Lords Chamber

Tuesday 14th July 2026

(began 1 month, 4 weeks ago)

Share Debate
Watch Live
Skip to latest contribution
This debate has concluded
14:36
14:36
None Portrait Oral questions: Current business hiring intentions and their implications for the wider economy
-

The UK labour market and economy
14:36
14:37
14:38
14:39
14:40
14:41
14:42
14:42
14:43
14:44
14:44
14:45
14:45
14:46
14:46
14:47
None Portrait Oral questions: Availability of parenting support programmes for families following a child's diagnosis of an autism spectrum condition
-

Second Oral Question Baroness Limb. question. Standing in my name on the Order Paper. >> My Lords, we fully recognise the
14:47
14:48
14:48
14:49
14:49
14:50
14:50
14:51
14:52
14:52
14:53
14:53
14:54
14:55
14:55
14:56
14:57
14:57
14:58
14:58
14:59
14:59
15:00
15:01
15:02
15:02
15:03
15:04
15:05
15:05
15:06
15:06
15:07
15:07
15:08
15:09
15:10
None Portrait Oral questions: Suspicious Activity Report enquiries conducted by the National Crime Agency concerning the funding of the Reform Party
-

Oral Question Lord Bassam of Brighton. Standing in my name on the Order Paper.
15:10
15:10
None Portrait
-

And notwithstanding the Minister's honest answer, perhaps Minister's honest answer, perhaps he could advise the House of how many suspicious activity reports annually the government would expect to be lodged against political parties as a result of political donations. And does the noble Lord, the Minister, agree with me that it's extraordinary that for a party, the Reform Party that pitches itself as being anti-establishment and always claims the moral high ground in politics to be reliant on funding from questionable, not to say dodgy donors.



**** Possible New Speaker ****

Yeah. I always try and be helpful, but

**** Possible New Speaker ****

I always try and be helpful, but I can't for the reasons I've mentioned, give information to the House or to my noble friend on the House or to my noble friend on the number of reports that are taken. What I can say is it's in the interest of all of us in this House interest of all of us in this House to make sure that our politics is clean, that our politics is not funded by illegal sources, and that funded by illegal sources, and that we take action to make sure that all political parties are held to account for the funding they receive, to exercise their political activity, and to get themselves elected or not, as it may be.

And I'm very happy to talk through as we go through this, the details of the Rykoff review, which the government has received and accepted all recommendations that have been made, and that includes a range of measures which I think my noble friend will welcome, and which I think will put great pressure on a number of political outlets who find that their involvement in some of the areas which the review is trying to tighten will make them much more challenging for them to receive donations from various sources.
15:12
15:13
Lord Hanson of Flint Portrait Lord Hanson of Flint, The Minister of State, Home Department (Labour)
-
-
Yeah. do have clean financing of political parties. And if I refer him to the Rykoff review, let me just say some of the things that we've agreed and we've accepted that we're going to do a cap on donations from overseas electors, a tightening of corporate donation rules, a moratorium on crypto donations which will be of interest to my noble friend Lord Bason, strengthen non-party campaigner and candidate controls. Strengthen know your donor checks. Standardised political financing reporting. Now any political party who wishes to adopt clean funding should sign up to those principles.

And when we bring measures before the House, I trust the noble Lord will support them. I'll look at what he said with regard to labour together. But I also say to him, I think we should try and take the politics out of this party, politics out of this, and have an even level playing field so that all political parties know who has been funded, why and how, and ensures that those

**** Possible New Speaker ****

fundings are clean and transparent and open. Yeah. Is it not the case that

**** Possible New Speaker ****

Yeah. Is it not the case that one of the things that has allowed reform in Nigel Farage to, to get reform in Nigel Farage to, to get off a little bit here is the sheer complexity of electoral law and the whole area around this. We are whole area around this. We are about to start consideration of the 27th representation of the people's 27th representation of the people's Bill, and the other 26 others are not consolidated. Is there not a good case for the government to decide that we need to consolidate electoral law? And in the simplicity that might follow, that there would be greater control over dodgy dealings in party funding?

**** Possible New Speaker ****

Well, the bill that the noble Lord mentions is going to go before Lord mentions is going to go before the House of Commons now, probably in September, because it was due this week, but we've put the Hillsborough law in place, which I welcome this week, and that has been moved back. It's important that we have clear electoral law. He tempts me to talk about issues which are not my direct departmental responsibility, but I departmental responsibility, but I will reflect on what he said and listen carefully to representations and pass them on to the appropriate Minister.
15:15
15:16
Lord Hanson of Flint Portrait Lord Hanson of Flint, The Minister of State, Home Department (Labour)
-
-
As I just mentioned to the noble Lord, the report and Third Reading Lord, the report and Third Reading of the representation of the people's Bill are going to be brought forward as soon as parliamentary time allows, and I'm not the Minister responsible for that bill, but I'll certainly pass on the comments of the noble Lord, and I hope I share with him an aspiration to ensure that we put as tight a ring as possible around those donations. So there's transparency, clarity, openness and that.

The National Crime Agency, if there are contradictions to be made,

**** Possible New Speaker ****

has the independent policing through. My Lords, my Lords, the

**** Possible New Speaker ****

My Lords, my Lords, the Electoral Commission, as I understand it, will be given the power to share information with third parties, which is very welcome and long overdue. But will it also be given the powers to it also be given the powers to require information from third parties, which is normal for any regulator that one can think of regulator that one can think of with tough sanctions for non-compliance? Yeah.

**** Possible New Speaker ****

One of the recommendations is that we standardise political finance reporting, and the government has accepted that. And government has accepted that. And in accepting that, what that means is that we've given the Electoral Commission powers to prescribe standardised reporting formats, and standardised reporting formats, and we are continuing to work with the Electoral Commission on a number of other areas. And I'll certainly,

**** Possible New Speaker ****

other areas. And I'll certainly, again reflect on what the noble Lord has said. The Labour Together episode has

**** Possible New Speaker ****

The Labour Together episode has already been mentioned. Not only did that organisation fail to declare donations, but they paid to have journalists investigated. Does the noble Lord the Minister, agree it would be inappropriate for it would be inappropriate for anyone involved in these scandals to be given a senior role in government?
15:17
15:17
15:18
15:18
15:18
15:19
15:20
None Portrait Business of the House
-

That concludes our questions for >> That concludes our questions for today. Our Third Reading of the Cheltenham Borough Council markets Bill. The Senior Deputy Speaker My Bill. The Senior Deputy Speaker My Lords, I beg to move that this bill be now read a third time. The question is that this bill will be question is that this bill will be now read a third time, as many of that opinion will say, content and contrary not content. The contents have it. The question is that this bill do now pass, as many of that opinion will say, content.

The contrary not content. The contents have it. Supply and appropriation.

**** Possible New Speaker ****

Main estimates. Bill. Lord Livermore. My Lords, I beg to move that

**** Possible New Speaker ****

My Lords, I beg to move that this bill be. Now read a second time. Question is that this bill be now read a second time. Question is that this bill be. Now read a second time, as many of that opinion will say, content. The opinion will say, content. The contrary, not content. The contents have it.

**** Possible New Speaker ****

have it. My Lords, I beg to move that this Bill be not permitted. The question is that this Bill be not permitted. As many as have that opinion will say content contrary, not content. The contents

**** Possible New Speaker ****

have it. Lords, I beg to move that this Bill be. Now read a third time.

**** Possible New Speaker ****

Bill be. Now read a third time. The question is that this bill be. Now read a third time, as many are of that opinion will say,

**** Possible New Speaker ****

are of that opinion will say, content. The contrary, not content. The contents have it. my Lords,

**** Possible New Speaker ****

The contents have it. my Lords, pass. The question is that this Bill do now pass, as many of their opinion will say, content. The contrary not content. The contents have it. Questions on a statement made in the House of Commons
15:22
None Portrait Statement: Death of Ann Widdecombe
-

Widdecombe.
15:22
Lord True Portrait Lord True (Conservative)
-
-
Yes, my Lords, no 78 year old woman deserves to be bludgeoned to death in her own home, and the whole house will wish that the search for anyone who may have incited or abetted her cowardly killer will be far reaching and remorseless, and their punishment unbending. And to those who sneered about Ann Widdecombe after the news of her death or worse, welcomed her death, I say to them that to try to unsay such things when you learn of the manner of her death doesn't make it OK.

Your shameful words are indelible, and their stain lies not on her, but forever on you. My Lords, there's too much easy hatred in politics today. We must confront all its perpetrators and root them out. There was no hatred in Ann Widdecombe. Strong principles. Yes, you sure knew where you stood. Convictions expressed with clarity. Certainly a zeal to serve her community. Absolutely. My Lords, readiness to debate fiercely and then make up with a drink and a laugh afterwards.

Very much so. People who knew her in the House of Commons say there was never a harder working constituency MP. She worked for the causes in which she believed, day in, day out, right to the very end. Her killer found her after one engagement and he took her as she was preparing for her next one. The response from her own community in recent days has shown how dearly she was loved by her neighbours and those with whom she so faithfully worshipped her divine creator at Buckfast Abbey.

My Lord, she was one of those rare politicians that the non-politicians real people related to and liked. Yes, she was a character. She loved her country. My goodness me, how much she loved this land. Eccentric, maybe. But how English is that? My Lords, my party leader, Kemi Badenoch, spoke simply and eloquently as a woman of a fallen woman, of the shock that we in the Conservative Party feel at the death, the loss of a dear colleague of decades.

And like Kemi, I reach out to the members of reform to whom an lately hitched her redoubtable wagon. Her loss is a loss, in my judgement, to the whole of public life, and it's another darkening of the happiness and the cheerful innocence of things. My Lords, I thank the Minister for the kind words we have heard from the government and from so many in the party opposite. Sometimes we know we're all brothers and sisters under the skin, on the same journey, for the same purpose of public duty.

Anne's death is another reminder of the real threats to many in public life. We remember David Amess and Jo Cox and Ian Gow, Anthony Bury, Robert Bradford, Airey Neave all slain by terrorists while serving MPs. My Lords, I know there is a limit to what the noble Lord the Minister, will be able to say about the ongoing investigation. But the announcement that counter-terrorism police are now leading the investigation has only deepened. Concern felt here in Westminster and across the country.

The Home Secretary said the suspect was not known to prevent. Can the noble Lord the Minister, give the House any update on latest information that he can share? And there was much in the statement, understandably, about the advice of available to MPs and new provision that may be made at the other end of this Palace the. Can the noble Lord, the Minister, say anything about what provision may be made for members of your Lordships House, who. My Lords, are not free from daily threats of violence.

My Lords, we must never, ever close the gates of democracy, but we must safeguard all those members or not, who come to Parliament to serve their fellow countrymen, countrymen and women. My Lord, surprise has been widely expressed about the haste with which the Devon and Cornwall Police downplayed any idea there was a political motive to this killing. Is the Minister satisfied with protocols for releasing information to the public in high profile cases? In this social media age, and will he commit to reviewing the handling of this case so the right lessons are learned.

But my Lords, let us for the future. For now, all our thoughts and prayers should be with Anne's family and friends, and I know the whole house will join with me in expressing our deepest sympathies to them all. Yeah, yeah.
15:27
Baroness Doocey Portrait Baroness Doocey (Liberal Democrat)
-
-
My Lords, from these benches we join others in extending condolences for the death of Ann Widdecombe. The reaction to this tragedy has rightly included tributes from every party and from all sections of society. That's a reminder that under fierce disagreement, there's a shared commitment to our democratic institutions and a shared vulnerability. When violence enters political life. Like every member of this House, we were shocked and saddened by her death, the circumstances of which are subject to an active police investigation.

The police have been clear right from the outset that they're treating this as a suspected murder. However, they haven't yet established a motive and the situation seems to change constantly, and I suspect it will do as they uncover more and more evidence. They've also asked us to respect their request, not to speculate and to allow them to do their work. If only we could have the same lack of speculation on the internet and on social media, wouldn't that be great? But unfortunately, it's never going to happen.

Ann Widdecombe commanded widespread, widespread respect for her commitment and democratic debate and her public services, first as a councillor, then as an MP for two decades, then as a government Minister and finally as a member of the European Parliament. This tragedy is a reminder that those who serve in public life should be able to do so safely. We depend on people from all parties and from none to put themselves forward and speak their minds without fear or favour.

But my own personal experience suggests that particularly younger people won't even consider the possibility of making politics their life. Because when you ask them, even though they're highly articulate and very happy to tell you what the government should and shouldn't do, they say, well, we're not going to put ourselves forward to be shot down. And I honestly think, my Lords, that we really all ought to work together to change this system because they shouldn't be feeling like that.

They should want to serve and realise how great it is to do so. From these benches we send our sympathy to Anne's family, her friends, her former colleagues, her constituents and those in her community who will all be grieving her loss. Our responsibility now is to continue our arguments with definitely with seriousness, but also with civility, and to give the police the space they need to establish the facts of her very sad death here.
15:31
Lord Hanson of Flint Portrait Lord Hanson of Flint, The Minister of State, Home Department (Labour)
-
-
I'm grateful, my Lords, for both the contributions to the noble Lord the contributions to the noble Lord True and from the noble Baroness Doocey. Everybody in this House knows that politics is about beliefs, about standing for things and about making your views known. And no one can deny that Ann Widdecombe did that in a way that was energetic, forthright, occasionally humorous, and unlike many members of this House, occasionally on Strictly Come Dancing as well, which I think is really important.

I spent 18 years in the Commons with Ann Widdecombe, and I can't think of many areas where we ever agreed, but we did that in a way that was, again, with civility, with humanity, with mutual respect for views that we held and the loss of her in the circumstances that we've had is both dedicated, dedicated, sort of is both devastating for her family, but also devastating for all of us who knew her, and particularly for those members of the House. In this House who knew her as well.

She brought conviction to our politics. She was forthright in her opinions. She argued courageously for things she believed in, and she didn't deserve to be murdered in this way. Now, I cannot, as the noble Lord and noble Lady have mentioned, comment upon the current police investigation, it's not appropriate to determine or comment upon that, but I can say is that enhances the noble Lord True that the police are possibly, as I speak, making a further statement on the further developments in the murder investigation, they were due to make a press conference between 3 and 315, and they may well be doing that now.

And I'm trying to check whether anything further has been said. It is important that we give the police time to examine that. The issue that the noble Lord has mentioned about Devon and Cornwall Police and the noble Lady mentioned also, and counter-terrorism police, has been taken in cooperation with both forces to look at further leads. And again, it doesn't necessarily mean that terrorism issues were involved, but it's important, again, that we give the opportunity for the police to investigate counter-terrorism. Police have now taken the lead on the investigation.

And as Lawrence Taylor, the head of national counter-terrorism police, has said, we have new information and evidence. That means counter-terrorism policing is leading the investigation. The police are pursuing multiple lines of inquiry to establish motivation for the attack. Ann Widdecombe had an inimitable style in politics. She was valued by her own side, but she was valued by both Houses of Parliament and she served Maidstone for 23 years as a champion for her constituents. She served the country in government as Minister for employment and then prisons.

She served with pride and

**** Possible New Speaker ****

With a commitment. That means that today we mourn her loss that today we mourn her loss tremendously. Both noble Lords and ladies who have spoken have mentioned the issue of security for mentioned the issue of security for elected politicians. Every case that the noble Lord mentioned of the murder of a politician. I can remember I've seen colleagues of mine, you know, Jo Cox and Sir mine, you know, Jo Cox and Sir David Amess murdered. I've watched from afar as Airey Neave, Ian Gow and Reverend Robert Bradford were murdered.

It is not a way to do politics. We do our politics by discussion, and I think it's important that we ensure that members of Parliament and indeed, members of this House have the support to be able to do that job free of fear. I don't think there's a single member of Parliament who's not faced threats at some time or other, and many members of this House do so as well. The Home Office will work very closely with the parliamentary authorities, because ultimately, it is the parliamentary authorities who are responsible for the security of this House, but we will work with them, and we will continue currently to review how we can work with Operation Bridge, which is the police support through local forces and through national support to ensure that we get that protection and it will be done on the basis of threat and on the basis of particular support for members of Parliament who require that support.

Ultimately, we will find out who murdered Ann Widdecombe. They will face a severe prison sentence in due course. But we should remember the contribution that Anne made. We should remember the affection with which she was held. We should remember, dare I say, the differences that we had, and we should engage in our parliamentary democracy and our public life to reflect those values in the way in which we know they should be reflected, which is mutual respect, honest disagreement, sometimes open discussion, but ultimately one that recognises that Parliament is there for a purpose to reflect the will of the people.

And our job is to make sure we do that, as Anne would have wanted in a civilised, humorous or principled manner.
15:36
Lord Alton of Liverpool Portrait Lord Alton of Liverpool (Crossbench)
-
-
Lord Hanson of Flint has just. >> The assassination of Airey Neave here in the precincts of Parliament in 1979. It was the day after I was elected in a parliamentary by election. And so some of the horrors that we have witnessed in the years that have passed have left an indelible mark on me, not least because Sir David Amess was a very close friend, as indeed was Ann Widdecombe. So much so that, and was a godparent to one of my children and a close family friend.

On one occasion, after a particularly tough battle in a Home Office bill, in another place where she at the time was a Home Office Minister, she told me that I was her favourite bleeding heart liberal and. But as the house may. I imagine we often had our differences and as recently as last month in a curry house where I know I've seen the noble Lord from time to time, and indeed the noble Lord, Lord Clarke. It was a favourite watering hole of Anne's.

And just last month we argued again about so many things, respectfully recognising the differences that we had and was intelligent. She was principled and she was kind. And yes, her beliefs were founded on those twin pillars of faith and patriotism in a very toxic environment, fuelled often as the noble Lord Lord True in the noble Baroness Doocey have said, fuelled by hatred, we have to do far more to respect difference and diversity and to uphold those who are minorities in our community.

We must work far harder to create a climate in which difference of opinion can be expressed with tolerance and respect. And now we must do all we can, both to honour and memory. I hope there'll be a book of condolence which we can all sign. But in addition to that, my Lords, we have to honour her memory by creating an environment where people can express their differences, intolerance and in respect.
15:38
15:39
15:40
15:41
15:42
Lord Hanson of Flint Portrait Lord Hanson of Flint, The Minister of State, Home Department (Labour)
-
-
Yeah. >> I'm grateful for for my friend. I don't disagree with any word that she said. There is, I think, again, increasingly threats are delivered and views are delivered in an online way. And that online way has, I think, increased the toxicity of the debate that we have in a public forum, and we need to ensure that we examine that. And there are also currently legislation available to look at the online space and to look at how the online space is managed.

But let me just come back to the main point on this, and I want to just reemphasize this for all noble Lords. This has been a vicious murder. We do not know yet the motivation for that murder and speculation, and the discussion today has strayed into the political aspects of that. Potentially, we do not yet know the causes of that murder. What we will do is have a proper investigation. At some point. I hope the charges will be made against somebody for that murder, and they will be held to account in the courts, and then we can examine if there are lessons to be learned.

Whatever has happened with the murder of our colleague and Widdecombe.

**** Possible New Speaker ****

My Lord. I would. Offer my condolences to family

**** Possible New Speaker ****

Offer my condolences to family and friends of Ann Widdecombe. I've felt for many years that the felt for many years that the government under invests in the protection of those in public life who are facing potential terrorist who are facing potential terrorist threats. I realise that there has been considerable progress in recent years, both on the recent years, both on the resourcing and in the coordination of support to those at potential risk, but I wonder whether the Minister would agree with me that whilst it's very important that there should be an assessment of the threats that are faced by individuals, that in reality, in
15:44
15:45
Lord Hanson of Flint Portrait Lord Hanson of Flint, The Minister of State, Home Department (Labour)
-
-
with great authority about the type of threat that many elected politicians and members of this politicians and members of this House may face, and I bow to that experience and that knowledge. What I would say to him is that we do I would say to him is that we do keep this under review at all times. In fact, following the murder of Sir David Amos, my right hon. Sir David Amos, my right hon. Friend the Home Secretary has commissioned Robert Buckland, a former conservative Justice former conservative Justice Secretary, to examine the security arrangements for members of Parliament and for others, and we're expecting him to report as soon as possible.

It's extremely important that we keep ourselves safe, because for the very reasons the noble Lord has mentioned, a member of Parliament in the constituency as well as in this House, are representing 70, 80, 90, 000 people. They are sent there by the population to do a job and they should not face threats in doing their job. They should face political discussion, political debate, but they shouldn't be intimidated or face intimidation in

**** Possible New Speaker ****

undertaking that role. Anne and Anne and myself were on

**** Possible New Speaker ****

Anne and Anne and myself were on totally different sides on the hunting debate, which went on for many hours in the other place, and many hours in the other place, and all through that we remained. We remained friends because Anne understood differences that could understood differences that could be respected. She was in a minority in her party on the hunting bill. I was a minority in my party, on the hunting bill, and more recently, I was delighted that she came over to Northern Ireland as as as a reformed spokesperson to speak at
15:46
15:47
15:49
15:50
15:51
15:52
15:52
15:53
15:54
15:56
15:57
15:58
15:59
Lord Moynihan Portrait Lord Moynihan (Conservative)
-
-
>> My interests as chair of Amy, Chair of Action and Chair of Buckthorn Partners, all involved in different ways with energy transition both in the UK and around the world. And I am grateful to the Minister for taking the statement made in another place yesterday. There, the DEFRA Minister took the statement and the exchanges focussed on her responsibility. Today is the turn of the noble Lord, the Minister for DESNZ. So I will concentrate my questions on the aspects of the statement which focussed on the government's record to meet the objectives set out in the statement, or, more precisely, the consequences of Secretary of State Ed Miliband's tenure, who is rumoured to be heading to the Treasury at the end of the week.

My Lords, we all share the importance of protecting our climate and restoring nature. The key question is whether the government has been capable of making progress on both, the statement notes the introduction of the Carbon Budget seven and praises it despite it being regretted in your Lordships House. It claims to be, and I quote, working in partnership with local communities, businesses, Commons, conservationists and farmers. The Climate Change Committee suggested a 35% reduction in meat and dairy consumption by 2050, and a 50% reduction in the number of cattle and sheep, a doubling of tree planting rates by 2030 and a doubling of peatland restoration by 2040.

I asked the Minister, does he agree with those representing the farmers that they will be forced to uproot their entire business models within a single generation? My Lord. Similarly, the statement informs us the government will, and I quote, protect and conserve 30% of our land and sea for nature by 2030. Yet last week, the government approved One Earth solar farm, a week after approving Pear Tree and Dene solar farms. One earth will cover 3900 acres and will have a capacity of 740MW.

Half of the farm will be on best and most versatile land, BMV land. Can the Minister explain how that enhances our natural environment, and does he agree with the Secretary of State, who recently overruled his own planning inspectors to approve this? The Britain's second largest solar farm? Despite their recommendations to refuse the application over concerns about environmental damage and the loss productive farmland, which this statement is meant to protect, it is estimated that the site, 660 hectares, could produce around 5300 tonnes of wheat a year.

And does the Minister not agree that the government is getting the balance wrong? Britain needs affordable, reliable, clean power but covering productive farmland with vast solar developments whilst ignoring practical alternatives is not the answer. Ministers should be pursuing an energy strategy that strengthens our energy security without undermining our farmers. However, I understand that there is some good news coming from the statement. Could I ask the noble Lord, the Minister, to confirm that Andy Burnham is going to accept the long running campaign from this side of the House to approve the jackdaw gas field and will be going to Aberdeen during the recess? With this welcome news, let us hope that this is the beginning of a Damascene conversion of Ed Miliband, especially if he is to move to the Treasury, although somehow I doubt it.

So, given the decision to approve jackdaw this summer, does the Minister now agree that the North Sea gas is four times cleaner in production than imported LNG? And would he agree that UK energy security is strengthened by reducing reliance on imported gas? Would he agree that this would be a first step to protecting and indeed, increasing oil and gas jobs would grow tax revenues, would secure energy transition and vitally important in the context of this statement would reduce the carbon emissions our reliance on gas generates.

When the Secretary of State states that the North Sea is a mature oil and gas province, we agree with him. The primary source rocks were deposited about 150 million years ago, and with the right tax allowance, regulatory and decommissioning regimes as Norway, we could be producing a similar 4 million barrels of oil by the time the first new build. Nuclear comes into generation in the late 2030s. And that is my Lord's optimistic, given the government's unacceptable delay in enacting the Fingleton recommendations.

Will the Minister confirm that the Burnham government understands that what we're talking about is global warming, and that the UK is not detached from the globe as such? Does he agree that we should count all emissions, all emissions in all the supply chains that deliver solar panels and offshore wind to the UK? If we are to be honest with the public, and not just virtue signalling to a world that is not listening, but looking with incredulity at the government's de-industrialisation, with the cost of electricity to our industrial base being the highest in the OECD and four times higher than the states, the Under-Secretary of state for DEFRA noted during the Q&A exchanges following the statement that a school in her constituency, the Richard Lea Primary School, is installing new solar panels.

Is the Minister aware that this school's sources its solar panels from a solar. The company has a very high exposure to the Xinjiang province in China. In fact, the very highest rating and the accusations of Uyghur slave labour in that province are well known to your Lordships' House. Does he agree that our solar panels are neither home-grown nor clean? The component parts come from China, which rely heavily on vast coal fired factories daily, belching out CO2 into the atmosphere. Does he agree that the total carbon footprint of a finished Chinese panel averages around 490kg of CO2 equivalent per module, involving extreme furnace temperatures, adding to global warming at an alarming rate, high levels of CO2 into the atmosphere for polysilicon, ingot and wafer production, and then melt the imported Chinese offshore wind farms, where Chinese white asbestos ends up in wind turbines to imported brake pads and hoist components sourced from third party suppliers in China, where the material is not prohibited and is now installed in service lifts that transport our technicians up.

The turbine towers in the North Sea. Would the Minister agree with me that all these essential steps in the supply chain must be taken into account when considering CO2 emissions? Globally, offshore wind turbines, which rely on powerful permanent magnets with neodymium, with praseodymium and with dysprosium, the supply of the latter being almost exclusively controlled by China. And if you add in the copper and cobalt from the Democratic Republic of the Congo, where child labour and high emission CO2 global warming mining takes place, pupils, children and teachers at the Richard Lee Primary School might not be so impressed.

Does the Minister not agree that if we were to transport all these vital elements of this massively misnamed, clean, home-grown supply chain, we could have an acreage which would be close to covering the Isle of Wight with CO2 belching factories and illegal working practices. And so I ask the Minister, how will parents, teachers and children at the Richard Lee Primary School regard that? My Lords, the state of the climate and nature is under threat, but sadly, the government's energy response in this statement is lamentable.
16:06
Earl Russell Portrait Earl Russell (Liberal Democrat)
-
-
Very good. My Lords, we welcome this statement. The science is absolutely certain that human induced climate change is beyond doubt. What has changed is how fast the impacts are arriving on our very doorsteps. This summer's heat waves in May and June caused as many as 2700 excess deaths. Transport systems strained, over a thousand schools closed and London Ambulance Service endured its busiest ever day. We are now. We are on our third heat wave of 2026 in 2026 is the first year the UK has reached 35 degrees in May, June and July consecutively.

Excess heat is putting a strain on every individual citizen, on our economy, on our schools and on our health systems. Europe is now confirmed as the fastest warming continent on earth, warming more than twice the global average. This government has been genuinely good on the energy transition, approving renewable projects to power the equivalent of more than 19 million homes. But nature has been the poor relation. Not a single new site of scientific interest has been designated in England since 2023. Our tree planting rate remains less than half the annual target.

Labour's messaging on nature has been muddled, its green mission too often undermined from within climate and nature, are not separate. They are co-dependent, a government, strong on one and weak on the other will ultimately fail at both. Our climate is changing faster than our policies. The Climate Change Committee's fourth independent assessment of the UK climate risk was stark on adoption. Not a single delivery pathway was rated as good. Inaction cannot continue. Three of our five worst harvests have been recorded since 2020.

Our food security is threatened. The Green Alliance has today written to Ministers to warn that the UK is built for a climate that no longer exists. An emergency action is needed. We must do far more faster on adaption. It is the vulnerable, the elderly, the sick, the poor and the workers who will suffer the most. These matters are hard and we cooperate and they become almost impossible when we do not. And I say with real regret that the Conservative Party's ever continuing retreat from reality, rejecting the 2050 net zero target, and now reportedly barring prospective candidates who continue to support it, is a betrayal of their own history and the consensus that this country requires.

To those who say that UK emits only 1% of global emissions, so why bother? Every major economy could say the same to those who say the net zero is impossible. I ask what is possible instead. British leadership only works if Britain leaves the wildfire risks this summer are at an extreme level, endangering lives and devastating habitats. Yet the government's wildfire strategy is still not ready, and we remain completely reliant on commercial aircraft to fight fires. We have had one mega fire already last year and we are not prepared for the next.

