National Resilience Committee

Thursday 9th July 2026

(began 2 months, 3 weeks ago)

Share Debate
Watch Live
Skip to latest contribution
This debate has concluded
10:30
10:31
None Portrait Speaker 2
-

Thank you. Thank you so much. And thank you to the committee for having us today. My name is and I'm director for Resilience and Recovery at Ministry of Housing, Communities and Local Government. Um, so the UK Resilience Action Plan, uh, sees the Local Resilience Forum in England as a critical part of the resilience system, bringing together local partners and expertise in planning for responding and recovering from emergencies. It also underlines the importance of partnership working both with the local resilience tier in England, as well as devolved governments in Scotland, Wales and Northern Ireland.

MH CLG. Uh, so my team provide a provide a sort of central role in linking the national and local together across the resilience cycle. And what this means is, especially in terms of planning and preparedness, is that each local resilience forum in England will have a dedicated resilience adviser who will work with them on planning and preparedness. So, for example, making sure, uh, that there is development of local risk assessments aligned with the NSR risks, they will work with lead government departments and bringing together local resilience forums and lead government departments to prepare for certain risks.

So for example, we've got local national energy risk planning group, um, as well as making sure that local partners are part of exercising. So as a recent example, uh, exercise Pegasus, which was an exercise to prepare for pandemic preparedness, involved all 38 local resilience forums and was a very useful exercise in strengthening local and national joins. We will do the same in response and recovery. So members of my team. Um are act as government liaison officers during a response, making sure that there are joints between the local and national identifying, for example, where you might need sharing of mutual aid across local resilience forums or indeed where chairs of strategic coordinating groups, which are the local response structures set up um, need to attend Cobra again to sort of strengthen the national and local join.

I think the Resilience Action plan acknowledges where things need to be strengthened to strengthen that function. And there are a number of actions we are taking forward on that, including a new LRF partnership assurance framework and peer review model, which adds to the work that we currently do to assess local capabilities. Again, from a planning perspective, and I can go into more detail on that, as well as improving data sharing. Um, and, uh, the commitment we have to clarify the role of strategic authorities and mayors as well.

So there are a number of actions in that and we'll continue to deliver those as well.
10:34
10:34
10:35
10:36
None Portrait Speaker 2
-

Shall I start off with that, John. So, um, the commitment to the National Strategic Forum will add to the number of sort of forums we already have that bring together different partners at different levels. So for example, we've got quarterly meetings with all of the local resilience Forum chairs in England. We bring together a wider set of local resilience partners, uh, twice a year, which include voluntary and community sector and businesses, uh, etc.. And then we have, uh, various other forums at different levels that do the same.

The intention of the National Strategic Forum is to make sure that we have a forum where we are sharing situational awareness and strengthening that information flow between, um, between all of the partners that are, that are there and the resilience space. I think the resilience action plan clearly recognises that, uh, that our response across the UK is a whole of society response and we need to make sure that we are enabling all our wider partners to be able to contribute and support the delivery of resilience forum. And that would be the sort of intention of the strategic forum itself.

Um, and I think from one of the sort of main aims, from my perspective, would be to make sure that it recognises the flexibility that we need to be able to respond to emergencies of various different scales and clearly recognises the principle of subsidiarity, which means that most of the local response, the response to emergencies, will be led at a local level, where they have the most expertise as well.
10:38
10:38
10:39
None Portrait Speaker 1
-

Good.
10:39
10:39
10:39
10:39
None Portrait Speaker 1
-

No. We heard you.
10:39
10:39
10:40
None Portrait Speaker 4
-

Terms of.
10:40
10:41
None Portrait Speaker 2
-

Shall I come in on the data sharing?So, um, certainly in my engagement with local resilience forums, I understand the challenges that they have in dispersing their responsibility to have data identify and hold data on vulnerable people, as well as, uh, maintaining, um, updated lists on, um, voluntary community members who can be deployed in emergencies because of, um, you know, the, the, the compatibility between different systems and need for data sharing protocols, uh, cabinet office last year published guidance for local resilience forums to be able to identify and support vulnerable people, uh, including, um, data sharing protocols and the information commissioner's guidance has been really helpful in this regard, which makes it clear that data sharing in emergencies, where there is serious risk to life is, is completely, uh, fine, um, centrally where we have information on vulnerabilities, uh, we will share with local partners.

So recent examples include any information that we hold on people that were coming back to the UK as a result, as part of the response to hantavirus or being repatriated as a result of the Middle East conflict, um, funding in the past has also been used by local partners to develop tools, um, which are really great to see. So Cumbria Lif in particular has developed a tool using property data to identify vulnerable individuals. Uh, southwest LFS again have done something. Similar where they have used um, mapping software again to be able to sort of identify vulnerable cohorts as well as deploy resources to them.

What we are very interested in is making sure how we can use those lessons to be able to strengthen the local resilience to, as a whole. Um, and I've got some dedicated team members in my team who are thinking about how we best do that. Working closely with Cabinet Office on the tools that they have so that we can make sure that we're plugging in that information nationally and locally.
10:43
10:43
10:44
10:45
10:45
10:46
10:46
None Portrait Speaker 2
-

With LFS. Also getting partner contributions as well as in-kind contributions as well. So that makes up the totality of local resilience forums. Now on the kind of boundary question. So the the strengths of local resilience forums as I see them is the fact that they are that bring together local partnerships with local expertise to be able to respond to emergencies that reflect, uh, challenges and risks as they apply to, to, to areas. As an example, uh, southwest LFS will cover predominantly rural areas with high levels of visitor economy.

