Cyber Security and Resilience (Network and Information Systems) Bill (Sixth sitting)
I think the Minister is saying that there will be a parliamentary scrutiny mechanism under these powers. Is that what he is saying?
Showing every spoken contribution, including 5,731 under 12 words. Hide short remarks
I think the Minister is saying that there will be a parliamentary scrutiny mechanism under these powers. Is that what he is saying?
Okay.
I really think we should be very critical about this. What we are doing now is parliamentary scrutiny. There will be directions in future, which we expect to be laid, and they will also be subject to parliamentary scrutiny. Even where they are redacted because of national security concerns, somebody, or some mechanism of Parliament, will be able to scrutinise them. Can the Minister confirm that?
Okay.
Clause 45 gives the Secretary of State powers to require regulatory authorities to monitor and report on regulated entities’ compliance with directions given under clause 43 for reasons of national security. Clause 46 provides the Secretary of State with extensive information-gathering powers through the use of information notices to facilitate the giving of directions and monitoring of compliance with directions under clause 45(4). Clause 47 empowers the Secretary of State to conduct inspections to assess whether a regulated entity is complying with directions issued under clause 45(4). The Secretary of State may appoint a third party to conduct the inspection, and require the regulated entity to meet the costs associated with this. I reiterate the point that these powers are necessary; however, given the potential for significant cost and administrative burden for businesses, they should be subject to contemporaneous or near-contemporaneous oversight by parliamentary authorities, observing the necessary confidentiality protocols. I also make the point that these information-gathering powers apply extraterritorially and may lead to conflict with regulated entities’ data privacy obligations in other jurisdictions. What discussions has the Secretary of State conducted with industry and law enforcement counterparts in other countries about the approach to information sharing for this purpose, and the implications for companies operating services on a cross-border basis?
Clauses 48 to 52 deal with notifications and financial penalties where a regulated entity is deemed not to be compliant with directions issued by the Secretary of State under part 4. In particular, clause 48 would grant enforcement authorities powers to issue a contravention notice if they believe a person has failed to comply with a requirement under part 4. The notice must set out details of remedial steps to address the failure, as well as the financial penalty that the enforcement authority intends to impose. Clause 49 would require penalties to be set at a level that is appropriate and proportionate, with the maximum penalty being £17 million or 10% of turnover. A maximum daily penalty of £100,000 applies to ongoing breaches. The maximum fines for failing to comply with an information notice or an inspection would be set at £10 million.
Clause 53 would grant the Secretary of State powers to issue directions to regulators where this is necessary for national security reasons, and to allow a reasonable period for the regulator to comply with that direction. Clause 54 provides that directions may be amended or revoked by the Secretary of State. Under clause 55, directions to regulated entities or regulators must be laid before Parliament unless that “would be contrary to the interests of national security.” I repeat my earlier question about the ISC’s role regarding scrutiny. Clause 56 would permit the Secretary of State and regulatory authorities to share any information obtained under part 4 with each other and the NCSC. The provision also allows for the sharing of information with other UK or overseas public authorities with equivalent cyber-security or national security functions. Government amendments 23 and 24 seek to amend that clause to provide for directions and notices issued under this part to be sent by email to relevant persons who provided those contact details to regulatory authorities. Some reassurance on the extent of information sharing for businesses is delivered through provisions specifying that disclosures of information should be limited to that which is relevant and proportionate. However, those are high-level and subjective terms, open to interpretation by the authority sharing the information. Can the Minister provide any update on the development of protocols between authorities to ensure that information shared is limited to that which is necessary for effective oversight and enforcement in relation to national security risks?
I beg to move, That the clause be read a Second time.
