Showing every spoken contribution, including 5,731 under 12 words. Hide short remarks

1. 3 Feb 2026·Parliament·Graham Stuart

   Universal Credit (Removal of Two Child Limit) Bill

   The hon. Lady is, as ever, showing a powerful oratorical style, but it is so easy when doing that to get one’s facts wrong. Unemployment, I am sure she will recognise, was at a near record low when the Conservatives left office and has risen by more than 20% in the less than two years that Labour has run the country. I know the hon. Lady is careful with the facts and will want to retract the point about unemployment under the Conservatives. Whatever other ills she wants to attribute to us, I do not think she can genuinely attribute that.

   Hansard source
2. 3 Feb 2026·Parliament·Edward Argar

   Railways Bill (Ninth sitting)

   Can the Minister give a few examples of the exceptional circumstances that might cause the power to be used?

   Hansard source
3. 3 Feb 2026·Parliament·Edward Argar

   Railways Bill (Ninth sitting)

   Is the hon. Member aware that, although not in a domestic context, there have in the past been schemes in which, instead of air miles, points or miles have been available—for example, with Eurostar—and they were extremely popular?

   Hansard source
4. 3 Feb 2026·Parliament·Edward Argar

   Railways Bill (Tenth sitting)

   As ever, Mrs Hobhouse, it is a pleasure to serve under your chairmanship. I will speak primarily to amendment 63, as articulated, typically eloquently, by my hon. Friend the shadow Minister. We have heard some extremely powerful interventions during the course of this Committee, particularly from the hon. Member for Bexleyheath and Crayford, about the importance of ensuring that the system—if I can call it that—genuinely recognises and is responsive to the needs of those who are disabled, have mobility issues, or face a whole range of things. He has made that case very powerfully, and I can understand what the Minister is seeking to do. I suspect—although I do not wish to put words in his mouth—that the Minister will say that the amendment is unnecessary because it is inherent in the purposes of a passengers’ council that, of course, all passengers will be considered, and that the amendment simply draws out a particular aspect that must be highlighted. I can understand that. If that is the case, the Minister could accept this amendment without any adverse effects, and without any challenges to the drafting of the Bill or the integrity of what he is seeking to do with the clause, because the amendment emphasises that responsibility but does not lose sight of the particular needs of disabled people and others in the operation of the railway—I am sure the hon. Member for Bexleyheath and Crayford would make a point about the importance of that. Looking at the amendment tabled by my hon. Friend the Member for Broadland and Fakenham, very little—if anything—would undermine the integrity or policy intent of what the Minister is seeking to achieve with the clause. It would simply draw it out and make it much clearer, and remind the passengers’ council, in explicit terms in the legislation, of what it is there to do. I hope that the Minister, in recognising the intent behind it, can move some way to meet my hon. Friend and I by potentially accepting the amendment, or at least, if he is not able to do so today, by committing to take it away and consider whether he might accept it at a later stage.

   Hansard source
5. 3 Feb 2026·Parliament·Edward Argar

   Railways Bill (Tenth sitting)

   Does the Minister also recognise that the review has led to cuts of about 20 individual programmes? That was not done on the grounds of accessibility—although the letter I received from his colleague the noble Lord accepts that there is clearly a significant accessibility challenge in the case of station in my constituency—but by imposing on the scheme a match funding requirement that was never, as I understand it, part of the original scheme.

   Hansard source
6. 3 Feb 2026·Parliament·Edward Argar

   Topical Questions

   In their manifesto at the last election, the Government promised to set up specialist rape courts in every Crown court location. Will the Minister update the House on how many have been set up to date?

   Hansard source
7. 3 Feb 2026·Parliament·Dr Neil Shastri-Hurst

   Changes to Jury Trials

   Sir Brian Leveson’s review did not contain any specific modelling to support his view that limiting jury trials would reduce by 20% the time taken for trials. If the Government’s own modelling does not support and validate Sir Brian’s assessment, will they U-turn on the policy?

   Hansard source
8. 3 Feb 2026·Parliament·Dr Neil Shastri-Hurst

   Universal Credit (Removal of Two Child Limit) Bill

   At its heart, this debate is about choices, and the choice before us today is whether we believe that compassion is best expressed through limitless expenditure or through a system that is fair, responsible and worthy of the people who fund it. We in this House all share the same objective: we want every child—[Interruption.] Well, I hope we do, because we want every child in every corner of this country to have hope and opportunity in their future. If we are truly honest, a good society is measured not by how much it spends, but by how wisely it spends, and that is where the Bill does not meet the test before it.

   Hansard source
9. 3 Feb 2026·Parliament·Dr Neil Shastri-Hurst

   Universal Credit (Removal of Two Child Limit) Bill

   I will make some progress. I will start with a real-life experience from my own constituency. Some months ago, I met a couple at a community event, both of whom were in work and clearly raising their children with a great deal of pride and care. They spoke to me with a quiet determination about the sacrifices they were forced to make: no foreign holidays, no luxuries, often working long hours and, of course, careful budgeting of the household income. Their message was that they did not expect the state to intervene on their behalf; they were not asking for anything special. Instead, they were merely asking for fairness, and fairness is what is at stake today. The two-child limit rests on the simple principle that the welfare system should reflect the real choices faced by working families up and down the country. Across the United Kingdom, parents weigh responsibility against aspiration every day, asking themselves whether they can provide, whether they can sustain and whether they can provide their children with security.