And we'll be thinking about impacts of severe weather and coastal flooding funding a north east LFS would be thinking about the critical national infrastructure that they hold in their patch. So LRF model allows that flexibility. And as John had said earlier, those local insights sort of shape responses. Um, they are also, um, LFS able. And our current model, one of the strengths is that it is able to flex to respond to the scale of the emergency. So for example, the recent outbreak of men be involved.

Kent lrf only um, the heat related emergency that we had last um last month, although you could say we are back again, although um not quite emergency level yet. And technically in technical terms, um, we were able to convene, uh, affected LFS in a response coordinating group. So again, creating a, bringing together different configuration of LFS and in some cases like, um, the response to the Middle East, we brought together all LFS to share situation awareness. So the current model sort of helps to flex, um, and scale up in the UK resilience action plan, we've already committed to clarifying the role of strategic authorities and mayors and are engaging with both strategic authorities, uh, taking learning from the model that is there in Scotland, taking models from learning from models that exist in other countries like the US and Finland, to make sure that we are strengthening that and clarifying that, which also then supports the, the, the regional lens as well.

We are, uh, obviously mainstreaming resilience considerations into, uh, into reviews, including the review of police boundaries. Keeping in mind, of course, that we also have, uh, changes to local government as a result of local government reorganisation. There have been changes to integrated care boards boundaries as well, as well as the fact that at the moment, the geography is no less, um, creative. Uh, I think so. As an example, Cumbria is one LRF where there is broad degree of alignment between council, police and um fire geographies.

Uh, in contrast, Thames Valley, I believe encompasses one police, three FRS and 14 local authorities. So already we're talking about kind of a very different geography, um, geographical pattern as far as arrests are concerned. Um, you asked about whether we, we engage, we include, uh, private sector in exercising. So local resilience forums will include, uh, yes. Include private sector in some of the training and exercising. There's some good examples in, in London. Um, and elsewhere.

Dorset does the same in some of the responses to their, to their risks. Uh, there is more that we could do to make sure that we are, there is more consistency in that approach. Um, and that is something that we work with lead government departments on as well as, and making, making sure that when we are engaged with local areas, that is something that is there, I think on. The level of preparedness we have different. Processes to assure ourselves of that, uh, which include, uh, to every twice a year, we do seasonal preparedness, which are basically LRF self-assess themselves against their level of preparedness.

That is combined with, we work with cabinet office on local capability assessments, which try and look at the level of preparedness that is held at local level, aligned with nsra risks and national capabilities. And as I said, we are we will be rolling out this year a local partnership assurance framework with a peer review protocol, which is designed so that we are bringing in challenge into the system and really building on the expertise the sector holds itself, to be able to assess that.
10:50
10:51
10:51
10:52
10:52
None Portrait Speaker 3
-

Should be open at the start is that we don't actively go and recruit those organisations, and the reason we don't is that they're quite fragmented and diverse group, so there's no overarching kind of network to pull them together. The other reality is actually it's that local level engagement that's probably quite crucial in there. So the local planners will know where their cultural infrastructure is much better than I would and how to make use of that. And we will come in and intervene if there is a problem or a challenge within that.

And we are working across those sectors to in the implementation of legislation like Martyn's Law, to make sure that they are fully engaged and aware of what the responsibility is. But I think we don't have a direct kind of role in saying recruiting in and through, obviously, the evacuation and shelter bit is a policy area owned by the Cabinet Office as well, and I know they are engaging across the VCs and others looking at some of this area. Um, and again, that that process is something that we should be kind of focusing on that local tier to be able to understand and be able to connect all of the different local areas and spaces that can provide support.

We did see a lot of these institutions stepping forward during Covid and offering up being vaccination centres. We see an amazing range of activities that libraries provide in terms of response, both in getting key worker status during the pandemic, but also looking at how they can support people to get an NHS app and a much wider group of other responsibilities, as well as that culture integration and being a first port of call for a lot of people coming into the country. So we are keen to ensure that we can support that.

But we don't have an overarching programme to recruit those individuals. Organisations.
10:54
None Portrait Speaker 1
-

Yes, please.
10:54
10:54
10:54
10:55
None Portrait Speaker 7
-

Thank you.
10:55
None Portrait Speaker 1
-

Okay, Lord peach.
10:55
10:56
None Portrait Speaker 2
-

I start off that question. So I think it's, um, what John was talking about at the start. And as the UK Resilience Action Plan sort of underlines that we are the system that we have in the UK very much is around whole of society resilience approach and making sure that we are enabling and empowering all partners to participate in and work collaboratively to deliver the plan for, respond to and recover from emergencies. Um, as I said before, one of the strengths of the local resilience tier in England is the fact that what we can flex to the scale of various different emergencies, whether they are very, very localised or whether we need different configurations of local authorities to come together to respond, or indeed, national emergencies.

