Telecommunications (Security) Bill
Thursday 15th July 2021
(3 years, 4 months ago)
Grand CommitteeTelecommunications (Security) Act 2021 View all Telecommunications (Security) Act 2021 Debates Read Hansard Text Read Debate Ministerial Extracts Amendment Paper: HL Bill 15-III Provisional third marshalled list for Grand Committee - (14 Jul 2021)
Lord Coaker
“Horizon-scanning body
(1) Within three months of this Act being passed, the Secretary of State must establish a body corporate with a remit to consider emerging and future developments for the telecommunications sector for the purposes of identifying current and emerging security threats.(2) The body must include representatives from, but is not limited to— (a) the National Cyber Security Centre;(b) the intelligence services;(c) the National Cyber Force;(d) the Ministry of Defence(e) the Home Office;(f) the Department for Digital, Culture, Media and Sport;(g) the National Security Council;(h) the Investment Security Unit;(i) the Armed Forces;(j) OFCOM;(k) relevant industry bodies and companies;(l) relevant telecommunications and security experts.(3) The body must publish a report annually which is laid before both Houses of Parliament.”
Lord Coaker (Lab)
Good afternoon, everyone. I am looking forward to the Committee session this afternoon. Two days ago was my first Grand Committee sitting as a Member of the House of Lords, and I was impressed by the quality of the contributions. I have been moved by the intellectual power of the people here and I look forward to that. I was grateful to the Minister for her contributions and the way she tried to answer the questions, even if one or two of them were not as well put as her Civil Service brief. I appreciated that, and it helps the Committee enormously when we have that positive, constructive engagement, even if there is a measure of disagreement at times. As I said at the beginning, a Bill like this unites us all in wanting to contribute in a way that defends and secures our country and democracies across the world. It is in that spirit that I move Amendment 18 and table Amendment 25 in my name, and I know the Minister will take it in that spirit.
I also thank the noble and gallant Lord, Lord Stirrup, very much for supporting both the amendments. I know the Committee is looking forward to his informed and experienced contribution to our discussions. Although the noble Lord, Lord Alton, is not present—he will no doubt read Hansard—I also thank him for his support for Amendment 25.
These are probing amendments that challenge the Government to explain to the Committee and the wider public their thinking and why these amendments are not necessary. Their various measures are contained elsewhere in the Bill, but it is an important debate for us to have because, as all of us have said, national security is the first duty of any Government and that includes Her Majesty’s Opposition and other parties. That is what “Government” means in total—the responsibility of us all to our citizens.
These amendments are also saying that, to secure democracies across the world in the face of the autocratic challenges and threats we see, it is necessary for us to work well not only in our own country but with our allies. That is clearly something the Government wish, as well.
Our telecoms infrastructure, as I saw yesterday when I went to Airbus—a brilliant company in Portsmouth—is clearly critical to our defence and security as well as our economic prosperity. The Bill’s impact assessment rightly highlights the threats we face, stating that the
“most significant cyber threat to the UK telecoms sector”
comes from other states. It is not a terrorist threat in the normal sense of a threat from individuals; but when powerful states can take action against us, that is significant for our country and for democracies across the world. The impact assessment continues:
“The UK Government has publicly attributed malicious cyber activity against the UK to Russia and China as well as North Korea and Iranian actors”.
That is worrying and significant for all of us.
Both amendments say that our approach to security has to be co-ordinated domestically and with our allies. That is, frankly, a challenge for any Government. As to the list of bodies I have included in the amendment, I am sure the Minister could say that I have not mentioned this or that body. However, those that I have listed are based on my own research. I am sure that other significant bodies should be on it. However, the point is that the challenge is significant. How will cross-departmental co-ordination on the current security infrastructure work at a domestic and international level? I know that the response is often that we have the National Security Council and that is why it was set up, and the Prime Minister chairs it. It is obviously incredibly important and it would be ridiculous to say that it is anything other than an effective co-ordinating body. However, that does not alter the fact that coming to the table are significant actors in their own right within the sphere. It is right to ask, how do the Government expect the new duties placed on the telecoms sector to work and be policed by all the various bodies?
The amendments also highlight the question of how we future-proof this legislation against current and emerging threats. To be blunt, it is hard enough to deal with the current threats as we understand them. At security levels far higher than those we have in this Committee, there will be those who will not only be trying to deal with the current threats but looking at what might happen, five, 10 or 15 years down the road. That is a real challenge for anyone. How do we stop those threats?
We have come to a view about Huawei. Some may argue that perhaps we should have done so two, three or four years ago but we are where we are and we have now concluded that all Huawei equipment should be out of our country’s networks by 2027. Would it not have been better to have predicted that several years ago, so that we would not have to try to stop that company’s involvement now? How does the Minister believe that the current structures and those envisaged in the Bill will deal with not only current but future threats?
The concern is shared by our allies. The recent NATO summit communiqué stated:
“NATO and Allies…will maintain and enhance the security of our critical infrastructure”,
including “communication information networks” such as 5G. I should say to the Minister—the noble and gallant Lord, Lord Stirrup, will have much greater understanding and awareness of this issue—that one of the most significant moves that the alliance made in that communiqué was to confirm that a cyberattack, including on our own telecoms networks, could trigger an Article 5 response.
With the Committee’s permission, I will read from paragraph 32, as it is so important:
“We reaffirm that a decision as to when a cyberattack would lead to the invocation of Article 5 would be taken by the North Atlantic Council on a case-by-case basis. Allies recognise that the impact of significant malicious cumulative cyber activities might … be considered as amounting to an armed attack.”
I emphasise “armed attack”. We and our allies are saying, quite rightly, that the theory of deterrence is now being applied to the world of cyber. The Minister will understand the principle that an attack on one is an attack on all, so theoretically it could be one of our allies that is subject to that attack and that we come to the defence of. Again, I think that is quite right. Does the Minister have any comment highlighting how the Government see that being taken forward?
Amendment 18 seeks to establish a horizon-scanning body for our telecommunications sector, to identify current and emergent threats and produce an annual report for Parliament. The body would include representatives from the Armed Forces, relevant departments, the intelligence services and the National Cyber Security Centre, as well as industry and security experts. Can the Minister explain how the Government will watch out for future threats without such a body? How will cross-departmental work be managed? Will the new telecoms advisory council include security experts or ex-military personnel?
The Spectator is not a magazine whose political opinions I agree with, but this is so serious. The front page this week features the relationship between China and Cambridge. Whatever the rights and wrongs of it, I am just reporting to the Committee what is said in a well-regarded magazine that I and many other noble Lords read. To have that on its front page, and then inside, significant articles about the relationships and the potential difficulties that they may cause for us on a security level, shows to the Committee and the wider public how difficult this is becoming. You have one of the most brilliant universities in the world being questioned in terms of its relationship with China, in a well-regarded publication. That is a challenge for us as we take this Bill through and what it means for us in maintaining our security to defend our democracy.
Amendment 25 seeks to ensure that the Government publish a long-term strategy for our telecommunications security and resilience. Can the Minister outline how she expects that to happen? We should consider how to collaborate more effectively with our allies—NATO and the Five Eyes—and consider proper resourcing of UK security infrastructure. I believe DCMS is now developing a long-term strategy to consider how international standards can be developed. Can the Minister explain how the UK will work with our allies on R&D or adoption and deployment? This is critical for the security of our nation, so it would be helpful for the Committee to understand.
I hope that the Minister takes my contribution in the spirit in which it is meant, which is to challenge in a way that I hope is helpful to the security of the nation and of our telecoms infrastructure and businesses. The last year or two have been a bit of a wake-up call for all of us, including me, as to the potential threats that there are. Given the security level that we are all at, what some people working at STRAP levels know and understand about the threats to our nation one can only begin to imagine. I look forward to the Minister’s response and to the contributions of the noble and gallant Lord, Lord Stirrup, and other Members of the Committee. This is meant to be a probing, challenging amendment. I hope that the Minister will be able to respond in that spirit, and that we can all look forward to seeing how the security of our nation can be effectively maintained against the threats as we understand them now and as they may emerge in the future. I beg to move.
The Earl of Erroll (CB)
My Lords, I do not want to bang on for a long time because, in a way, this falls in with things such as the technical advisory committee. It is all part and parcel of the same thing, and we have to keep our eyes open and start forward scanning and see what else is out there.
Ofcom is not in fact a department; I seem to remember that it was set up by Europe through regulations and that originally, it reported via Parliament to the European regulators. I am not entirely sure what Ofcom’s chain of command is; I must do some research into it. Having this buried inside such a body without proper parliamentary scrutiny is unwise, so it is only sensible to embed the principle of having proper advisory committees. This is an obvious no-brainer: we need people with these abilities and skills to be advising on this stuff, and I cannot understand why there would be any objection to it.
Amendment 25 covers the very good point about long-term strategy. As was pointed out on Tuesday, our relationship with the Five Eyes could easily change. There have been efforts from time to time to drive a wedge between us, and we need to start looking at that. One cannot assume that the status quo regarding who is an ally or friend will continue for ever. The fact that we are in different parts of the globe and therefore perhaps in different trading blocs could cause undue pressure, so we must have this horizon-scanning, long-term attitude.
The speech of the noble Lord, Lord Coaker, reminded me of the Tallinn Manual and the question of when cyberwarfare escalates to actual warfare because your entire infrastructure and systems have been taken down. It is a very interesting document. I skimmed through it a long time ago, but it was very eye-opening and before we just leap in, people should take a look at it.
That is really all I have to say. This is so obvious, and I just hope that the Government are going to do something about it.
Lord Stirrup (CB)
My Lords, in speaking to Amendments 18 and 25, to which I have added my name, I have in mind the very purpose of the Bill itself, which is, I take it, to ensure the security and resilience of our telecommunications capability here in the UK. The Bill as drafted places certain duties on the providers of those capabilities and gives powers to the Secretary of State to make regulations and issue codes of practice. This is all well and good, but these somewhat mechanistic, albeit welcome, measures will not by themselves result in the necessary degree of security and resilience.
As I said at Second Reading, things move quickly in the world of technology, and they will move even faster during a determined attack on our telecommunications infrastructure. If we are to respond successfully, we will need to be both agile and adaptable. The measures in the Bill will, by themselves, not ensure this.
One of the reasons why we are even considering this Bill is concerns over the position of Huawei in our telecommunications architecture, the clear channel that runs through that company to the Chinese Communist Party, and the ensuing vulnerability of our system. None of this comes as a great surprise, but we have allowed ourselves to get into a position where we are now having to play catch-up. This is largely because we spent the first half of the last decade thinking almost exclusively of the economic opportunities offered by China and very little about the associated security risks; in other words, our decision-making process was unbalanced and distorted. Without proper safeguards, we could easily find ourselves in a similar situation with regard to some future threat.
What sorts of safeguards might help prevent such an occurrence? There is no single answer to this question but at the very least we need a process that provides an appropriate degree of horizon scanning and that, importantly, draws in expertise from across technology, business and security organisations and, indeed, from across different government departments, to give us the best chance of coming to a balanced view.