   Hansard source
10. 3 Feb 2026·Parliament·Dr Neil Shastri-Hurst

    Universal Credit (Removal of Two Child Limit) Bill

    I thank the hon. Lady for her intervention, but this is about choices. We come to this place to make choices about how we spend taxpayers’ money to ensure that it is fair across the board. We can all bring moving individual stories, but there is the reality of how we support Government expenditure across the board so that it is fair and equitable and ensures that families up and down the country are having to make similar choices every single day. What this Bill tells the country is that choices no longer matter. It tells the taxpayer that restraint is optional. It tells Government that limits are now outdated. The Government say that the Bill will reduce child poverty—I understand that, and I respect that intention—but poverty is not conquered by cheque books alone. It is conquered by work, education, stability and ambition. It is conquered when families are supported to stand tall instead of being encouraged to lean forever. For far too long, politics has fallen into the trap of believing that every social problem has a fiscal solution—if only we spend more money, subsidise a little more or borrow more—but history teaches us a much harder lesson. A society that confuses help with dependency does not liberate the poor, but simply imprisons them. The Bill will cost approximately £3 billion a year, which will be paid not by abstractions, but by people—by the nurse working a night shift, the self-employed plumber, the shop worker who is saving for a deposit or the small business owner who is keeping three other people in employment. Those people are entitled to ask whether this is fair. Is it fair that they have to calculate every single pound while the state abandons calculation altogether? I simply do not believe it is.

    Hansard source
11. 3 Feb 2026·Parliament·Dr Neil Shastri-Hurst

    Universal Credit (Removal of Two Child Limit) Bill

    It would be a safety net if it provided a short-term boost. What it does instead is provide an endless cheque book without any checks and balances in place. If there was a sunset clause, that would be different, but there is not. The two-child limit was about more than blame; it was about balance. It recognised that a welfare system without boundaries eventually loses legitimacy altogether, and when legitimacy is lost, discourse soon follows. That is the great unspoken risk of this Bill: it does not merely expand spending, but weakens trust; it widens the gap between those who give and those who receive and, in doing so, puts the whole settlement at risk. What is fundamentally missing from this Bill is any serious strategy for mobility. Where are the plans for skills, for progression, for family stability and for moving people from welfare into work? Instead, the Bill simply offers the politics of reassurance without reform, comfort without challenge, spending without strategy and debt without direction. The Conservatives recognise the importance of lifting people up, of not holding them down and of providing opportunity and not permanent subsidy. The true measure of social justice is not how many people we support, but, crucially, how many people we no longer need to support. The question before us, therefore, is whether we will tackle poverty at its root or merely manage it year after year; whether we will build a system that strengthens families or one that substitutes for them; and whether we will choose the easy road or the responsible one. This Bill chooses the easy road—it chooses sentiment over structure, expansion over reform and today over tomorrow. I simply cannot support that choice.

    Hansard source
12. 3 Feb 2026·Parliament·Dr Luke Evans

    Universal Credit (Removal of Two Child Limit) Bill

    Fairness matters, not only to those receiving the support but to those making the difficult choices without it. During the short time I have, I will talk about the principles and then the context. I come to this subject thinking about the publican in my constituency who has two children and who wakes up in the morning, leaves their house in Barwell and goes to their business. They have seen their national insurance contributions rise, their valuation has changed and the tax has gone up on that, the rate relief has been withdrawn from them and they have seen the minimum wage go up. Those are all costs that they are having to consider. What about the independent pharmacist on the high street, who gets up and goes to work in Hinckley, having to face the fact that national insurance contribution costs are going up?

    Hansard source
13. 3 Feb 2026·Parliament·Dr Luke Evans

    Universal Credit (Removal of Two Child Limit) Bill

    I would credit her. She is a credit to the hon. Gentleman’s family for what she has managed to achieve. The key point I am trying to get to is that, when those people leave their doorstep, is it fair that the choice they have made to have only two children is simply thrown out the window, because an extra £3,650 is now being given to the parent of the third and fourth child next door, simply for not going to work? That is not fair, and that is the heart of the principle. At the end of the day, the welfare state works best when it is a bridge to work and not a substitute for it. We have often heard about the working poor.

    Hansard source
14. 3 Feb 2026·Parliament·Dr Luke Evans

    Universal Credit (Removal of Two Child Limit) Bill

    That is far from the truth. I am simply arguing that we need to be fair to those who need the system to support them and those who contribute to it. I worry that we are pulling at the fabric here. It is interesting that the debate in the House is slanted towards the Labour view, because they have the numbers. If we look at the public polling, however, we know that, consistently, 60% of the public support the cap and only 30% want it to be taken away. Why is that? Fundamentally, they understand that there has to be give and take. The worry here is that someone will suddenly get £3,650 with no contractual change within society to better themselves. The money could be better spent. To take an example from the last Government, in 2021 they changed the UC slider from 63% to 55% to encourage work. That cost about £2.5 billion; we are talking about £3 billion today. We have heard from the Government how this will be paid for. It is not hypothecated. The pharmacist I was talking about and the sister of the hon. Member for Bishop Auckland (Sam Rushworth) will pay for this, as will the publican who goes out to work. They will see their taxes rise. That is the contract that I am worried about.