And the the forums that we have in and we do this across the resilience cycle. So we have various different forums, as mentioned before, where we will use and share situational awareness with, with local partners. And by that I mean local partners in the wider sense. We will have the mechanisms in place to make sure that we're engaging with each LRF to identify where, uh, there needs to be escalation to a lead government department like DHS, which is working on leads on pandemic preparedness, making sure that we are joining the local, national, and any training and exercising, and indeed, whether there are things that need to be done at the Cabinet Office level.

Scotland has a model which is, uh, which has formally has, uh, regional structures, but builds on the local into the, into the regional and then national, uh, the, the work we are doing, which is committed to in the resilience action plan is to think about the role of strategic authorities and mayors in providing it, whether how we strengthen and clarify that, and whether that provides an additional regional lens to our to our current structures. But indeed, it is the sort of flexibility and the range of and the need to make sure that we can respond to the range of impacts that are, uh, that can happen and risks that can materialise.

And the strength of the system is its ability to respond to all of those.
10:58
10:59
11:00
11:01
11:01
11:01
11:01
11:02
11:02
11:03
11:04
None Portrait Speaker 1
-

Thank you. Lord oats.
11:04
11:04
11:04
None Portrait Speaker 2
-

Hope you can hear me. So, um. The, uh. The. I keep going back to the strengths of local resilience forums, but one of their strengths is, of course, the ability to bring together various different partnerships at a local level in response structures. And they are, by their very nature, multi-agency partnerships, um, that. In the context of, uh, the fact that each of those partners will be, uh, will be delivering a wider set of responsibilities and where there will be a reform targeted to them means that actually, it is very important that we are consistently thinking about the impact on resilience as a whole of those changes in terms of local government reorganisation.

Uh, we, uh, my teams are making sure that we have guidance in place so that we can make sure that, uh. Local unitary authorities are very clear of their responsibilities on resilience under the Civil Contingencies Act. We also, following Grenfell inquiry recommendation, uh, working with the local government organisations and the UK Resilience Academy to make sure that we have training in place for local authorities and local authority chiefs and wider local authority. Officials on resilience to make sure that we are underlining the importance of that.

Uh, again, as I said, also on the, on the changes where, uh, which relate to police boundaries or, uh, we are already thinking about the role of strategic authorities and engaging with them and engaging with various other partners to make sure that we are, um, we are clarifying and strengthening those. And that is a commitment in the UK Resilience Action plan.
11:06
None Portrait Speaker 1
-

Anything to add?Mr..
11:06
11:06
11:07
11:07
None Portrait Speaker 6
-

Thank you.
11:07
None Portrait Speaker 7
-

Can I just.
11:07
11:07
11:07
11:08
11:08
11:08
11:08
11:08
11:08
None Portrait Speaker 5
-

Thank you. Thank you.
11:09
11:09
11:09
11:09
11:09
11:10
None Portrait Speaker 3
-

How's it going?Uh, so again, we have obviously the local media action plan was published in March, and that is aimed at trying to ensure a healthy and local, uh, plural local media for the benefit of the communities across the UK. Quarter that is trying to get that level of trust locally so that people do actually trust that local journalism side and that it does directly report, as you said, on some of the institutions that it needs to both critique and ensure that it's, uh, getting accurate information out and being trusted locally.

Um, we are kind of trying to help local newsrooms across the country innovate and adapt their business. So again, a lot of that plan is focused on how do you keep up with digitisation. That's why this week we have actually launched now the 12 million over two years fund, uh, for the local news. Uh, it's called the local news fund. Uh, and again, we're uplifting community radio as well by about £1 million per annum. So many pounds over the next three years to do that.

Um, what we're trying to do with that is focus on that digital innovation, uh, rather than we are not there to prop up local news, but we are there to give them as much support as we can to get themselves into a position where they can impact and affect people. Um, we are. Trying to, to also, one of those things that we're trying to do is make sure that we're making the best of the advertising money that government does spend. And again, we spend about 4 million a year at the moment across government on with local media.

Uh, and again, how we continue to reinforce that and make sure we are leaning into that around that there is a bit of work that we're also doing with the West of England Combined Authority to try and facilitate that better engagement between local public services and local media, so that there's more of a joint effort. And again, that's a testing point at the moment. We will see how that goes and then try and roll it out more broadly as well, just so that you build those connections, that understanding of it.

Again, that is part of understanding that the, um, the relationship between those groups is really critical and shouldn't be competitive in the way that it can be. But at least that engagement is really, really key. We are trying to do a bit more about that kind of journalism as careers across. We've got a pilot in the North West at the moment. Again, how do you inspire people to want to go into local journalism and see the benefit of it?Uh, in terms of how that can, can be used in, through, particularly around also how we support schools to navigate their way through online, uh, kind of interaction again, trying to make more emphasis around the kind of free publications that go out to all of the primary and secondary schools, how people access that.

There are 150 local, uh, public. And national publications that schools can get access to. So making sure that that is woven in a bit more and a bit more prominently.
11:13
11:13
11:13
11:14
11:15
11:15
11:16
11:16
11:16
11:18
None Portrait Speaker 3
-

So the quick answer is yes, we do. And I genuinely, over the last few years have looked at how we can expand that. It might not be specifically on saying how you prepare for resilience, but it is an understanding of what that climate might look like, particularly aimed at young people. So if we look at the VE day celebrations where we had a fantastic level of activity, so 1 in 4 Brits did actually engage in actively in some form of a activity related to VE day in particular.

