Cyber Security and Resilience (Network and Information Systems) Bill

Debate between Lord Holmes of Richmond and Baroness Neville-Jones

Committee stage
Tuesday 1st September 2026 Grand Committee

[Lord Holmes of Richmond (Con)]

My Lords, it is a pleasure to speak to this group of amendments; I was certainly delighted to sign those in the name of the noble Lord, Lord Birt. Before turning to the specific subject matter, I say that the point he raised about JLR is germane to our broader discussions this afternoon and goes to the heart of the sense of coherence, or lack thereof, in certain key elements of the Bill.

JLR suffered a serious cyber attack yet it currently would not fall within one of the sectors covered by the Bill. Was that attack significant at a level that should be of concern to the Bill? To look at its economic impact—the definition of which my noble friend Lord Camrose has identified as being somewhat broad, to paraphrase what he said—the JLR attack impacted that quarter’s GDP numbers, thus raising the eyebrows of the markets, the ratings agencies and all international economic observers. I would suggest that the impact was more than material and certainly significant, yet it would fall outside the sectors in the Bill as currently drafted.

That goes to the point at the heart of the need for an OCR or an entity that would perform that function or role. Much of the discussion so far on this group is understandably echoic of the discussion we are having around the need for AI to be taken on by some regulator. As we are discussing the need for AI regulation and legislation, it seems only fair for me to give a nod to the AI authority in my AI regulation Private Member’s Bill—it comes with music every time I announce it, this time from a phone going off; that is multimedia.

The reality is, if the choice of the Government, be it for AI or for cyber, is not to have a single centralised regulator, then the consequences are clear and profound. In no sense is there any chance of clarity, consistency and coherence for businesses and sectors right across our economy and society. When you come to cyber, you should not have to consider whether it is or is not in a sector within the Bill. Is that specific regulator in that sector tooled up or do they have any experience, knowledge or ability to lead when it comes to all the challenges of cyber?

Let us take one obvious example, just for the case of efficiency, effectiveness and economic good management. Say that there is a search out, a recruitment, for a particular cyber professional and it turns out that Ofgem and the FCA are both in the final throes of getting that person. The FCA ends up getting that cyber professional; that is good for the FCA and good for financial services, but less good for Ofgem. How is that in any sense good for the broader economy and society, the UK as a whole, when it comes to protection from and an effective coherent approach to the cyber risks and how we guard against them?

The case for a unifying regulator when it comes to cyber is equal to that for AI. It would enable clarity, consistency and coherence of approach and would be that centre of expertise. There would be horizontal impact across all sectors and it would be delivered effectively and efficiently. That cannot simply be the case just for individual regulators; no matter how well intended or up for it they may be, they simply could not deliver that. Even if one sector did, another sector would not, which would mean that, just by dint of where your business or you as an individual happen to come across a cyber challenge, it would be the luck of the draw as to whichever regulator or professionals were in that field. The case for an individual, central, clear and coherent cyber regulator is clear. I hope that the Minister agrees and I look forward to her response.

[Baroness Neville-Jones (Con)]

My Lords, the last two interventions seemed to raise two issues, not one. The first is the question of how many regulators and the second is their coverage. Who will they regulate? Will they regulate just, say, the public sector, or will they regulate, in effect, the whole of the economy, including retail, business, high street businesses and so on? You can argue a case for any of these approaches: you can try to do too much, and certainly you can fail and do too little.

While I can see the case for a single regulator, my worry is that large organisations like that, with monopoly powers, in the end either tend to fail, because they just do not cope, or become overweening. I do not think that we want either of those two things. I am therefore in favour of something that is more decentralised than that and has more specialised regulators involved, partly because I think the nature of the regulation probably deserves that. However, at the same time, there has to be some degree of co-ordination—in fact, a high degree of co-ordination—between the regulators. They must operate according to the same principles, applied appropriately. They must espouse the same philosophy and must be seen to be fair. Therefore, great divergence and different approaches will equally not work. There needs to be a mechanism for co-ordination, for discussion and for agreement of principles. There also needs to be a thinker there somewhere. I am therefore in favour of some bit of the system being bigger than the rest, so that it inspires a degree of good and recognised co-ordination in the system.

Crime and Policing Bill

Debate between Lord Holmes of Richmond and Baroness Neville-Jones

Committee stage
Wednesday 7th January 2026 Lords Chamber

[Lord Holmes of Richmond (Con)]

My Lords, it is a pleasure again to follow my friend, the noble Lord, Lord Clement-Jones, whose amendment I agree with. I will speak to my Amendments 361 through 364, which are, as he rightly put, companions to the intent of his Amendment 360.

In simple terms we have an opportunity to change the law to benefit our cyber professionals and everything that they do to keep us safe, often—rightly and understandably—in the shadows. They deserve not only our respect but our support, and this is one small way we can support them.

