Lords Grand Committee
Thursday 3rd September 2026
Skip to latest contribution
This debate has concluded
(began 3 weeks, 5 days ago)
Watch LiveSkip to latest contribution
This debate has concluded
12:15
12:16
Speaker 2
-
Speaker 2
I rise to present amendment 17 in my name, and I'm also going to take amendment 28 with it as it's closely related. 17 is, in part, a probing amendment about what constitutes an incident and the circumstances in which a reporting is obligatory. Neither is it. This amendment that I'm presenting doesn't affect the amendment, which the government, I think, is going to present immediately afterwards. Now , as drafted, clause 15 gives the very strong impression that an incident, quote, capable of having unquote, an adverse effect on security must be reported.
This is the case. It constitutes a much wider definition of what should be reported than if it were described as an incident which is, quote, likely to have an adverse effect. Indeed, I think it's a widely held view that and it's certainly the case in the industry, and it's a point with which, however, I agree that the likely to have would be far too wide a definition and would lead to extensive overreporting and quite undue and unnecessary burden on regulators.
So looking at the drafting, I asked myself the question, well, what is the point of the capable of having definition in clause 15. And I'm going to put forward an hypothesis which it will be very helpful if the minister can confirm if the correct understanding of the existing draft and does not mean, does not mean that all incidents capable of having an adverse effect on security will need to be reported. Now, is it right to say that the definition in clause 15 of what constitutes a quotes incident applies across the whole of the regulations, and therefore feeds into security as well as reporting duties? That's to say , firms have a preventative duty to defend against what could be what could happen, as well as what is likely to happen.
That's a preventative duty. So can the minister confirm that the phrase capable of having applies to firms, to that they should have an adequate preventative policies, but is not. And this is where the the point comes in is not the trigger for an incident to be reported. But in each case, this requires it to have affected or be affecting the system. So I'm making a distinction between capable of having, which applies to a duty to pursue preventative policies.
But is not the trigger, not the trigger for the duty to report, which lies in the phrase capable and not capable of having, but likely to have. Now, there are examples of of what I'm saying in the regulations, and I can I can cite them. Regulation 113 A on page 21, line 35. Regulation 12A2A on page 26 and regulation 14E2A on page nine, line 27.
Now, if the minister can confirm that within existing structures, what I have said is correct, i.e., which means that there are no circumstances in which capable of having would be the reporting trigger, that would be a very helpful clarification, and I'll listen closely to what the Minister's reply is on this point. But there is a however, and the, however, is that there's a snag when it comes to the introduction of data centres, and that's the object of my amendment 28 data centres sit outside existing structures, one that I've just been talking about.
And as yet in the in the drafting. There's no reporting trigger regulations for them. That's to say that given that it's intended, the data centres should be in future big players in the system, it matters that there's a gap in what we what our information about the circumstances in which they would have a duty to report. So I think it's it's it's an odd anomaly. Regulation 11 a three, which is on page 23, lines 1415 makes a reportable.
An incident which quotes could have had a significant effect, whether or not it actually had any impact at all or anything was affected. And as a no list of factors for adjudging, the significance of, of, of judging what constitutes significant attack on the face of the bill, I mean, this makes it quite difficult to interpret. So whereas for the the operators of essential services for operators of essential digital services and for managed service providers, such factors are set out expressly in the regulations of the bill.
They're absent for data centres. So my question is why is this the case and what is the the rationale for what appears to be an anomaly? And it means that when coming to reporting to reporting an incident, a data centre has to do so when any of the following have had or were having or were likely to have, and I quote, a significant impact on the operational security of the network and information systems relied on to provide data centre services a significant impact on the continuity of such services by data centres and any other impact in the UK or part of it, which is significant.
Now these are these are very wide definitions of liability to report and the discrepancy between them and those applying to other operators, I have to say, doesn't seem either sensible from the security point of view, nor fair actually from in business circumstances, it's going to be all sorts of different kinds of business using data centres. So I expect that the government will say, and I hope I'm not going to it's not going to be the case, but I fear the government may say that thresholds and factors for all categories of business will be set out in secondary legislation and subject to consultation, and I would ask the Minister if she would think hard about the adequacy of that reply.
We are talking here about a penalty backed duty, which is the core, which is a core element of the bill. It's not some minor point, and it does seem a poor legislative to ensure that incident reporting measures for regulated entities reflect what we are trying to achieve. The bill already requires relevant, regulated entities to consider a list of factors when determining if an incident is likely to have a significant impact and be reportable.
This included whether data related to users is or is likely to be compromised. Government amendments 1936 and 44 remove the reference to users, meaning all data compromises relating to the relevant network and information system are in scope of incident reporting, so this enables key incidents to be reported, including the compromise of commercially sensitive information or exposure of access details or user names of the regulated service. These incidents will need to be reported to Ncc-cc and the relevant regulator.
So to respond to the noble Lord, Lord Clement-jones, that is the motivation behind the change to that categorisation. This will enable that the regulators have full oversight of significant security compromises to support them keeping the UK safe and secure, and we will also shortly consult on what consult and what constitutes a significant impact, and put further detail on in secondary legislation and guidance. Let me turn now to the amendments tabled by the noble Baroness, Baroness I.
Lords.
This is the case. It constitutes a much wider definition of what should be reported than if it were described as an incident which is, quote, likely to have an adverse effect. Indeed, I think it's a widely held view that and it's certainly the case in the industry, and it's a point with which, however, I agree that the likely to have would be far too wide a definition and would lead to extensive overreporting and quite undue and unnecessary burden on regulators.
So looking at the drafting, I asked myself the question, well, what is the point of the capable of having definition in clause 15. And I'm going to put forward an hypothesis which it will be very helpful if the minister can confirm if the correct understanding of the existing draft and does not mean, does not mean that all incidents capable of having an adverse effect on security will need to be reported. Now, is it right to say that the definition in clause 15 of what constitutes a quotes incident applies across the whole of the regulations, and therefore feeds into security as well as reporting duties? That's to say , firms have a preventative duty to defend against what could be what could happen, as well as what is likely to happen.
That's a preventative duty. So can the minister confirm that the phrase capable of having applies to firms, to that they should have an adequate preventative policies, but is not. And this is where the the point comes in is not the trigger for an incident to be reported. But in each case, this requires it to have affected or be affecting the system. So I'm making a distinction between capable of having, which applies to a duty to pursue preventative policies.
But is not the trigger, not the trigger for the duty to report, which lies in the phrase capable and not capable of having, but likely to have. Now, there are examples of of what I'm saying in the regulations, and I can I can cite them. Regulation 113 A on page 21, line 35. Regulation 12A2A on page 26 and regulation 14E2A on page nine, line 27.
Now, if the minister can confirm that within existing structures, what I have said is correct, i.e., which means that there are no circumstances in which capable of having would be the reporting trigger, that would be a very helpful clarification, and I'll listen closely to what the Minister's reply is on this point. But there is a however, and the, however, is that there's a snag when it comes to the introduction of data centres, and that's the object of my amendment 28 data centres sit outside existing structures, one that I've just been talking about.
And as yet in the in the drafting. There's no reporting trigger regulations for them. That's to say that given that it's intended, the data centres should be in future big players in the system, it matters that there's a gap in what we what our information about the circumstances in which they would have a duty to report. So I think it's it's it's an odd anomaly. Regulation 11 a three, which is on page 23, lines 1415 makes a reportable.
An incident which quotes could have had a significant effect, whether or not it actually had any impact at all or anything was affected. And as a no list of factors for adjudging, the significance of, of, of judging what constitutes significant attack on the face of the bill, I mean, this makes it quite difficult to interpret. So whereas for the the operators of essential services for operators of essential digital services and for managed service providers, such factors are set out expressly in the regulations of the bill.
They're absent for data centres. So my question is why is this the case and what is the the rationale for what appears to be an anomaly? And it means that when coming to reporting to reporting an incident, a data centre has to do so when any of the following have had or were having or were likely to have, and I quote, a significant impact on the operational security of the network and information systems relied on to provide data centre services a significant impact on the continuity of such services by data centres and any other impact in the UK or part of it, which is significant.
Now these are these are very wide definitions of liability to report and the discrepancy between them and those applying to other operators, I have to say, doesn't seem either sensible from the security point of view, nor fair actually from in business circumstances, it's going to be all sorts of different kinds of business using data centres. So I expect that the government will say, and I hope I'm not going to it's not going to be the case, but I fear the government may say that thresholds and factors for all categories of business will be set out in secondary legislation and subject to consultation, and I would ask the Minister if she would think hard about the adequacy of that reply.
We are talking here about a penalty backed duty, which is the core, which is a core element of the bill. It's not some minor point, and it does seem a poor legislative to ensure that incident reporting measures for regulated entities reflect what we are trying to achieve. The bill already requires relevant, regulated entities to consider a list of factors when determining if an incident is likely to have a significant impact and be reportable.
This included whether data related to users is or is likely to be compromised. Government amendments 1936 and 44 remove the reference to users, meaning all data compromises relating to the relevant network and information system are in scope of incident reporting, so this enables key incidents to be reported, including the compromise of commercially sensitive information or exposure of access details or user names of the regulated service. These incidents will need to be reported to Ncc-cc and the relevant regulator.
So to respond to the noble Lord, Lord Clement-jones, that is the motivation behind the change to that categorisation. This will enable that the regulators have full oversight of significant security compromises to support them keeping the UK safe and secure, and we will also shortly consult on what consult and what constitutes a significant impact, and put further detail on in secondary legislation and guidance. Let me turn now to the amendments tabled by the noble Baroness, Baroness I.
Lords.
12:38
Speaker 3
-
Speaker 3
Could I interrupt the Minister before she moves on to the next set of amendments? I don't intend to ambush the Minister as regards her amendments this time around, but I would seek assurance, given there seems to be quite a philosophical difference between her amendments that she's tabling today and those put forward by the noble Lady Neville-jones. And there is considerable industry concern about the disproportionality involved here, my Lords, and I would seek the assurance of the Minister that between committee and report he will actively consult , not just, you know, when the bill is, you know, in black letter form, but she will actually consult about the impact of this part of the bill of clause 15, because from many industry voices, my Lords, there is quite a lot of concern, and I do think it's incumbent on the government to listen to those voices about the impact of this reporting structure and duties before they, you know, go ahead in a way that, you know, many of us believe is is really not going to be helpful for the running of those businesses.
12:40
Speaker 2
-
Speaker 2
I, as I mentioned, we already have undertaken I haven't already mentioned we have already undertaken some consultation. We I am very happy to commit to contact affected businesses, business organisations and have further conversations between now and report. Perhaps if I progress a little bit more, I may be able to answer some of the questions which I think may have given rise to some of that. But equally, there are different rationales for some different thresholds in the bill, which I again, just about to come on to.
I will set out the rationale for those because I think they are well motivated and are linked to the risk profile that we see in the country and the connectedness of certain regulated entities in the country. So just turning to the the amendments tabled by Baroness Neville-jones and her questions to me on the the first question, which is the link between the definitions and whether they apply beyond incident reporting, they they do apply to the security duties within the bill, which means that regulated entities have a duty to prevent or minimize the impact of incidents.
So making the amendments from the noble Baroness would limit this and would reduce the security and resilience. And we do also think that not every incident should be reportable, but organisations need to take appropriate and proportionate steps to mitigate the risks before, during and after a broader sense of incidents. So turning to the second part of her amendments and her second question, the the government has recognised that the reporting threshold for data centers is broader than that for other regulated entities under the bill, and this reflects the distinctive role and risk profile of data centres.
They are the physical infrastructure underpinning digital services across the economy and public sector. The. Unlike the virtual cloud layer, for instance, they combine cyber, physical personnel and operational technology risks. This is particularly important in co-location facilities, where infrastructure belonging to numerous customers is concentrated in one location. They may need physical access to the premises and information about facilities or operational systems, so a single incident could therefore exploit both physical and digital vulnerabilities, potentially affecting the confidentiality, confidentiality, integrity or availability of services belonging to multiple customers and sectors.
And the consequences may also extend beyond the facility's immediate geographic location because the hosted service can support users and essential services elsewhere. So that is the rationale for having this threshold for as applying to data centres to to come on to the questions raised, including by Lord Clements or Clement Jones on the. The use of the phrase capable of. And the points made in the amendment by the noble Baroness, Baroness Neville-jones replacing could have had or capable of having with likely to have would exclude some incidents because their eventual impact was uncertain or successfully contained, and it would also constrain the security duties.
As I mentioned earlier , in reference to the incident reporting definitions introduced by clause 15, the the . The detail subsequently here sets out that how the notification of incidents applies in each regulated sector except for for for data centres. So that that is how the definition is made for regulated sectors other than data centres. So we also have a lot of safeguards in the bill to ensure that reporting remains proportionate.
It is intended to capture significant near misses, not routine scanning, unsuccessful low level attacks or ordinary operational events, and clear guidance will ensure the industry understands this threshold. As the noble Baroness, Baroness Neville-jones pointed out, we will be setting this out in in secondary legislation and that will allow the consultation that the noble Lord, Lord Clement Jones, also emphasized, which we agree with, is so, so important. We have undertaken extensive engagement to date and will continue to do so.
Let me now turn to the question of reporting, and I will speak to amendment 165. Laid by the noble Lord, Lord Clement Jones. On. On this I share the noble Lords views on the vital importance of collating this data to understand the threat landscape in which our essential services operate. Indeed, keep up to date statistics on the incidents they have triaged. For this reason, however, I do not agree that we need to mandate further annual reports to publicise this data.
Crucially, the NCS already publish an overview of incidents they have triaged in their annual report. This contains up to date statistics about the character categories of incident, which NCS have tracked or handled, with further commentary on the type of incident and sectors involved. Additionally, the Secretary of State will have the opportunity to set out additional data in the Annual report they publish on the Statement of Strategic Priorities. And while the Statement of Strategic Priorities will only be finalised following consultation of the draft with regulators and subject to parliamentary approval, my expectation is that it will obtain objectives relating to how regulators oversee and implement effective incident reporting, which I will also come on to again shortly.
The annual report would therefore be a natural forum in which to collate and share the insights regulators have gleaned. So based on these considerations, I would rather I would argue that no further additional reporting is is is is necessary. Coming on to the the question of ransomware. And I thank the noble Viscount Camrose for highlighting the importance of tackling ransomware. It's and highlighting the continued threat posed by criminal groups to the UK of using this method.
And that is why one of the reasons we have widened the scope of the incident reporting requirements under the Bill. So under the new provisions, entities will be required to report a greater range of harmful incidents that have a significant impact, including, crucially, ransomware incidents themselves. I note the noble Viscount Central concern is that the possibility that this reporting could be followed by enforcement action, and that would disincentivize reporting in that context, where a regulated entity has taken appropriate and proportionate steps to manage the risks in their system and experience a ransomware attack.
Despite these precautions, there is unlikely to be any reason for enforcement action. Under the regulations, regulators would always take into account the security measures which an organisation has put in place. However, it is also right that regulators are able to take enforcement action where organisations have failed to safeguard the security of the essential services, and to do so, they will need to have sight of ransomware attacks that have had a significant impact.
I therefore can't accept the idea of excluding ransomware incidents from the reporting provisions of the bill, as this amendment envisages. On the question of. The impact assessment spoken to under amendment 172. Impact assessment is is indeed very important, as is the consultation with industry. We have taken to date. The incident reporting requirements have been carefully designed with impacts on regulated entities in mind, and that is why we have chosen to adopt the two stage reporting incident requirement outlined in the Bill over multi-stage reporting adopted in Is two, and why we have taken a proportionate approach to expanding the range of reportable incidents that need to be reported, and the cost implications of each of these measures are already quantified in our impact assessment for the Bill, and I would also like to reassure once again, all noble Lords, that we will continue to work closely with regulated entities and the design and implementation of the Incident Reporting framework in the coming months.
This will include the reporting thresholds , which we intend to set out in secondary legislation, as well as the steps on streamlining the reporting process itself, and there are already opportunities for reviewing and assessing the way in which the incident reporting framework is operating. One of these will be the annual report on the Statement of Strategic Priorities, which I have spoken to already, and the other is the legislative review mechanism required under clause 40. So for that reason, I'm confident that the intent of the amendment, which indeed is is right, will be achieved through this combined programme of work and that, again, a further report will be unnecessary.
My Lord, listen very carefully to what the minister has said. I had hoped that we would get greater clarity. I fear that the fog has increased. I entirely accept the point that companies have a general duty to take as as many preventative measures as they can to increase security, but that's a different matter, it seems to me, from actually what should trigger a reporting duty. And precisely, I think, what you have laid out, Minister, what minister laid out leads to a situation of much, much greater reporting, overload, reporting of items that don't don't require that kind of treatment.
So I am I'm extremely concerned that what the industry fears and where I think they have a real point, that actually they will be cause to, to, to be active in areas which lead the regulators to be swamped and which reduces the real level of security because they're doing things which they don't really need to. And it's the kind of thing which those of us who are willing to contemplate a, a, a, a system of, of regulation, which allows for differentiation between sectors, in other words, a sectoral approach.
It's the kind of differentiation seems to me that's going to lead to a terrible muddle. So I am really very unhappy about the response that's been given to that general point. And it strengthens the cause of those who say what we should have is 1.1 general regulator and and they should set, set, set, set the rules. Secondly, on the the question of the data centres, I cannot understand that the fact of a data centre would alter the rules under which companies are actually operating, doing their business, and they happen to be located in a data centre.
So I fear that this is an issue to which I think we will have to return at report stage, because I think we're not heading in the right direction as things stand. Yeah yeah.
I will set out the rationale for those because I think they are well motivated and are linked to the risk profile that we see in the country and the connectedness of certain regulated entities in the country. So just turning to the the amendments tabled by Baroness Neville-jones and her questions to me on the the first question, which is the link between the definitions and whether they apply beyond incident reporting, they they do apply to the security duties within the bill, which means that regulated entities have a duty to prevent or minimize the impact of incidents.
So making the amendments from the noble Baroness would limit this and would reduce the security and resilience. And we do also think that not every incident should be reportable, but organisations need to take appropriate and proportionate steps to mitigate the risks before, during and after a broader sense of incidents. So turning to the second part of her amendments and her second question, the the government has recognised that the reporting threshold for data centers is broader than that for other regulated entities under the bill, and this reflects the distinctive role and risk profile of data centres.
They are the physical infrastructure underpinning digital services across the economy and public sector. The. Unlike the virtual cloud layer, for instance, they combine cyber, physical personnel and operational technology risks. This is particularly important in co-location facilities, where infrastructure belonging to numerous customers is concentrated in one location. They may need physical access to the premises and information about facilities or operational systems, so a single incident could therefore exploit both physical and digital vulnerabilities, potentially affecting the confidentiality, confidentiality, integrity or availability of services belonging to multiple customers and sectors.
And the consequences may also extend beyond the facility's immediate geographic location because the hosted service can support users and essential services elsewhere. So that is the rationale for having this threshold for as applying to data centres to to come on to the questions raised, including by Lord Clements or Clement Jones on the. The use of the phrase capable of. And the points made in the amendment by the noble Baroness, Baroness Neville-jones replacing could have had or capable of having with likely to have would exclude some incidents because their eventual impact was uncertain or successfully contained, and it would also constrain the security duties.
As I mentioned earlier , in reference to the incident reporting definitions introduced by clause 15, the the . The detail subsequently here sets out that how the notification of incidents applies in each regulated sector except for for for data centres. So that that is how the definition is made for regulated sectors other than data centres. So we also have a lot of safeguards in the bill to ensure that reporting remains proportionate.
It is intended to capture significant near misses, not routine scanning, unsuccessful low level attacks or ordinary operational events, and clear guidance will ensure the industry understands this threshold. As the noble Baroness, Baroness Neville-jones pointed out, we will be setting this out in in secondary legislation and that will allow the consultation that the noble Lord, Lord Clement Jones, also emphasized, which we agree with, is so, so important. We have undertaken extensive engagement to date and will continue to do so.
Let me now turn to the question of reporting, and I will speak to amendment 165. Laid by the noble Lord, Lord Clement Jones. On. On this I share the noble Lords views on the vital importance of collating this data to understand the threat landscape in which our essential services operate. Indeed, keep up to date statistics on the incidents they have triaged. For this reason, however, I do not agree that we need to mandate further annual reports to publicise this data.
Crucially, the NCS already publish an overview of incidents they have triaged in their annual report. This contains up to date statistics about the character categories of incident, which NCS have tracked or handled, with further commentary on the type of incident and sectors involved. Additionally, the Secretary of State will have the opportunity to set out additional data in the Annual report they publish on the Statement of Strategic Priorities. And while the Statement of Strategic Priorities will only be finalised following consultation of the draft with regulators and subject to parliamentary approval, my expectation is that it will obtain objectives relating to how regulators oversee and implement effective incident reporting, which I will also come on to again shortly.
The annual report would therefore be a natural forum in which to collate and share the insights regulators have gleaned. So based on these considerations, I would rather I would argue that no further additional reporting is is is is necessary. Coming on to the the question of ransomware. And I thank the noble Viscount Camrose for highlighting the importance of tackling ransomware. It's and highlighting the continued threat posed by criminal groups to the UK of using this method.
And that is why one of the reasons we have widened the scope of the incident reporting requirements under the Bill. So under the new provisions, entities will be required to report a greater range of harmful incidents that have a significant impact, including, crucially, ransomware incidents themselves. I note the noble Viscount Central concern is that the possibility that this reporting could be followed by enforcement action, and that would disincentivize reporting in that context, where a regulated entity has taken appropriate and proportionate steps to manage the risks in their system and experience a ransomware attack.
Despite these precautions, there is unlikely to be any reason for enforcement action. Under the regulations, regulators would always take into account the security measures which an organisation has put in place. However, it is also right that regulators are able to take enforcement action where organisations have failed to safeguard the security of the essential services, and to do so, they will need to have sight of ransomware attacks that have had a significant impact.
I therefore can't accept the idea of excluding ransomware incidents from the reporting provisions of the bill, as this amendment envisages. On the question of. The impact assessment spoken to under amendment 172. Impact assessment is is indeed very important, as is the consultation with industry. We have taken to date. The incident reporting requirements have been carefully designed with impacts on regulated entities in mind, and that is why we have chosen to adopt the two stage reporting incident requirement outlined in the Bill over multi-stage reporting adopted in Is two, and why we have taken a proportionate approach to expanding the range of reportable incidents that need to be reported, and the cost implications of each of these measures are already quantified in our impact assessment for the Bill, and I would also like to reassure once again, all noble Lords, that we will continue to work closely with regulated entities and the design and implementation of the Incident Reporting framework in the coming months.
This will include the reporting thresholds , which we intend to set out in secondary legislation, as well as the steps on streamlining the reporting process itself, and there are already opportunities for reviewing and assessing the way in which the incident reporting framework is operating. One of these will be the annual report on the Statement of Strategic Priorities, which I have spoken to already, and the other is the legislative review mechanism required under clause 40. So for that reason, I'm confident that the intent of the amendment, which indeed is is right, will be achieved through this combined programme of work and that, again, a further report will be unnecessary.
My Lord, listen very carefully to what the minister has said. I had hoped that we would get greater clarity. I fear that the fog has increased. I entirely accept the point that companies have a general duty to take as as many preventative measures as they can to increase security, but that's a different matter, it seems to me, from actually what should trigger a reporting duty. And precisely, I think, what you have laid out, Minister, what minister laid out leads to a situation of much, much greater reporting, overload, reporting of items that don't don't require that kind of treatment.
So I am I'm extremely concerned that what the industry fears and where I think they have a real point, that actually they will be cause to, to, to be active in areas which lead the regulators to be swamped and which reduces the real level of security because they're doing things which they don't really need to. And it's the kind of thing which those of us who are willing to contemplate a, a, a, a system of, of regulation, which allows for differentiation between sectors, in other words, a sectoral approach.
It's the kind of differentiation seems to me that's going to lead to a terrible muddle. So I am really very unhappy about the response that's been given to that general point. And it strengthens the cause of those who say what we should have is 1.1 general regulator and and they should set, set, set, set the rules. Secondly, on the the question of the data centres, I cannot understand that the fact of a data centre would alter the rules under which companies are actually operating, doing their business, and they happen to be located in a data centre.
So I fear that this is an issue to which I think we will have to return at report stage, because I think we're not heading in the right direction as things stand. Yeah yeah.
12:52
12:52
12:52
12:52
12:53
Speaker 2
-
Speaker 2
My Lords, I rise to introduce a very large number of amendments for which I apologize. Amendments 18 to 23, 25 to 31, 33 to 39, 41 to 47 and 49 and 50. Just greedy. Yes. Full house. Fear not. It is not quite as complex as it seems. These amendments which are. I've put, I have introduced, but I'm very grateful for the support of both the noble lady, Baroness Kidron, and my noble friend Lord Holmes of Richmond.
They seek to strengthen the staged reporting requirements of the four different groups of entities. So each change has to be repeated four times. And because of the way the bill is drafted, I was unable to introduce just the change. I've had to put each micro phrase in. So hence the reason we have so many amendments. So this aims to strengthen the staged reporting requirements for operators of essential services, for data centres, for relevant digital service providers, and for relevant managed service providers.
So everything is multiplied by four. The bill, as it stands, only requires an initial report within 24 hours and a full notification within 72 hours of an incident. My amendments add two further stages an intermediate report, which is capped at 14 days after the incident, has first been notified or sooner if the relevant regulator requires, and a final report within one month. In all four cases, the reports must be given without undue delay, so regulated entities can't use the timeframes as an excuse to delay until the end of the time period.
These amendments are in line with the EU's Nice two directive and the reason why I've introduced them is I said I spoke a lot at second reading is I've lived this. I absolutely understand what the fog feels like that in the first moment when you when you have been attacked, you don't understand what's happened. You don't know who's attacking you. You don't know what they could have stolen. You don't know where they've gone.
But you do know that it's serious. That's your first report. 72 hours later, you're starting to understand quite how awful it could be. That's your second report , where you start to get real data because your teams have worked all night, usually all around the world, to try and work out where the malign actors have gone. But it's really only after a couple of weeks that you've got a proper sense of what has happened.
And my experience, I obviously recognise is ten years old. But quite recently I had a long conversation with some of the leaders at Marks and Spencer, and the thing that scared me most was that it seemed so similar to my experience ten years ago, that this basic process is likely to be the same. So you need the requirement to properly update what have you learnt? Two weeks on and then a month later the fog is starting to clear and you have a proper sense of the real scale of the problem .
And the reason why we need to put this in legislation is that throughout that entire period, all the incentives for you as a corporate leader are not to say anything. This is the biggest corporate taboo, and your board will be encouraging you not to tell everyone. The public will be telling you not to tell everyone. And there is a real risk that unless you're forced to, you just make it easier for the blackmailers to do their work. So my personal experience was being blackmailed during this process.
Obviously at the time there were none of these regulations. And, and I can tell you, you know, that there were so many voices saying, why didn't you just shut up? You don't know what's going on yet. Keep quiet. And yet, if you share this information in the fog with regulators and with law enforcement agencies, that's how the law can prevail. It's how regulators can work out what's happening. It's how they can warn others who might be affected.
And it's how the law enforcement agencies can do their work to actually try and find the bad guys. So this does really matter if we want the rule of law to exist in the digital world, because the incentives, even for entirely well-meaning and upstanding leaders of corporations and government departments, dare I say, are to keep quiet. And so we need to put on the on the face of the bill, these reporting requirements. All this does is bring our own legislation in line with the.
This two framework. And to be honest, many of these companies and many of these incidents are likely to need to be reported in Europe at the same time as they are in the UK. So, as my noble friend, Barrister Neville-jones has said, there is a real primacy on keeping things simple. So the more that we can mirror and have exactly the same reporting requirements, the easier it is. When you are in that terrifying moment when you realize that you've got a serious incident, I beg to move.
They seek to strengthen the staged reporting requirements of the four different groups of entities. So each change has to be repeated four times. And because of the way the bill is drafted, I was unable to introduce just the change. I've had to put each micro phrase in. So hence the reason we have so many amendments. So this aims to strengthen the staged reporting requirements for operators of essential services, for data centres, for relevant digital service providers, and for relevant managed service providers.
So everything is multiplied by four. The bill, as it stands, only requires an initial report within 24 hours and a full notification within 72 hours of an incident. My amendments add two further stages an intermediate report, which is capped at 14 days after the incident, has first been notified or sooner if the relevant regulator requires, and a final report within one month. In all four cases, the reports must be given without undue delay, so regulated entities can't use the timeframes as an excuse to delay until the end of the time period.
These amendments are in line with the EU's Nice two directive and the reason why I've introduced them is I said I spoke a lot at second reading is I've lived this. I absolutely understand what the fog feels like that in the first moment when you when you have been attacked, you don't understand what's happened. You don't know who's attacking you. You don't know what they could have stolen. You don't know where they've gone.
But you do know that it's serious. That's your first report. 72 hours later, you're starting to understand quite how awful it could be. That's your second report , where you start to get real data because your teams have worked all night, usually all around the world, to try and work out where the malign actors have gone. But it's really only after a couple of weeks that you've got a proper sense of what has happened.
And my experience, I obviously recognise is ten years old. But quite recently I had a long conversation with some of the leaders at Marks and Spencer, and the thing that scared me most was that it seemed so similar to my experience ten years ago, that this basic process is likely to be the same. So you need the requirement to properly update what have you learnt? Two weeks on and then a month later the fog is starting to clear and you have a proper sense of the real scale of the problem .
And the reason why we need to put this in legislation is that throughout that entire period, all the incentives for you as a corporate leader are not to say anything. This is the biggest corporate taboo, and your board will be encouraging you not to tell everyone. The public will be telling you not to tell everyone. And there is a real risk that unless you're forced to, you just make it easier for the blackmailers to do their work. So my personal experience was being blackmailed during this process.
Obviously at the time there were none of these regulations. And, and I can tell you, you know, that there were so many voices saying, why didn't you just shut up? You don't know what's going on yet. Keep quiet. And yet, if you share this information in the fog with regulators and with law enforcement agencies, that's how the law can prevail. It's how regulators can work out what's happening. It's how they can warn others who might be affected.
And it's how the law enforcement agencies can do their work to actually try and find the bad guys. So this does really matter if we want the rule of law to exist in the digital world, because the incentives, even for entirely well-meaning and upstanding leaders of corporations and government departments, dare I say, are to keep quiet. And so we need to put on the on the face of the bill, these reporting requirements. All this does is bring our own legislation in line with the.
This two framework. And to be honest, many of these companies and many of these incidents are likely to need to be reported in Europe at the same time as they are in the UK. So, as my noble friend, Barrister Neville-jones has said, there is a real primacy on keeping things simple. So the more that we can mirror and have exactly the same reporting requirements, the easier it is. When you are in that terrifying moment when you realize that you've got a serious incident, I beg to move.
12:58
12:58
12:58
Speaker 5
-
Speaker 5
My Lords, I'm very glad to support all of the amendments and I will not read them out again. The noble Lady Harding has already convincingly set out the case, and. And I really do hope that the Minister recognises that these amendments are born out of lived experience characteristic of this House, and very precious. When considering how legislation actually impacts in the world at times of crisis. The amendments specifically call on state for staged incident reporting to create a drumbeat of information and oversight so that damage can be minimised.
Cyber attacks move quickly. They're extremely confusing for those involved. Stage staged incident reporting enables regulators to have a more immediate understanding so that they can offer support, anticipate, spread, learn lessons for strengthening guidance in the future. And I would say it's been more than five years since the Joint Committee on the Draft Online Safety Bill started its report draft on the draft legislation with the sentence self-regulation of online services has failed.
The tech sector has really taught quite a good game, but we do know from experience that it is hard to to get them to act voluntarily, that they resist regulations which are not precisely framed and meaningfully enforced. And, and, and obviously, what the noble Lady Harding said about incentives also plays into that. My Lords, these amendments make clear the processes for what a service provider should do in the event of a cyber attack, rather than rely on the discretion of service providers themselves.
And they make sure that those who need the information have the information. And I think it was Viscount Camrose who said, who used the phrase our collective ability to understand what's going on. It is not good enough for one part of the system to understand, but everybody in the system have that opportunity. It's been said a number of times already, but a small cyber attack in one part of the stack can have a disproportionate impact across the whole.
The regulator having just in time information, could save the pain for many others down the line. These are really sensible amendments and I hope the government looks favourably on them.
Cyber attacks move quickly. They're extremely confusing for those involved. Stage staged incident reporting enables regulators to have a more immediate understanding so that they can offer support, anticipate, spread, learn lessons for strengthening guidance in the future. And I would say it's been more than five years since the Joint Committee on the Draft Online Safety Bill started its report draft on the draft legislation with the sentence self-regulation of online services has failed.
