National Resilience Committee
Thursday 25th June 2026
Skip to latest contribution
This debate has concluded
(began 3 months ago)
Watch LiveSkip to latest contribution
This debate has concluded
10:31
Speaker 1
-
Speaker 1
Good morning and thank you very much, all three of you. We have Roger Davis on the on line there. I think you can see him on the screen. Thank you all very much for your time in helping us with this inquiry today. I should remind you that it is a public session. It's being broadcast live. You will all receive a transcript within the next couple of days or so. So if there are any minor inaccuracies that you need to correct, please let us know then.
And if you think of anything afterwards that you wish you'd said, um, we're very happy to have supplementary evidence in writing if, if that, if that feels right. Um we've obviously. Got a lot of questions to put to you. And when you're giving your first answer, it would be helpful if you could introduce yourself very briefly. So we've got that on record as well. Um, in terms of the fragmented information environment and the possibility of network disruption and um in what ways can technology give rise to mis and disinformation, um, such as through the use of AI as well.
And although it's packing a bit too much, probably into this question, for those of you who, um, for whom this is relevant, perhaps you could also incorporate into your network disruption and um, in what ways can technology give rise to mis and disinformation, um, such as through the use of AI as well. And although it's packing a bit too much, probably into this question, for those of you who, um, for whom this is relevant, perhaps you could also incorporate into your answer whether you think that, um, there would be a possible network disruption and um, in what ways can technology give rise to mis and disinformation, um, such as through the use of AI as well.
And although it's packing a bit too much, probably into this question, for those of you who, um, for whom this is relevant, perhaps you could also incorporate into your answer whether you think that, um, there would be a possible. Undesirable end to universal access to digital information if the shutting down of digital, um, terrestrial television were to happen, as I gather, is the current plan. Which would disrupt access to information in an emergency. So that's quite a lot of scene setting. Um, and perhaps we could start with Mr.
Davis on screen, and then we'll move to the other two.
And if you think of anything afterwards that you wish you'd said, um, we're very happy to have supplementary evidence in writing if, if that, if that feels right. Um we've obviously. Got a lot of questions to put to you. And when you're giving your first answer, it would be helpful if you could introduce yourself very briefly. So we've got that on record as well. Um, in terms of the fragmented information environment and the possibility of network disruption and um in what ways can technology give rise to mis and disinformation, um, such as through the use of AI as well.
And although it's packing a bit too much, probably into this question, for those of you who, um, for whom this is relevant, perhaps you could also incorporate into your network disruption and um, in what ways can technology give rise to mis and disinformation, um, such as through the use of AI as well. And although it's packing a bit too much, probably into this question, for those of you who, um, for whom this is relevant, perhaps you could also incorporate into your answer whether you think that, um, there would be a possible network disruption and um, in what ways can technology give rise to mis and disinformation, um, such as through the use of AI as well.
And although it's packing a bit too much, probably into this question, for those of you who, um, for whom this is relevant, perhaps you could also incorporate into your answer whether you think that, um, there would be a possible. Undesirable end to universal access to digital information if the shutting down of digital, um, terrestrial television were to happen, as I gather, is the current plan. Which would disrupt access to information in an emergency. So that's quite a lot of scene setting. Um, and perhaps we could start with Mr.
Davis on screen, and then we'll move to the other two.
10:34
Speaker 2
-
Speaker 2
Thank you. Good morning, everyone, and thank you for the invitation. I'm sorry I'm not there with you in the room. There's a lot in that question. Let me just step through it. Um, in terms of the BBC, I think clearly in terms of the media ecology as we now see it, there are substantial risks in terms of misinformation and disinformation and the role of bad actors. So the protecting essential, trusted information for the whole population that is universally accessible is a critical role for the BBC and a critical, critical contribution that we make in terms of national resilience, our ability to challenge inaccurate information, to verify and audio sources is incredibly important, particularly as we see the rise of poorly or malign content on social media platforms.
And clearly, the government is taking a more proactive step in that space, which we welcome. Um, but our principle response to those risks is very significant investment into our journalistic resources, not only in the UK, but globally, so that we can address those risks, um, directly. Um, and let me answer your question specifically on DTT in terms of the government consultation, um the government have come to a view that there is a route through um to switch off on DTT by 2034, but with some substantial caveats.
There is still a small minority of people, um, that are reliant on DTT for access to live television signals. That number will reduce substantially between now and 2034, but it is essential, essential that they, those individuals are not left behind and that there is clear action taken in order to bring those give those individuals full access to the benefits of digital provision. And clearly we will work with other broadcasters and with the government to make sure those steps are taken. Um, it is important that the media ecology evolves.
But as we learnt with digital switchover some 15 years ago now, it's vital that everybody is part of that journey and that we consider how we provide full universal access to our digital services, even for those at the moment who don't have the confidence or the ability or the money to fund access to digital.
And clearly, the government is taking a more proactive step in that space, which we welcome. Um, but our principle response to those risks is very significant investment into our journalistic resources, not only in the UK, but globally, so that we can address those risks, um, directly. Um, and let me answer your question specifically on DTT in terms of the government consultation, um the government have come to a view that there is a route through um to switch off on DTT by 2034, but with some substantial caveats.
There is still a small minority of people, um, that are reliant on DTT for access to live television signals. That number will reduce substantially between now and 2034, but it is essential, essential that they, those individuals are not left behind and that there is clear action taken in order to bring those give those individuals full access to the benefits of digital provision. And clearly we will work with other broadcasters and with the government to make sure those steps are taken. Um, it is important that the media ecology evolves.
But as we learnt with digital switchover some 15 years ago now, it's vital that everybody is part of that journey and that we consider how we provide full universal access to our digital services, even for those at the moment who don't have the confidence or the ability or the money to fund access to digital.
10:36
10:36
Speaker 3
-
Speaker 3
Thank you very much. Um, so my name is Sophie and, uh, I'm associate director for Digital Infrastructure at tech UK. So a bit about tech UK. In the first instance, we are an industry organisation of around 1100 tech companies. Um and my, my role here today and I hope to shine a light on is that kind of whole connectivity ecosystem. So the companies that I work with most are operators like BT, uh, suppliers, um, all kinds of technologies across the telecoms landscape.
So fixed mobile satellite. Um, and yeah, we look at things around data centres, telecoms, cloud provision. Um, so that's the, the, um, what I hope to bring today to, to the session, um, I think just firstly to go on to the, the risks, um, one of the things that I'm struck by and touched on, um, the switch over from DTT, DTT a few years ago is that today in 2026, so much relies upon the digital infrastructure that our members are building in the UK. So much of our lives, like this session, are being streamed live.
And that that requires that internet connection. Um, and because of that, I think that the resilience question is really a kind of whole economy issue because so much of what we do now runs on this internet infrastructure. Um, and it is, it is resilient, um, in its general approach, you know, routine resilience is there, there's no, there's no need for concern. Um, but I would say is that we need to make sure that our networks can, uh, resist a shock and keep functioning. Um, that's obviously absolutely essential when you're using technology.
Um, that brings great value. Um, the binding constraint on our telecoms infrastructure is power. So power and telecoms have a mutual dependence. So if there's no electricity, um, there's no, there's no network. And that that plays out in very different ways. Um, so I think that's just the one thing that we would always call call to is, is, is the power. Um, I won't speak too much to the, to the disinformation question. That's not really my, my area of absolute, um, but I can follow up with colleagues if that's helpful.
I think what I would say in terms of, you know, you mentioned generative AI, um, AI is, is but a tool. It's, um, it's not creating a new category of risk. It's perhaps accelerating and scaling what is already out there. Um, but, but yeah, I would say it's, it's also a powerful defensive tool. So we can use it both to make sure that our networks are running, make sure that there's any fault detected, but also, um, stop those messages coming through that we perhaps wouldn't like.
So fixed mobile satellite. Um, and yeah, we look at things around data centres, telecoms, cloud provision. Um, so that's the, the, um, what I hope to bring today to, to the session, um, I think just firstly to go on to the, the risks, um, one of the things that I'm struck by and touched on, um, the switch over from DTT, DTT a few years ago is that today in 2026, so much relies upon the digital infrastructure that our members are building in the UK. So much of our lives, like this session, are being streamed live.
And that that requires that internet connection. Um, and because of that, I think that the resilience question is really a kind of whole economy issue because so much of what we do now runs on this internet infrastructure. Um, and it is, it is resilient, um, in its general approach, you know, routine resilience is there, there's no, there's no need for concern. Um, but I would say is that we need to make sure that our networks can, uh, resist a shock and keep functioning. Um, that's obviously absolutely essential when you're using technology.
Um, that brings great value. Um, the binding constraint on our telecoms infrastructure is power. So power and telecoms have a mutual dependence. So if there's no electricity, um, there's no, there's no network. And that that plays out in very different ways. Um, so I think that's just the one thing that we would always call call to is, is, is the power. Um, I won't speak too much to the, to the disinformation question. That's not really my, my area of absolute, um, but I can follow up with colleagues if that's helpful.
I think what I would say in terms of, you know, you mentioned generative AI, um, AI is, is but a tool. It's, um, it's not creating a new category of risk. It's perhaps accelerating and scaling what is already out there. Um, but, but yeah, I would say it's, it's also a powerful defensive tool. So we can use it both to make sure that our networks are running, make sure that there's any fault detected, but also, um, stop those messages coming through that we perhaps wouldn't like.
10:39
10:39
Speaker 4
-
Speaker 4
Um, I'm Alex Towers, I'm the director of policy and public affairs for BT Group. That includes BT, E Plusnet and our sort of semi independent network infrastructure division, which is Openreach. Um, I actually also used to work for quite a long time at the BBC, so it's nice to see Roger and uh, also, you know, very much agree with, uh, everything you said about the importance of that institution, um, in terms of sort of BT and the telecoms infrastructure, I mean, the nature of the sort of risks that we are trying to manage all the time, I guess hasn't changed very much.
But the scale of the possible threats and the possible risks of things going wrong is, is changing. And that's where we should be, I think, kind of thoughtful. So the stuff we're trying to constantly protect and keep, keep running and provide contingency for is sort of the physical infrastructure, literally the cables that come into the country. All of our exchange buildings or mobile mass network, all the other sort of interconnected equipment that we, um, we service every day. And so one category, the kind of, as Sophie mentioned, the power supply that all that depends on, which is a critical interdependency is kind of second thing.
And then all of our kind of it and sort of systems infrastructure that runs in the background to keep the whole show on the road. And we have we do a huge amount of work and spend tens of million pounds every year on trying to just keep those going in the kind of business as usual sort of way. Clearly, there are a number of different ways in which they could be threatened. And some of that has always been with us. So literally accidental damage to a cable from a ship, for example, or kind of wear and tear and, but increasingly, cyber threats, AI risks across our network.
We see sort of, you know, millions of different types of attacks every every year we have hundreds of thousands of people sort of, you know, in the background, um, sort of trying to worry about that. And there's kind of physical sabotage. And sometimes that is linked to AI and disinformation. I'm not an expert on sort of disinformation that he's talking about, but certainly on occasions in particular during Covid, we saw kind of conspiracy theories online about 5G, for example, being to blame in some way for the pandemic.
And that literally caused people to try to set fire to telecoms mass genuine problem for us, where we had to get the government involved in trying to handle that. So these things are sort of inter connected. Plus then there are sort of supply chain issues which, uh, sort of, you know, increasingly a focus given just the way geopolitics is going and the sort of questions about our sovereign capabilities and where we need to invest as a country, and then the climate and the extremes of climate that can cause issues just for how equipment works, most of which we think we have kind of factored in.
But it's a continuing concern and extreme weather and storms cause problems for telecoms equipment. And so the level of all those risks, I guess, is increasing. And as Sophie saying, the sort of issues that come from any outage are increasingly on a different sort of level because of the interconnectedness of the whole economy and the extent to which all the way we live our lives depends on, uh, on and, uh, telecoms networks. So other aspects of CNI banking, government services, uh, very, a very protracted outage would cause significant problems across all those kind of territories, which is exactly why this is a good moment to be sort of asking the question about, well, are we.
On a different sort of level now of risk?And what do we do about that, and how do we try and think through some of these issues about the ways in which different parts of the economy are tied together, and we have particular issues?Again, as we were saying about, um, the energy networks and are we worried about whether we can get kind of priority service from them in the event of some sort of problem?They are also dependent on us for any kind of smart grid kind of capacity that they want to provide.
So, um, this is a sort of team team game. And I guess just to finally touch on the DTT question you asked, I mean, it's absolutely the right question to ask. So we, we are very pleased. The government have said this week as, as Rhodri says, that they think there's a compelling case to move for television transmission from terrestrial onto IP. We are very confident that is technically achievable in the time frame they are talking about, which is sort of eight year period.
Um, again, as already said, we've done something like this before with the digital switchover, um, a decade or so ago. It's totally possible, but it does absolutely depend on a joined up plan to make sure that everyone is brought on that journey. I mean, this is a shift we are making across various different technologies. Actually, we are currently changing people's landline technology over. We've got to 92%, I think now of people who have landlines, giving them a new way of using that tech.
We will be switching off 2G. We are rolling out fibre and the television switch off is kind of part of this kind of suite of upgrades that the country needs to make to get everyone onto the best possible tech with the, with the best possible resilience actually, so that it works really fantastically for everyone. And everyone has the same sort of starting point in life. But that does mean answering really important questions about, as we got the access for the technology to everyone, is it affordable for everyone?Does everyone understand how to make the change and confident about that?And have we thought about.
Absolutely what the resilience questions might be?If there is a problem further down the line and there's a plan to kind of deal with that, all of that is totally achievable. But it does need some work.
But the scale of the possible threats and the possible risks of things going wrong is, is changing. And that's where we should be, I think, kind of thoughtful. So the stuff we're trying to constantly protect and keep, keep running and provide contingency for is sort of the physical infrastructure, literally the cables that come into the country. All of our exchange buildings or mobile mass network, all the other sort of interconnected equipment that we, um, we service every day. And so one category, the kind of, as Sophie mentioned, the power supply that all that depends on, which is a critical interdependency is kind of second thing.