That must change before next year's El Nino impacts are felt on tipping points. The Minister, minsters say on tipping points, will the Minister say what more the government will do to strengthen monitoring of the Amoc circulation system? The government's National Nature Security Assessment warns that every critical ecosystem is on a pathway to collapse. If true, as I believe it is, the public and this House deserve to see the full assessment, not merely the summary. So I ask the Minister to commit to its publication in full.

The 30 by 30 delivery plan published yesterday is welcome, but it is insufficient. It leans too heavily on farmers and land managers volunteering with no statutory backstop, no guarantee that voluntary schemes will deliver at the scale which is required. Labour must stop doing things to people, start doing things with them. Give communities real opportunities to protect nature, launch a national campaign and provide an emergency briefing because misinformation is filling the gap left by government silence, fear alone will not sustain the public.

Throughout this crisis. We must offer hope and invest in young people who will live the longest with the consequences of what we decide. Finally, our climate and nature laws are out of date. I ask the Minister, will the government finally match strong words on climate with equally strong action for nature?
16:11
Lord Whitehead Portrait Lord Whitehead, Minister of State (Department for Energy Security and Net Zero) (Labour)
-
-
Yes.

**** Possible New Speaker ****

valuable contribution in. Responding to this. The statement, which. Is a repeat.

**** Possible New Speaker ****

Is a repeat. Of. The statement yesterday made in

**** Possible New Speaker ****

The statement yesterday made in the other place, the statement, as noble Lords will know, was about noble Lords will know, was about climate and nature, and particularly the extent, as indeed noble Lords such as the. Noble Baroness Jones repeatedly reminds us, you cannot disentangle one from the other. Climate change drives nature loss. Nature loss drives climate change. And if you tackle one and you don't do the other, you won't succeed in doing the first thing.

So the the idea that actually making sure that our environment is liveable within that it is a thriving environment for the purposes of nature, both extension and recovery is completely wound in to climate change. And the actions that we take against it in general. And what the statement yesterday in the other place did, I hope set out, was what action the government is taking in terms of that clear linking. And indeed, we can see just recently in terms of the most recent spending round, that the government put forward, unprecedented sums aside for nature development, recovery and restitution.

For example, they put enhancing and sustaining that production for the future by the changing in practices that farming can undertake. 8.816 million for tree planting, with three, among other things, three large national forests getting underway and, of course, £85 million for peatland restoration. Now, those are very practical things which actually tackle some of the key issues on nature degradation in this country. And I would suggest that the the government is indeed matching its words with a very substantial amount of investment in making sure that nature can live and survive in the right way for the future.

Now, the noble Lord, Lord Moynihan, for the opposition, did as I anticipated. He might concentrate rather more on particular energy and climate, climate change issues. What I would say is that those areas as well are very much tied into the nature climate change balance, because certainly, you know what you absolutely need in terms of a thriving background for nature is clean air, clean energy, clean environmental circumstances under which that energy is produced and an environment which allows nature to thrive.

Therefore, and I would suggest that actually solar power, for example, is one of the things that absolutely does that. So I don't recognise the noble Lords characterisation of the apparent inherent dirtiness of solar panels, the carbon payback for a solar panel is estimated to be just 1.05 years. I would agree with him to the extent that where the solar panel is made under circumstances where the production arrangements, shall we say, are little browner than they are in Europe, then that payback will be marginally greater.

But it's only 1.18 years, so I don't really recognise the characterisation of solar that the noble Lord puts forward. It is an integral part of bringing energy and nature together in terms of how we produce clean energy, and we produce a clean air at the same time. The noble Lord asks whether I will, in advance of the government, new government actually being in place, predict a number of things that they are about to do, which of course I won't.

But I would. I would remind the noble Lord that the jackdaw field is not a field that has not been explored. It is a field that presently Ministers are taking decisions on whether to proceed with. And of course I should not. I should not pre-empt that decision process, but I. He can be assured that decision process is underway. The. The final point I would I The. The final point I would I would I would put to his particular.

Points on this particular area is. The production of clean energy and low carbon is not about de-industrialisation and indeed, as. As he will know, the government has invested something like £61,000,000 billion over the recent period and has crowded in over £100 billion of clean, green, low carbon investment as as a process. So it is it is actually value added as far as its investment. And it is reindustrialising the country, albeit on a different level of carbon output in a way that we can see before us in terms of the British based requirements for a lot of both offshore wind and nuclear and various other things such as that, which means that a lot of this activity is taking place as industrial processes in the UK and creating green, low carbon jobs to replace those brown high carbon jobs.

As a result. Now the noble Lord, Lord Russell. Quite rightly talks about what is, I think, quite evident around us outside this chamber. This chamber, mercifully is reasonably cooled. But outside we are experiencing the hottest year in history. Last year and will undoubtedly break those sort of records again this year if we go on the way we are. So we are in a position of an absolute emergency as far as adaptation is concerned. We cannot just think about mitigation for the future.

And I agree with the noble Lord that there's a long way to go in terms of getting that adaptation right for the future. But I would also suggest that the the government is really, as it were, on the case as far as adaptation is concerned. I mean, we need to look, for example, at the record sums that have been put in place in terms of flood protection and flood relief, and indeed, the work that the government is doing at the moment in order to make sure that building regulations and various things such as that are actually climate change proof, as opposed to lagging behind as much of our society does at the moment.

But I would agree that there's a there is a long way to go, and I'm sure we will debate between ourselves how that process goes in the near future, but I thank him for his general support for the measures that the government has and is taking on climate change and nature, and look forward to his continued support in the future, I.
16:21
16:22
Lord Whitehead Portrait Lord Whitehead, Minister of State (Department for Energy Security and Net Zero) (Labour)
-
-
I did indeed not provide, I think, a complete answer to the noble Lord, Lord Moynihan, who put that forward as a as a thought in his contribution concerning farming. And indeed, he concentrated instead on mainly on energy and climate change. And that is what I responded to particularly. But I would say to the noble Baroness that we. We have indeed produced, as she will know very recently, the farming roadmap, which is a comprehensive roadmap of how indeed inform very substantially by farmers in the first instance, on how we can actually develop more sustainable farming.

And contrary to what the noble Lord says, that doesn't involve, for example. Removing a lot of livestock from farming practices, it involves more sustainable practices in. In general, it involves. Indeed, the. The noble Lord will, I'm sure, understand and agree with me that the agriculture and land use sector needs to make sure it's. Its emissions go down substantially. It's the one one of the two sectors that have actually flatlined as far as emissions are concerned in recent years.

But the question is how you do it, rather than simply say that there are particular things you have to do which are detrimental to the interests of farming. And I have already mentioned what is happening as far as the Elms arrangements are concerned. There are all sorts of other things. The project associated with that, such as things such as low methane feedstuffs for cattle, which are getting a lot of traction and a lot of interest in farming circles, which can actually reduce emissions very substantially without having to cull any livestock or cause people to change their eating patterns, or indeed change, cause farmers to do things other than farm in a more sustainable way.

That's the key to what we are trying to do as far as farming is concerned. And I hope the noble Lord and indeed the noble Baroness will support it.
16:25
16:26
16:27
16:29
16:30
16:30
16:31
16:32
16:33
16:35
16:36
Lord Barber of Chittlehampton Portrait Lord Barber of Chittlehampton (Labour)
-
-
A very sorry state of affairs, and we need to get to that as soon as possible in order that we can make the progress that we all know is absolutely necessary in the end.

**** Possible New Speaker ****

is absolutely necessary in the end. My. I. I had the privilege of. Chairing the Devon.

**** Possible New Speaker ****

Chairing the Devon. Land Use pilot. A few years ago, and what we learned is that people think in silos, but the solutions are in combinations on eczema, where you've got water challenges, you've got energy challenges you've got and contributions to these things tourism, mental health, exercise, housing, transport, wind, energy, water, all of these things, biodiversity. We've introduced white tailed sea eagles. We've introduced pine martens on Exmoor that you see the change happening and the real risk in this debate is that the debate is not sophisticated enough, and it falls into a set of false dichotomies which will frustrate us.

My question to the Minister is, in taking through this agenda they set out here, will the government think in the sophisticated way that I've just described about the broad areas of land, as our population grows and the challenges of every acre of land become greater and greater? And I haven't even mentioned food and farming, which set up the pilot that I've used. These are really important, difficult things, but we're not going to get there. My question is, are we by simply debating false dichotomies? dichotomies?
16:38
16:39
16:39
16:40
16:41
16:42
Lord Livermore Portrait Lord Livermore, The Financial Secretary to the Treasury (Labour)
-
-
Yeah. is a pleasure to open the Second Reading debate of the taxation, Energy and Vehicles Bill. The measures contained in this bill will support businesses across the UK as they deal with the immediate economic costs associated with the ongoing conflict in the Middle East. We did not start this conflict and we did not join it, but it is impacting our economy, including by putting pressure on energy markets and disrupting supply chains. Despite these pressures, the latest economic data shows that the government's economic plan is working.

Inflation last month held steady. Britain's economy was the fastest growing in the G7 for the first quarter of this year. Borrowing is forecast to fall in every year of this parliament and wages are continuing to rise. However, as the Chancellor has said repeatedly, we must continue to be responsive to a changing world and responsible in the national interest. That is why we have taken action to support businesses and families, including by reducing VAT on some activities from 20% to 5% and extending the £0.05 fuel duty cut until the end of the year, saving the average motorist £120.

Since last year, we have committed over £50 million to help those struggling with the cost of heating oil to support hauliers and farmers. We have cut red diesel by over a third until the end of this year, and to help reduce costs for energy intensive firms, we've expanded the British Industry Competitiveness Scheme to over 10,000 manufacturers. We are also providing targeted support to the chemicals and ceramics industries, protecting thousands of jobs and putting businesses on a secure footing for the long term.

The measures contained in this bill go further to protect consumers and to help firms to deal with rising prices. It covers three areas the energy generator levy, mileage rates and vehicle excise duty for heavy goods vehicles. First, the energy Electricity Generator Levy. The price of energy has risen since the war in Iran began, benefiting generators whose costs bear no relation to the price of gas. The government's objective is to ensure that those who benefit from these increased prices and volatility pay their fair share.

That is why, in our first budget, we extended an increase the energy profits levy. Last year, the Chancellor announced a new permanent windfall tax regime on oil and gas. In April this year, we went further still by announcing an increase to the rate of Electricity Generator Levy and extending it beyond its original sunset date of 2028. The Electricity Generator Levy recovers excess revenues made by generators who do not use gas or electricity prices over a long term average to ensure it does not disincentivize investment.

Any new investment since the 22nd of November 2023 is exempt from the levy. The increase in the main rate of the levy, from 45% to 55%, is legislated for in this bill before us today. The extension will be legislated for separately. The government will set out the fiscal impact of this increase at the budget in the autumn, with the costings certified by the OBR in the usual way. Raising the rate will help break the link between electricity and gas prices. Even though the UK is generating more electricity from sources such as nuclear and renewables, international gas prices still set the price of our electricity.

This means that when global gas prices spike, so do bills here in the UK. By breaking the link between gas and electricity prices, we can help to insulate consumers from the volatility of future crises. The rise in the Electricity Generator Levy will contribute to this by encouraging participation in the Wholesale Contracts for difference scheme, currently under a separate scheme known as contracts for difference, some electricity suppliers are guaranteed a stable fixed price for the electricity they produce. The new Wholesale Contract for difference scheme will offer certain existing eligible generators who are not already signed up to contracts for difference, the option to bid for a fixed price for the electricity they generate, increasing the rate of the energy generator levy will therefore increase the appeal of a fixed rate under the new Wholesale Contracts for difference scheme, in turn helping to protect consumers from volatile gas linked electricity prices.

The Department for Energy Security and Net Zero will come forward later this year, with a consultation on the Wholesale Contracts for difference scheme. The design of the post 2028 Energy Generator Levy will be considered alongside this consultation. My Lords, the second measure contained in this bill relates to mileage rates. As fuel prices have risen, so has the cost of filling up a car or van for those who drive for work. Despite this, mileage rates the amount that workers are reimbursed for every mile they drive have not changed since 2011.

This has created a significant gap between the amount it costs to run and maintain a vehicle, and the amount that workers are reimbursed for. In recognition of these pressures, the Chancellor has announced the largest ever increase to mileage rates and the first uprating in 15 years. As a result, mileage rates have now increased from 45 to £0.55 for the first 10,000 miles. Beyond 10,000 miles, the rate will remain at £0.25. This change will benefit employees using their own vehicle for work, and those who are self-employed and use simplified expenses rates.

The increase came into effect on the 6th of April, and the legislation before us gives statutory effect to this change. Overall, the increased rate will benefit around 2 million employees and 1 million self-employed individuals, saving over £120 a year for a worker doing 6000 business miles. While employers are not required to reimburse at the new rates set out, if employees are reimbursed below the tax free rate, they can claim mileage allowance tax relief directly from HMRC more widely. In March, the Chancellor announced a review of mileage rates as a whole.

This review is ongoing and will inform the budget this autumn. The third measure in this Bill concerns vehicle excise duty on heavy goods vehicles. The road haulage sector plays a vital role in transporting goods across the UK, but haulage firms are disproportionately exposed to higher fuel costs. That is why we are providing additional targeted support for the sector through this bill. With a 12 month holiday from vehicle excise duty for the majority of heavy goods vehicles. Eligible vehicles renewing their Ved in this period will pay a reduced annual rate of £1.

This will save a typical HGV £600, and those with higher liability will in some cases save more than £900. On top of savings from fuel duty, it will benefit around 46,000 UK based road freight firms. Taken together with other freezes to fuel duty since the general election, the average HGV has saved over £2,000 compared to the plan set out by the previous government. My Lords, this government has the right economic plan to deliver secure and resilient growth in a changing world.

But as we have seen, including over recent days, the war in Iran continues to create uncertainty and volatility in the global economy and therefore higher costs for businesses here in Britain. The government has responded by providing immediate support to help with these additional costs, including through the measures contained in this bill. These measures will ensure that electricity generators, who benefit from increased prices pay their fair share. They will support around 2 million employees and 1 million self-employed people who need to drive for work, and they will deliver targeted help to the road haulage sector, ensuring that HGVs remain on the road to deliver food and other products to communities right across the country.

This bill shows that in the face of global pressures, the government will continue to be responsive to a changing world and responsible in the national interest. I beg to move.
16:49
Baroness Neville-Rolfe Portrait Baroness Neville-Rolfe (Conservative)
-
-
This bill, be now read a second >> This bill, be now read a second time. My Lords. >> This bill. >> Is presented by the government

**** Possible New Speaker ****

Is presented by the government as a series of targeted measures designed to address a specific issue, the war in the Middle East, issue, the war in the Middle East, and I thank the Minister for his full explanation. But the truth is that what we are discussing is, in fact, a series of sticking plaster measures designed to kerb some of the worst excesses of what can only be described as an economy seriously in trouble. My Lords, the current government, and indeed the one that has to come under the leadership of Andy Burnham, faces a deeply serious situation.

Last week, the office for Budget Responsibility in their Fiscal Risks and Sustainability Report warned that without action, public debt is set to move on to an unsustainable upward path in the near future. A key finding is that early action to hit off difficult fiscal outcomes is much less costly than late action. Now, this is partly due to the sheer scale of our national debt. Last year, the government borrowed 129 billion, 80% of which was spent on debt interest.

In an increasingly jumpy bond market, the OBR estimates that an additional £28 billion a year would be needed to meet the government's critical pledge to spend 3.5% of GDP on defence. At the same time, spending on the state pension and on health is projected to rise sharply in the next few years. One of the reasons why I called for a cap on expenditure on pensions as a percentage of GDP in my independent review of the state pension age as long ago as 2022, and why I deplore the failure to hold a full House of Lords debate on the ten year plan for the NHS.

The Lords Economic Affairs Committee said much the same years ago about the unsustainability of debt. In their report, National Debt. It's time for tough decisions. The then chair, my noble friend and far sighted Lord Bridges of Headley, was quoted at the time as saying our national debt risks developing on an unsustainable path. Moreover, we're now spending more on welfare 334 billion than we collect in income tax 331 billion. The new Prime Minister and Chancellor of the Exchequer faced the choice of either significant tax rises or deep spending restraint.

If we are to stop debt from spiralling further out of control. Yet the OBR has also made clear that tax rises cannot simply be treated as a limitless answer. Continually increasing taxes risk, creating ever greater economic distortions, with the Laffer curve biting into receipts. For example, if the top rate of income tax goes up, wealth taxes raise less than expected, as we know from overseas experience, and they certainly damage competitiveness. Further stealth taxes on earnings risk, weakening work incentives and drag more people out of the labour market.

So the key to squaring the circle, as I've discussed with the Minister on many occasions, is growth, particularly per capita growth or higher productivity. EU growth has been sluggish. Yet the government wants to get closer to the EU and agree to a package of changes, which will certainly cost hundreds of millions a year. Given the difficulties of negotiating with the EU with no certainty that it will improve our economy to the extent hoped. I am also concerned about the impact on our legally binding obligations under Cptpp and our agreements with the US, particularly on vehicles which will come to later, and on farmer agreements that are vital to UK growth.

And I ask a question, what is the nature of the legal advice that the government is relying on in saying that they will continue to deliver such international obligations once a revised T is agreed? My Lords, the government's assault on business rises in National Insurance business rates and dividend and capital taxes, and the Employment Rights Act is already having exactly the effect on business that we forecast. With employment squeezed and a crash in economic optimism and and enterprise. A report this week from accountants BDO showed that business activity dropped sharply last month after a brief rebound earlier this year ran out of steam.

My Lords, my Lords, the truth is that there is a deeply serious situation facing Mr. Burnham and we can't divorce our discussions today from this bank robber. Which brings me on to today's bill. Increasing mileage payments to £0.55 for the first 10,000 business miles is a measure we support. It is right that workers who use their own vehicles for work, including carers, should not be left to absorb rising motoring costs. Now I know that the announcement was the early fruit of an ongoing review, as the Minister explained, but can the noble Lord, the Minister, tell us about the logic behind the difference in treatment for hard working carers and others who drive more than 10,000 miles a year? I turn to the HGV vehicle excise duty holiday.

HGV duty had been frozen since 2014 until Labour came into office, but reducing it to £1 for a year. Whilst it will provide some welcome relief to the sector. Does not solve the problem. Ministers should not overstate the impact. More than 95% of road haulage firms are small businesses operating on tight margins. The government say the measure will save around £600 for a typical lorry and £900 for the largest vehicles yet, to put it into context, at peak prices, filling a single HGV can cost more than £1,000, so this does not offset the wider pressures that the government have imposed through higher business rates, transport, taxes and fuel duty, with duty and VAT receipts, of course rising whenever petrol prices spike.

If the government is serious about supporting businesses, particularly small businesses in this country, then they must consider this policy as one of a series of changes they must make to create a tax and economic environment which backs business, especially small business, rather than penalising it. I turn now to the Electricity Generator Levy. This was introduced under the last government as a temporary windfall tax and a short term response to exceptional circumstances. It was due to end in 2028. However, what we now see is the government proposing to increase the rate from 45 to 55% and to extend it beyond 2028 with no end date.

The case put forward by the government is that the increased rates will support the decoupling of gas prices by incentivising generators into voluntary wholesale contracts for difference. However, while the new higher levy applies from today, those new contracts are yet to be seen. The proposed strike price is, I believe, not known. The likelihood of generators accepting them is therefore unknown and in question, and the value for money for taxpayers is yet to be proven. Moreover, the HMRC impact note for this bill contains no figures for the Exchequer impact.

We should have had that ideally now, or at least during the consultations the Minister referred to. Rather than acting to lower energy costs by taking sensible steps to increase the supply of energy, such as utilising our resources in the North Sea and moving forward with Jackdaw and Rosebank. The government seems to be using tax as a long term lever to alter the incentives faced by generators. Another measure we introduced was a short term emergency measure with a clear sunset date.

Sunsetting is a responsible approach to temporary taxation and to short term regulation, which I think can be very useful. It helps to avoid the accumulation of too much regulation. And I know the Minister worries about unjustified accumulation because it can have an adverse effect on productivity. Sunsetting has the merit of allowing periodic parliamentary scrutiny, and of encouraging fiscal officials to think creatively about other routes to a desired end. Instead, the government appear to be moving to a long term final answer when the relevant contracts for different parameters are unknown and untested.

Before the noble Lord, the Minister asks, as he sometimes does, what we would do. The official opposition have been clear. We would cut bills for businesses and consumers through our cheaper energy plan. We take VAT off energy bills. We would access the carbon tax and legacy subsidies, and we would again use our resources in the North Sea, as the Norwegians are doing. Tax cannot and should not be the long term solution to the problem of affordable energy. I might remind the Minister at this juncture of the OBR's warning.

They also agree that tax cannot be the solution to all of this. As we can see on page 81 of their report. There is a significant fiscal cost to the commitment to reduce carbon emissions to net zero by 2020 due to the loss of revenues linked to such emissions, and this is particularly true of fuel duty, with three quarters of the decline in revenue due to the transition to electric vehicles. This is a good example, I believe, of the difficulties government face in relying so heavily on taxation to finance spending.

My Lords, this bill contains measures which, in isolation are not without merit, but these measures must be seen for what they are limited interventions against a backdrop of rising costs, of weakening confidence and increasingly strained public finances. Temporary relief has its place, but it is no substitute for a serious growth strategy. A competitive tax system, disciplined public spending and an energy policy that brings costs down by increasing supply rather than by reaching for higher taxes. That is the test by which this bill should be judged.
16:59
Lord Redwood Portrait Lord Redwood (Conservative)
-
-
My Lords, I fully support my noble friend Baroness Neville-Rolfe noble friend Baroness Neville-Rolfe in her general statement about what needs to be doing and in her needs to be doing and in her specific criticisms and support for measures in this Bill. It is right that the best way out of the financial hole the government finds itself in again is by growth. And that, I think, is a cross-party idea, which all agree. But unfortunately, this government has one main hope, which is that a closer relationship with the EU and taking more EU laws into our own system will give them extra growth, whereas all the evidence of the past shows the opposite will happen.

Our growth rate actually halved when we were in the EEC, compared with the 20 years before we joined it, because of the damage laws and extra taxes were doing to our economy. After we had signed up to first, the customs union and then the complete single market. And if we look at the reset leaks and possibilities, it's practically all cost and no benefit. It's Britain giving in. It's Britain becoming a rule taker. The rules will be more restrictive on some of our industries, which were beginning to benefit from not having to take on all the extra EU rules they they've been legislating and there will be a considerable financial bill with the extra costs of Erasmus and the administrative levies and maybe a solidarity levy and the loss of 6 billion of fish over a 12 year period.

So I'm afraid the government won't find the growth there. But we are today focusing on this, this set of three limited measures. And like my my noble friend, I think two of them are modestly beneficial and seems perfectly reasonable to increase the mileage allowances given the way costs have gone over recent years and something the previous government hadn't done. And that therefore is perfectly welcome. And it is, of course, helpful to a haulage industry in great distress, both because volumes aren't ideal and because wage and tax costs have gone up, and because energy costs, above all, have gone up to give them some relief.

And the government's chosen a rather modest form of relief in this VED reduction. But I think I have two criticisms of it. The first is, I'm not sure a year is the right period for it. I don't think we can guarantee that miraculously, in a year's time, other costs will reduce and that therefore they won't need this help anymore. It would have been wiser to keep it open ended to see what is going to happen, particularly to the the energy costs.

And it also is concentrated on the heavier and bigger end of the commercial fleet. And there are a lot of other businesses, particularly small businesses, struggling with the cost of smaller vehicles where there is no, no help offered. So I think that is a pity, and it would be good if the government looked again at the full range of businesses and the question of duration, because it may be that this judgement, whilst helpful, doesn't go far enough and maybe not over the right time period.

But the biggest item that I object to quite strongly is the generator levy. Now, it is quite true, as the Minister has pointed out, that this was first introduced by the previous government. I liked it no more then than I like it now, and I did make critical remarks to Ministers trying to get them not to do it. If you are going to impose a windfall tax, it should be a genuine windfall tax, which should therefore be geared to a level of price or a level of profit, which you have decided to designate as being windfall.

And what has happened is that the last government and now this government is building this windfall tax into all its budgets as a regular feature, regardless of what the international price of oil and gas or the regional price of gas turns out to be in the months or years ahead, it would be much more convincing as a windfall measure if it were geared to a price target and or a profit target, and came in and was fiercer when there was genuine windfall profit and dropped out as soon as there wasn't windfall profit.

And the Minister will know, observing world markets that even with the continuing uncertainty created by both the Ukraine war and by the war in the Middle East, we are seeing pretty big, volatile swings, particularly in the oil price. That will make a huge difference to profitability of the businesses that are being taxed through through windfall taxes. So I would like the government to think again about the whole principle of windfall taxation. And if it does want a windfall tax, it should be targeted and very clearly based on genuine windfall profits.

But I have one final further worry about the government's strategy over energy, which is illustrated by the sort of tinkering measures in this piece of legislation. The government has gone in favour of very dear energy, with very high carbon taxes, emission trading taxes and general impositions, fuel duties and all the rest of it. It says it's got net zero reasons for it, but I think it's also got revenue raising reasons for it. It sees it as one of the easiest ways without violating the Central Manifesto pledges.

And it now realises correctly, that it is overdoing it, that the cost of energy with all the tax is extreme in this country has a particularly virulent case of this making it uncompetitive and losing US jobs and business, and therefore other tax revenues. So now the government is in the business of finding ways of parcelling out modest subsidies or rebates on this excessive taxation in the hope that that will see them through and would enable them to keep some business going.

And I fear they should come to the conclusion they're not giving enough back to enough businesses and people. And so look out there in the marketplace, Ministers and you will see jobs being cancelled, vacancies not becoming available, jobs being lost, turnover not growing, profits turning into losses, factory closures coming through in all the high energy using areas that we've talked about before, closure of oil and gas, having knock on effects to refineries, refining and petrochemicals. So we see an industrial collapse, mainly led by and generated by excessively expensive energy and offering a few bits back and not going to solve the problem.

I'm glad the government is now expanded the number of businesses that will get some kind of energy rebate to 10,000. But that's by no means all the businesses out there that are suffering badly from energy, and they're not offering enough back because they are taking lumps out and wish to make it worse by joining the even more expensive EU carbon trading and emissions trading schemes and introducing the Cbam to catch anybody who dares to import higher energy using products. So please, government, think again.

I want you to succeed in creating more jobs, in promoting growth, getting investment, getting incomes up. This does the opposite. Dear.

**** Possible New Speaker ****

Energy is a killer. I will confine my comments to

**** Possible New Speaker ****

I will confine my comments to clause one of the Bill, which increases the rate of Electricity increases the rate of Electricity Generator Levy from 45% to 55%, are fully support this increase and fully support this increase and wish it had been actually higher. Despite various initiatives that
17:08
Lord Sikka Portrait Lord Sikka (Labour)
-
-
were mentioned by the Minister of Jim's marginal pricing system remains fundamentally flawed and ultimately determines consumer prices and in the process, showers profits on companies that are generating electricity. The Ofgem cap is not based on average cost or weighted average cost of all the inputs, or indeed any notion of actual cost. One of the ofgem's objectives is to ensure profit for each supplier at each stage. In other words, at generation, transmission, distribution and retail. This means that that the Ofgem cap is set at the most expensive price or cost per unit.

Otherwise, the marginal producer, which is the most expensive producer, cannot make a profit. This is reverse of what happens in competitive markets, where the most expensive producer is driven out of business. Off. John Ofgem's pricing formula is a boon for companies generating electricity from oil, nuclear, renewables, solar, wind, hydro and other forms of inputs because they are paid the price of electricity produced from gas, which is usually the most expensive input. So the bill does not reform Ofgem's pricing formula.

It does not fully decouple the price of gas produced electricity from the rest. Instead, it takes a little bit more of excess profits via the levy. Even with 55% levy, electricity generators still be able to keep 45% of the excess profits manufactured by a flawed Ofgem formula. They have already kept billions of excess profits. What is the excuse for letting them have more still keep more? The government's rationale is that the revenues resulting from this bill will help to subsidise some businesses and and households, but it won't help all households and all businesses, and does not really provide a long term relief from profiteering by energy companies.

A study by unite reported that since the pandemic, electricity and gas supply companies have increased their profit margins by 363%. Electricity generation companies have increased their profit margins by 198%, but successive governments and Ofgem have made no attempt to reduce profit margins of electricity generators. Hopefully the Minister will comment on this. Can he also explain why is Ofgem's marginal pricing system not abandoned and the price of gas produced electricity, price of gas produced electricity not fully decoupled from the rest? Can he also explain how much excess profit has been facilitated by Ofgem's pricing formula, and what proportion has been or will be recovered by the Electricity generator levy? It is also worth noting that the returns to energy investors are much higher because of the flawed UK tax laws.

Just to provide a background before I provide some detail. So the background statistics are that 80% of UK offshore wind wind generation is foreign owned. The largest onshore wind farm in Wales is owned by a Swedish entity. EDF is 100% owned from France. EE is based in Germany. Scottish Power is owned by a Spanish multinational. The shareholders of their UK operations, which who are mostly based abroad, receive billions in dividends without deduction of tax at source.