The tech sector has really taught quite a good game, but we do know from experience that it is hard to to get them to act voluntarily, that they resist regulations which are not precisely framed and meaningfully enforced. And, and, and obviously, what the noble Lady Harding said about incentives also plays into that. My Lords, these amendments make clear the processes for what a service provider should do in the event of a cyber attack, rather than rely on the discretion of service providers themselves.
And they make sure that those who need the information have the information. And I think it was Viscount Camrose who said, who used the phrase our collective ability to understand what's going on. It is not good enough for one part of the system to understand, but everybody in the system have that opportunity. It's been said a number of times already, but a small cyber attack in one part of the stack can have a disproportionate impact across the whole.
The regulator having just in time information, could save the pain for many others down the line. These are really sensible amendments and I hope the government looks favourably on them.
13:01
Speaker 6
-
Speaker 6
My Lords, it's a pleasure to rise to support these amendments and indeed to have signed all of them. Though in doing so, I almost got a serious case of electronic RSI. They have the great good fortune of being clear, precise and aligned with existing regulations in other jurisdictions. As Lady Harding has already pointed out, many, many businesses will be have operations in multi jurisdictions for something as significant as reporting.
Why wouldn't we follow NIST to, in this respect, the clarity of the amendments is their strength and even more so when compared with what is currently in the bill in this respect and what we're trying to achieve from these changes, it's clear the 24 hour initial reporting period. That makes sense. Of course it does. And as Baroness Harding points out, what one knows at that point is that something's happening and a report is made.
And in many ways, that's all that needs to be known and all that needs to be reported. But to have the situation as currently set out in the Bill 24, then 72 in that period, so much would need to have been known to comply with the provisions currently set out in the bill is just not realistic to have . This stage approach is both clear. Precise, enables what the purpose of this bill is all about, supports the individual, business or entity that is under the attack.
Crucially, as other noble Lords have said, put the power in the collective that as a consequence of one attack, the collective can benefit. If there is a sense of commitment to this reporting schedule, which will only come if it is in this stage form, as clearly set out by Baroness Harding. If we want to enable businesses and other entities to really commit to this process and not just be dragged there by force of statute, but to have it as a means of business as usual, of real cultural change and commitment to the positivity of this.
It has to work for them. This stage process not only does that, but by aligning with this , stops this being yet another burden added to business. Another burden added unnecessarily and less effectively than what these amendments propose. I very much look forward to the Minister's response.
Why wouldn't we follow NIST to, in this respect, the clarity of the amendments is their strength and even more so when compared with what is currently in the bill in this respect and what we're trying to achieve from these changes, it's clear the 24 hour initial reporting period. That makes sense. Of course it does. And as Baroness Harding points out, what one knows at that point is that something's happening and a report is made.
And in many ways, that's all that needs to be known and all that needs to be reported. But to have the situation as currently set out in the Bill 24, then 72 in that period, so much would need to have been known to comply with the provisions currently set out in the bill is just not realistic to have . This stage approach is both clear. Precise, enables what the purpose of this bill is all about, supports the individual, business or entity that is under the attack.
Crucially, as other noble Lords have said, put the power in the collective that as a consequence of one attack, the collective can benefit. If there is a sense of commitment to this reporting schedule, which will only come if it is in this stage form, as clearly set out by Baroness Harding. If we want to enable businesses and other entities to really commit to this process and not just be dragged there by force of statute, but to have it as a means of business as usual, of real cultural change and commitment to the positivity of this.
It has to work for them. This stage process not only does that, but by aligning with this , stops this being yet another burden added to business. Another burden added unnecessarily and less effectively than what these amendments propose. I very much look forward to the Minister's response.
13:04
13:05
13:05
13:05
13:05
Speaker 7
-
Speaker 7
We're all so keen, my Lords. I was only going to say that good can come out of bad events and the experience as well as the speech of my noble friend Baroness Harding, is one such good aspect, and if it combines with bringing us into line with European practice, which is something so many businesses already have to follow, so much the better. So I do hope the noble lady, the Minister, will be as sympathetic as she possibly can be to enable friend's amendment.
13:05
13:05
Speaker 3
-
Speaker 3
My Lords, I'm grateful for the opportunity to intervene briefly. My Lords, I very strongly support this set of amendments relating to stage notification of incidents. My Lords, this really is a significant group of amendments. Noble Baroness, Lady Harding and so well supported by the noble Baroness Kidron and noble Lord Holmes, and the noble Lord, has really illustrated extremely well, and. As.
Has been described, the noble Baroness has a great deal of experience. She brings an invaluable perspective to this committee, having led a major telecommunications provider through one of the most high profile corporate cyber breaches in British history. And she speaks from real experience and understands very clearly what happens inside an organisation in the immediate aftermath of a severe attack. So, my Lords, I think we should listen extremely carefully to what she has to say.
And in those critical opening hours, incident response teams and forensic engineers are working under an intense fog of war, so to speak, actively fighting to contain the malware, isolate compromised servers and protect customer data. You can't expect an organisation to produce an exhaustive multi-variable forensic post-mortem within the first few hours of a fast moving operational crisis. Yet as clause 15 currently stands, the reporting pipeline that follows the initial notification is left thin and unstructured, and the noble Baroness amendments fix this three stage architecture mirrored clause by clause across each category of regulated entity.
Operators of essential services , data centres, relevant service providers and relevant managed service providers. And my Lord, sir, I'm not going to add much further. I think noble Lords have already spoken extremely eloquently. Cyber incidents do not likely conclude on the day a final report falls due and where an incident is still live at the point the final report is owed, the entity must instead give a progress report on the information known to date, followed by the final report within one month of the incident actually ceasing.
And that seems to me, my Lords, to be a very sensible, realistic accommodation of how live incidents actually unfold. I think, finally, my Lords, we should turn to the amendments tabled by the noble Lord, Lord Ashcombe, although I don't see him in committee, and I think they're in this group of amendments which would extend the deadline for the full notification from 72 hours to 30 days. And I understand the underlying concern. 72 hours can be an unforgiving window in which to complete a full investigation and analysis.
But I do think that it's actually the noble Baroness Lady Hardings amendments, which actually deliver what we need. My Lords intermediate reporting exists precisely so that authorities are not left in the dark for weeks at a time. So I think, my Lords, taken together, the noble Baroness amendments replace a single blunt deadline with a structured, predictable reporting line, one that gives business clarity on exactly what is required and when, whilst ensuring that the NCC and our competent authorities receive high quality structured intelligence rather than a single rushed snapshot.
And as she said, this is the kind of stage discipline that the EU's NIS2 directive already reflects, and which this bill should emulate.
Has been described, the noble Baroness has a great deal of experience. She brings an invaluable perspective to this committee, having led a major telecommunications provider through one of the most high profile corporate cyber breaches in British history. And she speaks from real experience and understands very clearly what happens inside an organisation in the immediate aftermath of a severe attack. So, my Lords, I think we should listen extremely carefully to what she has to say.
And in those critical opening hours, incident response teams and forensic engineers are working under an intense fog of war, so to speak, actively fighting to contain the malware, isolate compromised servers and protect customer data. You can't expect an organisation to produce an exhaustive multi-variable forensic post-mortem within the first few hours of a fast moving operational crisis. Yet as clause 15 currently stands, the reporting pipeline that follows the initial notification is left thin and unstructured, and the noble Baroness amendments fix this three stage architecture mirrored clause by clause across each category of regulated entity.
Operators of essential services , data centres, relevant service providers and relevant managed service providers. And my Lord, sir, I'm not going to add much further. I think noble Lords have already spoken extremely eloquently. Cyber incidents do not likely conclude on the day a final report falls due and where an incident is still live at the point the final report is owed, the entity must instead give a progress report on the information known to date, followed by the final report within one month of the incident actually ceasing.
And that seems to me, my Lords, to be a very sensible, realistic accommodation of how live incidents actually unfold. I think, finally, my Lords, we should turn to the amendments tabled by the noble Lord, Lord Ashcombe, although I don't see him in committee, and I think they're in this group of amendments which would extend the deadline for the full notification from 72 hours to 30 days. And I understand the underlying concern. 72 hours can be an unforgiving window in which to complete a full investigation and analysis.
But I do think that it's actually the noble Baroness Lady Hardings amendments, which actually deliver what we need. My Lords intermediate reporting exists precisely so that authorities are not left in the dark for weeks at a time. So I think, my Lords, taken together, the noble Baroness amendments replace a single blunt deadline with a structured, predictable reporting line, one that gives business clarity on exactly what is required and when, whilst ensuring that the NCC and our competent authorities receive high quality structured intelligence rather than a single rushed snapshot.
And as she said, this is the kind of stage discipline that the EU's NIS2 directive already reflects, and which this bill should emulate.
13:10
Speaker 8
-
Speaker 8
As. As per the points made by other noble Lords, I think this is a prime example of. You realize how valuable it is to have people in in this House and in this particular committee who have lived lived the experience and and, you know, I think because of that, this is a very, very well thought out set of proposals. But I thank my my noble friend Baroness Harding to bring before us and of course, my noble friend, Lord Holmes and Baroness Kidron for supporting.
They also mirror actually a lot of what I saw from the other side when I was the Health Minister, and we had the problem with cannabis and the testing, and that's where I came as well, in terms of actually, you do need some real teeth as well, because, you know, even though you've got public bodies like the NHS who you would think would be listening to the minister in terms of certain requirements, you know, that doesn't even always follow the case.
And I think the point that my noble friend Baroness Harding made about, you know, everyone telling you to keep quiet, that applies to state organisations just as much as as private companies. So I think that, you know, having teeth is an important part in all of this and making it happen. And I think the stage approach, as mentioned, you know, in your first 72 hours, it's all about you just want to get the information out there.
And part of my questions I'll come on to in a minute is, what are we doing from our side? Then with that information, make sure it is being valuably used and used to alert others. And then it's only later on that you get into the kind of lessons learned stage round about the 30 day mark. So I think the stage reporting is, is a very, very sensible and well thought out approach. But that does bring me on to the point which I'd be grateful if the minister is able to address, is that if we are if we are requiring businesses to provide such information to the government very quickly, what do they get back? You know, the strong justification for rapid instant reporting is surely that the NCS can aggregate the intelligence, identify common attack vectors and vulnerabilities, and rapidly warn other organisations before they too maybe are attacked.
Obviously, that's the difference here between just regulatory reporting and genuine cyber national defence. So I'd be grateful if the minister can explain what happens or what the plan is in terms of what's going to happen operationally when one of these early notifications are received, how quickly is the information assessed? How quickly can actionable intelligence be disseminated to other potentially vulnerable organisations, and what obligations are there on the government and the regulators to ensure that the information provided by one organisation improves the resilience of everyone else? And there is a wider point, of course, throughout our consideration, the Bill we need to guard against measuring success by the number of organisations regulated more, or the number of reports submitted.
Rather, the real test is whether fewer attacks succeed, whether we identify attacks faster, whether organisations can recover more quickly, and whether intelligence from one attack prevents the next one. That's the outcome that, of course, we want this regime to achieve. So I hope that the minister will look seriously at the principles behind the set of amendments and, in particular, whether we can achieve a reporting structure which gives government the information it genuinely needs quickly, while allowing organisations to concentrate their scarce cyber expertise on the thing that matters the most defeating the attack.
They also mirror actually a lot of what I saw from the other side when I was the Health Minister, and we had the problem with cannabis and the testing, and that's where I came as well, in terms of actually, you do need some real teeth as well, because, you know, even though you've got public bodies like the NHS who you would think would be listening to the minister in terms of certain requirements, you know, that doesn't even always follow the case.
And I think the point that my noble friend Baroness Harding made about, you know, everyone telling you to keep quiet, that applies to state organisations just as much as as private companies. So I think that, you know, having teeth is an important part in all of this and making it happen. And I think the stage approach, as mentioned, you know, in your first 72 hours, it's all about you just want to get the information out there.
And part of my questions I'll come on to in a minute is, what are we doing from our side? Then with that information, make sure it is being valuably used and used to alert others. And then it's only later on that you get into the kind of lessons learned stage round about the 30 day mark. So I think the stage reporting is, is a very, very sensible and well thought out approach. But that does bring me on to the point which I'd be grateful if the minister is able to address, is that if we are if we are requiring businesses to provide such information to the government very quickly, what do they get back? You know, the strong justification for rapid instant reporting is surely that the NCS can aggregate the intelligence, identify common attack vectors and vulnerabilities, and rapidly warn other organisations before they too maybe are attacked.
Obviously, that's the difference here between just regulatory reporting and genuine cyber national defence. So I'd be grateful if the minister can explain what happens or what the plan is in terms of what's going to happen operationally when one of these early notifications are received, how quickly is the information assessed? How quickly can actionable intelligence be disseminated to other potentially vulnerable organisations, and what obligations are there on the government and the regulators to ensure that the information provided by one organisation improves the resilience of everyone else? And there is a wider point, of course, throughout our consideration, the Bill we need to guard against measuring success by the number of organisations regulated more, or the number of reports submitted.
Rather, the real test is whether fewer attacks succeed, whether we identify attacks faster, whether organisations can recover more quickly, and whether intelligence from one attack prevents the next one. That's the outcome that, of course, we want this regime to achieve. So I hope that the minister will look seriously at the principles behind the set of amendments and, in particular, whether we can achieve a reporting structure which gives government the information it genuinely needs quickly, while allowing organisations to concentrate their scarce cyber expertise on the thing that matters the most defeating the attack.
13:14
Speaker 9
-
Speaker 9
I thank Noble Lords for their amendments in this group. We spoke previously about the importance of effectiveness, The importance of effectiveness, of proportionality and of clarity. And I absolutely hear the experience from the noble Baroness, Baroness Harding, from her experience leading telecommunications company and the experience they had. And we have learnt from experiences across all sectors in introducing the new regime that is indeed put here on the face of the Bill, which does put in, as others have said, a staged approach.
It is a staged approach of, first, an early alert to regulators and the NCS within 24 hours that will provide awareness and enable the NCS and regulator to provide early support, as well as potentially understand if an impact is impacting multiple regulated entities. It will, under the bill, it. We allow for appropriate information and anonymized information that might provide threat intelligence or alerts to others to be shared in that way.
That is the intention. I can't obviously lay out in detail how NCS and the regulators would respond to particular examples, but to to respond to the question just from Lord Markham just then, the Fuller report within 72 hours will provide more detail that recognised that investigations may still be ongoing. As the noble Baroness, Baroness Harding, brought to life and organisations would provide the information that is known to them at their time. This, however, would also provide much more actionable information to the regulator and NCS and enable much more practical response support to to those entities that had been had been affected.
And just to complete this, because we're going to come on shortly to the question of customers. But after this key digital supply chain sectors must also notify customers who are likely to be adversely affected. I am mentioning this because to set out the requirements in 1 in 1 go. I recognise from the interventions and the motivation to provide clarity and consistency with two, and also that regulators should have a comprehensive, comprehensive understanding of these incidents.
We believe that the the stages we set out meet, that they have been carefully developed to provide the right notification in the in the in the at the appropriate time, they have been developed in consultation with industry, as many noble Lords exhorted in the previous group and. But crucially, under the information gathering powers in clause 15, regulators can also request further information about an incident that has been reported to them if they consider this necessary to understanding the incident and how it is being managed, that may be appropriate in some incidents, obviously, and it may be not appropriate in others.
It is that kind of balance, practical balance that is enabled by the Bill, and I think that is a more proportionate approach than requiring reporting to all entities within the scope of the regulations. The incident reporting is something that we quantified in our impact assessment, and by my calculation, the proposed amendments could lead up to five, lead to up to five stages of reporting an initial notification, a full notification, a potential interim report, and then either a final report or a progress report followed by a final report.
So I think that the the. The model set out in the bill strikes that right balance clarity to potential affected regulated organisations. The requirement enforceable requirement that Baroness Harding spoke to to change the culture within organisations, to provide that information to regulators and and sufficient actionable information to regulators to enable them to assess that and act on it. I'm not entirely sure if if the noble Lord Ashcombe amendment was moved, but in the as a precautionary measure, I would also resist the suggestion that extending the time frame for submitting the full incident notification, which would.
His. His amendment would require the full notification to be submitted within 30 days of a regulated entity becoming aware of an incident, rather than the current deadline of 72 hours. This change would mean that regulated entities will provide no information to their regulators. Following the initial notification between 24 hours, which could create a worrying gap between both the regulator and ncc's awareness of the incident. Maintaining the rhythm set out in the bill would mitigate that risk.
I.
It is a staged approach of, first, an early alert to regulators and the NCS within 24 hours that will provide awareness and enable the NCS and regulator to provide early support, as well as potentially understand if an impact is impacting multiple regulated entities. It will, under the bill, it. We allow for appropriate information and anonymized information that might provide threat intelligence or alerts to others to be shared in that way.
That is the intention. I can't obviously lay out in detail how NCS and the regulators would respond to particular examples, but to to respond to the question just from Lord Markham just then, the Fuller report within 72 hours will provide more detail that recognised that investigations may still be ongoing. As the noble Baroness, Baroness Harding, brought to life and organisations would provide the information that is known to them at their time. This, however, would also provide much more actionable information to the regulator and NCS and enable much more practical response support to to those entities that had been had been affected.
And just to complete this, because we're going to come on shortly to the question of customers. But after this key digital supply chain sectors must also notify customers who are likely to be adversely affected. I am mentioning this because to set out the requirements in 1 in 1 go. I recognise from the interventions and the motivation to provide clarity and consistency with two, and also that regulators should have a comprehensive, comprehensive understanding of these incidents.
We believe that the the stages we set out meet, that they have been carefully developed to provide the right notification in the in the in the at the appropriate time, they have been developed in consultation with industry, as many noble Lords exhorted in the previous group and. But crucially, under the information gathering powers in clause 15, regulators can also request further information about an incident that has been reported to them if they consider this necessary to understanding the incident and how it is being managed, that may be appropriate in some incidents, obviously, and it may be not appropriate in others.
It is that kind of balance, practical balance that is enabled by the Bill, and I think that is a more proportionate approach than requiring reporting to all entities within the scope of the regulations. The incident reporting is something that we quantified in our impact assessment, and by my calculation, the proposed amendments could lead up to five, lead to up to five stages of reporting an initial notification, a full notification, a potential interim report, and then either a final report or a progress report followed by a final report.
So I think that the the. The model set out in the bill strikes that right balance clarity to potential affected regulated organisations. The requirement enforceable requirement that Baroness Harding spoke to to change the culture within organisations, to provide that information to regulators and and sufficient actionable information to regulators to enable them to assess that and act on it. I'm not entirely sure if if the noble Lord Ashcombe amendment was moved, but in the as a precautionary measure, I would also resist the suggestion that extending the time frame for submitting the full incident notification, which would.
His. His amendment would require the full notification to be submitted within 30 days of a regulated entity becoming aware of an incident, rather than the current deadline of 72 hours. This change would mean that regulated entities will provide no information to their regulators. Following the initial notification between 24 hours, which could create a worrying gap between both the regulator and ncc's awareness of the incident. Maintaining the rhythm set out in the bill would mitigate that risk.
I.
13:19
Speaker 3
-
Speaker 3
My Lords, before the Minister sits down and before the noble Baroness stands up, I heard what the minister had to say about consulting across sectors, and I was reminded that second reading I mentioned the fact that the law firm which I'm associated with, DLA Piper back in 2017, was subjected to a not Petya ransomware attack. My Lords, and I think it would be really helpful because what the minister said is completely at odds, really with, well, not only with what the noble Baroness Harding said, but also the experience that we had in terms of the way that you need to understand how these events unfold.
And it would be really helpful to know from the minister or for her to publish, you know, the sectors where they've had those discussions and the parts of industry who have agreed that this is an appropriate form of incident reporting. My Lords, because , you know, what we're trying to do throughout this bill is really grounded in what is practical. And at the moment, this particular clause, you know, despite the fact that we're, you know, letting through some government amendments, despite the fact that we're doing that, it does seem that we're heading in the wrong direction, and it's going to be disproportionate in the way that it impacts on business, and it's not even going to be fit for purpose, despite the disproportionality.
It's just not going to work.
And it would be really helpful to know from the minister or for her to publish, you know, the sectors where they've had those discussions and the parts of industry who have agreed that this is an appropriate form of incident reporting. My Lords, because , you know, what we're trying to do throughout this bill is really grounded in what is practical. And at the moment, this particular clause, you know, despite the fact that we're, you know, letting through some government amendments, despite the fact that we're doing that, it does seem that we're heading in the wrong direction, and it's going to be disproportionate in the way that it impacts on business, and it's not even going to be fit for purpose, despite the disproportionality.
It's just not going to work.
13:21
Speaker 9
-
Speaker 9
I mean, I think we all agree we want a proportionate and clear regime. The noble Lord is supporting further incident reporting here. Further stages, additional stages of of incident reporting. In our impact assessment, we set out the implications of that very clearly in terms of sort of cost to business and so on. And we will come on shortly to discuss potentially broadening the scope of the incidents under that would be reported.
We have not been able to quantify that potential impact , because as a sort of counterfactual, because we are only just discussing that.
We have not been able to quantify that potential impact , because as a sort of counterfactual, because we are only just discussing that.
13:21
Speaker 2
-
Speaker 2
My Lords, I've listened really carefully to the noble lady, the minister, and thank her for her response. But I feel we've just had a completely black and white no, which is extremely disappointing. And I think we've had something almost worse than a black and white note, because I actually think if I've heard her correctly and I will need to go back and read it again, I think she's added uncertainty because I think in in suggesting it's okay because regulators have the ability to ask for extra reporting.
That's the company's worst nightmare. What you want is really clear black and white guardrails, which is what we've been trying to introduce in these amendments. So I had been hoping we could have follow up discussions between now and report, but I feel like the door has been slammed rather in my face. I would be very keen, as the noble Lord Clement Jones has just said, to understand what consultation has really happened and to recognise that you need to consult organisations that have actually experienced a substantial cyber attack.
If you haven't, I'm afraid you want to keep quiet and you don't want to report anything. So it's easy to go and ask broad groups of of organisations. Would you like more reporting? We all know what the answer to that would be. That's an easy consultation. So I would really value more detailed discussions with her and her officials between now and report, because I do feel we will be coming back to this at report, particularly given the support that my members have received from across the committee, for which I'm extremely grateful.
I beg leave to move to to to withdraw. Sorry. Getting myself in a pickle at the end.
That's the company's worst nightmare. What you want is really clear black and white guardrails, which is what we've been trying to introduce in these amendments. So I had been hoping we could have follow up discussions between now and report, but I feel like the door has been slammed rather in my face. I would be very keen, as the noble Lord Clement Jones has just said, to understand what consultation has really happened and to recognise that you need to consult organisations that have actually experienced a substantial cyber attack.
If you haven't, I'm afraid you want to keep quiet and you don't want to report anything. So it's easy to go and ask broad groups of of organisations. Would you like more reporting? We all know what the answer to that would be. That's an easy consultation. So I would really value more detailed discussions with her and her officials between now and report, because I do feel we will be coming back to this at report, particularly given the support that my members have received from across the committee, for which I'm extremely grateful.
I beg leave to move to to to withdraw. Sorry. Getting myself in a pickle at the end.
13:23
13:23
13:23
13:23
13:23
13:24
13:24
13:24
13:24
Speaker 10
-
Speaker 10
Baroness Neville-jones amendment 28 not moved. Amendment 29, 30 and 31. Harding amendment 32 not moved. Amendment 333435. Baroness moved. Amendment 36 formally. The question is that amendment 36 be agreed to. As many as of that opinion will say content. Content. The contrary not content. The contents have it. Amendment 37, 38 and 39. Not moved.
Not moved. Amendment 40. Not moved 414243. Not moved. Amendment 44. Baroness Lloyd, the question is that amendment 44 be agreed to. As many as of that opinion will say content . The contrary not content. The contents have it. Amendments 45, 46 and 47. Baroness moved amendment 48 not moved. Amendment 49 not moved.
Not moved. Amendment 40. Not moved 414243. Not moved. Amendment 44. Baroness Lloyd, the question is that amendment 44 be agreed to. As many as of that opinion will say content . The contrary not content. The contents have it. Amendments 45, 46 and 47. Baroness moved amendment 48 not moved. Amendment 49 not moved.
13:25
13:25
13:25
13:25
Speaker 2
-
Speaker 2
I apologise. I stand to move a whole nother group of amendments that suffer from the same challenge of needing to be repeated four times, which is why I suggested to the clerks that we grouped them, otherwise we'd have got ourselves into a real muddle. This group seeks to address the obligation to report incidents to customers. As the noble lady the minister referenced in her remarks earlier. Currently, the bill requires notification only where a customer is, quote, likely to be adversely affected, and the obligation is to explain the nature of the incident and why the customer is affected.
My amendments seek to broaden and deepen that duty. Customers must be notified where an incident has caused or has the potential to cause severe operational damage or financial loss, where I hope my drafting has not fallen prey to the issue that my noble friend Baroness Jones addressed in amendment 17, and if it has, we obviously need to address that the duty is extended to cover related natural or legal persons who could suffer considerable damage as a result, and the regulated entities must also advise customers on what measures to take in response.
And I think, probably most importantly in this group of amendments, keep them updated until the incident is resolved. Whereas at the moment the bill only requires them to notify them once and then leave them hanging, waiting to find out what's going on. Together, these ensure customers are told promptly what to do and are kept informed throughout the incident until it's resolved. These also follow the Nice two directive in requiring advice on protective measures and go a little further than is to by extending making it a requirement rather than a requirement, to communicate to related persons as well.
Sadly, I have personal experience in this as well, but not from my TalkTalk times actually much more recently. And I suspect anybody who is on the board who has chaired a business has experienced this. So an organisation I chair was recently is the customer of a managed service provider who experienced an incident. They didn't tell us it was to do with some of our staff's payroll information. It's really quite sensitive and important.
They didn't tell us when they did tell us. They then didn't keep us informed about what was going on. So I feel that pain now. I do know that some of of noble lords may have concerns that we don't want to create panic. And I absolutely agree. We don't want to create panic by endless notification notifications. Hence my attempt to define this as severe operational damage. And I'd very much welcome input between now and report.
If we can tighten that wording to make sure that this isn't lots of unnecessary email alerts telling you that a system that's three stages back in the tech stack might have been affected. But when your customer's data has been exposed in a cyber attack by a managed service provider or a data centre or digital service that you use, I think it's entirely reasonable that those companies have a requirement to inform you and to keep you updated during the incident, and that is all these amendments seek to do.
I beg to move.
My amendments seek to broaden and deepen that duty. Customers must be notified where an incident has caused or has the potential to cause severe operational damage or financial loss, where I hope my drafting has not fallen prey to the issue that my noble friend Baroness Jones addressed in amendment 17, and if it has, we obviously need to address that the duty is extended to cover related natural or legal persons who could suffer considerable damage as a result, and the regulated entities must also advise customers on what measures to take in response.
And I think, probably most importantly in this group of amendments, keep them updated until the incident is resolved. Whereas at the moment the bill only requires them to notify them once and then leave them hanging, waiting to find out what's going on. Together, these ensure customers are told promptly what to do and are kept informed throughout the incident until it's resolved. These also follow the Nice two directive in requiring advice on protective measures and go a little further than is to by extending making it a requirement rather than a requirement, to communicate to related persons as well.
Sadly, I have personal experience in this as well, but not from my TalkTalk times actually much more recently. And I suspect anybody who is on the board who has chaired a business has experienced this. So an organisation I chair was recently is the customer of a managed service provider who experienced an incident. They didn't tell us it was to do with some of our staff's payroll information. It's really quite sensitive and important.
They didn't tell us when they did tell us. They then didn't keep us informed about what was going on. So I feel that pain now. I do know that some of of noble lords may have concerns that we don't want to create panic. And I absolutely agree. We don't want to create panic by endless notification notifications. Hence my attempt to define this as severe operational damage. And I'd very much welcome input between now and report.
If we can tighten that wording to make sure that this isn't lots of unnecessary email alerts telling you that a system that's three stages back in the tech stack might have been affected. But when your customer's data has been exposed in a cyber attack by a managed service provider or a data centre or digital service that you use, I think it's entirely reasonable that those companies have a requirement to inform you and to keep you updated during the incident, and that is all these amendments seek to do.
I beg to move.
13:29
13:29
Speaker 5
-
Speaker 5
No, my Lords, for reasons that I don't understand, I don't have my name on these amendments. Give , give, give all the all the others from the noble lady that I did. And I just really rise to support this. And it's funny because when I came back from holiday in August, I had no less than five emails from companies saying that there had been data breaches in which I was involved.
And I had that exact thought about, well, what now? What do I do? What's next? How serious and did nothing.
And I had that exact thought about, well, what now? What do I do? What's next? How serious and did nothing.
13:30
Speaker 6
-
Speaker 6
My Lord, I rise to support all of these amendments. It's brings the customer perspective well into focus, which the bill is currently chronically insufficient on, in my view. And as Baroness Harding identified herself, if these amendments don't quite get to the precision of it, how will the government bring something forward which will do the trick perfectly, because this is a critically significant element which is currently not within the bill, an allied point which has already been nodded to as well.
Can I ask the minister in the bill's drafting here seems to like likely to, in earlier editions, capable of. Why would there not be coherence through the Bill as to the type of legal construction which is being used throughout. Surely that would not only be beneficial, more precise, but it would give greater clarity to all those who have to engage with the issues therein.
Can I ask the minister in the bill's drafting here seems to like likely to, in earlier editions, capable of. Why would there not be coherence through the Bill as to the type of legal construction which is being used throughout. Surely that would not only be beneficial, more precise, but it would give greater clarity to all those who have to engage with the issues therein.
13:31
Speaker 3
-
Speaker 3
My Lords, I also want to speak in support of these customer notification amendments tabled by the noble Baroness, Lady Harding of Winscombe. As I've said, the noble Baroness does bring vital lived experience and in more ways than I thought from the front line of corporate crisis response. When a major cyber breach occurs, vague statutory requirements to notify customers as soon as reasonably practicable leads to corporate delay. Amendment 58 replaces this with a strict statutory 24 hour notification clock, while amendment 65 establishes explicit harm, triggers and requires providers to provide actionable remediation advice to affected customers.
And, my Lords, look at what amendment 60 and 65 in particular would achieve across clause 16. Under amendment 65, notification is explicitly triggered whenever an incident causes or threatens severe operational disruption, substantial financial loss or material harm to downstream users and my Lords. Furthermore, amendment 71 places place a positive duty on the provider to advise customers on immediate remediation steps they can take in the cyber realm, time is the attacker's greatest ally.
If a hospital, bank or small supplier is informed within 24 hours that their cloud or managed service provider has been breached and given technical instructions on how to isolate their system, they their systems, they can prevent contagion before it paralyzes their operations. And my Lords, we must ensure customer notification is prompt and meaningful, empowering downstream businesses to isolate compromised systems before contagion spreads. So we very strongly support these amendments, my Lords.
And, my Lords, look at what amendment 60 and 65 in particular would achieve across clause 16. Under amendment 65, notification is explicitly triggered whenever an incident causes or threatens severe operational disruption, substantial financial loss or material harm to downstream users and my Lords. Furthermore, amendment 71 places place a positive duty on the provider to advise customers on immediate remediation steps they can take in the cyber realm, time is the attacker's greatest ally.
If a hospital, bank or small supplier is informed within 24 hours that their cloud or managed service provider has been breached and given technical instructions on how to isolate their system, they their systems, they can prevent contagion before it paralyzes their operations. And my Lords, we must ensure customer notification is prompt and meaningful, empowering downstream businesses to isolate compromised systems before contagion spreads. So we very strongly support these amendments, my Lords.
13:33
Speaker 11
-
Speaker 11
My Lords, I to thank my noble friend Lady Harding of Winscombe for tabling this important set of amendments, which we welcome also for clarifying the the refinements of the grouping process, which had slightly eluded me up to that point. So as with the previous group, it amends for key areas, but of customer reporting on this occasion , it tightens the timing to notify customers, widens the incidence. Expect it to be reported by removing the adverse impact criterion.
It adds extra reporting triggers and it adds an advice on remedies duty. My Lords, of course, businesses should be supported in the case of cyber attacks and our priority must be preventing, containing and controlling such incidents. But this cannot come at the expense of the customers that businesses serve and depend on. Customers deserve to know when a firm they depend on is targeted, even if such an attack does not necessarily directly adversely affect them.
They deserve to be informed promptly, and they deserve to be informed of potential remedies. I think also, it's worth saying there's there is a very welcome side effect to doing so, which is to say, based on the premise that behaviours are the best guard against cyber attack and constantly being aware that cyber attacks are going on is going to improve behaviours as as was said earlier, and I forget which noble Lord said so, you know, the goal is not to create panic, but on a kind of continuum between insouciance and panic, there must be a closer point to concern that we need to imbue more widely, I think, in the population to keep people aware that we are constantly at risk of being hacked.
So I think , and on these benches, we feel these are wise, pragmatic, helpful changes. And I certainly hope the noble Baroness, the Minister agrees.
