Cyber Security and Resilience (Network and Information Systems) Bill

Bradley Thomas Excerpts

2nd reading
Tuesday 6th January 2026 Commons Chamber

[Bradley Thomas (Bromsgrove) (Con)]

I start by putting on the record my broad support for the principles in the Bill. Cyber-threats are among the biggest threats that our country faces. We are living in the grey zone right now—every day, thousands of cyber-attacks take place on private companies, publicly owned companies and infrastructure. This is probably the most profound wave of attacks and hostility that we face; they are in plain sight, but the vast majority of the country and our constituents are unaware of them. That is for good reason: there are many good people working at the National Cyber Security Centre, in the intelligence agencies and the military, across Government and across private industry who do so much to keep us safe. However, that does not mitigate the fact that the threat is real, present and only ever increasing.

It is only ever increasing not just because of criminality in a cyber form, but because of the threats that come from nefarious states, particularly Russia, China, Iran and others that have been mentioned. The Jaguar Land Rover attack is particularly prominent in everyone’s minds. It affected the whole country and affected global supply chains, but it had a particularly profound effect in my constituency, where many of the JLR workforce are based. We have seen what happens if we fail to invest sufficiently in our cyber-defences—such a deficiency in investment only enables those who seek to do us harm. The point has been made that our lives are not somewhat digital; they are fundamentally digital in almost every facet of life.

I would like to emphasise a couple of points in particular. One that I have not heard spoken about much, which I think is both within the scope of the Bill and, at the same time, somewhat adjacent to it, is the role of foreign technology in our supply chains, particularly kill switches. We are seeing increasing numbers of news articles about these switches, particularly relating to energy installations. Questions have been raised on numerous occasions on the Floor of the House about the prevalence of kill switches in Chinese technology in particular and the risk of exposure to an adversarial state abroad that could destabilise our energy systems. I would particularly like to see a joined-up, whole-of-Government approach to tackling the broader threat, instead of it being viewed through a single lens. I know that Ministers will be looking at it across the board, but I would appreciate if the Minister could address how it is being looked at across Government.

Another case is the rise of Chinese-made cars. It struck me that around 12 months ago I rarely saw a Jaecoo or Omoda car on our streets, but now they seem to be everywhere. I cannot help but suspect, given the links that those manufacturers have to the Chinese Communist party, that there are potentially kill switches within those vehicles and, more importantly, that the vehicles are sending data on users’ mobility habits to a foreign adversarial state. The implications of that are profound.

My final point is about the reporting regime. I introduced a ten-minute rule Bill a couple of months ago that touched on the broad principles within reporting, calling on the Government to have a pragmatic approach with regard to the reporting obligations on particularly small companies. I suggested a threshold of £25 million of turnover before a company would be within the scope of my proposed Bill. I chose that threshold because it would omit the vast majority of small or family-owned businesses unless they are designated within one of the 13 critical industries. The reason for that was simply a fear that reporting obligations on small businesses are ever-growing, and for many businesses additional cyber-security obligations could result in significant additional head count that they may not be able to afford. I encourage the Minister to engage as much as possible with representatives of small business to ensure that the reporting obligations are as minimal as possible while capturing the broad principle of the Bill.

I support the broad principle of the Bill; I think it is a step in the right direction. I hope that the Government will adopt a cross-Government approach. This is a wider societal issue that all of us have an obligation and duty to fulfil. I look forward to seeing the Bill’s progress and contributing as it makes its way through Parliament.