And then all of our kind of it and sort of systems infrastructure that runs in the background to keep the whole show on the road. And we have we do a huge amount of work and spend tens of million pounds every year on trying to just keep those going in the kind of business as usual sort of way. Clearly, there are a number of different ways in which they could be threatened. And some of that has always been with us. So literally accidental damage to a cable from a ship, for example, or kind of wear and tear and, but increasingly, cyber threats, AI risks across our network.
We see sort of, you know, millions of different types of attacks every every year we have hundreds of thousands of people sort of, you know, in the background, um, sort of trying to worry about that. And there's kind of physical sabotage. And sometimes that is linked to AI and disinformation. I'm not an expert on sort of disinformation that he's talking about, but certainly on occasions in particular during Covid, we saw kind of conspiracy theories online about 5G, for example, being to blame in some way for the pandemic.
And that literally caused people to try to set fire to telecoms mass genuine problem for us, where we had to get the government involved in trying to handle that. So these things are sort of inter connected. Plus then there are sort of supply chain issues which, uh, sort of, you know, increasingly a focus given just the way geopolitics is going and the sort of questions about our sovereign capabilities and where we need to invest as a country, and then the climate and the extremes of climate that can cause issues just for how equipment works, most of which we think we have kind of factored in.
But it's a continuing concern and extreme weather and storms cause problems for telecoms equipment. And so the level of all those risks, I guess, is increasing. And as Sophie saying, the sort of issues that come from any outage are increasingly on a different sort of level because of the interconnectedness of the whole economy and the extent to which all the way we live our lives depends on, uh, on and, uh, telecoms networks. So other aspects of CNI banking, government services, uh, very, a very protracted outage would cause significant problems across all those kind of territories, which is exactly why this is a good moment to be sort of asking the question about, well, are we.
On a different sort of level now of risk?And what do we do about that, and how do we try and think through some of these issues about the ways in which different parts of the economy are tied together, and we have particular issues?Again, as we were saying about, um, the energy networks and are we worried about whether we can get kind of priority service from them in the event of some sort of problem?They are also dependent on us for any kind of smart grid kind of capacity that they want to provide.
So, um, this is a sort of team team game. And I guess just to finally touch on the DTT question you asked, I mean, it's absolutely the right question to ask. So we, we are very pleased. The government have said this week as, as Rhodri says, that they think there's a compelling case to move for television transmission from terrestrial onto IP. We are very confident that is technically achievable in the time frame they are talking about, which is sort of eight year period.
Um, again, as already said, we've done something like this before with the digital switchover, um, a decade or so ago. It's totally possible, but it does absolutely depend on a joined up plan to make sure that everyone is brought on that journey. I mean, this is a shift we are making across various different technologies. Actually, we are currently changing people's landline technology over. We've got to 92%, I think now of people who have landlines, giving them a new way of using that tech.
We will be switching off 2G. We are rolling out fibre and the television switch off is kind of part of this kind of suite of upgrades that the country needs to make to get everyone onto the best possible tech with the, with the best possible resilience actually, so that it works really fantastically for everyone. And everyone has the same sort of starting point in life. But that does mean answering really important questions about, as we got the access for the technology to everyone, is it affordable for everyone?Does everyone understand how to make the change and confident about that?And have we thought about.
Absolutely what the resilience questions might be?If there is a problem further down the line and there's a plan to kind of deal with that, all of that is totally achievable. But it does need some work.
10:45
10:45
Speaker 5
-
Speaker 5
Yes. I think this is um largely for um Mr. Davis. Um and it is about messaging and um preparedness and resilience and how it can be made clear and accessible for the public, including during emergencies. And what work are you putting into that, given the BBC's extremely important role in terms of information?
10:45
Speaker 2
-
Speaker 2
Yeah. Thank you. And I should have introduced myself at the start. I'm Roger Davies, I'm deputy director general of the BBC. Um, we're very focused on this. I mean, clearly the BBC has a central role in delivering a. Crucial information. We have a formal role under our Royal Charter in terms of, um, how critical messages can reach the public in times of crisis. We have clearly a body of work and evidence from Covid in terms of how we respond at pace to critical emergencies and how we make sure public information is clear and available rapidly.
Um, and we are now working with the government in terms of the government's own resilience action plan and closely liaising with a number of bodies, not least the National Cyber Security Centre, in terms of developing a whole range of proactive measures that strengthen our resilience and reduce the risk of us falling victim to an attack. Um, I think the critical part of this is clearly the delivery of our news services. And whilst it might feel a peripheral question, um, the central one is how do you maintain trust?Um, because a moment of national crisis.
Um we see time and time again that users, millions of users turn to the source that they trust the most. And that right now is, remains the BBC by far the most widely used and most trusted news outlet. Um, still three quarters of UK adults coming in to BBC news across each week. So well ahead of any other news provider. And it's that trustworthiness and how we build and safeguard that trust that I think is the critical work for the BBC.
Um, there is clearly technical work to do, infrastructure work to do. Um, but fundamentally, are you a brand that the audience trusts to go to in moments of genuine threat and jeopardy?We're in a good place. We've demonstrated what we can do in Covid, where trust levels were through the roof. Um, but that is the job in hand.
Um, and we are now working with the government in terms of the government's own resilience action plan and closely liaising with a number of bodies, not least the National Cyber Security Centre, in terms of developing a whole range of proactive measures that strengthen our resilience and reduce the risk of us falling victim to an attack. Um, I think the critical part of this is clearly the delivery of our news services. And whilst it might feel a peripheral question, um, the central one is how do you maintain trust?Um, because a moment of national crisis.
Um we see time and time again that users, millions of users turn to the source that they trust the most. And that right now is, remains the BBC by far the most widely used and most trusted news outlet. Um, still three quarters of UK adults coming in to BBC news across each week. So well ahead of any other news provider. And it's that trustworthiness and how we build and safeguard that trust that I think is the critical work for the BBC.
Um, there is clearly technical work to do, infrastructure work to do. Um, but fundamentally, are you a brand that the audience trusts to go to in moments of genuine threat and jeopardy?We're in a good place. We've demonstrated what we can do in Covid, where trust levels were through the roof. Um, but that is the job in hand.
10:48
Speaker 1
-
Speaker 1
Thank you. Could I intervene here and say I'm interested in the emphasis you put on trust?Quite rightly, but we've gone out of our way to canvass the views of young people. And it was quite striking that they were divided pretty much 5050 on whether they trusted the BBC. And I wonder if you're doing any proactive work to try and encourage a more positive attitude towards the BBC amongst young people.
10:48
Speaker 2
-
Speaker 2
Yeah, look, thank you for that. Look, I'm an optimist on this. I mean, there's a lot of talk about youth engagement with the media. Um, the BBC, according to Ofcom, remains the top ranked organisation among 12 to 15 year olds for news, the most important news source for 12 to 15 year olds. We know that 12 to 15 year olds trust the BBC more than any other organisation. Now, I don't pretend there aren't challenges. The polarization and division that we see in social media means that many audiences, and particularly young audiences, can come to the BBC with a preconceived view of where the truth might.
So there are significant challenges for us. Um, but again, if you take a brand, you know, some would regard a heritage brand like Newsround, the most trusted source of news for children aged 7 to 12. Even among 13 to 16 year olds, the second most trusted behind BBC news. So we have the brands and the provision that can drive trust with those audiences. What we need to do more of is make sure that we have a really ambitious news offer sitting on social media platforms, where increasingly younger audiences are going for news and information.
And part of our new partnership with YouTube is to do just that, to make sure we are the number one news brand, not just in the UK on YouTube, but globally too. And and there is work to do on that.
So there are significant challenges for us. Um, but again, if you take a brand, you know, some would regard a heritage brand like Newsround, the most trusted source of news for children aged 7 to 12. Even among 13 to 16 year olds, the second most trusted behind BBC news. So we have the brands and the provision that can drive trust with those audiences. What we need to do more of is make sure that we have a really ambitious news offer sitting on social media platforms, where increasingly younger audiences are going for news and information.
And part of our new partnership with YouTube is to do just that, to make sure we are the number one news brand, not just in the UK on YouTube, but globally too. And and there is work to do on that.
10:49
10:50
10:50
10:50
Speaker 4
-
Speaker 4
No, no, but I think there is a sort of interesting question about the public sort of thinking about these questions is a more of a government should be trying to do to put a real on not quite a war footing, but a sort of, you know, different kind of mindset about how prepared you are for things going wrong, which we totally show we can do as a country during the pandemic. Um, but, you know, as things change and people are going to be more reliant on having, for example, backup sources of power or radios or whatever it is in there.
There's an interesting question there from a sort of whole of society point of view in the way in other countries, there's always a danger of kind of pointing at Scandinavia, because it's a different sort of culture. But still other countries do more of this. And I think that is a sort of reasonable question to ask.
There's an interesting question there from a sort of whole of society point of view in the way in other countries, there's always a danger of kind of pointing at Scandinavia, because it's a different sort of culture. But still other countries do more of this. And I think that is a sort of reasonable question to ask.
10:51
10:51
Speaker 3
-
Speaker 3
Thank you. Yeah. The only thing that I would just point to is, um, you know, the, the telecom sector has invested a huge amount in helping communicate with its customers in times of emergency. So the cell broadcast system that sends out, um, national alerts through people's phones, um, that's really just there to work in a, in a time of kind of great disruption, whether that be a storm or, um, or another kind of, um, difficult moment. I think the, the point is that that's a public message being broadcast to the, to the country and to Alex's point, I think it's, this is where media literacy comes in.
Because if you're thinking about someone picking up their phone and looking at a message and it's saying something, you want them to be able to determine, that's that's an official message. Or does that look a bit suspicious?So I think Ofcom is looking at that. It's just published something on media literacy this week. It was definitely in the Green Paper that was was produced on Tuesday. So media literacy is something that um just an interesting point to.
Because if you're thinking about someone picking up their phone and looking at a message and it's saying something, you want them to be able to determine, that's that's an official message. Or does that look a bit suspicious?So I think Ofcom is looking at that. It's just published something on media literacy this week. It was definitely in the Green Paper that was was produced on Tuesday. So media literacy is something that um just an interesting point to.
10:52
10:52
Speaker 6
-
Speaker 6
All right. Well, we had evidence if I can talk to Mr. Davis. And I thank you all for coming. We had evidence from Sam Wise of Saatchi and Saatchi that actually said 82% of people in. The not too distant past have been likely to turn to national television for information, but that this has now dropped to 51%. He added the proportion of people turning to family and friends via messaging had gone from 33% to 50% in a national emergency.
So what that's saying is the trust is with the local community and local family, rather than with the BBC, which we had quite a lot of information from YouGov and other people saying that people think of it as it has 50% of people believing it's biased. So, I mean, I think that that's something you have to handle.
So what that's saying is the trust is with the local community and local family, rather than with the BBC, which we had quite a lot of information from YouGov and other people saying that people think of it as it has 50% of people believing it's biased. So, I mean, I think that that's something you have to handle.
10:53
Speaker 2
-
Speaker 2
Yeah. Look, there are lots of different ways of looking at data. What I would say to you is that the BBC remains far and away the most trusted news organisation in the UK and the number one most trusted news organisation globally. But there is no doubt there is pressure on trust scores for all broadcasters. What I would say, if you look at the Reuters report that came out last week, is that trust in the public service media in the UK and particularly in the BBC, has remained resilient.
And what is what is impacting on trust is, of course, new media entrants. The role of social media, which is polarising people. It's it's raising questions about what you trust and what you believe. So there is clearly that has a drag on on the whole industry. But I would say that we time and time again see our scores on trust way, way above the rest of the industry. So I think I don't want to underplay the challenges. Um, we have a lot to, to pick up on the point just being raised.
We have a lot of work to do. Uh, in the space of media literacy to help people navigate a new ecology around news, you know, the role of bite size, uh, helping children navigate fake news and information. Uh, a brand called other side of the story so they can really start to develop their own personal toolkit to understand what is fake and what is real. It's the same with AI. You know, we've just launched a bite sized guide to AI again, about giving children knowledge so they can make more informed choices and be confident about how they deploy AI tools at home and in their studies.
So that is all part of our work to build trust and to give people the confidence to navigate a media climate that is changing so rapidly.
And what is what is impacting on trust is, of course, new media entrants. The role of social media, which is polarising people. It's it's raising questions about what you trust and what you believe. So there is clearly that has a drag on on the whole industry. But I would say that we time and time again see our scores on trust way, way above the rest of the industry. So I think I don't want to underplay the challenges. Um, we have a lot to, to pick up on the point just being raised.
We have a lot of work to do. Uh, in the space of media literacy to help people navigate a new ecology around news, you know, the role of bite size, uh, helping children navigate fake news and information. Uh, a brand called other side of the story so they can really start to develop their own personal toolkit to understand what is fake and what is real. It's the same with AI. You know, we've just launched a bite sized guide to AI again, about giving children knowledge so they can make more informed choices and be confident about how they deploy AI tools at home and in their studies.
So that is all part of our work to build trust and to give people the confidence to navigate a media climate that is changing so rapidly.
10:54
10:54
10:55
Speaker 7
-
Speaker 7
Uh, yes, thank you, thank you. Thank you very much for coming. Bringing our not inconsiderable expertise to our committee. Uh, we've heard from other, um, uh, experts, uh, witnesses about the sort of large scale communications disruptions. We heard from Ofcom about providing interim coverage using mobile generators. And we've heard from the BBC about, you know, actually how you do your business community. And I know BT has provided some very interesting evidence on the challenges facing all providers.
So I just wondered if you could sort of bring that together. Perhaps this is one um, more for you, Mr. Towers, but you know everybody else as well. What are the actual plans?If you could just sort of broaden them out for us, maintaining communications in a, in a, in a major. Disruption and also the recovery period. And how, how does it all connect.
So I just wondered if you could sort of bring that together. Perhaps this is one um, more for you, Mr. Towers, but you know everybody else as well. What are the actual plans?If you could just sort of broaden them out for us, maintaining communications in a, in a, in a major. Disruption and also the recovery period. And how, how does it all connect.
10:56
Speaker 4
-
Speaker 4
Yeah. Um, so I mean, there's a huge amount we do already to kind of prepare, I suppose, for those sorts of situations. So part of the plan is, I guess I'd sort of split it into sort of two sectors. There's a kind of are we ready to absorb whatever risk there might be, number one. And then how do we respond and repair and address the sort of situation as it presents itself?So the kind of absorbed bit is all about how we design the network to begin with.
