Cyber Security and Resilience (Network and Information Systems) Bill (Carry-over Extension)

Martin Wrigley Excerpts

Carry-over motion
Wednesday 4th November 2026 Commons Chamber

[Victoria Collins (Harpenden and Berkhamsted) (LD)]

The Liberal Democrats absolutely support this motion, but it is my democratic duty to highlight some things that I would love the Government to consider as we make this extension.

Let us look locally, nationally and internationally. In July, Hertfordshire county council raised its cyber-security risk to the maximum score on its register, 25 out of 25. That is exactly the kind of risk that this Bill should manage, yet the Bill excludes local authorities, even though they hold social care records on some of the most vulnerable people. Less than a fortnight ago, 32 Government services went offline while Departments patched critical flaws in widely used web software. That shows just how vulnerable the heart of our nation’s digital infrastructure and security is. On Sunday night, hackers attacked dozens of supermarket refrigerators and freezers in seven European countries, raising their temperatures to 50°C and spoiling millions of euros-worth of produce. That is the food we all rely on every single day, and the National Cyber Security Centre has warned:

“The UK’s cyber resilience is not yet where it should be.”

Our framework must not fall behind those of our closest neighbours. We should deepen co-operation with European Union agencies and member states. In a digital world, isolation only increases risk.

Those examples lay bare the crucial importance of the Bill and the devastating cost to businesses, consumers and our national security if we fail to get it right. The Bill cannot simply react to yesterday’s threats; we must ensure that our critical national infrastructure is prepared for the future, which means addressing over-reliance on high-risk foreign technology, and tackling the rapidly escalating threat of cyber-attacks powered by artificial intelligence, and on the internet of things, which is embedded in so much of what we use.

Digital sovereignty underpins everything else. We can no longer ignore the risks of over-reliance on American and Chinese technology, or rely on hostile, unpredictable states for our critical infrastructure. More than half of central Government organisations now run most of their systems on the cloud, and that all sits with just two companies, both American. The Government are the UK’s largest buyer of technology, but they almost never buy British. Since 2023, Palantir has won more than £420 million in public contracts across the national health service, the Met, the financial regulator, a city council and the Ministry of Defence. The latter’s £240 million contract was awarded without competition. Palantir is also an approved supplier on six public sector buying frameworks with a combined value of more than £9.7 billion—a route into Whitehall, the NHS, the police and our local councils.

[Martin Wrigley (Newton Abbot) (LD)]

Does my hon. Friend agree that it is a travesty that Palantir is not on the strategic suppliers list maintained by the Cabinet Office?

[Victoria Collins]

I thank my hon. Friend for that. There is so much that highlights that this is the wrong approach from our Government, and that we need to look not only at our suppliers, but at the importance of backing British technology. We believe that a digital sovereign strategy would change things. We need to back British innovation, reduce our dependencies and make our critical systems more secure. We need to look at each level of the tech stack and have a strategy that is right for the UK. I put that proposal to this House in June through new clause 13, which received cross-party support, but the Government and the Conservatives voted it down.

Sovereignty is not about doing this alone; it is about working globally while backing British. It is about becoming and staying world leaders in technology. It is about securing high-quality digital infrastructure that embeds us in global supply chains and makes the most of our incredible talent and skills. That would give us international leverage, not isolation. The Government say that sovereignty is covered by Departments across Whitehall, and last week’s Budget put another £60 million in the sovereign AI fund, but a venture fund and a patchwork of departmental reports are not a strategy.

The new powers on high-risk vendors in clause 44 allow the Government to react once a risky supplier is already in our system, but a strategy needs to be proactive. It needs to build British capability so that we never get to that point. Even industry is calling for a strategy, so I urge the Government to bring forward their own amendments on digital sovereignty.

Secondly, amendment 107, which passed in the Lords—a Cross-Bench amendment that Liberal Democrat peers supported—requires a review within a year of Royal Assent, and every year after that, of whether the regime is working, which sectors it covers, the supply chains, the regulators and the AI Security Institute. Given the fast pace of change in cyber-security, we urge the Government to support the amendment and to look at expanding the scope to local government, which holds our electoral rolls and our social records, and to retail, because a country that cannot feed itself is not resilient. We welcome the Government’s commitment in the other place to reviewing whether all critical national infrastructure sectors should be covered by this legislation and the Network and Information Systems Regulations 2018.

This week’s NCSC review warns that AI-powered malware is highly likely to be used in ransomware attacks on our critical infrastructure by 2028, yet there is still no clarity on who oversees AI in our cyber-defences: a single regulator, the AI Security Institute, or another body that is exactly right for the task. Our constituents and businesses need that clarity, because where there is trust in the regulatory environment, there is investment. People need to trust the technology; that is both pro-business and pro-society.

The Government need a plan for who does what, and they need it sooner rather than later. As Europe calls for a leaders’ summit on AI, I call again on the Government to convene a global AI summit, and to look towards an international AI safety agency, headquartered in the UK and modelled on the International Atomic Energy Agency, with a global treaty on pausing the development of super-intelligent AI.

Finally, none of this works unless those who are expected to deliver it can work. Small and medium-sized enterprises make up 99.8% of UK businesses and are often the most vulnerable link in the cyber-supply chains. This week’s discount on Cyber Essentials certification is welcome—the Liberal Democrats called for that—but it is time-limited; it ends in March, and the certificate must be renewed every year. Even the NCSC calls it only a starting point. SMEs need real support from a cyber-security support service when they are hit, to give them clear guidance.

On Second Reading, I compared this Bill to a house with stronger fences and a better alarm, but with its back door left wide open. The past few days alone have shown us why closing that door matters. I urge the Government to consider our amendments, for the communities and councils who rely on critical infrastructure, for the businesses integrated into every supply chain, and for every family who expect the services that they rely on to be there when they need them. We support the carry-over motion.