It adds extra reporting triggers and it adds an advice on remedies duty. My Lords, of course, businesses should be supported in the case of cyber attacks and our priority must be preventing, containing and controlling such incidents. But this cannot come at the expense of the customers that businesses serve and depend on. Customers deserve to know when a firm they depend on is targeted, even if such an attack does not necessarily directly adversely affect them.
They deserve to be informed promptly, and they deserve to be informed of potential remedies. I think also, it's worth saying there's there is a very welcome side effect to doing so, which is to say, based on the premise that behaviours are the best guard against cyber attack and constantly being aware that cyber attacks are going on is going to improve behaviours as as was said earlier, and I forget which noble Lord said so, you know, the goal is not to create panic, but on a kind of continuum between insouciance and panic, there must be a closer point to concern that we need to imbue more widely, I think, in the population to keep people aware that we are constantly at risk of being hacked.
So I think , and on these benches, we feel these are wise, pragmatic, helpful changes. And I certainly hope the noble Baroness, the Minister agrees.
13:35
13:35
Speaker 9
-
Speaker 9
I would like to thank the noble Baroness for raising the important points around customer communication as as set out in the Bill, the Bill does take forward the current duties in terms of by customers that the Bill places on data centres, OS, DSPs and MSPs that duty was designed to ensure that providers of key digital and data infrastructure services consider whether their customers are likely to have been adversely affected by a reported incident and whether, through disruption of service, compromise of their data or exposure of their systems to cyber threats and to notify them .
And just to sort of explain the logic to the point that the noble Lord, Lord Clement-jones, made about the importance of meaningful communication with customers, the reason that we have defined drafted the bill so that customer notification follows the 72 hour incident report is to ensure that regulated entities can focus on understanding the nature of the incident , and contact customers when they are more likely to understand the potential impacts it has had. The question of what a organisation might reasonably be expected to know within 24 hours.
Hours of identifying an incident is is one that we have just previously discussed, but the point is that customers should be communicated with in a timely manner, with sufficient information that they can take action, necessary action. So on that point, the rationale for 72 hours was also to time it for simplicity with the 72 hour report. But I'm very happy to talk to the consult further with the noble Baroness to explain the logic of the 72 and the 42 hour sort of requirement to communicate with customers, because the motivation is exactly the same, which is to have actionable, meaningful communication with customers.
On the question of the sort of degree of depth of communication and the advice that can reasonably put be put on regulated entities on technical measures, what technical mitigations customers should take on their own. So I think it is very reasonable that the regulated entity should share what they know about the nature of the incident. I think the question about whether the regulated entity is in the right position to provide advice to customers on what mitigations they should take is, is a both a practical and sort of technical one, whether they would have enough insight to be able to give those kind of effective understanding of the situation of the customers and the detailed understanding of what the customers are, what their business is, is in order for them to be able to give effective organisation, sorry, effective, a meaningful advice in that way, or whether that would just be a requirement on the entities themselves, which wouldn't have the intended impact.
So on, on that point, I'm not quite persuaded that the line is drawn in the right position on the point, on keeping in touch to to which noble Baroness Baroness Kidron and other Baroness Harding put. That is something I'm happy to come back at. At. I'm happy to come back to at report to to make sure we have got the right balance between the initial notification and the right type of customer communication.
And just to sort of explain the logic to the point that the noble Lord, Lord Clement-jones, made about the importance of meaningful communication with customers, the reason that we have defined drafted the bill so that customer notification follows the 72 hour incident report is to ensure that regulated entities can focus on understanding the nature of the incident , and contact customers when they are more likely to understand the potential impacts it has had. The question of what a organisation might reasonably be expected to know within 24 hours.
Hours of identifying an incident is is one that we have just previously discussed, but the point is that customers should be communicated with in a timely manner, with sufficient information that they can take action, necessary action. So on that point, the rationale for 72 hours was also to time it for simplicity with the 72 hour report. But I'm very happy to talk to the consult further with the noble Baroness to explain the logic of the 72 and the 42 hour sort of requirement to communicate with customers, because the motivation is exactly the same, which is to have actionable, meaningful communication with customers.
On the question of the sort of degree of depth of communication and the advice that can reasonably put be put on regulated entities on technical measures, what technical mitigations customers should take on their own. So I think it is very reasonable that the regulated entity should share what they know about the nature of the incident. I think the question about whether the regulated entity is in the right position to provide advice to customers on what mitigations they should take is, is a both a practical and sort of technical one, whether they would have enough insight to be able to give those kind of effective understanding of the situation of the customers and the detailed understanding of what the customers are, what their business is, is in order for them to be able to give effective organisation, sorry, effective, a meaningful advice in that way, or whether that would just be a requirement on the entities themselves, which wouldn't have the intended impact.
So on, on that point, I'm not quite persuaded that the line is drawn in the right position on the point, on keeping in touch to to which noble Baroness Baroness Kidron and other Baroness Harding put. That is something I'm happy to come back at. At. I'm happy to come back to at report to to make sure we have got the right balance between the initial notification and the right type of customer communication.
13:39
Speaker 2
-
Speaker 2
I'd like to thank all the noble Lords who again, have supported my long list of amendments and your excellent contributions, and it feels as if we made a very small breakthrough, for which I'm extremely grateful. So I'd like to thank the noble lady, the Minister, and I won't delay anyone any longer as we have another group of amendments to come, but I look forward to some detailed discussions between now and report to see if we can bring this back in a form that we're all able to support.
I beg leave to withdraw the amendments.
I beg leave to withdraw the amendments.
13:40
13:40
13:40
13:40
13:40
13:40
13:40
Speaker 2
-
Speaker 2
We have only one amendment. But that is because this inserts a new clause as opposed to lots of small changes into existing clauses. So number 17, amendment number 72 is in my name. And once again, I thank the noble lady, Baroness Kidron, for adding her name to it. This clause seeks to ensure that organisations regulated under the Bill must report any near misses, cyber threats or incidents that are currently under the thresholds as set out in the Bill that could affect their network and information systems.
And I am again very mindful that it is important that this is consistent with the extremely well made points of my noble friend, Baroness Jones in Amendment 17. So again, very welcome to have discussions around if we've got the wording right, because the purpose is to get the near miss rather than a huge deluge of meaningless reporting. This as currently it stands, the bill only requires regulated entities to report what has actually happened, and only if it crosses a threshold based on factors such as scale, duration and the number of people affected.
Whereas my amendments look to close the gaps where, for example, an attack that an organisation has stopped before it has caused major damage, but if they had not been successful, would have had very substantial damage effect across the whole industry. Examples where you have very credible warnings of an expected attack that doesn't occur, or any incident that falls just below the thresholds, that could be still very significant. So the intention of this amendment and this probably unlike my other two groups, is quite a probing amendment to see if we could work together to capture the spirit of this is to close the reporting gap, where significant incidents may not be reported, simply because of the way we've drawn up the definitions in the bill, just like the other two groups that I have have led.
This follows the EU two directive, though the two directive creates a voluntary reporting provision for this as opposed to a mandatory one. My personal view is that the taboo for for going public on cyber attacks is so great that voluntary reporting is not the way to do this. It is actually better for all organisations to know the black and the white of what they can do and what they should do, and what they they don't have to do in some sectors.
Certainly the one I worked in, in telecoms there is a fair amount of voluntary sharing, but even there, there is such a taboo to actually go and speak to your regulator about a problem that I think you need to make this mandatory rather than voluntary. Other than that, this seeks to replicate what is in the EU two directives. And with that, I think you've probably heard enough of me this afternoon. I beg. To
And I am again very mindful that it is important that this is consistent with the extremely well made points of my noble friend, Baroness Jones in Amendment 17. So again, very welcome to have discussions around if we've got the wording right, because the purpose is to get the near miss rather than a huge deluge of meaningless reporting. This as currently it stands, the bill only requires regulated entities to report what has actually happened, and only if it crosses a threshold based on factors such as scale, duration and the number of people affected.
Whereas my amendments look to close the gaps where, for example, an attack that an organisation has stopped before it has caused major damage, but if they had not been successful, would have had very substantial damage effect across the whole industry. Examples where you have very credible warnings of an expected attack that doesn't occur, or any incident that falls just below the thresholds, that could be still very significant. So the intention of this amendment and this probably unlike my other two groups, is quite a probing amendment to see if we could work together to capture the spirit of this is to close the reporting gap, where significant incidents may not be reported, simply because of the way we've drawn up the definitions in the bill, just like the other two groups that I have have led.
This follows the EU two directive, though the two directive creates a voluntary reporting provision for this as opposed to a mandatory one. My personal view is that the taboo for for going public on cyber attacks is so great that voluntary reporting is not the way to do this. It is actually better for all organisations to know the black and the white of what they can do and what they should do, and what they they don't have to do in some sectors.
Certainly the one I worked in, in telecoms there is a fair amount of voluntary sharing, but even there, there is such a taboo to actually go and speak to your regulator about a problem that I think you need to make this mandatory rather than voluntary. Other than that, this seeks to replicate what is in the EU two directives. And with that, I think you've probably heard enough of me this afternoon. I beg. To
13:43
13:43
13:43
Speaker 5
-
Speaker 5
My Lords, I support amendment 72 and indeed managed to sign my name to it , I do. I do recognise the probing nature of this, but I also recognize the problem that it seeks to address and the knowledge that a cyber threat or cyber attack has failed. Maybe incredibly important intelligence, because on the whole, someone trying to create a cyber threat is not going to retire at the first time.
The it didn't work out. They're actually going to try somewhere else. And so I think it's the intelligence element of this that seems to me so crucial. And, you know, often, you know, some of the people in cybersecurity talk about seven stages of cyber attack. The first stage, which is the reconnaissance. And then, you know, you're just having a look around trying to identify vulnerabilities. The second stage is weaponization, developing the means to target that weakness, which can be as simple as an email.
And it's not until the third stage that the attack begins, but there's still 3 or 4 stages, each of which can provide a barrier, each of which can be the place at which the attack stops. And, and, and I think that, you know, and it's it's not uncommon for attackers to carry out multiple attempts to find or exploit a vulnerability or indeed to do a small scale attack in order to then do something larger down the line.
In all of these cases, there is something absolutely critical for for the regulator to know, possibly for the enforcement community to know. And, and I was, I did really just want to finish my. I did notice that the minister, in one of her answers, said on another, on another. Group said that reporting of significant near misses was a requirement. And I just absolutely love to understand where that sits and recognising what Lady Harding.
Harding has said about the language. I do think that this would be an important piece of intelligence to make mandatory in the Bill.
The it didn't work out. They're actually going to try somewhere else. And so I think it's the intelligence element of this that seems to me so crucial. And, you know, often, you know, some of the people in cybersecurity talk about seven stages of cyber attack. The first stage, which is the reconnaissance. And then, you know, you're just having a look around trying to identify vulnerabilities. The second stage is weaponization, developing the means to target that weakness, which can be as simple as an email.
And it's not until the third stage that the attack begins, but there's still 3 or 4 stages, each of which can provide a barrier, each of which can be the place at which the attack stops. And, and, and I think that, you know, and it's it's not uncommon for attackers to carry out multiple attempts to find or exploit a vulnerability or indeed to do a small scale attack in order to then do something larger down the line.
In all of these cases, there is something absolutely critical for for the regulator to know, possibly for the enforcement community to know. And, and I was, I did really just want to finish my. I did notice that the minister, in one of her answers, said on another, on another. Group said that reporting of significant near misses was a requirement. And I just absolutely love to understand where that sits and recognising what Lady Harding.
Harding has said about the language. I do think that this would be an important piece of intelligence to make mandatory in the Bill.
13:46
13:46
Speaker 14
-
Speaker 14
Support Baroness Harding. Amendment, as I do all of the amendments which have previously discussed. By definition, my Lords, a near miss means a severe threat narrowly avoided, which would have had substantial consequences if it had not been avoided. The interesting thing is that everyone tells me that the near-miss reporting in the aviation industry proved to be massively significant, fundamentally changed a the whole approach to air safety with very beneficial consequences.
So I think the case is very sound that it should be applied here.
So I think the case is very sound that it should be applied here.
13:47
Speaker 6
-
Speaker 6
My Lords, I, I support this amendment and particularly in terms of the probing nature and what work potentially can be done between committee and report in this respect. And it's really about this question of Mandation. There shouldn't be any question of a voluntary requirement for something which is not about the individual organisation, business or entity. This is about the community. This is about the greater good, this is about the country and going broader than that.
And the fact of a near miss says nothing in terms of the severity of intent and the intent which can thus be gleaned to benefit at that point, across that sector, across that community, across the country and beyond. So Mandation has to be the standard for this particular provision.
And the fact of a near miss says nothing in terms of the severity of intent and the intent which can thus be gleaned to benefit at that point, across that sector, across that community, across the country and beyond. So Mandation has to be the standard for this particular provision.
13:48
Speaker 3
-
Speaker 3
My Lords, I can't possibly compete with the noble Baroness Kidron's Shakespearian seven stages as opposed to ages, my Lords. But strangely enough, amendment 72 and we support the it in its entirety that deals with voluntary reporting is the is the bit of the amendment that we particularly like, my Lords, because our National security services and sectoral competent authorities. Authorities do desperately need early upstream visibility of emerging threat patterns before a full blown systemic crisis unfolds.
And in the cyber domain, the precursors to a catastrophic attack. The subtle network probes the exploratory reconnaissance, and near misses often appear weeks before a critical system is actually breached. And at present, the bill does create a bit of an all or nothing trap. If any entity experiences a sophisticated near miss that fails to cross the statutory threshold of an active, disruptive breach, they have a powerful legal incentive to keep quiet.
They fear that if they approach a regulator voluntarily, they'll expose themselves to regulatory scrutiny, compliance investigations and potential enforcement action. And , in our view, by including a dedicated statutory framework into the Dnis regulations specifically for the voluntary notification of near misses, subthreshold anomalies and early stage cyber threats. My Lords, we believe that is a significant , beneficial addition to the Bill. Effectively, it establishes a safe harbour for intelligence sharing.
So, my Lords, you know, we, as the recent analogue 72 Green Paper powerfully argued, we must move away from a culture of fear and silence in this area, and we must encourage continuous, proactive information flows between our critical infrastructure operators and the NCS. So, my Lords, we do strongly support this amendment.
And in the cyber domain, the precursors to a catastrophic attack. The subtle network probes the exploratory reconnaissance, and near misses often appear weeks before a critical system is actually breached. And at present, the bill does create a bit of an all or nothing trap. If any entity experiences a sophisticated near miss that fails to cross the statutory threshold of an active, disruptive breach, they have a powerful legal incentive to keep quiet.
They fear that if they approach a regulator voluntarily, they'll expose themselves to regulatory scrutiny, compliance investigations and potential enforcement action. And , in our view, by including a dedicated statutory framework into the Dnis regulations specifically for the voluntary notification of near misses, subthreshold anomalies and early stage cyber threats. My Lords, we believe that is a significant , beneficial addition to the Bill. Effectively, it establishes a safe harbour for intelligence sharing.
So, my Lords, you know, we, as the recent analogue 72 Green Paper powerfully argued, we must move away from a culture of fear and silence in this area, and we must encourage continuous, proactive information flows between our critical infrastructure operators and the NCS. So, my Lords, we do strongly support this amendment.
13:50
Speaker 4
-
Speaker 4
My Lords, I thank my noble friend Lady Harding of Winscombe for her amendment. Also in the name of the noble Baroness, Lady Kidron. My Lords, we believe that this is rather a straightforward amendment if we are to seriously tackle cyber attacks and create a generally resilient cyber system, then we shouldn't simply stop at the reporting of incidents that do happen. A key way of ensuring that we build not just a responsive, but a preventative cyber system, is by knowing what potential risks exist, by knowing who is attempting to commit cyber attacks, even if they have not done so yet.
My Lords, this is a reasoned amendment that only places a requirement on those already considered regulated persons with the opportunity for others not regulated, to voluntarily report. I hope that the noble Baroness Minister will agree.
My Lords, this is a reasoned amendment that only places a requirement on those already considered regulated persons with the opportunity for others not regulated, to voluntarily report. I hope that the noble Baroness Minister will agree.
13:51
Speaker 9
-
Speaker 9
I thank the noble Baroness for raising this question about the requirement for regulated entities to report cyber threats, near misses and threshold subthreshold incidents within the 72 hour deadline. Let me, first of all, come to the question of voluntary reporting, which we also touched on a little bit in the context of discussing the the industry groupings yesterday and the trust groups that exist, often facilitated by the NC. These are incredibly valuable groups.
We absolutely encourage voluntary reporting, whether through those groups or through other industry bodies. I think there is a question about whether putting such groups and such mechanisms on a statutory footing helps or hinders exactly what is being . What is the motivation, sorry, helps or hinders that objective, because the the the the confidence to share information, as the noble Baroness mentioned and others mentioned, is something that we need to engender.
And there is a question about whether that is if that is within the regulatory perimeter, as it were, that encourages that or it doesn't. That is something that I am happy to come back to at report on the question of reporting subthreshold incidents, incidents might have been that have been successfully contained or have proved ineffective , incidents which fall below the current reporting thresholds or any potential circumstance or event which could, if it have occurred, affected the regulatory entities, systems or the users of a service provided through these systems.
We discussed in the context of data centres and to answer the question on from Baroness Kidron, I was speaking in in respect of the discussion on data centres in respect of near misses, we had entered the point that Baroness Neville-jones highlighted, which is that near misses and those types of incidents would be captured for data centres, given the particular role they play in our digital infrastructure. The extension of similar, in fact perhaps broader requirements as we read it, much broader requirements than that to all regulated entities would increase regulatory reporting very significantly.
And I think to the point that Baroness Neville-jones made right at the beginning, although it could possibly have been someone else as well, the ability of our regulators to effectively utilize this threat intelligence and manage it so that it can be conveyed into actionable advice and trend data. So this is these are the considerations that we take also just another consideration, which is that those entities which perhaps have the more sophisticated surveillance and mitigations, may be able to identify attacks more effectively.
And we want to set up a situation where they are there was any kind of perverse incentives in the system from those who have very adept surveillance and assessments from reporting or from from developing that. So at this stage, I think even though I heard very clearly, the motivation is, as it were, just to catch those. Who are those? Those incidents that are just for our reading of the amendment is that it would be much wider, and it may indeed have some of these other effects.
So I'm at this stage that would not be something as drafted that I would support before the.
We absolutely encourage voluntary reporting, whether through those groups or through other industry bodies. I think there is a question about whether putting such groups and such mechanisms on a statutory footing helps or hinders exactly what is being . What is the motivation, sorry, helps or hinders that objective, because the the the the confidence to share information, as the noble Baroness mentioned and others mentioned, is something that we need to engender.
And there is a question about whether that is if that is within the regulatory perimeter, as it were, that encourages that or it doesn't. That is something that I am happy to come back to at report on the question of reporting subthreshold incidents, incidents might have been that have been successfully contained or have proved ineffective , incidents which fall below the current reporting thresholds or any potential circumstance or event which could, if it have occurred, affected the regulatory entities, systems or the users of a service provided through these systems.
We discussed in the context of data centres and to answer the question on from Baroness Kidron, I was speaking in in respect of the discussion on data centres in respect of near misses, we had entered the point that Baroness Neville-jones highlighted, which is that near misses and those types of incidents would be captured for data centres, given the particular role they play in our digital infrastructure. The extension of similar, in fact perhaps broader requirements as we read it, much broader requirements than that to all regulated entities would increase regulatory reporting very significantly.
And I think to the point that Baroness Neville-jones made right at the beginning, although it could possibly have been someone else as well, the ability of our regulators to effectively utilize this threat intelligence and manage it so that it can be conveyed into actionable advice and trend data. So this is these are the considerations that we take also just another consideration, which is that those entities which perhaps have the more sophisticated surveillance and mitigations, may be able to identify attacks more effectively.
And we want to set up a situation where they are there was any kind of perverse incentives in the system from those who have very adept surveillance and assessments from reporting or from from developing that. So at this stage, I think even though I heard very clearly, the motivation is, as it were, just to catch those. Who are those? Those incidents that are just for our reading of the amendment is that it would be much wider, and it may indeed have some of these other effects.
So I'm at this stage that would not be something as drafted that I would support before the.
13:55
Speaker 2
-
Speaker 2
Noble lady. The minister sits down. Might I just ask her? It seems to me, and it was my suggestion to to break up these different amendments into groupings, because otherwise we'd have had about 100 amendments in one group. But there is an awful lot of overlap in the discussion between this group, particularly, and amendment 17. In the name of my noble, noble friend next to me, would she commit to having a joint meeting where we could try and work this through together? Because I do think we share a common goal of wanting to give as much relevant, immediate, up to date intelligence into the network as possible without overwhelming recognizing that that time, as the noble Lord Clement Jones said, is absolutely everything in these cyber attacks.
So if we could discuss that together rather than separately, I think that would be extremely valuable.
So if we could discuss that together rather than separately, I think that would be extremely valuable.
13:56
13:56
Speaker 2
-
Speaker 2
Thank you very much. I've heard very clearly the willingness to to discuss and collaborate from from the minister, which is extremely welcome, as is the contribution from all noble Lords. I think if the last hour and a half has shown anything is actually I do think there is a genuine sort of cross committee desire to try and work to. This is what this House does at its best, which is trying to genuinely improve with a shared goal of a piece of legislation that actually the country will benefit from if we can get it right.
So I beg leave to withdraw the amendment. Is it your.
So I beg leave to withdraw the amendment. Is it your.
13:57
13:57
13:57
13:57
Speaker 8
-
Speaker 8
My Lords, I. I rise to move. Amendment 73 standing in the name of the noble Lord, Lord Alton of Liverpool, alongside the noble Lord, Lord Hunter King. See the noble Baroness Ludford and myself. Lord Alton is unfortunately unable to be here today, and I'm very pleased to move the amendment on his behalf. The. The principle behind the amendment is very simple, and one that I'm delighted to see has cross-party support and I'm assure trust that it will have cross committee support as well.
We all recognise that cyber threats do not respect national borders. Effective cyber security, therefore requires international cooperation and information sharing. That's something that I think we all believe in, and a lot of the measures that we've been talking about today is actually giving teeth to these organisations and these powers to make sure it really happens. However, this shows when sometimes things can go too far and the risk around that, and that must surely be limits.
And where information obtained under UK statutory powers can subsequently be sent and how it can be used. The Bill gives Niss enforcement authorities power to share information with overseas authorities. Amendment 73 would prevent such information being shared with the Secretary of State. Determines that the receiving jurisdiction cannot guarantee the right to a fair trial, or where disclosure could result in action incompatible with that right. This is not a theoretical concern.
We know that authoritarian states increasingly use apparent legitimate law enforcement processes as instruments of transnational oppression. China provides perhaps the clearest example. There are well-documented concerns about the independence of its judiciary, particularly in national security cases and the treatment of dissidents and human rights defenders. The information we are talking about here is not necessarily innocuous administrative data, and this information can include IP addresses, digital identifiers, and user level logins in the wrong hands.
That information could potentially be used to identify individuals, establish their activities or assist in building a case against them. For dissident, dissident or human rights defenders living in this country, that could have very serious consequences not just for them, but potentially for family members remaining overseas. I therefore find the government's response to this amendment when it was debated in another place particularly interesting. My right hon. Friend, Sir Ian Duncan Smith , moved substantially the same amendment.
The. The Minister said that he agreed with much of my right hon. Friend's diagnosis, indeed that he totally agreed with his objective. The government's objection was instead principally about the mechanism. The Minister was concerned that placing an explicit fair trial safeguard in this particular information sharing regime could create uncertainty about how other statutory information sharing regimes should be interpreted. That may be a legitimate drafting concern, but it does not answer the underlying policy question.
Indeed, the government promised in the Commons to continue engaging on precisely this issue, so I hope the Minister can tell us what progress has been made since then. If the government accepts the diagnosis and accepts the objective, what alternative safeguards does it propose? More fundamentally, I would be grateful if the minister could answer one very simple question what protection currently prevents information obtained by a UK regulator under these powers being passed to an overseas authority, where it could then contribute to the prosecution of an individual in a judicial system which a fair trial cannot be guaranteed.
Nor do I think this amendment should be seen as inhibiting legitimate international cyber security cooperation. Quite the opposite. We want information to be shared rapidly with trusted partners where that makes us safer. But international cooperation cannot mean that information gathered under UK statutory powers should be available to regimes that may substantially subsequently use it to facilitate political persecution. The UK has a proud tradition of defending the rule of law and the right to a fair trial.
Those principles should apply just as much in the digital world as they do elsewhere. I would therefore ask that the Minister will either accept the principle behind amendment 73 and, given the government's acknowledgement of the problem in the Commons, explain how they intend to address it. I beg to move.
We all recognise that cyber threats do not respect national borders. Effective cyber security, therefore requires international cooperation and information sharing. That's something that I think we all believe in, and a lot of the measures that we've been talking about today is actually giving teeth to these organisations and these powers to make sure it really happens. However, this shows when sometimes things can go too far and the risk around that, and that must surely be limits.
And where information obtained under UK statutory powers can subsequently be sent and how it can be used. The Bill gives Niss enforcement authorities power to share information with overseas authorities. Amendment 73 would prevent such information being shared with the Secretary of State. Determines that the receiving jurisdiction cannot guarantee the right to a fair trial, or where disclosure could result in action incompatible with that right. This is not a theoretical concern.
We know that authoritarian states increasingly use apparent legitimate law enforcement processes as instruments of transnational oppression. China provides perhaps the clearest example. There are well-documented concerns about the independence of its judiciary, particularly in national security cases and the treatment of dissidents and human rights defenders. The information we are talking about here is not necessarily innocuous administrative data, and this information can include IP addresses, digital identifiers, and user level logins in the wrong hands.
That information could potentially be used to identify individuals, establish their activities or assist in building a case against them. For dissident, dissident or human rights defenders living in this country, that could have very serious consequences not just for them, but potentially for family members remaining overseas. I therefore find the government's response to this amendment when it was debated in another place particularly interesting. My right hon. Friend, Sir Ian Duncan Smith , moved substantially the same amendment.
The. The Minister said that he agreed with much of my right hon. Friend's diagnosis, indeed that he totally agreed with his objective. The government's objection was instead principally about the mechanism. The Minister was concerned that placing an explicit fair trial safeguard in this particular information sharing regime could create uncertainty about how other statutory information sharing regimes should be interpreted. That may be a legitimate drafting concern, but it does not answer the underlying policy question.
Indeed, the government promised in the Commons to continue engaging on precisely this issue, so I hope the Minister can tell us what progress has been made since then. If the government accepts the diagnosis and accepts the objective, what alternative safeguards does it propose? More fundamentally, I would be grateful if the minister could answer one very simple question what protection currently prevents information obtained by a UK regulator under these powers being passed to an overseas authority, where it could then contribute to the prosecution of an individual in a judicial system which a fair trial cannot be guaranteed.
Nor do I think this amendment should be seen as inhibiting legitimate international cyber security cooperation. Quite the opposite. We want information to be shared rapidly with trusted partners where that makes us safer. But international cooperation cannot mean that information gathered under UK statutory powers should be available to regimes that may substantially subsequently use it to facilitate political persecution. The UK has a proud tradition of defending the rule of law and the right to a fair trial.
Those principles should apply just as much in the digital world as they do elsewhere. I would therefore ask that the Minister will either accept the principle behind amendment 73 and, given the government's acknowledgement of the problem in the Commons, explain how they intend to address it. I beg to move.
14:02
14:02
14:02
14:02
14:02
14:02
14:02
Speaker 1
-
Speaker 1
agree with everything that noble Lord, Lord Markham has, has has said. I mean, my remarks were principally have China in mind. Of course, it's not the only repressive regime, but I think in our minds, our examples of, of political prisoners in, in Hong Kong, Jimmy Lai, Joshua Wong, who who was in the news recently being outrageously imprisoned on national so-called national security grounds for democratic expression and, and protest. And there are, of course, many others.
There are concerns about electroshock weapons being. Demonstrated inside the Chinese embassy here. We recently had a considerable. I think it was an eight year sentence on the manager of the Hong Kong Economic and Trade Office in the UK and our National Security Act for attempts at repression in the UK. So there are problems of justice or other injustice in Hong Kong, China, but also the tentacles of repression are very much reaching to this country, and particularly to the Hong Kong diaspora.
And I mean, we've we've seen other examples like Interpol, red notices, which have been misused. And so there is a great concern that requests could be made by authoritarian states under this bill for digital information sharing, which have a, a, a, a nefarious purpose. And we we have had examples in, in Hong Kong of residential surveillance, holding individuals incommunicado for up to six months without access to a lawyer or family, which amount to enforced disappearance increases the risk of, of, of torture.
We've got the lack of judicial independence as noble Lord, Lord Markham mentioned, which explicitly prevent a fair trial, particularly in so-called national security cases. The the treatment of imprisoned activists is undermines any semblance of a fair trial. Concerns about evidence, admission of evidence obtained through torture being admitted in China, which includes Hong Kong courts, the the situation in in in prisons is is intolerable. I understand that Jimmy Lai the conditions he's being held in, are.
He's practically boiling with the heat of his of his cell. So anyway, all this gives you an illustration of everything that I think you're already aware of. So the. I understand that under the Extradition Act, cooperation between the UK and Hong Kong authorities is permitted on a case by case, ad hoc basis. And if that is incorrect, I'll. I would accept correction. But if under the under this bill, NIST data, including sensitive information such as IP addresses, digital fingerprints, user level logs from digital service providers could increase the risk of extradition to a country without a bilateral treaty with the UK.
It. It could trigger special extradition arrangements, bypassing traditional human rights safeguards. I think we're on a slightly uncertain basis of extradition to Hong Kong, into which this bill could add another element. So, you know, there's nothing to guarantee. There's no permanent safeguards against extradition to Hong Kong. And this data sharing could serve as an intelligence gathering tool, which facilitates this process by providing the evidence which then justifies justifies the filing of an extradition request.
So we could increase the likelihood of an ad hoc extradition request, which would make it more difficult for the British authorities. And and of course, we all know that the diaspora in the UK are, many of them living in, in, in fear of their lives, not just their their safety, but their lives with bounties on their on their head. So. And, and, and also we, we are aware of all the cyber attacks which, which we understand are being launched from Chinese direction.
And this, this data could help. Identification of the architecture of the UK's critical systems and choke points, and could also assist with the harassment of dissidents and human rights defenders living in the UK. So for all these reasons, I very much support this this amendment. If the government has. The noble Lord, Lord Markham said. If the government believes that there are institutional drafting problems, I think it is incumbent on it if it if it agrees with us, which I can't see how it doesn't or won't, that there is a danger in this zone of sharing data with a repressive regime.
I would very much ask the government to come up with something which fits the existing parameters, but allows the prevention of just opening the door to assisting repression, which is certainly against any values in this country.
There are concerns about electroshock weapons being. Demonstrated inside the Chinese embassy here. We recently had a considerable. I think it was an eight year sentence on the manager of the Hong Kong Economic and Trade Office in the UK and our National Security Act for attempts at repression in the UK. So there are problems of justice or other injustice in Hong Kong, China, but also the tentacles of repression are very much reaching to this country, and particularly to the Hong Kong diaspora.
And I mean, we've we've seen other examples like Interpol, red notices, which have been misused. And so there is a great concern that requests could be made by authoritarian states under this bill for digital information sharing, which have a, a, a, a nefarious purpose. And we we have had examples in, in Hong Kong of residential surveillance, holding individuals incommunicado for up to six months without access to a lawyer or family, which amount to enforced disappearance increases the risk of, of, of torture.
We've got the lack of judicial independence as noble Lord, Lord Markham mentioned, which explicitly prevent a fair trial, particularly in so-called national security cases. The the treatment of imprisoned activists is undermines any semblance of a fair trial. Concerns about evidence, admission of evidence obtained through torture being admitted in China, which includes Hong Kong courts, the the situation in in in prisons is is intolerable. I understand that Jimmy Lai the conditions he's being held in, are.
He's practically boiling with the heat of his of his cell. So anyway, all this gives you an illustration of everything that I think you're already aware of. So the. I understand that under the Extradition Act, cooperation between the UK and Hong Kong authorities is permitted on a case by case, ad hoc basis. And if that is incorrect, I'll. I would accept correction. But if under the under this bill, NIST data, including sensitive information such as IP addresses, digital fingerprints, user level logs from digital service providers could increase the risk of extradition to a country without a bilateral treaty with the UK.
It. It could trigger special extradition arrangements, bypassing traditional human rights safeguards. I think we're on a slightly uncertain basis of extradition to Hong Kong, into which this bill could add another element. So, you know, there's nothing to guarantee. There's no permanent safeguards against extradition to Hong Kong. And this data sharing could serve as an intelligence gathering tool, which facilitates this process by providing the evidence which then justifies justifies the filing of an extradition request.