That is what Amendment 18 seeks to do. It will not cure all ills but it will provide us with a mechanism to drive adaptability, not just in our architecture but in our thinking, something that is traditionally hard to achieve. Of course, the Minister may say that the Bill is not the place for setting out this kind of thing. My response to that would be: if not here, then where? The responsibilities outlined in the amendment must be met if we are to achieve the Bill’s laudable purpose.
Amendment 25 is in many ways a follow-on from Amendment 18. It calls for the deliberations of a horizon-scanning body and the ensuing policies and actions to be presented to Parliament in the form of a comprehensive strategy. Most importantly, it seeks to ensure that such a strategy is coherent with other elements of government policy, as set out in various documents, such as the integrated review, and in other legislation, such as the National Security and Investment Act. It also seeks to encourage international co-operation in this regard. I believe this is essential, since we rely so heavily on collective security for our national safety. The noble Lord, Lord Coaker, has already highlighted the importance that NATO now attaches to the whole area of communications and cyberspace.
Taken together, these two amendments put in place measures that would improve our agility and adaptability and thus strengthen the Bill in terms of its ultimate purpose. If the Government are going to set their face against such measures in this legislation, I ask the Minister to explain how the essential functions they prescribe are to be carried out and how Parliament can be confident of their success.
Baroness Stroud (Con)
My Lords, it is a privilege to speak after the noble and gallant Lord, Lord Stirrup. I support Amendment 18, in the names of the noble Lord, Lord Coaker, and the noble and gallant Lord, Lord Stirrup, and Amendment 25, which is also in the name of the noble Lord, Lord Alton.
These amendments propose a pathway forward that would ensure we are well equipped to handle the challenges that will inevitably come our way in the next decade. Amendment 18 places a requirement on the Secretary of State to create a body designed to analyse and consider existing and emergent threats in the telecommunications sector, incorporating representatives from the major bodies of our national security matrix. This body would then be required to lay an annual report before all Members of Parliament, ensuring adequate parliamentary scrutiny and oversight. Indeed, if not for Back-Bench agitation, we might still be aimlessly integrating Huawei into our critical infrastructure, lagging behind our Five Eyes allies in recognising the security threat that such high-risk vendors pose.
Amendment 25, building on the horizon scanning outlined in Amendment 18, requires the Secretary of State to publish a long-term telecommunications strategy in partnership with the aims and outcomes of our closest Five Eyes and NATO allies. In alignment with the integrated review of security, defence, development and foreign policy, this strategy would ensure that long-termism is built into our thinking across both our economic and strategic aims in the coming decade.
We have one of the most sophisticated and advanced intelligence-gathering apparatuses in the world. We are a significant asset to our Five Eyes and NATO allies and a crucial linchpin in ensuring the international order. Yet we have been slow to respond to the rapidly changing digital landscape that we find ourselves in.
An obvious example of this is the much-discussed high-risk vendor, Huawei. It is extraordinary to think that all the way back in 2013 a report from the Intelligence and Security Committee concluded that Huawei posed a risk to national security and that private providers were responsible for ensuring the security of the UK telecoms network. Yet now, according to Ofcom, Huawei accounts for about 44% of the equipment used in providing superfast full-fibre connections directly to homes, offices and other businesses in the UK.
In a Statement to Parliament last year, the Foreign Secretary made the welcome announcement that
“high-risk vendors should be excluded from all safety- related and safety-critical networks in critical national infrastructure”—[Official Report, Commons, 28/1/20; cols. 710-11.]
and yet, due to how embedded this vendor has become in our critical infrastructure and the lack of competition, Huawei, as we have heard, is not set to be removed as a provider until 2027. It should never have reached this point. A horizon-scanning body and deeper parliamentary oversight would ensure that we are not left sleeping at the wheel again. How was it that our Five Eyes allies were significantly more alert to this risk than we were?
Furthermore, without cross-body co-ordination, the rapid advances in technology we are set to witness over the coming years will make it even more difficult to adapt to threats as they manifest themselves. GCHQ Director Jeremy Fleming suggests that the UK needs to prioritise the advances in quantum computing, as well as working with allies to build better cyber defences and shape international standards and laws in cyberspace. With quantum computing becoming more mainstream, there is a risk that a sudden increase in processing power could render existing encryption methods useless.
These are just some of the challenges we face. The future of our security and sovereignty will depend on the steps we take in this Bill. According to MI5, at least 20 foreign intelligence services are actively operating against UK interests. We have a remarkable security and intelligence community but, as we enter this new era, we must accept that our ability to adapt to emerging challenges will be the defining feature that drives us forward and keeps us ahead of other nations that would challenge our national interests.
We have seen how easy it is for a digital attack to break down our critical systems. Just last month, a ransomware attack in the US took down the entire Colonial Pipeline infrastructure, which transmits nearly half the east coast’s fuel supplies. Analysts have suggested that hackers could have been inside Colonial’s IT network for weeks or even months before launching their ransomware attack.
This issue extends into the digital space. A 2018 report commissioned by the US Senate intelligence committee, The Tactics & Tropes of the Internet Research Agency—a Russian propaganda unit—revealed that there was:
“A sweeping and sustained social influence operation consisting of various coordinated disinformation tactics aimed directly at US citizens, designed to exert political influence and exacerbate social divisions in US culture”.
I posit that we may not even be aware of the scope of the disinformation and destabilisation occurring online that is challenging our sovereignty and internal security.
I support these amendments in light of the fact that it has taken considerable Back-Bench activity to alert us to the security issues posed by high-risk vendors; that we are still not thinking clearly on China; and that we need systems and structures to ensure that long-termism is built into our thinking across both our economic and strategic aims in the coming decade.
Baroness Northover (LD) [V]
My Lords, Amendment 18 would require the Secretary of State to
“establish a body … to consider emerging and future developments for the telecommunications sector for the purposes of identifying current and emerging security threats.”
Amendment 25 would require the Secretary of State to
“publish a long-term strategy on telecommunications security and resilience.”
These are very sensible proposals, and the speakers have made a cogent case. I thank the noble Lord, Lord Coaker, for his wide-ranging and positive introduction to these amendments.
This is an extremely complex area, as we have heard, not only within our discussions of the Bill but beyond. We know from bitter experience that something can be flagged as a risk and then, without proper focus on it—given all that Governments have to focus on —follow-through is less than systematic. Think of pandemics, flagged, not least in the 2015 strategic review, yet followed through with little or no preparation. This picks up a theme that the noble Baroness, Lady Stroud, emphasised in relation to Huawei: awareness but lack of action. Therefore, the case for a body that looks at this area in the widest sense is compelling.
The Parliamentary Under-Secretary of State, Department for Digital, Culture, Media and Sport (Baroness Barran) (Con)
My Lords, I thank the noble Lord, Lord Coaker, for tabling these amendments and for his very generous opening remarks. He reminds us that we must remain vigilant about current and emerging threats to our telecoms networks. Rightly, he also urged the Government to communicate how we will do that in a way that makes sense to the public. Today, we are focusing on this Bill and how it is designed to protect our networks now and into the future.
As we heard, Amendment 18 calls for a body to be set up for the purposes of monitoring current and emerging threats to our telecoms sector. The amendment lists a number of committees, departments, organisations and agencies that should be represented on this body.
The noble and gallant Lord, Lord Stirrup, asked: if not here, where? I will try to answer that question in my remarks.
I assure noble Lords that we already have established procedures to monitor current and emerging threats to the telecoms sector. The National Cyber Security Centre undertakes regular risk assessments of such threats, and those assessments are used to inform government policy. For example, the code of practice the Bill will allow us to issue will be informed by the National Cyber Security Centre’s assessments.
In addition, the Government already have forums in which emerging threats and new technological developments are discussed with industry. The noble Lord, Lord Coaker, asked me to give examples of a particular domestic focus. This is one of them. For example, the National Cyber Security Centre’s network security information exchange is a trusted community of security professionals from across the telecoms sector who come together on a quarterly basis to discuss openly and share information on security issues and concerns. There are also established channels for the kind of cross-government and interagency working that the noble Lord’s amendment seeks to formalise. The Government do not see that it would be necessary to establish a new body corporate, which would simply risk duplicating the work of existing forums.
The noble Lord’s amendment would also make provision for Parliament to receive annual reports on current and emerging threats from this new body. The National Cyber Security Centre already publishes guidance as and when threats develop. Furthermore, as noble Lords are aware, the Intelligence and Security Committee is able to see and scrutinise the National Cyber Security Centre’s assessments of current and emerging threats. Given that there is already this provision for parliamentary oversight, I do not consider that laying a report before Parliament annually would be necessary.
Amendment 25 would require the Government to publish a long-term telecoms security and resilience strategy, covering various topics set out in the amendment, within six months of the Bill’s Royal Assent, and would require this strategy to be laid before Parliament. The Government share the noble Lord’s desire to ensure that this country is fully prepared to overcome future challenges to the security of our telecoms networks. However, the publication of such a strategy is, we feel, unnecessary because recent government reports and announcements, publicly available, already address these topics. The noble Lord will be aware that the Bill is the result of the recommendations put forward in the UK Telecoms Supply Chain Review Report, published in July 2019. That report, along with the Government’s announcements last year, has already set out our strategy for addressing telecoms security risks, particularly relating to supply chains.
In addition, we published our 5G Supply Chain Diversification Strategy last November. This includes our strategy for collaborating with allies on future network research and development, and influencing global telecoms standards. As I will touch on when we debate Amendments 24 and 28, this work is progressing well and the Government’s response to the recent diversification taskforce report, published earlier this month, sets out the steps we are taking to deliver on our goals.
More broadly, the Government’s approach to telecoms security and resilience is informed by cross-government priorities. These include the integrated review, published in March, which committed to launching a new comprehensive cyber strategy this year. The strategy will set out how we will build up the UK’s cyber resilience, deter our adversaries and influence tomorrow’s technologies so that they are safe, secure and open.
Alongside this, a national resilience strategy will ensure that our suite of systems, infrastructure and capabilities for managing the full range of resilience risks becomes more proactive, adaptable and responsive to future threats and challenges. Work is well under way to develop these cross-cutting strategies, and we will ensure that our approach to telecoms security and resilience continues to take them into account.
I think the noble Lord, Lord Coaker, and the noble and gallant Lord, Lord Stirrup, know very well that there is a tension between having a greater degree of focus in a strategy and a wider scope. We believe that we have struck the right balance in this area.
The noble Lord, Lord Coaker, asked about cyber deterrence. He may be aware that the Government will shortly bring forward legislation to counter state threats of the type he described. It will create new offences, tools and powers to detect, deter and disrupt hostile state activity by states targeted at the UK. He also referred, in the context of future-proofing, to the National Security Council. Among its responsibilities is examining forward-looking strategies.
The noble Baroness, Lady Northover, mentioned the role of the FCDO. Of course, she will know that the First Secretary of State provides leadership across departments to ensure that the Government’s response to cyberthreats and our ambition as a cyberpower are fulfilled.