So the sort of fixed telecoms network that kind of broadband, the wires in the ground sort of stuff is, is designed so that the, the different phone exchanges that provide the service are kind of overlapping. And then if something happens to one of them, it kind of we try to contain the geographic kind of risk of outages to the population by there being others to support as a kind of similar principle for the mobile phone network, where the masts have overlapping coverage so that even if one gets knocked out, there might be others that can step in.
So there's a kind of design point. And then also built in is a degree of kind of power, resilience and backup. So we have something like 5000, I think generators around the different around the kind of BT Openreach kind of network and the core network that is underpinning both the sort of broadband and the mobile phone network has got a seven day kind of backup period built into it in terms of power supply. Many of those mobile phone masts will have their own kind of separate backup battery or generator supply.
The cabinets all have four out of the street cabinets that you see. Green ones on the road will have four hours kind of built into them. And, you know, many of the services that we provide are sort of especially the kind of critical. Uh, 999 and the sort of service we provide to the emergency services have additional kind of, um, sort of resilience built into them so that they can carry on working for, for longer. So we try and kind of prioritise the services if you like.
So all that is sort of good sort of readiness. Um, and then as soon as something does happen, then the question is how quickly can you respond and recover. So that is a mixture of. So we have our own. In our case, we have our own dedicated teams called the BT Emergency Response Team that literally head off to wherever an incident is and try to provide kind of temporary solution and then a permanent solution. So, uh, for example, when there was an issue with one of the Scottish islands earlier in the year, there was a kind of immediate deployment of those people, provision of for a temporary period of a kind of satellite based service, because a cable had gone down that couldn't be replaced.
And then the kind of repair from the cable repair ship, that took a while, but we were able to sort of provide that kind of short term measure. So we've got our own kind of system that is quite effective in dealing with those sort of. Specific localised issues. And then there is a government sort of mechanism that goes around that as well. So it's called the Electronic Communications Resilience and Response Group. It's a sort of Cabinet Office thing which kind of kicks into action as soon as there was an issue, because sometimes it might just affect us, but more often it's going to affect quite a lot of different operators, and we'll all be trying to run around trying to work out how do we fix that.
So that is a good, um, additional layer of, of sort of, um, operation. And it's worth saying now, I think. So all of that is, is good and is based on kind of decades of work and like tens of million pounds every year spent on trying to kind of sustain all of that. And it's good for, uh, specific outages based on specific local or regional events. One of the questions I think you're asking is a committee, and certainly the government is asking is, what if there is some more profound, much more widespread national outage sort of a situation.
And that is candidly like a harder question to say. We totally got that covered today. I mean, lots of the things I've mentioned about kind of power backup and batteries and generators do provide a solution for a period of time in that sort of situation. Have we quite defined perfectly as a country?What's the right amount of time and the right sort of level of coverage?And for those sorts of. Probably not. Are we kind of ready for the sort of interconnected questions about how the power and telecoms networks work together in this situation?There's definitely more to do.
I would say.
So the sort of fixed telecoms network that kind of broadband, the wires in the ground sort of stuff is, is designed so that the, the different phone exchanges that provide the service are kind of overlapping. And then if something happens to one of them, it kind of we try to contain the geographic kind of risk of outages to the population by there being others to support as a kind of similar principle for the mobile phone network, where the masts have overlapping coverage so that even if one gets knocked out, there might be others that can step in.
So there's a kind of design point. And then also built in is a degree of kind of power, resilience and backup. So we have something like 5000, I think generators around the different around the kind of BT Openreach kind of network and the core network that is underpinning both the sort of broadband and the mobile phone network has got a seven day kind of backup period built into it in terms of power supply. Many of those mobile phone masts will have their own kind of separate backup battery or generator supply.
The cabinets all have four out of the street cabinets that you see. Green ones on the road will have four hours kind of built into them. And, you know, many of the services that we provide are sort of especially the kind of critical. Uh, 999 and the sort of service we provide to the emergency services have additional kind of, um, sort of resilience built into them so that they can carry on working for, for longer. So we try and kind of prioritise the services if you like.
So all that is sort of good sort of readiness. Um, and then as soon as something does happen, then the question is how quickly can you respond and recover. So that is a mixture of. So we have our own. In our case, we have our own dedicated teams called the BT Emergency Response Team that literally head off to wherever an incident is and try to provide kind of temporary solution and then a permanent solution. So, uh, for example, when there was an issue with one of the Scottish islands earlier in the year, there was a kind of immediate deployment of those people, provision of for a temporary period of a kind of satellite based service, because a cable had gone down that couldn't be replaced.
And then the kind of repair from the cable repair ship, that took a while, but we were able to sort of provide that kind of short term measure. So we've got our own kind of system that is quite effective in dealing with those sort of. Specific localised issues. And then there is a government sort of mechanism that goes around that as well. So it's called the Electronic Communications Resilience and Response Group. It's a sort of Cabinet Office thing which kind of kicks into action as soon as there was an issue, because sometimes it might just affect us, but more often it's going to affect quite a lot of different operators, and we'll all be trying to run around trying to work out how do we fix that.
So that is a good, um, additional layer of, of sort of, um, operation. And it's worth saying now, I think. So all of that is, is good and is based on kind of decades of work and like tens of million pounds every year spent on trying to kind of sustain all of that. And it's good for, uh, specific outages based on specific local or regional events. One of the questions I think you're asking is a committee, and certainly the government is asking is, what if there is some more profound, much more widespread national outage sort of a situation.
And that is candidly like a harder question to say. We totally got that covered today. I mean, lots of the things I've mentioned about kind of power backup and batteries and generators do provide a solution for a period of time in that sort of situation. Have we quite defined perfectly as a country?What's the right amount of time and the right sort of level of coverage?And for those sorts of. Probably not. Are we kind of ready for the sort of interconnected questions about how the power and telecoms networks work together in this situation?There's definitely more to do.
I would say.
11:00
11:00
11:00
11:01
Speaker 2
-
Speaker 2
Just just to echo a couple of themes there from Alex. I think that the clearly a lot of our work is based around minimising, um, in advance the risk that we face. So in cyber security, etc., etc. but clearly, if there was a national power outage, we have a, a clear plan that we've developed in coordination with the Cabinet Office about how we would prioritize public public information messages, particularly using, um, radio transmission, which would probably be the most resilient in a moment like that. So we have a prioritized set of services, both that could be deployed at a national level or across our local network of services that would ensure that public information messages were available.
Now it goes back to a point Alex raised, which is what is the preparedness of the audience for those types of, of moments?Uh, you know, in terms of very practical things like, um, access to batteries, um, and, and access to basic tools that would help them be personally more resilient in a moment like that. And that is clearly something that the government will be thinking about because other, um, parts of Europe, for obvious reasons, are probably more advanced on that journey. Um, but we do, as I say, work very closely with Cabinet Office and other government departments to make sure that the, the public information part of responding to a power outage is in good shape.
Now it goes back to a point Alex raised, which is what is the preparedness of the audience for those types of, of moments?Uh, you know, in terms of very practical things like, um, access to batteries, um, and, and access to basic tools that would help them be personally more resilient in a moment like that. And that is clearly something that the government will be thinking about because other, um, parts of Europe, for obvious reasons, are probably more advanced on that journey. Um, but we do, as I say, work very closely with Cabinet Office and other government departments to make sure that the, the public information part of responding to a power outage is in good shape.
11:02
11:02
Speaker 8
-
Speaker 8
Yes. I mean, actually, it's very interesting, this discussion because it seems to me getting to one of the core problems that we're going to have to address, which is there has been in all Western economies, a push, dramatic push towards just in time and and possibly a little less balanced with, uh, with, with just in case and a real danger of, of then confronting single points of failure in the system and reference therefore to taking out Freeview, taking out, taking out landlines, if your power source locally goes down and your internet's knocked out, if you're so dependent on on that for accessing material, is it maybe not a little incautious to be basically eliminating landlines, which even if that doesn't obviously affect every household, but at least neighbours can spread news.
But suddenly you've got a an area blackout.
But suddenly you've got a an area blackout.
11:03
Speaker 4
-
Speaker 4
In the case. So it's absolutely right. Um question to be asking because as we've been saying, I think the level of risk, the scale of the impact of the risk is bigger. In the case of landlines. It's quite an interesting case in point, I think, because the the current landline, um, technology or the sort of the sorry predecessor landline technology is called the PSTN public switched Telephone network. For those interested in the details is really on its last legs.
So they literally don't make the parts any longer. And we are currently to, to support the, uh. Network that still exists that we're switching over. We're having to kind of take parts from one part of the network to fix the problem in a different part, because there's no other way of doing it. So it is not a secure, resilient, uh, means of communication. The newer landline technology that is based on internet, um, technology, but it has 50% fewer faults in it.
So it's both more resilient in general. And it also, we can kind of sustain it for a longer period of time. So it's definitely the right thing to be doing. But then the question is, how do you manage a transition kind of really sensibly and make sure people know what they where they sit within it. So for example, anyone who we classify as a vulnerable customer, and that's anyone in an area without any mobile coverage, anyone over the age of 75, anyone with a particular sort of, um, telecare medical need, there's a long list of sort of criteria.
We try to be as broad as possible about it. All those people we are sort of. Leaving to the sort of end of the process so that we make sure we can manage them sort of separately, and we give them a dedicated unit that has a battery backup sort of system built into it, so that it should provide that sort of resilience and that lasts for, you know, very significant number of hours better than the sort of basic model that's out there on the market. So we're trying to be really thoughtful about that.
I mean, it's still really important that those people understand what they need to do to plug the thing in to make sure it does kind of work properly. And that's back to the sort of media literacy point and the kind of public information side of things, but it's the right thing to do to put them hopefully in a more secure position at the end of the process just needs really careful design.
So they literally don't make the parts any longer. And we are currently to, to support the, uh. Network that still exists that we're switching over. We're having to kind of take parts from one part of the network to fix the problem in a different part, because there's no other way of doing it. So it is not a secure, resilient, uh, means of communication. The newer landline technology that is based on internet, um, technology, but it has 50% fewer faults in it.
So it's both more resilient in general. And it also, we can kind of sustain it for a longer period of time. So it's definitely the right thing to be doing. But then the question is, how do you manage a transition kind of really sensibly and make sure people know what they where they sit within it. So for example, anyone who we classify as a vulnerable customer, and that's anyone in an area without any mobile coverage, anyone over the age of 75, anyone with a particular sort of, um, telecare medical need, there's a long list of sort of criteria.
We try to be as broad as possible about it. All those people we are sort of. Leaving to the sort of end of the process so that we make sure we can manage them sort of separately, and we give them a dedicated unit that has a battery backup sort of system built into it, so that it should provide that sort of resilience and that lasts for, you know, very significant number of hours better than the sort of basic model that's out there on the market. So we're trying to be really thoughtful about that.
I mean, it's still really important that those people understand what they need to do to plug the thing in to make sure it does kind of work properly. And that's back to the sort of media literacy point and the kind of public information side of things, but it's the right thing to do to put them hopefully in a more secure position at the end of the process just needs really careful design.
11:05
Speaker 1
-
Speaker 1
Okay. Thank you, Lady Winterton. I hope your supplementary is very quick before we bring Lord Oates in, because can I just say, I'm aware that we've only got Mr. Davis online till exactly 11:30 when he has to click out. So if you want to hear his answers to all our questions, everybody needs to be briefed.
11:05
11:05
Speaker 9
-
Speaker 9
It's probably straight to Mr. Davis, which was do you do practice sessions of, uh, in terms of what we're talking about, you know, do you have with your regional, uh, personnel networks and so on?Do you do the kind of Cobra?Um, it's happened and we're pretending that we're in the midst of an emergency.
11:06
Speaker 2
-
Speaker 2
Yeah. So we do, we do regular emergency planning, uh, and scenario planning that can be against a range of risks, uh, whether that's cyber security or power outages. So that's regular internal planning, uh, across our networks with a range of staff. Um, but we also, as I say, collaborate with government, with government in terms of, um. Public messaging priorities, uh, working through how issues will be escalated in moments of crisis. So yes, there is more and more focus on this.
I think, you know, you have seen, uh, in our, in our response to the green paper on the Royal Charter, this role in terms of national resilience, um, is only going to become more important for the BBC. But do you and I've.
I think, you know, you have seen, uh, in our, in our response to the green paper on the Royal Charter, this role in terms of national resilience, um, is only going to become more important for the BBC. But do you and I've.
11:06
Speaker 2
-
Speaker 2
No, we do both. So, um, the most recent experience I had was in looking at various cyber security risks and actually role playing a, a scenario based on a situation a US broadcaster had faced in the last 2 or 3 years. So yes, we test the planning to make sure that we've got the muscle memory internally when those moments of crisis, or if those moments of crisis should hit. Clearly, Covid gave us an awful lot of experience in terms of how you mobilize an organisation at speed.
11:07
11:07
11:07
Speaker 10
-
Speaker 10
And I think my question is directed principally to Mr. Davies. The BBC obviously has huge experience working around the world, both through the corporation itself and also through BBC Media Action, which which I believe you, chair, and I wondered if you could share with us if there are any particular lessons that the BBC would draw from its work in countries where communication systems are disrupted, such as during internet or mobile outages, uh, in terms of support and emergency communications in the UK.
11:07
11:07
Speaker 2
-
Speaker 2
We have a lot of experience in this space. I mean, particularly around emergency radio program. And it goes back to the point I was making earlier about the resilience of radio networks. Um, I think back in February, the World Service launched a temporary emergency radio programme for Iran. Uh, in response at that point to the crackdown on protests. Um, but we continued that service, uh, throughout the, uh, the attacks by the US and Israel on, on the country.
Uh, we look at that as a fairly standard now response to front line emergencies in different parts of the UK. A similar response in 2023, uh, in Sudan, uh, again, a regular daily, um, radio programme to give people information about how to cope with the humanitarian crisis, but also, frankly, to give Sudanese people an opportunity to hear their own accounts of what they were going through. Uh, again, another emergency radio service launched in Gaza in November 2024, and extensions of TV bulletins in response to crisis. Uh, launched on BBC News in Ukraine in February 2022.