So we could increase the likelihood of an ad hoc extradition request, which would make it more difficult for the British authorities. And and of course, we all know that the diaspora in the UK are, many of them living in, in, in fear of their lives, not just their their safety, but their lives with bounties on their on their head. So. And, and, and also we, we are aware of all the cyber attacks which, which we understand are being launched from Chinese direction.
And this, this data could help. Identification of the architecture of the UK's critical systems and choke points, and could also assist with the harassment of dissidents and human rights defenders living in the UK. So for all these reasons, I very much support this this amendment. If the government has. The noble Lord, Lord Markham said. If the government believes that there are institutional drafting problems, I think it is incumbent on it if it if it agrees with us, which I can't see how it doesn't or won't, that there is a danger in this zone of sharing data with a repressive regime.
I would very much ask the government to come up with something which fits the existing parameters, but allows the prevention of just opening the door to assisting repression, which is certainly against any values in this country.
14:09
14:09
14:09
14:09
14:09
14:09
Speaker 13
-
Speaker 13
Lord Alton, who is the architect of the amendment, and indeed of many amendments in relation to China and human rights, unfortunately can't be here. But, my Lords, I think both Lord Markham and Baroness Ludford, who explained very eloquently why this is important, and particularly the focus on China and my Lords . Over the years, the British governments of all colours have had a very ambiguous policy towards China, as we know. On the one hand, in terms of trade and the economy, it's crucially important.
On the other, we have to admit that Chinese repression, its appalling human rights record, means that the government needs to tread very carefully in its relationships with China. My own interest from this came from the problems, particularly in Xinjiang province, with forced organ harvesting of dissidents and followers of Falun Gong. And, my Lords, when we say forced organ harvesting, essentially we mean that prisoners are killed in order that their organs may be taken and sold essentially on an international market.
And China makes billions of pounds from this appalling practice. Now, over the years, Lord Alton has chipped away legislatively in a number of pieces of legislation which essentially precludes British companies from supplying goods or medicines or chemicals to China in which they which could then possibly be used for organ harvesting. And there are a number of pieces of legislation where this happens. Obviously, this bill is different, but I think the argument that Baroness Ludford and Lord Markham have made as to why we should have special provisions in relation to fair trials and the release of information to authoritarian countries, I fully take Baroness Lunsford's point, and she asked.
Lord Markham referred back to the debates in the other place, and the difficulty of drafting. But I hope that the government might be prepared to talk particularly to Lord Alton, about whether we can find a way forward here.
On the other, we have to admit that Chinese repression, its appalling human rights record, means that the government needs to tread very carefully in its relationships with China. My own interest from this came from the problems, particularly in Xinjiang province, with forced organ harvesting of dissidents and followers of Falun Gong. And, my Lords, when we say forced organ harvesting, essentially we mean that prisoners are killed in order that their organs may be taken and sold essentially on an international market.
And China makes billions of pounds from this appalling practice. Now, over the years, Lord Alton has chipped away legislatively in a number of pieces of legislation which essentially precludes British companies from supplying goods or medicines or chemicals to China in which they which could then possibly be used for organ harvesting. And there are a number of pieces of legislation where this happens. Obviously, this bill is different, but I think the argument that Baroness Ludford and Lord Markham have made as to why we should have special provisions in relation to fair trials and the release of information to authoritarian countries, I fully take Baroness Lunsford's point, and she asked.
Lord Markham referred back to the debates in the other place, and the difficulty of drafting. But I hope that the government might be prepared to talk particularly to Lord Alton, about whether we can find a way forward here.
14:12
Speaker 15
-
Speaker 15
Can I, first of all, thank noble Lords for their amendments. Obviously, we miss the noble Lord Alton, but he has already spoken to me this morning to emphasise his regret at not being able to be here. And I think many of you know the important reason why he can't be, which he was also keen to stress. So I thank all the noble lords who've spoken in this on this important amendment for discussion, which seeks to restrict overseas information sharing where there could be a risk to an individual's right to a fair trial.
And let me begin by saying that I am sympathetic to noble Lords concerns. We must be rigorous in protecting fundamental liberties and the rule of law, both nationally and internationally. As such, I understand that DCMs officials, because I'm told that the. The double D in DCMs the first D is silent, so I hope that you've been advised, accordingly, that officials have been working with teams across government to consider these concerns carefully. And from this, I am confident that the risks that have been identified by noble Lords are very low.
The information sharing powers are discretionary. Regulators are under no obligation to share information overseas. Under this bill, we work closely with all regulators and know that they are extremely cautious, only sharing information internationally when it is necessary to do so , and after considering whether disclosing that information is in line with their public duties, including those under the Human Rights Act. I've
And let me begin by saying that I am sympathetic to noble Lords concerns. We must be rigorous in protecting fundamental liberties and the rule of law, both nationally and internationally. As such, I understand that DCMs officials, because I'm told that the. The double D in DCMs the first D is silent, so I hope that you've been advised, accordingly, that officials have been working with teams across government to consider these concerns carefully. And from this, I am confident that the risks that have been identified by noble Lords are very low.
The information sharing powers are discretionary. Regulators are under no obligation to share information overseas. Under this bill, we work closely with all regulators and know that they are extremely cautious, only sharing information internationally when it is necessary to do so , and after considering whether disclosing that information is in line with their public duties, including those under the Human Rights Act. I've
14:13
Speaker 7
-
Speaker 7
I've particularly listened very carefully, obviously, to both noble lords. Markham, my noble friend Lord hunt, and the noble lady Baroness Ludford, all with their particular areas of interest and, of course, expertise. And I'm going to turn to a couple of those points in a minute. In addition, though, the bill adds further explicit safeguards that information must only be disclosed if it is relevant and proportionate. This requires regulators to exercise judgment and limit information to only that which is necessary for the purposes of the sharing, and by requiring, by requiring the Secretary of State to convene panels of experts in order to judge every instance of information sharing internationally would add a significant layer of bureaucracy, given the very low risk and the safeguards already in place, that would be disproportionate and would slow or even halt legitimate, essential international regulatory cooperation.
International collaboration has long been central to the Niss framework, with information sharing essential to ensuring that tackling the cyber threat is a global effort. The Bill ensures that our regime reflects the UK's post-Brexit position by enabling effective cooperation with trusted international partners, including close allies such as the US and Australia. Particularly on the Hong Kong point raised by the noble lady, Baroness Ludford, there is no uncertainty regarding UK Hong Kong extradition.
The UK suspended the treaty in 2020 and passed legislation to reflect the suspension in UK domestic law in 2025, completing the severing of ties between Hong Kong and UK extradition systems. And so I'm hoping that addresses that particular point.
International collaboration has long been central to the Niss framework, with information sharing essential to ensuring that tackling the cyber threat is a global effort. The Bill ensures that our regime reflects the UK's post-Brexit position by enabling effective cooperation with trusted international partners, including close allies such as the US and Australia. Particularly on the Hong Kong point raised by the noble lady, Baroness Ludford, there is no uncertainty regarding UK Hong Kong extradition.
The UK suspended the treaty in 2020 and passed legislation to reflect the suspension in UK domestic law in 2025, completing the severing of ties between Hong Kong and UK extradition systems. And so I'm hoping that addresses that particular point.
14:15
Speaker 1
-
Speaker 1
My apologies for interrupting, noble lady, but I think and I won't be able to find my notes, but I, I think what I was understanding was that though, that although the treaty had been suspended, there could be consideration on a case by case, ad hoc basis. Is that wrong? Is there no is there a complete ban on extradition or notwithstanding suspension of the treaty? Could there still be a case by case, ad hoc extradition?
14:16
Speaker 7
-
Speaker 7
Thank you. The noble lady, I will write to you on the particular point that you raised around case by case. So just to continue and to finish, I know that my noble friend the Minister will be very happy to meet with noble Lords again to discuss this, as she has done to done so quite recently with the noble Lord Alton, and discuss further.
14:17
Speaker 14
-
Speaker 14
So I think I think the the the Minister for her response, and thank the involvement of all noble Lords as suspected, I think the Committee is completely united in in what we're trying to achieve here, and obviously very pleased to hear that the Minister is sympathetic, but I think we all agree the devil will be in detail here. And that's why I'm grateful for the offer of a meeting, which I'm sure that Lord Alton and many of us here will be delighted to take up, I think, a couple of concerns.
And again, we cover this in the meeting itself. But as as the noble lady, the Minister mentioned, that there's no obligation for regulators. But the question is why leave it to their discretion? And the noble lady, the minister again later said that there was concern about it being overburdensome on Secretary of State officials having to determine these cases. But if there's a group of experts, that would be too much burden for surely it's even less likely that regulators in all sorts of different fields are really going to try and apply that same that that same knowledge.
So, so so I think the concern from all of this is that it just will then, you know, whilst the intentions are good, unless there are firm constraints put in this bill, it will just be something which, you know, through, through no malcontent or, you know, wrong reason, but is just something which is overlooked. So I think that's why we feel it's very important that we do have something on the face of the bill, which really adds teeth to this and something that we'd be delighted to explore further in, in, in meetings and report stage.
At this point, I beg to thank you.
And again, we cover this in the meeting itself. But as as the noble lady, the Minister mentioned, that there's no obligation for regulators. But the question is why leave it to their discretion? And the noble lady, the minister again later said that there was concern about it being overburdensome on Secretary of State officials having to determine these cases. But if there's a group of experts, that would be too much burden for surely it's even less likely that regulators in all sorts of different fields are really going to try and apply that same that that same knowledge.
So, so so I think the concern from all of this is that it just will then, you know, whilst the intentions are good, unless there are firm constraints put in this bill, it will just be something which, you know, through, through no malcontent or, you know, wrong reason, but is just something which is overlooked. So I think that's why we feel it's very important that we do have something on the face of the bill, which really adds teeth to this and something that we'd be delighted to explore further in, in, in meetings and report stage.
At this point, I beg to thank you.
14:18
14:19
Speaker 15
-
Speaker 15
Is it your lordships pleasure to this amendment be withdrawn? The amendment is by leave withdrawn. The question is that clause 18 stand part of the Bill. As many as are of that opinion will say content contrary, not content. The contents of it. The question is that clauses 19 to 21 be agreed to en bloc. As many as are of that opinion will say content don't contrary not content. The contents have it after clause 21, amendment 74, Baroness Kidron.
14:19
Speaker 11
-
Speaker 11
My Lords, I rise to move. Amendment 74 in the name of the noble Baroness Morgan, Baroness Ludford and indeed myself. Baroness Morgan is very sorry that she cannot be in the House this afternoon, but she particularly wanted me to thank the Minister for their helpful meeting last week. This amendment and amendment 167 in the name of the noble Lady Ludford, relate to the governance of regulated bodies who will be caught under this act.
The reason for this legislation is to reflect the rapidly changing cyber environment and to strengthen the current vulnerabilities of those organisations, providing services critical to societal or economic life. As, as we have discussed, regulators will be given powers to designate critical suppliers whose disruption could have a significant impact on essential services. And as we have discussed in previous groups, many of us think this bill does not go far enough in setting out who those critical suppliers are.
I think that we are going to see many amendments similar to this one in other forthcoming bills that make provision for senior manager liability when new responsibilities are legislated. This is something that we've been through in other bills, and the only way to change the culture of an organisation is to start at the top. Indeed, I'm sure boards will grumble when they accept new duties, but they will keep their regulators happy were they to be in sight of the law.
What really makes the difference to successful implementation is knowing that if it can be proven, and I do want to read out subclause 18A1B. The failure was committed with the consent or connivance, or is reasonably attributable to any neglect on the part of a senior executive or group of senior executives, deliberately or carelessly, that individual will be held responsible. And my Lords, I just point you at recent court cases in the in the area of social media where disclosure has repeatedly shown that senior executives knew of harm or put or stood in the way of harm mitigation for years.
And I think this idea that that it is it might capture an unwilling or unwitting senior executive is made clearly not the case by what I have just read out. I understand that the Minister and Baroness Morgan also discussed this in the context of financial services, a regime introduced after the 2008 financial crash, with the very intention to change the culture of financial service businesses and to focus senior minds on the damage those businesses can do if they don't meet their responsibilities.
And a more recent example is the introduction of the consumer duty by the Financial Conduct Authority, which required relevant boards to appoint an individual consumer duty champion, something which the noble lady, Baroness Morgan, was involved with. And I would also point to the Building Safety Act. That was a response to the Grenfell Tower disaster. I am hoping that the government actually is sympathetic to this amendment, but if they find themselves unable to be sympathetic, I.
I would be interested also to hear the noble lady the Minister's thoughts on whether we could require the relevant regulator to introduce a named Senior Manager regime, which indeed we did in the Online Safety Act. The final point I would like to make is that the senior manager must be senior. The intention behind the amendment is to change the culture of an organisation to ensure preventative action is taken to avoid penalties.
As I said at the outset, culture change starts at the top. The services covered in this bill are by definition considered by minister to be critical to national life, which means the most senior governing body should be discussing them and responsible for them. While day to day management may be delegated, overall oversight and responsibility should sit at the top, and for that reason I support, and indeed , I know that the noble lady, Baroness Morgan, supports amendment 167, tabled by the noble Lady, Baroness Ludford.
This clause would focus the minds of those at most senior levels of organisations caught by the Bill, and I really do hope that the government supports this ambition. I beg to move.
The reason for this legislation is to reflect the rapidly changing cyber environment and to strengthen the current vulnerabilities of those organisations, providing services critical to societal or economic life. As, as we have discussed, regulators will be given powers to designate critical suppliers whose disruption could have a significant impact on essential services. And as we have discussed in previous groups, many of us think this bill does not go far enough in setting out who those critical suppliers are.
I think that we are going to see many amendments similar to this one in other forthcoming bills that make provision for senior manager liability when new responsibilities are legislated. This is something that we've been through in other bills, and the only way to change the culture of an organisation is to start at the top. Indeed, I'm sure boards will grumble when they accept new duties, but they will keep their regulators happy were they to be in sight of the law.
What really makes the difference to successful implementation is knowing that if it can be proven, and I do want to read out subclause 18A1B. The failure was committed with the consent or connivance, or is reasonably attributable to any neglect on the part of a senior executive or group of senior executives, deliberately or carelessly, that individual will be held responsible. And my Lords, I just point you at recent court cases in the in the area of social media where disclosure has repeatedly shown that senior executives knew of harm or put or stood in the way of harm mitigation for years.
And I think this idea that that it is it might capture an unwilling or unwitting senior executive is made clearly not the case by what I have just read out. I understand that the Minister and Baroness Morgan also discussed this in the context of financial services, a regime introduced after the 2008 financial crash, with the very intention to change the culture of financial service businesses and to focus senior minds on the damage those businesses can do if they don't meet their responsibilities.
And a more recent example is the introduction of the consumer duty by the Financial Conduct Authority, which required relevant boards to appoint an individual consumer duty champion, something which the noble lady, Baroness Morgan, was involved with. And I would also point to the Building Safety Act. That was a response to the Grenfell Tower disaster. I am hoping that the government actually is sympathetic to this amendment, but if they find themselves unable to be sympathetic, I.
I would be interested also to hear the noble lady the Minister's thoughts on whether we could require the relevant regulator to introduce a named Senior Manager regime, which indeed we did in the Online Safety Act. The final point I would like to make is that the senior manager must be senior. The intention behind the amendment is to change the culture of an organisation to ensure preventative action is taken to avoid penalties.
As I said at the outset, culture change starts at the top. The services covered in this bill are by definition considered by minister to be critical to national life, which means the most senior governing body should be discussing them and responsible for them. While day to day management may be delegated, overall oversight and responsibility should sit at the top, and for that reason I support, and indeed , I know that the noble lady, Baroness Morgan, supports amendment 167, tabled by the noble Lady, Baroness Ludford.
This clause would focus the minds of those at most senior levels of organisations caught by the Bill, and I really do hope that the government supports this ambition. I beg to move.
14:25
14:25
Speaker 1
-
Speaker 1
My Lords, I'm pleased to speak to amendment one, six, seven and grateful for the support from noble lady Baroness Kidron and the support is mutual. Well, I co-signed her amendment, but I think they're complementary because amendment 74 is about liability of senior executives. Amendment 167 is about board oversight by the board rather than the individual executive oversight, responsibility and accountability. And I was I was interested to hear noble, noble lady, Baroness Kidron, refer not only to financial and consumer conduct as an area where this such responsibility is exists, but also building safety.
And indeed, I'm also simultaneously involved on the public accountability. The Hillsborough Law Bill, which introduces a duty of ethical conduct and candour and transparency on public authorities and public officials. Perhaps what some of these other sectors have in common is that the it's been an after the event thought that, oh, maybe boards and senior executives ought to have some kind of responsibility in this area. We've had a catastrophe. You know, with with often a great deal of of harm, particularly obviously in Hillsborough created.
And maybe it would be a good idea if the people at the top, often extremely highly paid people at the top, took some interest in this area rather than regarded as some sort of, you know, lowly service, rather like sort of cleaning, cleaning the loos or something in the in the HQ building. I mean, we've seen, I mean, I know it's now routine to refer to, to places like examples like Jaguar Land Rover and Marks and Spencer's huge financial effects of, of cyber attacks.
So this is not some negligible issue. And cyber security ought to be a core responsibility for senior people. I mean, I'm sitting to just close to noble lady Baroness Harding, who today has referred to her own. And we all you know, we all remember her personal experience, which was she was painful for her very public. And and she's actually been through it. And so nobody knows better what it can be like when you when you have a big cyber data breach or cyber attack.
So it really is long past due that this it ought to be a top responsibility of boards, directors and senior executives. And yet we understand that. I think I get this from my noble friend, Lord Clement-jones, that the government's own Cyber Security Breaches survey reveals that board level ownership of cyber risk in the UK has declined from 38% to 27% over the last three years, going precisely in the wrong direction.
So I don't think I need to really persuade anyone here of how important it is for senior people in the organisation to to be aware and carry not only responsibility, awareness, accountability, but also liability so that it it hits where it hurts. If if something goes wrong, I'm personally it seems to me pretty much a no brainer. And I hope the noble lady. The Minister will agree.
And indeed, I'm also simultaneously involved on the public accountability. The Hillsborough Law Bill, which introduces a duty of ethical conduct and candour and transparency on public authorities and public officials. Perhaps what some of these other sectors have in common is that the it's been an after the event thought that, oh, maybe boards and senior executives ought to have some kind of responsibility in this area. We've had a catastrophe. You know, with with often a great deal of of harm, particularly obviously in Hillsborough created.
And maybe it would be a good idea if the people at the top, often extremely highly paid people at the top, took some interest in this area rather than regarded as some sort of, you know, lowly service, rather like sort of cleaning, cleaning the loos or something in the in the HQ building. I mean, we've seen, I mean, I know it's now routine to refer to, to places like examples like Jaguar Land Rover and Marks and Spencer's huge financial effects of, of cyber attacks.
So this is not some negligible issue. And cyber security ought to be a core responsibility for senior people. I mean, I'm sitting to just close to noble lady Baroness Harding, who today has referred to her own. And we all you know, we all remember her personal experience, which was she was painful for her very public. And and she's actually been through it. And so nobody knows better what it can be like when you when you have a big cyber data breach or cyber attack.
So it really is long past due that this it ought to be a top responsibility of boards, directors and senior executives. And yet we understand that. I think I get this from my noble friend, Lord Clement-jones, that the government's own Cyber Security Breaches survey reveals that board level ownership of cyber risk in the UK has declined from 38% to 27% over the last three years, going precisely in the wrong direction.
So I don't think I need to really persuade anyone here of how important it is for senior people in the organisation to to be aware and carry not only responsibility, awareness, accountability, but also liability so that it it hits where it hurts. If if something goes wrong, I'm personally it seems to me pretty much a no brainer. And I hope the noble lady. The Minister will agree.
14:30
Speaker 13
-
Speaker 13
My Lords, I've added my name to the noble lady, Baroness Ludford amendment 167. I also support amendment 74 and I've. I've done that in the knowledge that it's perfectly possible that the noble lady. The Minister, will say that she wants to minimise regulation wherever possible, and I get that. But I also get that we've been saying for years now that cyber security should be a board responsibility, and that that requires knowledge, and that knowledge requires training, which is what clause 167 provides for.
We've been saying that, but very little has actually happened. So if we're not to legislate about this, then what? What is it that will make people actually act? And if the noble lady, Baroness Ludford, is right, that board ownership of cyber security has actually declined, then we've got to do something. I do understand that people who start, say, a wine business or a book business are probably interested in wine or books rather than cyber security.
And if they were interested in cyber security, they'd probably start a cyber security business in which they would probably make a great deal more money. But they've got to be interested in cyber security in exactly the same way as they've got to be interested in money. And so hence this clause, which I support.
We've been saying that, but very little has actually happened. So if we're not to legislate about this, then what? What is it that will make people actually act? And if the noble lady, Baroness Ludford, is right, that board ownership of cyber security has actually declined, then we've got to do something. I do understand that people who start, say, a wine business or a book business are probably interested in wine or books rather than cyber security.
And if they were interested in cyber security, they'd probably start a cyber security business in which they would probably make a great deal more money. But they've got to be interested in cyber security in exactly the same way as they've got to be interested in money. And so hence this clause, which I support.
14:32
14:32
Speaker 6
-
Speaker 6
Lord, I strongly support the drift of both amendments moved by the Baroness Kidron and Ludford. As I said the other day, I have sat on many boards with many distinguished people containing a variety of experience in many jurisdictions, but I have not often come across a board which contains anyone with a pronounced understanding of technology, let alone this extremely, quite narrow, narrow but deep area of complexity that is cyber security.
So I hope the committee will forgive me for reminding you of what I said on Tuesday, that the way to achieve this objective is to require boards boards at an appropriate level. I don't mean every board in the land to have a cyber resilience audit each year, in the way that all major organisations have a very searching financial audit each year, which the whole board, even though it may contain people who are not themselves, they'll be there for different reasons.
They've got marketing expertise, expertise or sector expertise. But believe me, every single board, when the auditor comes, team of auditors who've been in the business for weeks, sometimes months, when they report they are listened to and anything they advise is acted upon. We need to do exactly the same for cyber resilience.
So I hope the committee will forgive me for reminding you of what I said on Tuesday, that the way to achieve this objective is to require boards boards at an appropriate level. I don't mean every board in the land to have a cyber resilience audit each year, in the way that all major organisations have a very searching financial audit each year, which the whole board, even though it may contain people who are not themselves, they'll be there for different reasons.
They've got marketing expertise, expertise or sector expertise. But believe me, every single board, when the auditor comes, team of auditors who've been in the business for weeks, sometimes months, when they report they are listened to and anything they advise is acted upon. We need to do exactly the same for cyber resilience.
14:33
Speaker 16
-
Speaker 16
My Lord, this bill is largely directed at a given segment of the corporate sector, but I think it reminds us, however, that there is a very large swathe of the corporate sector that we're not we're not focusing on directly. However, it is the case that in the corporate sector, generally, the board has to be interested in all risks, all risks, not just financial risks or or, you know, whether it's the bulk market, the, the book market or the wine market is in good shape.
They have to actually be able to protect the business at home and its shareholders. And they have a duty to the shareholders to do that. So I think it's a very good opportunity actually, to try and raise the level of performance in this area. The record is demonstrated not to be very good. This is an opportunity, actually to help, help raise the the level of performance and make it clear, you know, if you take on a responsibility as a board director, that you're going to have to actually be able to help conduct the, the business of that of, of that organisation at the highest possible level.
So I very strongly support amendment one, six, seven.
They have to actually be able to protect the business at home and its shareholders. And they have a duty to the shareholders to do that. So I think it's a very good opportunity actually, to try and raise the level of performance in this area. The record is demonstrated not to be very good. This is an opportunity, actually to help, help raise the the level of performance and make it clear, you know, if you take on a responsibility as a board director, that you're going to have to actually be able to help conduct the, the business of that of, of that organisation at the highest possible level.
So I very strongly support amendment one, six, seven.
14:35
Speaker 8
-
Speaker 8
My Lords, I also support both amendment 74 and 167. And my experience is that boards that tell you that their cyber security is really good are the ones that you should be most worried about, boards that are really worried about it and can tell you where they think they're exposed. They they might be in a slightly better place, and there are too many organisations who will tell you they're fine. So I think it's entirely appropriate.
Boards that are not doing what are set out in in clause one, six, seven are in trouble. And so I think it's entirely appropriate and fully support that amendment. Amendment 74. I would just like to draw a thread between the financial services senior manager regime, what we've learned in the Online Safety Act and debates we had on Tuesday about whether or not frontier models, AI models are included in the scope of this bill.
So what we've learned from the financial services senior manager regime is that when you make individual human beings accountable, they do change. There's no doubt that the senior manager regime in financial services has served to move the dial on culture, in financial services, and all previous attempts had failed. What we've also learnt in the Online Safety Act is that various companies, not ones regulated by this bill. I've had various companies have not taken seriously fines from Ofcom and simply refuse to obey.
And so what we are living through at the moment is an era where the tech sector wants to believe that it is exceptional that that the individual laws from individual countries don't really apply to them. And so I think that it's very important that we do put into this bill liability for senior executives precisely because what we've learnt in a sector that's doing it, you get culture change in, in in other digital legislation where we don't have this, we've had active flouting of regulators decisions.
And this is even more important if the noble lady, the minister, were to accept the amendments to be debated on Tuesday by that noble Lord Tereshchenko has arrived just in time, because I firmly believe the single most important part of regulating AI is to hold the creators of the model accountable for their actions. And given that the biggest cyber security threats we face are the actions of Agentic AI, I want to be able to build the framework that enables us to hold those managers and leaders who are developing those models who currently say, this is really nothing to do with me at all, accountable for their actions, which I think clause 74, and I may be stretching it a bit.
Oh, nice birdsong. I think I may be stretching it a bit, but I would hope that clause 74 would be the beginnings of a framework that would enable us to hold those senior tech titans to account.
Boards that are not doing what are set out in in clause one, six, seven are in trouble. And so I think it's entirely appropriate and fully support that amendment. Amendment 74. I would just like to draw a thread between the financial services senior manager regime, what we've learned in the Online Safety Act and debates we had on Tuesday about whether or not frontier models, AI models are included in the scope of this bill.
So what we've learned from the financial services senior manager regime is that when you make individual human beings accountable, they do change. There's no doubt that the senior manager regime in financial services has served to move the dial on culture, in financial services, and all previous attempts had failed. What we've also learnt in the Online Safety Act is that various companies, not ones regulated by this bill. I've had various companies have not taken seriously fines from Ofcom and simply refuse to obey.
And so what we are living through at the moment is an era where the tech sector wants to believe that it is exceptional that that the individual laws from individual countries don't really apply to them. And so I think that it's very important that we do put into this bill liability for senior executives precisely because what we've learnt in a sector that's doing it, you get culture change in, in in other digital legislation where we don't have this, we've had active flouting of regulators decisions.
And this is even more important if the noble lady, the minister, were to accept the amendments to be debated on Tuesday by that noble Lord Tereshchenko has arrived just in time, because I firmly believe the single most important part of regulating AI is to hold the creators of the model accountable for their actions. And given that the biggest cyber security threats we face are the actions of Agentic AI, I want to be able to build the framework that enables us to hold those managers and leaders who are developing those models who currently say, this is really nothing to do with me at all, accountable for their actions, which I think clause 74, and I may be stretching it a bit.
Oh, nice birdsong. I think I may be stretching it a bit, but I would hope that clause 74 would be the beginnings of a framework that would enable us to hold those senior tech titans to account.
14:38
14:38
14:38
Speaker 17
-
Speaker 17
My Lords, I just wish to rise quickly. I was just checking my records and particularly around amendment 167. It was just under a year ago that I completed the FTT Board Directors programme, which was specifically around cyber risk for boards. And it was a room of around 50 people. We had a tabletop exercise, a real life scenario about what one does in the event of a very serious cyber crisis, a cyber risk. And I was really struck by a number of things.
First of all, in the room were people with vast swathes of expertise and experience, and none of which were technology experts. All of them said that no other members of their board had attended a training like this. In some way or another. They were there because, having completed a board director programme, it piqued their interest as it did mine and it was something free on offer and they decided to attend. Having gone through that session, we covered things like the regulatory experience, around issues, around how to challenge management in in the event of one of these incidents and how you need to test organisational resilience, look at the risks involved and also how to respond decisively and to have the expertise and understanding in order to do so.
It was very clear to me, even just during that half day exercise, that that training was not sufficient for me as a board director and member to be able to fulfill that role. And so I think for so many reasons, but having gone through that experience, this amendment is so important to ensure that boards across this country, be they private boards or be they of FTSE or regulated companies, are able to do their jobs effectively. And in this world that's extending.
And I would also echo the points around AI, that it's even more imperative that we have this amendment to ensure that boards are able to fulfil their roles effectively.
First of all, in the room were people with vast swathes of expertise and experience, and none of which were technology experts. All of them said that no other members of their board had attended a training like this. In some way or another. They were there because, having completed a board director programme, it piqued their interest as it did mine and it was something free on offer and they decided to attend. Having gone through that session, we covered things like the regulatory experience, around issues, around how to challenge management in in the event of one of these incidents and how you need to test organisational resilience, look at the risks involved and also how to respond decisively and to have the expertise and understanding in order to do so.
It was very clear to me, even just during that half day exercise, that that training was not sufficient for me as a board director and member to be able to fulfill that role. And so I think for so many reasons, but having gone through that experience, this amendment is so important to ensure that boards across this country, be they private boards or be they of FTSE or regulated companies, are able to do their jobs effectively. And in this world that's extending.
And I would also echo the points around AI, that it's even more imperative that we have this amendment to ensure that boards are able to fulfil their roles effectively.
14:40
Speaker 9
-
Speaker 9
My Lords, this has been a really useful debate, and in particular because it really has distilled all the the board experience and the considerable board experience. Indeed, board training experience around the committee, my Lords, which I very much hope that the Minister has listened to with with interest. Amendment 74 on the name of Baroness Morgan, moved by the noble Baroness Kidron, lines the UK with the EU two framework. It introduces personal civil liability for senior executives who deliberately or carelessly neglect cyber duties and amendment 167 in the name of my noble friend Baroness Ludford mandates board level oversight and technical training.
In our view, my Lords, on these benches to build national resilience, cybersecurity must become a personal fiduciary director's responsibility. And as the noble baroness, my noble friend and and the noble Lord Arbuthnot said, this is long overdue and it's. It would be additional to other existing sectors, my Lords. And we need to learn from that experience in the way that the noble Baroness Harding mentioned. And I very much hope that we will do that in the course of this bill.
Together, these two amendments target what is arguably the single, single greatest cultural and noble. Baroness Kidron emphasized the word culture. My Lords, quite rightly, cultural and behavioral failure in UK cyber security today, the persistent treatment of cyber security by company boards as a delegated technical IT issue, rather than a core personal and fiduciary leadership responsibility. And I'm afraid, my Lords, the government's approach to corporate cyber governance has been almost entirely passive.
To date, ministers have relied on voluntary guidance such as the cyber government's code of practice, hoping that boards would voluntarily prioritise digital resilience. And the proof of this policy failure is undeniable. My noble friend quoted the Cyber Security Breaches survey, which showed that board level ownership of cyber risk has actually declined over the last three years. And of course, the board's neglect. Cyber security. This carries massive public costs as seen in major supply chain recent major supply chain disruptions.
While company directors face strict personal legal liabilities under company law for signing off on financial accounts, they're permitted to treat systemic cyber vulnerabilities, vulnerabilities that can wipe hundreds of millions of pounds from the economy and paralyse critical national supply chains with complete personal legal impunity. And my Lords, my noble friend, also reminded us of the catastrophic real world cost of this boardroom neglect in the automotive sector, where a supply chain breach at Jaguar Land Rover cost an estimated £500 million, halting production lines for four months and forcing the government to step in with a 1.5 billion loan guarantee.
And we saw it also in retail, also mentioned by my noble friend, where the cyber attack on Marks and Spencer cost £300 million and contributed to a 99% collapse in pre-tax profits. Amendment 74 provides the direct legislative teeth this bill is missing by introducing personal civil liability for senior executives. It amends the NIS regulations to establish that where a regulated entity fails to comply, comply with core risk management duties and that failure was committed with the consent of violence or deliberate or careless neglect of a senior executive.
The regulator may impose a personal civil penalty. Crucially, however, amendment 74 contains what we consider to be rigorous fair safeguards. Liability is not strict. It requires proven consent, connivance or gross neglect. Secondary any penalty must be strictly proportionate to the executive's individual culpability and financial means. And third, it provides an immediate statutory right of appeal to the independent First tier Tribunal, and this aligns the UK directly with the EU's NIS2 directive, which has already established senior management accountability across 27 neighbouring economies.