In other words, they pay no tax whatsoever on those dividends. This results in huge loss of tax revenues, which could help the government to increase support for energy customers. Countries such as the US, Australia and Sweden deduct a withholding tax at source on dividends paid to foreign investors. They make a distinction between investors resident in tax treaty countries, EU countries and non-cooperative tax havens. So can the Minister explain can the Minister explain why the government does not do the same, and why it is content to forgo billions of tax revenues by not having a withholding tax? I am also concerned about the lack of good energy infrastructure.

Since privatisation, National Grid has paid £28 billion in dividends, plus millions more in share buybacks. But we don't actually have a good energy infrastructure. This is similar to the woes of the water industry. This week, it has been reported that Britain's biggest community solar projects has been forced to shut for the duration of its first summer by the government's energy system operator, to avoid overloading the local grid with renewable energy during periods of high wind.

The government pays companies up to 180 zero zero £0 an hour just to switch off wind turbines. At the same time, gas plants are paid extra sums to produce more electricity to balance the system and meet demand for the period September 2021 to April 2025. The cost of balancing the electricity grid came to £11.8 billion and is expected to hit £8 billion a year by 2030. So can the Minister explain why, after 36 years of privatisation, National Grid and other energy companies are not penalised for failure to provide a good and reliable electricity transmission and storage system? I look forward to

**** Possible New Speaker ****

hearing the minister's reply. I'm going to contribute.

**** Possible New Speaker ****

I'm going to contribute. In two parts. Firstly and briefly. It's about time. That the mileage. Rates went up to £0.55. It

**** Possible New Speaker ****

Rates went up to £0.55. It reflects the obvious truth that the cost of getting about has become more expensive, and these real more expensive, and these real costs must be covered. So I welcome this measure insofar as it goes, but would observe that it would
17:15
Lord Fuller Portrait Lord Fuller (Conservative)
-
-
but would observe that it would have been much better had the rates been indexed for future years so as to avoid these cliff edge effects. And I also support the support for our hard working lorry drivers. I know from personal experience, when I used to run trucks myself, how hard it is to make a living from road transport. In fact, we paid £1 million of tax per year on faulty vehicles before a single penny in corporation tax. The tax man has the first pull on the road, but I want to turn to the generator levy and this is just another line in taxes, fees, charges and levies that have taken the aggregate burden of taxation to new highs, pressing down on our economy and squeezing the dynamism from it.

Labour thinks they're going to tax the generators, but as we all know, these levies work through and are borne by the consumer. So this bill is just adding just another layer to the cost of living. My Lords, last week the lights nearly went out for the third time this summer, Neso broke the glass to plead generators supply to supply more electricity, any electricity at any price. They've never had to ask for margin in the summer before. And on Friday last week, The Times reported that Britain was close to blackouts, but the scale of the crisis was hidden.

So let's shine a light on that. The times reported that the staff at Neso alleged that for multiple periods on June the 23rd, the grid fell outside safe operating limits. At the time, the grid was using all available power to meet demand, meaning that any single one of these had failed. It would have triggered an automatic system shutdown, causing power cuts across the country. There have been other cases since the government's impact assessment for this bill says it is not expected to have any significant macroeconomic impacts.

All the boxes where the fiscal assessments would normally be written are empty. The government website tells us that the Exchequer Secretary to the Treasury has read this information and, given the available evidence, concludes that it represents a reasonable view of the likely cost, benefits and impacts of the measure. My Lords, as Britain sweltered, it turned out that 420 of our critical cool chain food warehouses that store half our nation's food could barely keep their contents cool enough. My Lords, in Spain, when the lights went out, people on life support machines died.

Indeed, if last week it wasn't for the kindness of strangers in France, the lights would indeed have gone out. If we meet them in the World Cup in ten days time, I wonder, well, who knows what will happen? Is this the impact the Exchequer Secretary had in mind? Because Labour has bought us a grid that is demonstrably more fragile, wholly less reliable and significantly more expensive. It has brought our manufacturing economy to its knees with the world's highest energy electricity prices, and this measure will make them more expensive.

Still, we might have expected a margin call in January, when short day lengths and low winds, combined with high demand for heating, can cause a shock that's expected and planned for and avoided. But not in the summer when we're told that solar panels will make us more energy secure. So this measure will have the significant additional unintended consequence beyond jacking up prices. Quite simply, it makes the cost of generating electricity more expensive, so it harms the investment case for building new power stations.

So we become even more reliant on the kindness of strangers. And the reason high price we have high prices is that supply is constrained. We have reduced the competitive tension in the market with an overly focus on renewables. And the truth is that this measure will harm the generating fleet replacement of our power stations as they wear out. The hard truth is that when the person in the NIS control button control room presses the button, we need energy generators to supply.

And there's nothing wrong with having power stations ticking over, but available to leap into action when the call to action is made. If the price is high enough, that's how the market works. And in these moments, given a choice of having the lights go out or paying through the nose, we need to pay up and look big. But when we are in that hole and need these people to jump to attention, increasing the levy from 5545 to 55 is biting the hand that feeds us at the very moment we are in greatest peril.

This generator levy reduces the incentive for companies to participate in the break glass market. Unless we accept that the wholesale price is driven higher still. And my Lords, I can hardly believe what I'm about to say, because I agree with the noble Lord Lord Sikka that this isn't the way to fix the energy market. Have even more levies. It needs reform because crowd pleasing price caps and rent caps such as this will never work. We need reform of the energy market to break the link with gas.

But this isn't the way to do it. My Lords. Disincentivising the replacement of our power stations is going to lead to something worse and wholly more sinister. There are special types of power station that must be spread throughout the grid in order for it to function properly. These power stations provide grid frequency stabilisation and ensure that power matches electricity supply with the right frequency. Tightly controlled around 50Hz. In fact, keeping within 1% of that 50Hz figure is a legal obligation for NIS.

Otherwise, we all get contagious blackouts and equipment damage. So these inertial power stations have special value value that must be paid for, and value that is perversely brought within the scope of this measure. My Lords, we have a structural risk on our grid that there are only two of these special power stations north of the River Humber, and both are scheduled for closure and none for replacement. With more levies, there are less incentives to to build their replacements. So this bill is laying the structural framework for the entirety of the electrical grid in our nation, which extends to Ireland, but especially in the north of England and Scotland.

To fail by disincentivising the replacement of the special power stations that maintain the frequency that protect our economy. Perhaps the noble Lord, the Minister should have a word with the Exchequer. Secretary to the Treasury in the few days he remains in post to explain that there are, after all, plenty of consequences to this Bill. In the meantime, this is where Labour's ignorant energy fundamentalism has brought us. It's not that the lights normally go out under Labour, it's that this government is

**** Possible New Speaker ****

legislating to ensure that they do. My Lords, from these benches, we

**** Possible New Speaker ****

My Lords, from these benches, we are broadly supportive of this Bill. It contains three sensible, if modest, measures responding to the modest, measures responding to the very real pressures households and businesses face because of the ongoing conflict in the Middle East, ongoing conflict in the Middle East, and we will not oppose them. Our wish is for the government to do more to protect the public and the
17:23
Earl Russell Portrait Earl Russell (Liberal Democrat)
-
-
more to protect the public and the economy from the impacts of this continuing conflict, and to see these measures are monitored, reviewed and reported on. I note that the fragile ceasefire, which many had hoped would bring stability to the region, has now completely broken down again. We have now had three days of American attacks on Iran. Iran has struck numerous tankers in the Straits, and Trump is now talking of imposing a toll on all ships that are exiting the Straits.

The cost of oil has shot up again overnight. So, my Lords, this conflict is far from over and its consequences for the UK in terms of energy prices, fuel costs and the cost of living will continue to be felt for some considerable time. I seek reassurance from the Minister that today's measures must not, and will not be the limit of the government's ambitions. They are welcome, but they are minor in scale. This bill does little to bring down the underlying cost of energy, particularly electricity, which remains stubbornly high and unreasonably high.

In brief, the bill's three measures are an increase in Electricity Generator Levy from 45 to 55%. Targeted, exceptional returns when wholesale prices spike, an increase in the approved mileage allowance rates from 45 to £55 per mile for the first 10,000 miles, backdated to the start of this year, and a 12 month vehicle excise duty. VED holiday for most heavy goods vehicles. Renewing their licence between the 1st of July 2026 and the 30th of June 27, reducing their liability to a nominal £1 on the mileage rate.

I echo the point made by my hon. Friend for Saint Albans. In the other place, that this increase is long overdue, and it will particularly benefit those who work in the care sector. Can I ask the Minister what steps the government will be taking to ensure that care workers are made aware of it on the vehicle excise duty? All hauliers have understandably welcomed the relief and we are supportive of it. Can I ask the Minister, given the conflict's impacts represent ongoing costs beyond the 12 months, can I ask why the government didn't consider giving themselves the power in this legislation to possibly extend the holiday for a further year, without the need to bring back further primary legislation? I ask what confidence the government have that this relief will be passed through also to consumers, rather than absorbed elsewhere in the supply chain.

The public would rightly be concerned if haulage costs continue to rise. Can I also ask what monitoring is planned, and will this be reported at least by the autumn budget, or is there an option to do that sooner? On the Electricity Generator Levy? We have long argued for exactly this kind of decoupling of electricity prices from the volatile gas prices. That this increase is said to encourage, and we support that objective, although we don't feel that this measure alone is capable of doing that.

Can I ask the Minister to assure the House that this levy increase will not undermine those ambitions? The levy increase is, in effect, the stick of the carrot of longer term contracts, and the interaction between these two policies is actually quite a complex matter. So can I ask, how will the government keep the overall objective under further scrutiny? A higher rate is only a proxy for the real goal of moving legacy generators. Off spot price exposure and onto newer fixed term contracts for difference.

I will be grateful if the noble Lords Minister could set out how progress on the actual migration to CFDs will be monitored and reported, because without that information, it's quite difficult for Parliament to be able to make a decision or a determination on actually the how this policy objective, this wider policy objective, has been achieved more broadly. Will the Minister confirm that should this conflict continue, the government will bring forward further measures as needed and keep both houses updated? My Lords, we are supportive of this Bill and it sits along, but we do feel it needs to sit alongside much wider set of proposals that we believe are required, and indeed, many across the House have strayed beyond the measures in this bill into border areas.

My party have called for a three month extendable emergency transport package to keep Britain moving and immediate MP cut in fuel. A cap on bus fares at £1, a 10% cut in rail fares and a reduction in VAT on public electricity charging. We have also set out a permanent essential energy guarantee, giving every household a discount on their energy use, with vulnerable and larger households receiving more, and we continue to press for the wider structural reforms that would genuinely bring down bills for good and energy security.

Bank offering low interest loans for home energy improvements, reversing cuts, cuts to insulation programmes so that we can halve energy bills within a decade. Can I ask the Minister, can we expect a serious and detailed plans to come in the Energy Independence Bill to make sure that our cost of energy is reduced, and particularly the cost of electricity, which, as I know, the noble Lord is aware, we need to bring down so that we can get people on to EVs and on to heat pumps.

The cost of electricity remains too high. The crisis in the Middle East is not resolved, and much remains to be done. Should it continue and deepen, we stand ready to work in cooperation with Ministers and government, to protect our citizens and our economy from the worst of its impacts.
17:29
Lord Altrincham Portrait Lord Altrincham (Conservative)
-
-
I want to thank all the noble >> I want to thank all the noble Lords who have spoken in this debate, and to thank the Minister debate, and to thank the Minister for his usual courtesy in hosting the debate, and also for his explanation of the rather undefined windfall tax that my noble friend talked about, and in particular, to note the lively contributions of my noble friend Lord Fuller and also Lord Sikka, who both touched on the rather fraught area of the contract for differences and high wind.

And maybe the Minister could comment on that. As we have discussed, this bill contains some small and mainly useful welcome measures. The government's recognition that more must be done to support small businesses is also a step in the right direction. However, the difficulty we see is that while such measures may have a place as emergency, short term relief as the last government recognised, they cannot form the basis of a sustainable long term economic strategy. More widely, noble Lords will be aware that the interim report of the Tims Review of Disability Benefits spending was published last week, and it showed that spending is forecast by the Department for Work and Pensions to rise to more than £41 billion by 2031.

On that benefit alone, as my.

**** Possible New Speaker ****

Noble friend and other noble Lords have made clear, the office for Budget Responsibility has warned that taxes will have to rise warned that taxes will have to rise or spending will have to be cut if we are to avoid an unsustainable path for debt. But the tax rises path for debt. But the tax rises this government have already imposed are themselves becoming unsustainable. They are penalising unsustainable. They are penalising businesses, tourists, publicans, workers and those who want to come to this country to generate wealth, to this country to generate wealth, investment and employment.

A more sensible approach would be to take steps to increase domestic energy supply from the North Sea, to support growth and ensure that any tax reliefs are matched by credible reductions in spending. The government's net zero approach has weakened our domestic energy industry and left us increasingly dependent on global supplies, including from countries that continue to support Russian oil. In the latest round of sanctions, the government left open a loophole for Russian oil that is refined into diesel and jet fuel in third countries.

Indeed, we are now in the extraordinary position of relying on adversaries and on

**** Possible New Speaker ****

global supply chains shaped by them to meet demand that we could and Should be meeting through domestic energy production. That is domestic energy production. That is bad for our economy and has led to a degree of industrial collapse, as noted by my noble friend, Lord Bedford. It's bad for energy security and bad for our standing in the world. What we need from in the world. What we need from this government is a serious plan to address the underlying problem. Spending must be brought under control and quickly.

If we are to control and quickly. If we are to keep public finances within the bounds of sustainability. Welfare would seem an obvious place to start, but any new government will need the political courage, discipline and authority to deliver reform at the scale required. The wider economic challenge facing the government will only become more serious if this is the approach that the new administration, under the incoming Prime Minister takes to the economy, to energy security and to fiscal policy. My Lords, it is a pleasure to close this Second Reading debate on the taxation, Energy and Vehicles Bill.

I am very
17:32
Lord Livermore Portrait Lord Livermore, The Financial Secretary to the Treasury (Labour)
-
-
grateful to the select Group of noble Lords for their contributions and questions. The measures and questions. The measures contained in this Bill will support businesses across the UK as they deal with the immediate economic costs associated with the ongoing costs associated with the ongoing conflict in the Middle East. We did not start this conflict and we did not join it, but it is impacting our economy, including by putting pressure on energy markets and disrupting supply chains. That is why, as the Chancellor has said why, as the Chancellor has said repeatedly, we must continue to be responsive to a changing world and responsible in the national interest.

The noble Lady Baroness Neville-Rolfe once again unfortunately sought to talk Britain's economy down in her contribution. Yet the latest economic data shows that inflation in the UK held steady while it rose in other comparable countries. The noble Baroness and also the noble Lord Lord Redwood spoke about economic growth. They didn't mention that Britain's economy was the fastest growing in the G7 for the first quarter of this year, and Baroness Lloyd of Effra also spoke about debt. Borrowing is forecast to fall in every year of this Parliament.

The measures contained in this bill cover three areas the Electricity Generator Levy mileage rates and vehicle excise duty for heavy goods vehicles. The noble Baroness Donaghy noble Baroness Neville-Rolfe seemed keen to talk about almost anything other than the measures contained in this bill, but when she did focus on them, she said that they were just short term measures. A point also made by the noble Earl, Lord Russell. I disagree the measures contained in this bill will provide important, immediate support to families and businesses as they deal with the consequences of the war in the Middle East, including the largest ever uprating to mileage rates and a significant reduction in vehicle emissions duty for haulage firms.

The increase to the Electricity Generator Levy also forms part of a wider long term strategy to de-link gas from electricity prices, helping to shield consumers from the impact of volatile prices. But as I said, I set out in my opening speech they are. They form just one part of a wider support we are providing to households and businesses, and we stand ready to go further where necessary. The noble Lady Baroness Neville-Rolfe also asked about North Sea oil and gas. She knows that I agree with her that North Sea oil and gas production is an important and valuable resource, and its workforce is a vital asset to our country.

That is why we are harnessing our domestic supply by managing existing fields for their entire lifetimes, including by allowing tiebacks to those fields to ensure that they remain viable. The first measure in this bill concerns electricity Electricity Generator Levy. The price of energy has risen since the war in Iran began, benefiting generators whose costs bear no relation to the price of gas. The government's objective is to ensure that those who benefit from these increased prices and volatility pay their fair share. That is why we are delivering an increase to the rate of Electricity Generator Levy from 45% to 55%, and extending it beyond its original sunset date of 2028.

Raising the rate will ensure that a greater percentage of exceptional generator revenues is made available to support businesses and households, and it will help break the link between electricity and gas prices by encouraging participation in the new Wholesale contracts for difference mechanism. The noble Lady, Baroness Neville-Rolfe, asked about the end date to the government plans to extend the Electricity Generator Levy beyond 2028 in order to encourage participation in the new contracts for difference mechanism and therefore provide more certainty to firms by offering a fixed price for the electricity they produce.

We work closely with industry to design the post 2028 Electricity Generator Levy regime. DESNZ are planning to publish a consultation on the new contracts for difference mechanism later this year, and the design of Electricity Generator Levy will be considered alongside this consultation. The noble Lord Lord Redwood criticised the government's energy policy overall. My noble friend Lord Whitehead set out, I think, in probably greater detail than I can in answer to the in to the noble Lords question in the previous debate.

As the noble Lord knows, we are in this country particularly exposed to volatile gas prices, not least because the previous government failed to invest in renewables. We need to invest in an economy that is as low carbon and not gas based as possible. And by delinking from gas. A key part of of the measures contained in this bill, we can help to separate the price of electricity from the volatile price of gas internationally. The noble Lord Lord Fuller said that we would increase the cost of electricity, but actually helping to delink from gas will actually do, I believe, the exact opposite.

The noble Lord Lord Fuller also said that these measures would disincentivise future investment. It clearly won't because Electricity Generator Levy has strong protections for new investment after 2023, which are exempt from the levy. The Electricity Generator Levy is only levied on legacy renewable generators, who stand to make extraordinary profits when high gas prices set the wholesale price without any commensurate increase in costs. The noble Lady Baroness Neville-Rolfe, asked about the Wholesale Contracts for difference scheme. Businesses have welcomed the announcement of the scheme and the certainty that these contracts will provide with them for years to come, the chief executive of the CBI said if implemented correctly, voluntary contracts for difference could reduce the impact of gas on retail electricity prices and ensure the benefits of clean power can be realised across the country.

It is right that we now work closely with businesses on the detail, which is why businesses will have the opportunity to respond to the consultation. DESNZ are planning to run later this year. My noble friend Lord Sikka asked a series of questions, which I will look at in greater detail and write to him if I am able. My Lords, the second measure contained in this bill relates to mileage rates. I am grateful to the noble Lords Lord Redwood and Lord Fuller Lord Altrincham and the noble Lord, Lord Russell, and the noble Lady Baroness Neville-Rolfe, for their support for this measure.

As fuel prices have risen, so has the cost of filling up the car or van for those who drive to work. Despite this, mileage rates have not changed since 2011. In recognition of these pressures, the Chancellor has announced the largest ever increase to mileage rates in the first uprating in 15 years. The noble Lady Baroness Neville-Rolfe, asked about how the government determined these uprated rates in determining these rates, the government considered the need to respond to the effect of the war in the Middle East on fuel costs after a prolonged period with no change, while balancing support for individuals with overall fiscal responsibility.

She asked about the £0.25 rate. Our objective has been to focus support where costs are highest. The vast majority of drivers travel fewer than 10,000 miles a year. The £0.25 rate above 10,000 miles reflects the marginal cost of driving falls as mileage increases, with fixed costs such as insurance servicing and depreciation covered by the higher £0.55 rate. Petrol and diesel. Motorists, including those who use their own vehicle for work, will also benefit from the extension of the £0.05 fuel duty cut to the end of this year.

The noble Lord Lord Fuller mentioned indexation. The decision the government has taken on mileage rates is the targeted response to current cost pressures. The review, announced by the Chancellor in March, will consider the rate beyond 2020 627. Annual indexation is not currently the government's policy. The government has already committed to a review of these rates and will set this out at the budget. The noble Lord, noble Lord Russell, asked about communicating to care workers. As he may know, the trade union unison has warmly welcomed this measure and I believe will be communicating actively to their members.

The third measure containing this bill is the vehicle excise duty on heavy goods vehicles. The road haulage sector plays a vital role transporting goods across the UK, but haulage firms are disproportionately exposed to higher fuel costs. That's why we're providing additional targeted support for the sector through this bill. With a 12 month holiday from vehicle excise duty for the majority of heavy goods vehicles. The noble Earl, Lord Russell, asked about the power to extend this further beyond one year. That's perfectly possible in future finance bills and would not require any additional primary legislation.

The noble Lord, Lord Redwood, asked about smaller vehicles being included in this beyond just HGVs van drivers, for example, will benefit from the decisions we have taken to extend the fuel duty cut to the end of this year. Those who use their own vehicle for work will also benefit from the mileage rates increase in this bill. That includes 163,000 van drivers currently estimated to be claiming simplified expenses. It is right, though, that the government balances direct support for firms with overall fiscal responsibility.

Extending this measure to vans would cost an estimated 1 to £1.5 billion a year, but we will continue to keep this issue under review. The noble Lady, Baroness Neville-Rolfe asked about the impact of other taxes. Typical HGVs will save £600 or 912 £912 for more HGVs, with higher vehicle emissions in total. The decision taken since the general election to freeze fuel duty will save HGVs over £2,000 for the average HGV compared to the previous government's plans. My Lords, this government has the right economic plan to deliver secure and resilient growth in a changing world.

The war in Iran continues to create uncertainty and volatility in the global economy, and therefore higher costs for businesses here in Britain. The government has responded by providing immediate support to help with these additional costs, including through the measures contained in this bill. This bill shows that in the face of global pressures, the government will continue to be responsive to a changing world and responsible in the national interest. I beg to

**** Possible New Speaker ****

move. The question is. That this bill be now read a

**** Possible New Speaker ****

That this bill be now read a second time. As many of that bill will say, content not content. The contents have it.

**** Possible New Speaker ****

contents have it. My Lords, I beg to move that this bill be not committed. The question is that this.

**** Possible New Speaker ****

The question is that this. Bill be not committed, as many of that opinion will say. Content contrary, not content. The contents

**** Possible New Speaker ****

have it. My Lords, I beg to move that this Bill be now read a third time.

**** Possible New Speaker ****

The question is that this bill be now read a third time, as many of that opinion will say. Content

**** Possible New Speaker ****

of that opinion will say. Content contrary, not content. The contents have it. My Lords, I beg to move that

**** Possible New Speaker ****

this Bill do now pass. The question is that this Bill do now pass, as many of that have been, will say, content, not been, will say, content, not content. The contents have it. We might just have a short pause for might just have a short pause for noble Lords who wish to leave to do Second Second Reading Second Reading of Second Reading of the Second Reading of the Cyber Security and Resilience Network and Information Systems Bill Baroness Lloyd of Effra.
17:43
17:43
Baroness Lloyd of Effra Portrait Baroness Lloyd of Effra, Parliamentary Under Secretary of State (Department for Science, Innovation and Technology) (Labour)
-
-
the UK forward. They have enabled us to work faster, more efficiently and with more flexibility than ever and with more flexibility than ever before. But with these advancements come risks. As the technology powering our modern economy has powering our modern economy has leapt forward, so too have the tools our adversaries use to extort, tools our adversaries use to extort, disrupt and surveil. Last year, over 600 000 UK businesses were subject to cyber attacks. This is not only holding businesses back, it's undermining our security.

These are criminals and hostile state actors seeking to disrupt the very foundations of our country. My Lords, the UK is now the most targeted country in Europe for cyber attacks. It's the duty of this government to take bold action. We have been clear that all businesses must protect themselves from cyber attacks. But this does not mean regulating every single business they know their customers, their suppliers and their best place to protect themselves using the free tools we've provided. I commend those who have already signed our Cyber Resilience pledge and urge more to do so, committing to take the three simple steps recommended within it.

Making cyber a board level responsibility and following the Cyber Governance Code of practice. Signing up to the National Cyber Security Early Warning Service and taking a risk based approach to requiring cyber essentials across supply chains. This is our government certification scheme to help organisations improve their cyber resilience. Cyber essentials works organisations with IT are 92% less likely to claim on their cyber insurance than those without, and taking these steps can make a huge difference. However, where the risks are so great that public safety, the economy or our national security is threatened, it is right that we regulate the network and information systems on NIS Regulations 2018 are the UK's only cross-sector cyber legislation.

They apply to operators of essential services in the energy, health, transport, drinking water and digital infrastructure sectors, as well as some digital service providers. The NIS Regulations are designed to protect the security and resilience of our most essential services, to keep the lights on, to ensure taps keep running and protect our NHS. We regulate only where we must, and that is why the scope of the NIS Regulations is precise. They are a targeted security intervention and the best tool in our arsenal to protect our most essential services.

However, the regulations have fallen out of date and if we do not act, the essential services we all depend on will remain under threat. That is why we have introduced this bill, the Cyber Security and Resilience Network and Information Systems Bill is a vital opportunity to improve the UK's defences. In fact, it's the first bill in British history to have cyber in its name. It will update the NIS Regulations for the modern age and ensure the government can maintain their effectiveness and respond to imminent national security threats.

My Lords, the objectives behind this bill are threefold. First, it will safeguard the services our people most rely on making our essential and digital services more secure. Second, it will deliver a step change in our national security, increasing our defences against cyber attacks that threaten this country. Third, it will better protect our economy. The UK will be a safer, more attractive place for businesses to establish themselves, thrive and grow. This bill achieves these through proportionate and timely measures, which I will speak to in turn.

First, this bill brings more sectors into the scope of the NIS Regulations. As our economy becomes more interconnected, so do the routes that cyber criminals exploit. For example, data centres in the UK have become critical to nearly all our economic activity and public services, from NHS patient records to financial services. These vast digital depots are a key part of the modern world. That is why data centres meeting the bill's thresholds will be regulated as essential services, ensuring they take steps to secure their networks.

The bill also brings large load controllers under regulation. These are organisations that manage significant electricity flows to or from smart appliances. They must be safeguarded to secure our electrical grid and protect consumers using such appliances. We are also bringing large and medium managed service providers or MSPs into scope of the NIS Regulations. These are organisations offering ongoing services to customers like remote IT support or cyber security threat management. MSPs have deep access into their customers systems as more and more organisations rely on them, MSPs become an increasingly attractive entry point for disruption.

Noble Lords will remember last April's cyber attack on M&S. This involved a managed service provider being socially engineered, with attackers able to gain access and compromise systems. We need to close this gap, but these regulations must be proportionate and targeted. Large and medium MSPs make up less than 1 in 10 of MSPs active in the UK, but account for 97.6% of the UK's MSP revenue. So small and micro MSPs will be exempt from this measure by targeting regulation where the risk and reach are greatest.

We protect almost all MSP customers without burdening small businesses in limited circumstances. Small and micro businesses supply critical goods or services to the essential and digital services we rely on. This bill therefore enables businesses supplying critical goods and services, including smaller companies, to be designated as critical suppliers. This is designed to combat the cyber risks stemming from increasingly complex supply chains. Members may be aware of the 2024 attack on Synovus, a pathology provided to some NHS trusts. Criminals thousands of miles away deployed ransomware and made some overseas files unusable, delaying 11,000 appointments.

This demonstrates the rippling effect that a compromised supply chain can have on the services at their ends, duties that critical suppliers will be subject to will be set out in secondary legislation. I turn to our 12 NIS regulators, whose sectoral expertise is critical to protect our essential and digital services. However, these regulators are often operating with one hand tied behind their backs. They don't have the information, resources or levers necessary to properly fulfil their duties. For instance, at present, organisations need only tell their regulator about an incident once it has already caused significant disruption.

Under the bill, they will have to report more types of breaches to both their regulator and the NCSC within 24 hours, and provide a full report within 72. This includes incidents like pre-positioning and ransomware. When an incident may not cause immediate damage, but poses a real threat to the UK economy or society. This will not only enable the NCSC to support those affected more quickly and warn others, but allow the government to better understand the threat landscape. Furthermore, the bill requires digital and managed service providers and data centres to inform their customers about reportable incidents that are likely to adversely affect them.

This way, customers can take appropriate steps to protect themselves, but effective reporting must be matched by consistency. Our 12 regulators cover all NIS sectors and the UK's four nations. We must utilise their sectoral expertise, but we must also ensure that the rules are applied consistently. We cannot allow any sector to become an easy target. This bill enables government to designate a single set of strategic priorities, as well as objectives tied to them, that regulators must seek to achieve. This will complement the security and resilience requirements to come in secondary legislation, setting clear, consistent expectations and putting good practice on a firmer footing.

