Question to the Department for Science, Innovation & Technology:

To ask the Secretary of State for Science, Innovation and Technology, whether the (a) National Cyber Security Centre and (b) National Security Unit for Procurement have provided advice to (i) Ministers and (ii) officials on risks associated with the use of Chinese-manufactured Cellular Internet of Things modules in consumer products, including internet-connected vaping devices.

The UK Government takes an actor-agnostic approach to supply chain resilience, focusing on the characteristics and behaviours of technologies and suppliers rather than their country of origin. This ensures that our regulatory frameworks remain objective, proportionate, and resilient to evolving threats.

Ministers receive technical advice from National Cyber Security Centre (NCSC) on a wide range of cyber threats, including on IoT products. Their assessment is that a compromised cellular internet of things module would not, by itself, enable an end-to-end attack. From a cyber security perspective, risk is managed through the broader set of controls supporting monitoring, resilience and recovery across the system. Advice on managing the security of cellular internet of things modules technology is provided to industry and government by the NCSC.