New clause 2 contains an obligation for the Secretary of State to establish and maintain by regulation a list of foreign powers presenting a significant cyber-security risk to the UK. The list must include states that have been confirmed by GCHQ as having perpetrated a cyber-attack, whether by a state department, agency or affiliate, on the UK in the preceding seven years. It must also include foreign powers that GCHQ has warned pose a risk to the security or resilience of the network or information systems of one or more operators of an essential service or critical suppliers. New clause 3 would compel the Secretary of State to review and report to Parliament on the risk to networks and information systems posed by foreign powers appearing on the register under new clause 2, with specific regard to activities undertaken from abroad and the risk posed by locations or premises controlled by those states in the United Kingdom. New clauses 13 and 15, in the name of the hon. Member for Henley and Thame, look as if they have been tabled in the same spirit of genuine concern about the risk of foreign hostile state interference and control in critical systems and supply chains. There is an established precedent in UK legislation for maintaining registers or lists of hostile state actors and other entities presenting a threat to our national security for use by Government. That includes the foreign influence registration scheme under the National Security Act 2023, which came into effect last year. Russia and Iran were placed on an enhanced tier of the scheme, which applies to foreign powers considered to pose a risk to the UK’s safety or interests. The Government said that that was in response to those countries being identified as presenting an elevated national security risk. China was conspicuous by its absence, despite the director of GCHQ having confirmed in 2024 that her organisation devotes more resource to China than to any other single mission.
Frankly, I find it astounding that, according to my understanding, in response to the planning decision being granted our security services said that they would take measures to start moving sensitive digital cables. It strikes me that a decision about sensitive digital cables should have been pertinent to the planning application in the first place. The Government remain reluctant to name China as a threat to UK national security, despite the overwhelming and growing portfolio of evidence. In case the Government are still in any doubt, we need look only at the oral testimony given to this Committee by the Inter-Parliamentary Alliance on China for a clear picture of the role of China and its state affiliates at the forefront of the cyber-security threats to our critical sectors. Given that established and growing threat, new clause 3 would compel the Secretary of State to review, among other matters, the cyber-security risk to surrounding critical networks in the vicinity of the super-embassy site in the City of London. In the Commons debate on the embassy application in June last year, my hon. Friend the Member for Thirsk and Malton (Kevin Hollinrake) reminded the Minister for Housing and Planning that the Government’s own cyber-security experts, Innovate UK, have warned about the threat to the City of London from the embassy. My hon. Friend made specific reference to the Wapping telephone and internet exchange that would be surrounded on three sides by this new embassy—not to mention the fibre cables I referred to earlier, which carry highly sensitive information and run beneath this site.
I do not want to repeat the discussion that we had a moment ago. I think it is complete lunacy to permit the building of a super-embassy—one of the biggest in the region—next to highly critical data transmission. I am also concerned by media reports that the Prime Minister’s recent visit to China was greenlighted only following the final approval of the embassy. I am deeply depressed that, following the visit, Jimmy Lai has been effectively sentenced for life. I respect the tone and constructive way in which the hon. Member for Harlow approaches this debate, but it is fair to say that the Government are sadly weak on standing up to hostile state actors such as the Chinese Communist party. As I said at the start, there is simply no point in granting the Secretary of State powers to issue directions on the basis of national security if the Government are not willing to be clear-eyed about the most critical cyber-security risks to the nation. I therefore submit that the new clauses are a vital addition to the Bill to focus the attentions of the Secretary of State to ensure that her functions under part 4 are carried out in the best interests of our national security. No responsible Government would or should vote against such provisions. Parliament should make it crystal clear that the Chinese Communist party is a threat to the United Kingdom. We must support new clauses 2 and 3. Ordered, That the debate be now adjourned.— (Taiwo Owatemi.)
I will allow Munira Wilson to intervene—at a stretch, because she arrived late to the debate.
Order.
Order. I am going to begin calling the Front Benchers at 5.08 pm—do the maths.
Does the Minister appreciate how appallingly bad it looks for the Prime Minister of this country and the then ambassador in Washington, the disgraced Peter Mandelson, to have met Alex Karp, the chief executive of Palantir, in February last year without any written record of the meeting being made? Is he at least able to say which officials—other than, of course, our then ambassador—were present at that meeting?