And what we've focused on really heavily is how do you get that youth engagement in particular?And a lot of our arms length bodies. So I will give a shout out to the Imperial War Museum, the National Theatre, the ability to creatively think about how so you know, James Graham raises a little play that imagines the day after the end of conflict that has been touring around schools for the last kind of six. Well, last year it toured around until early this year. Um, just to say to how do you get children to engage and interact on it?Uh, you know, letters to loved ones.

How do you use that reality of what war is like and how people can imagine themselves in and just a huge amount. So we had 285,000 schoolchildren across the UK, responded to the V mail campaign about sending a letter and getting a letter back from the veteran. We are obviously at a period where there are fewer and fewer veterans available, and VAT might be the last one. Whether it's a big celebration for it, but how you get that living memorial, and I know a lot of what say, for example, the Imperial War Museum, I think in the next few weeks are kind of hosting something about how you you impart that knowledge to young people and an open forum around it.

And they've been brilliant collaborators with us in trying to be creative in how we approach it. Same with historic royal palaces. A lot of our bodies can get that reach out and can do it in a creative way that that gets people interested in a way that I think candidly, if you're just saying you must have this many hours worth of stuff, it doesn't quite capture the imagination in the right way, but also to be able to tell some of those stories in quite a creative way.

So again, we had a production company that supported us just to do a small app in terms of showing the 3D photos and what that felt like and how that looked in colour and kind of just different ways of engaging with young people. And we're really happy that they're kind of our youth engagement for V was really high. Uh, again, those ages 25 to 34, we said 40% of that group said they were actively involved to some point or another. In terms of the VE day celebration.

So that reach in and the schools, materials that we can do and the work across departments to get there, a lot of what the events can give you is a single moment that people do remember. Uh, and I think certainly how that kind of comes across over time, you can see that resilience and that understanding of what it means to be at war. Uh, I'd also probably give a bit of a shout out to some of the intergenerational charities, intergenerational England really good at trying to connect that through as our library is increasingly looking at intergenerational as some great examples of where Alzheimer groups are engaging with kind of mother and baby kind of groups, just to get that connection across.

And that is a part of wider resilience. It's just a very specific set of community angles to it.
11:20
None Portrait Speaker 1
-

Thank a last word.
11:20
11:20
11:23
11:23
11:25
None Portrait Speaker 13
-

Mr. chairman, good morning everybody. Um, just to say, I suppose I'm I'm a former security minister, which may may be relevant, though it was not resilience was not part of my portfolio at the time. Um, but I did have in fact, I am really the author of the National Security Council, um, which was partly. Uh, one of the reasons that I thought I dreamed up, in effect, the, that structure was partly because of the shortcomings of the lead, the lead department, uh, in, in, in decision making.

Um. To go to your, to go to your question, um, a lot, I think depends on what you actually mean by a whole of nation approach or whole of society approach. And it's not clear to me that we in the UK have a definition of that, that we agree on. Um, I mean some of us I think, take it to mean um critical CNI properly protected. Um, you know, sinews of government functioning, but don't take it as far as involvement of the population in a.

In an active way or the imposition of new burdens on the population, such as some kind of national service, which could also be voluntary. So I think we have a definitional problem to begin with. What do we as a country think we're talking about?Um, I hope the committee will decide to give a definition to that of their own. My my own view is that we certainly need to go further than simply the CNI and various other obvious, um, weaknesses in the system and vulnerabilities that we need to deal with.

Um, and we certainly do need to consider, uh, what role the general public as well as. Hitherto we've had the, the local resilience. Forums, which is about, I think the furthest extent that we at the moment have by way of definition of what the general public or what society more broadly might contribute. And, and most of our work. Um, and I don't think people have been idle, but most of our work is very much on the functioning of government, which has a long history.

Because if you look at the way in which we dealt with the war, um, we certainly did have measures to look after the population. But but I was involved in dismantling a lot of the wartime measures when the day of, of, uh. Um, being able to liberate us from it. And with German unification. And what I discovered was that most of the measures were, were to do with the functioning of government, the protection of the head of state, the protection of ministers.

But how the the system and the wheels of government and its immediate surroundings would be able to work in a time of prolonged crisis. There wasn't a lot about the. The general public and indeed um. You know, we had an evacuation early on, but very much, you know, society other than rationing. No. Continued uh, as. Early as it could. Now you want that in a society, but what we have never gone down the road of is the sort of Finland.

Uh, experiment. Or an experiment. I mean, it's permanent policy and it is very extensive. I understand the committee is going to see that. Um, and it is a very different model. And I think that, um, my own conclusion was we wouldn't go as far as that, but there's a lot that we can learn. And I certainly do think that we are getting to a, getting into an international situation in which we will have to ask the general population to be actively involved.