So I think the key muscle memory here is speed of response. Um, but secondly, a platform focused primarily built around radio, which again, going back to the point I was making about power outages in the UK, um, radio particularly, um, FM gives you very significant resilience, uh, in moments of crisis. If you've got the backup generator generators in place.
Uh, we look at that as a fairly standard now response to front line emergencies in different parts of the UK. A similar response in 2023, uh, in Sudan, uh, again, a regular daily, um, radio programme to give people information about how to cope with the humanitarian crisis, but also, frankly, to give Sudanese people an opportunity to hear their own accounts of what they were going through. Uh, again, another emergency radio service launched in Gaza in November 2024, and extensions of TV bulletins in response to crisis. Uh, launched on BBC News in Ukraine in February 2022.
So I think the key muscle memory here is speed of response. Um, but secondly, a platform focused primarily built around radio, which again, going back to the point I was making about power outages in the UK, um, radio particularly, um, FM gives you very significant resilience, uh, in moments of crisis. If you've got the backup generator generators in place.
11:09
Speaker 10
-
Speaker 10
Very quickly ask a follow up on, on, on the radio issue in particular, um, the, you know, some of the advice of how people prepare is to have a wind up radio should things go wrong. Um, I don't think there's particular advice on whether that should be DAB shortwave. FM you seem to be suggesting FM is the most resilient frequency. Is that correct?
11:10
11:10
Speaker 2
-
Speaker 2
Across as many as many platforms as possible. Um but clearly the access to a whether it's a wind up or a battery operated radio, um, that has access, ideally both to FM and dab dab frequencies is probably the best option that, that users would face. Um, in a moment of a national power outage, our response would be to focus information around two of our major radio frequencies. Um, but clearly we have the option as well to localise both on FM and dab across our local radio network.
So we've got a whole variety of tools to respond. And it would depend very much on the nature of the outage, whether it was regionally, whether it was regionally localised, as it were, or whether we were facing a national problem.
So we've got a whole variety of tools to respond. And it would depend very much on the nature of the outage, whether it was regionally, whether it was regionally localised, as it were, or whether we were facing a national problem.
11:10
11:11
Speaker 6
-
Speaker 6
And I'll have actually two questions. So I'll give them both to you in order to save time. It's really to do with the relationship between government and the private sector. So, I mean, how can the first question, how can further conversations between government and the private sector benefit communications resilience, such as by establishing responsibility for. Funding such subsea infrastructure?And then second question, to what extent is there a need for either the government or businesses to attain digital sovereignty?Okay.
So, uh.
So, uh.
11:11
Speaker 4
-
Speaker 4
Maybe I'll go first. Um, so I guess, and this comes a little bit to the point also that Lord Spellar was making about, uh, just in time versus just in case, I guess. So the, um, the telecoms industry is not hugely competitive and we're all kind of spending our time trying to put lots of investment into trying to improve our infrastructure, but also kind of win customers, keep customers, keep prices down for all sorts of good and helpful reasons. It does mean we have not got sort of large amounts of capital sitting around ready to deploy on a kind of, or maybe just in case there's this resilience question.
So all the things I've described we're doing, we're doing because of the obvious things we must do. Is there now a question about in, in some sort of areas like subsea cables, uh, providing a sort of a much greater degree of contingency, probably. Yes. And are we as an industry kind of ready to step in and fill that gap?Maybe not. So. Absolutely. It is a conversation we are having with the government and a bit of a question for them.
And it goes to to some extent, as you say, the actual infrastructure, lots of infrastructure itself is is funded by, uh, different sorts of companies and coalitions. But there are questions about, uh, some really geeky ones about exactly how it works with the. Crown land. If you want to get your cable onshore and that costs are of that. But there's an important question about repair as well. So we currently have access as BT to two repair ships. One of them is in France, is French owned, doesn't come here very much, is usually busy elsewhere in Europe.
This is not an area of sort of Brexit dividend, I should say. Uh and the other is we've got is in this country, but it's sort of 35 years old. And is that enough for the range of possible issues we're going to face in the next ten years with all the hostile actors out there, and even just the sort of fact that the cables themselves are getting a bit older and there's wear and tear and all that sort of stuff, and possibly not what's what's the right response to it.
It absolutely needs to be some sort of conversation between the government and the industry. We're talking about it, but we haven't got an answer on that just yet. I would say, um, really good question. And then digital sovereignty, I mean, I'll have a go and then Sophie will sort of want to speak for the wider kind of industry probably, I think. I mean, it's really, really important and genuine question. I think they're much more interest from all sorts of different parts of the corporate world and, uh, public.
Services, critical national infrastructure customers as BT on what we can supply them with. And we do now have totally sovereign offer of, you all your voice data, cloud AI services can be provided, uh, on a UK sovereign basis. Um, but there's an awful lot of sort of chatter out there also about, you know, what exactly is sovereign. It needs a bit of a sort of clearer definition, I think, from the government about where they think the, the sort of, um, focus should go. And there is a role they can play, I think, in how they procure as the public sector, what they say the right sort of boundary is between UK sovereign and American or other, um sort of owned services.
And they haven't quite got to that bit, you know, doing lots of really great stuff around investing in start ups and sovereign AI supply is also a kind of demand question.
So all the things I've described we're doing, we're doing because of the obvious things we must do. Is there now a question about in, in some sort of areas like subsea cables, uh, providing a sort of a much greater degree of contingency, probably. Yes. And are we as an industry kind of ready to step in and fill that gap?Maybe not. So. Absolutely. It is a conversation we are having with the government and a bit of a question for them.
And it goes to to some extent, as you say, the actual infrastructure, lots of infrastructure itself is is funded by, uh, different sorts of companies and coalitions. But there are questions about, uh, some really geeky ones about exactly how it works with the. Crown land. If you want to get your cable onshore and that costs are of that. But there's an important question about repair as well. So we currently have access as BT to two repair ships. One of them is in France, is French owned, doesn't come here very much, is usually busy elsewhere in Europe.
This is not an area of sort of Brexit dividend, I should say. Uh and the other is we've got is in this country, but it's sort of 35 years old. And is that enough for the range of possible issues we're going to face in the next ten years with all the hostile actors out there, and even just the sort of fact that the cables themselves are getting a bit older and there's wear and tear and all that sort of stuff, and possibly not what's what's the right response to it.
It absolutely needs to be some sort of conversation between the government and the industry. We're talking about it, but we haven't got an answer on that just yet. I would say, um, really good question. And then digital sovereignty, I mean, I'll have a go and then Sophie will sort of want to speak for the wider kind of industry probably, I think. I mean, it's really, really important and genuine question. I think they're much more interest from all sorts of different parts of the corporate world and, uh, public.
Services, critical national infrastructure customers as BT on what we can supply them with. And we do now have totally sovereign offer of, you all your voice data, cloud AI services can be provided, uh, on a UK sovereign basis. Um, but there's an awful lot of sort of chatter out there also about, you know, what exactly is sovereign. It needs a bit of a sort of clearer definition, I think, from the government about where they think the, the sort of, um, focus should go. And there is a role they can play, I think, in how they procure as the public sector, what they say the right sort of boundary is between UK sovereign and American or other, um sort of owned services.
And they haven't quite got to that bit, you know, doing lots of really great stuff around investing in start ups and sovereign AI supply is also a kind of demand question.
11:15
11:15
Speaker 3
-
Speaker 3
Thank you. Um, a repair ship for subsea cable breaks. It's your classic kind of resilience versus redundancy case study because typically don't need it. And it's sitting there, but as soon as you do need it, it's absolutely vital. So, um, I think it's, I absolutely echo Alex's point on what the UK has in terms of its own capability to, to repair, um, cable breaks, of course, 70 to 80% of the breaks are accidental. So, you know, I know government is looking at how it can strengthen some of its deterrents and penalties for those accidents happening.
Um, but equally, I think, you know, roughly a third are sort of not accidental. And it's, it's the whole piece. It's the land where they come in, but it's the cables themselves. So, uh, yeah, I think it's a very interesting conversation. And I think it's one that government has to enter into with the kind of standing partnership with industry because, um, yeah, the sector is won't be able to fund it alone. Um, sovereignty. It's, it's top of mind for many of our members.
It's an ever increasing, um, discussion. Uh, we see it as a sort of mix of capability, leverage and openness. So you don't just want to own things, ownership for its own sake. Um, you want to invest where we lead. So where the UK leads, we want to buy better everywhere. You know, that's helpful for cost. For instance. Um, and we want to shape the world that we trade in. I think, um there's a, there's a, there's a layer of it that's almost a sort of sovereign imperative.
So the subsea cables is part of that, but it's other technologies and areas where we feel that, uh, if you don't co-fund or put your weight behind. Um, yeah, it's essentially a sort of strategic, uh, loss. You're excluded from that. So, um, yeah, there are certain areas like subsea, like quantum computing, for instance, where, um, the UK to fully support it, it makes a lot of sense.
Um, but equally, I think, you know, roughly a third are sort of not accidental. And it's, it's the whole piece. It's the land where they come in, but it's the cables themselves. So, uh, yeah, I think it's a very interesting conversation. And I think it's one that government has to enter into with the kind of standing partnership with industry because, um, yeah, the sector is won't be able to fund it alone. Um, sovereignty. It's, it's top of mind for many of our members.
It's an ever increasing, um, discussion. Uh, we see it as a sort of mix of capability, leverage and openness. So you don't just want to own things, ownership for its own sake. Um, you want to invest where we lead. So where the UK leads, we want to buy better everywhere. You know, that's helpful for cost. For instance. Um, and we want to shape the world that we trade in. I think, um there's a, there's a, there's a layer of it that's almost a sort of sovereign imperative.
So the subsea cables is part of that, but it's other technologies and areas where we feel that, uh, if you don't co-fund or put your weight behind. Um, yeah, it's essentially a sort of strategic, uh, loss. You're excluded from that. So, um, yeah, there are certain areas like subsea, like quantum computing, for instance, where, um, the UK to fully support it, it makes a lot of sense.
11:18
Speaker 12
-
Speaker 12
Um, thank you very much. I mean, you've kind of alluded to some of this, but in relation to digital sovereignty, um, we're in a world where, uh, data cloud services and AI are more or less concentrated in the hands of a few global companies. So how can the UK, uh, preserve. Strategic autonomy and at the same time. Um, kind of remain open and competitive, right.
11:19
Speaker 13
-
Speaker 13
I'd like to dive into the cable question a little bit deeper. Uh. Pun intended. Do you not think that there has to be someone in, in government responsible, given the risk of state risk of, of states who wish us harm, literally deliberately cutting cables?There's plenty of evidence across the globe that that is happening, and it seems unusual if we're such a digital economy and we're so exposed to that vulnerability that we're not actually pursuing it. Which leads to my very detailed question which part of government do you think should be responsible for that?
11:19
11:19
Speaker 2
-
Speaker 2
Can I just pick up the first question on on the challenge around digital sovereignty?Because I think it's a timely debate. Um, and I think there are, you know, there are a whole set of questions around AI and the level of sovereignty that the BBC wants the BBC, the UK wants to develop in terms of foundational models, large language models, which I know government is very focused on. I would just make a point in the context of the whole conversation that we've had, which is the ability of the the ability of the UK to have a sovereign media organisation that has independence from from global influence, from international, from other international players is critical.
The BBC is still, despite all the competition still used by 94% of the population every month, which is an extraordinary number, it remains a universal service, and that is a critical part of our national infrastructure, and it is a critical part of achieving digital sovereignty that you have a a UK owned media player of scale. Um, and I think in the conversation that we have about the future of the BBC over the next 12 months, this is a critical part of the narrative that if we allow the BBC to be reduced or we allow it, or we compromise its universality.
We also compromise the country's digital sovereignty. And I think this is a something that has not been discussed in previous charters, but it feels incredibly timely.
The BBC is still, despite all the competition still used by 94% of the population every month, which is an extraordinary number, it remains a universal service, and that is a critical part of our national infrastructure, and it is a critical part of achieving digital sovereignty that you have a a UK owned media player of scale. Um, and I think in the conversation that we have about the future of the BBC over the next 12 months, this is a critical part of the narrative that if we allow the BBC to be reduced or we allow it, or we compromise its universality.
We also compromise the country's digital sovereignty. And I think this is a something that has not been discussed in previous charters, but it feels incredibly timely.
11:20
Speaker 4
-
Speaker 4
Shall we?Carry on on that question and then come back to cables, maybe. I mean, first of all, just briefly, I would really agree with with um Rhodri by the way, and also I mean, it is good that the BBC is sort of putting all that stuff on YouTube and social media. Equally. It's really important that we're not entirely reliant on those global platforms for people to find their way to the BBC's content. So that is another sort of question to be grappling with.
And I think, look, it's a really complicated question. We obviously can't pretend that we are going to be able to sort of exist in a world without big US tech companies and sort of somehow or other, um, onshore, everything that the country needs, we just need to kind of plot our way through some of this is sort of statecraft stuff, I guess. So out of my sort of beyond my pay grade about how we use the sort of bits of leverage that we've got in international sort of politics.
But we can invest in sort of some of the components of a sovereign tech stack, which are about sort of, you know, data centres and services that you put on top of them. Uh, and, you know, so as I say, BT is doing some of that. Other companies will be doing some of that. It's really important part of the answer, and in particular around this question of resilience, of critical government and national infrastructure type services, there has to be an answer about how those things stay on and are secure in all circumstances.
And that's the question the government should be asking.
And I think, look, it's a really complicated question. We obviously can't pretend that we are going to be able to sort of exist in a world without big US tech companies and sort of somehow or other, um, onshore, everything that the country needs, we just need to kind of plot our way through some of this is sort of statecraft stuff, I guess. So out of my sort of beyond my pay grade about how we use the sort of bits of leverage that we've got in international sort of politics.
But we can invest in sort of some of the components of a sovereign tech stack, which are about sort of, you know, data centres and services that you put on top of them. Uh, and, you know, so as I say, BT is doing some of that. Other companies will be doing some of that. It's really important part of the answer, and in particular around this question of resilience, of critical government and national infrastructure type services, there has to be an answer about how those things stay on and are secure in all circumstances.