My noble friend Lady Stroud talked about the Government being asleep at the wheel in relation to Huawei. I think that is a little harsh. The Government have always considered Huawei to pose a relatively high risk to the UK’s telecoms networks compared with other vendors. A risk mitigation strategy has been in place since Huawei began to supply equipment to UK public telecoms providers. Obviously, the Government have announced extensive advice to manage those security risks based on the work of the experts at the National Cyber Security Centre. Most recently, the Secretary of State announced advice that providers should remove all equipment made by Huawei from 5G networks by the end of 2027.
The noble Lord, Lord Coaker, asked about the presence of security experts on the recently announced diversification council. I can confirm that a senior official from the National Cyber Security Centre will attend to provide that expertise.
The noble Earl, Lord Erroll, asked what parliamentary scrutiny there was of Ofcom. The chief executive and other senior officials from Ofcom give regular evidence to parliamentary Select Committees, including an annual scrutiny session with the DCMS Select Committee, and it also lay its annual report and accounts before Parliament.
I hope I have managed to address most of the points raised and to reassure your Lordships that, while we recognise the very valid questions that have been asked, we believe that we have the balance right in terms of co-ordination and strategy. With that, I ask the noble Lord to withdraw his amendment.
The Deputy Chairman of Committees (Baroness Healy of Primrose Hill) (Lab)
I have received a request to speak after the Minister, from the noble Lord, Lord Fox.
Lord Fox (LD)
I thank the Minister and other speakers for this debate, which is really important. The Minister was basically saying in her response, “Don’t worry, we’ve got this covered.” If the Government did indeed have it covered, I suggest that ripping out 40% of the 5G network at the cost of several billion pounds to the industry is a pretty poor cover. The point made by the noble Baroness, Lady Stroud, that it took Back- Benchers to highlight this rather than the Government was particularly apposite.
The Minister portrayed the decision to remove Huawei almost as if it was a success of the process. Will she acknowledge that these billions of pounds are growth that we will not get, that they are investment in this country that has been wasted, and that it has put the country in danger in the process? Will she further acknowledge that there might be others who are able to help in the process of avoiding a repeat of what is a huge debacle?
Baroness Barran (Con)
I tried to present the breadth and depth of approaches that the Government are taking to address this incredibly serious and complex problem. If I may borrow the word used by the noble and gallant Lord, Lord Stirrup, we have tried to show some agility in responding to changing circumstances. The noble Lord will be aware that there were changes to the US foreign-produced direct product rules in May 2020 which changed the risk profile of our engagement with Huawei, and we acted on that, so I do not feel that I have to apologise at this point.
Lord Coaker (Lab)
I thank the Minister for her reply and for again seeking to answer the questions. We may well have to come back to some of this, but I take the point that the Government are seeking to address current and emerging threats; I just think that this needs to be more clearly stated in the Bill. The Minister gave examples of cross-government working. We all know that there are examples of cross-government working, but the Committee is saying—I think that there was agreement across the Committee—that sometimes there is a need for a mechanism to ensure that it happens. It may be that another body will do that more effectively in the face of the threats that we face now or may face in the future—it may be that we seek to replace rather than add a body. The Government may want to consider that.
Lord Coaker
“Provision of information to the Intelligence and Security Committee
The Secretary of State must provide the Intelligence and Security Committee of Parliament as soon as is reasonably practicable with a copy of—(a) any direction or notice (or part thereof) that is withheld from publication by the Secretary of State in the interests of national security in accordance with section 105Z11(2) or (3) of the Communications Act 2003;(b) any notification of contravention given by the Secretary of State in accordance with section 105Z18(1) of the Communications Act 2003;(c) any confirmation decision given by the Secretary of State in accordance with section 105Z20(2)(a) of the Communications Act 2003;(d) any reasons for making an urgent enforcement direction that are withheld by the Secretary of State in the interests of national security in accordance with section 105Z22(5) of the Communications Act 2003; and(e) any reasons for confirming or modifying an urgent enforcement direction that are withheld by the Secretary of State in the interests of national security in accordance with section 105Z23(6) of the Communications Act 2003.”Member’s explanatory statement
This new Clause would ensure that the Intelligence and Security Committee of Parliament is provided with any information relating to a designated vendor direction, notification of contravention, urgent enforcement action or modifications to an enforcement direction made on grounds of national security.
Lord Coaker (Lab)
I apologise to the Committee for having to hear so much of me in the first 48 minutes. This is a really important amendment and I will make a couple of general remarks before making some more specific comments.
Concern has been expressed throughout consideration of this Bill about the extent to which the Bill provides for parliamentary scrutiny. Parliamentary scrutiny is the important area that Amendment 22 seeks to address, and I am grateful for the support of my noble friend Lady Merron and the noble Baroness, Lady Northover.
Amendment 22 seeks to improve and prioritise national security. We have all said that we support the intention behind this Bill and the need for national security, but the sweeping powers that the Bill gives the Secretary of State must be used in the interests of securing our critical national infrastructure. Removing Huawei does not in itself do that, so there is a question of accountability here. Amendment 22 is designed to ensure greater scrutiny, focus and transparency and address the deepening hole in accountability presented by the Government. At its heart, it would
“ensure that the Intelligence and Security Committee … is provided with any information relating to a designated vendor direction, notification of contravention, urgent enforcement action or modifications to an enforcement direction made on grounds of national security”
by the Secretary of State, as soon as reasonably possible.
The Minister knows that, during the passage of the National Security and Investment Bill, noble Peers from all sides of this House repeatedly tried to ensure that the Intelligence and Security Committee had oversight of national security issues. To be frank with the Minister, it was difficult to understand why the Government were so determined not to give the committee a role. This amendment says to the Government that the ISC is the appropriate place to discuss matters of national security and that it has a unique role in assessing security implications, as even Ministers accept.
The key point is to ask the Minister how this would work. This is the nub of the amendment and goes to the heart of what many noble Lords have said. The DCMS Select Committee and many of the people who will be looking at these documents do not have the required clearance to scrutinise highly classified evidence, so should the ISC, which does have the necessary security clearance, not have a role? It is the only committee of Parliament that has regular access to documents marked “information sensitive for national security reasons”.
I am sure that many of us simply do not understand that when you look at the state security threats to the telecommunications infrastructure that have been identified by the Government, the level of clearance will not be official-sensitive, STRAP 1 or STRAP 2, it will be STRAP 3. No one in this Committee will see that. Some Members of the Committee may have seen it in the past. So how can Parliament be reassured without knowing that the Intelligence and Security Committee has looked at it? Who has oversight of it? Even the Minister will not have the level of clearance to see all of it, yet she will tell the Committee that Parliament has oversight of these matters, when none of us—or very few of us—have the security clearance to actually look at and scrutinise those threats. So how will Parliament scrutinise it if we do not have the security clearance to do that? It is logically inconsistent. Yet time and again, the Government refuse to allow the committee set up with that express purpose—namely, the Intelligence and Security Committee—the function that it was set up to do on behalf of Parliament. With respect, I simply do not understand why the Government are so resistant to that. On many of the other things that we mention, there is a debate and opinions are exchanged. But this is completely and utterly illogical.
I ask the Committee to consider this. Given that the level of security clearance needed to protect our country, its telecommunications structure and that of our allies from the threats posed by other states is above that of the vast majority of Ministers of the Crown, Members of the House of Lords and civil servants, who is to scrutinise these matters if not the Intelligence and Security Committee? I fail to understand what the answer to that is. Parliament deserves to scrutinise these matters and it should be done by the committee set up to do that because it is the only committee of Parliament that has the necessary security clearance. I beg to move.
The Earl of Erroll (CB)
My Lords, the noble Lord, Lord Coaker, has summed up an important recurring theme that was raised at Second Reading. The Government should take this very seriously indeed.
Oversight by a body with top-level security clearance is essential. I certainly would sleep safer if I knew this was happening. Part of this comes from the Minister’s reply when I started to query the status of Ofcom and its relationship to the Civil Service department. I gather that the relationship of Ofcom is similar to that of an agency—if it is not actually set up as an agency; it is set up as a regulatory body, I think. I remember the huge problem—debacle would be a better word—when Defra failed to bring in the new mapping system back when we were changing the way of paying farmers. Everyone knew that it was about to be disastrous. Everyone could see the train crash coming. The Minister could not do anything about it except stand at the Dispatch Box and say, “I’m not allowed to interfere. It is a separate company. We can only call it to account at the end of the year.” As a result, when it all went pear-shaped and farmers suffered disastrous and severe financial problems, the Minister was retired—and it was not any fault of his. He knew perfectly well what was going on but had no power under the structure.
This is my problem with the agency structure that was set up, I think under Mrs Thatcher, when she was trying to cut back the Civil Service so she took things off the Civil Service books to make the figures look better. We have to be very careful when we are handing huge powers or these momentous decisions to an agency. Therefore, it is important that we get into the Bill mechanisms by which we can know what is going on at the time and make sure that it is not going wrong. This oversight, certainly by the Intelligence and Security Committee, is essential—a no-brainer.
I will just mention that the same principle applies in Amendment 29 in the names of the noble Lords, Lord Clement-Jones and Lord Fox, which I did not put my name to because I thought that was unnecessary. Exactly the same thing applies to the Investigatory Powers Commissioner. Rather than me wasting time speaking again, I will say it now: please will the Government start looking at this more seriously?
Baroness Northover (LD) [V]
My Lords, I have added my name in support of Amendment 22, which the noble Lord, Lord Coaker, explained so comprehensively and so well. He has picked up an ongoing theme that has been so agitating noble Lords—especially, I note, the noble and learned Lord, Lord Judge—about the Executive increasingly and simply bypassing Parliament. I think that the noble and learned Lord will be very interested in this matter when we come to Report in the Chamber.
In this regard, I can do no better than refer the Minister to the speech by the noble Lord, Lord West, at Second Reading. He is the Lords representative on the Intelligence and Security Committee. He pointed out that this is exactly what that committee is for. It is clearly vital that Parliament has a role in what is covered under the Bill, but we also understand the potential security sensitivities here. This is where that committee can play a vital role on behalf of Parliament, but under the strict security rules under which it operates. If there are matters that the Secretary of State is withholding from publication in the interests of national security and in related areas, these must be reported to the ISC. I therefore urge the Minister to accept this amendment.
Lord Fox (LD)
My Lords, I commend the noble Lord, Lord Coaker, and my noble friend Lady Northover for this amendment, which I would have signed had she not done so already. We heard at Second Reading an excellent speech from the noble Lord, Lord West, explaining not only why this amendment is important but why certain figures who would normally speak in this debate are not doing so. He explained that the ISC is seeking to change its MoU. As such, he and others would not speak in this particular debate.
However, we have an analogous debate to refer to, which has already been mentioned. Those of us who are veterans of the National Security and Investment Bill have been through this already. I think the noble and gallant Lord, Lord Stirrup, is the only other person in this Room who was involved in it. I certainly spent some of my life on that Bill.
