Iranian State-sponsored Cyber Attacks: Mitigation and Preparation
(Limited Text - Ministerial Extracts only)
Read Full debate
Lord Harris of Haringey (Lab)
My Lords, I refer to my interest, as recorded in the register, as chair of the National Preparedness Commission and beg leave to ask the Question standing in my name on the Order Paper.
The Parliamentary Secretary, Cabinet Office (Baroness Anderson of Stoke-on-Trent) (Lab)
My Lords, the National Cyber Security Centre is closely monitoring the situation in the Middle East and directly engaging with critical sectors, providing immediate and specific information and advice. It has issued an alert, urging all organisations, especially those with assets or supply chains in the region, to remain vigilant. While it is likely that the direct cyber threat from Iran to the UK has not changed, NCSC advises organisations to strengthen their cyber security posture due to the fast-evolving nature of the conflict. The National Protective Security Authority also issued updated guidance last year on countering the threat of sabotage, helping organisations to protect their sites from physical threats.
Lord Harris of Haringey (Lab)
My Lords, I am grateful to my noble friend for that reply. I am also grateful for what the National Cyber Security Centre has been doing in terms of targeted advice. However, last week four people were arrested by the Metropolitan Police under the National Security Act for what has been reported as spying against Jewish organisations— so there is an issue about that in terms of the risk of Iranian sabotage. There has also been a series of incidents across Europe and in this country of Russian-inspired or Russian paid-for attacks on various businesses. What is the general advice given to the public, to small businesses and to larger businesses in terms of the precautions they ought increasingly to take under the current international situation?
Baroness Anderson of Stoke-on-Trent (Lab)
My noble friend raises an important point; all of this comes down to our national resilience and making sure that we are prepared for such threats. Before I highlight what we are doing on the specifics of cyber, and on cyber more generally, let me highlight that ministerial colleagues, the Faith Minister and the security services, which have done so much in recent days to keep us safe, have met and spoken to a large range of Jewish and Muslim organisations to provide reassurance. They have also met with my noble friend Lord Mann and 20 councils to provide reassurance to those who are so worried about the current conflict.
In terms of specific guidance, the reality is that in this space we need a whole-society approach. Businesses have to take the lead—they know where their threats are and where their vulnerabilities may lie—but at this point we need to make sure that we are collectively working together. The Government will bring forward the cyber action plan by spring, and the cyber security and resilience Bill is currently in the other place.
Lord Howell of Guildford (Con)
My Lords, as the defence production need for entirely new kinds of warfare steps up, as it is now doing, are the Government satisfied that the needs of our strategy, which are rapidly growing, are closely enough aligned with the plans of British industry?
Baroness Anderson of Stoke-on-Trent (Lab)
The noble Lord is right that we need to make sure that we are protecting British industry and working with key allies. Last year, cyber attacks cost the economy £15 billion, and it is a growing threat. We need to work with business, but also to be led by it because it knows what infrastructure is there. As some noble Lords will be aware, some of this is low tech as much as high technology, and people are seeking every vulnerability. We all need to be cognisant of that and make sure there is a genuinely whole-society approach.
Lord Wallace of Saltaire (LD)
My Lords, if we are going to have a whole-society response, we had better make sure that the whole society is informed about the nature of the threat. Nearly a year ago, the strategic defence review talked about the need for
“a national conversation led by the Government”—
political leadership by the Government—to inform and educate the wider public about the nature of these new cyber and other hybrid threats from a number of different countries: Iran, Russia, China and others. When are the Government going to provide that political leadership through the national conversation which was proposed?
Baroness Anderson of Stoke-on-Trent (Lab)
My Lords, I am disappointed that not everybody looks at the NCSC’s website in the same way that I do to ensure that they are updated. The noble Lord is right that we need to make sure that people are aware. It was one of the reasons why it was so important in the run-up to the national alerts we had on all our phones last year that materials were made available about what else could be done in terms of resilience and what other things needed to be done. I urge all noble Lords to make sure they are also protected. I hate to do this, but there is a cyber offer available to every Member of your Lordships’ House, and I believe only 10 of us have accessed it. It would be very good if all Members of your Lordships’ House took up the security offering provided to protect us while we talk about others too.
Lord Peach (CB)
My Lords, sticking with the theme, Iran is a sophisticated actor and works closely with Russia. We know the threats that Russia can generate, which are more than cyber. It is not just time for a national conversation; it is time to strengthen our national security narrative for the whole country.