If an individual is fit to draw a multi-million pound executive salary running a critical national provider, they must be prepared to carry personal responsibility for securing it. Complementing that amendment. Amendment 167, tabled by my Noble friend Baroness Ludford, embeds active board level governance across all regulated entities. It places a formal statutory duty on governing boards to approve the organisation's cyber risk management approach, periodically satisfy themselves that appropriate proportionate measures are actively in place and, crucially, undergo mandatory mandatory cyber security training so that directors possess the technical literacy required to assess risk and hold their IT IT teams to account.
And of course, my Lords, the noble Lord Burt mentioned his previous amendment 91, which we think is entirely complementary to these two amendments, which. And of course, we debated that earlier, which would require mandatory reporting on cyber risk management within annual corporate accounts under the Financial Reporting Council. My Lords, I think we've had an extremely comprehensive and useful debate today, drawing on the considerable experience of all of us on boards. My Lords, these two amendments are entirely practicable, entirely desirable.
My Lords, and I very much hope that the Minister will accept both amendments.
In our view, my Lords, on these benches to build national resilience, cybersecurity must become a personal fiduciary director's responsibility. And as the noble baroness, my noble friend and and the noble Lord Arbuthnot said, this is long overdue and it's. It would be additional to other existing sectors, my Lords. And we need to learn from that experience in the way that the noble Baroness Harding mentioned. And I very much hope that we will do that in the course of this bill.
Together, these two amendments target what is arguably the single, single greatest cultural and noble. Baroness Kidron emphasized the word culture. My Lords, quite rightly, cultural and behavioral failure in UK cyber security today, the persistent treatment of cyber security by company boards as a delegated technical IT issue, rather than a core personal and fiduciary leadership responsibility. And I'm afraid, my Lords, the government's approach to corporate cyber governance has been almost entirely passive.
To date, ministers have relied on voluntary guidance such as the cyber government's code of practice, hoping that boards would voluntarily prioritise digital resilience. And the proof of this policy failure is undeniable. My noble friend quoted the Cyber Security Breaches survey, which showed that board level ownership of cyber risk has actually declined over the last three years. And of course, the board's neglect. Cyber security. This carries massive public costs as seen in major supply chain recent major supply chain disruptions.
While company directors face strict personal legal liabilities under company law for signing off on financial accounts, they're permitted to treat systemic cyber vulnerabilities, vulnerabilities that can wipe hundreds of millions of pounds from the economy and paralyse critical national supply chains with complete personal legal impunity. And my Lords, my noble friend, also reminded us of the catastrophic real world cost of this boardroom neglect in the automotive sector, where a supply chain breach at Jaguar Land Rover cost an estimated £500 million, halting production lines for four months and forcing the government to step in with a 1.5 billion loan guarantee.
And we saw it also in retail, also mentioned by my noble friend, where the cyber attack on Marks and Spencer cost £300 million and contributed to a 99% collapse in pre-tax profits. Amendment 74 provides the direct legislative teeth this bill is missing by introducing personal civil liability for senior executives. It amends the NIS regulations to establish that where a regulated entity fails to comply, comply with core risk management duties and that failure was committed with the consent of violence or deliberate or careless neglect of a senior executive.
The regulator may impose a personal civil penalty. Crucially, however, amendment 74 contains what we consider to be rigorous fair safeguards. Liability is not strict. It requires proven consent, connivance or gross neglect. Secondary any penalty must be strictly proportionate to the executive's individual culpability and financial means. And third, it provides an immediate statutory right of appeal to the independent First tier Tribunal, and this aligns the UK directly with the EU's NIS2 directive, which has already established senior management accountability across 27 neighbouring economies.
If an individual is fit to draw a multi-million pound executive salary running a critical national provider, they must be prepared to carry personal responsibility for securing it. Complementing that amendment. Amendment 167, tabled by my Noble friend Baroness Ludford, embeds active board level governance across all regulated entities. It places a formal statutory duty on governing boards to approve the organisation's cyber risk management approach, periodically satisfy themselves that appropriate proportionate measures are actively in place and, crucially, undergo mandatory mandatory cyber security training so that directors possess the technical literacy required to assess risk and hold their IT IT teams to account.
And of course, my Lords, the noble Lord Burt mentioned his previous amendment 91, which we think is entirely complementary to these two amendments, which. And of course, we debated that earlier, which would require mandatory reporting on cyber risk management within annual corporate accounts under the Financial Reporting Council. My Lords, I think we've had an extremely comprehensive and useful debate today, drawing on the considerable experience of all of us on boards. My Lords, these two amendments are entirely practicable, entirely desirable.
My Lords, and I very much hope that the Minister will accept both amendments.
14:46
Speaker 3
-
Speaker 3
My Lords, I thank the noble lady, Baroness Kidron, for opening this debate on behalf of my noble friend, Baroness Morgan of Coates. I will come to her amendment in a moment after I touch on amendment 167, tabled by the noble Baroness, Lady Ludford, whose comments I think particularly about board ownership of cyber risk, were really well founded and and an extremely important basis foundation for the debate, as indeed were those of the noble lady, Baroness Burger, who pointed out the the difficulty of accelerating from zero cyber knowledge to sufficient.
That that is a non-trivial undertaking, my Lords, amendment 167, I feel is is absolutely in line with the principle that we raised on day one of this Committee stage in the form of amendment 92 B, that is to say, the idea that executives should be held accountable for cyber security and resilience plans by their board and their shareholders by reporting consistently on protections. This amendment, I think perhaps a little bit more explicitly, would require the same thing, and I'm very happy to support it.
Indeed, my Lords, amendment 74 largely, I think, follows the same sentiment that companies should and must be held accountable for their own cyber security. On this one, however, I do perhaps need a little bit more persuasion, and I'm I'm going to tread a little bit tentatively here because I very much take on board the comments of my noble friend, Lord Arbuthnot here, that we have not solved this problem yet, and carrying on as we are is probably not that sensible, but I do have some inner alarm bells ringing about this one.
So while , you know, we of course very much support the goal of making companies self-sufficient and accountable to their shareholders, this amendment would give the Information Commissioner powers to enforce compliance and sanction individual negligence. And I think the concern here is that, as a matter of principle, the inner working of companies who's accountable internally to whom and for what should be placed in a different category than requirements placed upon them. We should encourage companies to figure out internal issues themselves, by all means, requiring board oversight of cyber security plans, as we've attempted to do.
But my understanding is that we would be making it the Information Commissioner's job to decide which individual is responsible when cyber attacks take place and are not adequately defended. So, as I say, I find this quite a tricky path forward, but clearly willing to keep talking and to be persuaded. I am also concerned about the disincentives to become a director that this might put in place, because of what feels to me like the inherent uncertainties of the liabilities that may hang over board directors.
As as they undertake these responsibilities. That being said, I of course, completely agree with the underlying principle and look forward to hearing the noble Baroness the Minister's response.
That that is a non-trivial undertaking, my Lords, amendment 167, I feel is is absolutely in line with the principle that we raised on day one of this Committee stage in the form of amendment 92 B, that is to say, the idea that executives should be held accountable for cyber security and resilience plans by their board and their shareholders by reporting consistently on protections. This amendment, I think perhaps a little bit more explicitly, would require the same thing, and I'm very happy to support it.
Indeed, my Lords, amendment 74 largely, I think, follows the same sentiment that companies should and must be held accountable for their own cyber security. On this one, however, I do perhaps need a little bit more persuasion, and I'm I'm going to tread a little bit tentatively here because I very much take on board the comments of my noble friend, Lord Arbuthnot here, that we have not solved this problem yet, and carrying on as we are is probably not that sensible, but I do have some inner alarm bells ringing about this one.
So while , you know, we of course very much support the goal of making companies self-sufficient and accountable to their shareholders, this amendment would give the Information Commissioner powers to enforce compliance and sanction individual negligence. And I think the concern here is that, as a matter of principle, the inner working of companies who's accountable internally to whom and for what should be placed in a different category than requirements placed upon them. We should encourage companies to figure out internal issues themselves, by all means, requiring board oversight of cyber security plans, as we've attempted to do.
But my understanding is that we would be making it the Information Commissioner's job to decide which individual is responsible when cyber attacks take place and are not adequately defended. So, as I say, I find this quite a tricky path forward, but clearly willing to keep talking and to be persuaded. I am also concerned about the disincentives to become a director that this might put in place, because of what feels to me like the inherent uncertainties of the liabilities that may hang over board directors.
As as they undertake these responsibilities. That being said, I of course, completely agree with the underlying principle and look forward to hearing the noble Baroness the Minister's response.
14:50
14:50
Speaker 15
-
Speaker 15
And those who introduced their amendments on behalf. Baroness Kidron, who introduced Baroness Morgan's amendment for raising the incredibly important topic of board accountability and senior management oversight. It is absolutely right that organisations, especially those delivering our essential services, are held properly accountable for their activities. That is why the Bill creates a more meaningful enforcement regime, both in terms of the maximum fines that can be levied up to £17 million or 4% of turnover, whichever is higher, alongside a simpler process of taking that forward.
I also agree with the points made by. Baroness Ludford and Baroness Neville-jones, and indeed by my noble friend Baroness Burger, on the sort of extent of this being within the regulatory perimeter, as well as the non regulatory perimeter. The the importance of boards upskilling themselves, taking training seriously is is absolutely imperative . And that is why we have our cyber governance code of practice. That is at the heart of our approach to board and executive accountability.
And I would I personally feel that I am an extremely active proponent of this. For those who feel that we are not doing enough, I would request your support in continuing to. Highlight this very important code of practice in your own organizations, and on all the numerous boards you sit on, to make sure that we are governing cyber risk appropriately, and that many of the board directors that you sit alongside are are aware of it.
Just to say that is not obviously the limit of the approach we are taking. We are going to introduce a new security and resilience requirements in our secondary legislation, and our proposals will include a dedicated requirement on board level governance, which will be consistent with the cyber assessment framework that will cover. Issues such as organizational capability, senior responsibility and accountability for security and resilience and effective risk escalation. And it is in that way that we will connect the clarity on what is expected of boards with the accountability through the enforcement regime.
And just to touch on the point that was alluded to by the noble Lord, Lord Clement-jones, on the U.S regime, individual liability for board level members is not mandatory under NY's two, and different EU member States have taken different approaches to implementing the directive in this approach, in this respect. So there is not a single model of implementation the EU is following in that respect. So just to conclude, the. And I would also like to concur with the point that the noble Viscount Camrose made around the importance of attracting those with cyber expertise to take on board level roles, and to be able to contribute as a part of the board , accountable to shareholders in that way.
And we don't want to introduce anything that might disincentivize either senior executives with cyber expertise or those at board level to take these very important roles. So I do believe that together with the enforcement regime and the security and requirement, security and resilience requirements, that those two things will cement the importance of board and executive accountability into firmly into the regime in the way that noble Lords have highlighted today. And I think that is the right approach.
I also agree with the points made by. Baroness Ludford and Baroness Neville-jones, and indeed by my noble friend Baroness Burger, on the sort of extent of this being within the regulatory perimeter, as well as the non regulatory perimeter. The the importance of boards upskilling themselves, taking training seriously is is absolutely imperative . And that is why we have our cyber governance code of practice. That is at the heart of our approach to board and executive accountability.
And I would I personally feel that I am an extremely active proponent of this. For those who feel that we are not doing enough, I would request your support in continuing to. Highlight this very important code of practice in your own organizations, and on all the numerous boards you sit on, to make sure that we are governing cyber risk appropriately, and that many of the board directors that you sit alongside are are aware of it.
Just to say that is not obviously the limit of the approach we are taking. We are going to introduce a new security and resilience requirements in our secondary legislation, and our proposals will include a dedicated requirement on board level governance, which will be consistent with the cyber assessment framework that will cover. Issues such as organizational capability, senior responsibility and accountability for security and resilience and effective risk escalation. And it is in that way that we will connect the clarity on what is expected of boards with the accountability through the enforcement regime.
And just to touch on the point that was alluded to by the noble Lord, Lord Clement-jones, on the U.S regime, individual liability for board level members is not mandatory under NY's two, and different EU member States have taken different approaches to implementing the directive in this approach, in this respect. So there is not a single model of implementation the EU is following in that respect. So just to conclude, the. And I would also like to concur with the point that the noble Viscount Camrose made around the importance of attracting those with cyber expertise to take on board level roles, and to be able to contribute as a part of the board , accountable to shareholders in that way.
And we don't want to introduce anything that might disincentivize either senior executives with cyber expertise or those at board level to take these very important roles. So I do believe that together with the enforcement regime and the security and requirement, security and resilience requirements, that those two things will cement the importance of board and executive accountability into firmly into the regime in the way that noble Lords have highlighted today. And I think that is the right approach.
14:54
Speaker 9
-
Speaker 9
My Lords, can I just check before noble Baroness Kidron rises, the the noble Baroness. The Minister has uttered some very warm words about the responsibilities of directors. But am I right in thinking that nothing of what she said? There is any intent in the Bill to create a legal liability that compels directors in the way that these two amendments do, or creates any form of personal financial fiduciary duty on a director.
And so that essentially what she's arguing for, despite, you know, the warm words, is essentially a voluntary scheme.
And so that essentially what she's arguing for, despite, you know, the warm words, is essentially a voluntary scheme.
14:55
Speaker 15
-
Speaker 15
Not so the security and resilience requirements, which will come as. Out of the bill, they are to be set out. We will consult on those. They will have a requirement on board governance, and that is the way in which the board governance will be. The expectations will be set out as a result of the bill, and that is the way that regulators and others then enforcing against the bill will take that into account, should there be in their enforcement regime.
14:56
Speaker 9
-
Speaker 9
Sorry. but the minister saying these are expectations, do you think do you think the minister could write to us? Because I do think that there's a huge amount of lack of clarity in in the middle of the the the the warm words, I think we, you know, we take encouragement from the fact that the government wants to see boards take responsibility. But you know, where where is the where are the teeth? My Lords.
14:56
14:56
14:56
Speaker 15
-
Speaker 15
No, no, the obviously, we haven't yet gone out to consultation on this security and resilience requirements. That would be something we would do after the past, the passing of the bill. So I can I can certainly update on the process and the expectation. But obviously the the point of the and how that links with the enforcement duties in further detail.
14:56
Speaker 9
-
Speaker 9
I think the minister's also going to have to point out the power under which the government is going to act , to actually fix that liability or make sure that the guidance or whatever it is, is, is complied with because that's the you know, what we're talking about here is the power and the duties in primary legislation. My Lords, it's all very well for the government to say, you know, we're going to produce guidance, but unless there's something in the bill that permits that and makes sure that the government can make it stick, then I think we're all going to feel dissatisfied.
14:57
14:57
14:57
14:57
Speaker 11
-
Speaker 11
I think the noble Lord, Clement Jones, has done a lot of my work for me. I want to thank everyone who contributed, and I think I was, you know, really struck by the expertise in this room. And and we started this morning talking about the lived experience and the importance of lived experience. And I do say that very strongly to the minister. I have been in the House long enough to see acts of Parliament passed, see them, go see them regulated and see them fail , because they didn't understand really how they were going to hit when, you know, when they were in the world.
And I think that this, this grouping is really worth, it's really worth listening to particularly, you know, those comments on one six, seven, I think on, on 74. I just want to say both to the noble Viscount Camrose and also to the noble lady, the minister. It is such a high bar of connivance in this amendment. It is such a high bar. There is no accident. I mean, it is you know, the words are deliberate and knowingly and, you know, etcetera, etcetera.
I've read them out as part of my introduction. And so I will take up the offer of the the noble viscount to come and speak to him and persuade him. And, and I do ask, you know, the noble lady, the Minister, to really think about it, because I think we have heard that culture doesn't change without an incentive. And this is an incentive. Yeah. This is an incentive to say that that if you are seen to grossly mislead and undermined the regulation, then you are liable.
I think, my Lords, that is what good law does.
And I think that this, this grouping is really worth, it's really worth listening to particularly, you know, those comments on one six, seven, I think on, on 74. I just want to say both to the noble Viscount Camrose and also to the noble lady, the minister. It is such a high bar of connivance in this amendment. It is such a high bar. There is no accident. I mean, it is you know, the words are deliberate and knowingly and, you know, etcetera, etcetera.
I've read them out as part of my introduction. And so I will take up the offer of the the noble viscount to come and speak to him and persuade him. And, and I do ask, you know, the noble lady, the Minister, to really think about it, because I think we have heard that culture doesn't change without an incentive. And this is an incentive. Yeah. This is an incentive to say that that if you are seen to grossly mislead and undermined the regulation, then you are liable.
I think, my Lords, that is what good law does.
15:00
15:00
15:00
15:00
Speaker 16
-
Speaker 16
Is it your lordships pleasure this amendment be withdrawn. The amendment is by leave withdrawn. Question is that clause 22 stand part of the Bill. As many to that opinion will say, content and not content. The contents have it. Question is that schedule one be the first schedule to the bill, as amended, of that opinion will say content. Content contrary, not content. The contents have it. The question is that clause 23 stand part of the Bill, as amended, of that opinion will say content.
Content contrary, not content. The contents have it after clause 23. Amendment 75. Baroness Kidron. Not moved. not moved, not moved. The question is that schedule two be the second schedule to the bill. As Minister, that opinion will say content.
Content contrary, not content. The contents have it after clause 23. Amendment 75. Baroness Kidron. Not moved. not moved, not moved. The question is that schedule two be the second schedule to the bill. As Minister, that opinion will say content.
15:00
15:00
15:00
Speaker 16
-
Speaker 16
Opinion will say content. content content the contrary not content. The contents have it in clause 24. Amendment 76. Lord Birt not moved, not moved and 77 Lord Birt not moved. Amendment 78 not moved. The question is that clause 24 stand part of the bill, as many of that opinion will say, content content to the contrary, not content the contents of it after clause 24.
Amendment 79 Baroness Ludford.
Amendment 79 Baroness Ludford.
15:01
Speaker 1
-
Speaker 1
My Lords, this is a group of rather wide scope. And I, I I I'm kicking off and then I will also speak to amendment 168 in my name, so as not to ask to speak twice, which is on an entirely different subject from 79. So I think we're going to we're going to have probably quite a long debate on, on this group. Anyway, 79 is about including political parties within this within this bill.
And my my honourable friend Victoria Collins MP made the same case in the other place to tabling a new clause to designate political parties as carrying out essential activities. And, you know, we've we've we've discussed several days that cybersecurity is, is not just a technical matter confined to server rooms and I.T. department. It's a matter of national resilience, economic strength, functioning of society, and I would argue, democratic integrity. And on this last count, the bill is silent.
And I would remind the committee that between August 2021 and October 22nd, as we later learnt, hostile actors sat undetected inside the systems of the Electoral Commission and exfiltrated copies of the electoral registered an intrusion the government attributed to a China State affiliated actor, and there were apparently reconnaissance against the email accounts of parliamentarians who had spoken out against China. And so we're hearing more and more denial of service attacks and other incidents affecting critical national infrastructure, which may have some knock on effect to our democratic structures.
When you think what political parties hold membership lists, canvassing databases covering millions of electors, data on political opinion, special category data of the most sensitive kind, perhaps precisely the material valuable for espionage, for transnational repression, and for targeted disinformation in a campaign period. And when you think about the kind of defences that which are protecting this information, well, you know, those of us who have experience of local party activity, we're normally talking about a small office with a handful of staff and a great many volunteers, not, you know, massive enterprises that themselves have been the subject of cyber attacks.
So we perhaps have a quite a weak link at the heart of our democracy. The National Cyber Security Centre does have Defending Democracy guidance, but this is voluntary opt in and unenforced. There's no duty to report an incident, no assessment framework, no designated regulator, and no floor beneath which a party cannot fall. So I, I think those there is weakness regarding the cybersecurity, political parties and indeed of electoral infrastructure.
Now, I'm sure the minister will tell me that parties are not infrastructure. Indeed not. But the bill is is encompassing data center and managed service providers on the basis that disruption disruption there would significantly affect day to day functioning of society. Well, if the compromise of a major party's voter database in the final week of a general election would not meet that test, I struggled to think what would. Nothing in this amendment invites government into the internal affairs of parties.
It asks only that organisations through which the British people exercise their democratic voice are held to a basic standard of resilience. Democracy is essential infrastructure. It's a privilege that we must defend with the utmost priority, and I believe the bill should reflect that. So if I may, Madam Deputy Speaker, I will just cover the other completely different matter, which is in my amendment 168. Now, this is this was this amendment was prompted because probably like others of you in in July, I had several notifications from the charity Arts Organisation, an academic organization, I can't remember.
I think I had 4 or 5 altogether where which warning me of a data breach. And they. This was a named company. I think it's been in the public domain called beacon, and they had been they'd experienced a cyber security incident involving unauthorized access to their systems. And as I understand it, they they store data on the membership and customer of a lot of organisations, about a thousand I think I read and my, I think my this is a probing amendment because I'm really asking the government, where do organizations like this sit? They.
I mean, I think they're variously described as a customer relationship management service provider or a software as a service relationship provider. And I mean, I don't think they fall into RSP or RDSP. They're not cloud computing. They're not an online marketplace search engine and, and so on. They're probably not well, I don't know, maybe arguably a managed service I.t management support , maintenance or Maintenance or monitoring.
I don't know precisely what the relationship really is between the organization and this beacon. Customer relationship management service provider. I don't really understand. And that's really the point of the amendment to to find out if the government knows where they sit in the in if you like, in the , in the. In the sphere of, of cyber and data services, because they, they will often have a lot of personal data.
Date of birth, contact data, records of donations and memberships, booking of events quite a lot where you could profile somebody and find out a lot about them. So it's quite risky to have all that in unauthorized hands. So what I'm asking the the, the government besides, I think this these breaches triggered reporting duties to the information commissioner under the GDPR. But I don't think, as far as I know, that a comparable incident would trigger this bill's incident reporting duties.
So I don't know where they fit. And I'm really asking the noble lady, the minister, to to tell me how they where they live in the in the ecosystem, really, and what, what , what could or should be be done to try and support their their support for the organisations that they work for. I, yeah, I beg to move amendment 79. I think.
And my my honourable friend Victoria Collins MP made the same case in the other place to tabling a new clause to designate political parties as carrying out essential activities. And, you know, we've we've we've discussed several days that cybersecurity is, is not just a technical matter confined to server rooms and I.T. department. It's a matter of national resilience, economic strength, functioning of society, and I would argue, democratic integrity. And on this last count, the bill is silent.
And I would remind the committee that between August 2021 and October 22nd, as we later learnt, hostile actors sat undetected inside the systems of the Electoral Commission and exfiltrated copies of the electoral registered an intrusion the government attributed to a China State affiliated actor, and there were apparently reconnaissance against the email accounts of parliamentarians who had spoken out against China. And so we're hearing more and more denial of service attacks and other incidents affecting critical national infrastructure, which may have some knock on effect to our democratic structures.
When you think what political parties hold membership lists, canvassing databases covering millions of electors, data on political opinion, special category data of the most sensitive kind, perhaps precisely the material valuable for espionage, for transnational repression, and for targeted disinformation in a campaign period. And when you think about the kind of defences that which are protecting this information, well, you know, those of us who have experience of local party activity, we're normally talking about a small office with a handful of staff and a great many volunteers, not, you know, massive enterprises that themselves have been the subject of cyber attacks.
So we perhaps have a quite a weak link at the heart of our democracy. The National Cyber Security Centre does have Defending Democracy guidance, but this is voluntary opt in and unenforced. There's no duty to report an incident, no assessment framework, no designated regulator, and no floor beneath which a party cannot fall. So I, I think those there is weakness regarding the cybersecurity, political parties and indeed of electoral infrastructure.
Now, I'm sure the minister will tell me that parties are not infrastructure. Indeed not. But the bill is is encompassing data center and managed service providers on the basis that disruption disruption there would significantly affect day to day functioning of society. Well, if the compromise of a major party's voter database in the final week of a general election would not meet that test, I struggled to think what would. Nothing in this amendment invites government into the internal affairs of parties.
It asks only that organisations through which the British people exercise their democratic voice are held to a basic standard of resilience. Democracy is essential infrastructure. It's a privilege that we must defend with the utmost priority, and I believe the bill should reflect that. So if I may, Madam Deputy Speaker, I will just cover the other completely different matter, which is in my amendment 168. Now, this is this was this amendment was prompted because probably like others of you in in July, I had several notifications from the charity Arts Organisation, an academic organization, I can't remember.
I think I had 4 or 5 altogether where which warning me of a data breach. And they. This was a named company. I think it's been in the public domain called beacon, and they had been they'd experienced a cyber security incident involving unauthorized access to their systems. And as I understand it, they they store data on the membership and customer of a lot of organisations, about a thousand I think I read and my, I think my this is a probing amendment because I'm really asking the government, where do organizations like this sit? They.
I mean, I think they're variously described as a customer relationship management service provider or a software as a service relationship provider. And I mean, I don't think they fall into RSP or RDSP. They're not cloud computing. They're not an online marketplace search engine and, and so on. They're probably not well, I don't know, maybe arguably a managed service I.t management support , maintenance or Maintenance or monitoring.
I don't know precisely what the relationship really is between the organization and this beacon. Customer relationship management service provider. I don't really understand. And that's really the point of the amendment to to find out if the government knows where they sit in the in if you like, in the , in the. In the sphere of, of cyber and data services, because they, they will often have a lot of personal data.
Date of birth, contact data, records of donations and memberships, booking of events quite a lot where you could profile somebody and find out a lot about them. So it's quite risky to have all that in unauthorized hands. So what I'm asking the the, the government besides, I think this these breaches triggered reporting duties to the information commissioner under the GDPR. But I don't think, as far as I know, that a comparable incident would trigger this bill's incident reporting duties.
So I don't know where they fit. And I'm really asking the noble lady, the minister, to to tell me how they where they live in the in the ecosystem, really, and what, what , what could or should be be done to try and support their their support for the organisations that they work for. I, yeah, I beg to move amendment 79. I think.
15:10
15:10
Speaker 9
-
Speaker 9
My Lords, I wish to speak to amendment 81 a in my name. If I can just also say that I was glad to have my name to amendment three, eight, and 13 that were in the name of the noble Baroness, Lady Kidron. And I'm sorry that I was not able to speak to those on Tuesday due to some caring responsibilities. But turning to 81 a. This amendment is all about education, and our British educational institutions sit at the heart of our communities.
They are key to developing our children and young people and helping them grow, supporting them through the most important developments of their lives. This year, the UK was ranked as having the third best public education system in the world, something that we should be so proud of, but also something that we must safeguard. We've seen that our education system has changed rapidly in the past decade. We now have exam results revealed via an app. We've got homework being set through online portals.
I receive it weekly for both of my children. An increasingly vast amounts of student data is being stored online, including around attainment. If our young people. To be properly supported, that support must extend beyond the classroom to the network and information systems now central to their education, a point only reinforced as universities and colleges continue to further embrace online learning. Exam results determine a young person's future opportunities. And it's just a couple of weeks ago that we'll all remember the pictures in the press and the interviews with young people, the elation of many 16 and 18 year olds as they revealed and received their GCSE and A-level results.
We owe it to the next generation to do everything we possibly can to give them the best possible chances, to protect the integrity of that system that determines their future, and to prevent the chaos that could follow. If, say, for example, university, place allocation, clearing or accommodation processes could not proceed. And for anyone that might have friends or family whose 18 year olds are currently going through that process, it's frenetic enough at this time as scrambling to get a place for young people that might not have made their grades changing universities, changing courses, trying to get a university spot, a university accommodation.
We've already seen what chaos looks like on a small scale, and you perhaps will recall students who sat their A-level physics paper with Cambridge International that had their results voided after just one paper was leaked online, with a substitute mark calculated from other components. That was just one paper from one exam board, and it was still enough to undermine confidence in the results for every student affected. We need to look need to look no further than the terrible experience very recently in India, where the National Testing Agency's medical entrance exam results were withdrawn after a paper was leaked, it triggered mass protests and, tragically, at least 21 reported suicides among students who had sat the exam.
If a single compromised paper can cause that level of devastation, we cannot afford to leave our education system exposed to a compromise on a grand scale. So this amendment, amendment 81 A, would establish that the education sector is an essential activity by requiring the Secretary of State to make regulations under part three of the Bill. This would bring within scope any institution that provides primary, secondary, further or higher education and vocational training.
It includes exam boards involved in setting, marking or awarding grades, higher education, admission bodies and anybody that's central to the provision of primary or secondary education that holds substantial volumes of student or staff data. The obligations would require that education bodies take appropriate and proportionate technical and organisational measures to manage risks to the security of their network and information systems that they take appropriate and proportionate measures to prevent and minimize the impact of cyber incidents, with a view to ensuring continuity of service, and that they have regard to the state of the threat and ensure that a high level of security appropriate to the risk and have regard to any relevant guidance issued by their regulator.
My Lords, I hope that this is a simple amendment. It's a simple amendment to protect the integrity and security of our children and young people's future in this country. We know, as we've already heard during the course of some of these debates, about the increasing level of evidence that cyber attacks are becoming more prevalent and easier to conduct, particularly as a result of artificial intelligence. And I look forward to many more debates about why this bill should consider that very seriously, and include it in our education system must be equipped to meet that threat, and it should be contained within this bill.
And to fail to do so, I think, would let down our children and young people and undermine the excellence of our British education. I beg to move my amendment.
They are key to developing our children and young people and helping them grow, supporting them through the most important developments of their lives. This year, the UK was ranked as having the third best public education system in the world, something that we should be so proud of, but also something that we must safeguard. We've seen that our education system has changed rapidly in the past decade. We now have exam results revealed via an app. We've got homework being set through online portals.
I receive it weekly for both of my children. An increasingly vast amounts of student data is being stored online, including around attainment. If our young people. To be properly supported, that support must extend beyond the classroom to the network and information systems now central to their education, a point only reinforced as universities and colleges continue to further embrace online learning. Exam results determine a young person's future opportunities. And it's just a couple of weeks ago that we'll all remember the pictures in the press and the interviews with young people, the elation of many 16 and 18 year olds as they revealed and received their GCSE and A-level results.
We owe it to the next generation to do everything we possibly can to give them the best possible chances, to protect the integrity of that system that determines their future, and to prevent the chaos that could follow. If, say, for example, university, place allocation, clearing or accommodation processes could not proceed. And for anyone that might have friends or family whose 18 year olds are currently going through that process, it's frenetic enough at this time as scrambling to get a place for young people that might not have made their grades changing universities, changing courses, trying to get a university spot, a university accommodation.
We've already seen what chaos looks like on a small scale, and you perhaps will recall students who sat their A-level physics paper with Cambridge International that had their results voided after just one paper was leaked online, with a substitute mark calculated from other components. That was just one paper from one exam board, and it was still enough to undermine confidence in the results for every student affected. We need to look need to look no further than the terrible experience very recently in India, where the National Testing Agency's medical entrance exam results were withdrawn after a paper was leaked, it triggered mass protests and, tragically, at least 21 reported suicides among students who had sat the exam.
If a single compromised paper can cause that level of devastation, we cannot afford to leave our education system exposed to a compromise on a grand scale. So this amendment, amendment 81 A, would establish that the education sector is an essential activity by requiring the Secretary of State to make regulations under part three of the Bill. This would bring within scope any institution that provides primary, secondary, further or higher education and vocational training.
It includes exam boards involved in setting, marking or awarding grades, higher education, admission bodies and anybody that's central to the provision of primary or secondary education that holds substantial volumes of student or staff data. The obligations would require that education bodies take appropriate and proportionate technical and organisational measures to manage risks to the security of their network and information systems that they take appropriate and proportionate measures to prevent and minimize the impact of cyber incidents, with a view to ensuring continuity of service, and that they have regard to the state of the threat and ensure that a high level of security appropriate to the risk and have regard to any relevant guidance issued by their regulator.
My Lords, I hope that this is a simple amendment. It's a simple amendment to protect the integrity and security of our children and young people's future in this country. We know, as we've already heard during the course of some of these debates, about the increasing level of evidence that cyber attacks are becoming more prevalent and easier to conduct, particularly as a result of artificial intelligence. And I look forward to many more debates about why this bill should consider that very seriously, and include it in our education system must be equipped to meet that threat, and it should be contained within this bill.
And to fail to do so, I think, would let down our children and young people and undermine the excellence of our British education. I beg to move my amendment.
15:15
15:15
15:15
15:15
15:15
Speaker 14
-
Speaker 14
Just just very, very briefly. As I made clear earlier in the week, I think this bill scope of this bill is far too narrow. And I suggested and continue and will continue to suggest that we have to extend the definition of essential services. I remind us all, despite all the things we've been talking about this afternoon, the organisations in the frame in this bill as drafted, are our national infrastructure sectors, not the great width of the economy or the public sector.
And I've suggested in my amendments that we have to have a definition for essential services, which covers the economy J, L, A and Marks and Spencers not covered at the moment, the bill society in general. And I think we've just heard an excellent account of why education has to be one of those that is included, and defence and security. I don't think we should be picking and mixing and putting on the face of the bill a small number of sectors.