And that's the question the government should be asking.
11:21
11:21
Speaker 3
-
Speaker 3
I've just absolutely echo Alex's point, but also just to just to be really clear that for tech UK, our view is that, you know, ownership doesn't give you leverage, jurisdiction does. So, you know, making sure that we have, uh, yeah, control over what is in the UK is, is absolutely essential. That would be.
11:22
11:22
Speaker 4
-
Speaker 4
I'm definitely I'm always nervous about telling government which which bit of government should be doing what, but I think there is, uh, there's definitely a protective sort of defensive kind of question, which I guess is an MED thing because as you say, it's not we're not seeing at the minute lots and lots of sort of these hostile attacks, but it's obviously possible. Um, so that's a question for one bit of government. I guess there's also a question about kind of sort of building in resilience and adding to resilience, uh, is more for the sort of, um, the decent bit of government or whatever, you know, it ends up being.
And to some extent, this is also a devolved issue, by the way. So lots of, lots of within the UK, cables are between different parts of Scottish islands. Those are some of the cables that we bt operate. Some of them have got resilience built in like. There are two cables between Ireland A and Ireland B and some of them haven't. And that was a procurement decision made some time ago by someone. And there's a question about is that right or not?And that will be for the Scottish Government, I guess, to consider.
And to some extent, this is also a devolved issue, by the way. So lots of, lots of within the UK, cables are between different parts of Scottish islands. Those are some of the cables that we bt operate. Some of them have got resilience built in like. There are two cables between Ireland A and Ireland B and some of them haven't. And that was a procurement decision made some time ago by someone. And there's a question about is that right or not?And that will be for the Scottish Government, I guess, to consider.
11:23
Speaker 1
-
Speaker 1
Anybody else on cables. Right. Okay. Let's move on to Lady Paul's question then, please. Thank you very much. Thank you very much for your very interesting contributions. I think this is primarily for you, Sophie. Um, how can the government avoid a complacent approach to cyber threats, for example, you know, the upcoming Cyber Security and resilience bill?Uh, are there additional things that should be covering?And if so, could you kind of be specific about what you think should be included and obviously, we'd be very interested in both Rhodri and Alex's contribution as well.
11:24
11:24
Speaker 7
-
Speaker 7
You do not want to just assume that that is just complacency alone. It takes a whole mindset shift to to make things secure and resilient. We've talked about the kind of anticipation of shocks and how you might absorb them, that planning and then the plans that you have to recover. And, and that's, you know, that's for each organization to take view. Um, I don't think that expanding the scope is perhaps something that we would, we would like to see at this point.
We know that your, you and your colleagues are now to, to sort of address the bill as it returns to the House of Lords. And I think that we would just want to see it sort of implemented at pace. Yeah. Um, the the secondary stage of the CSB will be where it, it's really crucial because that secondary legislation and the codes of practice will be exactly where industry is making sure that it's, it's, you know, optimal. So some, some form of mandatory consultation with industry would be very welcome.
Um, being able to resource the regulators. It's bringing a few new sectors into scope and just making sure that, that, regulation layer is, is optimal as well. It's something that we would support. Um, yeah. And just keep it proportionate. I think, you know, there's an element of, um, the criticality of certain sectors perhaps doesn't need to be applied economy wide, um, really need to select what could have the most kind of um, disruption versus keeping costs low for businesses whilst encouraging that mindset and approach to, to being secure and resilient and collaboration, you know, it's something that we at UK very much support, I've worked a lot on the Telecom Security Act, um, which is carves out the telecom sector from the cyber security and resilience bill.
Um, and that's very much a sort of collaborative effort to understand the threats and the risks, understand how to engage with the regulator and government. Um, so yes, we wouldn't like to see anything in terms of scope engaging, but, you know, I would say that the, the powers that secretary of State will be given to bring in new sectors, you know, that's welcome. It's good to have that as a, as a sort of, um, a tool and, um, yeah, kind of final call would really be no, no added complexity.
So as much alignment as possible. Many of these organisations, you know, if you're caught, you may be a telecoms provider that's um, provides a different service. That means that you would be both working to the Telecom Security Act, but also the Cyber Security resilience bill. So yeah, just making sure that there's alignment between between different guidelines.
We know that your, you and your colleagues are now to, to sort of address the bill as it returns to the House of Lords. And I think that we would just want to see it sort of implemented at pace. Yeah. Um, the the secondary stage of the CSB will be where it, it's really crucial because that secondary legislation and the codes of practice will be exactly where industry is making sure that it's, it's, you know, optimal. So some, some form of mandatory consultation with industry would be very welcome.
Um, being able to resource the regulators. It's bringing a few new sectors into scope and just making sure that, that, regulation layer is, is optimal as well. It's something that we would support. Um, yeah. And just keep it proportionate. I think, you know, there's an element of, um, the criticality of certain sectors perhaps doesn't need to be applied economy wide, um, really need to select what could have the most kind of um, disruption versus keeping costs low for businesses whilst encouraging that mindset and approach to, to being secure and resilient and collaboration, you know, it's something that we at UK very much support, I've worked a lot on the Telecom Security Act, um, which is carves out the telecom sector from the cyber security and resilience bill.
Um, and that's very much a sort of collaborative effort to understand the threats and the risks, understand how to engage with the regulator and government. Um, so yes, we wouldn't like to see anything in terms of scope engaging, but, you know, I would say that the, the powers that secretary of State will be given to bring in new sectors, you know, that's welcome. It's good to have that as a, as a sort of, um, a tool and, um, yeah, kind of final call would really be no, no added complexity.
So as much alignment as possible. Many of these organisations, you know, if you're caught, you may be a telecoms provider that's um, provides a different service. That means that you would be both working to the Telecom Security Act, but also the Cyber Security resilience bill. So yeah, just making sure that there's alignment between between different guidelines.
11:27
11:27
Speaker 14
-
Speaker 14
Last question, if I may. Thank you very much for everything you have said so far. If I may start with Rhodri Davies, because he's got to go. But for everyone, a question is, if there was one recommendation you would like to be put into our report, hopefully taken on by the government, what would that be?Just one.
11:27
Speaker 6
-
Speaker 6
Uh, a sustainable financial footing for the BBC. To be a universal service. I mean, it's I it's pure self-interest. But frankly, it's also it's a critical part of our national resilience. And if we want it to remain at scale, uh, it requires a funding settlement that allows it to continue to thrive and be a full national and local service at every level.
11:28
11:28
Speaker 8
-
Speaker 8
Um, I would say, I mean, slight cheek because there's two halves of this, but on, on the two things that worry us most. So that's, uh, power and the sort of subsea cables we would like a, you know, more defined, more sophisticated sort of statement, I guess, from the government about what is the like sort of reasonable worst case type scenario and therefore a proportionate plan intervention to get us where we need to be to deal with that reasonable worst case.
11:28
11:28
Speaker 7
-
Speaker 7
Well, yeah. Um one quite specific one. Um I think UK we're seeking to understand government's plans for the 1.5% of GDP to spend on security and resilience. The other 3.5% is obviously going to be spent on core defence. We would just love to see some details on that. In terms of funding, kind of new capability to make us more secure and resilient.
11:29
11:29
11:29
11:29
11:29
11:29
11:30
11:30
Speaker 1
-
Speaker 1
And thank you all very much for coming to help us with this important inquiry. Thank you for your time. I should remind you that this is a public session and it's being recorded, broadcast live. A couple of days time, you'll each receive a transcript of the session. And so if you do spot any minor inaccuracies that need correcting, then feel free to do so at that point. And if you see anything or you don't see anything that you wish you had said at the time, feel also feel free to send us supplementary evidence in writing.
Um, we've got a lot of questions to ask all three of you. And then just before you give your first answer, if you could briefly introduce yourself so that we've got that on the record as well. Thank you. So I'm going to start with the first question. Um, which is a broad one, I think, and ask you, what are the constituent parts of the UK's critical national infrastructure and how does resilience vary between them?And perhaps you could also say when you're giving this answer.
What are the missing parts of critical national infrastructure?What should be defined as CNI but currently isn't?And perhaps I could start with Martin Frobisher, please.
Um, we've got a lot of questions to ask all three of you. And then just before you give your first answer, if you could briefly introduce yourself so that we've got that on the record as well. Thank you. So I'm going to start with the first question. Um, which is a broad one, I think, and ask you, what are the constituent parts of the UK's critical national infrastructure and how does resilience vary between them?And perhaps you could also say when you're giving this answer.
What are the missing parts of critical national infrastructure?What should be defined as CNI but currently isn't?And perhaps I could start with Martin Frobisher, please.
11:32
Speaker 16
-
Speaker 16
My name is Martin Frobisher, and I'm the group safety and engineering director for Network Rail. So in terms of what is critical national infrastructure?Well, railway certainly are. And really, as a witness, I can really only speak for railways with any degree of technical knowledge. But of course, the railway interacts with many other systems. We rely upon um, electricity for power. We work closely with agencies such as the Environment Agency on Flood Defences and, and other other matters.
So we interact with a whole load of other organisations. And rail most definitely is critical national infrastructure. It gets people to destinations and it gets goods to to supermarkets.
So we interact with a whole load of other organisations. And rail most definitely is critical national infrastructure. It gets people to destinations and it gets goods to to supermarkets.
11:33
11:33
11:33
Speaker 17
-
Speaker 17
You yes. Thank you. My name is Polly Copeman. I'm a senior vice president in a private threat intelligence company that provides intelligence to CNI across Europe. Um, one thing, if I may, um, it's Armed Forces Week this week, and I would just like to give a bit of an acknowledgement when it comes to resilience to our armed forces. Um, just just take that second to do that. I work very closely with some military colleagues. Um, and I think it's really important that we acknowledge the work that they do.
Um, when it comes to CNI, um, basically we have these 13 areas that have been pre-defined. So we've got the kind of, um, transport and all the supporting systems around that. We've got health, we've got food. So they're all critical services to the UK sitting underneath it. And I think it's worth, we kind of just go through that sitting underneath it. We've got the lead government departments. So if you're working with energy, you've got the lead government department for energy that you're going to interact with, and they're there to kind of help and coordinate, but they understand the bigger, you know, resilience piece within the government and they can support CNI organisations in understanding that.
And there is something that I'd like to just mention. There is a layer, a kind of technical layer, which I'm very interested in, which is um, around advice and technical support from organisations like Gchq, the National Cyber Security Centre and the National Protective Security Authority. So they're also providing frameworks and governments to CNI and CNI at its rawest form. At the bottom is kind of a lot of it is being managed and owned and operated by private organisations. The two points that I'd love to answer is, I think resilience varies between those sectors or between those, and it has something to do with the maturity of those organisations, the experience of those organisations and the relationships between those.
Okay.
Um, when it comes to CNI, um, basically we have these 13 areas that have been pre-defined. So we've got the kind of, um, transport and all the supporting systems around that. We've got health, we've got food. So they're all critical services to the UK sitting underneath it. And I think it's worth, we kind of just go through that sitting underneath it. We've got the lead government departments. So if you're working with energy, you've got the lead government department for energy that you're going to interact with, and they're there to kind of help and coordinate, but they understand the bigger, you know, resilience piece within the government and they can support CNI organisations in understanding that.
And there is something that I'd like to just mention. There is a layer, a kind of technical layer, which I'm very interested in, which is um, around advice and technical support from organisations like Gchq, the National Cyber Security Centre and the National Protective Security Authority. So they're also providing frameworks and governments to CNI and CNI at its rawest form. At the bottom is kind of a lot of it is being managed and owned and operated by private organisations. The two points that I'd love to answer is, I think resilience varies between those sectors or between those, and it has something to do with the maturity of those organisations, the experience of those organisations and the relationships between those.
Okay.
11:35
11:35
Speaker 18
-
Speaker 18
I'm Margaret Reid. Thank you for inviting me to give evidence. I'm the interim infrastructure policy and strategy director for the National Infrastructure and Service Transformation Authority. Um, and that's a unit within Treasury. Um, you've already heard a few of the critical national infrastructure sectors. And I'm sure that you've got a full list. I can give you the full list if you're interested, which is chemicals, civil nuclear communications, which includes data centres, defence emergency services, energy finance, food, government, health, space transport and water and wastewater.
Um, and I can also give you the official definition, but I'm sure you already have that from the Cabinet Office. Um, I think the key thing that I wanted to, to pull out is that Cabinet Office is currently mapping resilience standards across all the CNI sectors, and that work will be complete by the end of the year. So I think your questions as a committee and your inquiry is very timely to feed into that that work that Cabinet Office are doing.
Um, and I can also give you the official definition, but I'm sure you already have that from the Cabinet Office. Um, I think the key thing that I wanted to, to pull out is that Cabinet Office is currently mapping resilience standards across all the CNI sectors, and that work will be complete by the end of the year. So I think your questions as a committee and your inquiry is very timely to feed into that that work that Cabinet Office are doing.
11:36
11:36
Speaker 10
-
Speaker 10
Yes. Well, this is for Margaret Reid. Thank you all for coming. This is very helpful. Um, and it's really just coming. Pointing right down to water, actually, because we were, um, we're lacking a bit of, um, advice on water. And so how resilient is the water. Um, infrastructure?I mean, it's, and I can just say, it seems to me that we have, uh, if we had a big drought, um, we have the water supply in the west coming onto the Welsh mountains, south west, etcetera, but we're very dry in the south east and East Anglia and is there a water grid, a water pipeline grid, for instance.
But, but how resilient is is the water supply infrastructure and and what efforts are being made to accelerate its.
But, but how resilient is is the water supply infrastructure and and what efforts are being made to accelerate its.
11:37
Speaker 18
-
Speaker 18
Um, generally our water supply is very resilient. We've got a very high drinking water quality and we haven't used emergency drought measures. So that's rota cuts and standpipes for 50 years. But the infrastructure was built for a different pattern of population, a different pattern of industry and a different pattern of climate. And those things are changing. So the Environment Agency has estimated that we will have a water supply deficit of 5,000,000,000l a day by 2055. And as you say, some areas are affected in different ways.
So with the south and East, for example, rely very heavily on groundwater, and that requires two winters of rain to refill. Um, but the north west is much more flashy, if you will. Um, and they rely on regular rain to keep their reservoirs full. Um, in terms of the question about the pipe, um, that is being worked through. So one of the things that the water companies have to do is water resource management plans, and they set out how they will meet those deficits that I just mentioned.