The Secretary of State will be required to consult the regulators on a draft of the statement before designating it. In addition, the bill gives regulators new powers to recover their full regulatory costs from the organisations they oversee. This includes enforcement costs, ensuring that this is not. This is not conducted to the detriment of regulators books. Regulators must consult on how these fees will be calculated, and publish a yearly statement to show how these funds were used. The bill also raises the maximum penalty enforceable for regulatory breaches, while simplifying the penalty bands for easier, more consistent application, regulators must consider all circumstances of a case before setting a penalty.

This is not designed to punish companies, but to incentivise their compliance. The ideal scenario is no penalties at all. We are also fixing legacy issues concerning information sharing, so regulators can better understand what can and can't be shared, and with whom. All information shared must either meet a specified purpose or require permission to be shared and be relevant and proportionate to the purpose for which it is shared. My Lords, this Bill unties our regulators hands, giving them the information, resources and powers they need to hold the line.

That is what effective regulation should look like. Finally, the Bill contains some important measures to enable future resilience, ensuring that the NIS Regulations remain effective into the future. This bill introduces a targeted, essential set of delegated powers to enable the NIS Regulations to keep pace with the ever changing cyber landscape. This includes powers by which the government can bring new services or sectors into scope of the regulations, so long as they meet the bill's strict criteria, or make regulations to further mitigate the risks from security and operational compromises.

In the majority of cases, these delegated powers will be subject to consultation and the affirmative procedure will apply. Today's threats were unimaginable in 2018, so we must not legislate as though today's threats will stand still. These are carefully targeted, and it would be remiss not to take this opportunity to provide for careful, proportionate, delegated powers in almost all cases of these powers. The government must consult on any changes. Parliament will have the final say over legislation made under these powers are delegated powers.

Memorandum contains greater detail. My Lords, in exceptional circumstances, even secondary legislation is too slow right now. If our intelligence community becomes aware of an incident that threatens our national security, the government has no emergency power within the NIS Regulations to protect our people. This bill provides powers for the Secretary of State to direct regulators and regulated entities where national security is threatened. This could entail instructing a sector to follow new guidance in response to a crisis, or requiring an organisation to take technical steps to remove an intruder from a network.

These are essential last resort levers. The bill has strong safeguards to ensure they are used accordingly and only where strictly necessary for national security. My Lords, this bill is about protecting the foundations of a modern economy. Growth cannot flourish where essential services are vulnerable, where businesses are exposed to disruption, and where hostile actors can exploit weaknesses. We are not choosing between security and growth. We are recognising that one depends on the other. This will help secure the services our people rely on.

Give businesses the confidence to invest and grow and strengthen our national security in an increasingly dangerous world. I beg

**** Possible New Speaker ****

to move. The question is that this bill

**** Possible New Speaker ****

be now read a second time. My Lords, please let me thank

**** Possible New Speaker ****

My Lords, please let me thank the noble Baroness, the Minister, for introducing the Bill before your Lordships House this afternoon. your Lordships House this afternoon. I should say at the outset that His Majesty's loyal opposition supports Majesty's loyal opposition supports the objective which lies behind this legislation. The cyber threat facing the UK is growing incrementally, both in scale and
17:56
Earl of Effingham Portrait The Earl of Effingham (Conservative)
-
-
sophistication, from hostile states to organised crime from ransomware, attacks on our public services to increasingly complex attacks on critical national infrastructure. critical national infrastructure. The need to strengthen our national resilience is indisputable. Many resilience is indisputable. Many noble Lords will be familiar with a number of the reforms contained within this bill, predominantly within this bill, predominantly because they originate from the review of the Network and Information Systems Regulations undertaken by the previous conservative government. Following the consultation launched in 2022.

It should not be a surprise that we therefore welcome measures to improve consistency across the various regulators responsible for enforcing the existing regime. However, my Lords support for the objectives of the Bill should never prevent your Lordships House from asking whether the legislation is actually sufficient and proportionate, and most importantly, noble Lords would be absolutely right to constructively challenge whether this legislation forms part of a coherent strategy, and that should indeed be a central question.

We are being asked to scrutinise and revise. One of the fastest moving areas of public policy, without the government having first published the cyber strategy within which these measures are intended to sit. Ministers have described this bill as merely one component of a wider programme to strengthen Britain's cyber resilience, but it is entirely fair and reasonable to ask where exactly is that programme? Where is the strategy and where is the explanation of how these powers fit within the government's broader approach to protecting our digital economy and our critical national infrastructure? Only last Thursday, we heard an oral question on the impact of AI in vaccine technology, and it is obvious to all that AI is regrettably also transforming the way cyber attacks are conducted, increasing both their scale and their sophistication.

Hostile states have become more aggressive. Organised crime has become more capable. The boundary between economic security and national security has become ever more blurred. Yet little of that ever shifting landscape appears to find expression within the bill itself. In fact, artificial intelligence does not appear to feature in the legislation. Quantum cracking does not feature. Weaponized disinformation does not feature. The wider question of how government intends to respond to AI enabled cyber threats remains unanswered. Nor does the bill address the long standing concerns surrounding the Computer Misuse Act.

Despite repeated calls from the industry for reforms that better reflect modern cyber security practice and remove the legal uncertainty facing legitimate cyber security researchers. My Lords, legislation in this field is unlikely to come before Parliament every year, and that places a particular responsibility on noble Lords now to ensure that what is enacted today remains remains relevant as much as it realistically can tomorrow. The government has shown an enthusiasm for regulation across a number of sectors, and sometimes regulation is necessary.

Sometimes it is unavoidable. But good regulation should always be proportionate. This is especially true when it comes to firms that are already navigating an increasingly complex regulatory environment and face ever more costly obligations under the government's direct and indirect taxing of small businesses. The bill introduces new obligations, new reporting requirements and new compliance duties for organisations operating in sectors that are undoubtedly important to our national resilience. It may be the case that some of this regulation is justified.

However, it also raises many questions for the opposition. The most pressing of which is what assessment has the government made of the cumulative regulatory burden these measures will impose on businesses? Many organisations are already subject to reporting requirements under data protection legislation, sector specific regulation and forthcoming proposals concerning ransomware reporting. If these various obligations are not properly aligned, businesses risk finding themselves complying with multiple reporting regimes for what is in reality the same cyber incident.

And this would not strengthen resilience, but rather create additional bureaucracy during a time of crisis. And nowhere is this a greater concern than for small and medium sized enterprises. Large multinational organisations generally possess dedicated legal and compliance teams and cyber specialists capable of navigating increasingly complex regulatory requirements. Smaller businesses simply do not have the resources to do that, and often these businesses are the very scale ups and high growth companies upon which our future economic prosperity and unicorn status depends.

Everyone wants economic growth. None more so than His Majesty's loyal opposition. But if the government wants growth, it must ensure that cyber regulation does not become yet another barrier to enterprise and innovation. So will the noble Baroness. The Minister, confirm to your Lordships House that the overwhelming majority of SMEs will remain outside the scope of these new regulatory requirements? And by what benchmark will an SME be defined in the legislation? Will the Minister please explain what support, alongside the new obligations the government intends to provide for those smaller organisations that may ultimately fall within the regime? Resilience cannot simply be legislated into existence.

It requires expertise and resources. The bill grants significant new responsibilities to regulators, operating across a wide range of sectors. For these provisions to operate successfully, the legislation assumes that such regulatory regulators possess both operational capacity and the expertise necessary to exercise those responsibilities effectively. And will the noble Baroness Minister outline how these assumptions have been stress tested? And finally, my Lords, this bill confers important national security powers upon the Secretary of State.

Whilst these powers may well prove necessary, they also reinforce the importance of transparency, the exercise of national security powers should be informed by clear principles and robust accountability, particularly where they concern hostile foreign actors seeking to undermine our critical infrastructure. Will the noble Baroness Symons inform the House what mechanisms are going to be in place to ensure such accountability? His Majesty's loyal opposition does not dispute that the cyber threat facing our country is real, nor do we dispute that the Network and Information Systems regulations require updating.

Indeed, much of the work underpinning this bill was initiated by the previous conservative government. But surely we need we need a strategic framework. Instead of having to ask why these sectors, why these thresholds? Why these powers? How does this legislation fit alongside artificial intelligence, ransomware policy, national resilience and wider cyber reform? These are not unreasonable questions. They are precisely the questions that a responsible analysis of a slew of updated proposals require, and we ask the government to provide the strategic context which accompanies

**** Possible New Speaker ****

the bill before us. Here. My Lords. I too, thank the noble Lady for

**** Possible New Speaker ****

I too, thank the noble Lady for introducing this bill. And from these benches we welcome the Bill, but we feel in a number of ways but we feel in a number of ways that it doesn't go far enough. Hostile state actors, organised Hostile state actors, organised crime and others are increasingly targeting our systems at every level with potentially catastrophic
18:06
Baroness Northover Portrait Baroness Northover (Liberal Democrat)
-
-
level with potentially catastrophic effects. As previous speakers have said, attacks on our energy networks, water supplies, transport systems, financial infrastructure and digital services are becoming more frequent. It is clearly vital that organisations that deliver essential services have high standards of cyber security, and they should report serious incidents promptly and transparently. We also recognise that the coverage of those that the coverage of those who need to report in this way should be widened. But is the bill ambitious enough? I'm serving on the House of Lords Select Committee on National Resilience, and there's at least one other speaker in the debate who also serves on that select committee, and I'll be drawing here from some of the evidence that's been submitted to us.

We were, of course, part of the EU arrangements until Brexit, and this is yet another area we needed to address after that. That resulted in the 2018 regulations, which this bill seeks to update. The post-Brexit arrangements seem to have been complicated, putting complicated, putting in place clear primary legislation. The Minister in the Commons noted that Brussels is pressing ahead with its own updates. Quote, while we lag behind. He stated that this, quote, procedural quirk has left essential UK services more exposed, which perhaps tells us something about why the UK has such appalling figures compared with some of our EU counterparts, as hackers and cyber criminals exploit gaps in our dated laws.

Close quote. We do indeed have the worst record in Europe for such attacks, and I would argue from submissions we've received to our select committee, that it makes most sense for us to be aligned with the EU regulations. It has been put to us that this would mean that organisations do not need to answer to two sets of regulations in Europe. It's clear that this would assist us anyway, given that the EU regulations cover a wider range of areas, which it makes little sense to overlook as the government appears to be doing as it was put to us by ISC2 and the.

And I quote, the government may have missed an opportunity to have the same taxonomy of CNI across jurisdictions. For example, the EU's NIS two directive on cyber security includes manufacturing, public administration, and food production. These sectors are also critical for the UK's national and economic resilience. Thus, under the proposed regime, manufacturers operating across the UK and EU, when victim of a cyber security incidents in the UK would be mandated to report this to EU authorities, but not to the UK.

The Association of British Insurers. Abi also notes that the bill is narrow in scope and I quote large parts of the economy, including organisations that are economically significant due to their scale, interconnectedness, connectedness or role in supply chains will remain outside this regulatory perimeter. They note that the government's approach to these unregulated sectors relies primarily on voluntary governance mechanisms, including its proposed new cyber governance code of practice. Not that we've yet seen that the Abi argues that without stronger incentives, measurement and accountability, there is a risk that this will not deliver consistent or meaningful improvements.

They warn that this creates a disconnect between the regulated NIS economy and the wider unregulated economy, despite risks flowing directly between them. We know the wide, deep and prolonged effect of cyber attacks on M&S, JLR and Synovus. Yet JLR and M&S will be out of the scope of this bill, as the Commons Minister himself noted. Surely we need to take a whole of economy approach. We surely should include the public sector and economically significant sectors such as retail and manufacturing.

In evidence to our Select Committee. UK Defence First also argued that the potential loss of control of satellite communications is a severe national risk, and that this bill should explicitly treat space space assets as critical national infrastructure. Could the noble Lady comment? DSIT has estimated that significant cyber attacks on businesses cost the UK almost £15 billion in 2024. The National Cyber Security Centre reported that nationally significant cyber incidents had more than doubled in a year.

As ISC2 says, quote, it's no longer a question of if an organisation will be attacked, but when. ISACA, a global professional association focussed on this area, emphasises that digital service providers, particularly cloud infrastructure, also represent a growing concentration of systemic risk. The financial sector is increasingly reliant on a small number of cloud providers, creating potential single points of failure across critical services. For example, evidence presented to the Treasury Committee highlighted that 73% of UK cloud services are provided by just three providers.

There are warnings that cyber risk is inherently systemic. Disruption is rarely confined to a single organisation or sector, but is increasingly transmitted through supply chains, shared infrastructure and third party dependencies, which the noble Lady made reference to. According to the Cyber Security Breaches Survey, only 7% of UK businesses have formally reviewed the potential cyber security risk presented by their wider supply chain. In addition, it's reported that many SMEs may perceive that they are too small to be a target.

Yet government research has found that 50% of UK SMEs face some kind of cyber breach or attack in 2025, and it's also reported that for small businesses, a cyber incident can be existential. Roughly 60% of SMEs who fall victim to a cyber attack go out of business in six months. It's all very well, as the noble Lord just indicated, being outside regulation here. If our SMEs simply go to the to the wall as a result of inadequate preparation and protection.

Evidence to our Select Committee suggests that skills shortages are a key challenge for companies, especially SMEs and those in the public sector. Is that why the government has not included them here? But that leaves our economy wide open. That surely is not the right answer. Cyber education, training, apprenticeships, investment and skills must accompany regulatory reforms and the regulators themselves will need to be properly resourced so that they can deal with their new responsibilities. And we know that public bodies have often found themselves dependent on ageing digital systems with the risks from that.

We also need to recognise the need for the highest level of leadership in this area, in companies and other organisations. It cannot simply be left to IT departments. Cyber security must now be a major consideration at board level. We also need leadership from the government working with allies on intelligence, sharing common standards, coordinated responses to hostile activity and cooperation on investigation. We know we face increasing attacks from rogue states. It's spoken of how it's spoken of now as being low level warfare.

And we've seen the effect in many other countries as democracies are under attack. In conclusion, although we welcome this bill, we are seriously concerned about its limitations. A start would be to align with the EU, which already recognises that a whole of economy approach is the

**** Possible New Speaker ****

right one. I look forward to the noble Lady. The minister's response. Yeah, yeah.

**** Possible New Speaker ****

Thank you. My Lords. The government's own

**** Possible New Speaker ****

My Lords. The government's own cyber survey reports that 43% of UK businesses experienced a cyber businesses experienced a cyber attack last year, costing the UK economy an estimated £15 billion. economy an estimated £15 billion. Just a few examples of those many attacks. A deep fake video call cost £20 million. Marks and Spencer's was attacked in Easter of last year, losing an estimated £300
18:16
Lord Birt Portrait Lord Birt (Crossbench)
-
-
million and with operations only fully restored three months later. Most impactful of all so far, Jaguar Land Rover suffered an attack to halt production for attack to halt production for around five weeks, was unable fully to restore its supply chains for to restore its supply chains for four months and lost around £500 million. Moreover, the government million. Moreover, the government had to step in and to guarantee a loan of £1.5 billion to stabilise Jlr's extensive supply chain. Yet our economy.

My Lords, is barely touched by this bill as Baroness Northover has just identified. I think. I think a lot of people untutored have a mental model of a technology platform as something you might offload off the back of an HGV. In reality, my Lords, any technology platform, even in a medium sized business, can be a highly complex network composed of hundreds of providers. Any component of which can present a vulnerability. Just two examples. Amongst very many, the widespread reliance by providers on free to use but vulnerable open source software maintained by volunteers or the external software providers bolted on to a technology platform offering a myriad of services for example payroll, finance, logistics, e-commerce or customer relationship management.

There is a possible vulnerability in every part of this complex network of providers, with many doors to pry open, and once one door is opened by a bad actor, my Lords, a fraudster, a foreign power, a hacktivist or a ransom gang, the potential to explore and to disable much or all of the whole system is possible. Entry can be through a clever phishing email, perhaps a personalised with stolen data or through application, network and infrastructure vendors failing to close down vulnerabilities immediately they are identified.

A frightening example, my Lords. A Chinese entity, was able to penetrate a large number of services provided by Microsoft to the US government. As a result, among many, the mailboxes of the Secretary of Commerce and the US Ambassador to China were read in a coruscating report the Cyber Safety Review Board, the US government agency that investigated the breach, concluded that. And I quote, Microsoft's security culture was inadequate, that the incident resulted from. And I quote again, a cascade of Microsoft's avoidable errors.

We need to act now, my Lords, to protect our wider economy as well as our public sector institutions. I am not a technologist, but for three decades I have had to deal constantly with digital technologies and technologies from a position of authority in many large organisations, both in the public and private sectors, at national, European and global level. And I have discussed this bill extensively with technology and cyber experts that I know and respect, and it has become perfectly clear to me that the bill, as constructed, does not begin to match the threats that we in the UK face and threats that will only grow.

My Lords, for instance, AI will increasingly empower malign reconnaissance, enabling attacks that probe, diagnose and bypass defences, and at some point, quantum quantum computing, with its awesome power, will fatally undermine our current approach to encryption. This is a highly demanding and ever changing environment, my Lords, and it is frankly preposterous to suppose that the 12 existing sector specific regulators of our national infrastructure can acquire and constantly update the knowledge effectively to regulate cyber resilience. So, my Lords, I conclude emphatically that we need a single, focussed, dedicated and expert regulator, which I suggest we call the office for Cyber Resilience.

The OCR to span both the public and private sectors, both organisations and, vitally, those who supply them with the technologies that they use. And for clarity, my Lords, the OCR should also regulate the national infrastructure providers. First, I propose that the OCR should regulate platform and software providers to ensure that they sell and vouch safe, secure products up front and update them immediately when vulnerabilities become apparent. This doesn't happen at the moment. The office for Product Safety and Standards does that in the UK for consumer goods, and the Vehicle Certification Agency does it for cars.

Why not protection for our vital technology? Second, companies and institutions of a significant size are currently required under statute to face an annual external audit, the purpose of which is to maintain high standards in financial reporting and corporate governance under a code set by the FLC, the Financial Reporting Council. I propose, my Lords, that we should extend the remit of that audit under the auspices of the OCR to report on the audited organisations and its suppliers, management of cyber security and thus bring company boards clearly into play.

Third and finally, my Lords touched on a little earlier, we need to professionalise the skills of the cyber and IT community, which are highly variable. Every profession that I'm aware of, which can have a significantly adverse impact on individuals or society, faces a hierarchy of qualification before they can operate at different levels. Where the physician, lawyer, chartered accountant, architect or airline pilot. How far across the economy would the Oscar's remit reach? It would extend precisely to the same extent as the obligation to have a statutory audit, that is, to companies with an annual turnover of about £15 million and with an excess of 50 employees, and a statistic for Earl of Effingham.

The surprise, perhaps, would be that that would only mean 2% of UK companies. But those companies would represent around 70 to 80% of the UK economy. My Lords, to conclude, we simply must be bolder. We must take the opportunity that this Bill presents better to enable every kind of organisation in the UK to withstand this ever growing and deeply destructive threat of

**** Possible New Speaker ****

cyber attack. My Lords, what a pleasure it is to follow such an interesting and constructive speech, and I do hope the noble Lord will take full part the noble Lord will take full part in the Committee stage of this Bill. I declare my interest as chairman I declare my interest as chairman of the technology company. You tell us UK's advisory panel, and I'd
18:24
Lord Arbuthnot of Edrom Portrait Lord Arbuthnot of Edrom (Conservative)
-
-
us UK's advisory panel, and I'd like to thank the noble Lady, the Minister, for the briefing she gave us a couple of months back, which was extremely helpful. The best legislation has a permeating principle, a principle which helps to explain the purpose of the new law and which helps to inspire obedience to and observance of the new law. Yesterday, the Joint Committee on the National Security Strategy held an evidence session about deterrence in an age of Russian aggression, in which one of the witnesses, Professor Bettina Rheims, professor of International security at the University of Nottingham, told us that the key thing that should be included in this bill is that it should hold vendors of software accountable for the reliability and security of their product, which rather follows on from what the noble Lord Lord Birt has just been saying that, after all, is what we do with cars.

When Ciaran Martin was the head of the NCSC, it was one of his overall aims. But that is not what this bill does. This bill doesn't have a permeating principle. It's a bit of a muddle. Winston Churchill might have said that this pudding has no theme. My noble friend, the noble Earl of Effingham asked about strategy, and he was absolutely right to do so. The bill draws in some sectors, but not others. Without any clear explanation of the difference between those it includes and those it excludes.

In another place, the Shadow Secretary of State for science, Information and Technology, Julia Lopez,

**** Possible New Speaker ****

Said that she supported the bill but feared it might not work in practice. I do support the bill, practice. I do support the bill, but fear it might not work in but fear it might not work in principle. My Lords, we live in an age where everything is connected age where everything is connected to everything else. Drawing dividing lines, for example, between the private sector, some of between the private sector, some of which is included and some of which is excluded, and the public sector which is excluded is perilous and leads to incomprehension of the law.

And that set of unclear distinctions also ignores the effect of cascade during lockdown, a health crisis turned into an education crisis, with exam results becoming an unexpected casualty of Covid. When everything is dependent on computers and the public sector is dependent on the private sector and vice versa. It is unwise for new legislation to specify rigid demarcations. My Lords, those taking part in this debate have received many useful briefing notes from the Association of British Insurers, correctly drawing attention to the great value in behavioural terms of insurance, which can have a real impact on resilience of all types as well as cyber resilience.

From the News Media Association about the real danger posed by bots, which now form 50% of all internet traffic, and its accelerating fast from Zurich. Re correctly identifying the huge role played by SMEs in the cyber security sector. Yet worrying about the ability of SMEs to bear the demands of regulation, not least in reporting incidents within 72 hours and many more helpful briefings. I mention also the Computer Misuse Act. I know the government is committed to reforming that act in the coming National Security Bill.

As the noble Lord Lord Clement-Jones has been demanding for many a year now. But cyber UPS campaign on this is a long running one. Far too long running. And while talking about cyber security professionals. Because that's And in order to give cyber professionals proper protection, I'll bring you the very helpful briefing from Isc2. This this bill will dramatically increase the demand for cybersecurity professionals, even though there is currently a significant shortage of them. And as I understand it, the number of cybersecurity positions in government that are currently vacant is 50%.

That is horrifying. 58% of UK organizations have a critical or significant skills need, and 87% of teams have experienced at least one consequence due to skills needs. The members of Isc2 have said that the biggest impediment to their complying with cyber legislation and regulation is a shortage of skill. So what does this legislation do to increase those skills? And could we have a look at defining the the meaning of a skilled person in this bill? The shortage of such skills is likely to be exacerbated by there being 12 different regulators.

And here again, I rather echo what the noble Lord, Lord Burt said. And there's going to be a risk of potential duplication of regulation, even potentially contradictory regulation. What's an organization meant to do if one regulator requires that it does one thing, but another regulation that requires that it does not? Will the government ensure that regulators adopt common forms of evidence for demonstrating compliance and common cybersecurity standards? And how does the legislation take into account the fact that many organizations will be subject to foreign legislation as well? And here I agree with and on many other things, what the noble Lady, Baroness Northover, said about encouraging alignment with Europe, the European Union.

How are we learning from overseas experience? So, as I say, this is a well-meaning but muddled attempt to deal with an exceptionally fast moving, difficult problem. Governments always find it hard to keep up with the pace of technology. Technology. So is it really right to say that we should only re-examine this bill every five years? The Secretary of State should have to report to Parliament earlier than every five years. I know I sound a bit miserable, but I do support this bill.

I really do, but it could do better and we'll

**** Possible New Speaker ****

have a lot of work to do in the committee. My Lords, the government's whole of society approach to national security rightly recognises that resilience is not delivered by the state alone. It's delivered through partnership between government, regulators, industry communities regulators, industry communities and, crucially, the private sector. Cyber resilience is no exception. Exception. It requires every bit of
18:32
Baroness Paul of Shepherd's Bush Portrait Baroness Paul of Shepherd's Bush (Labour)
-
-
Exception. It requires every bit of the infrastructure to play its part. Those who defend networks, those who regulate standards and those who help organisations recover when incidents occur. So I welcome the Bill, and I note the broad support that it has received across the resilience sector as a good start. The Bill most important progress in strengthening incident reporting, modernizing, modernizing the NIST framework and placing greater obligations on essential service providers, digital services and critical suppliers. I particularly welcome the inclusion of managed service providers with the regulatory regime.

As other Lords have mentioned, more and more organisations rely on MSPs to keep pace with the changing nature of the threat and their ever expanding tools required to remain secure. Without them, many businesses and parts of our critical national infrastructure would struggle to access the expertise needed to keep themselves safe. But at the same time, MSPs can present a potential vulnerability because of the privileged access that they often hold to other clients infrastructure. The Bill is right to recognise this and I'm pleased to see them brought into scope.

My Lords, in welcoming the Bill, I must also point to what I think is a significant omission and for which I will focus my remarks, and that is that there's no mention of the insurance sector in the Bill, nor any real mention, really, of the point that private sector can play. I raise this not as a criticism, because I think there's ample opportunity to put this right and to enhance the bill's ambition. The bill already expands incident reporting and increases the volume and quality of cyber incidents, incident data available to regulators and to public authorities.

And that is an excellent step forward. But if the purpose of the bill is to improve our understanding of cyber risk and strengthen resilience across the economy, then it's worth asking whether we should also enable structured, anonymised incident data to be shared with the insurance sector and others who can use it, because the purpose of this data is to provide a clear picture of the threat. And so it's important that we share this as widely as possible to those who can help protect us.

And so I ask the Minister to consider this. This should not be an extension to the bill. This would be an extension to the bill, not a departure from it. It would build on the reporting architecture that the bill already creates, and it would do so in a way that supports the government's whole of society approach to resilience. And the principle is simple better data enables better modelling, better modelling enables better pricing and and strengthens resilience, a better price, and increases access to cyber insurance and strengthens resilience across the entire economy.

And cyber insurance is already an important part for keeping business safe. We know that it enables us to transfer financial risk so that shared between businesses and the private sector, rather than just being borne by the taxpayer. And I'm sure we'd all agree that cyber incidents and the cost of recovery should, in most cases, fall upon those organisations affected. As my Lords know, insurance remains one of the most effective and economically efficient way of achieving this. But insurance does not just pay out after an incident, it changes our behaviour before one.

So to to secure affordable premiums, organisations are required to adopt practical cyber hygiene measures such as multi-factor authentication, timely patching, network segmentation and robust incident planning. And these requirements are not set in stone but changes. The threat involves beyond legislation, which will mandate a change in behaviour. There are very few other ways to incentivise the scale and pace of behavioural change that is in that is required to improve our resilience than insurance. We have locks on our doors, safety features in our cars and sprinklers in our buildings because insurers encourage and rewarded these measures, and I think it has the same potential to play the same role in cyber resilience.

It's worth noting that sobering cyber essentials, which my Minister mentioned in her opening remarks, is is believed to be held by just 1% of all businesses. And while the growth rate is increasing, I think it would take decades to get to the point where Cyber essentials is going to provide us with the level of resilience that we need. So we need to do something different, and we need to incentivise things in a different way. So cyber insurance, as we also know, helps mitigate the moral hazard where organisations assume that they will underinvest in security because government or someone else will bear the consequences.

And, and the risk to our economy makes this unsustainable. My Lords, independent analysis commissioned by the Department for Science, Innovation and Technology, who sponsored this bill, shows that cyber attacks impose almost £15 billion of economic harm on the United Kingdom every year. That's equivalent to one month's NHS expenditure. Almost the entire annual policing budget, 30 new hospitals, or more than three decades of universal breakfast clubs. For every primary school child, it's enough to wipe out an entire year's profit for vast numbers of British businesses.

Yet only a small proportion of that national cyber risk is insured. Based on the data, the department's own modelling data, together with that of the Association of British Insurers and Lloyd's of London, is estimated that the UK cyber insurance market currently covers approximately 700 billion of annual losses. In other words, less than 5% of the economic harm caused by cyber insurance incidents is insured. More than £14 billion of losses therefore falls directly on businesses, public services and in some circumstances, the taxpayer.

We all know last year that Marks and Spencer's had cyber insurance and reportedly made a claim of around £100 million following their cyber incident, where Jaguar Land Rover did not have cyber insurance. And in the end, the government had to step in and provide a loan as the frequency and cyber events increases, it's in our interest to increase insurance reporting obligations. Name suppliers will be required to report significant incidents within 24 hours, fully report within 72 hours, and the band.

The Bill expands the definition of a reportable incident to include pre-positioning attacks significantly. Misses and incidents are likely to have substantial impacts. Even where disruption has not occurred, it must be permissible for regulators to share this information across a cross public authorities and with insurance companies creating a more coherent national understanding of cyber risk. If we accept that it's possible to share in some circumstances, I think it must be possible for us to consider that it could be shared in others.