It is a pleasure to serve under your chairmanship, Dr Murrison. I draw hon. Members’ attention to my entry in the Register of Members’ Financial Interests. I am a parliamentary vice-president of London Councils and a vice-president of the Local Government Association. I would like to thank those organisations for the excellent research that they have supplied to Members to help us prepare for today’s debate. While I congratulate the hon. Member for Dulwich and West Norwood (Helen Hayes) on securing the debate, listening to her story of being a councillor—one that is reflected, I think, by a good number of Members who were present this afternoon—made me think about where it sits in the context of what is happening with the local government funding formula overall and the particular impact that it is having on our inner-London boroughs. We know that London’s funding formula has always, to an extent, created a city of two halves. There are the inner-London boroughs, with a relatively generous settlement from that funding formula and, historically, generally lower council taxes. Then there is a doughnut of outer-London boroughs, in which my constituency and that of my hon. Friend the Member for Bromley and Biggin Hill (Peter Fortune) are found, with a funding level broadly in line with the surrounding county and district authorities. For a long time, it has been a source of concern among London authorities that there needs to be some levelling out to ensure consistency across council tax and funding. To address the longer-term funding issues, however, the Government clearly need to address the nature, scope and purpose of many of the statutory duties that exist across all those authorities, in order to enable us all to live within our means and to set levels of taxation that are reasonable for our constituents to pay. Sadly, we are not seeing that happening. Instead, as the hon. Member for Sutton and Cheam (Luke Taylor) described, we have a Government who came to office saying that they were the cavalry coming over the hill, and that they could be trusted to inject additional resources into inner London, outer London and other parts of the country that were concerned about funding. In their first Budget, however, local government was left £1.5 billion net worse off through the jobs tax—the national insurance rise—alone. The consistent feedback from councillors across London is that they feel a sense of shock and surprise at just how fast things have got so much worse. There are also particular significant dynamics in inner London. As several hon. Members have said, in the local government finance settlement, more than two thirds of the additional resources announced by the Government would come from the maximum possible council tax rise being imposed across the board. That is not additional Government funding, it is simply councils being required, as a minimum, to use their maximum possible tax-raising powers on the household budgets of all their local residents. We also see the impacts of exceptional financial support, a policy that has existed under Governments of all stripes under different names for a long time. It is essentially a measure to allow a council to borrow to get it through temporary financial difficulties. It is a way of avoiding the issuance of a section 114 notice, which is the equivalent of a bankruptcy notice, by the statutory finance officers in that local authority. On an almost weekly basis, this Government make written ministerial statements on local government best value interventions, and on agreeing exceptional financial support to the extent that it is no longer exceptional. It is clearly simply a method of sustaining local authorities to avoid bad headlines, rather than addressing the nature, scope and purpose of statutory duties, which need to be addressed to get budgets back into balance. Acute pressure has been created by an explosion in rough sleeping and homelessness in inner London since this Government took office. We need to be clear: London has always had a challenge around rough sleeping. Although my constituency does not cover Heathrow, it is a significant factor in my local authority’s activities. The number of people who find their way to an airport that is open 24/7, with showers, toilets and security, means that there are a disproportionately large number of rough sleepers in my local authority’s area. As we heard, there has been a 27% increase in street homelessness since this Government took office. That contributes to the sharply rising pressure on temporary accommodation that London Councils, on behalf of the capital’s local authorities, has highlighted as the biggest single factor driving inner-London councils to seek exceptional financial support and to look at significant reductions across the capital in the services that our constituents expect local authorities to provide, such as libraries, parks and clean streets. At the same time, according to a recent report by Savills, two thirds of London boroughs report reaching net zero: not net zero in the traditional sense of an environmental target, but net zero new housing starts. In two thirds of our capital’s boroughs, no new homes are being added to the housing stock at a time when the Government have