We sent back to the Commons an amended version of that Bill. Your Lordships adopted an amendment not dissimilar from the one in front of the Committee today. That decision was made, as we heard from the noble Lord, Lord Coaker, because the BEIS Select Committee is not enabled to deal with the level of security information it needs to properly scrutinise the operation of BEIS for the National Security and Investment Act. There is exactly the same situation here. I gather, anecdotally, that the BEIS Committee is already hitting issues with getting the information it needs under that Act.
We also heard anecdotally on Tuesday of the debacle over the Newport Wafer Fab, where the BEIS Secretary of State has failed to use the power given to him by the National Security and Investment Act to do something around national security. The noble Baroness, Lady Stroud, is no longer in her place, but once again the ministry was forced by Back-Bench action to reconsider what it was doing. This should not be how things work. It is beginning to look like these are rhetorical points, rather than actually being usable. I hope the same fate does not befall this legislation and that it actually gets used rather than shelved. But in the same way as BEIS, DCMS will have a Select Committee that cannot access the information it needs to scrutinise the activities covered in this Bill.
The noble Lord, Lord Coaker, notwithstanding the stifling atmosphere of this Committee Room, managed to do a very close approximation of complete incredulity over why the Government should not listen to this fantastic advice. I can say that, having gone through the last Bill and seen how resistant the Government are to advice of this sort, this is neither an accident nor a sin of omission. This is a sin of commission. The Government are very clear that they do not want proper scrutiny of what they are doing, and if this Bill remains as it is, there will not be the scrutiny that is needed. Neutering of that scrutiny is not an accident but a deliberate act of the Government.
Baroness Barran (Con)
My Lords, I thank the noble Baroness, Lady Merron, for tabling this amendment, and the noble Lord, Lord Coaker, for moving it. The role and remit of the Intelligence and Security Committee, as noble Lords have remarked, have been raised a number of times in the other place and at Second Reading of this Bill, so I welcome the opportunity to clarify how appropriate oversight of the Bill’s national security powers will be provided for in the Bill and through existing mechanisms.
Amendment 22 would require the Secretary of State to provide the Intelligence and Security Committee with copies of designation notices and designated vendor directions when such notices, or parts of them, are withheld under Section 105Z11(2) or (3) in the interests of national security. It would also require the Secretary of State to provide copies of notifications of contraventions, confirmation decisions, the reasons for giving urgent enforcement directions when withheld under Section 105Z22(5), and the reasons for confirming or modifying such directions when withheld under Section 105Z23(6).
I will try to correct the suggestion made by the noble Baroness, Lady Northover, and the noble Lord, Lord Fox, that the Government are trying to avoid parliamentary scrutiny on this particular point. That simply is not borne out by the way that the Bill is drafted. We are very clear about where parliamentary scrutiny should take place. I recognise the desire of your Lordships for the Intelligence and Security Committee to play a greater role in the oversight of national security decision-making across government, including in relation to this Bill. As I mentioned earlier, through the oversight of the National Cyber Security Centre, the Intelligence and Security Committee can request information around NCSC advice on, and activities relating to, high-risk vendors.
However, this amendment would extend the role of the Intelligence and Security Committee in an unprecedented way. As noble Lords are aware, the activities of the Department for Digital, Culture, Media and Sport are not within the ISC’s remit. That committee’s remit extends to the intelligence agencies and other activities of the Government in relation to intelligence or security matters, as they are set out in its memorandum of understanding.
The noble Lord, Lord Coaker, asked what he called the “central question” of how this will work in practice in terms of security access. My understanding is that according to the Osmotherly rules detailing how the Government may share information with Select Committees, members of the Digital, Culture, Media and Sport Committee are able to view and handle classified and other sensitive material, subject to agreement between the department and the chair of the committee on appropriate handling. Documents may also be shared with the chair of the DCMS Committee on Privy Council terms, subject to agreement between the committee chair and the department.
The advice of the intelligence agencies will not be the only factor that the Secretary of State will take into account when deciding what is proportionate to include in a designated vendor direction. As well as the advice of the National Cyber Security Centre, the Secretary of State will consider, among other things, the economic impact, the cost to industry and the impact on connectivity caused by the requirements in any designated vendor direction. The ISC does not have the remit to consider non-security issues such as the economic and connectivity implications of the requirements in designated vendor directions. The Digital, Culture Media and Sport Select Committee can consider those wider aspects and that is why it is the correct and appropriate body to see copies of designation notices and designated vendor directions that are not laid before Parliament. Any future changes to the ISC’s remit would be best managed through consideration of the Justice and Security Act 2013 and the associated memorandum of understanding.
For the reasons that I have set out, I am unable to accept the amendment and I hope that the noble Lord, Lord Coaker, will therefore withdraw it.
Lord Coaker (Lab)
I thank the Minister for her reply. The Government are going to have to reconsider this matter. The explanation of what can or cannot be looked at is very unclear. The purpose of the amendment is to make it clear through the legislation that the Intelligence and Security Committee would have an automatic right to look at some of the threats, rather than it being the judgment of someone, who has to consult someone else to make a decision. That is the whole point. It should not be a question of someone deciding after discussion whether the matter should go forward; there should be a requirement in the Bill that that be done.
The point that I keep making is that at security clearance level 3, hardly anyone in the country could look at this matter, but there may well be aspects of a threat to telecommunications from a state that are at that level. All that any of us is saying is that of course Parliament should not be openly told about it, but that does not mean that there should be no scrutiny by the committee set up with that express purpose, so that we have oversight and scrutiny of even the most highly classified information. It would be a great credit to our democracy if the even highest level of security threat were subject to a check, set up by Parliament.
I and the Committee are saying to the Minister that this matter needs to be reconsidered. Even the Government, in response to the debate in the other place, have said that they are going to look at the next annual report of the Intelligence and Security Committee to see whether its remit should be extended to include the DCMS Committee. The Government are therefore aware that there is a problem here and say that they will look at this issue. We are trying to horizon-scan here and are saying that this will be a problem if this proposal is not included in the Bill.
I honestly believe that the Government really are going to have to look at this. I am going to repeat that because it is so important. The Minister herself, even the Secretary of State, will not know of some of this. The noble and gallant Lord, Lord Stirrup, knows how many people know, but it is very few. Yet the Intelligence and Security Committee was set up to consider this issue and we are saying that there should be measures in the Bill to deal with it.
The reason why the noble Lord, Lord Fox, and I are incredulous is that this just does not logically hold together. This is not an opinion but a fact: if the Bill goes through unamended, we in Parliament will not be able to look at the security threats that people are making decisions about. It is accepted that not everybody should be told about such things—of course not—but I doubt whether Parliament thinks that this situation is acceptable. I ask the Minister to reconsider that.
Baroness Merron
“OFCOM’s Annual Report
After section 105Z29 of the Communications Act 2003 insert—“105Z30 OFCOM’s Annual Report(1) Every report under paragraph 12 of the Schedule to the Office of Communications Act 2002 (OFCOM’s annual report) must include a statement on—(a) the adequacy of OFCOM’s resourcing in fulfilling its functions under the amendments made to this Act by the Telecommunications (Security) Act 2021;(b) OFCOM’s determination of the adequacy of measures taken by network providers in the previous 12 months to comply with sections 105A and 105B of the Communications Act 2003 and regulations made thereunder; and(c) OFCOM’s assessment of emerging or future areas of security risk based on its interrogation of network providers’ asset registries.(2) The statement required by subsection (1)(a) must include an assessment of—(a) the adequacy of OFCOM’s budget and funding;(b) the adequacy of staffing levels in OFCOM;(c) any skills shortages faced by OFCOM.””Member’s explanatory statement
This new Clause introduces an obligation on Ofcom to report on the adequacy of their resources and assess the adequacy of the annual measures taken by telecommunications providers to comply with their duty to take necessary security measures. It also requires Ofcom to assess future areas of security risk based on its interrogation of network providers’ asset registries.
Baroness Merron (Lab)
My Lords, I will also speak to Amendment 26, which stands in my name. As I recall raising at Second Reading, the whole point about this legislation is not just its intent but whether it can be delivered in practice. Can it do the job that it intends to do? These amendments are intended to ensure that we know we have the resources, whether in people, funding, infrastructure or whatever, to deliver the protections that the Bill is intended to offer. There are considerable questions about that.
I will focus first on the new responsibilities, remit and powers that are being given to Ofcom. As we know, there has been a vast expansion of Ofcom’s remit over the past 10 years, so it is most important that it is appropriately resourced to carry out its duties and to be very forward-looking. As my noble friend Lord Coaker said earlier, for us, the whole issue of looking forward is a particular concern in the Bill. That has been echoed by many noble Lords this afternoon. I note that reassurance is often given by the noble Baroness, Lady Barran, as the Minister and I am sure that the noble Lord, Lord Parkinson, will also seek to reassure me. But I am sure he will have picked up the feeling in the Room today that we need to go rather further than words of reassurance.
What we know about Ofcom is that experience in national security measures is not its natural and current territory, so the expansion of these duties will absolutely require people with the required level of security clearance and experience. I recall the comments of Emily Taylor of Oxford Information Labs during the debate in the Public Bill Committee in the other place. She has considerable expertise in cyber intelligence and she said at that time that Ofcom
“will have to acquire a very specific set of skills and capabilities, and that will require substantial investment and learning as an organisation”.—[Official Report, Commons, Telecommunications (Security) Bill Committee, 19/1/21; col. 72.]
I also note that a memorandum was published recently by Ofcom and the National Cyber Security Centre about how they will work together as part of the new regulatory regime. On the face of it, I thought that might provide some of the reassurance that I am sure the Minister will wish to give to noble Lords. However, I observe that while the National Cyber Security Centre will indeed be able to provide advice on national security matters, the question is whether Ofcom has the resource and the greater expertise to understand that advice. It is one thing to receive advice but another to be able to work with it. I am sure noble Lords know their own limitations. I certainly know mine when it comes to advice and expertise. For me, that memorandum did not show understanding of the limitations that there are.
Amendment 23 would require Ofcom to report annually on the adequacy of measures taken by network providers to comply with changes introduced in the Bill, empowering the Government to track the effectiveness of the legislation. That seems to be good legislation: to put it in place, to make sure it does the job it ought to do, to resource it and then to track its effectiveness.
Amendment 23 would also ensure that Ofcom will have the human and informational resources to provide an assessment of security risks based on its interrogation of network providers’ asset registers. This needs to include things such as a reference to the adequacy of Ofcom’s budget, funding and staffing levels and any potential skill shortages that might mean that it cannot do the job it is intended to do.
It is interesting to look at the Government’s own impact assessment, which states that the costs of monitoring compliance with the telecoms security requirements could be up to £49.4 million by 2029. Allied to that, Ofcom’s current budget for telecoms security for this financial year has been increased by £4.6 million; that is intended to reflect its enhanced security role under the Bill. The first obvious question to the Minister is whether this funding will be sufficient to meet the demands and to engage those with the right security skills. As a supplementary question to that, what targets does Ofcom have to seek the numbers of new staff it needs?
On staff shortages and funding shortfalls, how does the Minister consider that the Government will be aware of these problems without some kind of annual report? Furthermore, where do the public fit into this? How will they know that everything is in hand without such a reporting requirement being met? In my view, if Ofcom is to do more on security, the Government absolutely have to make sure that it is secure and able in its new role.