Lloyd's of London, the Abi brokers, including Marsh and and Willis Towers, have all warned that a scarcity of reliable data is one of the principal constraints on market and product development. So why would we not want to facilitate improvement in cover as well? Market analysis analysis suggests that it's potential for the global Cyber Insurance market to expand annually by 25%. If the UK were to capture even a modest share of that growth, our domestic cyber insurance market could expand from its current value of around 700 million to well over 202 billion in a few years, and this would be more highly skilled jobs in London and maintain our position as London, as the leading world centre for specialist insurance.

My Lords, the Bill sets us in the right direction, but we do have a an opportunity to ensure that insurance is properly recognised as part of the resilience community and I believe that by enabling structured, timely and anonymized data to be shared, it would be a modest extension. The bill, but would have the capacity to deliver enormous change to the cyber resilience of our country. And I hope the government would consider this as the bill progresses through the House. Yeah.
18:40
Baroness Neville-Jones Portrait Baroness Neville-Jones (Conservative)
-
-
My Lords, I support this bill. I think I rather agree with those who've spoken previously that it's not particularly ambitious in its not particularly ambitious in its in its aims, but it. It is a in its aims, but it. It is a successful, I think, largely, largely useful piece of legislation. Mollis in aims and. Level liable to no service, I think for a for a period. What it doesn't do, I think, is look forward very much the.

The threat landscape is deteriorating. I'm not going to describe it, which has been done well by others, but we, the criminals and indeed other state operators are are leaders in technology adoption. And we can be sure that AI is going to be used against us, and we must be in a position to exploit it ourselves. So I think that one of the conclusions I draw from the discussion so far is that we are going to have to learn somehow to both legislate and make policy faster than we're doing at the moment.

This bill has taken a long time to get through the Commons, and I hope it's not going to take so long to get through this House, because we are already, I suspect, behind the curve again. Secondly, I think we have to learn to be willing to experiment and to change course. If it's not working. You can take many views on the subject of whether we should have sectoral regulation or whether we should have a single regulator. There are arguments in both directions.

I'm, on the whole, at the moment willing to try sectoral regulation, which brings with it potentially more flexibility, also more complexity. But if it doesn't work, it does seem to me we need to be prepared actually, to say this isn't working and we're going to do something different. So change, change of gear and willingness to change gear does seem to me to be something that we are going to have to come to terms with. And actually be prepared to say, when it is the case that we haven't got it quite right.

I think the the thrust of the bill is certainly in the right direction, and I'm going to focus on some of the more detailed points in, in in the drafting where I think we will need to try and accomplish some improvements. There's quite a lot of looseness in the drafting, which needs tightening up. You know, if you take a couple of examples, terms like managed service provider and critical supplier, as well as actually the very wide definition of the, of the notion of incident, all these need greater precision to avoid the word things like incident becoming a way in which companies that have no, no particular involvement get tangled up in, in legislation, in in.

Regulation. And if a part of a company, for instance, provides managed services, we need to know and the company needs to know whether the whole company is caught in the bill or whether it is simply that part which provides managed services. So there's plenty of implementation detail which we will need to have a closer fix on. I'm willing to support the notion that the government, to give the government the power to fill in the detail and update the law through secondary legislation, because it seems to me we can't always have primary legislation doing everything.

However, I think we have to have a duty to consult written in, in, into this bill for it to be a safe proposition. So one of the things I would like to know from the Minister is what is the timetable for secondary legislation, and will will the government be willing to consult when it comes to actually putting that through? It seems to me it's going to be a very substantial part of this particular bill. I've got a couple of comments that I want to make about the effects of the scope of the bill.

First of all, with the exception of service providers who are classed as critical suppliers and data center, the bill that other people have remarked is exclusively concerned with the public sector. But as the government Minister and indeed others have pointed out, some of the biggest losses have occurred actually in the private sector. I don't need to describe them because they already have been. I mean, the government may argue that it properly seeks not to regulate the private sector, and I certainly have considerable sympathy with that.

But it isn't satisfactory from the point of view of the taxpayer, that the government had to bail out with public finance. JLR, Jaguar Land Rover, and I don't think you know that under current conditions, that breach, which was expensive, is is likely to be the last one with sizeable financial effect. The government has recognised the the problem and is encouraging the private sector companies to make a pledge to improve the management of cyber security at board level, and I'm all in favour of that improving reporting of the on in the corporate code and increasing activity by the Audit Committee whose members.

I think if they are properly equipped with cyber expertise, will be make a valuable contribution. And all of that is is, you know, part of the way we must move forward. But I don't think, having said all that, that private sector security, private sector security, self-help, while essential, is not sufficient. So what should we do? The government correctly tells us that its first duty is the defence and security of the nation and cyber security strategy, which I do know something about having been involved in.

It was founded on the proposition that the protection of the economy involved active, active partnership between public and private sectors. Now the NCC does a vital job in understanding about the threat and giving advice and guidance on countering it, but I think it could do an even more important and larger job. It was intended at the outset to be more public facing than is currently the case, and it has, I think, to some extent, retreated from its previous public start.

I would like to see NCC re-emerge from the shadows with more threat analysis, advice and guidance and its funding increased. To do this, it would be particularly helpful, in my view, to SMEs, and we've all been worried about their access to expertise there and the cost to them, which is not insignificant of security, that it should be somehow alleviated. And they are valuable to us. You know, small, small companies do provide very important parts of larger systems. So if the NCS were to be a much more active security partner to the corporate world, there would be a strong case, in my view, for financial support from the private sector to it, to make it actually a much more joint enterprise.

I do urge the government to put their intelligence capabilities to greater effect in supporting the private sector, in raising its level of security. I don't think this is beyond us, and I think we ought to try to trying to do something where there is much, much closer cooperation between public and private sectors and the the banking world, though different, does give us some, you know, some pointers in the way in which that could be done. Now, secondly, within the public sector, the scope of the bill is puzzlingly selective.

I think other speakers have touched on this. Now, there is palpable anxiety among the general public about the security of one login and accessing government services safely. And I think this is the moment when the government could increase confidence. But not all government services are covered. Take an example. DWP has in its possession detailed personal, not to say, intimate, information about its clients and beneficiaries. Surely it's a candidate for coverage, but it isn't. So I would like to ask the Minister what the criteria are that govern whether a public sector service is covered or not, because on the face of it, I don't think selectivity looks at

**** Possible New Speaker ****

all wise. Well, the government's chosen has been. Excuse me, could I just gently

**** Possible New Speaker ****

Excuse me, could I just gently remind that it's an eight minute advisory backbench time?

**** Possible New Speaker ****

advisory backbench time? I conclude the bill. Let me just say that the Bill recognises the need for regulatory cooperation, need for regulatory cooperation, and it certainly going to be very important if that's made to work. I also agree with those who think also agree with those who think that we should be aligning with things like to, to reduce the potential conflict between ourselves and and other international regulators. I. My last thought is that. We need to ensure that that the level of security approach to the risk posed another definitional issue in the in the in the bill needs actually to again, to be pinned down.

So there's a great deal in the bill which we will want to talk about, I think, at Committee stage to make it actually something where the. Those who are implemented know exactly where their limits lie. Thank you. My Lords. This is proving a fascinating and a valuable debate, recognising the many strengths of this bill. What
18:51
Baroness Alexander of Cleveden Portrait Baroness Alexander of Cleveden (Labour)
-
-
could be tweaked and what perhaps is missing as we look ahead, let me begin with the strengths. And we heard from Lord Effingham that this bill builds on the work of the previous government and cross-party support. We've just heard from Baroness Neville-rolfe that national security is, of course, national security is, of course, the first obligation of government, and this is unarguably an important and this is unarguably an important step in protecting the nation against cyber criminals, hacktivists and hostile states. It will, quite simply make the UK a better place to live, to work and to do business.

We have heard already from Lord Birt about the economic impact of cyber attacks, and from my noble friend the Minister, about the 11,000 NHS appointments that are lost to cyber attacks. So it therefore seems very timely that we have this bill that will cover more essential services, improve regulatory effectiveness and speed up responses to cyber threats. It is clearly desirable that we have a stronger board level responsibility around cyber. It's got to be right that data centres are now included in the Bill, helping maintain the UK's position as a global destination for secure data hosting and for innovation, and the focus on high impact firms means that small companies will not be unduly burdened.

As my noble friend the Minister made clear, this is part of a wider national security effort that includes cyber action plan for the public sector, the forthcoming Cyber Action Plan for business, the Cyber Essentials Certification Scheme, free private cyber security support for NCS and all of these measures will help contribute to our cyber security in future. The 24 hour Incident Reporting System will mean that regulated entities have to notify customers impacted by incidents, and the tougher penalties for breaches will modernise enforcement and, I hope, improve the uptake of cyber insurance in the way Baroness Paul has indicated is so vital.

We have to hope that together this will mean in future, cutting corners will no longer be cheaper than doing the right thing. Nevertheless, given the speed at which new cyber threats are emerging, the Bill does, I think, try and strike a reasonable balance between maintaining parliamentary oversight and ensuring the government can act quickly as required. Let me turn to the question of tweaks, and many of them have been touched on, so I'll not dwell further on them. We heard from Lord Arbuthnot about the importance of the workforce, the increasing demand for cybersecurity skills.

So can I ask the Minister if the proposed codes of practice will include a framework for workforce development and training? Secondly, as many noble Lords have touched upon, is the scope of the Bill. I do have some sympathy for Baroness Northover about the case for closer alignment with EU regulations. When we have British companies operating in complying with the legislation in. In the areas that are covered, I also think a broader scope would drive the sort of behavioural change that my noble friend Baroness Paul cited.

I note that the Minister has already said that secondary legislation is available to expand the scope in future, but I look forward to her comments on why not now. Perhaps a broader scope, given the groundswell already in this debate, and also perhaps a particular look at public administration, local government in particular, given the scale and sensitivity of data and the essential nature of public services. Thirdly, I want to touch on something else that has been widely noted already.

The risks associated with having 12 regulators. Now, I appreciate that the government's intent is minimising regulatory upheaval. There is, of course, a balance to be struck here. Lord Birt approached the issue of risk from the desire and the need to ensure expertise. If I can look at it, perhaps through the risk of the duplication. At lunchtime today, I was speaking at an event that was hosted by a US law firm which counts amongst its clients a major cloud provider, insurance companies, professional services firms and a board effectiveness practice that works with both public and private sector organisations.

The strong consensus in the room was that a common cybersecurity standard across all regulators, upon which appropriate sector specific requirements could be shared merits consideration, and I think this approach may be in the spirit of the government's own amendments tabled in the other place, to streamline reporting and avoid unnecessary complexity. So I hope that issue is given further consideration. My Lord, in my few remaining minutes, I want to touch on what is not in the bill. As others have noted, technology is advancing faster than government frameworks can keep pace.

This bill was published last year just as it became clear that AI was tipping the advantage to attackers. Attackers only need to succeed once, whilst defenders potentially need to patch millions of users, and there is currently no technology to automate patching at the pace that is required. So the bill perhaps needs to say more on the role of integrating AI tools into cyber defenses. Arguably, the bill has an AI shaped hole, although I am encouraged that the incoming Prime Minister has signalled a fresh look at AI regulation.

Even Sam Altman, faced with a capricious precedent, has come round, writing last week in the Ft that citizens and their elected representatives must make the rules. And we have also seen the Five Eyes intelligence partnership. In a very rare joint communique last month, warning that the West's adversaries were just within months of developing cyber attacks that could overwhelm the defences of governments and companies, and noting the AI frontier models will fundamentally transform cyber capabilities. All of this is now with us.

And so raising our defensive capability in the face of this rising AI functionality is going to be essential. Our spy chiefs are asking Western companies to use AI models to strengthen their defences. Now, I fully appreciate that the government is completely across this threat landscape. So the question, my Lords, are how do we collectively legislate or regulate in such a threat landscape? Some suggestions, which I think we can consider in the Committee stage, is that perhaps advanced AI providers could be designated as covered entities under the bill.

Secondly, since the impact of AI in the cyber field is increasingly systemic rather than sector specific, perhaps we do need that common AI cybersecurity guidance supporting all regulators in this fast moving landscape as they then layer on the needs of their sector. Thirdly, perhaps there should be an AI field in the mandatory incident reporting regime. And finally, we should perhaps think about an AI oversight framework giving more teeth and a more coordinating role. So in conclusion, as widely recognised, this bill will support our economy, our people and make the country safer.

It is part of a package. It is a crucial building block rather than the final destination, and I strongly commend it to the chamber. My Lords, I.
19:00
Baroness Kidron Portrait Baroness Kidron (Crossbench)
-
-
Think there's a risk of >> Think there's a risk of agreement breaking out at this juncture. I too, very much welcome juncture. I too, very much welcome the cybersecurity bill and agree with others who've raised the emissions. Nothing for the private sector. Nothing on local authorities. It's focused on the size of service provider rather than risk, and in doing so, failing to learn from the battles during the Online Safety Act, which established beyond doubt that the size of a company does not equate to the risk it poses in any system, there's no mandate for executive responsibilities as in two in Europe, and all of these things feel like critical omissions.

But above all, there is nothing on AI, as we've just heard. And that's where I will focus my remarks. My Lords, in February, Darktrace, the cybersecurity firm based in Cambridge, surveyed cybersecurity professionals and found 73% of them reporting that AI powered threats are already significantly impacting their organisations. Nine out of ten said they needed major upgrades to their defences only. Only weeks ago, the US government instructed anthropic to withdraw two frontier models, going from a zero regulation of AI to a 100% ban within 90 minutes.

This was on the understanding that they posed a national security threat, with capabilities that experts anticipate will be mirrored by other frontier models, including the Chinese. Within months. My Lords, it seems extraordinary ill advised, therefore, that a four is. The AI is not front and center of the bill. Clearly this is a decision rather than an omission. So when she responds, can the noble Lady, the Minister, explain why, given the scale of the cyber security threat presented by AI, the government has chosen not to identify it and tackle it explicitly in the bill? The absence of AI from the bill also means the absence of the AI Security Institute.

AC is recognised globally as world leading. Yet since this government came to power, it has been renamed from Safety to Security Institute. It, and we have heard repeatedly from insiders that they have been instructed not to upset the Americans. And most recently, a decision was made to fold its Societal resilience team, including psychological harms, child safety, environmental harms, synthetic media abuse and faults with using AI for hiring police and credit scoring in favour of the existential threat agenda, which frontier companies prefer to discuss.

Because industry prefers to talk about the harms of the future rather than the ones that are here right now. My Lords, I sit on the Joint Committee of the National Security Strategy, and I simply cannot overstate the repeated cries from the security experts for society wide resilience and a broader definition of security, including information integrity and digital sovereignty. They understand that threats to security are structural, multifaceted, and need constant oversight. So I ask the noble Lady, the Minister, why are we not using this bill to strengthen and empower AC as an independent statutory body to ensure the safety and security of the nation and to provide a constant source of wisdom and expertise over AI across all domains, with a statutory remit that allows them to investigate the full spectrum of unsafe security risks and mandatory rules for AI safety training and reporting of security incidents directly to them.

My Lords, it is easy to dismiss dismiss these issues as outside the cyber security remit, but that is not the case. I was recently at a conference about Agentic AI last week, where medical researchers showed that in 51% of cases when a person should go to hospital, AI told them not to. This has profound consequences for the health of a nation. More chilling. Still, the same experts pointed out that as AI becomes integrated with health records and prescribing systems that a malign actor or hostile state could, in one fell swoop manipulate the online prescriptions of an entire nation.

Similarly, in my conversations with specialist police, they've said they're extremely worried about the way digital services are fuelling an ever growing pipeline of extremists. Yet recent research by the centre for Countering Digital Hate shows that eight out of ten chatbots are willing to plan a school shooting or an attack on a synagogue. And for the first time in 2025, automated traffic overtook human traffic online, much of it concealing its identity, leaving operators unable to distinguish distinguish benign automation from hostile traffic, and it enables the mass harvesting of data used to facilitate a future cyber attack at scale.

As non-human traffic climbs are, exposure to cyber attacks grows with it. At best. The bill is unclear how these sorts of harms impact on our security, and it adds to the mishmash of provisions and Secretary of State powers taken in several previous bills. At worst, these issues are not covered at all. In the other place, the Minister said the bill is technology agnostic, but can the noble Lady, the Minister, explain what that means? In practice? A AI is not simply another risk to be regulated.

It changes the nature, the speed and the scale of cyber attacks themselves. Two weeks ago, I and several other noble Lords received a briefing from the Institute for AI Policy and Strategy and the centre for Long Term Resilience. They are at the forefront of tracing emerging technologies and threats, and they set out a clear strategy built around four ideas delay, defend, detect and disrupt. They have practical proposals under each heading to improve the bill that would give us greater oversight, greater transparency, narrow the spectrum of risk and neutralise the risk.

But as it stands, the Secretary of State, as she has done on so many occasions, has taken powers to herself rather than offering Parliament a coherent plan of action. In short, my Lords, the greatest omission in the Bill is that it focuses primarily on what a limited set of companies and service providers should do, and too little on the resilience of the wider digital system. My Lords, over the last two years, we have seen the way in which dependencies on US tech have muted our ability to protect children.

Creatives make our NHS and government data vulnerable and our economy vulnerable. A truly secure cyber policy is a sovereign one, in which gives the government control over key choke holds in the system. Oversight over critical infrastructure, whilst encouraging a far greater range of providers, retains valuable data in the UK, prioritises UK tech companies and deliberately works alongside other middle powers by building relationships in which we are a rule maker rather than a rule taker. That, to my mind, is the real opportunity presented by this bill.

It is an opportunity that is yet to be realised.
19:08
Baroness Bennett of Manor Castle Portrait Baroness Bennett of Manor Castle (Green Party)
-
-
Yes, yes. >> Yes, yes. >> My Lords, it's a great pleasure to follow the noble Lady, Baroness Kidron, and her points about Kidron, and her points about digital sovereignty are ones that I will come back to, but I thank the. The noble Lady, the Minister also, The noble Lady, the Minister also, for introducing this bill, and I have been reflecting back. I'm approaching my eighth year in your Lordships House, and we have come a long way. About seven years ago I was standing behind the bar and a member of your Lordships House, who shall remain nameless, sidled up to me and said, they're talking about catfishing.

I gather that doesn't mean being beside a river with a rod. And I said, no, you're right, well done, well worked out. But we have come a long way. But of course, the world has changed an enormous amount in those eight years. And the message we've got from all corners of your Lordships House today is that the government is not keeping up, and your Lordships House is going to try and have to do its best to keep up for it and push the government in those ways.

Now, the noble Lady, the Minister in the introduction, talked about data centres as being a key part of the modern world. Their security, of course, has very reliant on water and energy supplies, just as all of our security is being impacted by their consumption of those supplies, something we really haven't talked about yet but need to think about a lot, is we tend to think about these information systems and networks as being up in the cloud, but of course, they are very physically, very much physically down to earth and dependent on all of our natural physical systems.

And that cannot be forgotten. But I'm going to focus mostly on two areas of concern that are missing or inadequately covered in this bill. In terms of our network and information systems. Now, there is literally right at this moment on Trafalgar Square, a Trojan horse reminder in mythological form to beware of Greeks bearing gifts, at least if they've just been besieging your city. I put it to the government that this is a parallel that they should be considering.

Beware of Silicon Valley tech bros bearing shiny, undeliverable promises with large lobbying budgets and frighteningly undemocratic values that bear allegiance to a state of doubtful levels of democracy and consistency. I do also just want to respond directly to the noble Lord, Lord Birt, who spoke about the risks of open source software volunteer run. Of course, it's very possible to question which is the greater risk a Silicon Valley tech row or a whole lot of people who were trying to work for the common good.

I might perhaps come. We might debate that as we go along. But this what we are talking about is the noble Lady, Baroness Kidron, identified. We are talking about digital sovereignty, and I draw your Lordships House to amendment tabled by my hon. Friend Sian Berry. In the other place that wasn't debated down there, about calling for the government to have a digital sovereignty strategy. It says the government must have and maintain this, which sets out the government's assessment of risks to network and information systems arising from a dependence on hardware, software or digital services that may be subject to foreign interference of the kind that the noble Lady, Baroness Kidron, referred to in terms of AI systems.

Extraterritorial legal requirements that may be imposed on non-domicile suppliers and vulnerabilities, undue control or supply chain dependency on foreign states and entities. So, my Lords, I think this is something that I'm sure everyone in your Lordships House knows what I'm talking about, but I'm just going to pick one example as a case study, a company whose place in our society, the values of its founders, owners and leaders give rise to concern in Parliament and with the public. I'm talking, of course, about Palantir.

Last month, the science, Innovation and Technology Committee warned it is often the only company capable of providing what's known as middleware, which is relied on by many public bodies. The committee also identified Microsoft and Amazon Web Services. And let's focus on this. These are. You don't even need the fingers of one hand to count the. Absolutely central suppliers here that they were putting us at the mercy of foreign actors. And the committee very explicitly called for the government to exercise the 2027 break clause in the NHS Federated Data Platform contract, ideally to develop an in-house replacement.

So that's one sovereign issue. I also want to raise a second sovereign issue, which faces towards perhaps a more obvious international danger, one that the government, I hope, will not deny. And that is, as was debated in the other place, the need for a critical safeguard in this bill for an anti transnational repression amendment. Now, I happen to know that the noble Lord, Lord Alton of Liverpool, who cannot be with us today, unfortunately intends to table an amendment as we progress this legislation because at the moment this bill creates a dangerous loophole.

It permits the sharing of highly sensitive network and information systems data with overseas authorities, without checking if those authorities operate within a system that guarantees legal standards and human rights. There needs to be a rule that says, let's check and think before we share. Now, it's important to say that this is not an act of specific measure. It's a universal principle based safeguard that would apply to any regime, anywhere in the world that rejects the rule of law.

It requires the Secretary of State to actively consult subject matter experts and civil society groups to identify compromised jurisdictions. We have to be realistic about the state of the world now, and authoritarian states have a long and troubling track record of using international structures such as Interpol notices, for example, to mask political persecution under the guise of criminal justice. And I should perhaps declare at this point that until recently, I was co-chair of the all party parliamentary group on Hong Kong.

So I will focus briefly on the issue of China. UN special rapporteurs have pointed out the issues there, and we cannot assume that so-called safe third countries will protect dissidents. Countries like Spain have also authorized extraditions to China. Cyprus has accepted individual quote unquote assurances, and countries like Hungary and Serbia are actively deepening, deepening judicial cooperation with Beijing. Now, the UK, of course, has suspended its treaty with formal treaty with Hong Kong. But recent proposed changes to the Extradition Act of 2003 opened the door to case by case, ad hoc arrangements.

And it's worth saying that this data includes IP addresses, digital fingerprints and user level logs. The concern doesn't just rely on extradition. This allows authoritarian states to identify dissidents in the UK, and we know that transnational repression against those dissidents has been a growing concern of great concern to diaspora communities and human rights defenders. So, my Lords, this bill needs a lot of work, has very many people have said, and there's really foundational work here that needs to be done.
19:17
Lord Forbes of Newcastle Portrait Lord Forbes of Newcastle (Labour)
-
-
My Lords, this bill sits squarely within the wider national security and preparedness agenda security and preparedness agenda that this House has repeatedly returned to in recent months. Since the publication of the Strategic Strategic Defence Review, we have spoken often about the interlocking nature of modern threats, geopolitical instability, climate shocks, pressure on critical infrastructure, and the growing complexity of our digital systems. This bill is therefore not a narrow technical measure. It is a national security bill and it deserves to be treated as such.

Every essential service in the United Kingdom, whether that be our energy grids, our water systems, our transport networks, our hospitals, our financial services now depend on digital infrastructure. The boundary between physical and digital security has dissolved. A cyber attack on a hospital is not an IT problem. It is a threat to life, a breach in a water company's control systems is not a data incident. It is a public health emergency and a compromise in a major data center or managed service provider can cascade and cause chaos across the economy in minutes.

We have seen in recent years how ransomware attacks have disrupted patient care or student learning, how supply chain vulnerabilities have exposed critical national infrastructure, and how hostile actors, some criminal, some state linked, have sought to test the resilience of our systems to destruction. The economic costs run into billions. The strategic cost is greater still, weakened confidence, reduced competitiveness and nation continually forced into reactive crisis management rather than forward looking preparedness. My Lords, resilience is not a cost.

It is a foundation stone of our national strength, and this bill is a necessary step in strengthening that foundation, the existing Network and Information Systems regulations introduced in 2018 were an important milestone, but the digital ecosystem has changed beyond recognition. In the years since, cloud computing, large scale data centres, outsourced managed services and complex supply chains now underpin almost every aspect of our national life. The regulatory perimeters and safeguards put in place almost a decade ago have not kept pace with the reality of modern risks.

This bill addresses that gap. It expands the scope of regulation to include data centres, managed service providers and critical suppliers. Crucially, it recognises that vulnerabilities often sit not in the front line operator, but in the third party services on which they depend. It strengthens incident reporting, ensuring that regulators receive timely, accurate information and that customers are informed when their services or data may be affected. It introduces statutory codes of practice, giving clarity to industry and consistency to regulators, and it provides modern enforcement and cost recovery powers, enabling regulators to act decisively when standards are not met.

Crucially, the bill requires the Secretary of State to publish a statement of strategic priorities for cyber resilience. This is a significant and very welcome development. It aligns regulators, industry and public services around a shared national mission. It ensures that our approach to cyber resilience is not fragmented or reactive, but coherent, strategic and future focused. And this bill is not simply about technology. It is about people. Cyber incidents disrupt lives, cancelled hospital appointments, delayed trains, compromised personal data, businesses unable to trade, local authorities unable to deliver essential services.

The public rightly expect that the systems they rely on every day are secure. This bill helps us to continue to meet those expectations. It also fits squarely within the broader preparedness agenda that many of us in your Lordships House have championed since the gracious speech. We have argued consistently for a whole system approach to resilience, one that recognises that national security considerations are not confined to the worlds of defence or intelligence, but include the stability of our infrastructure, the integrity of our supply chains and the confidence of our citizens.

Cyber resilience is now as fundamental as physical resilience. The two, my Lords, cannot be separated. We have also emphasised the importance of place based resilience. Local authorities, NHS trusts, utility companies and regional industries all depend on secure digital systems. A cyber incident in one part of the country can have national consequences. Strengthening digital resilience strengthens local resilience and vice versa, and we continue to make the economic case secure. Systems underpin investment, innovation and job creation.

They are essential to the competitiveness of our industries and the stability of our financial markets. In a world where digital infrastructure is as critical as roads or railways, cyber resilience is now an economic imperative, and cyber resilience, my Lords, is and must be a shared responsibility. Government, regulators, industry, public services and communities all have a role to play. This bill strengthens the framework within which that shared responsibility can be exercised, so this bill is timely and necessary, but it is not sufficient.

Legislation alone cannot deliver the resilience digital nation we need to become. We must understand the current limitations of our sovereign digital capabilities and take urgent steps to address this major vulnerability. We must invest in skills, in innovation and in the capacity of regulators. We must support industry to meet higher standards, and we must foster a culture of preparedness, one that anticipates risk rather than waits for crisis. I end with a brief reference to the motto of my home city of Newcastle upon Tyne, and I am not, my Lords, a Latin speaker, so I apologise to anyone if my pronunciation pronunciation offends any of those in your Lordships chamber that are 40 to defend it triumphant or triumphing by brave defence emblazoned across our city's crest, celebrates the victories won by the city in the 1600s against marauding invaders.

It symbolises the city's ability to withstand such assaults through its collective spirit of preparedness and fortitude. The lesson I believe we can draw from the history of Newcastle for this modern age is that by strengthening the digital sinews that hold our country together, we strengthen the country itself in the very act of doing so, we cast a defensive shadow against those who seek to do us harm and ultimately reduce the risk of attack in the first place. This bill, my Lords, is an important step in that direction and I am pleased to support it today in your Lordships House.
19:25
Baroness Ludford Portrait Baroness Ludford (Liberal Democrat)
-
-
My Lords, I see I. I have gone down on the speaker's list as Baroness Ludford first half, presumably in the expectation that I will make the second half of my speech later. Only kidding, only kidding. I knew I would learn a lot in this debate and I am not disappointed. I am no expert on cyber issues and I'm only speaking because. Firstly, it's an interesting as well as vital topic. Secondly, because my noble friend Lord Clement-Jones is very persuasive.

And thirdly, because the bill has prompted me to revisit my memory of being the victim of a cyber attack. 13 years ago, I was involved as an MEP on the drafting of the General Data Protection Regulation, the GDPR, and I see the noble Lord, Lord Morris, nodding in collective memory. I had sought to take a balanced approach, safeguarding personal data, but also not totally hampering digital services by overloading overloading them with red tape. This middle way did not please a group of extremist hacktivists who labelled me an agent of Big Tech and launched a denial of service attack against my MEP website.

It was successfully defended by the small firm which hosted my website, and indeed those of some Lib Dem MPs, including a coalition Minister or two. And they kept all the logs for me as I wanted to notify the police. I could not find anyone in the met to speak to. So since I was in touch with Europol and its British director at the time, his Chief of Staff kindly spoke to old colleagues and got an inspector to ring me. This chap was not only uninterested, but cross that I had got rank pulled on him, and he did not deign to pursue any inquiry.