an increasingly unattainable target of 1.5 million new homes. To hear hon. Members from throughout the Chamber talk about the acute pressure from housing need, at a time when housing delivery in the capital has absolutely collapsed, demonstrates that things are not going in the right direction. We are due to consider the local government finance settlement in the main Chamber tomorrow. More two thirds of local authorities have reported, having crunched the numbers on that funding formula, that they will be left worse off under it. Two thirds of councils in the country are worse off under the funding settlement being introduced by this Labour Government. There is another significant factor. This week we heard that the SEND White Paper is to be delayed further. It will address the significant long-term structural and demographic concern driven by the increasing numbers of children with more acute needs for whom local authorities have a statutory duty—another duty over which they have no discretion. Although the statutory accounting override—to which Ministers have referred in the past—goes some way to avoiding that becoming an acute problem, we see acute pressure building up across the country, not just in inner London. All that amounts to a situation where residents in inner London face extraordinarily significant increases in their taxes. The royal borough of Kensington and Chelsea has reported potential increases of council tax of up to £500 a year. Earlier, I met with one of the Conservative councillors from the London borough of Barnet, traditionally one of the less affected outer London boroughs, who reported that a £200 million funding gap is opening up as a result of the changes that this Government are making. Even for those of us in outer London boroughs, where council tax rates are broadly similar to those in the surrounding county and district areas, the combination of the rises in the mayoral precept, referred to by my hon. Friend the Member for Bromley and Biggin Hill, and those acute pressures, mean that in many cases council tax will already be at or well in excess of the £2,000 benchmark that Ministers have set out for council tax across the country. In conclusion, we see a consistent message from across the sector. The leaders of inner-London boroughs—Labour and Conservative—talk of acute pressures getting much worse much faster than they had expected, and shortfalls in this funding settlement so excessive that no level of cuts could lead to boroughs achieving them and meeting their statutory duties. When she speaks on the local government finance settlement tomorrow, will the Minister announce a more fundamental rethink? Local authorities have a huge range of statutory duties, with more than 800 different services delivered by a typical local authority. The rise in national insurance alone has significantly driven up the cost of those activities. We do not simply need more sticking plasters. Our residents, hearing a message from the Labour Government that there is more money in the system, find that money is coming straight out of their pockets and wallets, through massive increases in council tax. We need a fundamental rethink about how we deliver local government in the capital, so that it is affordable, deliverable and sustainable for the future.
Thank you, Mr Speaker, and it is great to see you back on your feet. Last week, the Labour party voted to increase the carbon tax, which increases costs for households and industry, and those costs have already doubled because of its policies. It is absolutely shameful for the Government to say that they have had no impact on the carbon tax whatsoever. It now accounts for over 10% of household electricity bills, and the rise is in effect a £5 billion a year tax on the British economy. Can the Minister explain why the Labour party wants to tax our industrial jobs out of existence, leaving Britain reliant on dirtier imports from abroad?
Last year, the Secretary of State signed a secret energy deal with China, which he has refused to publish. This is simply unheard of. We have heard repeatedly from intelligence services that China might seek to disrupt our energy system, so it is crucial that the public get to see what he has signed us up to. Will the Secretary of State commit to publishing the full text of his secret energy deal with China, and if not, will he tell the House what it is that he is trying to hide?
That is frankly another patronising non-answer from the Secretary of State. I am not sure whether he got the memo, but his party is fed up with the sexist boys club. What is crucial is that the public have lost faith in the Labour party. This is a serious moment. Does he accept that when he stands at the Dispatch Box and tells the public that by his calculation their bills are falling, not rising, they simply do not believe him? Does he also accept that when he does not set out what any of his plans—such as doubling the carbon tax or clean power 2030—will do to bills, he makes a mockery of his party’s pretence that it cares about the cost of living? Does he not reflect on all this—the £300 nonsense pledge, the Great British Energy fig leaf—and realise that when it comes to loss of trust, he is not their salvation but their problem?