    Hansard source
15. 3 Feb 2026·Parliament·Dr Luke Evans

    Universal Credit (Removal of Two Child Limit) Bill

    That is exactly right. The public will stand for a generous safety net, but they will not stand for people not trying to take things forward. I worry that, despite this Government’s talk of employment rights, the chances for employment and the working poor, more people are out of work under this very Government due to the choices they are making. That is fundamental to today’s debate, and trying to leverage morality into it misses the reality of responsibility. Every family in this country make fiscal choices and expect to behave responsibly, and so should the Government who lead them. That is the crux of the matter. In the time I have left, I will move on to the context. If this were a moral crusade, as we have heard the Prime Minister say, he would have done it in his very first Budget; he would have made that choice. However, as we have heard from other Members, when this policy was put forward after the new Government came in, 40-odd MPs did not vote and seven Labour Members had the Whip removed. If we are talking about poverty, one thing that has not been raised in the debate so far is the winter fuel payments policy. The Government’s own analysis said that it would put 50,000 pensioners into absolute poverty and 100,000 into relative poverty. So there is a dichotomy here, and it is about choices. Government Members seem to say that if we are going to solve poverty, we need to focus on one area, yet they all voted to take the fuel payments away—[Interruption.] I hear chuntering from the other side about means-testing, but that did not happen until later when there was a climbdown. The key thing is that these are difficult choices that have to be made. I worry that the public see straight through what is going on. They need fairness in the system. They do not need a vote to be held to try to placate the Back Benchers of a failing Prime Minister. If this truly was the mission of the Prime Minister at the start, he would have done it straightaway.

    Hansard source
16. 3 Feb 2026·Parliament·Dr Luke Evans

    Universal Credit (Removal of Two Child Limit) Bill

    Why, in that case, was the Whip removed from Labour Members? Why is there no contingency in the Bill to ensure that someone is progressing through the system? We have heard time and again from Members on both sides of the House that it is not only a safety net but a springboard. I come back to my point that if the Government want to make a difference, they could change the rating on universal credit to encourage more people into work, but that is not happening. That would help to support people who are in work but who are impoverished. The last Government brought in the household support fund to ensure that there was immediate support. I am pleased that the Government are bringing forward some form of contingency, but we still have not seen what that looks like. That will be a concern for people. I shall end where I began. This system has to be fair to those who are getting the support, but also to those who are paying for it. At the end of the day, a family lives within its constraints and so should a country. This Bill does nothing but the opposite, and that is my concern.

    Hansard source
17. 3 Feb 2026·Parliament·Dr Luke Evans

    Universal Credit (Removal of Two Child Limit) Bill

    Will the hon. Member give way?

    Hansard source
18. 3 Feb 2026·Parliament·Dr Luke Evans

    Universal Credit (Removal of Two Child Limit) Bill

    Will the hon. Member give way?

    Hansard source
19. 3 Feb 2026·Parliament·Dr Luke Evans

    Universal Credit (Removal of Two Child Limit) Bill

    There are not many on the Opposition Benches—the hon. Gentleman’s party won the last election—but we know that the public support keeping this cap in place. Any poll conducted in the last few years has suggested that, on average, 60% of people think that the cap should remain. Why does the hon. Gentleman think the British public back the cap staying in place?

    Hansard source
20. 3 Feb 2026·Parliament·Dr Luke Evans

    Universal Credit (Removal of Two Child Limit) Bill

    I just see the irony of the hon. Member talking about linking this to alcohol, which is a serious problem. Gambling is a serious problem as well, and his party has directly linked this to gambling, even though this is not a hypothecated tax. Could he explain the dichotomy between the two?

    Hansard source
21. 3 Feb 2026·Parliament·Dr Luke Evans

    Universal Credit (Removal of Two Child Limit) Bill

    Will the hon. Gentleman give way?

    Hansard source
22. 3 Feb 2026·Parliament·Dr Luke Evans

    Universal Credit (Removal of Two Child Limit) Bill

    The hon. Lady talks about speaking for the public, but consistently, in all polling, 60% of Brits want to see this policy stay in place. What does she say to them?

    Hansard source
23. 3 Feb 2026·Parliament·Dr Luke Evans

    Universal Credit (Removal of Two Child Limit) Bill

    rose—

    Hansard source
24. 3 Feb 2026·Parliament·Dr Kieran Mullan

    Topical Questions

    In a world where so many people walk on by or look the other way, I believe it is vital to the rule of law that our whole society gets behind people who are willing to stand up and be counted. We are joined in the Gallery today by one such person—Mark Hehir, a bus driver. Mark leapt to the aid of a passenger who was robbed, and the police said everything he did was entirely lawful, but his employer, Metroline, sacked him. More than 120,000 people have signed my petition giving their full support to Mark. Does the Justice Secretary agree that Mark is a hero who deserves our support?

    Hansard source
25. 3 Feb 2026·Parliament·Dr Kieran Mullan

    Topical Questions

    I welcome those remarks, and I am sure the public will want us to work across the parties on these issues, but this is not an isolated case. I have heard from employers themselves, shop workers and bus drivers that they want to do the right thing, but the law inhibits them from doing so. The Conservatives will be bringing forward proposals to introduce good samaritan protections in civil law for both employers and employees. Will the Secretary of State work with us to get that on to the statute book?

    Hansard source
26. 3 Feb 2026·Parliament·Dr Ben Spencer

    Cyber Security and Resilience (Network and Information Systems) Bill (First sitting)