I relate that anecdote to illustrate, firstly, that cyber resilience is a whole of society concern which needs to bring in all of us non-experts. But secondly, that the exclusion from the Bill of Public Sector services is a worrying hole. Politicians and political parties, as well as the police, local authorities and others, are rather key players in the cyber security ecosphere and I hope we will be exploring it further. Stages of this bill. The government's rationale for exclusions at Second Reading. In the other place, Minister for digital, Government and Data Ian Murray agreed that cyber security, quote, is very much an economic growth issue.

As we can see from the impact it has on our economy. Both Mr. Murray and his colleague Nisha Narayan, cited the 15 billion a year cost of cyber attacks to UK businesses. But in response to calls to include private sectors like retail and manufacturing, and also small and medium sized companies, Mr. Narayan claimed that, quote, introducing blanket coverage for whole new sectors would create extensive regulatory burdens for more of our economy, stifling economic growth. So, on the one hand, the government acknowledges the devastating cost to the economy of cyber security breaches of both public and private operators, but on the other hand, has including them in the bill, would damage the economy.

There's absolutely no logic to this. The sorely needed intent to boost the pipeline of professionals is, of course, welcome. But another thing the government could do on training is to protect the practice of ethical hacking as part of testing of networks. So this workforce is as prepared as they possibly can be to combat weaknesses in cyber protection. Is this going to happen via a reform and updating of the 1990 Computer Misuse Act? But the effort needs to encompass not only professionals, but all of us non-techies even oldies like me.

Given that the most common password in this country is apparently the word password, much lip service is paid to addressing digital exclusion. But there are huge numbers of people, a lot of them old, but not all of them old, who have not received any training and are still left out. So how does the government plan to expand to extend whole of society awareness of cyber safety to everyone living in this country, and not just regarded as a limited legislative exercise? And while doing that, the government could surely not avoid the issue of cyber enabled fraud, which is a multibillion pound epidemic in which criminals often compromise individual customers as a route into wider systems.

But I don't think is covered at all in this bill. The government's response to demands for the bill to place responsibilities on boards and senior executives has been as feeble as its muddle on the economic impact, Minister Narayan told the Other Place that last year, the government wrote to chief executives requesting requesting that they make cyber security a board level responsibility. That, in my opinion, is a bit pathetic with the consequences of neglect so clear a request is simply not good enough.

So the government should make cyber security a legal requirement on bosses, which would boost accountability. But alongside that, it could slim the bill's administrative load by clarifying responsibilities, definitions and thresholds. Having a single unified reporting portal rather than 12 regulators avoiding over reporting, which will simply make the wood invisible for the trees, and including a duty to consult on secondary legislation, not just an option, among many other streamlining, leaving the strategic priority statement to the government to draw up is a huge chunk of delegation.

This this bill is really a little bit of a mess, a combination of lots of executive power and lots of amending of the 2018 regulations. It might have been better to write a whole clean

**** Possible New Speaker ****

and comprehensive new bill. Yeah. We can no longer channel EU law into our jurisdiction because the European Communities Act was abolished. But in an era of abolished. But in an era of alignment, indeed dynamic alignment, the disparities between the government's choices in the Bill and the EU's proposed three directive are puzzling. As my noble friend Baroness Northover and friend Baroness Northover and others have pointed out, both to lighten the regulatory load on UK companies working across Europe and to facilitate cooperation with the EU, it would make sense to have a greater similarity between this bill and the EU's imminent new directive.

But the Bill is much more limited than the draft directive in its sectoral coverage and different in regulatory design. For instance, keeping different categories of regulated entities within the EU is bringing them all together and then distinguishing purely between essential or important. I am all for regulation being proportionate and flexible when that works. And I and some other British MEPs thought with some success to bring that into the GDPR. But can the noble Lord, the Minister, be explicit about why the government has diverged rather decisively from EU model and indeed left so much detail to executive discretion.

And when it comes to the desired digital sovereignty to avoid in future the servitude to US tech and the US government that the mythos episode demonstrated. Would it not make much more sense to work more closely the EU, so that British companies can help contribute to and benefit from a European market in digital commercial opportunities? I very much look forward to working with

**** Possible New Speaker ****

colleagues on these benches and across the House to improve this rather unambitious bill. Yeah, yeah, yeah.

**** Possible New Speaker ****

Yeah, yeah, yeah. My Lords, it's a pleasure to take part in this debate on Second Reading. I'm not taking part Reading. I'm not taking part because I was once hacked, but because I was very briefly the cyber security Minister, which is almost as surprising as learning almost as surprising as learning that I was once the Minister of Fashion. I think that several Fashion. I think that several themes have emerged during this very interesting debate, and I always find it interesting to
19:34
Lord Vaizey of Didcot Portrait Lord Vaizey of Didcot (Conservative)
-
-
debate a bill on technology, because the process of legislation is so ponderous and takes so long is so ponderous and takes so long when digital technology moves so fast. And I think there is a recurring theme, of course, that recurring theme, of course, that everything is digital. So the other thing I always find odd when we debate legislation like this, is debate legislation like this, is how we seem to continue to work in silos. AI has been mentioned so many times and AI is so important, many times and AI is so important, but I do recognise the need to have legislation to provide the government with a framework, just as the Online Safety Act has provided the government with a framework on which we can move forward on online safety.

And I'm less concerned about executive action and endless consultation, and I want to be able to have have the government have the powers to move quickly in this important area. As an opening remark, I'll say something perhaps counterintuitive, which is cyber security, as well as being a threat, is also a great opportunity. And I think it's very important for us not to lose sight of the fact that the UK is one of the leading countries in the world in terms of cyber security expertise.

We have a cluster of great companies built around Gchq, and we mustn't lose sight as we debate all these important issues of the fact that we have great world leading expertise which can actually contribute to the growth in our economy. When we talk about the defence investment plan, for example, it's important to talk about the huge opportunities we potentially have in creating great defence tech companies, so we shouldn't lose sight of the opportunity to create create great British cyber security companies, which goes to the point about potentially the whole debate about sovereignty and giving us our own capability.

Let me begin by echoing a number of speeches as well about how important it is, I think, to work in lockstep with our EU partners. It is a piece of irony that this legislation emerges effectively from a European directive. When we were beginning to debate, when I was the cyber security Minister, and in fact, this legislation is necessary because we cannot transpose European legislation any more directly into British legislation. But just as Baroness Ludford mentioned, the GDPR, it is the fact that Brussels often can take the lead in regulation like this, and big multinational companies tend to look at the biggest regulatory space in order to adhere to it.

So it is important that we are mindful of how Brussels plans to proceed in this area, even if we find areas where we can be more flexible. People have talked about our bad record in the UK on cyber security. In terms of cybersecurity attacks. I suspect that is because we remain still, I think the most digital nation in the EU and the English language as well provides us weirdly with some kind of vulnerability. But we are at the forefront of cyber security attacks, and it's important that we have the legislation and the bodies capable of responding to them.

Several themes have emerged. When I was the cyber security Minister, we did begin the preparations for the National Cyber Security Centre, and I thought that was incredibly important. I used to have a mantra that business in particular needed one front door that they could walk through in order to get the advice and expertise they needed to draw on to protect themselves. And we've talked constantly in this debate about 12 regulators, and I would echo the calls to provide a uniform platform for all those regulators, which can read across all the regulators, and they can add on top of that any sector specific needs that they meet.

But I also recognise the calls from many noble Lords to say that this is perhaps an artificially constrained bill, focusing on only a few sectors, a few vital sectors that are important to protect instead, as it were, seeing the whole picture and understanding, as many noble Lords have said, that cyber security pervades everywhere. And there are so many different ways that we should look at how to protect ourselves in this age. One of which, of course, is we mustn't lose sight of the hardware.

The noble Baroness, the Minister, spoke about software as a service is very important to remember that many of our public service providers, for example, still rely on ageing infrastructure, which provides a huge vulnerabilities to cyber security attacks. And I wonder whether the government has a strategy to update much of the hardware that's still being used. I was also interested in the remarks made about how vendors of software should be accountable, and I think that is a very important avenue to explore, to explore whether perhaps we could introduce a kite marks and audits of software providers to ensure that they are providing as robust cyber security, cyber secure software as can be.

And as, again, as the noble Baroness said, we can count on the fingers of one hand the main providers of the software that is used in the vast amount of businesses, and they also work with us, as it were, to be on the front line. It is interesting that this this issue has become an issue of sovereignty. I'm fascinated by the debate about the use of Palantir, for example. Personally, I have no problem with working with Palantir. I think they provide a vital service, and I hope that the government will be cautious in listening to the siren calls of people who say, don't work with these companies, simply because we disagree with the slightly bizarre views of some of their chief executives.

But nevertheless, it does call for the government, perhaps, to have a consistent story on this. One thought that occurred to me as the debate was continuing is what has happened to the debate about encryption? This is a dog that no longer seems to be barking. We had a very vigorous debate in the last few years about potential backdoors to encryption, about the security services being given, as it were, cyber keys to be able to access encrypted services like WhatsApp and signal, and a big pushback from the tech industry about how that would create big cyber vulnerabilities.

And I wonder whether the government has come to a settled view on that. And to return to the theme about the opportunities for the economy, the the need to invest in cyber skills in our workforce is absolutely vital to create a cyber workforce, a cyber defence force that works to protect the country, but works to give companies the kind of skills base they need to make themselves secure. And again, I would echo the call from Baroness Ludford about boards I was astonished to read in the House of Lords Library briefing that the number of board members with responsible for cyber has actually apparently fallen.

I don't know if that is true, and I don't know whether it's possible to work with the business bodies like the I, O, D and CBI to make it a strong corporate governance recommendation that every board should have somebody with a specialism, with a responsibility rather for cyber. Because, as I said at the beginning, this is a partnership and it's business as much as government that will protect us from cyber. And there's been reference, for example, to the insurance industry. One of the best ways that we can ensure that companies invest in cyber security is to make it mandatory to get cyber insurance, which you can't get unless you've put cyber secure measures in place, and also law firms in order to protect themselves from liability to take put in place important cyber measures.

I haven't made. I had a chance to support Lord Clement-Jones in his 50 year call for ethical hackers to be allowed to hack, and I would also echo the earlier call about the minister's views on the rise of bots and their impact on cyber security.
19:42
Baroness Gill Portrait Baroness Gill (Labour)
-
-
My Lords, too often we hear in >> My Lords, too often we hear in the news that our local hospital cannot access patient records. The cannot access patient records. The transport network in our cities is stalled. Or, as I've experienced stalled. Or, as I've experienced last year, on and off power for over a month. Whilst the local electricity grid had been affected by cyber attacks a decade ago, some of this would have sounded like a plot of a Hollywood movie.

Today, it is a weekly briefing on the desk of our cyber security data centres. Our world has fundamentally changed. We are no longer just fighting off rogue teenagers or opportunistic hackers looking for a quick payout. The UK is currently navigating a highly sophisticated, aggressive digital battlefield. Malign actors are often directed, tolerated or unleashed by hostile nation states like Russia, Iran and China, who are actively infiltrating key UK assets. They are mapping our infrastructure, stealing government credentials and probing our defences.

That is why I welcome the introduction of the Cyber Security and Resilience Bill. It is a critical, long overdue overhaul of our national baseline defence. It marks the moment the UK stops playing catch up with hostile states in starts to dictate the terms of our own digital safety. To understand why this bill matters, we have to look at how our digital ecosystem actually functions. Hostile actors do not just knock on the front door, they look for the weakest link in the supply chain.

Look at what happened in September 2025 with the devastating cyber attack on Jaguar Land Rover. Russia linked hackers deployed sophisticated ransomware that completely paralysed jailers IT networks. It forced a total shutdown of production lines across major UK plants for weeks. It had major impact on the workflow workforce. In my old constituency of West Midlands, the disruption that cascaded down into the automotive supply chain, affecting thousands of components manufacturers, mostly SMEs, with many workers facing layoffs around the region, had a major impact on the regional economy.

Likewise, it didn't just hurt the brand. It cost the British economy an estimated 1.9 billion, directly denting our national GDP. This wasn't just a corporate crime, it was an act of economic sabotage. And the threat extends far beyond manufacturing. Just weeks later, a massive cyber incident crippled electronic check in and baggage systems at Heathrow Airport and across Europe. Was Heathrow's central system breached directly? Know the attackers targeted a third party vendor, Collins Aerospace, scrambling the shared new software that multiple airlines rely on.

The result chaos at terminals, manual work at hundreds of disrupted flights, and over 1.5 million passenger records compromised. So this new legislation fundamentally expands our defensive perimeter to address this exact vulnerability. For the first time, it brings data centres, managed service providers and supply chain partners directly into the regulatory spotlight, establishing a framework to name a designated critical suppliers. This bill recognises a hard truth that our infrastructure is only as secure as the third party software we plug into it.

Because of these aggressive state threats, our wider net is useless without sharper teeth. This bill introduces two massive shifts in how organisations must run rapid transparency and genuine board level accountability. Under the new rules, if a covered organisation suffers a significant incident or even a near miss capable of causing harm, they must file a notification within 24 hours, followed by a full report within 72 hours. Because in cyber crisis, time is our most valuable currency, when all assets like Heathrow or JLR goes down, any early warning allows the National Cyber Security Centre and regulators to contain the digital contagion before it spreads.

There are real consequences of negligence. For too long, cyber security has been treated by some boards as a minor IT issue, tucked away obscurely in finance or some other department. This bill, I am very pleased, changes this calculation. Companies that do not comply face financial penalties up to 17 million or 4% of their global worldwide turnover. This forces the executives to realise that the robust cyber security is the core fiduciary duty. If you do not protect your network, you are jeopardizing your entire business.

Crucially, this legislation is built to outpace our adversaries. Nation states use criminal proxies because they are fast, scalable and disguised geopolitical motives. Static laws become obsolete within months. This bill grants the government agile powers to update regulations swiftly through secondary legislation. This means that as new state sponsored threats emerge, whether through weaponised artificial intelligence or quantum decryption, the UK can adapt its defences instantly without waiting years for a new act of Parliament. It also mandates the companies immediately to notify their own customers if a breach puts them at risk.

To conclude, let us be entirely clear this bill is demanding. It will require an unprecedented level of capital investment and profound cultural change from every boardroom in this country. And though I would urge the Minister to consider undue burden on the SME sector, whilst recognising that they can sometimes be the weakest link, but we cannot ignore the reality of implementation, and cultural change does not happen purely through goodwill. It happens when the risk of non-compliance becomes completely indefensible.

So I'd like to ask directly, my noble friend the Minister, a fundamental question. While the target of this bill is correct, the level of commercial investment and cultural transformation needed to meet these 24 hour deadlines staggering beyond the immense financial stake, what mechanisms, support and enforce frameworks will the Minister use to ensure this legislation drives genuine resilience, rather than just defensive corporate box ticking? How will you guarantee that this heavy stick builds a shield? Thank you.
19:51
Lord Ravensdale Portrait Lord Ravensdale (Crossbench)
-
-
I declare. Wireless and support this bill. Given the threats that we are facing, strengthening the cyber security of the UK is vital. I do security of the UK is vital. I do think the flexible, risk based approach taken within this bill is approach taken within this bill is the right one. Noble Lords have made many of the broader points already, so I'll focus on a few a few narrow points, but my remarks are really centred around the impact on economic growth and the need for proportionate regulation, because this legislation does support growth through, firstly, increasing our cyber resilience.

The noble Baroness, Lady Norfolk Northover, gave the example of the the £15 billion cost of cyber attacks in 2024, and that's actually a significant fraction of our GDP, around 0.5%. But also, I'm glad that the Lord, Lord Vaizey brought out our world leading cyber industry. So this this bill does represent a great opportunity there for one of our key industries. However, there are threats to that growth agenda within the bill, particularly through how larger corporates and SMEs will be affected.

And we do need to tread extremely carefully here. Business already has to deal with much burdensome regulation. As the noble Earl Lord Effingham, sets out at the at the beginning and as ever in legislation, we do need to think about those unintended consequences of of legislation. So to this end, there are three points that I would like to make. Now, looking at some of the detail of the bill, my first point is around supply chains. Now, clause 12 in the bill rightly brings in the concept of critical suppliers and ensures that supply chains are also within the scope of the regulations.

However, given the ambiguity of the criteria for designation, there is a risk, my Lords, that a significant number of SMEs could be affected, perhaps unintentionally, by this legislation. So I would be grateful if the noble Lady, the Minister, could set out what steps the government is taking to ensure that the critical supplier designation is restricted to suppliers, posing genuine systemic risks to the UK economy, because terms like potential to cause disruption, which is the wording used in the Bill, are qualitative and there are no hard quantitative thresholds in the bill.

So the risk, of course, is that a significant number of SMEs could be brought within scope, stifling those businesses in unnecessary regulation. We need to ensure that is proportionate and going through the bill. Continuing on this theme, my Lords, is clause 15 on reporting as to expand on what the noble Lady the Minister set out at the start. Clause 15 expands the definition of a reportable incident to include those, I quote, capable of having an adverse effect on network and information systems.

So the risk is that this could lead to overreporting as even perhaps a minor phishing email could be deemed to be capable of having an adverse effect. And then we could see overreporting perhaps overwhelming systems and bringing the risks that genuine threats could get through. So I'd also be grateful if the Minister could could tell us how the government will ensure that the capable of having an adverse effect threshold does not lead to overreporting of low level incidents.

Now, my Lord Lords, we've heard a lot of talk about AI in this debate and perhaps a little less on quantum. So I do I do want to bring up quantum as a specific aspect here. As the noble Lord, Lord Berts referred to. Now, I appreciate there's a difficult balance here. This is a framework, Bill, and it's perhaps not appropriate to set out specific technologies or technology impacts on the face of the bill. However, the threat of quantum computers using algorithms like Shor's algorithm to crack current public key crypto such as RSA enabling harvest, now decrypt later attacks on sensitive data is something that will come sooner or later.

And quantum computing is evolving astonishingly quickly. Now, the Parliamentary Office of Science and Technology, posts of which I'm vice chair of the board, have set out around a ten year timescale when a quantum computer will be able to break conventional encryption. And that does align with the the National Cyber Security Centre, which has already set out that organisations must complete migration to post-quantum crypto by 2035. But my Lords, I would. I would be grateful for the Minister's thoughts on how.

Perhaps this could be strengthened within the Bill. For example, the. The statement of Strategic priorities in clause 25. Really. Could there be something in that to help to join together the regulators in terms of that focus that is required on on quantum cryptography? So I'd I'd be very grateful for the the minister's thoughts on that to really key area, but in general, as I said, support the bill. Look forward to working with the Minister and her team as we move towards committee.



**** Possible New Speaker ****

My Lords, earlier today, the noble Viscount Colville and I were discussing that we were both quite discussing that we were both quite late down this list and feared that everything would already have been said. That does appear to be the said. That does appear to be the case, but fear not, I will still use my eight minutes. I do support this bill and I do agree with many noble Lords that we also need a
19:57
Baroness Harding of Winscombe Portrait Baroness Harding of Winscombe (Conservative)
-
-
noble Lords that we also need a much more comprehensive cyber security strategy, and like others, I have got some specific suggestions to this specific bill. My unique contribution, if it is unique, is that I am not an engineer and tech expert. As as the noble Lord clearly is, I think in health terms would be described as someone as an expert by lived experience in that I suspect I am the only noble Lord today. Probably the only noble Lord in in our on the roster who has actually been a CEO faced with a cyber attack, I have been that CEO whose company has been targeted by a gang of hackers trying to work out how to navigate the crisis.

I have had to go out and communicate to regulators, to customers, to shareholders, to Ministers, indeed to the my noble friend himself. In those days, the National Cyber Security Centre didn't exist. We were. Instead. I am obviously referring to my time as chief executive of TalkTalk. We were directed to the Metropolitan Police's hostage negotiation team. They were lovely, but unfortunately had no tech experience at all. In fact, we did know better ourselves. The security expert that came to brief the TalkTalk board had just come from Mexico, where he had been trying to get a bank manager back who had been kidnapped.

That was only 11 years ago, my Lords. At TalkTalk, we took the view that communicating was the only way to help our customers and therefore the only way to save the company. And I stand by that decision now. But my Lords, not everyone takes that view. I was accused at the time of being hopelessly naive for going out within 24 and 48 hours onto the airwaves and saying, my customers have been attacked. And no, I don't know exactly what has happened.

That is the timetable of this legislation. Most CEOs I talk to say, firstly, God, I'm glad I wasn't in that situation. That's my nightmare. And secondly, a surprised when I say that actually I would communicate earlier if if I was in that situation again, not later. Cyber attacks, my Lords, are a modern day taboo in the business world. Business leaders are terrified of admitting that they have been attacked, and I'm afraid that does mean mandating reporting is essential, because 11 years after I was in that situation, I actually don't think that's changed.

I think unless you do make it mandatory to report, people won't. So I was surprised at the time in 2015 that had Sainsbury's or Tesco been hacked, I wouldn't have had to have gone and told anybody. I had just come from Sainsbury's as my previous job. It's really depressing 11 years later to see that retail is still being excluded. I can't quite understand why water is essential, but food isn't. I really do think that Covid taught us that our retail food retail supply chain is, is, is an essential service and those that work in it are essential workers.

Managed service providers are in. But AI generative AI is out. Only a decade ago, that might have been OK, but it isn't now. In the other place, the Minister said that it's OK. There are powers in the bill so that we can get it right in the future. Well, we need to get it right now and we need the powers to try and keep up. I'm not against giving Ministers the power to keep this alive, but that's not an excuse for not being up to date today.

And as other noble Lords have said, it's sadly looks as if the EU has got this more right than we have. So we should be we should be humble enough to admit that rather than afraid and insist on doing the wrong thing. The other area I thought I'd give some lived experience in again has been mentioned by other noble Lords, which is the challenge of 12 regulators and the lack of. Join up. When the TalkTalk hack happened, we immediately stood up a series of work streams.

The obvious things like trying to work out what's happened. That is the biggest problem with the cyber attack. You genuinely do not know if you've been attacked by a nation state or if it's kids in the bedroom. You sometimes somehow hope it might be the former, but more often than not turns out to be the latter. So you have to know what's happened. You have to start communicating before you know what's happened. That's two work streams. You have to work out how to get your systems back up again.

That's another work stream. Even 11 years ago, without any of these additional regulators, we had to have a communicating with regulators. Work stream. Now, spare a thought for the poor managed service providers. They're companies that serve transport, telecoms, energy, the NHS. I think they might have a full house that if you were a managed service provider who suffered with a victim, the victim, remember, of a of an attack, you've probably got to deal with all 12 regulators. And we know, my Lords, those of us who've been here for a while, we do know that if you give 12 different public sector bodies the ability to define terms, they will define them 12 different ways, and they will have 12 different forms.

And that will stop you in the 24, 48 hours, the first week of a cyber attack, doing the things that you should be doing to try and protect your customers. So from an expert through lived experience, it is a genuine plea from me to, to, to the noble Lady, the Minister. Join up is essential. It shouldn't be optional. We all know it's hard to do. And if you don't sort it out in the bill, it won't happen. And please don't make that join up a forum.

We know that. Again, I can put myself back into that October 2015 and imagine having to communicate with the. Much as I love them, the DCRF. If we had to convene a meeting of 12 regulators in the heat of the crisis to work out what to do, that would not have helped anybody. So we either need a single regulator. As the noble Lord Birt so eloquently set out, or we need a regulator, as I know the government is looking at in a number of other areas, to try and reduce the burden of regulation.

I very much support what my noble friend Lord Effingham, said, that regulation does look like it's necessary here, but we do need to be careful that we are not just layering burden upon burden and doing it 12 times most definitely is. So, my Lords, I feel I've said nothing original at all, but possibly from a unique perspective. I am rare amongst past chief executives who've experienced a cyber attack in that I am willing to talk about it, which is exactly why this legislation is important.

But my Lords, I very much hope that, as with so many tech issues, the noble Lady, the Minister, will hear that actually we agree more than we disagree, and that perhaps we could work together to improve this bill, as this House is often quite good at doing.
20:04
Lord Taylor of Warwick Portrait Lord Taylor of Warwick (Non-affiliated)
-
-
And I thank the noble Minister for introducing this important bill. for introducing this important bill. Cyber security is clearly a vital importance to the protection and importance to the protection and prosperity of our nation. But if we fail to plan, then we plan to fail. fail to plan, then we plan to fail. And this bill is at the heart of the government's cyber security plan. I was born and raised in a part of the world that many think of as Paradise, bliss, Utopia.

It's called Birmingham, just off the M6 motorway by the gasworks, and I can see the sun accord there. Or maybe it should go to VARI don't know. I was a district councillor in that region and one of the largest employers there are Jaguar Land Rover. Now, this giant motor vehicle manufacturer is the head of a supply chain of over 4000 companies. JLR were the victim, as we all know, of a cyber attack last year and were bailed out by this government to the tune of £1.5 billion loan guarantee.

Now, the government believed it had no choice because if they'd let our fall, then thousands of workers would have lost their jobs. And I do have some sympathy with that rationale. But it did set a dangerous precedent. It's also worth noting, surely, that the company had not completed taking out an insurance policy against cyber attacks. And so the first point I want to make to the noble Minister is that there's no mention in the bill the role of the insurance industry.

Surely the issue of essential and compulsory cyber insurance is one that needs to be looked at going forward. Otherwise, we'll have another situation where we have to bail out another huge company, the retail chain Marks and Spencer, lost 99% of its profits due to ransomware attack, which disrupted services and stole customer data. Last year. Harrods and the co-op also experienced cyber breaches over recent months. And surely there is a glaring weakness then in the bill in that it will have no impact on private companies such as these.

So can the Minister explain why the scope of the Bill cannot be extended now? Not in the future, but now, to include large private retailers, at least those of us certain of a certain defined size or turnover? I understand there's a potential in the bill for improving things in the future, but why not do it now? One of the lessons of history is that we must learn lessons from history, and surely a vital lesson is to take into account the changes in the world around us.

In the Bill, the government recognises the fact that the artificial intelligence revolution has increased the need for more effective cyber security, and yet there are still no UK AI regulation. There's no cyber strategy. There's no mention whatsoever of quantum computing. Encryption is not mentioned. Surely these are matters that need to be discussed and looked at now, not sometime in the future. When you consider how fast AI is progressing. We also have a cyber security skills shortage, with 49% of UK companies admitting a lack of cyber foundational skills, as well as protecting the nation in this AI age, it is skills that will pay the bills and grow the economy.

Now, it's right that the government has announced initiatives to attempt to fill vacancies in the cyber security industry, but there is no definition in the bill of what is required to be a skilled person. In this context, I'll just ask the question why not? Why not look at it now. Now we're living longer and the demands on the public sector are growing. But there is also a lack of focus in the bill on the public sector, particularly the risk to NHS data.

For example, Synovus has been mentioned. It's a company which provides pathology services to the NHS. A couple of years ago, a ransomware attack on Synovus cost £32.7 million and resulted in delays to over 11,000 appointments and even, allegedly one death. Surely all companies, private and public that hold personal data should demonstrate that they have effective defences against cyber attacks. Now, I tried to find out whether Synovus would be covered by this bill, and there are some ambiguity as to whether it would be covered by the bill or its suppliers.

And I suggest that that ambiguity at this stage is not helpful. I welcome the fact that the expanded scope of the bill now includes data centres, managed service providers, electrical load controls and critical suppliers. But the bill does not go far enough to protect the UK economy. The current structure of the bill allows the Secretary of State, in principle, to expand the number of sectors in the scope of the regulations, but even to implement secondary legislation will require the government to meet a number of conditions.

I know the Minister has referred to emergency powers, but that's still a process rather than an event. And surely the principle of the Secretary of State reporting back to Parliament every five years is not good enough in this fast AI world that we're living in. The government also needs to recognise that many companies operate across borders, including in the EU, where they have to comply with European directives as to cyber security, which do not apply to the UK. Now, of course, overregulation must not stifle innovation.

But with 12 regulators enforcing this bill, there is a danger of regulatory duplication. This is especially so for organisations covered by more than one regulator. Where appropriate, the government should seek to ensure that UK cybersecurity regulations align across each regulated sector and across borders with other jurisdictions, such as the EU, for example, the government could ensure that all regulators accept common forms of evidence demonstrating compliance, so there needs to be the adoption of a common baseline security standard, alongside ongoing evidence of security requirements across regulated sectors.

This should also recognise that different sectors have their own particular needs. Farming is different to fashion, which is different to football. The standard could be, for example, the National Cyber Security Council Cyber Assessment Framework, CHF, and in order to coordinate regulators. An example of this already exists with the Digital Regulators Cooperation Forum, which helps deliver a coherent approach to digital regulation. My Lords, 43% of all UK companies experience a cyber breach. In the last 12 months.