We spoke earlier about the absolutely crucial aspects of future proofing and horizon scanning. It seems that Ofcom also needs to be able to assess future risks to the security of UK telecoms. We know that new types of threat have emerged over recent years; for example, attacks on healthcare systems. We are also sensitive to potential future risks; for example, the dependence of cloud computing infrastructure on Amazon Web Services, the dominant vendor in this market. Clearly, dangers could arise if AWS was bought by a hostile foreign state or hacked by a hostile operator. In all these ways, we need to ensure that Ofcom is equipped not just for the present but for the future.
Amendment 26 looks at the very important matter of skills in the wider sector. We know from the Institute of Engineering and Technology that the UK economy is suffering a loss of £1.5 billion per year due to STEM skills shortages, and the Chartered Institute of Personnel and Development has found that two-thirds of employers who have vacancies report that some are proving hard to fill, with engineering being one of the most prevalent.
Amendment 26 seeks to require the Government to publish a review of the implications of skills shortages and training support for the security of the tele- communications network and its supply chain. Again, this amendment looks forward to ensure that we can protect our security capability.
I have a few specific questions for the Minister. I would be interested to know whether he is concerned that the 2027 target for Huawei removal might be delayed due to skills shortages. Can he comment on what skills shortages have been identified as a security risk? What action are the Government taking to fill them? I look forward to hearing from him regarding these amendments. I beg to move.
Lord Stirrup (CB)
My Lords, Amendments 23 and 26 touch on the critical issue of skills, in Ofcom and then more widely in the supply chain. They are right to do so, but in my view they are too constrained and do not go nearly far enough. This is not the fault of the drafters—they have to propose amendments that fall within the scope of this particular legislation, and they have done so admirably—but the problem they expose goes much wider than the field of telecommunication.
We find ourselves in this discussion at least in part because of our current reliance on Huawei technology and on the associated vulnerabilities that this introduces. But why have we become so dependent on Huawei? I said earlier that in the first half of the last decade we made unbalanced decisions about our trade and security relationship with China, and that is true. But it is also a fact that Huawei was—and still is—one of the very few companies to have brought the necessary technology to market. Frankly, there were not many options open to us, so our supply chain is anything but resilient in this area.
There are two elements to this problem. One is the level of industrial commitment to and investment in critical technologies; the other is the skills base to support such industries. Both of these interlinked issues must be addressed if we are to resolve the weakness in our supply chain.
The answer does not, of course, have to be wholly national. Industrial capacity and skills that are sufficiently widespread internationally, particularly among responsible countries that abide by international law, norms and standards, would provide us with an acceptable degree of resilience. This will undoubtedly have to be part of the solution, at least in the short term, but we have to ask ourselves why, in technologies that are so important to our security and that promise such future advantage to the companies involved, we are lagging so far behind. I acknowledge that we cannot lead everywhere and provide everything ourselves, but surely an important part of our national strategy should be to put ourselves in the van of those capabilities that will shape and guard our future.
This is certainly not about direct government involvement in business decisions; that approach already has a quite sufficiently inglorious history. It is, though, about government incentives—not least through a clear strategy and consequent procurement decisions—for the appropriate industries and a national effort to provide the necessary skills base to support those industries.
Amendment 26 makes some modest proposals in this regard and I welcome them, as far as they go, but we need to go much further. Telecommunication is not the only area to be hampered by such problems, and I believe we should take a more holistic approach. I have no doubt the Minister will reject the amendment, although I stand ready to be surprised. If, however, he lives up to my expectations, I invite him to say whether the Government agree with my analysis and, if so, how they propose formally to tackle a problem that is so central to our future security and prosperity.
Lord Fox (LD)
Once again, this is a short but important debate, and one of a continuing series. In response to the noble and gallant Lord, Lord Stirrup, we had a short discussion that, to some extent, was crying over spilt milk about why industrial capacity in telecommunications in the United Kingdom is where it is. I think the noble Earl, Lord Erroll, largely agrees with me that it is to do with the purchasing decisions made by near-monopolistic private sector companies based on price. If that is not a lesson for the Government to take forward, we are all doomed anyway.
To turn to the detail of these two amendments, as both the noble Baroness, Lady Merron, and the noble and gallant Lord, Lord Stirrup, have set out, they are about people. Without overrepeating it, I come to the point I was talking about earlier, which is that BEIS is going through a similar process. It is setting up a unit that is supposed to scan the entire industrial landscape for supposed security problems and alert the Minister to decisions that should be made about the future of those companies. These people will have many of the same skills and face many of the same issues, going forward.
First, does the Minister think there is a sufficient pool of people available to cover both these units? Is it sensible to have two units operating in parallel to, and probably in isolation from, each other, with the BEIS unit setting up a telecoms capability, which DCMS will also have? Perhaps the Minister can tell us what conversations are going on between DCMS, Ofcom and BEIS to avoid that duplication. We have already heard that there are too few people so, frankly, it does not make much sense to have two departments competing for the same people.
More broadly, the noble Baroness, Lady Merron, is completely correct that there is a huge issue with the availability of people. Unless the Government pick up major programmes to train and retrain people and look at skills that are completely necessary to move forward, we will be left high and dry without the skills we need to create the sorts of industries that the noble and gallant Lord, Lord Stirrup, suggested we need. That will take time, so perhaps the Minister can say what the plan is. What is the process and what discussions are going on with trainers, universities and employers to deliver the skill set we need?
Of course, we would want to review all this annually, which is why these amendments are here, so the Government necessarily come to Parliament to explain how they are getting on and what they are doing. I am sure the Government do not want us to be suspicious of what they are doing, and the best way to avoid that suspicion is to be open and transparent, rather than try to operate in a black box.
Lord Parkinson of Whitley Bay (Con)
My Lords, these amendments, both tabled by the noble Baroness, Lady Merron, highlight the two important issues that our short debate covered—the role of Ofcom in relation to the Bill; and skills and training, and their effect on telecoms security. I am pleased to have the opportunity to outline some of the work that has already been done in these areas, which I hope explains why we consider these amendments not to be needed.
Amendment 26 would require the Government to complete a review of, and publish a report on, the impact of levels of skills and training on the security of the telecoms network and supply chain. It would require the Government to publish the report within six months of Royal Assent.
The Government certainly agree that it is crucial that public telecoms providers and organisations such as Ofcom have access to people with the skills that they need to keep our networks safe. DCMS published research this year as part of its annual survey, Cyber Security Skills in the UK Labour Market, which found that 50% of UK businesses have a basic technical skills gap. It also found that they do not have confidence in their ability to carry out basic cybersecurity functions and do not outsource these skills.
That is why the Government have a range of programmes already in place to support the growth of cybersecurity skills. Over the past five years, work funded by DCMS has supported over 160,000 young people to forge a career in the cyber sphere. The department has also funded a range of schemes to help adults or career changers to acquire new skills, most recently through the Cyber Launchpad initiative and projects sponsored through the fast track digital workforce fund.
Clearly, there is still much more work to be done to close the cyber skills gap. However, we are making progress. When compared with the 2018 survey, Cyber Security Skills in the UK Labour Market 2021 found that organisations were less likely to report a basic cyber skills gap in areas such as firewall configuration, restricting administrator rights and patching.
Specifically on skills in the telecoms sector, we know that telecoms providers need to have access to people with the right skills to ensure that their networks and services are secure, as the noble and gallant Lord, Lord Stirrup, rightly said. That is why we are creating a pipeline of these skills for the future, with telecoms apprenticeships currently available across the sector, and over 4,500 people starting this year alone.
The creation of the UK telecoms lab, as announced by my right honourable friend the Secretary of State in the other place last November, will facilitate knowledge sharing and promote skills development in telecoms security. The lab will collaborate with DCMS, the National Cyber Security Centre, the newly established UK Cyber Security Council and industry. It will develop and deliver training packages and support the establishment of professional bodies and communities. I hope that these initiatives demonstrate how seriously the Government take the task of supporting telecoms skills, and cyber skills in particular, and why we feel that the review proposed in the amendment is not needed.
I will speak more broadly about our skills agenda. The Department for Education has targeted specific investment in key areas of learning, such as science, technology, engineering and mathematics—STEM—and technical and digital subjects, which could support careers in telecoms. That includes: £2.5 billion of investment in the national skills fund to support adults to retrain and gain the skills they need for the future; nearly £2.5 billion made available for high-quality industry-designed apprenticeships; £500 million a year towards T-levels; up to £290 million to establish institutes of technology across the country, which will be the pinnacle of technical training; and a new £18 million growth fund to support further and higher education providers to expand high-quality higher technical education.
The noble Baroness, Lady Merron, asked about the impact of skills on the removal of Huawei equipment. We have no plans or intention to delay the 2027 target for the removal of Huawei equipment from 5G networks. Indeed, BT, for example, has already shared in the media that it is making good progress on removing Huawei from 5G networks, starting in Hull. We believe that we are on track.
Amendment 23 would require Ofcom to publish an additional statement as part of its annual report, under paragraph 12 of the Schedule to the Office of Communications Act 2002. This statement would contain information about the adequacy of Ofcom’s resourcing, and telecoms providers’ compliance with their security duties. It would also contain Ofcom’s assessment of any future or emerging risks to telecommunications networks, identified by interrogating telecoms providers’ asset registries.
I reassure the Committee that this amendment is also not needed. The Bill already contains a range of reporting mechanisms that will ensure that Ofcom’s role can be properly scrutinised. I will address three of these mechanisms in particular.
First, Ofcom will need regularly to report to the Secretary of State under new Section 105Z, providing information to assist him with the formulation of policy on telecommunications security. New subsection (4)(a) makes it clear that this report must include information on providers’ compliance with the duties imposed on them by the Bill.
Secondly, Ofcom will need to report on telecoms security in its annual infrastructure report. Clause 11 specifies that this should include information on the extent to which providers are complying with their security duties under new Sections 105A to 105D. Thirdly, by virtue of Clause 14, the Secretary of State will need regularly to report to Parliament on the effectiveness and impact of the new telecoms security framework.
The amendment would address three issues. I will take each in turn. The first concerns Ofcom’s resources, on which the noble Baroness, Lady Merron, began. As my noble friend the Minister mentioned at Second Reading, Ofcom’s security budget for this financial year has been increased by £4.6 million. This funding will allow Ofcom more than to double its headcount of people working on telecoms security, ensuring it has the necessary capacity to deliver its new responsibilities under the Bill. The noble Baroness asked specifically about staffing. Ofcom will work with a recruitment partner to secure the specific cyber skills needed to implement this work. This will include seconding in technical expertise to develop its capability further.