We need a conceptual approach to what we bring into the orbit of the bill, and we need a process in the bill to ensure that that that happens. My Lords, my Lords. just quickly, could. I
And I've suggested in my amendments that we have to have a definition for essential services, which covers the economy J, L, A and Marks and Spencers not covered at the moment, the bill society in general. And I think we've just heard an excellent account of why education has to be one of those that is included, and defence and security. I don't think we should be picking and mixing and putting on the face of the bill a small number of sectors.
We need a conceptual approach to what we bring into the orbit of the bill, and we need a process in the bill to ensure that that that happens. My Lords, my Lords. just quickly, could. I
15:17
Speaker 13
-
Speaker 13
just back up noble Baroness Ludford on Amendment 168, because I, like many other lords, have been involved with a variety of charities which were impacted by the cyber security breach at beacon CRM, which has about 1500 charities, that it restores stores an enormous amount of data, personal data. And I looked at its website, and perhaps this is to emphasize to the noble lady, the minister, the problem that we face. This is what this website, which had a major security breach in July, still says about its security the secure choice for security conscious charities.
Beacon has all the security certifications and features that you should expect in your CRM, and we're adding more all the time. We are ISO 27,001 2022 certified. We have Cyber Essentials Plus, which is the highest level of certification in the UK government's Cyber Essentials scheme and includes a technical audit of the beacon team's end point devices. We have world class infrastructure and we are a UK based system, so if I was a potential customer of beacon reading all of that, I would feel obviously a very false sense of security about the level of of knowledge and the level of defence that their systems have, and that is clearly not the case.
So we have a clear major mismatch between the way the degree of confidence that organisations such as beacon have in their own cyber security, and the reality of how feeble and weak it actually is. So I think before this happens again and again and again, it would be helpful to look at this more closely and see whether we need to do more.
Beacon has all the security certifications and features that you should expect in your CRM, and we're adding more all the time. We are ISO 27,001 2022 certified. We have Cyber Essentials Plus, which is the highest level of certification in the UK government's Cyber Essentials scheme and includes a technical audit of the beacon team's end point devices. We have world class infrastructure and we are a UK based system, so if I was a potential customer of beacon reading all of that, I would feel obviously a very false sense of security about the level of of knowledge and the level of defence that their systems have, and that is clearly not the case.
So we have a clear major mismatch between the way the degree of confidence that organisations such as beacon have in their own cyber security, and the reality of how feeble and weak it actually is. So I think before this happens again and again and again, it would be helpful to look at this more closely and see whether we need to do more.
15:19
15:19
15:19
Speaker 17
-
Speaker 17
My Lords. I think the noble Lord Birt was right to remind us that perhaps we need something rather more generic and comprehensive when we're assessing whether or not a particular sector should be brought into the Bill. But, my Lords, that doesn't mean to say that we shouldn't use this group of amendments to illustrate that the bill at the moment is by no means nearly comprehensive enough in terms of the way that the bill is structured and the sectors that it contains.
The bill remains stubbornly wedded to what you might call the traditional 2018 five utilities model water, energy, transport, health and core telecoms. But my Lords, you know, we've moved on from that world today. Systemic digital risk does not respect arbitrary, arbitrary what might be called 20th century utility boundaries for critical national infrastructure and adversary seeking to disrupt our society or blackmail. The UK does not need to compromise a power station.
They can strike our democratic institutions, our food distribution networks, our university research labs, our orbital satellites , or our software supply chains so that, looking first at amendment 79, tabled by my noble friend Baroness Ludford, this designates services supporting registered political parties as essential activities and my Lords hostile state actors, from Russian GRU units to Chinese state sponsored espionage networks are actively targeting our political parties. As my own friend and my noble friend argued, have argued strongly , political parties are a vital part of our constitutional machinery, yet they operate on shoestring budgets, with high staff turnovers heavily reliant on consumer grade IT and voluntary workers, while holding vast tranches of confidential voter files, donor databases and, if you might call it strategic policy intelligence, if a hostile power infiltrates or manipulates a major political party systems, the threat is not just a commercial data breach, it's the subversion of our electoral integrity and democratic sovereignty to leave our political parties outside statutory NCIS cyber cyber standards is an indefensible Democratic blind spot.
That amendment 79 decisively rectified rectifies. Turning to amendment 80, tabled by my noble friend Baroness Northover, who sadly cannot be present in the committee today. This addresses the fact that the government Bill does remain frozen in that 2018 world. It brings critical manufacturing, industrial, food production and large, large scale food distribution networks under statutory cyber cyber resilience duties. My Lords, our contemporary manufacturing and retail logistic networks are no longer purely mechanical operations.
Their vast, hyper automated, hyper automated cyber physical systems. They run on automated warehouse robotics, internet connected telemetry, and algorithmic just in time delivery pipelines. So consider the manufacturing of critical transport equipment. When Jaguar Land Rover suffered a catastrophic supply chain cyber breach, the damage was not confined to a single company balance sheet. Production lines were frozen for four months. Hundreds of component manufacturers were dragged to the brink of collapse, and the economic fallout cost between 1.6 billion and 2.1 billion, making it the costliest cyber attack in British history and forcing the state to step in with loan guarantees.
In an economy that depends entirely on vehicle transport to a large extent on vehicle transport and haulage equipment, leaving critical automotive and transport manufacturing outside statutory Ennis protections is an invitation to systemic economic blackmail. Even more acute is the vulnerability of our food supply, modern food processing and supermarket distribution operate with less than 48 hours of inventory buffer. When Marks and Spencer was hit by a major ransomware incident, it cost £300 million to remediate and wipe 99% from its statutory pre-tax profits.
As I said earlier, if a hostile state or sophisticated ransomware syndicate executes a coordinated attack against the central routing software of two major distribution operators, supermarket shelves across our cities would begin emptying within two days. Amendment 80 provides a clear, proportionate statutory safeguard. It includes an explicit turnover threshold of £12 million, ensuring that local bakeries, independent farmers and small shops face zero regulatory burden. It targets solely the industrial food processors and large scale distributors whose distribution would threaten the daily functioning of society.
In doing so, it aligns the UK with the EU's Nif2 directive, which has already brought food production, processing and critical manufacturing under statutory cyber obligations. If our European neighbours recognise that you cannot have national resilience, if your food supply can be halted by a single malicious click, why is this government leaving Britain's food supply chain completely exposed? And that brings me directly to amendment 81, in the name also of my noble friend Baroness Northover, which designates the space and satellite sector as an essential activity under part three.
My Lords, the omission of the space sector from primary cyber security legislation in 2026 is nothing short of extraordinary. The space sector is formally identified in the government's own industrial strategy as a core national growth driver. Yet this bill treats orbital infrastructure as if it was entirely invisible. Our entire critical national infrastructure, from financial transaction timestamps across the City of London, an automated container port, logistics to emergency blue light dispatch, cellular networks and high voltage grid synchronization rely absolutely on satellite positioning, navigation and timing or NDT ground truth.
Economic studies demonstrate that a five day blackout of satellite positioning systems would inflict a staggering 5.2 billion direct loss on the UK economy. Furthermore, the UK possesses world leading capability in earth observation and small satellite manufacturing, with sovereign launch facilities advancing at saxavord. But satellites, ground uplink stations and space telemetry are dual use systems. As the House of Lords Special Inquiry Committee on Space, which I sat on, has heard throughout its evidence, heard throughout its evidence sessions.
Satellite communications and orbital command links are under relentless daily cyber probing, jamming and spoofing by hostile state adversaries. An exploit deployed against a satellite operators ground command software can sever communications, blind environmental monitoring or hijack commercial orbital satellites. Amendment 81 rectifies this strategic blind spot. It places a statutory requirement on the Secretary of State within six months to make regulations, bringing the state sector the space sector, into scope as an essential activity.
It specifically covers the operation of space objects and launch facilities, satellite communications, earth observation and critical PNT services, whilst requiring the government to designate an appropriate regulatory authority such as the CAA or Ofcom, to supervise compliance. My Lords, moving on to my own amendments. Before doing that, I also welcome amendment 81, a move by the noble Baroness Lady Burger, covering the education sector. Our world class universities are the engines of the UK science and technology prowess, holding billions of pounds of cutting edge IP, defence research and quantum computing prototypes.
There are under relentless cyber cyber espionage, assault from foreign adversaries, while centralised bodies like Ucas and qualification boards, as she said, hold sensitive data on millions of young people and bringing education into scope under part three is an urgent national security necessity. And, my Lords, I've tabled new amendments 81 A, B, 81, B, C and D. These amendments address the single most gaping, indefensible and dangerous structural failure of the bill the complete and absolute exclusion of central government, public authorities, local councils and our core democratic electoral infrastructure from the scope of our national cyber security perimeters.
How can we came to be building a genuinely cyber resilient nation when the public administration itself is left out entirely in the cold? My Lords, I wish I had more time, my Lords, to expand on those three amendments, but I will content myself that, hoping that the minister will have considered those amendments and will come back with some positive with a positive response. My Lords. And of course, we strongly look forward to an answer to my noble friend and noble Lord Russell of Liverpool's questions on Amendment 168.
The bill remains stubbornly wedded to what you might call the traditional 2018 five utilities model water, energy, transport, health and core telecoms. But my Lords, you know, we've moved on from that world today. Systemic digital risk does not respect arbitrary, arbitrary what might be called 20th century utility boundaries for critical national infrastructure and adversary seeking to disrupt our society or blackmail. The UK does not need to compromise a power station.
They can strike our democratic institutions, our food distribution networks, our university research labs, our orbital satellites , or our software supply chains so that, looking first at amendment 79, tabled by my noble friend Baroness Ludford, this designates services supporting registered political parties as essential activities and my Lords hostile state actors, from Russian GRU units to Chinese state sponsored espionage networks are actively targeting our political parties. As my own friend and my noble friend argued, have argued strongly , political parties are a vital part of our constitutional machinery, yet they operate on shoestring budgets, with high staff turnovers heavily reliant on consumer grade IT and voluntary workers, while holding vast tranches of confidential voter files, donor databases and, if you might call it strategic policy intelligence, if a hostile power infiltrates or manipulates a major political party systems, the threat is not just a commercial data breach, it's the subversion of our electoral integrity and democratic sovereignty to leave our political parties outside statutory NCIS cyber cyber standards is an indefensible Democratic blind spot.
That amendment 79 decisively rectified rectifies. Turning to amendment 80, tabled by my noble friend Baroness Northover, who sadly cannot be present in the committee today. This addresses the fact that the government Bill does remain frozen in that 2018 world. It brings critical manufacturing, industrial, food production and large, large scale food distribution networks under statutory cyber cyber resilience duties. My Lords, our contemporary manufacturing and retail logistic networks are no longer purely mechanical operations.
Their vast, hyper automated, hyper automated cyber physical systems. They run on automated warehouse robotics, internet connected telemetry, and algorithmic just in time delivery pipelines. So consider the manufacturing of critical transport equipment. When Jaguar Land Rover suffered a catastrophic supply chain cyber breach, the damage was not confined to a single company balance sheet. Production lines were frozen for four months. Hundreds of component manufacturers were dragged to the brink of collapse, and the economic fallout cost between 1.6 billion and 2.1 billion, making it the costliest cyber attack in British history and forcing the state to step in with loan guarantees.
In an economy that depends entirely on vehicle transport to a large extent on vehicle transport and haulage equipment, leaving critical automotive and transport manufacturing outside statutory Ennis protections is an invitation to systemic economic blackmail. Even more acute is the vulnerability of our food supply, modern food processing and supermarket distribution operate with less than 48 hours of inventory buffer. When Marks and Spencer was hit by a major ransomware incident, it cost £300 million to remediate and wipe 99% from its statutory pre-tax profits.
As I said earlier, if a hostile state or sophisticated ransomware syndicate executes a coordinated attack against the central routing software of two major distribution operators, supermarket shelves across our cities would begin emptying within two days. Amendment 80 provides a clear, proportionate statutory safeguard. It includes an explicit turnover threshold of £12 million, ensuring that local bakeries, independent farmers and small shops face zero regulatory burden. It targets solely the industrial food processors and large scale distributors whose distribution would threaten the daily functioning of society.
In doing so, it aligns the UK with the EU's Nif2 directive, which has already brought food production, processing and critical manufacturing under statutory cyber obligations. If our European neighbours recognise that you cannot have national resilience, if your food supply can be halted by a single malicious click, why is this government leaving Britain's food supply chain completely exposed? And that brings me directly to amendment 81, in the name also of my noble friend Baroness Northover, which designates the space and satellite sector as an essential activity under part three.
My Lords, the omission of the space sector from primary cyber security legislation in 2026 is nothing short of extraordinary. The space sector is formally identified in the government's own industrial strategy as a core national growth driver. Yet this bill treats orbital infrastructure as if it was entirely invisible. Our entire critical national infrastructure, from financial transaction timestamps across the City of London, an automated container port, logistics to emergency blue light dispatch, cellular networks and high voltage grid synchronization rely absolutely on satellite positioning, navigation and timing or NDT ground truth.
Economic studies demonstrate that a five day blackout of satellite positioning systems would inflict a staggering 5.2 billion direct loss on the UK economy. Furthermore, the UK possesses world leading capability in earth observation and small satellite manufacturing, with sovereign launch facilities advancing at saxavord. But satellites, ground uplink stations and space telemetry are dual use systems. As the House of Lords Special Inquiry Committee on Space, which I sat on, has heard throughout its evidence, heard throughout its evidence sessions.
Satellite communications and orbital command links are under relentless daily cyber probing, jamming and spoofing by hostile state adversaries. An exploit deployed against a satellite operators ground command software can sever communications, blind environmental monitoring or hijack commercial orbital satellites. Amendment 81 rectifies this strategic blind spot. It places a statutory requirement on the Secretary of State within six months to make regulations, bringing the state sector the space sector, into scope as an essential activity.
It specifically covers the operation of space objects and launch facilities, satellite communications, earth observation and critical PNT services, whilst requiring the government to designate an appropriate regulatory authority such as the CAA or Ofcom, to supervise compliance. My Lords, moving on to my own amendments. Before doing that, I also welcome amendment 81, a move by the noble Baroness Lady Burger, covering the education sector. Our world class universities are the engines of the UK science and technology prowess, holding billions of pounds of cutting edge IP, defence research and quantum computing prototypes.
There are under relentless cyber cyber espionage, assault from foreign adversaries, while centralised bodies like Ucas and qualification boards, as she said, hold sensitive data on millions of young people and bringing education into scope under part three is an urgent national security necessity. And, my Lords, I've tabled new amendments 81 A, B, 81, B, C and D. These amendments address the single most gaping, indefensible and dangerous structural failure of the bill the complete and absolute exclusion of central government, public authorities, local councils and our core democratic electoral infrastructure from the scope of our national cyber security perimeters.
How can we came to be building a genuinely cyber resilient nation when the public administration itself is left out entirely in the cold? My Lords, I wish I had more time, my Lords, to expand on those three amendments, but I will content myself that, hoping that the minister will have considered those amendments and will come back with some positive with a positive response. My Lords. And of course, we strongly look forward to an answer to my noble friend and noble Lord Russell of Liverpool's questions on Amendment 168.
15:30
Speaker 6
-
Speaker 6
My, my Lords, we have heard very compelling cases from all the noble Lords who have spoken in in this in this grouping about why a particular sector should be should be included in, in all of this, and I won't go through all the list. I think that that was that was gone through very well by Clement Jones a moment ago. But I think we could all agree that each one is a compelling case. And I think that probably illustrates the wider problem, because we're almost getting into a game of cyber whack a mole here where we can see them popping up left, right and centre.
And so I think where we're trying to come at this in terms of our amendment 92 in 92 A in my name and the my noble friend Lord Camrose and Lord Holmes is to try and take a more strategic view, and very much reflecting some of the views that noble Lord, Lord Burke was mentioning earlier as well. And that's really asking the government to assess strategically important entities outside the current regime and consider whether they should be brought into scope, where cyber attack would have sufficient serious impact on the economy or the day to day functioning society.
We're not asking for another long list of businesses to be regulated because, you know, again, we need to be careful in all of this. You know, the the regulatory burdens that we're putting on people as well. Instead, what amendment 92 A is trying to do is propose a risk based test and ask the question, what would actually happen if this organisation went down? Would essential services stop? Would supply chains that are very important fail with significant parts of the economy cease to function? If the answer to those is yes, surely the government should at least assess whether that organisation belongs within our national cyber security perimeter.
This also illustrates why we need to see the National Cyber Action Plan. It was promised this summer. We are now in September. And considering, you know, this is very pertinent to everything we're talking about in committee, I'd like to ask the noble Baroness, the Minister, when will we hopefully see this plan? But also I'd like to highlight one further issue, which I think Baroness Burger illustrated very well in the area of the data held in certain organisations, particularly in the in the education case.
And, you know, we all know the reason that a lot of these organisations are attractive targets is not because of the essential services they they often carry out, but actually also because they carry enormous quantities of valuable and sensitive data. And again, this was very much my experience. I saw with the the attack on Synovus when I was health minister, and it had a massive disruption on, you know, operations and diagnostic services in London.
But the question was, why was that organisation holding so much information in the first place? You know, they had names and addresses of people going back 20 years and their test results and their full medical records, and they didn't need any of that at all. Or it could have all been anonymised to do it all. And they definitely didn't need to hold it for 20 years. So to me, the question this comes on to an amendment we'll be talking about later on is that we really need to understand, do all these public bodies, what data do they really need to hold? Because of course, if the data isn't there in the first place to be stolen, if it's not interesting, it's not valuable, then that's the best line of defence of all.
Because there's no there's no reason for there to be a cyber attack on it. And as I say, we talk further on that in terms of amendment 174 E, but the principle is directly relevant to what we're talking about here. And also, before I come to the end, I have a special request from my colleague here who I think knows a thing or two, but I'm told on good authority that the last government AI regulation, white paper, actually has a lot of relevance and synergies to here.
So I would request that maybe the minister could look at that between now and report stage to to see where, as I say, there are synergies and learnings from it all. So in summary, firstly, we should systematically identify the organisations who compromise would cause the greatest damage as per our amendment 92 A. And secondly, we should reduce both the vulnerability and their attractiveness as targets, including by reducing the data price available to the attacker as per our amendment 174 E that would come on to later on.
That to me, is genuine cyber resilience, not merely making the safe harder to crack, but wherever possible, ensuring that there's nothing valuable inside the safe to steal. So I hope the minister will respond both to the important sectors raised by noble Lords into the central question behind amendment 92. A what systematic test is the government applying to determine which strategically important organisations should fall within the Hnis regime, and whether that regulatory perimeter keeps pace as technology and the threats change?
And so I think where we're trying to come at this in terms of our amendment 92 in 92 A in my name and the my noble friend Lord Camrose and Lord Holmes is to try and take a more strategic view, and very much reflecting some of the views that noble Lord, Lord Burke was mentioning earlier as well. And that's really asking the government to assess strategically important entities outside the current regime and consider whether they should be brought into scope, where cyber attack would have sufficient serious impact on the economy or the day to day functioning society.
We're not asking for another long list of businesses to be regulated because, you know, again, we need to be careful in all of this. You know, the the regulatory burdens that we're putting on people as well. Instead, what amendment 92 A is trying to do is propose a risk based test and ask the question, what would actually happen if this organisation went down? Would essential services stop? Would supply chains that are very important fail with significant parts of the economy cease to function? If the answer to those is yes, surely the government should at least assess whether that organisation belongs within our national cyber security perimeter.
This also illustrates why we need to see the National Cyber Action Plan. It was promised this summer. We are now in September. And considering, you know, this is very pertinent to everything we're talking about in committee, I'd like to ask the noble Baroness, the Minister, when will we hopefully see this plan? But also I'd like to highlight one further issue, which I think Baroness Burger illustrated very well in the area of the data held in certain organisations, particularly in the in the education case.
And, you know, we all know the reason that a lot of these organisations are attractive targets is not because of the essential services they they often carry out, but actually also because they carry enormous quantities of valuable and sensitive data. And again, this was very much my experience. I saw with the the attack on Synovus when I was health minister, and it had a massive disruption on, you know, operations and diagnostic services in London.
But the question was, why was that organisation holding so much information in the first place? You know, they had names and addresses of people going back 20 years and their test results and their full medical records, and they didn't need any of that at all. Or it could have all been anonymised to do it all. And they definitely didn't need to hold it for 20 years. So to me, the question this comes on to an amendment we'll be talking about later on is that we really need to understand, do all these public bodies, what data do they really need to hold? Because of course, if the data isn't there in the first place to be stolen, if it's not interesting, it's not valuable, then that's the best line of defence of all.
Because there's no there's no reason for there to be a cyber attack on it. And as I say, we talk further on that in terms of amendment 174 E, but the principle is directly relevant to what we're talking about here. And also, before I come to the end, I have a special request from my colleague here who I think knows a thing or two, but I'm told on good authority that the last government AI regulation, white paper, actually has a lot of relevance and synergies to here.
So I would request that maybe the minister could look at that between now and report stage to to see where, as I say, there are synergies and learnings from it all. So in summary, firstly, we should systematically identify the organisations who compromise would cause the greatest damage as per our amendment 92 A. And secondly, we should reduce both the vulnerability and their attractiveness as targets, including by reducing the data price available to the attacker as per our amendment 174 E that would come on to later on.
That to me, is genuine cyber resilience, not merely making the safe harder to crack, but wherever possible, ensuring that there's nothing valuable inside the safe to steal. So I hope the minister will respond both to the important sectors raised by noble Lords into the central question behind amendment 92. A what systematic test is the government applying to determine which strategically important organisations should fall within the Hnis regime, and whether that regulatory perimeter keeps pace as technology and the threats change?
15:35
15:35
15:35
15:35
Speaker 7
-
Speaker 7
many. aspects of the scope of of the Bill, and I recognise the sentiment amongst the noble Lords who have spoken today about the importance of expanding the scope of the Bill. Our approach has been to target regulatory requirements to a select number of essential services while using Non-regulatory, but effective measures to improve the cyber security and resilience of the wider economy. But as I set out at second reading, I have asked my officials to work across government to consider what additional services would merit being brought into the scope of the regime in the future.
This will allow us to make a holistic and considered approach and to ensure our assessment is appropriately prioritised. I would first like to focus on the CNI sectors not already covered by the regime. I share the noble, the. The intent behind the noble Viscount Camrose is which noble Lord Markham spoke to the objective that the process to expand the scope of the regime should be rigorous and evidence based, as set out in the Bill. For something to be defined as a new essential activity under the powers of this bill, the Secretary of State must be satisfied that the activity is essential to the economy or the day to day functioning of the society in all or part of the UK.
This is reserved for the most vital activities to our nation. I believe that is to. To the point raised by the noble Lord. Lord. But I believe that is a clear test, and in reaching the decision, the relevant departments would need to carry out that risk assessment and any economic assessments and consider whether inclusion is proportionate. That is part of normal policy development, and after that, proposals would be subject to consultations and the affirmative procedure.
The noble Lord, Lord Viscount proposed in his amendment that the assessment for inclusion is carried out on an entity by entity basis, which obviously differs from the sectoral approach we have taken thus far, and in setting out the detail that would need to be published in the approach set out in the amendment, that could lead to information on individual companies which could pose commercial or or national security risks posed to them by posed to them due to their criticality.
And I do think the sectoral approach is better. And I think, as others have spoken today, that looking at the systemic approach of sectors is, is, is the right way to is the right the right way to look at what is in the statutory approach?
This will allow us to make a holistic and considered approach and to ensure our assessment is appropriately prioritised. I would first like to focus on the CNI sectors not already covered by the regime. I share the noble, the. The intent behind the noble Viscount Camrose is which noble Lord Markham spoke to the objective that the process to expand the scope of the regime should be rigorous and evidence based, as set out in the Bill. For something to be defined as a new essential activity under the powers of this bill, the Secretary of State must be satisfied that the activity is essential to the economy or the day to day functioning of the society in all or part of the UK.
This is reserved for the most vital activities to our nation. I believe that is to. To the point raised by the noble Lord. Lord. But I believe that is a clear test, and in reaching the decision, the relevant departments would need to carry out that risk assessment and any economic assessments and consider whether inclusion is proportionate. That is part of normal policy development, and after that, proposals would be subject to consultations and the affirmative procedure.
The noble Lord, Lord Viscount proposed in his amendment that the assessment for inclusion is carried out on an entity by entity basis, which obviously differs from the sectoral approach we have taken thus far, and in setting out the detail that would need to be published in the approach set out in the amendment, that could lead to information on individual companies which could pose commercial or or national security risks posed to them by posed to them due to their criticality.
And I do think the sectoral approach is better. And I think, as others have spoken today, that looking at the systemic approach of sectors is, is, is the right way to is the right the right way to look at what is in the statutory approach?
15:38
Speaker 17
-
Speaker 17
I'm sorry to interrupt the Minister, but I think clarification along the way would be very helpful. She seems to be she's asked her officials to see what other sectors should be brought in, and she's given an indication of the kind of test. But my Lords, we're dealing with a bit of more fog here. Is that test going to be as she promising as something in primary legislation, or is it secondary legislation that's going to appear in, or is it just going to be something that the government policy will cover? And we will have no say on the kinds of sectors that should be included, my Lords.
I mean, for instance, the minister is the space minister. Do we have an indication that space or any of the key activities within space are going to be included? Do we have any white smoke from the department as to whether or not that is a sector which is going to be included, or are we going to hear by report stage what sectors might be included? It's all a bit vague, my Lords, and I think that doesn't give us a great deal of assurance.
I mean, for instance, the minister is the space minister. Do we have an indication that space or any of the key activities within space are going to be included? Do we have any white smoke from the department as to whether or not that is a sector which is going to be included, or are we going to hear by report stage what sectors might be included? It's all a bit vague, my Lords, and I think that doesn't give us a great deal of assurance.
15:39
Speaker 7
-
Speaker 7
I was referring to the process by which sectors can be brought into scope of the bill, as set out in the Bill, using the powers in the bill, which would follow the process I just mentioned, which would be subject to consultation and the affirmative procedure. So that would be that would that is the process I'm referring to.
15:39
Speaker 17
-
Speaker 17
But the powers, my Lords are further down the track. They're under secondary legislation. I'm assuming that the minister is promising that there will be. The Secretary of State will set out the criteria by which a new sector is brought in. Is that right? So do we have any indication of what I mean, apart from what the minister says today has said today in response particularly to the noble Lord Markham, do we have any indication as to what those criteria are going to be?
15:40
Speaker 7
-
Speaker 7
I highlighted a few of those criteria in the sense of the the the essential, the extent to which the activity is essential to the economy or the day to day functioning of the society or part of the UK. Obviously, we have already the list of critical national infrastructure. We need to talk. We need to go through a whole process. As others have mentioned earlier, we need to make our assessment.
We would then need to consult with industry on that. So there's you know, there is a process to go through here. I do think that that that process of consultation and talking to industry or any affected sector is absolutely critical to this. I'm absolutely happy to update Noble Lords and engage further ahead of report stage on this. In terms of the report that is referenced in amendment 92. A, I don't think I would I don't think we need a statutory obligation to bring this report back as set out.
And as I also mentioned, the particular focus on entities rather than sectors, I think I think it's it's better to look at the sectoral approach.
We would then need to consult with industry on that. So there's you know, there is a process to go through here. I do think that that that process of consultation and talking to industry or any affected sector is absolutely critical to this. I'm absolutely happy to update Noble Lords and engage further ahead of report stage on this. In terms of the report that is referenced in amendment 92. A, I don't think I would I don't think we need a statutory obligation to bring this report back as set out.
And as I also mentioned, the particular focus on entities rather than sectors, I think I think it's it's better to look at the sectoral approach.
15:41
15:41
Speaker 7
-
Speaker 7
I am offering. And so, yes, I'm happy to have you confirmed that that would be good, that I'm absolutely offering that as part of the engagement ahead of report stage. I absolutely hear the numerous areas that have been raised for inclusion in the bill, and I do think we should do so. Look at these in a methodical and sensible way , and look at the implications, as we have previously been discussing, for the obligations that are going to be placed on any entities that come within the scope of the bill incident reporting, board, accountability, and so on, so that we do this in a very sensible manner.
So that that is why I think this is the right approach to take.
So that that is why I think this is the right approach to take.
15:42
15:42
Speaker 7
-
Speaker 7
No, absolutely. And if I. I absolutely intend to talk about the public sector. I think given the the the numerous sectors that have been raised, I also do want to respond individually to each of the sectors because it is absolutely the case. I agree that all sectors need to improve their cyber resilience. It is not a case of only those who are in the regulatory perimeter, and it is also not only the way to improve, we should improve things right now and there is funding.
There are activities going into all of these sectors which may be people may that we can talk about sometimes with public funding, sometimes with public advice, sometimes through industry groups. I think I've talked a little bit already about the sort of cyber pledge and the Cyber Resilience Pledge, which over 100 companies have now signed, which sets out the absolute best practice about what actions to take, including making cyber a board level responsibility and following the cyber governance code of practice, signing up to the early warning service and taking a risk based approach to requiring cyber essentials across supply chains in the retail sector, the deepest industry led retail sector Council is working with experts and business representatives to consider cyber security in respect of the space sector, this is absolutely critical.
I couldn't agree more the importance of PA, the importance of comms underpins a huge amount of UK economic activity, and the UK Space Agency is already strengthening cyber resilience in practice through the development of a cyber space cyber assurance framework for the space sector, intending to help operators understand and demonstrate cyber resilience in a proportionate and practical way. And the UK s A also supports the provision of threat briefings and is working with industry on the potential development of a space information sharing analysis centre that would improve the flow of threat information, warnings and good practice between government and industry, and support links to international networks such as the US led global space Isac model, so that would help operators understand emerging threats and act quickly.
There are activities going into all of these sectors which may be people may that we can talk about sometimes with public funding, sometimes with public advice, sometimes through industry groups. I think I've talked a little bit already about the sort of cyber pledge and the Cyber Resilience Pledge, which over 100 companies have now signed, which sets out the absolute best practice about what actions to take, including making cyber a board level responsibility and following the cyber governance code of practice, signing up to the early warning service and taking a risk based approach to requiring cyber essentials across supply chains in the retail sector, the deepest industry led retail sector Council is working with experts and business representatives to consider cyber security in respect of the space sector, this is absolutely critical.
I couldn't agree more the importance of PA, the importance of comms underpins a huge amount of UK economic activity, and the UK Space Agency is already strengthening cyber resilience in practice through the development of a cyber space cyber assurance framework for the space sector, intending to help operators understand and demonstrate cyber resilience in a proportionate and practical way. And the UK s A also supports the provision of threat briefings and is working with industry on the potential development of a space information sharing analysis centre that would improve the flow of threat information, warnings and good practice between government and industry, and support links to international networks such as the US led global space Isac model, so that would help operators understand emerging threats and act quickly.
15:45
15:45
15:45
Speaker 7
-
Speaker 7
It is not the same. I'm. What I wish to stress is that the importance of strengthening cyber resilience can happen outside of having legislation being put in place, that there are many efforts that can go on to improve cyber resilience. Just moving on to the noble Baroness Ludford amendment and her question about the scope of the. And the noble Lord, Lord Russell of Liverpool's questions about CRMs and so on.
I don't know the specifics of this CRM, so I am very happy to write a hearing the sort of attributes that were enumerated for its characteristics. Businesses that offer software as a service are in the scope of regulations as cloud computing services under the DSP definition, if it meets the if it meets the definitions in the bill. But I don't know in. In the case of the particular company that you mentioned, whether these would meet any definitions in the bill, obviously, there are data protection legislation in place already, and processes are meant to have the systems in place for regular testing, assessing and evaluating the effectiveness of their measures to ensure the security of that processing.
And that is legislation that is already in place. If I move on to the public sector and to respond to the the point, the question from Lord Birt and the noble Lord, Lord Clement Jones, the government is already taking equivalent steps to secure its own essential activities through the Government Cyber Action Plan, published in January this year. The Government Cyber Action Plan applies to government departments, arm's length bodies and wider public sector organisations. It sets out clear expectations, targets and milestones at all levels to transform cyber security and resilience in the public sector.
The outcomes of the plan are aligned with the outcomes of the Bill. There will be a consistent approach to strengthening cyber resilience across the public sector, and government departments are accountable for setting expectations and overseeing resilience within the sectors and organisations within their purview. Whilst individual organisations remain responsible for managing their own cyber security and resilience. Which brings me on to amendment 81.
I don't know the specifics of this CRM, so I am very happy to write a hearing the sort of attributes that were enumerated for its characteristics. Businesses that offer software as a service are in the scope of regulations as cloud computing services under the DSP definition, if it meets the if it meets the definitions in the bill. But I don't know in. In the case of the particular company that you mentioned, whether these would meet any definitions in the bill, obviously, there are data protection legislation in place already, and processes are meant to have the systems in place for regular testing, assessing and evaluating the effectiveness of their measures to ensure the security of that processing.