    Q Thank you, Jen and David, for coming to give evidence to us morning. Two questions. First, one to you, Jen. Lots of UK corporations have been the subject of recent major cyber-attacks, such as Jaguar Land Rover and M&S. Under the Bill as drafted, these remain outside the scope of the regulation. In your view, what is the best way to mitigate the risk to the economy, jobs and supply chains of further cyber-attacks of that scale to these important out-of-scope businesses? Secondly, and linked to that: Mr Cook, what lessons have you learnt from assisting clients with the implementation of NIS2—the second network and information systems directive—on the need for certainty in legislation? What do you think will be the most challenging areas of business to implement this Bill? Jen Ellis: There is a thing that you always hear people say in the cyber-security industry which is, “There are no silver bullets”. There is no quick fix or one easy thing, and that definitely applies when looking at policy as well. I cannot give you a nice, easy, pat answer to how we solve the problem of attacks like the ones we saw last year. What I can say is that, looking at the Cyber Security and Resilience Bill specifically, I think it could include companies above a certain size or impact to the UK economy. The Bill currently goes sector by sector— which makes lots of sense, to focus on essential services—but I think we could say there is another bucket where organisations beyond a certain level of impact on the economy would also be covered. That could be something like the FTSE350. Including those might be one way to go about it, but it is worth noting that it would not simply solve the problem because the problem is complex and multi-faceted, and this is just one piece of legislation. David Cook: With respect to NIS2, that is an example of a whole suite of laws that have come in across the European Union—the Digital Decade law; I think there is something like 10 or 15 of these new laws. They do all sorts of different things, and NIS2 sits within that. NIS2 is the reform of the NIS directive, which is the current state of play in UK law. NIS2 gives certainty and definition, by way of the legislation itself and then the implementing legislation, which means that organisations have had a run-up at the issue and a wholesale governance programme, which takes a number of years, but they know where they are headed, because it is a fixed point in the distance, on the horizon. The Bill we are talking about today has the same framework as a base. The plan then is that secondary legislation can be used in a much more agile way to introduce changes quickly, in the light of the moving parts within the geopolitical ecosystem outside the walls. For global organisations with governance that spans jurisdictions, a lack of certainty is unhelpful. Understanding where they need to get to often requires a multi-year programme of reform. I can see the benefits of having an agile, flexible system, but organisations—especially global ones, which are the sort within the scope of this Bill—need time to prepare, recruit people, get the skillset in place, and understand where they need to get to. That fixed future point needs to be defined.

    Hansard source
27. 3 Feb 2026·Parliament·Dr Ben Spencer

    Cyber Security and Resilience (Network and Information Systems) Bill (First sitting)

    Q Thank you for giving evidence this morning. The Bill would not have prevented recent attacks on high-profile parts of UK industry such as Co-op, Marks and Sparks, and Jaguar Land Rover. What more do you think can be done to mitigate the risk to jobs, supply chains and the UK economy from further large-scale cyber-attacks against out-of-scope companies? My second question is a bit more technical. Do you consider that the definition in the Bill of a managed service provider is sufficiently clear and certain for businesses to understand whether they are in scope or out of scope of the Bill? Dr Sanjana Mehta: I appear before the Committee today on behalf of ISC2, which is the world’s largest not-for-profit membership association for cyber-security professionals. We have 265,000 members around the world and 10,000-plus members in the UK. On your question about sectoral scope, our central message is that we welcome the introduction of the Bill and we believe that it will go a long way towards improving the cyber-resilience of UK plc. Yes, there are certain sectors that are outside the scope of the Bill, and we believe that there are a number of non-legislative measures that could be used to enhance the cyber-security of other industries and parts of the sector. In particular, the forthcoming national cyber action plan should be used as a delivery vehicle for improving the resilience of UK plc as a whole. On the previous panel, I think Jen mentioned that there are voluntary codes of practice. As an organisation, we have piloted the code of practice for cyber governance, and we have signed up to the ambassadors scheme for the code of practice for secure software development. We think that the upcoming national cyber action plan can further encourage the uptake of such schemes and frameworks. Most importantly, we call upon Government to focus on skills development as a non-legislative measure, because ultimately that will be the key enabler of success, whether it is for organisations that are within or outside the scope of the Bill.

    Hansard source
28. 3 Feb 2026·Parliament·Dr Ben Spencer

    Cyber Security and Resilience (Network and Information Systems) Bill (First sitting)

    Q The issues about complexity and how loosely the Bill is drafted have come up quite a few times, and you have given good evidence regarding your concerns. What cost to business do you anticipate if the Bill stays so loose, with so much left to secondary legislation? Jill Broom: There is probably a broader point around legal certainty, which is not given on the face of the Bill. Some of our members have highlighted language that could create some pretty significant legal jeopardy for regulated entities. The Bill needs to go a bit further. It could and should do more to provide some legal certainty, because the cost to companies could be quite significant. To the point on consistency across regulators and things like that, we need more frameworks around how that is going to work. Leaving all the detail to secondary legislation is what makes it slightly difficult to examine what is on the face of the Bill, so making sure that everything is consulted on in a mandatory and meaningful way will be important.

    Hansard source
29. 3 Feb 2026·Parliament·Dr Ben Spencer

    Cyber Security and Resilience (Network and Information Systems) Bill (First sitting)

    Q Thank you for coming to speak to us this morning. I have a different question for each of you, so I will rattle them off and ask you to go through them. Starting with Ben from Darktrace, how are developing and emerging technologies such as AI and post-quantum crypto changing the nature of cyber-security threats? Do you think the Bill responds adequately to that changing threat landscape? Moving on to Matt from Cisco, what further guidance and consultation from the Government and the Information Commissioner is needed for MSPs to comply effectively with their obligations under the Bill? Chris from NCC Group, the National Audit Office report last year highlighted lots of serious deficiencies in Government cyber-resilience. Do you think the cyber action plan goes far enough? How can Government Departments be overseen and held to account in a way that will deliver meaningful improvements in cyber-resilience? Finally, Ian from Amazon, a core feature of your business model is extensive exposure to supply chain partners. Do you think that the designation of critical suppliers by regulators under the Bill is the correct approach? What further consultation is needed to make sure that that is proportionate, prioritises the most critical suppliers and, crucially, gives a degree of certainty, whether legal or financial? Ben Lyons: AI is significantly changing cyber-security. You can think about it at three levels: first, the way in which attackers are using AI to mount cyber-attacks; secondly, the need to secure AI systems and AI within companies and organisations; and thirdly, the question of how AI is changing cyber-security on the defensive side. In brief, we see significant use of AI by attackers. Today, we are releasing the results of a survey in which 73% of surveyed security professionals say that AI-powered threats are having a significant impact on their organisation. These are things like phishing, reconnaissance, and lowering the barriers to being able to launch attacks and review more targets more effectively. Last month, the chief executive officer of Anthropic, which is one of the main frontier AI labs, warned that he sees AI-led cyber-attacks as potentially being the main way in which cyber-attacks are conducted in the future. At the level of the enterprise, you have a challenge of how you secure the enterprise, in terms of not only developing and deploying AI, but visibility of AI used in an organisation. We are certainly seeing AI transform how cyber-security vendors and organisations manage the threat: they have greater visibility, can detect threats more quickly and the like. On how the Bill responds to that, one positive in its approach is that it is setting out an agile, outcomes-based approach that means that the regulatory regime can be capable of evolving as the threat evolves. It is sensible not to talk about AI in depth on the face of the Bill, but through mechanisms such as the code of practice, it will be possible for expectations to evolve over time as the threat and the technology mature.