And some of those plans include new transfers between water companies. There's also a requirement for new reservoirs, new desalination plants. Um, and some of the transfers are going to use existing infrastructure. So for example, there's an transfer planned, um, from using the Grand Union Canal. So that will take water from the Midlands to affinities water area in, in Hertfordshire. So those kind of things are being developed at the moment. Um and it does need to be accelerated as you said.
Okay.
So with the south and East, for example, rely very heavily on groundwater, and that requires two winters of rain to refill. Um, but the north west is much more flashy, if you will. Um, and they rely on regular rain to keep their reservoirs full. Um, in terms of the question about the pipe, um, that is being worked through. So one of the things that the water companies have to do is water resource management plans, and they set out how they will meet those deficits that I just mentioned.
And some of those plans include new transfers between water companies. There's also a requirement for new reservoirs, new desalination plants. Um, and some of the transfers are going to use existing infrastructure. So for example, there's an transfer planned, um, from using the Grand Union Canal. So that will take water from the Midlands to affinities water area in, in Hertfordshire. So those kind of things are being developed at the moment. Um and it does need to be accelerated as you said.
Okay.
11:39
11:39
11:40
Speaker 18
-
Speaker 18
So. um, I would say that, um, there's been some changes in thinking about water supply and in particular thinking about what water needs to be left in the environment for habitats, etc.. And that has meant that abstraction is being reduced. There's also more understanding of the effects of climate change and how that's going to mean that we've got different weather patterns, and therefore we need to have different water supply as a result of that. So work is ongoing. Um, to develop those options.
Um, and um, some of them, for example, will be going into planning consenting very soon.
Um, and um, some of them, for example, will be going into planning consenting very soon.
11:40
11:41
Speaker 2
-
Speaker 2
Thank you very much. And I've got three questions. So I'm going to roll the first two certainly into one. Um, could you just tell us a little bit about whether you think there's sufficient connectivity between the different types of infrastructure to ensure a coherent, holistic response to a national emergency?And also, do you think there should be a national resilience database through which critical national infrastructure operators and government departments can. Monitor threats?
11:41
11:41
11:41
Speaker 17
-
Speaker 17
Brilliant. Thank you, thank you. Great questions. Um, I, I think that connectivity does exist between these different sectors, but I believe that that is static. So and what I mean by that is, um, when you look at our national risk registers that are out there in the public and they are extremely good, but they tend to be viewed through the risk of through the lens of one risk. So it would be the risk of flooding, the risk of fire, the risk.
And, and I think that really the complexity as we move on to that kind of resilience piece, we're we're being faced with a much more hybrid threat and risk. Um, so, so what I would say is the need for it, um, is, is, is there for sure. And, and when you look at it, it needs to be, uh, near real time. So, so the idea of having a risk register, if I move that on to, you know, the second part of your question, and absolutely, I would support that as a kind of decision making tool.
There are things that currently exist out there and I can point to I'm certainly no expert, but I have done some research on this, so it might be something you would like to follow up on. There is something called a CNI knowledge base that exists for government and government only. And what that looks at is the cascading risks between the CNI sectors. And maybe, you know, my panelists here can kind of say a little bit more about that. And there is something called the TSP, which is the threat intelligence sharing platform from the National Cyber security side of it, from Gchq.
Um, but again, I, I feel that the need for it needs to be real time, as real time as possible so that we can understand it. There needs to be some good information protocols around sharing of that risk and threat, but I would absolutely support it.
And, and I think that really the complexity as we move on to that kind of resilience piece, we're we're being faced with a much more hybrid threat and risk. Um, so, so what I would say is the need for it, um, is, is, is there for sure. And, and when you look at it, it needs to be, uh, near real time. So, so the idea of having a risk register, if I move that on to, you know, the second part of your question, and absolutely, I would support that as a kind of decision making tool.
There are things that currently exist out there and I can point to I'm certainly no expert, but I have done some research on this, so it might be something you would like to follow up on. There is something called a CNI knowledge base that exists for government and government only. And what that looks at is the cascading risks between the CNI sectors. And maybe, you know, my panelists here can kind of say a little bit more about that. And there is something called the TSP, which is the threat intelligence sharing platform from the National Cyber security side of it, from Gchq.
Um, but again, I, I feel that the need for it needs to be real time, as real time as possible so that we can understand it. There needs to be some good information protocols around sharing of that risk and threat, but I would absolutely support it.
11:43
11:43
Speaker 18
-
Speaker 18
Yes. So Polly's already mentioned the CNI knowledge base. And the other thing that I would point to is the work under the adaptation reporting power, which is part of the Climate Change Act 2008. And that requires, um, infrastructure providers to report on how they manage climate risk specifically. And one of the things they have to do as part of that report is to consider the interdependencies with other sectors, and to do some, some planning together. And I've seen this happen in action.
So, for example, United Utilities have been convening all of the different actors in their region to think about the interconnectedness between sectors and to start to do that, that planning as to how they would would handle an issue that might arise from climate change.
So, for example, United Utilities have been convening all of the different actors in their region to think about the interconnectedness between sectors and to start to do that, that planning as to how they would would handle an issue that might arise from climate change.
11:44
11:44
Speaker 16
-
Speaker 16
My answer is specific to rail. Um, and for rail, we do understand the connectivity with other sectors. So we have a strong working relationship with the system operator for the national grid. The Neso organisation. We have a strong relationship with the other um um. Utilities that provide us with essential services. So we understand those relationships and we understand that connection. Um, and we work quite hard to make sure that we manage the interface issues.
So recently there were some testing of the national grid where the voltage was lowered to test resilience. We had a very strong relationship and contact with Neso whilst they did the testing. So I think those relationships work and are strong. In terms of your question about resilience database, my view is that if if that was taken as a project, it would need to be substantial and there would need to be real detail. I think if it's just a very high level summary, it would be of limited value to us.
But you would have to really map out the connectivity in great detail for that information to be of use to us.
So recently there were some testing of the national grid where the voltage was lowered to test resilience. We had a very strong relationship and contact with Neso whilst they did the testing. So I think those relationships work and are strong. In terms of your question about resilience database, my view is that if if that was taken as a project, it would need to be substantial and there would need to be real detail. I think if it's just a very high level summary, it would be of limited value to us.
But you would have to really map out the connectivity in great detail for that information to be of use to us.
11:45
Speaker 2
-
Speaker 2
Thanks very much. And then my final question, which I think is specifically for for Polly. Um, in your, um, original answer to Baroness cousin's initial question, you, you mentioned layers and in your in open horizons written evidence, there was mention of a missing operational middle layer. Yeah. Could you tell us a bit more about what, what that layer is and what's needed to establish it?
11:46
Speaker 17
-
Speaker 17
Yes. Thank you. Um, so the operational middle layer is what I to describe it as well as I can. It's it's for national resilience and it's supposed to take threat intelligence and information and basically pass that on so that we can understand the risk to them, make clever decisions and turn them into actions. So there is a decision making mechanism that's sitting in between this that I think needs addressing across sector. So across all of these sectors. And I think that's really, really important.
And just to reiterate, again, I'm working in a threat intelligence organisation. We are seeing state actor activity. You're seeing all of these things in the news. Our adversaries are moving very, very quickly. And I, my my gut feeling on, on all of this research and the stuff that I have done previously is we are quite slow and quite rigid. And the good news with that is that the middle layer that I'm talking about sits between two very well established infrastructure or infrastructure, but parts that we have in place already.
So the top part, just to shout out to the strategic intelligence piece, so, you know, the National Crime Agency, Gchq, I've spoken about all of our intelligence services. They are world revered, you know, and they, they provide a very good service and advice. So that's that kind of top layer. Underneath that, we have an operational layer of Cobra. We have police, we have emergency services that actually respond, and they tend to, along with the private sector, have well-established emergency preparedness leaders, crisis managers, and they train and test that.
But what I feel is really missing is this kind of cross sector decision making, because as I said, we're in this hybrid kind of cloudy world right now. And if I was to take an example and it needs to be able to review the intelligence as it comes in this kind of live threat picture, it needs to also understand emerging connectivity between these CNI sites. So between these CNI organisations, what's going on?Is there something that's cascading and it needs to be able to turn that into actionable, okay, information that can go out to to these CNI operators.
I also don't think we should be scared to set minimum kind of essential requirements for for CNI recovery time objectives for, for expectations that are very, very clear on what we need the UK to have and have functioning at all times. Uh, live example. Just to give you a live example where this strategic and operational layer exists, the strategic defence review with the Navy that was picking up a much wider remit when it comes to protecting CNI and the underwater infrastructure, strategic intent is absolutely bang on.
That's what we should be doing. We've got a fantastic Royal Navy. We want to protect our infrastructure, but there's this middle layer of I've now got to work with the private sector. CNI how often do I patrol those cables?What do I do if I find something, what is my actions on this kind of decision making model?And what it means is, is something that needs to be explored. So, um, can I just give three points?Pre agreed decision frameworks.
We know about them. We use them all the time. Let's just get those nailed. The kind of if you're in the private sector, the Raci matrixes. So the you know, responsible accountable consulted and informed. Let's do that. Let's get those nailed across sector Intel sell. As I said at the moment, there is intelligence being shared, but it goes energy to energy security, to security. Let's go cross sector. Um, and lastly, a big point.
And we were discussing this outside a little bit and funded exercises, wargaming at the decision making level. Let's not be scared to fail and learn. And I know that's incredibly hard for the government to do, but let's try, let's try.
And just to reiterate, again, I'm working in a threat intelligence organisation. We are seeing state actor activity. You're seeing all of these things in the news. Our adversaries are moving very, very quickly. And I, my my gut feeling on, on all of this research and the stuff that I have done previously is we are quite slow and quite rigid. And the good news with that is that the middle layer that I'm talking about sits between two very well established infrastructure or infrastructure, but parts that we have in place already.
So the top part, just to shout out to the strategic intelligence piece, so, you know, the National Crime Agency, Gchq, I've spoken about all of our intelligence services. They are world revered, you know, and they, they provide a very good service and advice. So that's that kind of top layer. Underneath that, we have an operational layer of Cobra. We have police, we have emergency services that actually respond, and they tend to, along with the private sector, have well-established emergency preparedness leaders, crisis managers, and they train and test that.
But what I feel is really missing is this kind of cross sector decision making, because as I said, we're in this hybrid kind of cloudy world right now. And if I was to take an example and it needs to be able to review the intelligence as it comes in this kind of live threat picture, it needs to also understand emerging connectivity between these CNI sites. So between these CNI organisations, what's going on?Is there something that's cascading and it needs to be able to turn that into actionable, okay, information that can go out to to these CNI operators.
I also don't think we should be scared to set minimum kind of essential requirements for for CNI recovery time objectives for, for expectations that are very, very clear on what we need the UK to have and have functioning at all times. Uh, live example. Just to give you a live example where this strategic and operational layer exists, the strategic defence review with the Navy that was picking up a much wider remit when it comes to protecting CNI and the underwater infrastructure, strategic intent is absolutely bang on.
That's what we should be doing. We've got a fantastic Royal Navy. We want to protect our infrastructure, but there's this middle layer of I've now got to work with the private sector. CNI how often do I patrol those cables?What do I do if I find something, what is my actions on this kind of decision making model?And what it means is, is something that needs to be explored. So, um, can I just give three points?Pre agreed decision frameworks.
We know about them. We use them all the time. Let's just get those nailed. The kind of if you're in the private sector, the Raci matrixes. So the you know, responsible accountable consulted and informed. Let's do that. Let's get those nailed across sector Intel sell. As I said at the moment, there is intelligence being shared, but it goes energy to energy security, to security. Let's go cross sector. Um, and lastly, a big point.
And we were discussing this outside a little bit and funded exercises, wargaming at the decision making level. Let's not be scared to fail and learn. And I know that's incredibly hard for the government to do, but let's try, let's try.
11:50
11:50
11:51
11:51
11:51
11:51
Speaker 12
-
Speaker 12
And your answer covered covered some of my some of my question that they have contractual arrangements. And as my defence Secretary, George Robertson, said, when we were in the Defence Department, you can't fire a contract at the enemy. Requires. Therefore, regular exercising of this to actually find out where actually your information is outdated and also a command structure and whether you have something that in some way replicates gold command or whatever, or whatever, as we have for other emergencies. But finally, could I put to you whether we have something akin to the aviation industry where it's not just when things go wrong, but when you have near-misses as well, which on a no blame basis is reported into the CIA and then enables them then to develop best practice.
And this is an international standard. And and therefore has actually resulted in a very, very safe, uh, civil aviation industry.
And this is an international standard. And and therefore has actually resulted in a very, very safe, uh, civil aviation industry.
11:52
11:52
Speaker 16
-
Speaker 16
So perhaps if I answer that for rail, we have a structure just as you've described. So we have the bronze, silver, gold command structure to deal with any incidents. And then if it's a major incident that really affects the whole industry, we set up a strategic crisis team and we've got very structured processes for managing that. We rehearsed those regularly. And, um, and, and practice all of those roles and where we've got people who are in the bronze, silver, gold role, we do specific training to make sure that they've got the, the skills and capability.
And we work closely with agencies such as the British Transport Police. And they are they're involved in joint exercises where it's relevant. And, um, the security services work closely with us and they brief us on the information that we need to know. Um, that's relevant to rail.
And we work closely with agencies such as the British Transport Police. And they are they're involved in joint exercises where it's relevant. And, um, the security services work closely with us and they brief us on the information that we need to know. Um, that's relevant to rail.
11:53
11:53
Speaker 16
-
Speaker 16
Um, that's, that's very much part of our safety culture. We have the rail accident investigation branch who are an independent investigation agency. Their role is not to allocate blame. Their role is to really understand what's happened. So they provide detailed forensic understanding of incidents. And then we have a culture within the railway where we encourage all our people to report near-misses. We have very formal processes for whistleblower reporting, and we have processes for making sure that whistleblowers are protected.
We have a policy which we call, um, the work safe procedure, which gives anyone the authority to, um, to stop work if they believe it to be unsafe. And we stand by that because, um, because giving people the authority to put safety first is absolutely part of our culture.