And I am in favour of some kind of of national service. I think it should be voluntary, but I think it should involve both sexes.
11:29
11:30
11:30
11:30
None Portrait Speaker 6
-

You wanted to be brief, so. Yes, but there are there are, I think, three reasons. The first one and the most straightforward. On sitting in Parliament is that it is departments of state that have statutory powers and oversee arm's length bodies. Um, and unless you're going to wholesale pick up those statutory powers and stick them in the hands of someone else, you've got to work through government departments. Secondly, there is a great risk in dealing with crisis resilience questions and questions about national security that we concentrate everything in one place when in order to respond to the range of events we need to deal with, we need a distributed response across different sectors, geographies and sectors of government, sectors of industry.

Parts of society, geographies. And so by by saying, no, no, we won't have lead government departments which is distributed. We'll rather bring it into a single place. You run the risk of having a country which is able to do one thing at once. And as we'd observe at any one time, if you're Prime Minister, you're dealing with multiple things and you should be able to chew gum and walk at the same time and not just get fired up about whether or not you can use different powers to do something at the edge of the system, which is in response to a resilience event.

So it's about having an articulated system that can do multiple things. And then the third one is, and I think this is something government departments find it very difficult to deal with. And I'm happy to unpack which departments I think, find it most difficult. At the moment, we have a system and um. Where in extremis we transfer tasks to the military from the civilian authority. You know, the Home Secretary does so in extremis and on occasion, military support will be asked for, um, for a civilian event, think pumps, pumping water off the Somerset levels or something.

Olympic games jolly good. Um, the foot and mouth we go. On critically, I think the system finds it difficult to understand that in real warfare or extreme hybrid warfare, fighting, we will have to support the civilian authorities. We'll have to support the military, and we'll have to. I think it's Macca if it's forgotten. Or did I forget?But it's Macca. We're going to have to reverse it. And that's what happened in the Second World War.

Everything was subjugated in the in the in the in the United Kingdom to enabling war, fighting. And if we're going to fight a war, we're going to need to do that. And that's going to need a distributed and articulated response, not a centralised one. So lead government departments are going to matter.
11:33
None Portrait Speaker 1
-

Thank you, Mr. Pitts.
11:33
None Portrait Speaker 14
-

Good morning. Thank you for inviting me to give evidence. Um, I'm Ed Dominguez, I was chief of staff in the Cabinet Office, where I helped to write and implement the National Resilience Framework, the biosecurity strategy, and parts of the cybersecurity strategy. I'm currently director of policy at ServiceNow, where I should declare that we provide risk governance systems to government and the wider public sector, as well as AI governance systems as well. And I'm a senior fellow at Policy Exchange, working on the risks of AI to government and society.

The answer to your question, I think, is I agree. Yes, it can be made to work and it has to be made to work. Uh, I don't think we're in a situation either fiscally or in terms of state capacity, where we can either stand up a US style FEMA system or, or undergo major shifts. And I think the 2022 resilience framework was a sensible articulation of how, with proper governance, coordination and oversight above the lead government department model and, uh, the whole of society approach below it.

Um, actually, it can be coherent. Uh, the few caveats I would add, I would just add are, firstly, we can't leave departments to mark their own homework. Um, the Cabinet Office needs to have a role in coordinating and testing departments assumptions, lending their expertise. Um, and, uh, and doing that regularly and, uh, not just. AD hoc. We need more exercising to do that as well. Um, the second thing I would add is that the lead government department model is not the only government department model.

Um, and, and sometimes there is an abrogation that where a risk is owned by a lead government department, other departments therefore don't need to worry about the cascading impacts of that risk. Um, and there needs to be a proper understanding of those cascading impacts and the responsibilities that a subsequent department would have in those events. And relatedly, finally, um, I do think that when catastrophic risks emerge, such as the pandemic, we should accept and, uh, prepare for the Cabinet Office similar to what he was saying, um, will take a role in leading the coordinated UK response.

Um, so that we don't have a situation as we did where suddenly a department feels that they're having to run a national response to a catastrophic crisis.
11:35
11:35
11:37
11:37
None Portrait Speaker 13
-

When I was in the Cabinet Office, um, in the days before the National Security Council, what I discovered was that um you'd. Get agreement in the Cabinet Office between various departments in involved in um. Some, some subject where they all had an interest. Come the day when actual decision was taken, the minister of the cabinet, minister of the lead department would decide, well, he wasn't going to do that at all. And he was going to do something quite different and quite something, something quite different usually turned out to be something which omitted to take account of the interests of the other departments.

And this was a fairly frequent event, and it meant that very often the Prime Minister was put in an embarrassing position of being briefed on one line of country and discovering actually that the terrain looked quite different. Um, so that was an unsatisfactory way of running, running government. Secondly, um, as has been mentioned by Baroness Northover, um it also combines with the, with the problem of the lead government not taking account of interests of other parts of government or indeed of no covering the, the subject as a whole.

And one of the classic examples is the um. The MI5, the security service, I mean, making the point to the Prime Minister about the increase in the likelihood the likely increase in terrorism in the country, about which nothing happened, partly because there wasn't an easy machinery of government, no, to to deal with it after that. I mean, we now have quite extensive machinery of government which sprang out of that experience. So my conclusion is I actually haven't got a an alternative, better solution than the lead government department, but partly because of the constraints of the British Constitution, where the money lies with the accountable Secretary of State.

So it's difficult actually to to shift that. What you can, however, do is involve other departments in a more more sure way in early decision making. And that's where the Security Council came into being, that a given subject will not just be discussed with the lead department. It will be discussed with all the other departments with an interest, so that you get early participation in the headline nation, the headline decisions out of which you can then formulate the right bureaucratic response. Very often it's found in the Cabinet Office.