    Hansard source
30. 3 Feb 2026·Parliament·Dr Ben Spencer

    Cyber Security and Resilience (Network and Information Systems) Bill (Second sitting)

    Q38 Thank you for giving your time this afternoon. I have a couple of questions, which I will deal with in one go. The first is for Natalie. Ofcom’s role in cyber-security regulations will be expanded significantly under the Bill. What preparation has Ofcom undertaken to ensure it has sufficient capacity for effective oversight and, where necessary, enforcement in relation to its new regulatory obligations? My second question is jointly for Ian and Stuart, from the ICO and Ofgem. Some industry stakeholders have expressed concern about low levels of incident reporting and enforcement under the NIS1—network and information systems—regs. How will your respective approaches to regulation change as a result of this Bill, to ensure that it is implemented and that cyber-resilience is improved across the sectors you are responsible for regulating? Natalie Black: I will kick off. We have some additional responsibilities, building on the NIS requirements, but the data centre aspect of the Bill is quite a substantial increase in responsibilities for us. It is worth emphasising that we see that as a natural evolution of our responsibilities in the sector. Communications infrastructure is evolving incredibly quickly, as you will be well aware, and data centres are the next big focus. In terms of preparations, we are spending this time getting to know the sector and making sure we have the right relationships in place, so that we do not have a standing start. I have done a number of visits, for example, to hear at first hand from industry representatives about their concerns and how they want to work with us. We are also focusing on skills and recruitment. We already have substantial cyber-security responsibilities in the communications infrastructure sector. We are building on the credibility of the team, but we are focused on making sure we continue to invest in them. About 60% of the team already come from the private sector. We want that to continue going forward, but we are not naive to how challenging it is to recruit in the cyber-security sector. For example, we are working with colleagues from the National Cyber Security Centre, and looking at universities it is accrediting, to see how we can recruit directly using those kinds of opportunities. Ian Hulme: On incident reporting, the thresholds in the existing regulations mean that levels are very low. Certainly, the reports we see from relevant digital service providers don’t meet those thresholds. I anticipate that we will see more incidents reported to us. With our enhanced regulatory powers and the expanded scope of organisations we will be responsible for, I anticipate that our oversight will deepen and we will have more ability to undertake enforcement activity. Certainly from our perspective, we welcome the enhanced reporting requirements. Stuart Okin: To pick up on the incident side of things, I agree with Ian. The thresholds will change. With the new legislation, any type of incident that could potentially cause an issue will obviously be reported, whereas that does not happen today under the NIS requirements. On enforcement, in seven years we have used all the enforcement regimes available to us, including penalties, and we will continue to do so. We absolutely welcome the changes in the Bill to simplify the levels and to bring them up, similar to the sectorial powers that we have today.

    Hansard source
31. 3 Feb 2026·Parliament·Dr Ben Spencer

    Cyber Security and Resilience (Network and Information Systems) Bill (Second sitting)

    Q Natalie, I am going single out Ofcom, which has a lot on its plate at the moment, particularly when it comes to the implementation of the Online Safety Act 2023 and all its other duties. Are you set up to administer your duties under the Bill? Are your resources siloed, given Ofcom’s competing considerations, particularly over the next few years? Natalie Black: That is a great question, and I am not at all surprised that you have asked it, given everything that is going on at the moment. As well as being group director for infrastructure and connectivity, I am also the executive member of the board, sitting alongside our chief executive officer, so from first-hand experience I can say that Ofcom really recognises how fast technology is changing. I do not think there is another sector that is really at the forefront of change in this way, apart from the communications sector. There are a lot of benefits to being able to sit across all that, because many of the stakeholders and issues are the same, and our organisation is learning to evolve and adapt very quickly with the pace of change. That is why the Bill feels very much like a natural evolution of our responsibility in the security and resilience space. We already have substantial responsibilities under NIS and the Telecommunications (Security) Act 2021. We are taking on these additional responsibilities, particularly over data centres, but we already know some of the actors and issues. We are using our international team to understand the dynamics that are affecting the Online Safety Act, which will potentially materialise in the security and resilience world. As a collective leadership team, we look across these issues together. The real value comes from joining the dots. In the current environment, that is where you can make a real difference.