The Department for Science, Innovation and Technology report that cyber attacks cost the UK economy £14.7 billion per year, and the problem is increasing. For ten years I had the privilege of being vice president of the British Film Board, BBFC, Hollywood. Hollywood sometimes does produce entertaining films which see the future. For example, Steven Spielberg's movie called A.I. was made 25 years ago, which is incredible to think now. There was a consistent theme in many of the more positive films that we regulated in that good did overcome evil.

So with a stronger version of this bill, we can defeat the cyber monsters in the more positive and hopeful movies we regulated. RoboCop did prevail over The Terminator, and Luke Skywalker did overcome Darth Vader. My Lords, I strongly welcome.
20:12
Baroness Berger Portrait Baroness Berger (Labour)
-
-
The intention of this bill to strengthen the United Kingdom's defences by updating our cyber security legislation as it applies to critical national infrastructure. That is good, and it's overdue. And as my noble friend Baroness Gill pointed to, there's barely a week that passes, if not a day that passes without a significant business, a hospital, a local authority or a supplier to government reporting a serious cyber incident. Every part of our infrastructure is vulnerable, and a legislative update to reflect that reality is one that this House should have absolutely no hesitation in supporting.

Noble Lords have already raised concerns about a number of things relating to either what is in the bill, what isn't in the bill, and perhaps those things that need to be tweaked, how we should consider the economic impact of cyber attacks, issues around insurance reporting, workforce development and training, making AC a statutory body, and the lack of joined up work across 12 different regulators. These are all concerns that I share. I want to use the time that I have available to add some details to the significant gap, which has already been shared by others, that this bill currently makes no provision at all for artificial intelligence and connected to that for cyber sovereignty.

My Lords, this is not a hypothetical concern. Our allies have already grasped that if their critical systems, their public services and their citizens data are going to depend increasingly on AI, then relying entirely on foreign built, foreign hosted models is itself a national security question and diminishes those countries resilience. This is now the direction of travel right across Europe, and we should not assume that we can simply stand outside it. The Netherlands has built GPT NL. It's a sovereign open language model developed by a consortium led by the research institute TNO, together with Cerf and the Netherlands Forensic Institute and funded by the Dutch government.

It exists explicitly so that Dutch public bodies are not routing sensitive data through servers that they do not control, governed by laws they did not write, and models they did not develop or test. Germany has gone further still with Sufi, the sovereign Open Source Foundation models a government backed initiative bringing together German research institutions and industry to build an open foundation model of around 100 billion parameters intended to underpin domestic industry and to handle complex technical and analytical tasks.

My Lords, these are not vanity projects. They are deliberate decisions by governments to secure and keep control of the systems. Their public services are increasingly relying on, and the strategic logic is plain. A handful of foreign providers now sit upstream of much of the world's AI capability, and a dependency that concentrated is a single point of failure that no government should accept for its critical national infrastructure. Sovereignty over the AI that runs our critical systems cannot be an optional extra. It should be treated as part of our national cybersecurity and national resilience decisions this bill has presented is currently silent on that question entirely.

I want to raise just two specific areas where this absence should concern your Lordships. The first is education infrastructure, specifically exams and marking, which are increasingly stored and processed online. I understand that awarding bodies in this country are already exploring AI assisted marking. If AI becomes embedded in that process, the accuracy of a child's marks will depend partly on how that AI model behaves. And yet it will sit outside this bill's jurisdiction. We are creating a critical dependency for the life chances of every child in this country resting on a model we may neither own nor be able to scrutinise, with no corresponding legislative safeguard, we would have all the risk of a critical dependency with none of the legal guardrails.

This bill is designed to provide. The second is electoral services and the data held on the electoral register. I don't think I need to labour the point about why the integrity, security and sovereignty of electoral roll data set, data set matter if AI systems come to play any role in how our electoral registers are compiled, verified or protected, and I think we should assume that they will, then we must be able to answer three questions who controls the model? Where does the data go and what happens if that dependency is disrupted or compromised? A register we cannot fully account for is the register that we all cannot fully trust.

This bill should be equipping us to answer those questions. None of these points are an argument against this bill. It's an argument for finishing it. And as many noble Lords have already alluded to, technology is moving faster than any bill can be introduced, and there are many stats about the speed of tech evolution. I think the one that concerns me the most is that the maximum length of tasks that AI models can successfully complete is now doubling roughly every four months.

We owe it to the public to build in adaptability from the start, rather than returning to primary legislation each time the landscape shifts. We have here in the United Kingdom, one of the largest and richest bodies of public data of anywhere in the world, not least from within our NHS and our public service broadcasters, at the cost of building capable as the cost of building capable AI systems continues to fall, we have a genuine opportunity to harness that data ourselves to help clinicians reach diagnoses faster, to ease the administrative burden that weighs so heavily on our public servants, and to build public services that reflect our own standards, our own accountability and our own values, rather than simply adopting whatever the market happens to offer.

Building this capability at home is also how we ensure that the guardrails and safety measures we believe are necessary are actually built in to bolster the opportunity for full cyber security, rather than inherited from systems designed to other standards and other priorities, and without any concern for real safety and security. This is something I will continue to advocate for and I believe will supercharge the realization of the aims of this bill. I would therefore welcome my noble friend the minister's reflections on whether AI and cyber sovereignty might yet find a place within this legislation.

I look forward to the rest of this debate, and playing my part in scrutinising

**** Possible New Speaker ****

and enhancing this legislation. I welcome much of this bill. It

**** Possible New Speaker ****

I welcome much of this bill. It couldn't be more important in a world in which warfare is not just physical but also digital. It's physical but also digital. It's essential as part of our national security, that our government steps in to protect us from such attacks. I think most noble Lords welcome the list of bodies to be regulated in part two, and I'm very glad that
20:19
Viscount Colville of Culross Portrait Viscount Colville of Culross (Crossbench)
-
-
in part two, and I'm very glad that data centres, large load control and specified management services have been brought within the scope of the Bill. The government, after all, celebrated the huge investments of AWS and DC oh one UK in data centres. It's important that they are now covered by this bill as an essential part of our national security. There's obviously been an attempt to future proof this bill in a fast changing world of tech. Clause 24, the beginning of part three gives the Secretary of State enormous and flexible powers for them to designate what is essential activity for the.

For the economy of the United Kingdom and the day to day functioning of society. This flexibility is then reinforced in clause 4243. Part four powers of Direction to regulated persons to decide what should be reported and to whom it should be reported. My fear is that this bill doesn't go far enough to address the present threats, let alone the future press threats. As Lord after Lord have raised these concerns about the failure to mention AI, as in this bill at all, I too was at the terrifying meeting that the.

That my noble friend Baroness Kidron mentioned, held by the Institute of AI Policy and Strategy and the centre for Long Term Resilience earlier this month. They guided us through the world of software vulnerabilities and patches in the arms race. That is the search for software vulnerabilities. It is a fight between the attacker finding the flaw first and the defender finding it first, and even then, the rollout of patches to downstream defenders can be slow and leave them open to further attacks.

Having absorbed these concerns, we were then told to automate AI attacks in which an automated AI agent can carry out all the steps of a cyber attack on its own. As an autonomous operator, the agents no longer need to have skilled labour to develop an attack. Expertise can be rented from AI systems, and the attacks can vary their approach and learn from each failure so initial defenses can be breached. Once again. The AI Security Institute found that between December 2005 and 2006 that a single hacker weaponized the Claude and GPT 4.1 systems to bypass safety guardrails and develop 400 attack scripts.

The breach exposed the personal data of 195 million citizens in Mexico, including the attacks on electoral registers. At the very least, if data centres can be added in at a later stage in the shaping of this bill, then frontier army models operating in this country can and should be added in as well. They need to be attacked. They need to be protected from attack by foreign agents and rivals. I'm aware, as Ministers have often said, that regulation can be an obstacle to new start ups.

If that's the case, then there needs to be a threshold on the size of the frontier AI models which which which would need to abide by the demands of the bill. There needs to be, on the face of this bill, a new clause in which AI frontier providers are designated as essential models. The noble Lady, Baroness Hardy, is right. I am going to repeat what other noble Lords have said. The Bill leaves lacuna over large sectors of the economy, which I'm sure most noble Lords regard as essential services.

This must include critical manufacturing and retail, both of which have suffered devastating cyber attacks in the last months. Many, many noble Lords have mentioned the huge. Marks and Spencer's attack. Noble Lords only have to imagine the effect on the country. If there were successful attacks on 1 or 2 of our big supermarket chains, the result would be to throw the national food supply chain into crisis. Surely the supermarkets, which provide much of our nation's food and other services, need to be considered very carefully for scope within the bill? I understand that unlike the finance, telecom and digital sectors, the manufacturing and retail sectors do not have a regulator.

Nevertheless, clause 24 allows for flexibility in this space. So I support the calls by by noble Lords and Lord. Bart and and Baroness Hardy for a cross-sectoral regulator. Maybe the government needs to set up a second tier of essential service sectors who should be preparing to be brought within scope of the Bill. Longer term, it might be important to ensure they are building the highest resilience AI powered cyber attack. This work has got to. This work has got to further strengthen resilience at board level.

It can't be left to AI departments to work out resilience on its own. May I suggest to the noble Lady, the Minister, that she that she gives further changes to the corporate governance code straight away, so there's more responsibility for reporting incidents is taken at board level. The Minister is in a unique position to do this, being the Digital Economy Minister and previously in D BT. But my Lords, my other area of concern about this bill is the importance of coordinating the reporting of cyber attacks, and especially AI cyber attacks, to build cyber resilience.

There should be an extensive list of sectors which are brought into scope as the as the EU legislation scope as the as the EU legislation has suggested. Sorry. What has suggested. What is terrifying is that so many of the automatic automated AI attacks are what the industry calls the misalignments, which means that their final outcome is not what the original design of the model had intended. They create outcomes that were not only not the original intention of the creators of the model, but those creators do not even know these alignments have taken place.

I know the government has created the Cyber Resilience Pledge for our top FTSE 350 companies, which means they will sign up to the Nsc's early cyber attack alerts and recommend a cyber central suppliers kit. And the government has put aside £90 million resilience centres to give advice against attacks on SMEs, but they all depend on voluntary response by the affected companies. The government needs to mandate a reporting requirement so that effective defences can be rolled out across the economy.

I also understand the flexibility on reporting given by clause 43, but this country is confronted by the prospect of automated AI attacks. It is essential on the face of the bill, as wide a range of reporting of attacks is is included, and there needs to be on the on the face of mechanism for mandating the coordination of these attacks, the government needs to to ensure that that information about the attacks is brought together and advice coordinated on how to build a defence to these attacks.

The information is crucial both for AI frontier models to know their agents are what their agents are creating misalignments, and for downstream companies affected by the attacks to build secure defences, the essential reporting on attacks needs to be brought together by the NCS or ISI, and then the Bill needs to ensure further long term that there is a cross-cutting regulator. My Lords, this Bill recognises that we live in an ever more dangerous digital world. The introduction of autonomous AI into the digital world will affect us all, and could do so to a disastrous degree.

I call on the government to ensure that AI is on the face of the bill, both in the both in the sectors and scope, but in the reporting requirements for these and other sectors. Failure to do so will open our country to attack, which will devastate the economy and our society for years to come.
20:27
Lord Holmes of Richmond Portrait Lord Holmes of Richmond (Conservative)
-
-
My Lord, to pledge to take part. >> In this Second Reading debate at this early stage, and also a pleasure to follow. My friend Viscount Colville of Culross, Viscount Colville of Culross, though he, by his own words, repeated some of the earlier points, repeated some of the earlier points, he was the first speaker to say lacunae, for which I am particularly grateful. It sounds of itself like a technology company in its own right, of which I should declare. My technology interest is set out in the Register as adviser variously to the Crown Estate and to Simmons and Simmons L LLP.

As has already been noted, this bill is significant. By having cyber in the title of the bill long overdue, much needed and critical. As the Minister said in her opening, to take a cross-sector approach to cyber. And yet that's the first interesting point, that the bill doesn't do that. Most notable, and already mentioned extraordinary that neither food nor space are included currently in the bill's drafting. Similarly, it's said to take across economy approach, and yet it doesn't.

But well worth mentioning the two sides of that economic coin and the huge economic growth potential from our cyber industries, and echoing all the points that have been made there around the need for skills, education, and really enabling the cyber sector to grow and deliver that economic benefit. To turn to some of the other issues, reporting has obviously been mentioned widely throughout the debate, and it's unfortunate that currently, if one is finds themselves in a situation such as my noble friend Baroness Harding, well, multiple agencies to have to report to.

Can I ask the Minister. Surely it would make sense to have a single reporting point, both in terms of speed, in terms of efficiency and in terms of effectiveness of that reporting system. Similarly, as has already been mentioned, there's so much opacity around many of the definitions within the bill. I pull out significant impact as one of them. What does this mean if significant impact stays as currently set out, the natural and understandable response from business is to go for the

**** Possible New Speaker ****

Low level mass reporting to avoid regulatory intervention. But avoid regulatory intervention. But does that enable the economy and the country to be better protected? the country to be better protected? In this respect, I think not. Similarly, the 24 hour and 72 hour Similarly, the 24 hour and 72 hour reporting feel oddly constructed to the artificial concept of a day set the artificial concept of a day set out in 24 hours. When one considers the real time velocity of these attacks, it would seem logical that something way ahead of 24 hours would be advantageous at that stage, and potentially something extending beyond 72 hours to do that second bit of the reporting process.

I asked the Minister whether what evidence is there to really support something which is quite arbitrary, around 24 hours or, as otherwise described a day? Moving on to the concept's most central to the bill around security and resilience, which will be the markers of the success or otherwise of this statute when it comes to issues around proportionality, when it comes to the ability to evolve and develop. Does the current structure of the bill really optimize this? MSPs have already been rightly mentioned, and the burden for them is overbearing, as currently set out in the bill.

Surely it would make more sense to have a concept around what is reasonable for Ms. MSPs to oversee what can legitimately be seen within their control, and how they can evidence that. Understandably, the multiple regulated issue has been well discussed and it's critically significant because how are we going to have coordination across all those organisations? A forum certainly is not a solution, as Baroness Harding rightly sets out a lead regulator, a single regulator. Something around those concepts has to be the way to go.

And it should be the NCS who have, I would argue, the loudest voice in determining what is the best model and what is the best structure for doing that. I was interested in the minister's introduction. She talked about the criticality of consistency across sector. I would agree entirely with this, but in a debate on the 4th of June in Grand Committee, when we were discussing AI, in her response, she argued that consistency wasn't necessarily a central principle for the government when it comes to the regulation of AI.

I believe that a true cross sector approach to cyber makes sense in this bill, and we can add to what's currently there and make that happen. But it's surely logical and indeed a consistent approach to consistency that we take that approach with AI. I'd ask the Minister to respond as to why, if this argument is good for cyber, why is it not good for AI? And through that cross sector approach, as will benefit this bill, to have it principles based, outcomes focused and inputs understood? Another point on consistency.

Can I ask the Minister, when she comes to sum up, to set out the advantages that she sees in all of the divergent points that the government have taken to the EU, NIST to that it's largely divergent on most of the points. I'd be interested to hear the government's arguments for the advantages that they're seeking to bring from that. My noble friend Lord Arbuthnot has rightly mentioned the CMA, and I know that my friend Lord Clement-Jones will also mention this. And it's right to mention this bill, even though the National Security Bill is said to be the vehicle in which this is going to come forward.

I think it's right to give it a run around the track in this legislative process with this bill, because we're talking about coverage currently holding our cyber professionals back because of a 1990 statute. To give some sense of what that means, in 1990, it had only been 24 years since England had won the World Cup. It's in urgent need of reform. We need to empower. We need to enable our great cyber security professionals to do their job. A quick point on DVS.

I'm not sure the Minister was involved when we did the data use and access bill now statute, but there was a lot of discussion rightly around DVS, and in some ways this parts of this bill are the other side of that coin, because currently we have the situation not addressed by DVS in the in the Data Use Access Bill or indeed in this current bill in terms of what happens for verification services when they have an attack where synthetic data is injected directly into the data stream, effectively bypassing the camera to get verification.

How does this bill address that issue? Does clause 12 do the potential regulations under clause 30 or the guidance indeed under clause 36, address this? And if not, what's the minister's view as to how we address that critical issue? All around synthetics? My Lords, the success of this bill and the success of cyber in the UK will rest so heavily on the shoulders of the women and men, our cyber security professionals, who do so much to keep our system safe and through that, keep us safe.

We owe them so much. Understandably, they often do this in the shadows, in dark rooms and in the doughnut. We give them our sincere thanks and we must demonstrate that thanks by the

**** Possible New Speaker ****

amendments we bring forward to make this bill better. Yeah, yeah, yeah. Very good.

**** Possible New Speaker ****

Yeah, yeah, yeah. Very good. My Lord. It's a pleasure to follow the noble Lord Holmes and Baroness Harding has inspired me to. As I'm so low down on the list, I'm nearly at the end not to do that thing. But I was thinking of that thing. But I was thinking of that phrase when she was speaking, when the noble Lady was speaking. Everything has been said, but not yet by everyone. And so I'm not going to do that.

I'm going to dump my very boring speech inspired by noble Baroness Ludford, who reminded me of what we used to do
20:37
Lord Moraes Portrait Lord Moraes (Labour)
-
-
for a living. And it does contextualise exactly what the government is trying to do. And I government is trying to do. And I first want to say to my noble friend the Minister, who has a very friend the Minister, who has a very tough job, and I will explain a little bit about why, why I think it is so difficult. But she has a tough job. But it's a job that we said we would do. We wanted to said we would do.

We wanted to update the regulation in 2018. We wanted, as Baroness Neville-jones said, move fast, have some urgency. I know why she's saying it, because I'll come on to what the intelligence services are dealing with every single day in terms of hacking and what the Russians are doing, and she knows that that's part of her DNA. So we have to move fast and we have to do something. So that is exactly what the government are doing. And I want to try and contextualise what they're doing and perhaps why this is really a national priority, and how we can be as constructive as we can in building both cyber security and cyber resilience.

The first thing I would say is that a number of noble Lords mentioned, and this is very much the context of what we're doing. They mentioned the EU Network Information Systems Directive. Baroness Harding Northover in some detail about our alignment with it. And of course, Baroness Ludford had had some critical views about where we are in terms of our alignment. And I think this really contextualises the complexity as well as the urgency of what we are doing here in the UK, because the reason.

My noble Lords have said this is because there are really only three global regulators doing this now. And those three global regulators are diverging very badly. The United States, the European Union and China. China does its own thing. The United States. You may remember Mark Zuckerberg coming to the EU inquiry, going to Congress and saying, well, we need a GDPR, obviously. Well, most of this legislation in the United States on cyber is, in fact, state led. The FTC looks at it, but it is really not national legislation.

Even the United States. So the EU is one of the few places, whether you like it or not, is one of the few places which has decided that it's a global regulator. And the nature of the cyber threat and the nature of cyber resilience is very much a global issue. Now, that doesn't take away or it doesn't dilute in any way some of the things that have been said. For example, noble Lord, about our special position as a country, as United Kingdom, we have the best intelligence services in the world, very relevant to this area.

We have Gchq, we have all of that, and we have the technologists and we have the companies close to to this area, the best, some of the best in the world. But the issue is global regulation and this is why it is so difficult. My the noble Baroness Ludford made exactly the point I was going to make, except I'm going to make a different conclusion. She talked about the. The way that two Ministers had said two different things. Ian Murray and our other Minister, who is Mr.

Narayan, and they seem to be saying two different things. So one is saying that we're taking a big hit. Real businesses, real people are being hit by cyber breaches. So he said that it's not 0.5% of our GDP. It's a big, big problem for the United Kingdom. And then our other Minister said, but we need the 12 kind of observers, as Lord Birt was talking about. And we need because they have the expertise within the 12. And that's why it's so complicated.

And if we do anything else, it is a huge burden on business. Now I believe that both are true, both are true. And this is where the complexity of enacting cyber legislation of good quality happens. I know this because I, as you know, Baroness Ludford will testify. I chaired the GDPR, many of the GDPR legislative trialogues. I chaired the E-privacy trialogues. I had to scrutinise many of the cyber conventions which are part of the EU treaties, part of EU body of law.

And what I learned very quickly. And if I can just quote the latest AI rapporteur, because we have now another AI act in the in the EU coming because the other one is out of date and the GDPR is out of date and Eprivacy legislation is out of date. And I just said to him, well, you've got the latest AI legislation. And he said, yeah, it's a bit like you just jump off the cliff and build your wings on the way down. Now, why somebody from Italy was quoting Ray Bradbury.

I don't know, but but but it's kind of correct. Now, I know the Minister has probably got the wings already. You've got wings. Don't worry, you'll be fine. But the point is that you have to move with such speed that the point that Baroness Neville Jones was making, that somehow you just have to move. And the urgency is great during this period. And the noble Lord Vaizey is not in his place, but he also inspired me to to depart from my notes a bit because he was explaining very eloquently because he was a Minister at the time how complicated this is for our current Ministers and government, because he was talking about encryption.

Now, what he was talking about was what the noble Lord was talking about. She would read my code of practice was that we were we knew that the companies Microsoft, Facebook, now meta, but all the others read it. Snap. All of them wanted end to end encryption and they didn't want it weakened. Why? Because with with strong end to end encryption, you deal with cyber threats. Now, they were saying that at the time when you may remember, there were lots of terrorism threats around.

So most enforcement agencies were saying, no, we need a backdoor to encryption. And that was well, that was the the prevailing wisdom. And that's what kind of won out in terms of the arguments. But the companies, in my view, were right because they were talking about the banking system. They were talking about privacy. They were talking about all of the threats that we now have if we weaken encryption. So this is why noble Lord advisory, not in his place, was saying this.

So the context I want to put here is that it is extremely complex to come up with good cyber security legislation and resilience legislation. The noble Lord Birt is so good with this communication that I almost think this OCR is a real thing now, but that's because he is who he is. You know, he could persuade anyone, you know. I mean, you know, he is what? And of course everyone is saying, yeah, let's get rid of the 12 and let's do this.

But I would just caution about the complexity of dealing with cyber threats. And I will give one example from from just the last example, if I may, just about the daily threats that we're having from foreign actors. This is very different from the corporate threats, some of which come from within the United Kingdom, which need a very different response. And we did see that in the European Union. So my time is up, but I just want to contextualize how tough this is going to be.

Let's yes, jump off the cliff, build the wings on the way down, get this done, do what we can do in committee because it's a national priority. Is it perfect? Of course it isn't. But we need to get moving because the threats are very real. My Lords, it's getting. Late and I'm told.
20:45
Lord Londesborough Portrait Lord Londesborough (Crossbench)
-
-
We're now. Competing with the Spain versus France World Cup Spain versus France World Cup semi-final. The winner, of course, may well face England in the final, but. So I'll try to be brief. And I but. So I'll try to be brief. And I speak not as a cyber expert or technologist, but as a former CEO technologist, but as a former CEO of a tech enabled mid-sized business, and I want to bring some ground level perspectives to these oft mentioned SMEs, one of which I currently chair.

And I do welcome this bill. But like many others, I have some concerns over its scope, its impact on those apparently outside the scope, but who sit within critical infrastructure supply chains. The challenges of a horizontal piece of legislation being layered over multiple sectors and their regulators, and why, as so many people have asked, is there no specific strategy for AI? All of that's been covered, and I won't repeat those points, but I do want to question why central government and local authorities will remain out out of scope.

The National Audit Office report last year found serious, slow to fix security flaws across 58 of the 72 government systems that were reviewed. The public sector badly needs binding legal requirements, not just a voluntary action plan, I suggest. As we've heard, the UK is already the most targeted country in Europe for cyber attacks, with over 40% of UK businesses experiencing such attacks at a cost put at almost £15 billion annually. But my Lords, those numbers are almost certainly an underestimate, not just because they apply to 2024, but because a whole range of cyber incidents go unreported and therefore unmeasured, especially in the world of SMEs.

In fact, 90% 6% of those UK businesses suffering a cyber attack were in fact SMEs and not because they are targeted, but because they are easier to breach. Now, if you factored in all the incidents and you took into account all of the costs, including the distraction from core business, the real cost this year may well be closer to £30 billion, roughly 1% of our GDP. My Lords, let's face it, when this bill is enacted, it will already be out of date.

That is not an argument for delay, but it is an argument for shaping legislation to allow for changes and add ons down the line as the threats change. But without going through the long and arduous processes of legislating through both Houses of Parliament, I suggest we are pragmatic, that we balance the need for parliamentary scrutiny and consultation with speed and agility. I'm going to finish my Lords by focusing on the mid-market and indeed the small businesses, for this bill tells us that high impact suppliers of any size could be designated as critical suppliers.

That's raised quite a few question marks. Two thirds of medium sized UK businesses reported a cyber breach last year alone, and yet only 15% of those businesses had formally reviewed the cyber risks their immediate suppliers posed to them. So this bill will make mid-market players take compliance, incident reporting, risk assessments and audits more seriously. This indeed should no longer be seen as the sole responsibility of the I'd I T department or the CTO, but become a board level issue that CEOs need to engage with.

Currently, only 27% of UK businesses have board level cyber accountability. That needs to change. My Lords. Confession time. I was once one of those mid-market CEOs who took two little interests at board level in the risks to our company's infrastructure and systems, delegating this to mid management and our offshore partners, and nearly paying the price when our online platform, which contained all of our customer data and 20 years of content, was, came under attack and was very nearly successfully hacked, lessons were quickly learned.

So can I ask the Minister how the government plans to address and resource the information, Communication and training challenge that this bill will present to mid market players? And I raise the same question for those SMEs who will get dragged into supply chain compliance issues, whatever their size, but without the specialist resources needed. And I note that the Liberal Democrats in the other place proposed what I thought was a very sensible amendment for the establishment of a cyber security support service to help SMEs comply with their regulatory duties.

But this was dismissed by the Minister, saying that very few SMEs would be in scope. But nobody's put a number to this, and I think this misses the point. I fear the government underestimates this challenge, both for mid-market and small players. If this information resource communication education piece is not properly addressed, you will not just lose links in the supply chain. You'll reduce the level of competition which will be bad for business and economic growth, and indeed bad for trade with our European neighbours who are way ahead of us in this area.
20:51
Lord Ashcombe Portrait Lord Ashcombe (Conservative)
-
-
My Lords, my noble friend Baroness Harding talked about Baroness Harding talked about speaking halfway down the list. The noble Lord, Lord Morris, nearly at the end of the list. My Lords, I am the end of the list. My Lords, I am lost. You'll be glad to hear. I must declare my interest as an employee of Marsh risk, an insurance brokerage company with a large cyber practice. Like many other noble Lords, I do welcome the government's ambition to strengthen the UK's cyber defenses and in doing so, to protect the continuity of the essential services on which the public depend.

The bill's direction of travel is right, widening the scope of the existing regulatory framework to reflect modern supply chains, strengthening oversight and improving the flow of information to regulators and the National Cyber Security Centre so that we can build a clearer national picture of threats and vulnerabilities. However, I'd like to press the Minister on two areas where the bill as drafted risks leaving practical gaps. First, the role of cyber insurance in building national resilience, and secondly, whether the proposed incident reporting timelines will, in practice help resilience or inadvertently hinder it.

On insurance. My argument is straightforward regulation, technical standards and guidance are essential, but they are not on their own. A resilient strategy resilience also means the ability to recover quickly, to fund remediation, to access specialist incident response capability at speed, and to keep vital services running while systems are rebuilt. Cyber insurance was referred to my noble friend Lord Arbuthnot, on its own is not a silver bullet, but it is one of the few tools that can mobilise financial and operational support within hours.

Time is of the essence to limit the further damage as. As we have seen in a number of recent incidents, the noble Lady, Lady Poole, discussed how insurance can incentivise behaviour and I very much agree with that and a lot of what she said. I'd like to take the process a little further. In the cyber insurance market, the best policies do more than pay claims. They typically provide 24 over seven emergency hotlines, pre-vetted panels of incident response firms, forensic expertise, legal and communication support, extortion specialists and business interruption expertise, all of which can be decisive in reducing harm, shortening outages and supporting faster restoration of services.

Some insurers even pay a loss of claims directly to the party owed, i.e breach counsel and forensic vendors saving their clients from having to pay large incident response costs out of pocket. For many small and medium sized organisations, it is often the only affordable way to access that depth of capability. This support can prevent can potentially prevent the government having to step in, as they had to offer to do in the Jaguar Land Rover incident. Yet cyber insurance can only play that stabilising role if organisations are encouraged to take take it up as part of a wider risk management approach.

Indeed, my noble friend Lord Vaizey talked about it being mandatory. At the very least we create. We need to create greater awareness of the benefits cyber insurance can bring to businesses. Personally, I tend to prefer a carrot rather than stick approach. So my first question to the noble Lady, the Minister is this what incentives are the government considering to encourage greater uptake of cyber insurance, particularly among smaller operators and critical suppliers who may sit out the largest corporate sit outside the largest corporate balance sheets, but whose disruption can cascade through supply chains.