Not always, but you you have a better chance of a cabinet committee then actually taking the topic more in the round than would otherwise have been the case. Does it work perfectly?No. But is it an improvement?I think yes, and so one of my solutions to this problem is early, early involvement of other departments that have an interest. And that applies also in many cases for resilience for the private sector. You have to bring the private sector in.

This is resilience is a partnership issue. Private sector needs to be in there early.
11:40
11:40
11:42
None Portrait Speaker 1
-

Thank you, Mr. Pitts.
11:43
11:43
11:44
11:45
11:46
11:46
11:47
None Portrait Speaker 6
-

So I'm. Strongly supporting supportive of that and, and, um, uh, one's very conscious when one is chairing as an official an official's cobra during a crisis, which bits of government work and which bits don't with the kind of agility and alacrity that you need. And the answer is, you know, you go to the military, you go to the intelligence agencies, you go to the police service, the fire service. There are some departments of state that have pockets of high performing, fast moving people, but not many.

So it's a bit unnerving. And so you do turn to the military. There is, however, in this question of resilience, a really significant British disease and risk. And that is that we are excellent. We have excellent special forces. We have an excellent RAF. We have an excellent navy, we have excellent intelligence services. We have excellent, uh, emergency response, but we don't have much of them. And what we tend to do is make use of them on every occasion.

So rather than distributing capability to do good enough provision widely, we tend to go. Now some of that has changed. You see it in the distribution of with armed policing moving away from the requirement for special forces to always respond to a terrorist incident when a high level of firepower is present. That's an example of where we've distributed it. But on the whole, we don't. That creates enormous risk at a time of hybrid warfare, and we're at greater.

And when there are greater range of hazard events happening to us, because we end up using the same capability or trying to use the same capability more times than it can bear, and it isn't available for its core task. So there's a yes, absolutely. But that going back to that whole of society approach, that has to be a hardening of the minds and responsiveness more broadly in society. Otherwise, despite the excellence of our elite forces and capabilities, they will fail.
11:49
11:49
11:50
11:50
11:52
11:52
11:53
11:53
None Portrait Speaker 6
-

Um so. Um. Information covers a, a wide range of things really. Uh, and there will be some material where the sources and methods that have generated production and the reliance of other bits of our war fighting or, or, um, geopolitical capability as a nation means we have to protect it, which is going to be difficult to distribute. And where we have to leave in the hands of those who generate it, uh, responsibility for making decisions about distribution. But that's quite a small portion of the, of the data that should be available in my view.

Uh, and we're capable and we see it, um, uh. In a variety of, for instance, counterterrorism, but also countering hostile state activity, the ability to move from very high classification into broad distribution of low classification material. So it can be made use by the authorities or external partners. I'm not familiar with the specifics of the problem that the energy sector said they had. It is hard to believe that it is not possible to have an interface given the problem. The problem they've raised with you to have an interface, maybe through the National Security Agency or another body that was consciously trying to make as much as possible available, um, we in.

A number of areas to do with resilience and cyber stands out. There is a kind of belief that there's something you could know about threat information that would enable you, you know, not to be at risk. And that is very rarely true threat information of a high classification kind might allow you to tune what you do. But, um, it doesn't actually resolve the issue for you. And it is, it is slightly, I'm afraid, in my view, on occasion, faulty thinking as opposed to making proper preparations for a range of things that may happen to you rather than saying, well, if you tell us the thing we've got to prepare for, we'll prepare for it, which, you know, your job is to deliver a service.

There are a variety of things that may interfere with them. Some of them are threats, some of them are hazards. Live with it. So I'm slightly skeptical, but I think whether if there is a specific issue, it probably could be worked through through the existing mechanisms, if they were told to.
11:55
11:55
None Portrait Speaker 13
-

To turn to your your, your first question, um. I mean, sometimes I think there are real constraints and one can't entirely get around that. Um, but, uh, I think the, the, the assessments machinery inside the Cabinet Office, which takes Intel and then assesses it. Analyse it and assesses it and, and comes out with something which is capable of wider distribution. So it seems to me you don't have to be in possession of, of the raw raw intelligence in order to be uh, able to be in a position where you have a very good clue as.

To what the issue is that you've got to solve. Um, I mean, it's a, it's a skilled activity, but it works. And so I'm, I'm not, I think, impressed by the notion that somehow you're in possession of such, such delicate information that you're paralyzed from taking necessary decisions. Um, I think, I think the machine can, can cope with that. Um, now your second, your second question was, uh, oh, the private sector. Um, well, yes. And I think that's one of the real issues about resilience.

Is, is that, you know. A very serious proportion of the means of making the country resilient are indeed in, in, in corporate business. I think as a general proposition, government needs to be closer to corporate business than it is. It needs to do a lot more partnership. Cybersecurity started out as a partnership. I think the latest measures actually reduce the level of partnership. And I think that's a mistake. So you've got to have partnership.