We have a policy which we call, um, the work safe procedure, which gives anyone the authority to, um, to stop work if they believe it to be unsafe. And we stand by that because, um, because giving people the authority to put safety first is absolutely part of our culture.
11:54
11:54
Speaker 18
-
Speaker 18
Um, if you want detail on the individual sectors, you will need to talk to the relevant departments, but I can give you an overview of, of some of the other sectors. So in water, in water and energy, um, there are requirements in the licence and also in legislation for companies to recover within a certain amount of time to exercise, to stress test, etc. the water specifically, um, there are going to be measures in the clean water bill which is coming, which will extend the requirements to third parties who are contracted by water companies who operate assets and deliver infrastructure in energy.
There's something called the Electricity system Restoration Standard, and that requires the National Energy System operator to have sufficient capability and arrangements in place to restore 100% of Great Britain's electricity demand within five days. And that also has to be implemented regionally. And they have an interim target of 60% of regional demand to be restored within 24 hours. Telecoms is covered by something called the Telecoms Telecommunications Security Act, and that requires um providers to ensure the security, integrity and availability of their networks. And they're also required to maintain uninterrupted access to emergency services nine, nine, nine and one, one, two.
And also an expectation to do backup power systems. And this comes back to your point about interaction between sectors and the importance of them planning together and thinking about how they can each meet their security supply requirements by working together.
There's something called the Electricity system Restoration Standard, and that requires the National Energy System operator to have sufficient capability and arrangements in place to restore 100% of Great Britain's electricity demand within five days. And that also has to be implemented regionally. And they have an interim target of 60% of regional demand to be restored within 24 hours. Telecoms is covered by something called the Telecoms Telecommunications Security Act, and that requires um providers to ensure the security, integrity and availability of their networks. And they're also required to maintain uninterrupted access to emergency services nine, nine, nine and one, one, two.
And also an expectation to do backup power systems. And this comes back to your point about interaction between sectors and the importance of them planning together and thinking about how they can each meet their security supply requirements by working together.
11:54
11:55
Speaker 17
-
Speaker 17
Just sorry. I know I keep following up, but you really touched on something for me. I think that there is something about the relationships and this kind of safe environment. And I think the private sector do it really, really well when it comes to this, creating this safe environment where you can say, I'm not happy, this is unsafe, this is. And they they do learn from it. Um, I, like I said, I don't have the solution for this.
I'm not sure. I'm not sure anybody does. But I know that it's this ability to fail fast, create that safe environment and work on those relationships will be key to resilience, without doubt.
I'm not sure. I'm not sure anybody does. But I know that it's this ability to fail fast, create that safe environment and work on those relationships will be key to resilience, without doubt.
11:56
11:56
Speaker 11
-
Speaker 11
Thank you for coming on. A very auspicious day, I think with our second hottest day ever. Um, and rails are buckling and you had a fire at your station. Um, so just in view of that, I know you've sort of sort of answered it, but just more broadly, I mean, if there's a major outage lasting several days or, you know, longer, you know, how, what are the practical things that you'll be doing?I think this is particularly for you, Mr. Frobisher, just to keep the rail network going.
11:56
Speaker 16
-
Speaker 16
First of all, um, in terms of several days of outage, as um, my colleague said earlier, the electricity system Restoration standard requires 60% of demand to be in place within 24 hours across the seven regions. So the scenario you're, you're describing goes beyond that. Um, I should say, if there's a localised failure, a regional failure, we have real resilience on the railway because our own overhead line power system has the capability to move power from one place to another. So if there's a localised failure, we have very high resilience.
If the whole grid stopped for several days, clearly that is a really difficult situation for us. Um, if it happened suddenly, then electric trains would stop, um, where they were because there's um because there's no traction power for the network and trains would stop outside of stations. So our first priority will be to manage passengers to make sure that we get people safely to a destination. And our first focus will be on our passengers. Beyond that, we will then look at how we can restore service based on what power is available.
Um, if there's electric trains stranded, clearly we'd have to have a very organized approach to shunting those and opening routes. If there was a UK wide power outage for several days, our primary focus will be on freight to, to get essential goods to supermarkets. And we will have a very focused, structured approach to managing the incidents. We would implement our gold, silver, silver, bronze structure. We would also declare it as a strategic crisis, and we would be very carefully managing the prioritisation of how we deal with the incidents.
We've got lots of backup power supplies for signalling, but some of those power supplies come from our overhead line traction system, because that distributes power across a wide geography, and that does provide resilience in normal situations. So some of our backup power supplies do depend upon transmitting power from one region to another. And therefore we would have to restore power with what was available. We would have a very clear command structure. But what you're describing is an incident that goes way beyond, um, what would would normally be envisaged.
And we have real resilience to the likely incidents of regional failures, because we've got this power to the ability to distribute power ourselves, um, to meet our own needs quite widely.
If the whole grid stopped for several days, clearly that is a really difficult situation for us. Um, if it happened suddenly, then electric trains would stop, um, where they were because there's um because there's no traction power for the network and trains would stop outside of stations. So our first priority will be to manage passengers to make sure that we get people safely to a destination. And our first focus will be on our passengers. Beyond that, we will then look at how we can restore service based on what power is available.
Um, if there's electric trains stranded, clearly we'd have to have a very organized approach to shunting those and opening routes. If there was a UK wide power outage for several days, our primary focus will be on freight to, to get essential goods to supermarkets. And we will have a very focused, structured approach to managing the incidents. We would implement our gold, silver, silver, bronze structure. We would also declare it as a strategic crisis, and we would be very carefully managing the prioritisation of how we deal with the incidents.
We've got lots of backup power supplies for signalling, but some of those power supplies come from our overhead line traction system, because that distributes power across a wide geography, and that does provide resilience in normal situations. So some of our backup power supplies do depend upon transmitting power from one region to another. And therefore we would have to restore power with what was available. We would have a very clear command structure. But what you're describing is an incident that goes way beyond, um, what would would normally be envisaged.
And we have real resilience to the likely incidents of regional failures, because we've got this power to the ability to distribute power ourselves, um, to meet our own needs quite widely.
11:58
11:58
Speaker 13
-
Speaker 13
Um, yeah. I mean, my question was about in terms of the standards that you've, um, applied like this 60% or whatever. Um, and the plans that you, you have in place, particularly for the railways, do they, how do they compare internationally?Um, are we higher or lower in terms of the standards that we set for the restoration of power?Um, and also a quick question about the channel tunnel. Um, because presumably you have to, um, have some agreements with France on keeping that going.
11:59
11:59
11:59
Speaker 2
-
Speaker 2
Just very briefly, you, you mentioned trains stopping outside stations, and you're having to manage passengers off and obviously in the channel tunnel potentially stuck in the Channel tunnel, do, um, do trains have any power on board to get themselves to a, you know, to the sort of next place?And is, is that a feasible resilience to have some kind of limited battery supply. So you're not having to handle a whole lot of people who you're. Retraining into fields and things like that.
12:00
12:00
12:00
Speaker 16
-
Speaker 16
So first of all, how we compare with other nations, we do compare well with other nations and we benchmark quite meticulously. So there's an organization called the International Union of Railways based in Paris, um, that is the, the organization that sets international standards for rail. We take a really close interest in that. Um, I'm European vice chair at the moment for that organization. And we, we use the International Union of Railways to do technical collaboration and understand where we are. So we have benchmarked, um, how we manage overhead line and power systems.
In fact, we're taking a paper on that to the Network Rail Board very shortly. So we take a real close interest in how we compare internationally in terms of the channel tunnel. Clearly, there are agreements for how that operated and the joint agreements with France, and there's emergency plans in place for for operational incidents in the tunnel. As for the question of trains that do do they have power?The answer is some do. Um, so clearly some of the fleet is diesel at this point in time, 60% of of the trains in the UK journeys are made under diesel traction, under electrical power.
Some of the trains are hybrid. They're. They're part electric, part battery, part diesel. So so hybrid trains do exist, but there is a fraction of the fleet, particularly on high speed mainlines, where, where we do rely, um, on purely electric trains. And in south of London, on the third rail network, there's lots of purely electric trains. So, so those trains don't have backup power. And in the event that the traction power is lost, then those trains don't have an alternative backup.
And that's the that's the current position on the, the UK network. I would not advise us going to on the third rail network wanting to put in diesel engines and extra batteries and things that we carry around as extra weight. It's not efficient either in terms of energy or cost. Um, we need to get resilience in our, in our power supplies rather than wanting to fit lots of extra batteries and weight and engines to purely electric trains, that would not make sense.
In fact, we're taking a paper on that to the Network Rail Board very shortly. So we take a real close interest in how we compare internationally in terms of the channel tunnel. Clearly, there are agreements for how that operated and the joint agreements with France, and there's emergency plans in place for for operational incidents in the tunnel. As for the question of trains that do do they have power?The answer is some do. Um, so clearly some of the fleet is diesel at this point in time, 60% of of the trains in the UK journeys are made under diesel traction, under electrical power.
Some of the trains are hybrid. They're. They're part electric, part battery, part diesel. So so hybrid trains do exist, but there is a fraction of the fleet, particularly on high speed mainlines, where, where we do rely, um, on purely electric trains. And in south of London, on the third rail network, there's lots of purely electric trains. So, so those trains don't have backup power. And in the event that the traction power is lost, then those trains don't have an alternative backup.
And that's the that's the current position on the, the UK network. I would not advise us going to on the third rail network wanting to put in diesel engines and extra batteries and things that we carry around as extra weight. It's not efficient either in terms of energy or cost. Um, we need to get resilience in our, in our power supplies rather than wanting to fit lots of extra batteries and weight and engines to purely electric trains, that would not make sense.
12:02
12:02
12:02
Speaker 9
-
Speaker 9
And this is a massive question that faces the United Kingdom sort of all the time. Um but I'm I'm wondering if you could focus, uh, in terms of resilience. And so, um, what have been the barriers to securing long term investment in infrastructure and what's being done to overcome these?And, um, as I say that, that, that is a, that is a challenge that the United Kingdom has wrestled with. Um, but I wondered whether, um, putting the national resilience lens on it, um, whether you are what, what you see the barriers as being now and whether you see that, that, um, the government and others are addressing this particular challenge.
12:03
12:03
12:03
Speaker 16
-
Speaker 16
Okay, so to start with, so our big challenge is that the railway has just celebrated its 200th anniversary. We're very proud of that. But of course that means we've got lots of assets that were built a long time ago. And the resilience of old assets is a challenge to us. Your question, what are we doing about it?We set we have a really detailed set of asset models, so we understand the age of our assets, the impact of ageing assets and what it would cost to invest to to maintain reliability from those assets.
We're funded in five year cycles and we use our asset models to inform the the bid that we make for each five year cycle to make sure that we properly invest in our assets for this next cycle, we're recognising that we've got ever hotter weather, ever greater rainfall, and all the effects of of climate. And we have built the forward looking effect of climate into our asset models. And that's something that we will be discussing, um, with our regulator and with Treasury as we bid for funding for the next control cycle.
So, um, so the answer to your question, how do we do it is by really understanding our assets, modelling the future um impact of climate change and, and wear and tear and making sure that we invest appropriately for the future. To.
We're funded in five year cycles and we use our asset models to inform the the bid that we make for each five year cycle to make sure that we properly invest in our assets for this next cycle, we're recognising that we've got ever hotter weather, ever greater rainfall, and all the effects of of climate. And we have built the forward looking effect of climate into our asset models. And that's something that we will be discussing, um, with our regulator and with Treasury as we bid for funding for the next control cycle.
So, um, so the answer to your question, how do we do it is by really understanding our assets, modelling the future um impact of climate change and, and wear and tear and making sure that we invest appropriately for the future. To.
12:05
Speaker 17
-
Speaker 17
Um, the only thing that I can really speak to here, because obviously I'm not representing CNI in a kind of funding cycle, but I can talk generally about kind of emergency preparedness and investment in security. And what I want to mention. There's an UN written kind of saying, and I don't know whether, whether you will kind of nod your head at this, but funding tends to happen around emergency preparedness and resilience after something has gone wrong. And it's quite sad that that is a known thing within, within our world.
And everyone sort of says, okay, the next incident will come, and then we get some budget and we'll be able to handle it. And I just want to give a shout out actually here to Gartner. I'm sure you've you've heard of Gartner. They are trying to assist emergency preparedness managers and security managers in getting funding at board level. And what they're doing is they're using business speak. So service level agreements that you would use against a customer, they're calling it something protection level agreements where you will be able to explain the level of protection versus the cost.
And I think that was quite a wise thing to do. So so that sadly, that's the only thing that I can add to, to, to funding.
And everyone sort of says, okay, the next incident will come, and then we get some budget and we'll be able to handle it. And I just want to give a shout out actually here to Gartner. I'm sure you've you've heard of Gartner. They are trying to assist emergency preparedness managers and security managers in getting funding at board level. And what they're doing is they're using business speak. So service level agreements that you would use against a customer, they're calling it something protection level agreements where you will be able to explain the level of protection versus the cost.
And I think that was quite a wise thing to do. So so that sadly, that's the only thing that I can add to, to, to funding.
12:06
12:06
Speaker 18
-
Speaker 18
Thank you. Um, there are quite a lot of different barriers, so I'll try to focus on, on the resilience point, but I think something is about investor certainty and confidence that they know, um, that things are going to be stable and therefore that they can invest particularly in skills and those kind of things. The supply chain needs to be ready for the kind of issues that we're seeing. And again, um, they need stability and certainty. And one of the things that NIST has been doing on that front is something called the infrastructure pipeline, and that is setting out a long term picture.
It's really important that it's long term about the projects that are coming up, where there's certainty and confidence so that the supply chain can invest in skills and kit and technology and those kind of things. And then the third thing I would say is it's sometimes quite difficult to make the case for maintenance. It's quite easy. What we're finding to, uh, put off maintenance because you can't see the, the issues don't arise immediately. And so one of the things that we're working with others in Treasury on is, is a value for money review.
And that is identifying the main drivers of poor asset condition. And one of those, as I said, is about how do you make the case for maintenance and make sure that the money goes in. And that's also the case in the private sector as well as the public sector. So it's well known, for example, that maintenance has been lacking in the water sector and government is is changing standards and things on that to make sure that that isn't the case going forward.