Order. The hon. and learned Lady will know that she had three minutes, which she has used. I call the shadow Minister.
I call the Chair of the Justice Committee.
I call the Liberal Democrat spokesperson.
Order. The hon. Gentleman’s question ought to relate to the urgent question.
The hon. Gentleman will know that that is not a point of order and not a matter for the Chair. I do not intend to continue the debate via points of order.
I call the shadow Minister.
I call the Chair of the Energy Security and Net Zero Committee.
I call the Liberal Democrat spokesperson.
Order.
I thank the Secretary of State for making his statement—and for not doing so in Lycra.
I thank the hon. Member for giving notice of his point of order. It is of course crucial that Members receive timely responses to correspondence with Ministers. As he will know, it is not a matter for the Chair, but I am sure that those on the Treasury Bench will have noted his concerns. If there have been delays to responses to written questions, he can raise that with the Table Office. Bill presented Images (Non-consensual Recording and Distribution) Bill Presentation and First Reading (Standing Order No. 57) Wera Hobhouse presented a Bill to create offences relating to the non-consensual recording of images of a person and the online distribution of such images for profit with the purpose of obtaining sexual gratification or of causing humiliation or distress to that person; and for connected purposes. Bill read the First time; to be read a Second time Friday 27 February, and to be printed (Bill 381).
With this it will be convenient to discuss the following motion: That the draft Social Security Benefits Up-rating Order 2026, which was laid before this House on 12 January, be approved.
I call the shadow Minister.
I call the Chair of the Work and Pensions Committee.
I call the Liberal Democrat spokesperson.
I have two points for the Minister to address. First, could he clarify whether an organisation would face repercussions if a regulator believed in retrospect that notification should have been provided sooner? Secondly, on customer notification, can the Minister address the concern around striking the right balance between informing the customer and ensuring that the update that they receive is meaningful and not so vague that it causes further distress or worry?
It is a pleasure to serve under your chairmanship, Dr Murrison. When introducing new legislation, it is essential that those who fall under its new regulations be clearly identified and given adequate time to prepare for compliance. However, despite the aims of the Bill and the wish to avoid worsening a cyber-attack incident, the Bill still presents far too much ambiguity. It is right to recognise the cyber landscape as continuously evolving. There is no dispute that this terrain becomes increasingly complex each day, requiring a level of flexibility in legislation to ensure that it keeps pace. However, this desire to safeguard such adaptability, and the goal of future-proofing, must not come at the expense of the effectiveness of legislation in the present day. The powers afforded to the Secretary of State to change the classification of essential activity, and to bring new sectors into scope of the Bill at any time, undoubtedly create uncertainty for many sectors and cast a shadow over long-term compliance. To be clear, we want organisations to comply with this legislation. We want to improve national cyber-resilience, gather vital intelligence and restore public confidence in our security. Why, then, would there not be a significant effort to make these regulations as easy to apply as possible, rather than leaving thousands of businesses second-guessing whether they fall within scope, with the pressure of large financial penalties hanging over their heads? In addition, many will know that I am a firm supporter of parliamentary process. I support the notion that all legislation should receive the scrutiny it is due by the democratically elected Members of the House of Commons. That is why I believe the Bill must not only set out clearer guidelines for who is in scope, but require an official amendment, debated in the House, to permanently bring any new sectors into scope after the Bill has been passed. I understand that, in times of emergency, the longer process of House of Commons scrutiny may not always be possible. That is why the Secretary of State should have powers to bring in sectors necessary in an emergency temporarily into scope, with less imposing of non-compliance penalties until their inclusion is made permanent by the House. Such an approach would not only allow for the quick reactions that cyber-security demands, but respect parliamentary processes and safeguard against organisations’ being unaware that they had suddenly been brought into scope until they received a potentially financially ruinous penalty notice for non-compliance. Looking at the need for more definitive guidelines on who will be regulated under the Bill, we have already heard from numerous industry stakeholders that are unsure whether they, or other organisations in their sector, will