I would also like to put on record my thanks and congratulations to CyberUp. It is an effective campaign because it has taken an issue, understood it at its essence and been clear, consistent and proportionate in its campaigning. It has not only been campaigning around the difficulties but offering practical and proportionate solutions. It is the very model of what a campaigning organisation should be.

We are told that 2026 is going to be the year smart glasses really take off—we will see. In 2007, the iPhone was launched. Yet the Computer Misuse Act still sits comfortably, dustily, fustily out of date on the statute book since 1990, a year when 0.5% of us UKers were online.

What has happened in the intervening 35 and a half years? Has that 0.5% doubled, trebled, increased tenfold or twentyfold? What was 0.5% in 1990 has moved on to 98.7% of the UK being online in 2025. That percentage alone should be enough to make the case for the need to urgently update the Computer Misuse Act. That Act came into being to address the issue of attacks on telephone exchanges. If the Government, or any polling organisation, went on to the streets of our country and asked anybody under the age of that of your Lordships about a telephone exchange, they might get some interesting results, but none of any benefit to the issues that we are discussing. It would be the greatest understatement to say that things have moved on since 1990.

There is a case for change, which the previous Government and this Government have largely accepted. Since 2021, work has been done on reviewing this issue, yet still we await any legislative change. What we are talking about is incredibly straightforward: giving a legal defence to legitimate cyber activities that is clear, concise, precise and proportionate.

The CMA being so chronically out of date would be a good enough reason to update it, but it is not just out of date, it is doing harm—harm to our cyber professionals, who, as I have already mentioned, do so much to keep us safe; harm to the security of our nation; and harm to the UK cyber industry.

I will share some numbers. There are 36.77 million reasons to make a change, because there have been 36.77 million cyber attacks on UK businesses and charities. There are another 27 billion reasons to make this change, because cyber attacks cost UK businesses and our economy £27 billion—not in total but year on year. Since 2021, when these various reviews began, £27 billion has been taken out of our economy year on year.

The changes in these amendments would bring the legal clarity and certainty required by our cyber professionals. If we look at other parts of the Bill, we can see where legal defences and clarity around public interest are being brought in. That would be completely analogous with what we are suggesting here with the Computer Misuse Act.

We are falling behind in terms of security, societal and economic benefits. The United States, France, Germany, Israel, Belgium and more countries already have a more appropriate regime than we do in the United Kingdom. The Government talk about growth, and quite right too. We already have a £13 billion cyber industry in this country. This change could unlock growth in the region of £3 billion, as well as in skills, training, jobs and careers, just by dint of making this very straightforward, clear, concise and proportionate change.

Dan Jarvis—partly in another place and largely at the Financial Times summit on 5 December last year—acknowledged this issue, stating that he understood the points behind it and that it was a priority for the Home Office. I therefore ask the Minister: is this a key, pressing and urgent priority? I suggest that it should be one of the Home Office’s top priorities. To that end, will the Minister agree to meet me and other colleagues across your Lordships’ House to update us on exactly where the Home Office’s thinking is, and where and when it is looking to make this change?

We have the ideal opportunity with this Bill. The time is now. In many ways, we are well overdue for the time being now. I ask the Minister: if not this Bill, what Bill? If not now, when?

[Baroness Neville-Jones (Con)]

My Lords, I support the amendments in this group, especially Amendments 360 and 362, tabled by the noble Lord, Lord Clement-Jones, and my noble friend Lord Holmes.

Like others, I welcome that the Government appear to have seen value in the introduction of a statutory defence for cyber security researchers. I hope that this will result in the updating of the Computer Misuse Act, for which, like others, I have been campaigning for about a decade. When it was passed, that Act was perfectly valid, but the market conditions, which have been described by colleagues, were extraordinarily different. As my noble friend Lord Holmes has rightly said, the Act is now not just neutral in the scene but actively doing damage to our national security.

The Act prevents or discourages those professionals whose work lies in researching things such as vulnerabilities in the system or threat intelligence from doing that work, because of the possibility of finding themselves in trouble with the law. It is therefore very important that we organise ourselves so that such challenges, if they exist, can be defended against as they come forward, and that the activities of our professionals can be both supported and encouraged.

I hope that, in drafting the legislation, the Government will ensure that they cover all aspects of this particular difficulty—not just vulnerabilities in the system but particularly threat intelligence, which, if we think about it for a moment, is becoming increasingly important. We need to know what is wrong with the system, and we need to know it early and before it is capable of doing real damage in each case.

This is an important amendment. When he replies, can the Minister give an assurance that the amendments that the Government will bring forward, I hope, will cover both the question of vulnerabilities and the issue of threat intelligence?