As we discussed earlier in the Committee, Ofcom will also work closely with the NCSC, which will share its expertise to support Ofcom’s implementation of the new regime. The noble Baroness mentioned the relationship between Ofcom and the National Cyber Security Centre. As she noted, the two organisations are in the process of developing a memorandum of understanding and have published a statement summarising how they intend to work together. The three key principles set out in that statement are, first, that the NCSC will provide expert technical cybersecurity advice to Ofcom to support implementation of the new telecoms security framework; secondly, that Ofcom and the NCSC will exchange information where necessary and permitted by law; and, thirdly, that the NCSC will continue to provide incident management support during serious cybersecurity incidents to telecoms operators and to Ofcom as necessary. That statement can be found on Ofcom’s website.
The second area of the amendment is a requirement for Ofcom’s annual report to include information on providers’ compliance with their duties under new Sections 105A to 105D. This reporting would duplicate provisions elsewhere in the Bill. Ofcom is already required to report publicly on providers’ compliance with those duties in Clause 11.
The final point in the amendment is about publishing information on emerging and future security risks. This has also been accounted for in the Bill. New Section 105Z(4)(f) already requires that Ofcom report to the Secretary of State any emerging risks it becomes aware of in its annual report on security. The noble Baroness asked about informing the public. It would be at the discretion of the Secretary of State whether to publish this information.
I can assure the Committee that Ofcom takes a forward-looking approach to regulation to ensure that it is robust in the face of market and technological developments. For example, its recent Technology Futures report looked at innovative technologies that will shape the communications industry, with input from the world’s leading technologists.
I hope that I have provided assurance that adequate and detailed reporting requirements for Ofcom are already outlined in the Bill. As I have set out, it already includes provision for reporting on Ofcom’s work, so additional requirements about skills and training are not necessary. I hope that the noble Baroness will therefore be content not to press her amendments.
Baroness Merron (Lab)
I am grateful to noble Lords and to the Minister for his reply, which referred to various items in some detail. What I take from this debate is that, although I am sure that noble Lords are interested to hear of the various initiatives and actions that are in place and which the Minister has rightly emphasised, the question still remains of whether this is enough. Is this exactly what we need? I feel again that this is something of a theme in our debates throughout Committee. Nobody is suggesting to the Ministers that nothing is being done, but is it being done coherently, is it sufficient and is it what is needed? That is again left hanging in the air.
I am grateful to the noble and gallant Lord, Lord Stirrup, who referred to—these are my words—the need for a national strategy which would, in his words, shape and guard our future. That is exactly the point of these amendments. Indeed, the Government do not do everything, but it is only the Government who have a role in bringing all the parties together and have the ultimate responsibility for security in this country, of course.
I note the helpful remarks from the noble Lord, Lord Fox, who referred to the need to work with other government departments. I would feed that into my point about the need for a strategic approach. My sense from this debate is that this is the part that is not quite clear. As the noble Lord, Lord Fox, asked, what is the plan? We have insight into actions, but whether that is a strategy or a plan is hard to make a judgment on. The Minister indicated that 50% of companies in the relevant sector—that seems a lot—are reporting that they have a lack of cybersecurity skills. Something else that I thought was important was when the Minister spoke of a lack of confidence. We all know that a lack of confidence in any sector, particularly this sector, is problematic and must be addressed.
It is disappointing that the Minister’s response is, again, that this is not necessary and we do not need to publish or to report to Parliament, because I feel it is a missed opportunity to satisfy the country and, within that, noble Lords. It is a missed opportunity to satisfy those who have the security of this country at heart, as the Minister does, about whether the measures are enough and whether they will go fast enough, fully meet the needs of the necessary part of the industry and provide the security needed. Although I am disappointed, I beg leave to withdraw the amendment.
Baroness Merron (Lab)
“Network diversification
(1) The Secretary of State must publish an annual report on the impact of progress of the diversification of the telecommunications supply chain on the security of public electronic communication networks and services.(2) The report required by subsection (1) must include an assessment of the effect on the security of those networks and services of—(a) progress in network diversification set against the most recent telecommunications diversification strategy presented to Parliament by the Secretary of State;(b) likely changes in ownership or trading position of existing market players;(c) changes to the diversity of the supply chain for network equipment;(d) new areas of market consolidation and diversification risk including the cloud computing sector;(e) progress made in any aspects of the implementation of the diversification strategy not covered by paragraph (a);(f) the public funding which is available for diversification.(3) The Secretary of State must lay the report before Parliament.(4) A Minister of the Crown must, not later than two months after the report has been laid before Parliament, move a motion in the House of Commons in relation to the report.”Member’s explanatory statement
This new Clause requires the Secretary of State to report on the impact of the Government’s diversification strategy on the security of telecommunication networks and services, and allows for a debate in the House of Commons on the report.
Baroness Merron (Lab)
My Lords, I move the amendment in my name and thank the noble Lords, Lord Fox and Lord Alton—he could not join us today —for their support.
The amendment is about ensuring that the intent of the Bill can be delivered, and the measures that we are all in favour of will actually happen. There is therefore a link to the earlier debates. Throughout these debates it has become clear that diversity of suppliers is needed at different points of the chain, with sufficient support for the UK’s own start-ups. That will be the only way in which we can secure proper telecoms security.
Even the Government’s 5G diversification strategy demonstrates how diversification and security are inherently linked. It states that if the status quo remains with market consolidation, it will lead to
“an intolerable security and resilience risk”.
However, as was said clearly in earlier debates, the Bill does not even mention supply-chain diversification or the diversification strategy, even though we would all agree that we cannot have a robust and secure network with only two service providers—Ericsson and Nokia—which is the number that will be left once Huawei is removed from our networks. I hope that the noble Baroness the Minister will have the opportunity to address that concern.
It is of course right to remove high-risk vendors from the UK’s networks and enable the Government to designate vendors and require telecoms operators to comply with security requirements. However, as seems obvious, our networks will not be secure if the supply chain is not diversified. All that will happen is that there will be a shift of dependency to another point of failure.
Therefore, the amendment requires that network diversification is reported on annually. That can include an assessment of likely changes of ownership of existing market players, new areas of market consolidation and available public funding. The report could also provide proper accountability for the strategy’s progress, which will lead to real action. That is what we need. We know that that was called for by the Science and Technology Committee, which criticised the current diversification strategy for not having an action plan with clear targets and timeframes for how that funding will be spent.
The Minister will expect a question on how the announced £250 million funding will be spent. We all know that there are small start-up suppliers in this sphere which are desperate for this kind of support. I should also refer to the new advisory council, which, as she knows, I will come to in a later group. There are many unanswered questions about the adequacy and independence of its advice.
We cannot have a secure network with only two service providers, which is what we will effectively be left with after the removal of Huawei. So we need a diversified supply chain, which means diversity of supply at different points in the supply chain and networks not sharing the same vulnerability of a particular supplier. That is incredibly important for network resilience. That is why the amendment has been tabled. We are concerned to ensure that national security is not put at risk due to a lack of diversification. I beg to move.
The Earl of Erroll (CB)
My Lords, this point is very important and has been put across very well by the noble Baroness, Lady Merron. Network diversification will increase resilience and security for various very obvious reasons. The main thing is not just the supply chain. How the internet works is that messages are split over a whole lot of different routers going all over the place. Two things happen. First, because it is split up, if they are all going across different vendors, it is impossible to intercept the entirety of the messages. If it is all over one vendor and there is a clever way of monitoring that, it might be possible to put it together. Funnily enough, if you have lots of vendors, it does not matter whether Huawei is in there or not, and you will end up with flaws.
Also, the resilience of the internet is such that if you knock out a good chunk of the routers, it will still work and automatically route around the ones that have not been knocked out. If they are all from one vendor and all have the same flaw in them at some point, whether they are friendly vendors or not, you can take the whole lot out at once. The very fact that you have a good mixture gives you greater resilience and security. Everyone seems to think that it still runs over a copper wire from one end to the other, but it does not. The IP world is very different from that. That is the main thing.
Amendment 20 is also about long-term strategy. My noble and gallant friend Lord Stirrup is right about all these things. Although the amendments are not in this group, I might as well say now, rather than waste the Committee’s time later, that this lies with the principle of Amendments 18 and 25, that we need the right advisers, who can then advise on the issues that we are now discussing in Amendment 24. It all hangs together. We should not be chopping this up and structuring the Bill in a way that makes us vulnerable.
We may think that we have got the right people in, but we have clearly failed to do all this so far. This is the place to rectify our blindness. From the Minister’s comment, I think that the major change is the diversification and proliferation of civil service departments that are involved in security. That really does reduce our security. The lack of coherence will cause confusion like nobody’s business and will be very expensive.
Baroness Stroud (Con)
My Lords, I support Amendment 24, tabled by the noble Baroness, Lady Merron, which adds a new clause to the Bill that would tackle the pressing issue of network diversification.
As we have heard, the amendment places a duty on the Secretary of State to produce an annual report to Parliament on the progress that has been made in diversifying suppliers for our critical infrastructure in our telecommunications networks and services. The report would then be debated in the other place, ensuring that there is sufficient parliamentary oversight of the successes, challenges and opportunities of our diversification strategy. As I think about it, I am not sure why the Government would not want to commit to such an undertaking. As we have already heard this afternoon, the diversification of our telecoms networks needs to be a priority for this Government and an integral part of Ofcom’s reporting on the progress of these networks.
However, it is important to note that we have a Government who understand the seriousness of this issue. Indeed, the Secretary of State told the other place on 30 November 2020:
“We must never find ourselves in this position again. Over the last few decades, countless countries across the world have become over-reliant on too few vendors”.—[Official Report, Commons, 30/11/20; col. 75.]
This should never have been allowed to happen, and as I have mentioned, I fear that without the adequate parliamentary oversight that this amendment could give us, it is at risk of happening again.
Despite the reassuring statements from the Foreign Secretary, as highlighted in Tuesday’s Committee by the noble Lord, Lord Alton, we have seen new vendors come to market that are also high risk. The noble Lord said:
“Last week, we learned that, in a deal estimated to be worth £63 million … the UK’s largest producer of semiconductors … has been acquired by the Chinese-owned manufacturer Nexperia. Nexperia is a Dutch firm but is owned by China’s Wingtech.”—[Official Report, Lords, 13/7/21; col. GC 461.]
On Wednesday, this led to the Prime Minister expressing concern after the Business Secretary had said that the Government were monitoring the situation closely but did not consider it appropriate to intervene at the current time.
This new challenge is set against the backdrop of the noble Lord, Lord Grimstone, who is at the Department for International Trade, telling the House that he wants to deepen trading relations and trade deals with China, and of China having just overtaken Germany to become the UK’s biggest single import market for the first time since records began. Goods imported from China rose 66% from the start of 2018 to nearly £17 billion in the first quarter of this year.
Lord Fox (LD)
I thank the various noble Lords for their contributions. I will speak to Amendment 24, which bears my name, but I recommend that the noble Baroness, Lady Stroud, reads the Chancellor’s Mansion House speech, in which he calls for a nuanced relationship with China. Failing that, she could read my speech on the first group of amendments, in which I challenged how nuanced a relationship can be with a country threatening both our security and that of its own people. At the heart of the Government’s challenge is to be all things to everyone in this argument. They are doomed to fail if they try to do that.