What does partnership mean?Well, it means actually that the two sides have to talk to each other. And I mean talk. I have been in the past to a Ministry of Defence meetings where the Ministry of Defence did the talking and the companies listened. That isn't, in my view, partnership, and I don't think it's the nature of the relationship these days because we have moved from I'm going to tell you what equipment I need, and you will tell me that. You will tell me whether you can do it and at what price.

Now it is I have a problem. How can we solve it?And I think that's very much more. Now how government actually should approach things anyway and is more likely to anyway, because it hasn't actually got the solutions within its means. So I'm hopeful about partnership, but I do think it's essential, and I do think it needs to start early. That's why I come back to what I was saying about needing top level involvement. I mean, power is very important because it's going to come up and it's going to be under stress.

And so you need to have a regular dialogue between the companies and government on how things are going and where the next, the next problems might arise. And you can think of other sectors where that needs to be the case. And that is, I think that's classic in a sense. Cabinet, Cabinet Office, committee function. And it could be made to work very well. And I think if the corporates are involved at an early stage, they are then much better equipped to to respond to the measures that are then going to be taken down the line about what we actually do.
11:59
None Portrait Speaker 1
-

Mr..
11:59
12:00
None Portrait Speaker 1
-

Thank you Lord for.
12:00
12:02
12:03
12:03
None Portrait Speaker 6
-

I had really three quick thoughts. So the the first one is. Um, um, I work for many, many years in the Middle East in the Foreign Service. And there's a category of state in the Middle East, I won't say which. When I was serving there, which were referred to as Dolittle, Mukhabarat, which are intelligent states where the intelligence services at the core of it, the titanium endoskeleton of those states. Um we can think which they are. You could argue Russia is that with the Chequers at the core of it.

So I'm really unnerved at the idea that we have a structure. And at the top of it are the intelligence services. Given that we have to deal with a whole variety of things that may happen to us, which are which our enemies are seeking to exploit. So we're dealing with natural hazard. And one of the characteristics of Russian hybrid warfare technique is that you exploit things that are happening, rather causing things to happen. So that our the tools we have for responding to everything is part of our hybrid warfare response.

The intelligence services provide us with a little tiny bit of information and framing that can be helpful for strategic decision making. One of the answers, if I may, to your question, is, it seems to me that in the private sector and in particular in any organisation, it's almost every organisation now which is data enabled. It is your ability to bring together and analyse increasingly using artificial intelligence or a genetically, although that's a little bit cutting edge, all of that data to form a view on what is happening to you, of which the really sensitive parts may be very, very small.

And I think one of the risks of our conversation here is that we're backward looking at a way of doing business that is actually behind us in private sector and including, incidentally, in the energy sector, where when I have worked with major American energy providers, their knowledge of what is happening within their networks, of how everything is running is far outstrips what we seem to be able to bring together. So there's an issue there on the middle layer. I'd note two things. First, no one said the word devolved when I used to convene a National Security Council Resilience committee, I had with me representatives of the devolved administrations, as well as all of the government departments and relevant arm's length bodies, which was quite a large meeting you can imagine that would do something around resilience.

We've got to think of the devolved and then final thought for you. It does seem to me that both the National Cyber Security Centre, there are some structural issues with it, and the National Security Agency are both significantly under tasked and held to account. So in other words, what what are they meant to do for us?What do we expect of them?And, you know, and under resourced as a result, because if they if you gave them the resource and held them to account, and it does feel to me like the National Security Agency should potentially or a body like it, possibly not in MI5, but somewhere else should have a more significant role at closing that gap between local resilience fora and what happens at the top in terms of preparedness.

Okay.
12:05
12:05
12:06
12:06
12:08
12:08
None Portrait Speaker 13
-

All right, here we go. Um, well, they seem to me there are two questions there. One is, does the government give enough guidance on the on, on on vulnerability and risks, the risks. And I mean does. Does corporate business take notice of it and take it seriously. And um, and act. The, on the first, um, I think it's patchy. I think in some areas we do quite well. I think the NCS is.

An excellent organisation, a very good, a very good development from the, from Gchq. Um, does it, is it active enough. Could it do more. I believe so. Uh and how would it do it. Um one of the, one of the criticisms I have of the forthcoming of, of the. Our discussion of, of the. Cyber security bill that's coming forward. Is that it, that bill virtually ignores the private sector. It brings it brings it in insofar as uh.

Corporate suppliers and of of service service providers will be will now be regulated. But the, the fortunes and the security of the private of the private sector. I mean, companies like JLR who, who have had a nasty experience, uh, are ignored. Now the government is now introducing something called a pledge. I don't actually think this is the game. I think that, uh, we want. Industry to be much more organized in the way banking is. Let's just say, you know, you have a very close relationship between the regulator, the bank, and actually the banks themselves.

And it's a relationship of confidence. That doesn't mean to say, you know, that they don't get a nasty rap over the knuckles from the Bank of England time to time. Nevertheless, this is a cooperative relationship. Now, in banking, you can imagine it is pretty close. I mean, I don't suppose that all industries need to operate that like that, but banking is one that has competition. So they've managed to make it work. And I think it should be looked at as a means of actually infiltrating into the corporate sphere more earlier advice from CSC than is at the moment the case.

So I would actually like to see a real change there, which does involve creating structures and those structures, it seems to me, can and should be funded by the private sector. But, but the counterparties that the government then takes them seriously and feeds them really good info that it gets. BT's themselves get information and actually the whole system is stronger when the corporates are also feeding in. So I think I think it's both necessary and possible actually to, to create a situation in which both parties actually perform better.