    Hansard source
32. 3 Feb 2026·Parliament·Dr Ben Spencer

    Cyber Security and Resilience (Network and Information Systems) Bill (Second sitting)

    Q That sounds slightly like an argument for having a single regulator, as opposed to multiple sector regulators. I apologise if I am putting words into your mouth. Natalie Black: That is definitely not what I am saying. You can cut the cake in many different ways. From where I sit—from my experience to date—you need specific sector regulators because you need regulators that understand the business dynamics, the commercial dynamics, the people dynamics and the issues on a day-to-day basis. We have many people who have worked at Ofcom for a very long time, and who know the history and have seen these issues before. When it comes to threats, which is ultimately what we are dealing with—cyber-security is a threat—it is cross-cutting. It adapts, evolves and impacts in different ways. The knack is having a sector regulator that really understands what is going on. That means that when you are dealing with cyber-incidents, you understand the impact on real people and businesses, and ultimately you can do something more quickly about it.

    Hansard source
33. 3 Feb 2026·Parliament·Dr Ben Spencer

    Cyber Security and Resilience (Network and Information Systems) Bill (Second sitting)

    Q From all three of your perspectives, are you quite clear about where your individual institutional responsibilities lie? Is there clear water between the organisations? When Ian Levy from Amazon gave evidence this morning, I was struck when he said that Amazon is regulated in the cyber-security space by four regulators. Is the separation of duties and responsibilities clear? Is there a risk that the Secretary of State’s ability to designate critical security risks will muddy the water a bit? Stuart Okin: We have a clear understanding of the responsibilities within Ofgem. We are the joint competent authority with the Department for Energy Security and Net Zero. The Department does the designation and instant handling, and we do all the rest of the operations, including monitoring, enforcement and inspections. We understand our remit with NCSC. GCHQ is part of the cyber-security incident response team; it is ultimately responsible there. Going back to your main concern, we are part of an ecosystem. We have to understand where our lines are drawn, where NCSC’s responsibilities are and what the jobs are. To go back to us specifically, we can talk about engineering aspects, electrical engineering, gas engineering and the cyber elements that affect that, including technology resilience—not cyber. As long as we have clear gateways and communication between each other—and I think that the Bill provides those gateways—that will also assist, but there are clear lines of responsibilities. Natalie Black: It is clear that there is work to do to get in the same place for the Bill. Exactly as Stuart said, the information gateways will make a massive difference. It is too hard, at the moment, to share information between us and with the National Cyber Security Centre. The fact that companies will have to report within 24 hours not only to us but to the NCSC is very welcome. To return to my earlier point, we think that there is a bit of work for DSIT to do to help to co-ordinate this quite complicated landscape, and I think that industry would really welcome that. Ian Hulme: I agree with colleagues. From an ICO perspective, we see our responsibilities as a NIS competent authority as complementary to our role as a data protection regulator. If you want secure data, you have to have secure and resilient networks, which are obviously used to process data. We see it as a complementary set of regulations to our function as a data protection regulator.

    Hansard source
34. 3 Feb 2026·Parliament·Dr Ben Spencer

    Cyber Security and Resilience (Network and Information Systems) Bill (Second sitting)

    Q Thank you for coming to give evidence this afternoon. I have two questions. First, what more could the Government be doing to make regulated sectors aware of the risks you have just laid out and what they can do to address them? Secondly, it has been reported recently that communications of senior Government aides were hacked by Chinese state affiliates between 2021 and 2024. In view of that threat to telecoms networks, what are the potential cyber-risks to communications infrastructure that you see arising from the intended location of China’s super-embassy in the City of London? Chung Ching Kwong: On the first question, about what can be done to help sectors understand the risks, education is paramount. At this point, we do not have a comprehensive understanding of what kind of risks state actors like China pose. We are very used to the idea that private entities are private entities, because that is how the UK system works; we do not see that organisations, entities or companies associated with China or the Chinese state are not independent actors as we would expect, or want to expect. There is a lot of awareness-raising to be done and guidance to be issued around how to deal with these actors. There is a lot of scholarly work that says that every part of Chinese society—overseas companies and so on—is a node of intelligence collection within the system of the CCP. Those things are very important when it comes to educating. Also, the burden of identifying what is a national security risk and what is not should not be put on small and medium-sized businesses, or even big companies, because they are not trained to understand what the risks are. If you are not someone specialising in the PLA and a lot of other things academically, it would be very difficult to have to deal with those things on a day-to-day basis and identify, “That’s a threat, and that’s a threat.” Sorry, what was the second question?

    Hansard source
35. 3 Feb 2026·Parliament·Dr Ben Spencer

    Cyber Security and Resilience (Network and Information Systems) Bill (Second sitting)

    Q It was about China’s super-embassy in London. What cyber-security risks do you think that poses, given your experience and background? Chung Ching Kwong: There is not a lot of publicly available information on the sensitive cabling that is around the area, so I cannot confidently say what is really going to happen if they start to build the embassy and have such close contact with those cables. The limit of this Bill when it comes to the Chinese embassy is that it cannot mitigate the risks that are posed by this mega-embassy in the centre of London, because it regulates operators and not neighbours or any random building in the City. If the embassy uses passive interception technology to harvest data from local wi-fi or cellular networks, no UK water or energy company is breached. There is no breach if they are only pre-positioning there to collect information, instead of actually cutting off the cables, so when they do cut off the cables, it will be too late. There will be no report filed under the Bill, even if it is under the scope of the Bill when it comes to regulation. The threat in this case is environmental and really bypasses the Bill’s regulatory scope.