I turn to the amendment I am supposed to be speaking to. As we discussed at Second Reading, there are essentially three strands to the diversity strategy. The first leg is supporting incumbent suppliers. I was corrected by the Minister: this refers not to domestic suppliers but suppliers we already have, presumably— although it is not explicit—with the ones we do not want having been weeded out. The second is attracting new suppliers into the UK market, and the third is accelerating open interface solutions, which I assume helps the second of those strands in particular.
There is not a strand about growing a domestic industry; some of us—I am one of them—were confused about this. It mostly seems to be about taking advantage of other countries’ businesses that we can trust—or think we can at the moment; I refer the Committee to earlier comments by the noble Earl, Lord Erroll, about today’s allies not always being tomorrow’s allies—rather than massively growing our own national capability. Bearing in mind those three legs, it would be helpful to hear from the Minister how the improvement in the domestic share of this market is planned.
In her letter to many of us on the subject of diversification, the Minister made the point that Vodafone has already attracted six new suppliers, two of which were Samsung and NEC, into the market through the open RAN deployment. I think I asked her at Second Reading when open RAN would become a significant player in telecoms delivery in this country. If she gave an answer then I am afraid I mislaid it, so can she tell us when open RAN will become a significant player or whether it is something of a sideshow? I do not mean that in a bad way; it is a recognition of where it really is in the market at the moment.
The biggest challenge I have with this is that the Government have launched a lot of strategies. They usually come with a glossy document and a picture of a smiling Secretary of State. I can confirm that this strategy is no exception. We have a very nice picture of the Secretary of State, Oliver Dowden, on page 3, but it does not come with a timeline and a delivery plan. The Government would not issue a strategy if they did not have a delivery plan, so I am sure there must be one. I think it would help us all if we understood what the delivery plan is. Perhaps the Minister could share with the Committee the timeline for the delivery of this strategy, otherwise many of us might suspect that it is something that gets only launched, not delivered. I understand that money has been put into it but, again, that does not guarantee that outcomes will be forthcoming.
This amendment has been tabled to reveal how that timeline is going and how the outcomes are being delivered. That is what it is for. It would enable the Government’s spending of taxpayers’ money on delivering this strategy to be tracked by Parliament. That seems a perfectly reasonable function for Parliament to have.
The Minister might come back and say that DCMS is being asked to lay all sorts of things before Parliament. If that is the case, I think that all of us, including me, the noble Baroness, Lady Merron, who spoke very capably on this, the noble Earl, Lord Erroll, the noble Baroness, Lady Stroud, and others are quite capable of coming up with a composite annual report that covers not just the items in Amendment 24, but those in Amendment 25 on strategy, Amendment 23 on Ofcom’s performance, and Amendment 26 on skills. Taken together, I am sure we could put together a composite annual report in the next round of discussions that would save DCMS having to make several different annual reports. I suspect that that might be a way forward and look forward to the Minister embracing this idea, because of course DCMS wants to demonstrate how it is delivering its diversification strategy.
Baroness Barran (Con)
I am grateful to all noble Lords for their contributions to this short debate and consideration of the Government’s ambitious diversification strategy. The amendment tabled by the noble Baroness, Lady Merron, raises the important issue of diversification, which I know is of great interest to your Lordships, as it was to Members in the other place. Diversification is a key part of the Government’s broader approach to ensuring that our critical networks are healthy and resilient. That is why the Government set out their 5G diversification strategy last autumn, and we are fully committed to ensuring that this strategy comes to fruition.
Our long-term vision for the telecoms supply market is one where, first, network supply chains are disaggregated, providing network operators more choice and flexibility; secondly, open interfaces that promote interoperability are the default; thirdly, the global supply chain for components is distributed across regions, creating resilience and flexibility; fourthly, standards are set transparently and independently, promoting quality, innovation, security and interoperability; and finally, security and resilience is a priority and a key consideration in network design and operation. However, the Bill focuses on setting clear security standards for our public networks and services. As the noble Baroness, Lady Merron, pointed out, although diversification is designed to enhance security and resilience, not all diversification activity is relevant to the security and resilience of our networks. That is why we believe the amendment would not be appropriate.
The Government have already made progress since the publication of our strategy, including the creation of the Telecoms Diversification Taskforce, which set out its recommendations in the spring. Work is already under way to implement several of those recommendations. Research and development was highlighted by the task force as a key area of focus in order to promote open-interface technologies that will establish flexibility and interchangeability in the market. As raised by the noble Baroness, Lady Merron, and the noble Lord, Lord Fox, it will also allow a range of new smaller suppliers to compete in a more diverse marketplace.
That is why the Department for Digital, Culture, Media and Sport was delighted to announce the launch of the future radio access network competition on Friday 2 July. Through this, we will invest up to £30 million in open radio access network research and development projects across the UK to address barriers to high-performance open deployments. This competition is part of a wider programme of government initiatives, which includes the SmartRAN Open Network Inter- operability Centre—more friendlily known as SONIC Labs—a facility for testing interoperability and integration of open networking solutions, which opened on 24 June. A number of leading telecoms suppliers are already working together through this facility.
We welcome recent announcements from operators including Airspan, Mavenir, NEC and Vodafone to introduce open radio access networks into their infrastructure. This demonstrates that industry is working alongside us, here in the UK, to drive forward the change needed in the sector. We continue to work with mobile operators, suppliers and users on a number of other important enablers for diversification; for example, we are developing a road map for the long-term use and provision of legacy network services, including 2G and 3G. Alongside this, the Government have led efforts to engage with some of our closest international partners, including the Five Eyes, to build international consensus on this important issue.
We are also working to deliver on UK issues in standard- setting bodies, and working with industry, academia and international partners to ensure that standards are set in a way that aligns with our overall objectives. Ensuring that standards are truly open and interoperable will drive market growth and diversification. Through the UK’s G7 presidency, we took the first step in discussing the importance of secure and diverse supply chains among like-minded partners and the foundational role that telecommunications infrastructure, such as 5G, plays.
The noble Baroness, Lady Merron, asked how we were planning to spend the initial £250 million, which we announced to kick off work to deliver our key priorities. These priorities have been informed by the recommendations of the Telecoms Diversification Taskforce and include: establishing a state-of-the-art UK telecoms lab; exploring commercial incentives for new suppliers; launching test beds and trials for new technologies such as open RAN; investing in an R&D ecosystem; and seeking to lead a global coalition of like-minded partners on an international approach to diversification. In response to questions from the noble Baroness and the noble Lord, Lord Fox, about the growth of UK businesses, we have been clear that we are focused on investing in the UK and in UK businesses, but do not think that a UK-only solution is a wise or realistic option.
We are working closely with operators and suppliers to develop targeted measures that address the needs of industry to deliver our long-term vision for the market. We responded to the task force’s findings in July and outlined our next steps and the use of that initial investment. If the noble Earl, Lord Erroll, has not seen the government response, I am sure he would find it interesting. It also sets out our plans to create a diversification advisory council, which will meet quarterly. I hope that responds to his question.
Baroness Merron (Lab)
My Lords, this has been a short debate but it has been valuable in shining a light on the requirement for diversification and the need to be sure that we are in the right place. I thank the Minister for her reply and the details she gave in response to various questions, including my own. Of course, as ever—I am beginning to feel like a stuck record—the requests to ensure that there is a reporting facility, so that we know all the things in place actually work, have not been accepted.
I was interested in the confidence of the noble Lord, Lord Fox, when he suggested to the Minister that there could be great creativity employed by all noble Lords. I am sure that is indeed the case, but I say to him that I fear our creativity is perhaps not required on this occasion, although I am sure we will stand ready should it be so.
I welcomed the comments of the noble Earl, Lord Erroll, who spoke about the shifting sands of alliances and allies. That is an important point when we consider diversification. I did of course hear the Minister say, rightly, “Of course, this is not just a UK solution to our security”, for a range of excellent reasons. However, we have to be able to take our place and it is that which is of concern. It is not just that the chain is in reference to the UK but that it should take account of those shifts which the noble Earl referred to.
The noble Baroness, Lady Stroud, again asked: “Why on earth would the Government not want to have more parliamentary oversight?”. I will leave that to others to answer, but it seems that it is not flavour of the month in the debate that we are having.
The Minister referred to my question about how the £250 million would be spent, and I am sure it was of great interest to all noble Lords to hear that. Yet it still leaves the question as to why it cannot be matter of report, of why Parliament cannot be not just reassured but informed, and have the opportunity to interrogate and to add. I have a sense that parliamentary oversight—and not just in this area—is not regarded as something which assists process, when in fact the whole experience is that it does. With that, I beg leave to withdraw the amendment.
Baroness Merron
“Telecoms Supply Chain Diversification Advisory Council: security function
(1) The Telecoms Supply Chain Diversification Advisory Council must discuss the impact of diversification on the security and resilience of public electronic communication networks and services at their quarterly meeting.(2) The Telecoms Supply Chain Diversification Advisory Council may advise the Secretary of State based on those discussions, and this advice must be published. (3) The membership of the Council must include members with expertise in security.(4) The appointments process for the Council must be transparent and consider the previous security experience of applicants.”Member’s explanatory statement
This amendment aims to probe the function of the Advisory Council in relation to the Bill.
Baroness Merron (Lab)
My Lords, I am pleased to speak to Amendment 28, which stands in my name. It is the result of a number of recent developments, which I shall refer to. Noble Lords will be aware that on 2 July the Government published their response to the Telecoms Diversification Taskforce’s report and in it announced that the taskforce was now to transition into the Telecoms Supply Chain diversification advisory council, which came up earlier today. The Minister will recall that in response to a Written Question from me she said:
“The Advisory Council will play a key role in overseeing and offering scrutiny to the delivery of the 5G Supply Chain Diversification Strategy. We will also draw on the expertise of the Advisory Council for wider telecoms supply chain diversification issues beyond the RAN (Radio Access Network).”
That is all well and good. However—and this is the point that the amendment seeks to unravel—the Government have also announced that Mr Simon Blagden will be the new chair of this permanent council. Noble Lords will be aware that Mr Blagden was the non-executive director of Fujitsu UK during the Post Office scandal and has donated more than £215,000 to the Conservative Party.
As we have all discussed, diversification is inherently linked to security, so the new advisory council has to provide sound, expert advice that will secure our telecoms network, and we need confidence in that. The point I want to explore with the Minister, as she is already aware from Written Questions that I have submitted, is that the appointment of Mr Blagden raises a number of serious questions about the council’s independence and how the appointment will be able to benefit national security.
In addition to tabling Amendment 28, I have a number of questions to tease out all these points. It is also worth noting that in the past 24 hours there have been reports of a telecoms company, IX Wireless, having given—it has come to light through correct declarations of course—more than £20,000 to Conservative MPs, while the Secretary of State has given this same company glowing endorsement at a launch event, with a promotional film, which I have seen, showing him in his ministerial office with the executives of that company.