And my second question is whether the noble Lady, the Minister, has considered introducing a moratorium on insurance premium tax of, say, three years. The companies that take out cyber policies for the first time as a way to incentivise uptake. I might add that incentives are not just about premiums, they are also about information and confidence, ensuring that organisations understand what insurance does and does not cover encouraging consistent baseline controls so that insurers can price risk responsibly and supporting appropriate data sharing so that lessons from incidents can improve both national defences and underwriting insight.

In short, the objective should be a virtuous circle better cybersecurity, better insurability, more uptake and stronger national resilience. Let me turn to the incident reporting discussed by the noble Lord, Lord Ravensdale, and my noble friend Lord Holmes. The policy intent to ensure that regulators and the NCS receive timely warning of significant events is understandable, and many noble Lords have mentioned this in principle. But in a major cyber incident, the earliest hours and days are dominated by triage containing the threat, protecting services, preserving evidence and restoring critical functionality.

Those involved in the response work round the clock to keep the businesses running. In that context, the requirement for rapid reporting can create real operational tension. As I understand it, the approach the approach envisages a two stage process, an initial notification shortly after the organisation becomes aware of a significant incident, followed by a fuller report with a tight time frame. My concern is not with the concept of early warning. Rather, it is the requirement to produce a comprehensive report within 72 hours risks driving premature, incomplete or speculative reporting, and it can put scarce technical leadership, pull scarce technical leadership away from response and recovery at precisely the moment it is most needed.

That is why I intend to table an amendment to adjust the reporting time, so that the full report is due within 30 days, with an expectation that the affected entity provides an initial notification promptly and then submits updates as material facts become clear. This would preserve the government's need for the awareness and situational insight, but it would also recognise the practical realities of incident response. Organisations often cannot state with confidence the root cause, scope of compromise or data impact within 72 hours, particularly where third party suppliers and complex networks are involved.

I would be grateful if the Minister could confirm whether the government has considered an approach of this kind, one that distinguishes clearly between an early warning and a detailed, evidence based report. The requiring of a detailed report can reduce the quality of information the authorities receive, increase the risk of later correction, meaning rework and additional expense for all concerned and possibly potentially undermine trust and transparency. My Lord, I support the bill's overall aims, but if we are serious about resilience, we must not think only about prevention, but also about recovery and continuity.

Cyber insurance, properly understood and appropriately incentivised, can be one of the mechanisms that turns a cyber event from a national disruption into a managed incident incident. And finally, on reporting, we should insist on a regime that delivers timely awareness without undermining operational response.
20:59
Lord Clement-Jones Portrait Lord Clement-Jones (Liberal Democrat)
-
-
My Lord, sir, can I first of all declare an interest as an adviser to DLA Piper on AI policy and regulation? And I should also say that we as a law firm were subject that we as a law firm were subject to an attack, a ransomware attack by Not Petya back in 2017. Not a pleasant experience, my Lords, can I thank the Minister for her introduction and earlier engagement on the Bill and thank all noble Lords speaking today in such an expert fashion on on the Bill, on these benches, like many other noble Lords, we support the fundamental objectives of this legislation to modernize our outdated cyber security framework.

But, my Lords, what has been remarkable today is the consensus Crossbenches, my Lords, that this Bill is not nearly ambitious enough. And indeed, as my noble friend Baroness Northover, Baroness Ludford, Lord Vaizey, Baroness Neville-jones, Baroness Harding have said, this could be a missed opportunity to align much more closely to the EU. Framework. My Lords, I'd prefer not to be jumping off a cliff with or without wings. My Lords, with all due deference to the noble Lord Moraes, I don't think that we're really living up either to the motto of Newcastle, the city of Newcastle, my Lords, the noble Lord Arbuthnot said.

Where are the principles? The noble Lord, Earl of Effingham, said, where's the strategy? And the noble Baroness Kidron said, where is the plan of action, my Lord? So there's quite a bit missing in the bill, and I shall take noble Lords through some of the. Those areas, my Lords, as many noble Lords today have illustrated, the threat landscape has deteriorated sharply. The National Cyber Security Centre has managed 204 nationally significant incidents in a single year, a doubling on the year before.

Yet, as the noble Lord Burt pointed out, this bill will apply directly to only a tiny minority of organisations. Meanwhile, 43% of UK businesses have experienced a cyber breach in the last 12 months, but one of the most glaring omissions is the almost entire exclusion. As the noble Baroness Alexander and the noble Lord Londesborough pointed out, is the exclusion of the public sector, central government, public administrations and local authorities are almost entirely exempt from the bill's direct statutory duties.

My Lords, how can we claim national resilience when the state itself is exempt? We've seen the data of 270 000 military personnel compromised in the Ministry of Defence hack and the devastating attack on the British Library, which destroyed irreplaceable data. Local authorities hold vast repositories of citizen data, from electoral registries to social care records. The ransomware attack on Redcar and Cleveland cost £10 million on Hackney £12 million. My Lords, as the noble my noble friend Baroness Northover, Lord Birt and Baroness Kidron, my noble friend Baroness Ludford, Lord Vaizey and Viscount Colville all said we must make cyber security a boardroom issue and it was very good to hear from the noble Baroness Harding with her lived experience of cyber attack.

My Lords, yet only 27% of businesses now have a board member explicitly responsible for cyber risk, down from 38% three years ago. The noble Lord Vaizey was correct and unlike the EU SNIS2, this bill failed to mandate executive responsibility. So, my Lords, I do support the noble Lord, but that we must now extend corporate financial audits to report on how an organisation and its suppliers manage cyber security using existing governance codes. My Lords, the urgency here is multiplied by the rapid rise of Agentic artificial intelligence and they will.

Baroness Alexander described this as an AI shaped hole and noble Baroness Kidron, Baroness Harding, the noble Viscount Colville all pointed to this omission. My Lords anthropic recently withheld wide release of its mythos mythos model because it could autonomously find and exploit software vulnerabilities across every major operating system. The UK's own AI Security Institute, as we've heard, found mythos substantially more capable at cyber offense than any model previously assessed, and warned that frontier AI capability is doubling every four months.

And of course, my Lords, that will be further amplified by quantum computing, as mentioned by the noble Lord Ravensdale, the EU's AI act already imposes binding cyber security and incident reporting duties on the handful of frontier model providers it judges to pose systemic risk. California and New York do the same for the largest developers. This bill, by contrast, does not mention AI systems at all, as many noble Lords have pointed out. Last month, the cyber security agencies of the Five Eyes Alliance, including our own National Cyber Security Centre, issued a joint statement warning that frontier AI is shrinking the gap between vulnerability, discovery and exploitation from months to a matter of days and that this can no longer be treated as a technical issue rather than as leadership responsibility.

Meanwhile, while our own defenders have a skills crisis, the noble Lord Byrne, the noble Lord Arbuthnot, Baroness Alexander, Lord Vaizey all raised the skills issue. ISC two warns that 88% of UK cyber professionals have experienced a breach in the last 12 months, as a direct result of skills shortages. Yet clause 43 references a skilled person, as pointed out by the noble Lord Taylor of Warwick, who must liaise with the Secretary of State during national security directions without defining what a skilled person is.

My Lords, who will actually enforce the rules the Bill distributes duties, as we've heard today, across 12 separate sectoral regulators, many of which, like Ofwat, already struggle to regulate their own domains. This fragmented approach guarantees duplication and gaps. And again, I agree with the noble Lord Burt and indeed the Joint Committee on the National Security Strategy. The UK needs a single expert or lead regulator, as mentioned by the noble Baroness Alexander, Lord Vaizey, Baroness Harding, Viscount Colville and the noble Lord Holmes to oversee both public and private sectors.

Failing that, the government should at least adopt the EU's digital omnibus model of a single report. Report once portal, my Lords and I share noble Baroness Paul's ambitions and those of the noble Lord Holmes. In this respect, my Lords, we must also. As the noble Baroness Neville-jones said, fix the Bill's definitions, and indeed mentioned by the name of Lord Ravensdale. For instance, tech UK warns that the current definition of a managed service provider is dangerously broad, risking capture of any basic IT support in the country.

My Lords. The Bank of England's own data shows that just three US giants control 73% of the cloud computing services supporting UK financial firms, and a number of noble Lords raised the issue of of of of cyber sovereignty. My Lords, the Trump administration blocked European and UK firms from accessing mythos. If a foreign ally can pull the plug on a critical cybersecurity tool overnight, how can this government claim true national resilience? And that is why, my Lords, as many noble Lords today have said, we need a comprehensive digital sovereignty strategy.

My noble friend Baroness Ludford called this servitude, and the noble Baroness Berge talked about. Critical. Critical defending my Lords and we need to assess our foreign policy dependencies and support domestic UK providers. And I would very much welcome what was said by the noble Baroness Kidron, Baroness Bennett and Baroness Burger. In that respect, the Bill is silent on cyber enabled fraud, which cost our economy billions of pounds every year, and exploit precisely the same weaknesses this bill is meant to close.

My Lords, Lord Arbuthnot mentioned related threat, which is emerging as tallies tracked. Automated bot traffic has now overtaken human traffic online for the first time. We need, as suggested by the Nmma, the Secretary of State under this bill, to assess the cyber security risks that anonymous bot traffic poses to UK websites. My Lords, if we expect businesses to defend themselves, we cannot handicap our own cyber professionals and I very much welcome what has been said by a number of noble Lords, including the Earl of Effingham, noble Lord Arbuthnot, Baroness Ludford and Lord noble Lord Holmes.

On the question of the Computer Misuse Act, my Lord, which badly needs amending, my Lords, finally, in the face of autonomous AI threats, the government needs an ultimate backstop and we support proposals by control AI to introduce strictly constrained last resort powers, allowing the Secretary of State to direct the shutdown of data centres or AI systems in a catastrophic emergency. The cost of inaction vastly outweighs that compliance burden, and the noble Baroness Gill graphically described the situation at Jaguar Land Rover, which lost around £500 million in a single attack.

But my Lords, currently JLR sits entirely outside the scope of this bill, as a number of noble Lords have pointed out, the retail sector as well. And, my Lords, the noble Baroness Paul indicated that that was true of the insurance sector too. My Lords, this Bill is a necessary foundation in committee. We will push hard for amendments to reflect the changes that are needed. My Lords, in this way we can ensure that our national cyber defenses are genuinely whole of society and fit for the age of AI.

My Lords, we're going to have a very well informed Committee stage. I hope the Minister is looking forward to it.
21:11
Viscount Camrose Portrait Viscount Camrose (Conservative)
-
-
Well done. all noble Lords who have contributed to this debate and, of course, to the noble Baroness, the course, to the noble Baroness, the Minister for her introduction this afternoon. I think it's been a really thoughtful, compelling and persuasive debate, and it is clear that on all sides of the House there is a shared recognition of the scale of the threat this legislation seeks to address, and the importance of doing so effectively. As my noble friend the Earl of Effingham said in his opening, we on these benches support the objectives of the Bill.

Indeed, much of what is in it has its origins in work begun by the previous government. Following the 2022 consultation, and we applaud the continuity. We do not intend to try to make the perfect. The enemy of the good, although I must say I wholly endorse the cyber insurance argument set out by the noble Lady, Lady Poole of Shepherd's Bush, and by my noble friend Lord Ashcombe, and others to. But listening to this debate, my Lords, has only reinforced for me the central question with which we began, which is, where is the strategy? Ministers have described the Bill as one part of a wider programme.

Yet the National Cyber Action Plan that was promised before the end of last year and then promised again for this summer, remains unpublished, and I perhaps observe as an aside that, alongside the Defence Investment Plan, we are in danger of creating the perception which we must avoid that there is a pattern of delay and avoidance when it comes to defending ourselves. Noble Lords across the House have in their own ways returned again and again to that same point, and I started off the debate diligently, writing down everybody who called for a change to the scope.

But that turned out to be everybody called for a change to the scope. And I think this makes our task today really far harder. I absolutely accept that this is a bill designed to have a narrow scope, but we have no way to understand the broader context in which that narrow scope sits. It's like trying to judge an orchestra, but only being allowed to hear the woodwind section. And it's inevitable. I think, that we will have questions that go, or concerns and suggestions that go beyond the narrow scope and intent of the bill.

How will SMEs learn to protect themselves better, as many, many people have raised? A great many noble Lords mentioned AI. Again, almost everybody mentioned AI, but what response overall is envisaged to the threats of emerging technologies, of which as yet we know little, such as newer AI models, the frontier and quantum cracking and so on. How will we reduce the number of vacancies for cyber roles? And by the way, I should add, it's not a new problem by any means that there are too many vacancies for cyber roles.

We were wrestling with it, you know, when when we were in government, it it is an intractable problem, but we need to find better ways to address how will we address the growing prevalence and effectiveness of weaponized disinformation that does so much harm to our society every day right now? Or more fundamentally, what are our strengths and weaknesses relative to those of our assailants and our allies? And let me express the hope, and I will return to this point, that during the passage of the bill and ideally before Committee stage, we have the National Cyber Action Plan to answer these, and no doubt many other questions.

And maybe this could make passage of the bill considerably easier for all of us, and particularly for the noble Lady, the Minister, and indeed help bring about the wish of my noble friend, Lady Neville-jones, that we get through this bill quickly in order to get these measures onto the statute book as soon as possible. My Lords, even the National Cyber Security Centre itself has publicly called on government to set out a strategic, a clearer strategic policy agenda. If Gchq's own technical authority feels moved to say so, my Lords, that ought to give the Minister the government pause in the House of Commons, my hon.

Friend, and in the other place, I beg your pardon, my hon. Friend, Doctor Ben Spencer, made precisely this point, warning that the National Audit Office had found, and I quote, inconsistent and in some cases, glacial progress on government cyber resilience, and that the Bill risked becoming, in his words, yet another missed opportunity. My hon. Friend Julia Lopez, for her part, reminded the Commons that if the pandemic accelerated the adoption of digital technology, artificial intelligence will embed it further still.

And yet, as she noted, and as noble Lords, including my noble friend Lord Arbuthnot, have echoed this evening to that particular quote. But in fact, as everybody has said this evening, the bill is silent on AI. It is silent on the Computer Misuse Act. These omissions go to the heart of whether this legislation will still be fit for purpose in five years time, given how disappointingly rarely Parliament revisits this ground on the question of regulatory burden, I was also struck by how many noble Lords share our concern for smaller businesses.

I do hope the noble Baroness, the Minister, agrees that this is not a party political point. It was raised by members of the party opposite in the other place, too, who rightly noted that SMEs are disproportionately targeted by cyber crime, yet are the least equipped to absorb new compliance obligations. In fact, tech UK, as the noble Lord Lord Clement-Jones pointed out, has warned that leaving so much of the detail of this regime to secondary legislation as well as some of the rather woolly language that was commented on by by the noble Lord.

Lord Ravensdale risks creating the kind of legal uncertainty and cost that falls hardest on smallest firms. Again, I'm not trying to make a political point. We urgently need this bill. But a practical point, and indeed my my noble friend Baroness Harding's account of attempting to communicate while managing the crisis caused by an attack was absolutely salutary. And I hope that noble Lady, the Minister, will take notice of that. So, Lords, as we move towards committee after the summer recess, and I think Committee promises to be a very productive activity, I do hope the Minister will reflect carefully on the questions raised today and in her closing.

Perhaps she could answer the following questions. First, will the government commit to a firm date for publishing the strategy within which this legislation is meant to sit? Second, how will the effectiveness or otherwise of the bill's measures be assessed, and how will that assessment be reported to Parliament? And hopefully not every five years? Third, what assessment has been made of the cumulative reporting burden facing businesses of all sizes already subject to data protection and sector specific obligations? And fourth, what confidence can she offer the House that the 12 regulators tasked with enforcing this regime? We have heard a great deal about, will have and will continue to have the resources and expertise to do so effectively.

My Lords, at committee, we on these benches will continue to press the government on precisely these questions because, like any regulation, it must be built on a foundation of strategic clarity rather than being asked to substitute for it. I look forward to the minister's response.
21:20
Baroness Lloyd of Effra Portrait Baroness Lloyd of Effra, Parliamentary Under Secretary of State (Department for Science, Innovation and Technology) (Labour)
-
-
Hear, hear. >> Excellent. >> I thank. >> Noble Lords for their insightful

**** Possible New Speaker ****

Noble Lords for their insightful and wide ranging content today, and I'm pleased to hear of the broad I'm pleased to hear of the broad support for the bill. I'd also like to thank the Minister in the other place and the parliamentarians who have engaged your noble Lordships and others ahead of the Bill. It has generally been dialogue shaped by pragmatism and a genuine, genuine interest in protecting our people and businesses. Should I not be able to respond to the specific points, all the very many specific points that were raised today in the allocated time, I will make sure I review Hansard carefully and reply to noble Lords accordingly.

Placing copies in the library. Viscount Camrose, the noble Viscount, Viscount Camrose, raised an excellent point about what is in the scope of the Bill and the other very many actions and activities by the government to equip our businesses to tackle cyber threats. And I agree with him that the National Cyber Action Plan would be the right place to set out exactly how this is all put together. I cannot today provide your noble Lords with a date for that National Cyber Action Plan to be published.

As many of your noble Lordships have pointed out, I too started writing down the names of all the noble Lords who had raised the question of scope, and I, too, decided. It's probably better to say everybody. Noted this. This is a very pertinent question. Cyber security and resilience is a shared responsibility. The government and NTSC provide a range of tools for all parts of the economy, and it's for all organisations to make use of those to enhance their protections.

We have invited all businesses. We've invited charities and other organisations to sign the Cyber Resilience Pledge and take the three tangible actions that can help boost their resilience to cyber attacks. And for many organisations, this will be a significant step in their defences and regulation will not be necessary nor proportionate. Under this Bill, we have chosen to regulate where disruption to services would mean people and businesses are left with little or no easy alternatives. Hospitals, drinking water, cloud service providers and the significant steps we're taking in this bill are reflective of the digital nature of our economy today, and reflective of the risks we encounter today.

I do recognise and share the sentiment of exploring other parts of the economy that will benefit from being under these regulations in the future, and I would assure the House that I have asked my officials to work with other government departments to consider what additional services could in future be brought into scope. But at the same time, I must say that this work needs to be undertaken with thorough consideration, taking taking into account a range of factors, the threat posed by by them, the threat posed to them by hostile, hostile actors, the potential impact they pose to the wider economy and the overall value of the sector.

And we need to take into account the important points that noble Lords have made around proportionate regulation. And I would confirm to the noble Baroness Neville-jones that would follow consultation, were we to extend to further sectors. On the important point about the government cyber Action Plan that Baroness Northover, Baroness Neville-jones, Baroness Ludford, Lord Londesborough and Lord Clement-Jones raised. This is indeed. It is crucial that our government, our public sector is covered and the government Cyber Action Plan. It was published in January and it will transform cyber security and resilience across government and the entire public sector by 2030.

It will enable us to achieve the same outcomes that we want to achieve for services regulated under the bill, clear and robust requirements, better incident reporting, stronger accountability and transparency. And the plan sets out accountability structures to ensure that cyber risks at all levels of government are actively owned and effectively managed. And I would like to assure your noble Lordships that we will continue to work with, with with Parliament to ensure proper oversight of the plans implementation and to the extension to local government that is also covered under under the overarching strategy of the Government Cyber Action Plan.

So to my noble friend Baroness Alexander of Clevedon, Mhclg are also taking action to strengthen local authorities cyber resilience, backed by £20 million of cyber grant funding and technical support. Because it is indeed incredibly important that local authorities are prepared and do enhance their cyber action. To the question raised specifically by the noble Lord Lords Holmes of Richmond and the noble Lord, Lord Taylor of Warwick, and the noble Baroness, Baroness Northover, Baroness Ludford and Baroness Harding of Winscombe, around, probably amongst others, around the food and retail sectors.

It is very important, equally, that the food and retail sector enhance their cyber resilience. The food sector is unusual amongst other critical sectors because of its high levels of diversity. There are approximately 2000 small and medium food manufacturers in the UK alone, and many more farms, distribution services, retailers and other types of businesses that form the UK's food supply chain. Given the lack of a single points of failure, we think there are more proportionate levers to full. Rather than bringing food into the scope of the bringing food into the scope of the regime currently.

On. Let me come to the question of of AI, which was raised by the noble Effington, the noble Viscount, Viscount Colville of Culross, noble Baroness Baroness Kidron and my noble friend Baroness burger. The government is committed to protecting our national security against the risks posed by advanced AI models, and our AI Security Institute is world leading and one of a small group of organisations with access to Anthropic's Claude mythos model before its release. In terms of addressing the risks of cyber attacks facilitated facilitated by AI, it is true that AI capabilities are moving very fast, but strong cyber fundamentals still work.

Our advice, and that of the NCS, is to ensure that organisations get the basics right, ensure and ensure they are managing risks at board level. There is extensive guidance on this from the government and from the NCS. In terms of the. Whether AI is in is in scope of the bill. The bill does not specifically bring large language models or AI companies into scope, but where organisations in scope use AI models and systems that those organisations will need to take appropriate and proportionate steps to manage the risks from those to these from hackers.

For example, if a LLM is used as

**** Possible New Speaker ****

Part of the day to day software available to staff in a hospital, and therefore part of the network and information systems. It would and information systems. It would be considered in scope. And to the question posed by Baroness Kidron question posed by Baroness Kidron on a, on a on an example of how on a, on a on an example of how this would. If, for example. We we. Under the bill, the bill grants the Secretary of State the power to direct entities.

If the compromise of the relevant or the threat of one gives rise to a national security risk that. This could, for example, require an entity to cease using an. Isolate an AI model. These powers are a backstop to an effective cybersecurity regime, enabling government to act swiftly in the face of unexpected national security threats. But they are also designed to be proportionate, recognising the need for stability amongst regulated entities and the importance of proper accountability. Many noble Lords reflected on the need for effective implementation for the the importance of consultation, the importance of secondary legislation.

It is indeed the case that there will be secondary legislation and guidance, and a business adjustment period for for this Bill and. Over a period. And to the question posed by Baroness Neville-rolfe, this will be up until probably 2028, when we expect the duties to come into force on the questions of incident reporting raised by the noble Earl Effington. Sorry all. Earl Effingham, the noble Baroness, Baroness Northover, the noble Lord, Lord Ravensdale and Baroness Harding of Winscombe.

We have heard the clear ask from businesses to minimise the time they spend filling in different reporting templates following an attack. We reflect, we understand the pressure that institutions can be on in the midst of a an attack, and we want to make sure they can prioritise the technical response. We're exploring all options and will look closely at other regimes in the UK and the new template used by EU member states for the two reporting reflective of questions posed by your noble Lordships on where we are looking at the EU regime in respect of the question of whether we think there is a risk of overreporting, we do not believe there is a risk of overreporting, but we will provide further clarity by setting out thresholds in secondary legislation, following consultation that will set out when an incident is considered to to have had or to be likely to have had a significant impact.

A question posed by Lord Holmes of Richmond and Lord Ravensdale. In respect of the questions posed or raised by the noble Baroness, Baroness Bennett of Castle, the ability to share information with like minded countries is important if we are to make cyber security a global effort. But the Bill does not mandate information sharing across borders, and there are important safeguards around the sharing of information for the purpose of prosecuting a crime. I followed the debate on this topic in the other place, and I would be happy to meet with those interested in this topic to to discuss it further.

Noble Lordships raised the question of the balance between a single consistent approach and being attuned to sector specific issues. One of the ways in which we are going to pursue consistency and provide clarity on what is expected is through the new security and resilience requirements for regulated entities, which will be set out in secondary legislation. These will will set out the clear and consistent set steps that regulated entities will need to take to mitigate their security risks, and to the questions posed by Lord Arbuthnot and Lord Burt and Lord Ravensdale in particular.

These will be high level, outcome based requirements that will be consistent with the Nsc's Cyber Assessment Framework, including requirements on board, responsibility and governance, supply chain and incident reporting and recovery, as well as introducing requirements around testing and exercising protection and protective security. These proposals will be technology and sector agnostic and take an all hazards approach to ensure resilience in the face of an evolving threat landscape and emerging technologies. They reflect the requirement for regulated entities to have regard to state of the art technology when assessing the risks they face.

So to the question posed by Lord Ravensdale and others on post-quantum cryptography. And that pays also by the noble Lord, Lord Burt on quantum, that these would be considered as part of that requirement by regulated entities, but would not necessarily be set out, singled out as a specific technology in the regulation. In order that we keep these regulations up to date and also matched to the security risks, the cyber risks that individuals, sorry, the individual entities face.

I would also say, in addition to those requirements on the the way in which the the the bill will capture board responsibilities. We do recognize that board level governance is essential to effective cyber risk management, which is why the Cyber Resilience Pledge sets out that making cyber a board responsibility is one of the three clear, tangible actions that any organization can make to boost their resilience. And the government's forthcoming Modernizing Corporate Reporting consultation will seek views on whether the existing risk reporting framework produces sufficient reporting on cyber risk management as an additional step that that could be considered.

In respect of the questions about the Secretary of State reporting to Parliament at least every five years, this is a minimum baseline, and additional reports can be published, published if deemed appropriate. On the question of the business burden and the definitions around small businesses, in particular raised by the noble Lord Londesborough and the noble Lord, Lord Ravensdale, we do believe this legislation is targeted and proportionate, only regulating, where necessary, to protect the most essential services rely on. That is why small and micro digital service providers are exempt from the regulations unless designated as a critical supplier.

In terms of the definition of that, that is, those. Those entities that employ fewer than 50 people and have an annual turnover or balance sheet of less than 10 million, they are exempt from being a DSP or an MSP. Under the bill. They can only be regulated if they are designated as critical suppliers, for which there will be a high bar for designation. In respect of the questions raised about how we support small businesses, as my noble friend asked, this is a very important part of our approach.

The NCS provide support through the Cyber Action Toolkit and Cyber Essentials, which also includes cyber insurance for those who get the certificate certification and for any organization that experienced an incident. The government's cyber Incident Signposting Service helps point them towards where the issue should be reported and where appropriate support can be sought in respect of the questions around regulated kind the questions around regulated kind of capacity and consistency raised by Lord Vaizey and noble Baroness Baroness Alexander, the framework will drive consistency across sectors through these common security requirements and through the statement of Strategic priorities, which will set the objectives regulators must seek to achieve at sector specific guidance from regulators will also remain key to address sectoral nuances and risks, building on a common foundation of good practice and just.

I would also note that the importance of building out sovereign capability in the UK, raised by many noble. Of your noble Lordships tonight is also one that the government is committed to pursuing. I'm sure we will have other opportunities to talk further about tech sovereignty in the coming week, as through oral questions and the debate coming coming on that in respect of cyber insurance raised by my noble friend Baroness Paul of Shepherd's Bush, Lord the noble Lord, Lord Ashcombe and Lord Robertson.

Cyber insurance absolutely can play an important role as part of a wider approach to cyber resilience, particularly in helping organizations manage the impacts of cyber resilience and support recovery. We don't believe that cyber insurance is a replacement for cyber security, but it is definitely a part of a wider suite of cyber measures in respect of the points made on skills by many of of those speaking tonight, this is incredibly important. We are improving industry understanding of cyber security.

We are investing through tech first in cyber skills. And we are working with the UK Cyber Security Council developing professional standards to bring cyber security in line with professions like engineering and accounting. And I would also like to heartily endorse the points made by Lord Ravensdale and Lord Vaizey about the strength of the cyber security industry and sector in this country. It is not only strong in this country, it is also exporting to many other parts of the world. Building on our strengths.

I would also just note that product security, which was mentioned by many today in the sense of building in requirements, is indeed a fact, a feature of our product security and telecoms infrastructure, or STI regime, which is an important complement to what is in the bill. And just probably to conclude, the Computer Misuse Act, points raised by the noble Lord, Lord Clement-Jones, leading the charge. Indeed, we did highlight that a bill focused on national security in the King's Speech will update the Computer Misuse Act and provide law enforcement with the updated powers and capabilities so that they can remain effective in this in this digital age, I to look forward to the Committee stage.

This is an incredibly important bill. I welcome the high levels of engagement across the House tonight on the practicalities and the details, and I would just say that this bill is fundamentally about national security. It will deliver stronger protections against those who want to disrupt our way of life. It does so with growth at the forefront, focusing first on support and partnership and only regulating where it's necessary.

**** Possible New Speaker ****

And I thank noble Lords, and I look forward to the bill's next stages. I beg to move. The question is that this bill

**** Possible New Speaker ****

The question is that this bill be now read a second time, as many of that opinion will say. Content contrary, not content. The contents contrary, not content. The contents have. It is.

**** Possible New Speaker ****

To move. We have a motion, motion, motion. Just a second.

**** Possible New Speaker ****

motion, motion. Just a second. I beg to move the second motion. The question is that this motion be agreed to, as many of that opinion will say. Content contrary,

**** Possible New Speaker ****

not content. The contents have it. My Lords, I beg to move that the House do now adjourn. House do now adjourn.
This debate has concluded
Return to start of debate - Return to top of page