    Hansard source
36. 3 Feb 2026·Parliament·Dr Ben Spencer

    Cyber Security and Resilience (Network and Information Systems) Bill (Second sitting)

    Q Thank you for coming to give evidence this afternoon. I have a couple of questions. First, how can industry and cyber-security researchers collaborate more effectively to increase cyber-resilience in the network and information systems of regulated sectors? Secondly, and building on that, are there any model schemes or arrangements for reporting risks to affected companies that could incentivise legitimate research activities? Professor John Child: My specialism is in criminal law, so this is a bit of a side-step from a number of the pieces of evidence you have heard so far. Indeed, when it comes to the Bill, I will focus on—and the group I work for focuses on—the potential in complementary pieces of legislation, and particularly the Computer Misuse Act 1990, for criminalisation and the role of criminalisation in this field. I think that speaks directly to the first question, on effective collaboration. It is important to recognise in this field, where you have hostile actors and threats, that you have a process of potential criminalisation, which is obviously designed to be effective as a barrier. But the reality is that, where you have threats that are difficult to identify and mostly originating overseas, the actual potential for criminalisation and criminal prosecution is slight, and that is borne out in the statistics. The best way of protecting against threats is therefore very much through the use of our cyber-security expertise within the jurisdiction. When we think about pure numbers, and the 70,000-odd cyber-security private experts, compared with a matter of hundreds in the public sector, police and others, better collaboration is absolutely vital for effective resilience in the system. Yet what you have at the moment is a piece of legislation, the Computer Misuse Act, that—perfectly sensibly for 1990—went with a protective criminalisation across-the-board approach, whereby any unauthorised access becomes a criminal offence, without mechanisms to recognise a role for a private sector, because essentially there was not a private sector doing this kind of work at the time. When we think about potential collaboration, first and foremost for me—from a criminal law perspective—we should make sure we are not criminalising effective cyber-security. The reality is that, when we look at the current system, if any authorised access of any kind becomes a criminal offence, you are routinely criminalising engagement in legitimate cyber-security, which is a matter of course across the board. If you are encouraging those cyber-security experts to step back from those kinds of practices—which may make good sense—you are also lessening that level of protection and/or outsourcing to other jurisdictions or other cyber-security firms, with which you do not necessarily have that effective co-operation, reporting and so on. That is my perspective. Yes, you are absolutely right, but we now have mechanisms in place that actively disincentivise that close collaboration and professionalisation.

    Hansard source
37. 3 Feb 2026·Parliament·Dr Ben Spencer

    Cyber Security and Resilience (Network and Information Systems) Bill (Second sitting)

    Q What are the arguments against amending the CMA, and how would you deal with them? Professor John Child: There are obviously a number. It is always more comfortable when you have a beginning point of criminalisation. The argument to decriminalise in an environment where you want to protect against threats is sometimes a slightly unintuitive sell. Is the criminalisation that we have doing the necessary work in terms of actually fighting the threats? To some extent, yes, but it is limited. Is it doing harms? There is an argument to say that it is doing harms. This comes back to the point that was made earlier, which was perfectly sensible. When you speak to the CPS and others, their position as prosecutors is to say, “Very few people are being prosecuted, and we certainly don’t want to be prosecuting legitimate cyber-security experts, so there is no problem.” Admittedly, that means there is no problem in terms of actual criminalisation and prosecution, but that is the wrong problem. If you focus on the problem being the chilling effect of the existence of the criminalisation in the first place, you simply cannot solve that through prosecutorial discretion, and nor should you, when it comes to identifying what a wrong is that deserves to be criminalised. You certainly cannot resolve it through sentencing provisions. The only way that you can sensibly resolve this is either by changing the offence—that is very difficult, not least because, from a position of criminalisation, it might be where other civil jurisdictions begin—or by way of defence, which realistically is the best solve from the point we are at now. If you have a defence that can be specifically tailored for cyber-security and legitimate actors, you can build in reverse burdens of proof. You can build in objective standards of what is required in terms of public interest. The point here is that the worry is one of bad actors taking advantage. The reality is that that is very unlikely. The idea that the bad actors we identify within the system would be able to demonstrate how they are acting in the public best interest is almost ridiculous. Indeed, the prospect of better threat intelligence, better securities and so on provides more information and better information-sharing to the NCSC and others and actually leads to more potential for prosecution of nefarious actors rather than less. It is a more complicated story than we might like in terms of a standard case for changing the criminal law, but it is nevertheless an important one.

    Hansard source
38. 3 Feb 2026·Parliament·Dr Ben Spencer

    Cyber Security and Resilience (Network and Information Systems) Bill (Second sitting)