It's really important that it's long term about the projects that are coming up, where there's certainty and confidence so that the supply chain can invest in skills and kit and technology and those kind of things. And then the third thing I would say is it's sometimes quite difficult to make the case for maintenance. It's quite easy. What we're finding to, uh, put off maintenance because you can't see the, the issues don't arise immediately. And so one of the things that we're working with others in Treasury on is, is a value for money review.
And that is identifying the main drivers of poor asset condition. And one of those, as I said, is about how do you make the case for maintenance and make sure that the money goes in. And that's also the case in the private sector as well as the public sector. So it's well known, for example, that maintenance has been lacking in the water sector and government is is changing standards and things on that to make sure that that isn't the case going forward.
12:07
12:07
Speaker 4
-
Speaker 4
Hello. Thank you very much. Um, my question is, what does the 2025 Strategic Defence Review mean in practice for the development, security and resilience of the infrastructure that underpins UK defence, including digital, industrial and importantly, space capabilities?Bearing in mind that for pages were devoted to space in the SDR. To yourself first.
12:08
Speaker 16
-
Speaker 16
Okay, that sounds good. So first of all we work closely with the military on what they require from the rail network, whether that's within the UK or whether we're assisting them in planning for moves further abroad. Um, we've got a clear understanding of the capability of the UK network and what can be moved, um on rail in in various ways. So we've got a detailed understanding of the gauging, which is the space, um that the, that the vehicles would occupy if they were moving by train.
We, we work closely with defence logistics on that. So we provide, I believe, the support that is needed from the UK railway to support defence in terms of digital and cyber. Um that's, that's very much an internal activity where we are looking at protection of the UK railway and its systems from the cyber threat. We have a good team internally within Network Rail and for our business systems, we have ISO 27,001, which is the standard for cyber security. We work very closely with the security services and they inform us of threats that are relevant.
And we have, um, cooperation across the railways of Europe on cyber. So if the, if the team in Deutsche Bahn are identifying any issues, they talk with my team and, and vice versa. So we, we've got a lot of work to do to constantly improve our resilience to cyber. It's an ever changing landscape. But we've got a team that works closely on it. We're well supported by government agencies, and we have a good network of contacts with with colleagues throughout Europe.
Thanks.
We, we work closely with defence logistics on that. So we provide, I believe, the support that is needed from the UK railway to support defence in terms of digital and cyber. Um that's, that's very much an internal activity where we are looking at protection of the UK railway and its systems from the cyber threat. We have a good team internally within Network Rail and for our business systems, we have ISO 27,001, which is the standard for cyber security. We work very closely with the security services and they inform us of threats that are relevant.
And we have, um, cooperation across the railways of Europe on cyber. So if the, if the team in Deutsche Bahn are identifying any issues, they talk with my team and, and vice versa. So we, we've got a lot of work to do to constantly improve our resilience to cyber. It's an ever changing landscape. But we've got a team that works closely on it. We're well supported by government agencies, and we have a good network of contacts with with colleagues throughout Europe.
Thanks.
12:09
12:10
Speaker 16
-
Speaker 16
So the bill I'm not an expert. Um, in terms of our cyber, the cyber security risks in rail, I do understand that. And I could give you a detailed answer about all that we're doing to, to protect ourselves. We've got, um, an approach that we've got the certification, which is about the, the patching and the measures that we need to take to prevent an incident happening. But our thinking at the moment is, um, in preparation for when it does happen, because this is a threat that you can't assume that you can, um, you can, um, always prevent it.
So we, um, whilst we're doing, we, we've got good measures on prevention. We're now also stepping up our capability on, um, on response. So we've, we've been working with a couple of concepts. One is digital lifeboats. So that is the concept of having standby systems prepared and built ready to be used in the event that our main systems are compromised. So we've been investing in, in that capability so that our critical systems have offline backups that are properly segregated and ready to go.
And a concept of big red buttons, we've called it, which is that sometimes you need to respond very fast. If the people who've got the capability to lock systems down need to go up the chain of command, that slows down the response. So we've got tools that can respond and lock systems down, and we've pre delegated the authority to people of what they can do in various scenarios. So they're not seeking authority by committee that those authorities are already in place. And the reactions are pre-planned.
So we've done a great deal to respond. I'm not an expert on the bill, but I can talk in terms of our practical measures.
So we, um, whilst we're doing, we, we've got good measures on prevention. We're now also stepping up our capability on, um, on response. So we've, we've been working with a couple of concepts. One is digital lifeboats. So that is the concept of having standby systems prepared and built ready to be used in the event that our main systems are compromised. So we've been investing in, in that capability so that our critical systems have offline backups that are properly segregated and ready to go.
And a concept of big red buttons, we've called it, which is that sometimes you need to respond very fast. If the people who've got the capability to lock systems down need to go up the chain of command, that slows down the response. So we've got tools that can respond and lock systems down, and we've pre delegated the authority to people of what they can do in various scenarios. So they're not seeking authority by committee that those authorities are already in place. And the reactions are pre-planned.
So we've done a great deal to respond. I'm not an expert on the bill, but I can talk in terms of our practical measures.
12:11
12:12
Speaker 17
-
Speaker 17
From from my point of view, the Strategic Defence review, I've already discussed the kind of challenges with that middle layer, um, where, you know, how do we operationalize this?Um, the only comment really that I would like to make is around the whole society approach. That's, that's kind of discussed. And, you know, um, desired from that, uh, the relationship then that means between the public, between the armed forces, between the private sector is fundamental to this, uh, you know, being accepted and funded correctly. And there's two parts to that.
And we cannot expect the public and private sector and even other government organisations to be resilient and to support military or defence capabilities without understanding the threat. So without sounding like a broken record, really, really good threat intelligence is needed and we need mechanisms to share that cross sector. The only other thing, and I just thought of it then, is around this dual use technology. Um, so there's a lot of private sectors out there that have wonderful technology that could support military organisations and certainly our armed forces.
But there are real challenges around the competitive nature of a private organisation. So if it's developed intellectual property that it holds dear and it wants to sell to the rest of the private sector and make money, it's quite difficult for it to then go into military contracts, even though they can be quite lucrative. So I think I think there's some delay in being able to utilise that technology for some of those reasons. And I can only speak for what I've been seeing kind of subsea in Norway, um with development around pipeline infrastructure.
And so.
And we cannot expect the public and private sector and even other government organisations to be resilient and to support military or defence capabilities without understanding the threat. So without sounding like a broken record, really, really good threat intelligence is needed and we need mechanisms to share that cross sector. The only other thing, and I just thought of it then, is around this dual use technology. Um, so there's a lot of private sectors out there that have wonderful technology that could support military organisations and certainly our armed forces.
But there are real challenges around the competitive nature of a private organisation. So if it's developed intellectual property that it holds dear and it wants to sell to the rest of the private sector and make money, it's quite difficult for it to then go into military contracts, even though they can be quite lucrative. So I think I think there's some delay in being able to utilise that technology for some of those reasons. And I can only speak for what I've been seeing kind of subsea in Norway, um with development around pipeline infrastructure.
And so.
12:13
12:13
12:13
Speaker 5
-
Speaker 5
My question is really about stress testing beyond exercises where you were testing one sector at a time, do you think firstly, do you think we we stress test when there's multiple threats and multiple things have gone wrong sufficiently. And secondly, you touched on it a little bit earlier, but just dive into the regional structure. Are you convinced that the regional structures, particularly in England, are strong enough if there is a multiple threat problem?Thank you.
12:14
Speaker 16
-
Speaker 16
Um. So in terms of rail, the response. So our exercises always involve escalation. So something happens then something else happens. Then you know another thing happens. That's been the basis of many of our exercises to prepare for a scenario where we're dealing with difficult problems and multiple problems. So that has been the basis on which we plan our exercises. It starts with something simple and routine. And then we we've generally looked at more complex scenarios as the exercise has developed.
Um, in terms of, of, for us, the regional structure, um, that fits very well with our gold, silver, bronze command structure, the local region has a regional leadership team which manages it to gold level. And then we put a national strategic crisis team above it, which looks beyond the rail region, and make sure that we have an overall coordinated national response. So, um, so we have a very structured response to incidents. We do rehearse those and we do practice.
Um, in terms of, of, for us, the regional structure, um, that fits very well with our gold, silver, bronze command structure, the local region has a regional leadership team which manages it to gold level. And then we put a national strategic crisis team above it, which looks beyond the rail region, and make sure that we have an overall coordinated national response. So, um, so we have a very structured response to incidents. We do rehearse those and we do practice.
12:15
Speaker 17
-
Speaker 17
You my, my comment, I think this is absolutely spot on. And one of the key issues, so I spoke about this hybrid kind of situation that we might be in as, as a, an incident occurs and either an instant impact or a rising tide incident occurs. And I think that when we role play scenarios, and I can say this because I'm not in your position here, guys, but, but, but, um, we always do that to kind of win. And the reality is so we might run a tabletop with the top team, you know, and we drip feed in scenarios and they come out, you know, the heroes, all we solve this or we didn't.
I think there needs to be, um, war gaming. And, um, I call it wargaming. It sounds a bit sounds a bit aggressive, but, but, but, but kind of these scenarios that we can fail and learn from within a safe environment and we stress test the decision making. And, and I absolutely agree with you, Lord peach. We need to do that in real time. So what if it happened today, at this time, right now, you know, and we need to build proper planning assumptions around that.
I mean, I was very privileged. I worked in the Olympics briefly where we were building, um, planning assumptions. And you need to, you need to make it as real as possible when you do these things. So if we needed police officers right now, how many are there around the building?How many could respond?How capable are they?And you build in the mechanisms to understand that, as it is today. Um, so I think that's a fantastic question.
And I think we need to do more of that.
I think there needs to be, um, war gaming. And, um, I call it wargaming. It sounds a bit sounds a bit aggressive, but, but, but, but kind of these scenarios that we can fail and learn from within a safe environment and we stress test the decision making. And, and I absolutely agree with you, Lord peach. We need to do that in real time. So what if it happened today, at this time, right now, you know, and we need to build proper planning assumptions around that.
I mean, I was very privileged. I worked in the Olympics briefly where we were building, um, planning assumptions. And you need to, you need to make it as real as possible when you do these things. So if we needed police officers right now, how many are there around the building?How many could respond?How capable are they?And you build in the mechanisms to understand that, as it is today. Um, so I think that's a fantastic question.
And I think we need to do more of that.
12:17
Speaker 18
-
Speaker 18
Cabinet office lead on the national exercise program. So you might want to take some evidence from them on that. The other thing I would say is that I think the resilience standards work is really important in this space, because it's thinking about across the whole system, rather than just on a sector by sector basis. And those standards, once they've been mapped by the Cabinet Office by the end of the year, will then be tested, um, and thought about in terms of the interdependencies, but also tested in terms of affordability, so that we can make sure that the standards are deliverable, um, for an emergency, but also for everyday life as well.
12:17
Speaker 1
-
Speaker 1
Thank you. Um, while we're on defense and before we move on to the final question, could I just ask another one particularly of Martin and Margaret?How aware are your sectors of critical national infrastructure aware?How aware are you of the seven baseline commitments of NATO?Um, that the UK has signed up to as the seven baseline resilience requirements, some of which um, involve. Transport roads as well as railway, I assume. And how if if you're aware of them, how complied.
Is your sector with them and are you aware of any monitoring of compliance within your area of CNI.
Is your sector with them and are you aware of any monitoring of compliance within your area of CNI.
12:18
Speaker 16
-
Speaker 16
The answer is yes. Um so we do um, I have a personal role as a reservist. I, I, I am the, the Army's link to the rail industry through what's called the Army Staff Corps. And I'm very closely involved in, um, in some of that planning. So, um, next week I'm at an exercise which is being led by home command. Um, and we've been invited as the rail representatives. So, um, so we have a, a close working relationship.
We understand the issues, we understand the detail.
We understand the issues, we understand the detail.
12:19
12:19
12:19
12:19
Speaker 18
-
Speaker 18
So, um, I should just clarify that the role of NIST is not to oversee the resilience of those sectors. So I'm not personally involved in any of those issues that you're raising. And I think you would need to take them up with the relevant government department. That is the lead for the relevant sector, right?
12:20
12:20
12:20
12:20
12:21
Speaker 16
-
Speaker 16
Me, it's about managing ageing assets. It's about investing in critical infrastructure. We will make the case for for the rail assets as part of our next funding review. And we will make that very numerically and very logically. But there's a trap. And if you look at what's happened in Germany, where Deutsche Bahn has underinvested for many years, it has led to resilience problems. So we understand our assets. We're making the case for investment.
We will do that very logically and very rationally, and we just appeal to government to go through that in a in a, in the right way and make the right investment in infrastructure.
We will do that very logically and very rationally, and we just appeal to government to go through that in a in a, in the right way and make the right investment in infrastructure.
12:22
12:22
12:22
Speaker 17
-
Speaker 17
Thank you. I, I believe it's about having a clear mandate and funding of this middle layer, and that needs to go cross sector. And I keep kind of doing this, but it needs to cut across all sectors to understand that risk picture between the public, between the private and it's not a strategy document. It is an operating model who is making the decisions when and where and can we operate between this cross sector space?I think it needs to assign clear ownership and not be scared to set minimum standards across the board.
So I think there are some in some of the legislation that we've discussed and recovery time objectives and but be clear that this is UK infrastructure, UK resilience, and this is our expectation. And I think that it should encompass these exercises. Going to Lord Peach's comment, um with data modelling, regular system wide stress tests. And I feel that we are prepared in certain pockets and there is some amazing work going on, but it's the consistency and accountability for a department or individual, um, to look at that kind of messy space in between.
So thank you, thank you.
So I think there are some in some of the legislation that we've discussed and recovery time objectives and but be clear that this is UK infrastructure, UK resilience, and this is our expectation. And I think that it should encompass these exercises. Going to Lord Peach's comment, um with data modelling, regular system wide stress tests. And I feel that we are prepared in certain pockets and there is some amazing work going on, but it's the consistency and accountability for a department or individual, um, to look at that kind of messy space in between.
So thank you, thank you.
12:23