fall within the mandatory scope. In addition, industry experts have publicly shared concerns about how far the net may be cast in some sectors, leading to the unintentional inclusion of organisations that are critical only to a single larger organisation, rather than to our national security, while ignoring other essential sectors altogether. Looking at recent cyber-attacks that have had a significant impact on our country, it is concerning that the definition of essential services may not include them within scope. While it is predicted that many of Jaguar Land Rover’s supply chains will be in scope, it has been publicly questioned whether it will be included. As the largest car manufacturer in the United Kingdom, it directly employs over 30,000 people across the UK and supports around 100,000 jobs indirectly. It is therefore no surprise that the cyber-attack it endured, estimated to have had a financial impact of over £1 billion, was significant to many, including more than 5,000 organisations impacted and many of my constituents, with JLR being one of the largest direct and indirect employers in the west midlands region. How, then, if a key aim of the Bill is to ensure that all essential services whose disruption would profoundly impact our nation in the event of a cyber-attack report all major incidents, can the vagueness of the definition of essential services be allowed to stand—especially when it creates a situation in which previous key victims are excluded? Of course, JLR is not the only victim where questions of inclusion remain. Also potentially falling outside the regulatory reach is Marks & Spencer, whose recent cyber-attack was another stark reminder of the rapidly advancing cyber-crimes scene and caused significant disruption, with costs estimated to run into the millions of pounds. Having met with M&S representatives recently, I had the opportunity to discuss their experience of enduring such an attack. Archie Norman, M&S chair, gave evidence to the Business and Trade Sub-Committee on Economic Security, Arms and Export Controls, where he said that “a growth economy” is “a cyber-resilient economy”. Having a cyber-resilient UK, and making the UK the safest place to do business, is a competitive advantage. I agree with that sentiment and firmly believe that increasing our cyber-resilience can only benefit our economy. It is imperative that we get this right. These cyber-threats are not going away; they are only going to get stronger and more technically advanced. We have seen that in the past year, with the National Cyber Security Centre reporting a 50% increase in British cyber-incidents deemed highly significant. Indeed, representatives of M&S told me that, at times, they found it much easier to get updates and information from the United States FBI than they did from our own authorities. We also know that foreign hostile states are becoming bolder in their actions against us. A few months ago—as a reason for introducing my ten-minute rule Bill, the Cyber Extortion and Ransomware (Reporting) Bill—I stated that research had revealed that 74% of UK IT leaders cited China and 71% cited Russia as their top cyber-security concerns. It is undisputable that last year’s espionage trials threw a harsh spotlight on the threatening scale of state-sponsored cyber-attacks. Improving our national cyber-resilience, and safeguarding all our infrastructure and essential services, including in the private sector, is vital in order to secure a prosperous economy and reinforce public confidence in our ability to defend ourselves against such threats.
I have two points for the Minister to address. First, can he address concerns around whether funds raised will be directly reinvested into improving cyber-security, rather than covering administrative overheads? Secondly, there is no specific reference to turnover thresholds, so how can the Minister be sure that a one-size-fits-all approach will not be used, causing many similar organisations to suffer financially?
Can the Minister elaborate on how he will ensure that regulators have the capacity to cope with large-scale data reports?
On the point about banding, can the Minister assure us that there will be consistency applied across regulators so that different events are not differentially penalised depending on the regulatory body? On the question of turnover and the financial penalty, can the Minister elaborate on how the figure was derived?
I have much sympathy with the hon. Gentleman’s arguments about the importance of local government, and I believe that it should be within scope of the Bill. Essential services are provided by councils on a day-to-day basis, but local councils are increasingly cash-strapped. Does he share my concern about the burden of compliance falling on councils, many of which differ in size and scale from their adjacent neighbours? They have differing degrees of IT infrastructure capability. We run the risk of increasing the compliance and regulatory burden on councils at a time when they may already have stretched budgets and lack the resource and capacity in the system to accommodate that additional burden.