And that is legislation that is already in place. If I move on to the public sector and to respond to the the point, the question from Lord Birt and the noble Lord, Lord Clement Jones, the government is already taking equivalent steps to secure its own essential activities through the Government Cyber Action Plan, published in January this year. The Government Cyber Action Plan applies to government departments, arm's length bodies and wider public sector organisations. It sets out clear expectations, targets and milestones at all levels to transform cyber security and resilience in the public sector.
The outcomes of the plan are aligned with the outcomes of the Bill. There will be a consistent approach to strengthening cyber resilience across the public sector, and government departments are accountable for setting expectations and overseeing resilience within the sectors and organisations within their purview. Whilst individual organisations remain responsible for managing their own cyber security and resilience. Which brings me on to amendment 81.
15:48
15:48
15:48
Speaker 7
-
Speaker 7
Well, the Cyber Action Plan is a very thorough document, which sets out a plan over many years to improve the the cyber resilience of the government and the public sector, which I think we all agree is absolutely needed. So to the fact that there are incidents still occurring in the in the public sector reinforces the need to act. We will publish the Cyber Action Plan. And as I mentioned two days ago, I will keep a.
The committee and the House updated on progress on that. Just in terms of education, this is incredibly an important sector, and the Department of Education takes an active approach to supporting the sector. It includes the Cyber Security Hub hub , providing schools in England with guidance and the standards for schools and colleges help institutions understand their cyber security requirements, and colleges have been required to meet cyber essentials since 2024, with more than 80% of colleges now meeting this requirement.
Coming on to the. The question of. Mhclg and local government. They are taking also meaningful steps and working with local authorities to increase their cyber defenses. This includes the rollout of cyber assessment framework for local government, which would be the equivalent to what is required in the cyber Bill and the recently proposed revisions to the best value statutory guidance to set new expectations for local authorities on cyber resilience, and that best value duty provides an immediate and proportionate route to improving through existing governance and accountability mechanisms.
In addition, Mhg is Mhclg is supporting councils directly on the question of electoral infrastructure and political parties and amendments. 79 and 81 D this is also incredibly important as as noble lords have set out and the government works with NTSC to mitigate risks there. MH CLG specifically works with local authorities to strengthen their electoral cyber resilience and ensure electoral data is adequately protected, and the Joint Election Security and Preparedness Unit has responsibility for coordinating election security, and the MH CLG Digital Electoral Services team maintains robust incident response arrangements to protect electoral systems and citizen data.
And I think, as Baroness Ludford mentioned, the NCS also has a broad package of support to political parties, candidates and elected representatives, and this includes regular engagement with parties who are able to access the NCS, Active Cyber Defence Services, as well as providing tailored advice to parties and candidates. So the reason I set all of this out is because what I think the motivation behind bringing these into scope is to engender further action.
What I want to emphasize is that further action is happening. Whether or not these are within the scope of the regulatory perimeter.
The committee and the House updated on progress on that. Just in terms of education, this is incredibly an important sector, and the Department of Education takes an active approach to supporting the sector. It includes the Cyber Security Hub hub , providing schools in England with guidance and the standards for schools and colleges help institutions understand their cyber security requirements, and colleges have been required to meet cyber essentials since 2024, with more than 80% of colleges now meeting this requirement.
Coming on to the. The question of. Mhclg and local government. They are taking also meaningful steps and working with local authorities to increase their cyber defenses. This includes the rollout of cyber assessment framework for local government, which would be the equivalent to what is required in the cyber Bill and the recently proposed revisions to the best value statutory guidance to set new expectations for local authorities on cyber resilience, and that best value duty provides an immediate and proportionate route to improving through existing governance and accountability mechanisms.
In addition, Mhg is Mhclg is supporting councils directly on the question of electoral infrastructure and political parties and amendments. 79 and 81 D this is also incredibly important as as noble lords have set out and the government works with NTSC to mitigate risks there. MH CLG specifically works with local authorities to strengthen their electoral cyber resilience and ensure electoral data is adequately protected, and the Joint Election Security and Preparedness Unit has responsibility for coordinating election security, and the MH CLG Digital Electoral Services team maintains robust incident response arrangements to protect electoral systems and citizen data.
And I think, as Baroness Ludford mentioned, the NCS also has a broad package of support to political parties, candidates and elected representatives, and this includes regular engagement with parties who are able to access the NCS, Active Cyber Defence Services, as well as providing tailored advice to parties and candidates. So the reason I set all of this out is because what I think the motivation behind bringing these into scope is to engender further action.
What I want to emphasize is that further action is happening. Whether or not these are within the scope of the regulatory perimeter.
15:52
Speaker 9
-
Speaker 9
I ask the minister on that particular point. Then ministers pointed to three examples of where education is is considering issues around cyber security. Specifically, it was around schools and 80%, only 80% of colleges. One of the concerns I outlined in my contribution was about around the examining bodies for both secondary and for universities as well, and there was no mention of universities. I understand a bit more about how they are currently being considered, if they're not going to be included within the scope of this bill.
15:52
Speaker 7
-
Speaker 7
Well, all all the general approach is that the lead government department has responsibility for ensuring cyber security in the areas that they cover. I will need to write to my noble friend , specifically on exam boards and examining authorities. I know that DfE does support bodies who support higher education and further education, but for further details I will come back to her. But more broadly, let me just come back to the point that I am very happy to talk further with noble Lords between now and report, and indeed, perhaps after report on the approach to assessing what should be within the regulatory perimeter and at what speed that can be advanced.
15:53
Speaker 8
-
Speaker 8
Before the minister sits down, could I ask a couple of questions and make one comment that the the. The question is. More the more we hear about the conversation that's taking place in in the discussion of the bill, the more anomalous the sectors that have been chosen for for included in the in the scheme becomes. Let me give you an example of of space. Plenty of us now receive our internet connection via a satellite.
It's an intimate part of the networking system of cyber security, inevitably. And what we appear to be told is that some parts of the telecoms internet world is going to be governed by the bill and other parts which are equally integrated and important part of it are going to be done separately by some special different arrangements, but not included. I as I understand what the minister said about space, it's not going to be done in this bill.
Greatest possible respect to the minister doesn't make sense. So my question is really, could could in the in the in the period we now have ahead of us, the government have another look at the whole question of the scope of the bill, because that does seem to me to be, you know, one of the one of the problems that lies between us. And as a result, what you'll find is that members are now trying to shove into the bill on the grounds that they are essential services, all sorts of things, some of which clearly, in my view, do need to be there, other than which it's arguable you don't.
My second question is, my point I'd like to make is that the minister said about about the action plan. I've read the action plan and it's a good plan, but it lays a heavy responsibility on the department that no longer exists, I say it's it's it. Where is that function which is set out so well and is important actually, to keeping government departments up to the mark, which again, are going to be done separately.
Where where is that responsibility now going to sit? Because it does require a very considerable degree of expertise on the part of those who are actually going to conduct this system of keeping people up to the mark, where how is that? How is that going to be done in future? Secondly, it seems to me that local government requires something of the same. I don't know, I mean, government is a whole thing. You know, it isn't somehow that some things can be done in central government and without regard to their implementation by local government, or vice versa.
So is the government going to extend the system that's been mapped out in the action plan for government to local government as well, in order to get the same standard of performance and integrity of of systems.
It's an intimate part of the networking system of cyber security, inevitably. And what we appear to be told is that some parts of the telecoms internet world is going to be governed by the bill and other parts which are equally integrated and important part of it are going to be done separately by some special different arrangements, but not included. I as I understand what the minister said about space, it's not going to be done in this bill.
Greatest possible respect to the minister doesn't make sense. So my question is really, could could in the in the in the period we now have ahead of us, the government have another look at the whole question of the scope of the bill, because that does seem to me to be, you know, one of the one of the problems that lies between us. And as a result, what you'll find is that members are now trying to shove into the bill on the grounds that they are essential services, all sorts of things, some of which clearly, in my view, do need to be there, other than which it's arguable you don't.
My second question is, my point I'd like to make is that the minister said about about the action plan. I've read the action plan and it's a good plan, but it lays a heavy responsibility on the department that no longer exists, I say it's it's it. Where is that function which is set out so well and is important actually, to keeping government departments up to the mark, which again, are going to be done separately.
Where where is that responsibility now going to sit? Because it does require a very considerable degree of expertise on the part of those who are actually going to conduct this system of keeping people up to the mark, where how is that? How is that going to be done in future? Secondly, it seems to me that local government requires something of the same. I don't know, I mean, government is a whole thing. You know, it isn't somehow that some things can be done in central government and without regard to their implementation by local government, or vice versa.
So is the government going to extend the system that's been mapped out in the action plan for government to local government as well, in order to get the same standard of performance and integrity of of systems.
15:56
Speaker 7
-
Speaker 7
The. Let me work backwards here. The noble Baroness makes a very good point about the services that are delivered at a local level often mirror those at. At central government level, the. At the moment we are consulting on the. This. The question of the best value duty and. And to give additional prominence, I think one of the issues with mapping these requirements into local government is that there are indeed many different services that are provided, but I think we may need to come back to that in.
In more detail on the question of where the cyber government Cyber Action Plan and the cyber government cyber unit now resides, that resides within DCMs. The team has transferred over and is up and running, and I have spoken to them many times in the last period. So they are very active in in in progressing the. The Government Cyber Action plan as per the timetable and the, the, the, the target plan set out there on the question of.
The approach and looking at other sectors to bring in. Indeed. And that is why I mentioned the second reading. I had already asked my official officials to work across government to consider what additional services would merit being brought in, and I mentioned earlier today that I think that that focusing on CNI services not already covered by the new regime would be the right place to start.
In more detail on the question of where the cyber government Cyber Action Plan and the cyber government cyber unit now resides, that resides within DCMs. The team has transferred over and is up and running, and I have spoken to them many times in the last period. So they are very active in in in progressing the. The Government Cyber Action plan as per the timetable and the, the, the, the target plan set out there on the question of.
The approach and looking at other sectors to bring in. Indeed. And that is why I mentioned the second reading. I had already asked my official officials to work across government to consider what additional services would merit being brought in, and I mentioned earlier today that I think that that focusing on CNI services not already covered by the new regime would be the right place to start.
15:58
Speaker 17
-
Speaker 17
My Lords, before the minister, can I just ask her whether she will show some greater enthusiasm for her own regulatory scheme? I mean, she's very reluctant. I mean, I hope that the criteria that she adopts within the department as to whether or not certain sectors are going to be brought in, will not only be about the criticality of the services, but also about the need for transparency, about the incidents themselves. We've had this whole debate today about notification being beneficial so that people like the NCS actually know what's going on, that we, the public, know what's going on.
We know the level of threat, our intelligence services are fully apprised. And so, my Lords, for critical sectors, I mean, the noble Baroness Neville-jones was entirely right. Things like space. My Lords, if we there's no duty of notification on a, say, a satellite manufacturer or something, we're all going to be in the dark . And the government rightly have introduced this bill to introduce some greater transparency in duties on some very important sectors.
We simply want to make sure that we capture all the important sectors, and they're all subject to the duty. And this shying away from the government's own framework does seem to me to be completely contrary. Contrary, my Lords, sir.
We know the level of threat, our intelligence services are fully apprised. And so, my Lords, for critical sectors, I mean, the noble Baroness Neville-jones was entirely right. Things like space. My Lords, if we there's no duty of notification on a, say, a satellite manufacturer or something, we're all going to be in the dark . And the government rightly have introduced this bill to introduce some greater transparency in duties on some very important sectors.
We simply want to make sure that we capture all the important sectors, and they're all subject to the duty. And this shying away from the government's own framework does seem to me to be completely contrary. Contrary, my Lords, sir.
16:00
16:00
16:00
Speaker 1
-
Speaker 1
Really that. That political parties are are sufficiently supported and and and protected given given really. I mean they are really well maybe the bigger parties are not so much run on a. shoestring of as some of us, but certainly at local level, I'm not talking about national level, but at local level, I. I think there could be it would be justified to see some beefing up of the obligations, but also the support that is is required.
I mean, we, we there's a political parties come in for a lot of flak or, you know, they're all always getting bashed around, you know, who wants parties. But actually we wouldn't have democracy in most cases without it being channelled through political parties. And so there are an obvious target for any mouth factor who wants to get at our democracy. So I think it's I think it's really unsatisfactory to to not give further and, and support to political parties.
And perhaps between now and report, we could we could reflect more on that just on on Carmen's. The noble Lord. Lord Russell prompted me to look at the website of the company. I mean, it's out of notice. I'm not giving away any secrets, beacon. Apparently it is about 1500. They claim 1500 charities and NGOs and other organisations. I mean, one was English National Ballet that I got notification from. So there's an awful lot of personal data that they manage and that has been, that has been subject to a cyber security incident.
So I think that happened in July. I tabled this amendment, I guess, in July. So I would welcome something from the minister and her team to get perhaps a little bit more steer about where an organisation like that really stands in relation to this bill and whether they should be encompassed to some extent within it. I mean, it has to be said that there this company's website, you wouldn't know anything had happened.
Maybe that's par for the course. But they, they they list all these security credentials and so on and how wonderful they are. I'm sure they are. I don't wish to impugn them. But the fact is they've had a major cybersecurity incident affecting apparently maybe 1500 organisations and the personal data of millions and millions of people in this country. And yet we're not I didn't really feel we were getting much back from the noble lady, the minister.
So perhaps we can think more about that as well between now and report. And I beg leave to withdraw. Amendment 79.
I mean, we, we there's a political parties come in for a lot of flak or, you know, they're all always getting bashed around, you know, who wants parties. But actually we wouldn't have democracy in most cases without it being channelled through political parties. And so there are an obvious target for any mouth factor who wants to get at our democracy. So I think it's I think it's really unsatisfactory to to not give further and, and support to political parties.
And perhaps between now and report, we could we could reflect more on that just on on Carmen's. The noble Lord. Lord Russell prompted me to look at the website of the company. I mean, it's out of notice. I'm not giving away any secrets, beacon. Apparently it is about 1500. They claim 1500 charities and NGOs and other organisations. I mean, one was English National Ballet that I got notification from. So there's an awful lot of personal data that they manage and that has been, that has been subject to a cyber security incident.
So I think that happened in July. I tabled this amendment, I guess, in July. So I would welcome something from the minister and her team to get perhaps a little bit more steer about where an organisation like that really stands in relation to this bill and whether they should be encompassed to some extent within it. I mean, it has to be said that there this company's website, you wouldn't know anything had happened.
Maybe that's par for the course. But they, they they list all these security credentials and so on and how wonderful they are. I'm sure they are. I don't wish to impugn them. But the fact is they've had a major cybersecurity incident affecting apparently maybe 1500 organisations and the personal data of millions and millions of people in this country. And yet we're not I didn't really feel we were getting much back from the noble lady, the minister.
So perhaps we can think more about that as well between now and report. And I beg leave to withdraw. Amendment 79.
16:04
Speaker 18
-
Speaker 18
See your lordships. Pleasure that the amendment be withdrawn. The amendment is by leave withdrawn. Amendment 80. Baroness Northover not moved. Amendment 81 not moved. Amendment 81 a Baroness Thatcher not moved. Amendment 81 B Lord Clement-jones not moved. Amendment 81. C Lord Clement-jones not moved. Amendment 81 d Lord Clement-jones not moved. Amendment 80 oh in clause in clause 25.
Amendment 82 . Lord Ravensdale not moved. The question is that clause 25 stand part of the bill. As many as that opinion will say content in the contrary, not content. The contents have it. The question is that clauses 26, 27 and 28 stand part of the bill on block. As many as that opinion will say content. Content. The contrary, not content. The content have it after clause 28.
Amendment 83. Baroness Kidron.
Amendment 82 . Lord Ravensdale not moved. The question is that clause 25 stand part of the bill. As many as that opinion will say content in the contrary, not content. The contents have it. The question is that clauses 26, 27 and 28 stand part of the bill on block. As many as that opinion will say content. Content. The contrary, not content. The content have it after clause 28.
Amendment 83. Baroness Kidron.
16:05
Speaker 3
-
Speaker 3
My Lords, I rise to speak to amendment 83 in my name and the names of the noble Lady, Baroness Ludford, the noble Lord Holmes, and the noble Lord Tarasenko. The amendment requires the Secretary of State to publish and maintain a digital sovereignty strategy before recess. Many of us are participating in a debate on digital sovereignty, and it was absolutely overwhelming the level of agreement across the chamber about the importance of , and the current threats to UK national sovereignty from our current arrangements with the tech sector, particularly US based EMFs.
That same sentiment is articulated by amendment 166 in the name of noble Baroness Lady Ford, and it is a sentiment shared in the other place where conservatives, Liberal Democrats and Greens all tabled similar motions. During the debate. I identified four areas in which UK has surrendered its leverage to make its own decisions our political leverage, by deferring to the power of US tech, our economic leverage by placing UK businesses at a structural disadvantage and entering into expansive and extractive content contracts.
Our technological capability , as we fail to invest in UK capacity in businesses and our strategic vulnerability by by depending on foreign companies for key infrastructure. Together, these weaken our economy, our security, our safety, and above all, our autonomy. The ability to choose. I doubt if it was any single government strategy to put us in this position, but it does reveal a lack of strategy that we find ourselves here.
Amendment 83 sets out a requirement for the Secretary of State to establish a digital sovereign strategy. Clause two requires an assessment of the risks to networks and information systems from dependence on hardware, software or digital products and services that may be subject to foreign influence and interference. Extraterritorial legal requirements imposed on non-domiciled suppliers, such as cloud providers through the US Cloud Act, vulnerabilities under undue control or supply chain dependency on foreign states or entities.
Use of UK data sets without licence or permission, and vulnerabilities to valuable data assets that belong to the British public, including those related to the NHS, BBC and Metoffice. The rest of clause two sets out further requirements to assess the risk of technological developments, market concentration or other strategic dependencies and give consideration to vital elements of sovereignty, including open source technology and assets, talent procurement, capital markets, international capital, collaboration with mid-size partners whom we retain leverage with.
And finally, clauses three and four call for a development of a dashboard enabling the measurement of digital sovereignty. I'm working with computer scientists at the British Computing Society who are developing a prototype for this, and I do urge the government to look at this work and consider developing it, both for its own procurement purposes, and also provide it as a tool for the wider business community. My Lords, I set that out in some detail because I rather suspect that we wouldn't have the conversation that we've just had in the last grouping if we had a proper strategy across the nation and so on.
But my Lords, sovereignty is now firmly on the agenda. I think it's partly due to the export ban on anthropic and Fable five, introduced by President Trump in June. But stories highlighting our sovereign vulnerability across the digital stack predate that event and have continued since. Dependency is not built overnight, it's the result of a systemic and concerted effort by entrenched big tech companies across many years to make itself indispensable to the UK state, businesses and society, and by successive UK governments failing to invest in our businesses, communities and people choosing always to buy oven ready tech irrespective of the economic, societal and individual costs.
But just as dependence is not built overnight, neither can sovereignty be reclaimed overnight, nor is it a zero sum game in which every part of the stack can or should be replaced. Nonetheless, to restore any independence at all, we require an equally systematic and concerted approach to build where we can to buy only projects, products and services that adhere to our laws, to recognise
That same sentiment is articulated by amendment 166 in the name of noble Baroness Lady Ford, and it is a sentiment shared in the other place where conservatives, Liberal Democrats and Greens all tabled similar motions. During the debate. I identified four areas in which UK has surrendered its leverage to make its own decisions our political leverage, by deferring to the power of US tech, our economic leverage by placing UK businesses at a structural disadvantage and entering into expansive and extractive content contracts.
Our technological capability , as we fail to invest in UK capacity in businesses and our strategic vulnerability by by depending on foreign companies for key infrastructure. Together, these weaken our economy, our security, our safety, and above all, our autonomy. The ability to choose. I doubt if it was any single government strategy to put us in this position, but it does reveal a lack of strategy that we find ourselves here.
Amendment 83 sets out a requirement for the Secretary of State to establish a digital sovereign strategy. Clause two requires an assessment of the risks to networks and information systems from dependence on hardware, software or digital products and services that may be subject to foreign influence and interference. Extraterritorial legal requirements imposed on non-domiciled suppliers, such as cloud providers through the US Cloud Act, vulnerabilities under undue control or supply chain dependency on foreign states or entities.
Use of UK data sets without licence or permission, and vulnerabilities to valuable data assets that belong to the British public, including those related to the NHS, BBC and Metoffice. The rest of clause two sets out further requirements to assess the risk of technological developments, market concentration or other strategic dependencies and give consideration to vital elements of sovereignty, including open source technology and assets, talent procurement, capital markets, international capital, collaboration with mid-size partners whom we retain leverage with.
And finally, clauses three and four call for a development of a dashboard enabling the measurement of digital sovereignty. I'm working with computer scientists at the British Computing Society who are developing a prototype for this, and I do urge the government to look at this work and consider developing it, both for its own procurement purposes, and also provide it as a tool for the wider business community. My Lords, I set that out in some detail because I rather suspect that we wouldn't have the conversation that we've just had in the last grouping if we had a proper strategy across the nation and so on.
But my Lords, sovereignty is now firmly on the agenda. I think it's partly due to the export ban on anthropic and Fable five, introduced by President Trump in June. But stories highlighting our sovereign vulnerability across the digital stack predate that event and have continued since. Dependency is not built overnight, it's the result of a systemic and concerted effort by entrenched big tech companies across many years to make itself indispensable to the UK state, businesses and society, and by successive UK governments failing to invest in our businesses, communities and people choosing always to buy oven ready tech irrespective of the economic, societal and individual costs.
But just as dependence is not built overnight, neither can sovereignty be reclaimed overnight, nor is it a zero sum game in which every part of the stack can or should be replaced. Nonetheless, to restore any independence at all, we require an equally systematic and concerted approach to build where we can to buy only projects, products and services that adhere to our laws, to recognise
16:11
16:11
16:12
Speaker 1
-
Speaker 1
My Lords, I will speak to amendment 166, which is, I think, an alternative route to the same destination, but I think probably that of the noble lady, Baroness Kidron is is superior. It's it's it's it's more comprehensive, and I readily concede that hers adds an important element, a digital sovereignty dashboard prepared by the office for National Statistics, the Competition and Markets Authority, the National Cyber Security Centre and the AI Security Institute, so that we can actually measure whether anything is changing.
I think the fact of cross-party agreement on this matter, which she referenced is important, might help persuade the Minister of the force of the argument. The Competition Markets Authority puts Amazon Web Services and Microsoft together at between 70 and 80% of the UK public cloud market. I mean, that's only not only a duopoly, but it's also a digital sovereignty issue. The Science Innovation Technology Committee in the other place, in its report, Rewiring the State in June found major departments, including HMRC and the NHS, locked into multiyear agreements that further entrench those dependencies.
And the National Audit Office has found no shared strategic approach across government towards the handful of very large suppliers who now dominate these markets and are, to a large extent, American . Research by British cloud provider Civo found that 83% of UK IT leaders believe that geopolitics threatens their ability to control their data, while only 35% know precisely where that data resides. I mean, I have a I have a history as a member of the European Parliament involved in all the arguments about transatlantic transfer of data and what happened to that data when it's in in the US.
This is all in the wake of the war on terror and Guantanamo and and so on. And I guess we're back in that territory. And so it's not just the the sort of economic side of, of, of non national control, but it's also your vulnerability to, to decisions and sometimes decisions that you don't like about where that what happens to the data. So this bill regulates technical risk.
It doesn't touch ownership or control. And the open rights group made that point in evidence to the Commons Public Bill committee. A supplier could satisfy every security standard in this bill and still be compelled by a foreign government to withdraw a service overnight or under, for instance, the US Cloud Act to hand over data held here in the United Kingdom. So, I mean, as we know, and the noble lady, Baroness Kidron, talked about, you know, these risks are not hypothetical because in June, the US Department of Commerce issued an export control directive requiring anthropic to suspend access to two of its newest models for any foreign national, whether inside or outside the the US, and it took effect immediately.
Companies shut down both models for every user worldwide. So there's a gap of 18 days. This episode, in fact ended. Okay. But it was a service in live commercial deployment on which British organisations had begun to build, switched off globally by a decision of another government without notice, with no with no British voice in the room. And if it had been running, a public service would have had no remedy, would have simply.
We would have simply had to wait. I mean, many of us, I think, are are no nationalists. But this situation worries us when we are so dependent on foreign owned, foreign controlled, foreign dictated services. I know the minister has the industrial strategy, the sovereign AI unit and Junes AI, AI hardware plan, but I, I think at least we we need to ask the minister to commit that digital sovereignty will be named in the statement of Strategic priorities under clause 25 and reported on under clause 40.
I. I would just end on noting that Dame Chi Onwurah said in the debates. MP who said in the debates in the other place that I think report stage. She. She said, I have put down a series of written parliamentary questions over the last seven years to find out just how dependent the government are on AWS and Microsoft. The data is not tracked across government, and she asked for the minister to say how he intends to assess a threat that the government are not measuring.
I confess I haven't recorded the answer from the minister, but I think even if I can't get an answer on that particular question, that second hand question now, I think we with noble lady Baroness Kidron, from these benches, we we we we share the deep concern at our vulnerability to external shocks and need to we need to have a bit of a reassurance that the government can is thinking about how we protect ourselves better from.
From all these external events. So something like amendments 83 or 1 six six. It would be good to hear positive response from the minister if.
I think the fact of cross-party agreement on this matter, which she referenced is important, might help persuade the Minister of the force of the argument. The Competition Markets Authority puts Amazon Web Services and Microsoft together at between 70 and 80% of the UK public cloud market. I mean, that's only not only a duopoly, but it's also a digital sovereignty issue. The Science Innovation Technology Committee in the other place, in its report, Rewiring the State in June found major departments, including HMRC and the NHS, locked into multiyear agreements that further entrench those dependencies.
And the National Audit Office has found no shared strategic approach across government towards the handful of very large suppliers who now dominate these markets and are, to a large extent, American . Research by British cloud provider Civo found that 83% of UK IT leaders believe that geopolitics threatens their ability to control their data, while only 35% know precisely where that data resides. I mean, I have a I have a history as a member of the European Parliament involved in all the arguments about transatlantic transfer of data and what happened to that data when it's in in the US.
This is all in the wake of the war on terror and Guantanamo and and so on. And I guess we're back in that territory. And so it's not just the the sort of economic side of, of, of non national control, but it's also your vulnerability to, to decisions and sometimes decisions that you don't like about where that what happens to the data. So this bill regulates technical risk.
It doesn't touch ownership or control. And the open rights group made that point in evidence to the Commons Public Bill committee. A supplier could satisfy every security standard in this bill and still be compelled by a foreign government to withdraw a service overnight or under, for instance, the US Cloud Act to hand over data held here in the United Kingdom. So, I mean, as we know, and the noble lady, Baroness Kidron, talked about, you know, these risks are not hypothetical because in June, the US Department of Commerce issued an export control directive requiring anthropic to suspend access to two of its newest models for any foreign national, whether inside or outside the the US, and it took effect immediately.
Companies shut down both models for every user worldwide. So there's a gap of 18 days. This episode, in fact ended. Okay. But it was a service in live commercial deployment on which British organisations had begun to build, switched off globally by a decision of another government without notice, with no with no British voice in the room. And if it had been running, a public service would have had no remedy, would have simply.
We would have simply had to wait. I mean, many of us, I think, are are no nationalists. But this situation worries us when we are so dependent on foreign owned, foreign controlled, foreign dictated services. I know the minister has the industrial strategy, the sovereign AI unit and Junes AI, AI hardware plan, but I, I think at least we we need to ask the minister to commit that digital sovereignty will be named in the statement of Strategic priorities under clause 25 and reported on under clause 40.
I. I would just end on noting that Dame Chi Onwurah said in the debates. MP who said in the debates in the other place that I think report stage. She. She said, I have put down a series of written parliamentary questions over the last seven years to find out just how dependent the government are on AWS and Microsoft. The data is not tracked across government, and she asked for the minister to say how he intends to assess a threat that the government are not measuring.
I confess I haven't recorded the answer from the minister, but I think even if I can't get an answer on that particular question, that second hand question now, I think we with noble lady Baroness Kidron, from these benches, we we we we share the deep concern at our vulnerability to external shocks and need to we need to have a bit of a reassurance that the government can is thinking about how we protect ourselves better from.
From all these external events. So something like amendments 83 or 1 six six. It would be good to hear positive response from the minister if.
16:18
16:18
Speaker 20
-
Speaker 20
In support of amendment 83, in the name of the noble Baroness, Lady Kidron, which I've added my name in my speech, I want to focus just on the aspects of the digital sovereign strategy which are relevant to the NHS, and I speak as someone who held an honorary contract with the Oxford University Hospitals NHS trust until November 2025, enabling me to be a co-investigator on research projects involving patient data, cyber attacks against NHS trusts and their supply chain occur with very high frequency from regular automated phishing attempts.
Blocked daily major incidents causing significant clinical disruption disruption health and social care consistently rank among the top sectors reported for cyber incidents and data breaches to the ICO. I'm sure we all remember the WannaCry cyber attack in May 2017, which affected 81 out of our 236 NHS trusts at the time, causing nearly 2000 appointments to be cancelled in a week . And less than two years ago, in November 2024, there was a major cyber attack against Wirral University Hospital NHS trust, which compromised the trust electronic patient record, an EP which I know well as it is the same as the EPR that we have in Oxford, Cerner Millennium.
But as a result of the cyber attack, staff in the rural hospitals lost all access to patient records, electronic prescribing tools and diagnostic results, all elective surgeries and outpatient appointments across the trust had to be cancelled, and members of the public were told not to use the emergency department at one of the hospitals in the trust. All clinical systems remain completely offline for nine days now. The EPR, as I mentioned, was Cerner Millennium.
Cerner is now part of Oracle Health and together, Oral and epic. Both US companies account for about 40% of hospital EPR contracts in England and Wales. In primary care, Image Software manages just under 60% of the patient records. The records of 35 to 40 million patients across England and Wales. EMIs was bought by Optum, part of UnitedHealth Group, in 2023. But in March this year, the United Health Group sold Optum to a US private equity firm, TPG, for just under 300 million.
I'll come back to that briefly later, my Lords, in 2023, NHS England and the Department of Health and Social Care launched the 2030 Cyber Security Strategy. The noble Lord, Lord Markham, when he was health minister, wrote the foreword. I'm sure, as he will remember, to the strategy strategy document. In it he wrote, and I'm sure that we all agree with him the cyber security of our health and social care underwrites patient safety.
The group director for cyber Security for DHS has recently written to all NHS trust boards informing them that from this month, September 2026, new cyber policies will be included in the next data security and protection toolkit, covering issues such as multifactor authentication, high high severity alerts and endpoint detection. Nothing about AI. Perhaps the subtitle of this bill.
Blocked daily major incidents causing significant clinical disruption disruption health and social care consistently rank among the top sectors reported for cyber incidents and data breaches to the ICO. I'm sure we all remember the WannaCry cyber attack in May 2017, which affected 81 out of our 236 NHS trusts at the time, causing nearly 2000 appointments to be cancelled in a week . And less than two years ago, in November 2024, there was a major cyber attack against Wirral University Hospital NHS trust, which compromised the trust electronic patient record, an EP which I know well as it is the same as the EPR that we have in Oxford, Cerner Millennium.
But as a result of the cyber attack, staff in the rural hospitals lost all access to patient records, electronic prescribing tools and diagnostic results, all elective surgeries and outpatient appointments across the trust had to be cancelled, and members of the public were told not to use the emergency department at one of the hospitals in the trust. All clinical systems remain completely offline for nine days now. The EPR, as I mentioned, was Cerner Millennium.
Cerner is now part of Oracle Health and together, Oral and epic. Both US companies account for about 40% of hospital EPR contracts in England and Wales. In primary care, Image Software manages just under 60% of the patient records. The records of 35 to 40 million patients across England and Wales. EMIs was bought by Optum, part of UnitedHealth Group, in 2023. But in March this year, the United Health Group sold Optum to a US private equity firm, TPG, for just under 300 million.
I'll come back to that briefly later, my Lords, in 2023, NHS England and the Department of Health and Social Care launched the 2030 Cyber Security Strategy. The noble Lord, Lord Markham, when he was health minister, wrote the foreword. I'm sure, as he will remember, to the strategy strategy document. In it he wrote, and I'm sure that we all agree with him the cyber security of our health and social care underwrites patient safety.
The group director for cyber Security for DHS has recently written to all NHS trust boards informing them that from this month, September 2026, new cyber policies will be included in the next data security and protection toolkit, covering issues such as multifactor authentication, high high severity alerts and endpoint detection. Nothing about AI. Perhaps the subtitle of this bill.
16:22
16:22
Speaker 20
-
Speaker 20
Hopefully to be removed by report stage. And yet we know that from Tuesday's debate and last week's open letter from 100 companies, including large tech firms, AI enabled cyber attacks are about to become more widespread, more sophisticated within months. This prompts three questions. Firstly, are officials from the minister's department, which has overall responsibility for cyber security, coordinating with the cyber security group within the NHS, especially with respect to the latest threats from AI agents.
