British industry than any policy of any Government in recent history. The deindustrialisation we are seeing in this country is something of which his party, which still laughably calls itself the Labour party, should be utterly ashamed. I ask him to withdraw his remark about the ignorance of maritime affairs.
Cyber Security and Resilience (Network and Information Systems) Bill (First sitting)
Q You have both mentioned the risk involved in supply chains. Do you think that, outside regulated industries, the Bill goes far enough to secure supply chains? If not, what would your recommendations be?
David Cook: The legislation talks about secondary legislation, so it allows for an agile, flexible programme whereby organisations can be brought within scope very quickly if concerns make that necessary. What that leaves us with, though, is that although legislation can be changed quickly, organisations often cannot. Where there is a definition, as we see with NIS2, as to which entities are in scope, organisations can embark on a multi-year programme to get into a compliant position. They can throw money at it, effectively.
What this legislation talks about, through the secondary legislation, is bringing organisations into scope and mandating specific security controls or specific requirements on those organisations in terms of security, but while the law might come in over a weekend, organisational change will not necessarily follow. There is a potential issue there. I can see the benefit and attractiveness of secondary legislation being used to achieve that aim, but having a clearer baseline as to what that sort of scope might look like—it could be ramped up or down, and the volume could be turned up or down, depending on need—would be more helpful. Reducing scope while diverging from NIS2 might be a benefit in terms of the commercial reality, but it might be a misstep in terms of security and the long tail that it takes to get more secure.
Cyber Security and Resilience (Network and Information Systems) Bill (First sitting)
I am so sorry. Could you possibly speak into the microphone? I cannot hear you.
Stuart McKean: Sorry. I was saying that the cyber-criminal does not care about lines, geographies or standards. They do not care whether you have an international standard or you follow the legislation of a certain country. They will attack where they see the weak link.
Cyber Security and Resilience (Network and Information Systems) Bill (First sitting)
Q Returning to the supply chain risks, I want to ask you about the difference between OT—operational technology—and IT, and whether there is sufficient detail in the Bill to protect that. If you have intelligent electronic devices from single suppliers across multiple sectors, are we confident that there is sufficient detail about what the regulatory role is in saying that suppliers should be within scope? Is more detail needed in the Bill?
Stuart McKean: I am not an expert on the detail, but I would say that there is currently very little detail in the Bill regarding IT and OT.
Cyber Security and Resilience (Network and Information Systems) Bill (First sitting)
Q Do you think that there should be more or not?
Stuart McKean: The devil is always in the detail, so any more clarity that can be put in the Bill is always going to be a good thing.
Cyber Security and Resilience (Network and Information Systems) Bill (First sitting)
Q I have two specific questions. The first is about OT versus IT. Do you think that OT and its supply chains are sufficiently covered in the Bill? Secondly, given that you are all from commercial organisations, from your direct client experience, what is going to be the thing that moves the dial on board governance, specifically in relation to cyber?
Chris Anley: On the OT versus IT question, we have mentioned specificity versus flexibility. The benefit of the UK sectoral regulator model is that regulators that are in areas where OT is predominant can set specific measures that can reinforce those environments, whereas if you try a one-size-fits-all approach, you run the risk of certain critical OT-based systems becoming subject to successful attacks.
Ben Lyons: The broad approach that the UK is taking is sensible, in that the existing guidance has a range of principles around OT, as well as IT, security. Manufacturing is not in the scope of the Bill, which is probably appropriate, but it is worth looking at what could be done to improve the security of the manufacturing sector, more broadly, probably through non-legislative means. In light of recent attacks, it is important to ensure that guidance and incentives are in place to support that sector.
Animals in Science Regulation Unit: Annual Report 2024
It is a pleasure to serve under your chairmanship, Sir John. I thank the hon. Member for Aberdeenshire North and Moray East (Seamus Logan) for securing this debate and all Members who have spoken in it. There are few issues that reflect our values as a society more than how we treat creatures in our care. Many people in our communities and across our country rightly feel strongly about this, and it is clear from the debate that Members from all parties share concerns for animal welfare.
Animal testing should be a last resort, only when there are no viable alternatives. That was the view of the last Conservative Government. We did not just talk about the three Rs—replacement, reduction and refinement—but legally embedded them into the fabric of our regulatory framework. We backed that with £90 million in research and a £27 million further fund called the CRACK IT Challenges innovation scheme, as well doubling annual investment to £20 million for the 2024-25 fiscal year. We also refused to vote for bans on protests outside animal testing sites. Can the Minister confirm whether the levels of investment that we left in place have been maintained, and what steps are being taken to accelerate the development of alternatives?
Turning to the annual report, these are figures that warrant rigorous scrutiny. I welcome the fact that the number of animals experiencing adverse welfare outcomes has fallen, but the statistics on non-compliance make for very difficult reading. As we heard, there were 146 cases of non-compliance across 45 different establishments, with 63 of those involving a failure to provide basic care such as food, water or suitable facilities.
The unacceptable instances highlighted by Members are harrowing: unweaned pups starving to death after their mother was killed; mice left without water for five days; and live animals accidentally placed in waste bags. Those are not administrative oversights; they should be criminal acts. Those animals are supposed to be protected under our regulatory system, but concerningly, 75% of cases are resolved with inspector advice alone. Does the Minister agree that a letter of reprimand is not a sufficient deterrent for such a profound failure of care?
We must ensure that sanctions are not just administrative slaps on the wrist but robust measures that prevent recurrence and punish wilful neglect and cruelty. Just last month, the hon. Member for North Ayrshire and Arran (Irene Campbell) asked directly whether a letter of reprimand was adequate. The Minister’s answer referred to a compliance framework, but did not address whether this sanction was sufficient. Will the Minister before us today commit to reviewing the effectiveness of current sanctions?
On staffing, while I know the Government have committed to increase inspector capacity by March 2026, capacity is currently lower than the average over the last 10 years, so I urge a focus on adequate recruitment. Turning to the 2025 strategy, the proposed three-baskets approach provides a welcome road map. It is right that the Government move quickly where mature technology exists, such as in skin-irritation testing, and aim for total replacement in 2026.
However, I sound a note of caution: we must ensure that we do not see countries with lower regulatory standards becoming industrialised for animal testing. Some products will continue to require animal testing, and we must not rely on animal suffering being exported and happening elsewhere, because that will be under worse conditions beyond the reach of British regulation. It would be not a victory for animal welfare but an abdication of responsibility. Can the Minister also share what steps have been taken to ensure that products imported into this country have been developed to adequate standards?
We all want to see the day when animal testing is no longer needed, but until that day comes, we have a duty to ensure that every procedure is justified, every harm is minimised, and every failure of care is met with the full force of a robust and well-resourced regulator, not a written rap on the knuckle.
Mr Speaker, you have been stalwart in standing with those of us who were sanctioned by the People’s Republic of China all those years ago, and you have been very clear that we stand as one in this House. Do you not find it as surprising as I do that the Prime Minister has come back with a deal that lifts the sanctions on those six of us who are still in this House, but not the one who is not, nor the lawyers, advisers and academics who support the work of this House? Is this not a direct affront to the democracy of this place, and an attempt to divide and conquer that we have seen China play against the European Parliament and that, sadly, has tricked our Government too?