That's to say government gives more information and the corporates actually take the thing, take the thing seriously. And it's a habit of it's a habit of working, and it's a habit of mind that you need to develop. Um, my experience of companies is that actually they're patriotic and apart from anything else, they stand to lose if they're, if they're not well informed, they know that they're vulnerable. So I don't think there's much, you know, unwillingness to come forward in order to actually be more secure.

It is it's very often a practical problem. And I think companies should be made responsible for the security of their supply chains. I think that's where it lies. So the big ones do have to take care of the smaller ones. The smaller ones need better access. This comes back to the distribution of information. So I think it's possible to make this system cohere while maintaining the separate roles of the parties, uh, and attain a much higher level of, of, of confidence in our level of security.
12:12
11:17
None Portrait Speaker 14
-

I would, I would add on, on supply chains that, um, this was a question that we asked in, in government about resilience of supply chains. And I think we felt there was not enough bandwidth or resource being devoted to understanding, uh, the, the supply chains as they relate to the, the critical risks on the risk register. Um, and I think that, uh, that is work that should be done. Um, and, and expedited. I'm aware you've heard from the National Preparedness Commission, I think they do some of that, that work.

And I think there is a role for, for experts to be brought in. But I think, I think the, um, the proof point is that, um, when of course we did need, uh. A supply chain, um, uh, in terms of ventilators, uh, during Covid, the question went out to business, what is the supply chain?What can you do now?You know, that was a success and there was a Baroness Neville-jones says a patriotic response, but I think perhaps need to be a little bit more strategic for the next crisis as to and for the, the, the critical risks on, on the guidance.

I mean, there is more guidance. Um, and, and, you know, I think the, the developments are, are welcome, but it's very much self-service. Um, and I think it goes to the cultural point that we might come on to discuss in terms of, um, feeling a, a shared purpose that we all have a, both business private citizens and government have a shared responsibility for, um, for our resilience. I noted, um, Rishi Sunak's comments about, uh, the Covid bailouts at the weekend. And without commenting on that, I think it does speak to the, the culture that, um, you know, businesses can abrogate responsibility to some extent to government, but of course, I mean, cyber attacks alone cost the economy.

If you believe KPMG £14 billion a year, £14.7 billion a year. And so we have to together work out a way, a way of getting a culture where we prioritize resilience more because it needs to be that that shared endeavour. And I think government could push a lot of their, um, their offer, like the National Resilience Academy that offers world leading training. I mean, people come from all over the world to be trained there, but how many of our businesses are aware of that offer and are putting their people through it?
12:15
12:15
None Portrait Speaker 6
-

I, I think it's a wonderful question. Um, because they are a significant source of vulnerability. And, and as we hear, not least from, uh, their representatives, it's a particularly difficult time for them to find the space, the investment, the time to do these additional things. I think the role of insurance is potentially very different. The time to do these additional things. I think the role of insurance is potentially very significant. Um, uh, for SMEs, there's very poor take up of, uh, terrorism.

Thinking about my role with Puri or cyber insurance. And it does feel, I mean, you know, below ten low, you know, five, six, 7%. If you have a big drive, you might get another percent. Um, and it does feel as if when you get below a certain size, there should be a standard insurance packet that you receive as an SME, which incidentally, which other companies will have an interest in. In other words, they'll have an interest in SMEs functioning and government has an interest in it too.

Um, that would also drive preparedness because, uh, I mean, it drives, um, if, if one thinks of preparedness response and recovery, the one we tend to neglect is recovery. So we do a certain amount around preparedness and place requirements on businesses to do stuff. We do a lot of work on response and so do businesses because they think, you know, we'll respond to this crisis. Recovery is the thing that really kills you and particularly kills you in a, in an SME, when small amounts of money can make a really significant difference.

So having insurance set up to instinctively support with a degree of automaticity, SMEs who have certain categories of risk eventuate, I think would make a material change, if I may, quickly on the on the question of supply chains, any serious business is getting a deeper and deeper knowledge of their supply chain, and some of that is technology enabled because it's easier to map them. Also, interestingly, it's easier for outsiders to map them as well. And by that I mean regulators and others. And one sees this in, for instance, something like CFIUS in the United States or the, or the investment security unit here who can look down a supply chain and say when they hit something they don't like.

On the whole, our high performing providers, such as, I don't know, the, um, the food retailers, you know, the supermarkets on the whole, they don't want government coming and advising them how to optimize their supply chain because not only do they feel they can do it, but also they say, well, we did it for Covid. And, you know, we, you know, we've kind of done this. We kind of know we can do this, I think Stuart would probably say at mass, uh, you know, I think even when I had a major cyber attack, there was still food in my stores and I still turned over and I was still reasonably well performing on the stock exchange.

So there is a thing about thinking about which sectors actually need to change their game and where their significant vulnerabilities are, and it is possible for government to map those out and have a dialogue in those areas, rather than doing something that smears across otherwise profitable and effective businesses that we should lead to get on because they have a motivation to get their supply chain right.
12:18
12:18
12:18
This debate has concluded
Return to start of debate - Return to top of page