Secondly, how have the recent reports from AC been communicated to the cyber security group in DHS and their implications for the NHS discussed with them? I note here that the new Minister for Science and Innovation, Chris McDonnell MP, is a minister both in DBE and DHS, and so I'm hopeful that the answer to these two questions might be yes. Thirdly, my third question. Given the high prevalence of foreign ownership of companies such as epic and TPG, responsible for managing patient data within the NHS, notwithstanding the single supplier agreement with Palantir, another US company for the federated data platform, as the minister's department assessed the risk to relevant network and information systems as a result of our technological dependence on these companies.
My Lord, what I have described for the NHS also applies to other sovereign data assets, such as those held by the BBC or the Met Office. If the full value to the UK of these sovereign data assets is to be realised as part of the government's growth strategy, we need then to be optimally protected against cyber attacks, including AI enabled attacks, and for that to happen, we need a coherent digital sovereign strategy across government departments and led by the minister's department.
Secondly, how have the recent reports from AC been communicated to the cyber security group in DHS and their implications for the NHS discussed with them? I note here that the new Minister for Science and Innovation, Chris McDonnell MP, is a minister both in DBE and DHS, and so I'm hopeful that the answer to these two questions might be yes. Thirdly, my third question. Given the high prevalence of foreign ownership of companies such as epic and TPG, responsible for managing patient data within the NHS, notwithstanding the single supplier agreement with Palantir, another US company for the federated data platform, as the minister's department assessed the risk to relevant network and information systems as a result of our technological dependence on these companies.
My Lord, what I have described for the NHS also applies to other sovereign data assets, such as those held by the BBC or the Met Office. If the full value to the UK of these sovereign data assets is to be realised as part of the government's growth strategy, we need then to be optimally protected against cyber attacks, including AI enabled attacks, and for that to happen, we need a coherent digital sovereign strategy across government departments and led by the minister's department.
16:25
Speaker 5
-
Speaker 5
My Lords, I echo the words of the noble Baroness, Lady Kidron, which is in the previous group. We probably wouldn't have had anything like that debate if there was indeed a clear strategy in place. I will speak very briefly and I will speak in the context of other countries views of the safety and security of actually doing business with the UK and UK entities. Part of the backdrop is, I think, an attempt by Her Majesty's Government to try and do a reset with the EU, not least because of the problems we're having with our erstwhile colonial possessions across the Atlantic.
And we need to be viewed as a safe haven when it comes to the security of our business and the security of our data, really. And if you look at what the EU, for all its bureaucratic idiosyncrasies, has been doing with NHS two in many instances, that is an extremely good model for us to try and look comprehensively at the different sectors that need to be involved. And NIS2, you know, covers energy, transport, banking, financial market, infrastructures, health, drinking water, wastewater, digital infrastructure, IST services, public administration, space, postal services, waste management, chemicals, food manufacturing research and other critical parts of the economy.
My Lords, they are ahead of us. They have done a great deal of groundwork, which I think if we were to talk to them, we could benefit from hugely without reinventing the wheel. But I do think it is imperative that not only that, we give noble Lords and parliamentarians a feeling that we know what we're doing and we know where we're going. It is imperative that other countries that are currently doing or are thinking of doing business or more business with us, have faith in the security of our data, of our cyber security infrastructure.
And at the moment, frankly, if I was looking to invest in this company, that is an area I would look at very carefully. And at the moment I would not feel very confident.
And we need to be viewed as a safe haven when it comes to the security of our business and the security of our data, really. And if you look at what the EU, for all its bureaucratic idiosyncrasies, has been doing with NHS two in many instances, that is an extremely good model for us to try and look comprehensively at the different sectors that need to be involved. And NIS2, you know, covers energy, transport, banking, financial market, infrastructures, health, drinking water, wastewater, digital infrastructure, IST services, public administration, space, postal services, waste management, chemicals, food manufacturing research and other critical parts of the economy.
My Lords, they are ahead of us. They have done a great deal of groundwork, which I think if we were to talk to them, we could benefit from hugely without reinventing the wheel. But I do think it is imperative that not only that, we give noble Lords and parliamentarians a feeling that we know what we're doing and we know where we're going. It is imperative that other countries that are currently doing or are thinking of doing business or more business with us, have faith in the security of our data, of our cyber security infrastructure.
And at the moment, frankly, if I was looking to invest in this company, that is an area I would look at very carefully. And at the moment I would not feel very confident.
16:27
16:27
Speaker 6
-
Speaker 6
My Lords, I think these amendments are highly pertinent. We simply must ensure that non-UK providers of services in this sector are firmly. They are partly. But they are firmly and wholly under the scope of this bill. For those of you who are at second reading, I read out a coruscating report by the American government which damned Microsoft for its poor, poor, poor cyber security. I'm sure that's not true across the whole of Microsoft.
But in that particular instance it manifestly was. I just like to observe that we. Our previous debate, I thought, was absolutely excellent, and it uniformly focused on organizations within the. In the UK that are providing services. There was a danger of anybody hearing that debate that might think that all those organisations are themselves responsible for breaches. The data on whether breaches chiefly occur through failures in organizations mentioned the absence of multifactor authentication, or whether they are the are caused by failures in the quality and design of the services that those organisations consume.
And by the way, the organisations consume literally hundreds and hundreds and hundreds of services. And the reality is that is a huge challenge for organisations to ensure that all the services that they buy are secure. You might say it's a near impossibility. So again, it's absolutely vital that we keep providers. I'm not saying they're not there, but they're certainly not there in the totality that we keep providers firmly within the scope of the bill and dare I say, in firmly under regulation.
But in that particular instance it manifestly was. I just like to observe that we. Our previous debate, I thought, was absolutely excellent, and it uniformly focused on organizations within the. In the UK that are providing services. There was a danger of anybody hearing that debate that might think that all those organisations are themselves responsible for breaches. The data on whether breaches chiefly occur through failures in organizations mentioned the absence of multifactor authentication, or whether they are the are caused by failures in the quality and design of the services that those organisations consume.
And by the way, the organisations consume literally hundreds and hundreds and hundreds of services. And the reality is that is a huge challenge for organisations to ensure that all the services that they buy are secure. You might say it's a near impossibility. So again, it's absolutely vital that we keep providers. I'm not saying they're not there, but they're certainly not there in the totality that we keep providers firmly within the scope of the bill and dare I say, in firmly under regulation.
16:29
16:29
16:29
Speaker 18
-
Speaker 18
Thank you so much, my Lords. I just want to write briefly in support of the principles behind these amendments. And I do so for a point which was raised by Baroness Ludford. And I just wish to make the point that kind of in a in a different way. There's many other that have been shared during the course of this debate, which I share. But Baroness Ludford refers to the questions asked by Chu Chhindwara MP in the other place.
And it's interesting because I submitted a very similar question just before the end of the summer in July, I asked the question, what proportion of the computing and cloud services used by government departments are provided by suppliers that are headquartered outside the UK, or subject to the jurisdiction of a government outside the UK? And I asked that question specifically in the wake of some recent events and in the wake of the debate that we had in July.
And the answer came back on Tuesday. And the response was that, as we heard from Baroness Ludford, I accept that the question asked by Sian Warren was specifically about AWS. I was asking about all services hosted outside the UK, but the answer was this information is not held centrally. Individual government departments are responsible for managing their own commercial arrangements for computing and cloud services, and would need to confirm the proportion of services provided by suppliers headquartered outside the UK.
My Lords, the government doesn't know how much it is collectively relying on other countries for our key government digital infrastructure, our government's critical systems, public services and citizens data are increasingly relying on this foreign built, foreign hosted clouds and data centres. And while the answer talks about commercial arrangements, I think it is about much more than that. This is a question, really, of our national security and our resilience, and I believe that we urgently do need a digital sovereignty strategy to ensure that we know the answers to these questions and that we can act on them and prevent any future challenges from happening and ensure that we are resilient, as we should be.
And it's interesting because I submitted a very similar question just before the end of the summer in July, I asked the question, what proportion of the computing and cloud services used by government departments are provided by suppliers that are headquartered outside the UK, or subject to the jurisdiction of a government outside the UK? And I asked that question specifically in the wake of some recent events and in the wake of the debate that we had in July.
And the answer came back on Tuesday. And the response was that, as we heard from Baroness Ludford, I accept that the question asked by Sian Warren was specifically about AWS. I was asking about all services hosted outside the UK, but the answer was this information is not held centrally. Individual government departments are responsible for managing their own commercial arrangements for computing and cloud services, and would need to confirm the proportion of services provided by suppliers headquartered outside the UK.
My Lords, the government doesn't know how much it is collectively relying on other countries for our key government digital infrastructure, our government's critical systems, public services and citizens data are increasingly relying on this foreign built, foreign hosted clouds and data centres. And while the answer talks about commercial arrangements, I think it is about much more than that. This is a question, really, of our national security and our resilience, and I believe that we urgently do need a digital sovereignty strategy to ensure that we know the answers to these questions and that we can act on them and prevent any future challenges from happening and ensure that we are resilient, as we should be.
16:31
Speaker 9
-
Speaker 9
My Lords, I rise to speak to this very strategic group of amendments, and I use that word again because the noble Baroness Kidron, right from the outset, made it quite clear that that's exactly what we lack a clear national strategy. And I paid tribute to her tenacity in tabling amendment 83, in particular, my Lords, following what I thought was an extremely. Extremely useful debate. I don't mind a bit of competition.
My Lord. But an extremely useful debate. On the last day before we went into recess. And that is something that is still very much top of mind at the moment. My Lords, as you can see, as the Minister can see from the contributions that have been made today. And if we had another debate today, I don't think we'd have any we'd feel any greater assurance than we did on the day we had that debate.
And I also thank my noble friend Baroness Ludford for having tabled . Amendment her amendment 166 along very much the same lines, because we do have at the moment, particularly in the public sector. And I thought the noble Baroness Burger put this extremely well, near-total and escalating digital dependence on foreign technology, monopolies and foreign jurisdictions. And, you know, and this, I think is, is quite prevalent in in Whitehall, that there is a kind of ignorance about the geopolitical reality, effectively, that so much of what you might describe as the digital stack is owned, operated and controlled from abroad.
And I'll come on to our procurement policies shortly. Amendment 83 defines the pillars of true digital sovereignty. It tackles extreme market concentration. And as we've heard, you know, three American technology giants, Amazon, Google and Microsoft control a staggering 73% of the cloud computing and enterprise hosting supporting our UK financial sector and public services. If an AWS region or Microsoft Azure network suffers a systemic failure, three quarters of the City of London and vast swathes of government administration are instantly paralysed, concentrating our critical national infrastructure into a handful of corporate choke points is the very antithesis of national resilience.
Second, it directly confronts foreign extraterritorial legal exposure because our critical public data is predominantly hosted on foreign cloud architectures, that data remains legally exposed to foreign statutory instruments, most notably US Cloud Act and subject to and is subject to sudden , unilateral geographic geopolitical shifts. And as my noble friend Baroness Ludford said, we saw a chilling preview of this vulnerability only recently when the US administration temporarily cut off European and UK financial institutions from accessing anthropic AI model Claude mythos.
Whatever the rights and wrongs of mythos, and I think we've got a pretty good idea of what the wrongs were from what the AI Security Institute had to say and its capabilities. Just supposing we'd adopted this powerful model in a cyber defensive role, and if an ally can pull the plug on frontline cyber security tools overnight, we don't possess true digital sovereignty. If a foreign ally can pull the plug on critical, cutting edge technology at a moment's notice, we don't have true national resilience.
We have a dangerous dependency. And my noble friend Baroness Ludford, amendment 166 does force the government to publish a formal digital sovereignty sovereignty strategy within 12 months, assessing foreign reliance and reforming public procurement to prioritise secure home grown UK technology. And in fact, both amendments tackle the glaring failure of current government procurement. The UK possesses world leading academic institutions and an exceptional cyber security start up ecosystem, but we suffer from a chronic scale up failure time and again.
Major public contracts, such as the recent NHS and defence platforms, are automatically handed to dominant foreign tech giants like Palantir. Rather than nurturing and scaling homegrown British technology. Subsection two C of amendment 83 and My Noble friend Baroness Ludford, amendment 166 provide the solution a legally require the government to use public procurement as a strategic lever to prioritise secure, interoperable and sovereign UK developed technologies. That's how, my Lords, we build long term sovereign capacity on our own soil, create high wage tech jobs and prevent our best innovations being swallowed up by our international competitors.
My Lords, in an era of contested supply chains, autonomous AI warfare and geopolitical instability, a nation that cannot secure its own digital foundation cannot truly govern itself. And I very much hope that the government will take heed of these amendments, even if it doesn't take them on board in this bill. My Lords, the former Secretary of State for de CET is on the record as being very much in favour of digital sovereignty, and I hope that that carries through into the current government.
My Lords.
My Lord. But an extremely useful debate. On the last day before we went into recess. And that is something that is still very much top of mind at the moment. My Lords, as you can see, as the Minister can see from the contributions that have been made today. And if we had another debate today, I don't think we'd have any we'd feel any greater assurance than we did on the day we had that debate.
And I also thank my noble friend Baroness Ludford for having tabled . Amendment her amendment 166 along very much the same lines, because we do have at the moment, particularly in the public sector. And I thought the noble Baroness Burger put this extremely well, near-total and escalating digital dependence on foreign technology, monopolies and foreign jurisdictions. And, you know, and this, I think is, is quite prevalent in in Whitehall, that there is a kind of ignorance about the geopolitical reality, effectively, that so much of what you might describe as the digital stack is owned, operated and controlled from abroad.
And I'll come on to our procurement policies shortly. Amendment 83 defines the pillars of true digital sovereignty. It tackles extreme market concentration. And as we've heard, you know, three American technology giants, Amazon, Google and Microsoft control a staggering 73% of the cloud computing and enterprise hosting supporting our UK financial sector and public services. If an AWS region or Microsoft Azure network suffers a systemic failure, three quarters of the City of London and vast swathes of government administration are instantly paralysed, concentrating our critical national infrastructure into a handful of corporate choke points is the very antithesis of national resilience.
Second, it directly confronts foreign extraterritorial legal exposure because our critical public data is predominantly hosted on foreign cloud architectures, that data remains legally exposed to foreign statutory instruments, most notably US Cloud Act and subject to and is subject to sudden , unilateral geographic geopolitical shifts. And as my noble friend Baroness Ludford said, we saw a chilling preview of this vulnerability only recently when the US administration temporarily cut off European and UK financial institutions from accessing anthropic AI model Claude mythos.
Whatever the rights and wrongs of mythos, and I think we've got a pretty good idea of what the wrongs were from what the AI Security Institute had to say and its capabilities. Just supposing we'd adopted this powerful model in a cyber defensive role, and if an ally can pull the plug on frontline cyber security tools overnight, we don't possess true digital sovereignty. If a foreign ally can pull the plug on critical, cutting edge technology at a moment's notice, we don't have true national resilience.
We have a dangerous dependency. And my noble friend Baroness Ludford, amendment 166 does force the government to publish a formal digital sovereignty sovereignty strategy within 12 months, assessing foreign reliance and reforming public procurement to prioritise secure home grown UK technology. And in fact, both amendments tackle the glaring failure of current government procurement. The UK possesses world leading academic institutions and an exceptional cyber security start up ecosystem, but we suffer from a chronic scale up failure time and again.
Major public contracts, such as the recent NHS and defence platforms, are automatically handed to dominant foreign tech giants like Palantir. Rather than nurturing and scaling homegrown British technology. Subsection two C of amendment 83 and My Noble friend Baroness Ludford, amendment 166 provide the solution a legally require the government to use public procurement as a strategic lever to prioritise secure, interoperable and sovereign UK developed technologies. That's how, my Lords, we build long term sovereign capacity on our own soil, create high wage tech jobs and prevent our best innovations being swallowed up by our international competitors.
My Lords, in an era of contested supply chains, autonomous AI warfare and geopolitical instability, a nation that cannot secure its own digital foundation cannot truly govern itself. And I very much hope that the government will take heed of these amendments, even if it doesn't take them on board in this bill. My Lords, the former Secretary of State for de CET is on the record as being very much in favour of digital sovereignty, and I hope that that carries through into the current government.
My Lords.
16:38
16:38
Speaker 11
-
Speaker 11
My Lords, I thank all the noble Lords who have added their names to the amendments and who have spoken in this debate. My Lords, both amendments in this group are underpinned by the same principle that national security and national technological capabilities deserve a unified plan, not one that targets some sectors and entities and not others, but a holistic plan that brings together all sectors and industries into a single framework. His Majesty's opposition, therefore, support the intention behind the amendments.
However, at risk of repetition, my Lords government could avoid the need for these propositions. They could do away with your lordships worries if they would commit, as mentioned by my noble friend Viscount Camrose, to publishing the National Cyber Action Plan within a set time frame and commit to including national digital sovereignty as part of that plan. In light of Tuesday's debate on AI, we would request a review and update as made of the previous government's AI white Paper, to ensure AI regulation and cyber regulation are aligned, AI and cyber regulation needs to operate in lockstep, and this bill is an appropriate place to do it.
It is evident that national sovereignty and a reduced reliance on foreign technology is vital to ensuring national wholesale cyber security. I commend these amendments in their aims to achieve that and look forward to the noble Baroness. The Minister's reply.
However, at risk of repetition, my Lords government could avoid the need for these propositions. They could do away with your lordships worries if they would commit, as mentioned by my noble friend Viscount Camrose, to publishing the National Cyber Action Plan within a set time frame and commit to including national digital sovereignty as part of that plan. In light of Tuesday's debate on AI, we would request a review and update as made of the previous government's AI white Paper, to ensure AI regulation and cyber regulation are aligned, AI and cyber regulation needs to operate in lockstep, and this bill is an appropriate place to do it.
It is evident that national sovereignty and a reduced reliance on foreign technology is vital to ensuring national wholesale cyber security. I commend these amendments in their aims to achieve that and look forward to the noble Baroness. The Minister's reply.
16:39
Speaker 16
-
Speaker 16
I thank Noble Lords for continuing the debate that we ended the last session on on the very, very important topic of the technical, technological and digital sovereignty of the UK. That is something that is very important to this government. It is something the government is taking action on. It is something that it is possible hasn't in past years had enough focus on, but I across many, many areas. That is what we are doing.
We have. We are clear that we need a coherent approach and a clear direction. We do need to obviously take into account that technologies and markets evolve. And the core of that approach was set out in the modern industrial strategy and digital and technology sector plan that set out the direction of travel, and the government will continue to consider how our priorities are best articulated. On the our objective, I think, as I articulated at the end of July, is not complete independence, but strategic resilience through a combination of domestic capability, diversified international partnership, and targeted management of critical dependencies.
This allows us to access the best of global markets while capitalizing on our domestic capabilities. That's why we already have in place a range of regulatory and non regulatory frameworks, which enable us to embed those objectives through existing industrial, technological and resilient strategies. I'm going to talk to some of those now for essential services in scope of the network and information set systems . Regimes such as drinking water, health and energy. All entities are required to manage and mitigate the risks posed to their systems which deliver essential services.
This includes the risks set out in the noble Baroness Ludford amendment in regards to market concentration, which the noble Baroness, Baroness Kidron and the noble Lord, Lord. Clement Jones, referred to the CMA is acting, it concluded an investigation into the cloud services market in July last year, which highlighted highlighted competition issues arising from market concentration. It has since announced a package of actions to improve competition in cloud services. This work has directly informed our thinking as we develop a more strategic approach to how the public sector procures cloud services.
We have. We are clear that we need a coherent approach and a clear direction. We do need to obviously take into account that technologies and markets evolve. And the core of that approach was set out in the modern industrial strategy and digital and technology sector plan that set out the direction of travel, and the government will continue to consider how our priorities are best articulated. On the our objective, I think, as I articulated at the end of July, is not complete independence, but strategic resilience through a combination of domestic capability, diversified international partnership, and targeted management of critical dependencies.
This allows us to access the best of global markets while capitalizing on our domestic capabilities. That's why we already have in place a range of regulatory and non regulatory frameworks, which enable us to embed those objectives through existing industrial, technological and resilient strategies. I'm going to talk to some of those now for essential services in scope of the network and information set systems . Regimes such as drinking water, health and energy. All entities are required to manage and mitigate the risks posed to their systems which deliver essential services.
This includes the risks set out in the noble Baroness Ludford amendment in regards to market concentration, which the noble Baroness, Baroness Kidron and the noble Lord, Lord. Clement Jones, referred to the CMA is acting, it concluded an investigation into the cloud services market in July last year, which highlighted highlighted competition issues arising from market concentration. It has since announced a package of actions to improve competition in cloud services. This work has directly informed our thinking as we develop a more strategic approach to how the public sector procures cloud services.
16:42
16:42
Speaker 16
-
Speaker 16
It has announced a series of measures, including actions from Microsoft and Amazon, to support greater choice for UK businesses and the public sector. And to the question my noble friend Lady Burger mentions, it is true that cloud spend is distributed across departments and managed through a range of departmental contracts and commercial arrangements. We have established a cross-government cloud consumption dashboard to improve visibility of cloud usage across the public sector, and we're working with both suppliers and departments to further improve the quality and completeness of our cloud infrastructure spend data to to provide a joined up view today and for the future.
So that is something that the government is acting on. Forgive me. Forgive me.
So that is something that the government is acting on. Forgive me. Forgive me.
16:43
16:43
Speaker 16
-
Speaker 16
Well well noted the. For all digital services, as many noble Lords have pointed out, government departments are required to carry out robust security and resilience assessments in their procurement to ensure that actions of foreign states or hostile actors cannot disrupt the delivery of public services. And in June, the Cabinet Office published Procurement Policy Note 025 entitled protecting the UK's National Security through Public Procurement and AI will be one of four key sectors recognized as critical for national security, with new guidance for priority, for new guidance for departments prioritising contracts for British business where necessary to protect our national security.
To the. To the questions raised in Lady Kidron's amendment and in the. In the interventions made to. About foreign actors access to UK sovereign data assets. The safety and security of UK data is always a priority for the government, with data representing a strategic national asset of significance to both our prosperity and security and the UK has strong safeguards to ensure that data collected and handled responsibly is handed responsibly, responsibly and securely, with personal data already protected under the UK, GDPR and companies registered in the UK, subject to our legal framework and regulatory jurisdiction in respect of cross-government data flows.
Having conducted a call for evidence on data brokers and national security last year, the government recently published a call for evidence on data Flows You Can Trust, which seeks to gather views from the public and businesses on the approaches they would like the government to take in this space, and I would encourage everyone to engage with that as well. But fundamentally, I would also like to comment on on the the point that the noble Lord, Lord Clement-jones, and the noble Baroness, Baroness Kidron, mentioned about support to UK businesses that absolutely does include the 500 million sovereign AI fund and the 1.1 billion AI hardware plan and the 2 billion quantum investment.
These are very significant investments. They go alongside support to our public finance institutions to help scale ups and startups, and to the noble Lord Russell of Liverpool's point we are seeing, and we remain to see, extremely healthy interest in the UK, with areas such as King's Cross attracting extremely important inward investment. So there are many actions that the government is taking on this very important question, responsive to the risks that have been mentioned in the amendments.
We are we are setting these out in all of our endeavours. Just just sorry, I forgot to respond to the point that Lord Tarasenko, the three questions Lord Tarasenko asked about contact between the department and the NHS on on cyber advice. I can say in general that that is the approach under the government cyber Action plan that that the department takes the government's cyber unit. I will need to revert to specific questions about the advice given on to whether A, C and the cyber security group have been in touch on that particular matter.
And the other two questions he asked. So this is a topic that remains extremely important to, to, to the government. Technology is advancing at a rapid pace and a statutory strategy of the nature that has been advocated today is likely to reduce the flexibility we have to respond to these developments, and may also require publication of sensitive material. I think that the current approach is most adaptable, effective and proportionate in this respect.
To the. To the questions raised in Lady Kidron's amendment and in the. In the interventions made to. About foreign actors access to UK sovereign data assets. The safety and security of UK data is always a priority for the government, with data representing a strategic national asset of significance to both our prosperity and security and the UK has strong safeguards to ensure that data collected and handled responsibly is handed responsibly, responsibly and securely, with personal data already protected under the UK, GDPR and companies registered in the UK, subject to our legal framework and regulatory jurisdiction in respect of cross-government data flows.
Having conducted a call for evidence on data brokers and national security last year, the government recently published a call for evidence on data Flows You Can Trust, which seeks to gather views from the public and businesses on the approaches they would like the government to take in this space, and I would encourage everyone to engage with that as well. But fundamentally, I would also like to comment on on the the point that the noble Lord, Lord Clement-jones, and the noble Baroness, Baroness Kidron, mentioned about support to UK businesses that absolutely does include the 500 million sovereign AI fund and the 1.1 billion AI hardware plan and the 2 billion quantum investment.
These are very significant investments. They go alongside support to our public finance institutions to help scale ups and startups, and to the noble Lord Russell of Liverpool's point we are seeing, and we remain to see, extremely healthy interest in the UK, with areas such as King's Cross attracting extremely important inward investment. So there are many actions that the government is taking on this very important question, responsive to the risks that have been mentioned in the amendments.
We are we are setting these out in all of our endeavours. Just just sorry, I forgot to respond to the point that Lord Tarasenko, the three questions Lord Tarasenko asked about contact between the department and the NHS on on cyber advice. I can say in general that that is the approach under the government cyber Action plan that that the department takes the government's cyber unit. I will need to revert to specific questions about the advice given on to whether A, C and the cyber security group have been in touch on that particular matter.
And the other two questions he asked. So this is a topic that remains extremely important to, to, to the government. Technology is advancing at a rapid pace and a statutory strategy of the nature that has been advocated today is likely to reduce the flexibility we have to respond to these developments, and may also require publication of sensitive material. I think that the current approach is most adaptable, effective and proportionate in this respect.
16:48
Speaker 6
-
Speaker 6
Before the minister says that she has sat down, this time before the minister sits down, I wonder if I might ask her to reflect at the end of day two of committee. Viscount Camrose has mentioned more than once that he'd like to see a national security cyber strategy and. But isn't the take away from these two days that actually. We are all very, very clear what the challenges of the UK are. And there's a great deal of uniformity across the room.
And I also think , in the quality of the Minister's minister's answers. But does this bill not to need to deal with all the issues that we we have surfaced and addressed, and frankly, it does not do that at the moment. And if this bill passes in its less ambitious form, how long will it be before we get another bill which does address the strategies? And if we if we have to wait that long, how much more damage is going to be done to our economy and to our society in in the meantime?
And I also think , in the quality of the Minister's minister's answers. But does this bill not to need to deal with all the issues that we we have surfaced and addressed, and frankly, it does not do that at the moment. And if this bill passes in its less ambitious form, how long will it be before we get another bill which does address the strategies? And if we if we have to wait that long, how much more damage is going to be done to our economy and to our society in in the meantime?
16:49
16:49
Speaker 16
-
Speaker 16
I mean, this bill, I think, is a substantive bill that increases. And to the point he made in his earlier intervention that substantially increases coverage of the digital infrastructure that much of our economy relies on. I think that is a very important point, whether or not this bill is the right place. I think, as I mentioned just in my starting remarks just now, to articulate the breadth of many of the issues that have been raised is indeed a good question.
I am not sure it is the right place to articulate all of those very good questions that have been raised, because some of them are much more wide ranging than the scope of this bill.
I am not sure it is the right place to articulate all of those very good questions that have been raised, because some of them are much more wide ranging than the scope of this bill.
16:50
Speaker 12
-
Speaker 12
My Lords, first of all, many thanks to to all who've spoken for for excellent contributions, I want to make three quick points, if I might. The first is that I have, in the course of the afternoon, opened the explanatory notes. Always a bit of a danger, but in paragraph two I just want to put this on the record. These reforms are intended to better protect the services and other activities that are essential to the day to day functioning of society in the UK and the economy through safeguarding relevant network information systems, the systems that allow computers and other devices to communicate with each other and their surrounding environment.
I do not think the bill as it stands, does that job and the last two groups have really , absolutely illustrated that. I think the second thing I would like to say to the noble lady, the minister and I, you know, I absolutely recognise all the all the things that she mentioned, but I did find myself counting and it was. 11 and my point is, we don't have a strategy. It's.
11 but it doesn't cover the scope of what we're discussing. It doesn't even cover the scope of security. And then the third thing, which I'm slightly loath to say, but I will now say, because otherwise I think we get nowhere, which is I have been in the room with ministers when they have indicated absolutely directly that they cannot do something because of America's desire. Absolutely. Categorically, yeah.
And I think that is the bit we didn't get from the minister. Sovereignty is about being able to impose our laws, choose our laws, decide what we can and can't do and what we're willing to risk and give up for it. And I'm not saying it's easy, but I think everybody around the committee has been really completely reasonable in trying to say, we're not trying to replace the stack we're trying to talk about.
We're trying to be strategic. But what we're really trying to do here is make the country safe, secure, and dare I say, you know, respond to its own laws. And I don't think that anything that the noble lady, the minister says has dealt with that fact. And I think it would be, you know, it wasn't asking for much to actually have a think about what strategy is and have a look at how we might get to a better place.
I'm saying let's have a vision of where we want to go and let's work out how to get there. And I don't think individual things and individual departments and leaving things out is, is the answer. I think this is a really easy amendment for the government to say yes to. Yeah. And I hope that by report they do.
I do not think the bill as it stands, does that job and the last two groups have really , absolutely illustrated that. I think the second thing I would like to say to the noble lady, the minister and I, you know, I absolutely recognise all the all the things that she mentioned, but I did find myself counting and it was. 11 and my point is, we don't have a strategy. It's.
11 but it doesn't cover the scope of what we're discussing. It doesn't even cover the scope of security. And then the third thing, which I'm slightly loath to say, but I will now say, because otherwise I think we get nowhere, which is I have been in the room with ministers when they have indicated absolutely directly that they cannot do something because of America's desire. Absolutely. Categorically, yeah.
And I think that is the bit we didn't get from the minister. Sovereignty is about being able to impose our laws, choose our laws, decide what we can and can't do and what we're willing to risk and give up for it. And I'm not saying it's easy, but I think everybody around the committee has been really completely reasonable in trying to say, we're not trying to replace the stack we're trying to talk about.
We're trying to be strategic. But what we're really trying to do here is make the country safe, secure, and dare I say, you know, respond to its own laws. And I don't think that anything that the noble lady, the minister says has dealt with that fact. And I think it would be, you know, it wasn't asking for much to actually have a think about what strategy is and have a look at how we might get to a better place.
I'm saying let's have a vision of where we want to go and let's work out how to get there. And I don't think individual things and individual departments and leaving things out is, is the answer. I think this is a really easy amendment for the government to say yes to. Yeah. And I hope that by report they do.
16:53
16:53
16:53
16:53
16:53
Speaker 10
-
Speaker 10
Oh, I'm so sorry. The question is that amendment that clause 29 is part of the bill. As many as have been content to the contrary, not content. The contents have it. Apologies to the committee. Now, after clause 29, amendment 84, Lord Clement-jones not moved. Is that correct? And Lord amendment 85. Lord Tarasenko not moved, not moved. Amendment 86.
Lord Tarasenko, the question is of clause 30 stand part of the bill. I'm so desperate to get to the end of the afternoon. I'm just missing stuff out.
Lord Tarasenko, the question is of clause 30 stand part of the bill. I'm so desperate to get to the end of the afternoon. I'm just missing stuff out.
16:54
16:54
Speaker 10
-
Speaker 10
However, my Lords, we must first agree that clause 30 stand part of the bill, as many of that opinion will say. Content to the contrary, not content. The contents have it in clause 31, amendment 86. Lord Tarasenko not moved. The question is that clause 31 stand part of the bill, as amended, of that opinion will say, content to the contrary, not content the contents of it. The question is that clauses 32 to 35 stand part of the bill en bloc, as many of that opinion will say, content content to the contrary, not content.
The contents have it after clause 35. Amendment 87. Lord Jones not moved. Amendment 88. Lord Birt not moved. Amendment 89 Lord Birt not moved and 90 and 91 not moved. Amendment 92 Lord Clement-jones not moved. Amendment 92 a Viscount Camrose not moved. Amendment 92. B Viscount Camrose not moved. The question is that clause 36 stand part of the bill as Minister of that opinion will say, content.
The contents have it after clause 35. Amendment 87. Lord Jones not moved. Amendment 88. Lord Birt not moved. Amendment 89 Lord Birt not moved and 90 and 91 not moved. Amendment 92 Lord Clement-jones not moved. Amendment 92 a Viscount Camrose not moved. Amendment 92. B Viscount Camrose not moved. The question is that clause 36 stand part of the bill as Minister of that opinion will say, content.
16:55