Baroness Anderson of Stoke-on-Trent (Lab)
I think it is fair to say that of course I agree with the noble and gallant Lord. It is also about making sure the foundations we have in place are right too. We go from national security to national defence within this space, as well as our wider resilience programme. It is one of the reasons why the Rycroft review into funding of political parties is so important and why the Representation of the People Bill, which is in the other place, is key. It is also why we are investing £170 million in Sovereign encrypted technology so that we can protect ourselves. The noble Lord is absolutely right that the challenges from Iran are not one-dimensional; they are multi-dimensional and we all need to be prepared.
Lord Polak (Con)
My Lords, when Russia invaded Ukraine, we were very quick to sanction individuals and freeze assets. Can the noble Baroness tell me what assets we have frozen of the late ayatollah? His office, I believe, is still open in Kilburn. Apparently, there are flats and so on near Israel’s embassy in Kensington. What are we doing to sanction the assets?
Baroness Anderson of Stoke-on-Trent (Lab)
My Lords, the Government have taken significant action so far. We have sanctioned the IRGC in its entirety, as well as 550 Iranian individuals and entities. We have also placed the whole of the Iranian state, including Iran’s intelligence services, on the enhanced tier of the new foreign influence registration scheme, to better reveal any Iranian influence on the UK. We are also training front-line police officers on what state threats are and are not. In terms of the specifics, I will have to write to the noble Lord.
Lord Stirrup (CB)
My Lords, we have talked a lot about cyber defence, and of course that is extremely important, but you do not win a war purely through defence and, be in no doubt, we are at war in cyber space. I do not expect the Minister to give us any details, but could she reassure the House that we are taking all the action necessary to go on the offensive in this area as well as defend?
Baroness Anderson of Stoke-on-Trent (Lab)
The noble and gallant Lord knows much more than I do about how to fight a war. He is absolutely right that we need to be prepared on all fronts, and I want to reassure him that we are making sure that we are.
Baroness Finn (Con)
My Lords, the National Audit Office recently examined the cyber threat facing the UK Government and reached some deeply concerning conclusions. It found that 58 critical government IT systems have significant gaps in their cyber resilience and that the Government do not even know how vulnerable at least 228 legacy systems are to cyber attack. It also highlighted a number of underlying weaknesses, shortage of cyber security skills within government and insufficient co-ordination across departments. In the face of what the NAO has described as a “severe and advancing” threat, with tensions in the Middle East further heightening the risk environment, can the noble Baroness set out what steps the Government are taking to address these shortcomings and strengthen the resilience of critical government systems?
Baroness Anderson of Stoke-on-Trent (Lab)
The noble Baroness will be aware that the cyber security and resilience Bill is in the other place, which is a starting point. I am aware of what she has highlighted and we are working across Government to fix it. There is also the cyber action plan, which will be published this spring.
Baroness McIntosh of Hudnall (Lab)
My Lords, may I bring my noble friend back to the question of a national conversation and ask her a rather more prosaic question about what efforts the Government are making to counter the kind of information that gives rise to very unhelpful behaviours: for example, the hoarding of certain kinds of foodstuffs, petrol and other things? Is she aware, or are the Government aware, of any particular rise in that kind of behaviour at this moment?
Baroness Anderson of Stoke-on-Trent (Lab)
I thank my noble friend for the question, which is interesting. I have not been made aware that any of those behaviours have yet happened. Anyone who watches the news is aware of quite how volatile and uncertain the world is. You can understand why that is. What I would say, both to members of your Lordships’ House and to the general public, is that there is a responsibility on those of us who can look after ourselves at a point of crisis to make sure that we have minimum levels of food and water at home so that the state can look after the most vulnerable and deal with the emergency at hand. All of that guidance is available on GOV.UK.
Lord Purvis of Tweed (LD)
My Lords, the source of much of this activity is the Iranian Islamic Revolutionary Guard Corps. Why have our Government not proscribed it to try and prevent this activity at source? Secondly, the growth of the rampant misinformation and disinformation, which is causing Islamophobia and antisemitism—some, indeed, from far-right evangelical groups in the United States—is now becoming pervasive. What work are the Government doing with Ofcom to prevent that at source?
Baroness Anderson of Stoke-on-Trent (Lab)
The noble Lord will be aware of my own voting record on the IRGC’s proscription—
Baroness Anderson of Stoke-on-Trent (Lab)
Yes, in opposition. But let me be clear: proscription powers are designed for non-state terror organisations, not state organisations. We have committed to taking forward plans recommended by Jonathan Hall KC for a proscription-like power for states and state-linked bodies to tackle hostile state activity. That will come forward as soon as parliamentary time allows.
With regard to the other point, some of this action is happening in terms of media literacy training, changes to the curriculum and how all of us interrogate data and what we see online. The reality, I say as someone who has lived and breathed some of the misinformation that is put out about people in this space, is that we need to be aware that what happens online really does have an effect offline. That is increasingly the reality that we have to manage, which is why my final word is to say once again how thankful I am to the security services.