Mandatory Digital ID

Martin Wrigley Excerpts

Tuesday 21st October 2025 Westminster Hall

[Martin Wrigley (Newton Abbot) (LD)]

The Government say that digital ID will eradicate illegal workers in the UK. It will not. Mandatory digital ID will not stop any more unscrupulous employers than does the check for the right to work in the UK, which is already in place. It is a vanity project that will cost the taxpayer billions of pounds and will not achieve the desired outcomes.

[Adam Dance (Yeovil) (LD)]

Does my hon. Friend agree that Labour needs to wake up? This scheme could put our personal data at risk, while costing taxpayers billions and doing little to restore public trust in the immigration service.

[Martin Wrigley]

I agree. Many of my local residents are still digitally excluded. Lack of mobile signal and in many places no fast internet access means that digital-only solutions leave too many people out in the cold.

[Rachel Gilmour (Tiverton and Minehead) (LD)]

Does my hon. Friend agree that the very idea of “Ihre Papiere, bitte” is not something that my constituents, or the British people more broadly, will stand for? That explains this cross-party opposition—which I, as a true Liberal, fully endorse.

[Martin Wrigley]

I agree with my hon. Friend’s point. The elderly, the disabled and those on low incomes are most likely to be adversely affected by this policy. The Government published a digital inclusion action plan in February 2025, but I hear from constituents that, seven months on, they have seen little or no improvement.

It appears that digital ID will be required not just for accessing employment but as a proof of right to rent, which risks placing additional burdens on people already marginalised in society. Mandatory digital ID also brings a deep unease about the growing relationship between the Government and large tech companies such as Palantir, Apple and Google. As a member of the Science, Innovation and Technology Committee, I have raised concerns about those relationships and have yet to receive satisfactory answers. Knowing that the Government are willing for those companies to hold and have access to such sensitive data is worrying. I will continue to push for answers and will oppose mandatory ID cards.

--- Later in debate ---

[Ian Murray]

A full consultation will be launched by the end of this year. There are two options that the Government could have taken. We could have started from the position of a fully fledged programme, a fully fledged policy, and then taken that out to consultation; or we could take the approach that we are doing at the moment, which is to go out to consultation after we have had some initial consultation with people, so that the formal consultation is shaped by people’s views and the concerns that they raise.

I will give two examples, which are from the island of Ireland and from Northern Ireland and in terms of the common travel area and the Good Friday agreement. These are things that have to be resolved. We now know they are big issues, and that will go into the consultation to try to resolve them. We cannot have it both ways. We have chosen to take this particular approach in order to develop a consultation—

[Martin Wrigley]

Will the Minister give way?

[Ian Murray]

Let me make some progress and I will give way. I want to read Members this paragraph:

“We will develop and establish a trusted and secure service for users to prove who they are, and that they are eligible for a service. Users will be able to store their information and choose to share it when applying to public services. This will improve a user’s access to services by providing a safe and secure way to prove their identity, while reducing time and cost for the public sector. Additionally, we will develop an inclusive approach for all users to ensure that…services are available for”

all, particularly those who are digitally excluded. That is from the Scottish Government in 2021. The hon. Member for Perth and Kinross-shire’s own party as the Scottish Government is developing this; it is actually SNP policy.

Let me just bust some of the myths. This is not a Brit card. I know that members of the SNP like to call it a Brit card, because that is what gives them traction in the way in which they constitutionally do these things, but it is not a Brit card. And let me just deal with the issue about compulsion and mandation, because everyone stands up and calls this mandatory digital ID. It is not mandatory. That is the wrong thing to say to our constituents. It is not compulsory in this country to have a passport, but one is mandatory to travel. If someone wants to travel on a flight, even an internal flight, in this country, they require that ID to be able to travel. It is not compulsory to hold a passport, but it is mandatory to use one for travel. It is exactly the same in this particular instance. It is not compulsory to have one. People will not be asked to show it; they will not be asked to produce it. There is a whole host of use cases that would be voluntary—

--- Later in debate ---

[Ian Murray]

Let me address that point directly. I have already been to Northern Ireland and spoken to all parties in the Northern Ireland Executive, and I have also been to the Republic to speak to the Irish Government about the processes that they have. In fact, they are about to introduce a similar scheme, because all EU countries have to have a scheme up and running by 2026. We fully understand the Good Friday agreement, the common travel area and nationality in Northern Ireland—that people can be British, Irish or both—and that will all have to be built into the system. As a Government, we have taken on board those legitimate concerns—not the myths. I have heard them directly from all parties in Northern Ireland, and we will ensure that those are resolved as part of the process. I hope that the hon. Gentleman will join us in the consultation to make sure that those are resolved.

[Martin Wrigley]

It is not much of a consultation if the Government have already said, very vocally, that they are going to do it. It is really a question of how hard they want to beat people.

[Ian Murray]

Of course it is a consultation. It is about how we get this right, what it looks like, how it is built, how federated data is secured, how we deal with digital inclusion and how we deal with the issues in Northern Ireland. That is what the consultation is about. It is about the Government learning from that. [Interruption.] Liberal Democrat Members are heckling from a sedentary position, but their own leader, the right hon. Member for Kingston and Surbiton (Ed Davey), said on 21 September that “times have changed”, and that he had been impressed by a visit to Estonia, where a liberal Government had brought in digital ID. He said that if a system was

“giving individuals power to access public services”,

he could be in favour. Four days later, he said that

“the Liberal Democrats will fight against it tooth and nail”.

It is the same hypocrisy as the Scottish National party; it was their policy five days before they came out against it.