    Q Thank you very much for coming in to give us evidence this afternoon, and thank you for your service. I have two questions. Who are the main threat actors in cyber-attacks on UK networks and information systems—what do they break down into, in terms of state actors, affiliates and criminal gangs? Secondly, on ransomware attacks, you will know that the Government review states that ransomware is “the greatest of all serious and organised cybercrime threats”. In your view, what is the scale of that threat and what sectors and businesses are the primary targets? DCS Andrew Gould: To take the actors first, they are probably quite well known, in terms of the general groupings. Yes, we have our state actors—the traditional adversaries that we regularly talk about—and they generally offer very much a higher-end capability, as you will all be aware. The next biggest threat group is organised crime groups. You see a real diversity of capability within that. You will see some that are highly capable, often from foreign jurisdictions—Russian jurisdictions or Russian-speaking. The malware developers are often the more sophisticated as service-type offerings. We see more and more ransomware and other crime types almost operating as franchises—“Here is the capability, off you go, give us a cut.” Then they have less control over how those capabilities are used, so we are seeing a real diversification of the threat, particularly when it comes to ransomware. Then, where you have that proximity to state-directed, if not quite state-controlled—that crossover between some of those high-end crime groups and the state; I am thinking primarily of Russia—it is a lot harder to attribute the intent behind an attack. There is a blurring of who was it and for what purpose was it done, and there is that element of deniability because it is that one further step away. Moving back down the levels of the organised crime groups, you have a real profusion of less capable actors within that space, from all around the world, driving huge volumes, often using quite sophisticated tools but not really understanding how they work. What we have seen is almost like a fragmentation in the criminal marketplace. The barrier to criminal entry is probably lower than it has ever been. You can download these capabilities quite readily—you can watch a tutorial on YouTube or anywhere else on how to use them, and off you go, even if you do not necessarily understand the impact. We certainly saw a real shift post pandemic from traditional criminals and crime groups into more online crime, because it was easier and less risky. You look more broadly at hacktivists, terrorists—who are probably a lot less capable; they might have the intent but not so much the capability—and then the group that are sometimes slightly patronisingly described as script kiddies. These are young individuals with a real interest in developing their skills. They have an understanding that what they are doing is wrong, but they are probably not financially or criminally motivated. If they were not engaging in that kind of cyber-crime, they probably would not be engaging in other forms of criminality, but they can still do a lot of damage with the tools they can get their hands on, given that so many organisations seem to struggle to deliver even a basic level of cyber-resilience and cyber-security. One of the things that we really noticed changing over the last 18 months is the diversification of UK threats. Your traditional UK cyber-criminal, if there is such a thing, is primarily focused on hacking for personal benefit, ransomware and other activity. Now we are seeing a diversification, and more of a hybrid, cross-organised crime threat. There are often two factors to that. We often hear it described in the media or by us within law enforcement publicly as the common threat—this emerging community online—otherwise known as Scattered Spider. There, we are seeing two elements to those sorts of groups. You see an element of maybe more traditional cyber-skills engaged in hacking or using those skills for fraud, but we also see those skills being used for Computer Misuse Act offences, in order to enable other offences. One of the big areas for that at the moment that we see is around intimate image abuse. We see more and more UK-based criminals hacking individuals’ devices to access, they hope, intimate images. They then identify the subject of those intimate images, most predominantly women, and then engage in acts of extortion, bullying or harassment. We have seen some instances of real-world contact away from that online contact. Think of the scale of that and the challenge that presents to policing. I can think of cases in cyber-crime unit investigations across the country where you have got a handful of individuals who have victimised thousands of women in the UK and abroad. You have got these small cyber-crime units of a handful of people trying to manage 4,000 or 10,000 victims. It is very difficult and very challenging, but the flipside of that is that, if they are UK-based, we have a much better chance of getting hold of them, so we are seeing a lot more arrests for those cross-hybrid threats, which is a positive. There is definitely an emerging cohort that then starts to blend in with threats like Southport and violence-fixated individuals. There seems to be a real mishmash of online threat coming together and then separating apart in a way that we have never seen historically. That is a real change in the UK threat that is driving a lot of policing activity. Turning to your ransomware question, what is interesting, in terms of the kinds of organisations that are impacted by ransomware, a lot of the ransomware actors do not want to come to notice for hitting critical national infrastructure. They do not want to do the cloning of pipelines. They do not want to be taking out hospitals and the NHS. They know they will not get paid if they hit UK critical national infrastructure, for starters, so there is a disincentive, but they also do not want that level of Government or law enforcement attention. Think of the disruptive effect that the UK NCA and policing had on LockBit the year before last. LockBit went from being the No. 1 ransomware strain globally to being out of the top 10 and struggling to come back. We saw a real fragmentation of the ransomware market post that. There is no dominant strain or group within that that has emerged to cover that. A lot of those groups that are coming into that space may be a bit less skilled, sophisticated and successful. The overall threat to organisations is pretty much the same. The volume is the volume, but it is probably less CNI and more smaller organisations because they are more vulnerable and it is less likely to play out very publicly than if there is a big impact on the economy or critical national infrastructure. As such, there is probably not the level of impact in the areas that people would expect, notwithstanding some of the really high-profile incidents we had last year.

    Hansard source
39. 3 Feb 2026·Parliament·Dr Ben Spencer

    Cyber Security and Resilience (Network and Information Systems) Bill (Second sitting)

    Q Thank you, Richard, for giving evidence this afternoon. I have a couple of questions. First, in your view, was the regulatory enforcement regime under NIS1 effective, and does the Bill, as drafted, tackle those challenges? Secondly, could you explain how information sharing and analysis centres improve cyber-resilience in the sectors in which they currently operate? Richard Starnes: The question about effectiveness is difficult to answer. There is the apparent effectiveness and the actual effectiveness. The reason I answer in that way is that you have regulators that are operating in environments where they may choose to not publicly disclose how they are regulating; it may be classified due to the nature of the company that was compromised, or who compromised the company. There may not necessarily be a public view of how much of that regulation is actually going on. That is understandable, but it has the natural downside of creating instances where somebody is being taken to task for not doing it correctly, but that is not exposed to the rest of the world. You do not know that it is happening, so the deterrent effect is not there. Information sharing and analysis centres started in the United States 20 or 25 years ago, when different companies were in the same boat. The first one that I was aware of was the Financial Services ISAC, which comprises large entities—banks, clearing houses and so on—that share intelligence about the types of attacks that they are receiving internationally. They may be competing with one another in their chosen businesses, but they are all in the same boat with regard to being attacked by whatever entities are attacking them. Those have been relatively good at helping develop defences for those industries.

    Hansard source
40. 3 Feb 2026·Parliament·Dr Ben Spencer

    Cyber Security and Resilience (Network and Information Systems) Bill (Second sitting)

    Q Do you think that would be helpful in this context? Richard Starnes: Yes. We have FS-ISAC operating in the United Kingdom and in Europe, with all the major banks, but if you took this and replicated it on an industry-by-industry basis, particularly ones in CNI, that would be helpful. It would also help with information sharing with entities like NCSC and GCHQ.

    Hansard source