I should say to the Minister that it is a question not just of how things are but of how things look. Of course there will be facts on which I am sure the Minister can enlighten us. I have a number of questions in that regard for her relating to an inquiry about the appointment process that was in place for Mr Blagden. Who was involved and which Minister made the final decision? Will there be payment for Mr Blagden in his role as chair? How will the council give independent advice and what happens if Ministers reject that advice? Will there be security experts as members of the advisory council? What knowledge did Mr Blagden have of the faults with the Horizon system during his time at Fujitsu? Can the Minister confirm that Mr Blagden has no remaining financial interests in Fujitsu?
I know that the noble Baroness may not be in a position to answer those questions now. In which case, I hope that she will write to me before we go into the Summer Recess. I beg to move.
Lord Fox (LD)
Before I comment on that excellent speech from the noble Baroness, Lady Merron, I want to return to the answer that the Minister gave on the Newport Wafer Fab issue, which proves the point that we were making on the need for the ISC to be involved. Regarding the ISC issue, the Government furnished themselves with the National Security and Investment Act, which was supposed to deal with issues such as this. However, the Prime Minister has chosen to refer it back not to the people running that unit but to the National Security Adviser, which proves the point that someone with access to national security information is needed to make decisions of this nature, rather than an organisation that does not have access to the information. It absolutely proves the point that our amendment on the ISC is completely appropriate, just as it was appropriate for the BEIS analogue of what is happening here.
The noble Baroness, Lady Merron, made an excellent speech and I am not going to attempt to adorn it either with my normal flippancy or with detail. There is just one issue that I wish to raise regarding Simon Blagden. Are there any outstanding legal liabilities from his time at Fujitsu? In other words, has his activity been fully exonerated or is there potential legal recourse? Other than that, I echo the point that perception of these issues is as important as reality. If the Government continue to operate in a black-box way, everybody will assume that things are going on that they cannot see and that should not be happening. It is therefore in the Government’s interests to be transparent about how that person in particular was appointed and how the advisory council will operate.
Baroness Barran (Con)
My Lords, I thank the noble Baroness, Lady Merron, for tabling the amendment and for giving me an opportunity to provide an update on the work of the Diversification Taskforce and the new diversification advisory council.
The Government recently announced the council, building on the work of the Diversification Taskforce, chaired by my noble friend Lord Livingston of Parkhead. I should like to take this opportunity to offer my thanks to him and the taskforce members for volunteering their valuable time and knowledge to their excellent review. Their recommendations and expertise will remain crucial to helping us bring greater resilience and competition to our future networks as the taskforce now transitions to the new diversification advisory council.
The Government recognise that diversification is a broad and complex issue relating to matters of security and resilience, technology and geopolitics. It is for this reason that we sought the advice of the experts appointed to the diversification task force. Many of the task force members will continue to provide advice as part of the new advisory council. In appointing the membership of the advisory council, the Government have followed all standard processes. The Government have ensured that the council comprises experts from both industry and academia across a wide range of subject matters, including security, of course.
Baroness Merron (Lab)
My Lords, I thank the Minister for her response. I will of course read it carefully so that I can again appreciate her answers to my various questions. There are some questions that I think are still outstanding, which also chime in with the question from the noble Lord, Lord Fox, regarding Mr Blagden’s links with Fujitsu and continuing potential issues in relation to that. I feel there are still some unanswered questions and would be grateful for a reply to those. I am absolutely sure that the Minister will write to me about those points.
I am grateful to the noble Lord, Lord Fox, for making the point, as I did, that there is reality and perception, and they both matter. There are clearly concerns about this appointment and about the need for assurance regarding security advice being impartial and appropriate. It is undoubtedly the case that sunlight is always the best disinfectant so, if there are any chinks of sunlight not yet coming through, I am sure that they will be forthcoming. With that, I beg leave to withdraw this amendment.
“Oversight by the Investigatory Powers Commissioner
(1) The Investigatory Powers Act 2016 is amended as follows.(2) After section 229(3)(j) insert—“(k) the exercise by the Secretary of State of functions under section 105Z1 of the Communications Act 2003”.”Member’s explanatory statement
This amendment would give the Investigatory Powers Commissioner oversight of the power given to the Secretary of State in this Bill to outlaw the use of individual vendors.
Lord Fox (LD)
I am moving this amendment on behalf of my noble friend Lord Clement-Jones, in whose name it is, who unfortunately could not come today. He figured that this would be taken on day three of the process, but we have got ahead of ourselves. I also thank the noble Earl, Lord Erroll, for his support for this amendment when he spoke to the second group. It is appreciated. I know that he has had to leave.
As Comms Council UK has pointed out, new Clause 105E is not the only new clause to give the Secretary of State extensive powers; there are others. New Clause 105Z1, for example, gives powers to the Secretary of State to outlaw the use of individual vendors, potentially with no parliamentary oversight, if the Secretary of State considers that it would be contrary to national security.
Clause 15 creates a scheme for dealing with particularly high-risk vendors by inserting new clauses into the Communications Act 2003. These empower the Secretary of State to give designated vendor directions where they consider it
“necessary in the interests of national security”
and the requirements imposed are
“proportionate to what is sought … by the direction.”
The designated vendor direction can impose wide-ranging requirements on providers on their use of
“goods, services or facilities … made available by a designated vendor specified in the direction.”
While vendors are entitled to notice of their designation if “reasonably practicable” to do so, they are not entitled to be consulted or informed of the reasons for the designation if the Secretary of State considers it contrary to national security. Vendors are also entitled to notice when directions are imposed on providers or when a designated vendor direction is revoked, but this right does not apply if the Secretary of State considers it contrary to national security.
The effect of all this is that, while a vendor may know of its designation, the providers with which it does business can have various restrictions imposed because of their relation to the designated vendor without the vendor knowing the reasons or possibly the existence of such directions. This is complicated but serious, and in several scenarios the vendors would have no real prospect of mounting any legal challenge, even under the closed material procedures provided for in the Justice and Security Act 2013.
Cutting to the chase, this amendment would give the Investigatory Powers Commissioner oversight of the power given to the Secretary of State in the Bill to outlaw the use of individual vendors. Without this, we are telling suppliers that they essentially have to operate without full legal protection. I cannot help thinking that this will discourage the future investment we need. I am interested to hear how the Government think they can mitigate an essentially Orwellian situation in which people find themselves in an adverse legal position but they do not know why, and sometimes they do not even know that they are there. I beg to move.
Baroness Merron (Lab)
My Lords, I thank the noble Lords, Lord Clement-Jones and Lord Fox, for tabling this amendment. I do not have too much to add to this brief and interesting debate, but I take the opportunity to thank the Constitution Committee for its report on the Bill.
At Second Reading the Minister said:
“Oversight of the Investigatory Powers Act regime by the Investigatory Powers Commissioner is considered appropriate because of the potential intrusion into the private lives of individuals as a result of the use of covert powers. The national security powers in this Bill are very different from those in the Investigatory Powers Act”.—[Official Report, 29/6/21; col. 747.]
However, she did not say why it would be wrong for the commissioner’s remit to change. This is the one point I put to the Minister, and it would be helpful to have a response.
Lord Parkinson of Whitley Bay (Con)
My Lords, I thank the noble Lords, Lord Fox and Lord Clement-Jones, for tabling this amendment. As the noble Lord, Lord Fox, says, the noble Lord, Lord Clement-Jones, is a victim of the speedy progress we have made in this Committee.
Like them, I recognise the importance of proper oversight and scrutiny in the use of the Bill’s powers. The amendment they tabled aims to give the Investigatory Powers Commissioner oversight of the Secretary of State’s power to issue designated vendor directions. The Bill already contains effective mechanisms for oversight of the Secretary of State’s use of those powers to give a designated vendor direction or designation notice. It requires the Secretary of State to lay copies of designation notices and designated vendor directions before Parliament. That will provide Parliament with the opportunity to scrutinise their use.
As the Committee has heard, on very rare occasions the Secretary of State may choose not to lay a designation notice or direction before Parliament because to do so would be contrary to the interests of national security. Where this is the case, the Digital, Culture, Media and Sport Select Committee will be able to view such directions and notices, so there will be oversight there.
On the legal point that the noble Lord, Lord Fox, raised, designated vendor directions and designation notices are subject to ordinary judicial review principles. The Secretary of State will issue designation notices and designated vendor directions only where they are necessary in the interests of national security and the requirements in the directions are proportionate.
The Investigatory Powers Act 2016 provides a frame- work for use by the security and intelligence agencies, law enforcement agencies and other public authorities to obtain communications and communications data. The role of the Investigatory Powers Commissioner is independently to oversee the use of these powers, ensuring that they are used in accordance with the law and in the public interest. The regime set out in the Investigatory Powers Act is not directly comparable with the new powers and framework set out by this Bill, as the noble Baroness, Lady Merron, noted. The reason for that is that oversight of activity by the Investigatory Powers Commissioner, as authorised by the Investigatory Powers Act, is considered appropriate because these powers often involve balancing important questions regarding the right to privacy.
The national security powers in this Bill are very different from those in the Investigatory Powers Act. They focus on protecting public telecommunications networks and services from the threats posed by high-risk vendors. That is different from questions about individual citizens, their communications and their communications data. That is why we respectfully disagree with the suggestion by the Constitution Committee of your Lordships’ House and feel that it would not be appropriate for the Investigatory Powers Commissioner to have an oversight role in respect of this Bill.
Briefly, that is why the Government disagree with this amendment and hope that the noble Lords, Lord Fox, will be content to withdraw it.
Lord Fox (LD)
I thank the Minister for his response—but not much. There is a tendency, which has come through in this and lots of other Bills, for representatives of Her Majesty’s Government to stand up and completely ignore important committees of this House. The Constitution Committee and the Delegated Powers and Regulatory Reform Committee are not any old committees; they are very serious. The way in which their advice—or rather more than advice—has been dismissed across the board by both Ministers in this debate is a serious development. I implore representatives of Her Majesty’s Government to take those committees more seriously, because their not being observed is somewhat an abuse of process.
That said, I will read the Minister’s response in detail, with a suitably socially distanced lawyer to advise me. I do not think we have heard anything that makes this amendment less needed but, at this stage, I beg leave to withdraw the amendment.
“Definition of public electronic communications network
In section 151 of the Communications Act 2003, in the definition of “public electronic communications network”, at the end insert “, including—(a) landline communications systems;(b) mobile data, audio and video networks;(c) digital surveillance networks;(d) satellite delivered networks;”.”Member’s explanatory statement
This amendment clarifies the definition of “public electronic communications network”.
Lord Fox (LD)
We are down to the irreducible minimum. During my Second Reading speech, I asked the Minister about the range of technologies covered by the Bill. I do not recall getting a meaningful answer, so I thought I would try again using this as a probing amendment.
The noble Baroness, Lady Merron, talked about the creativity of your Lordships. I am now going to test your memory functions, which I know can sometimes be stretched in this House. I would like your Lordships to cast your minds back to 2003, the year when the Nokia 1100 mobile phone was introduced. Few noble Lords will remember the number, but most of you will remember the phone. It was an iconic phone that took over mobile telephony. For those who would like to see one, I have two and, for as long as 3G is available, they will continue to work. More than 250 million of these basic GSM phones were sold. It was the best-selling consumer electronics device in the world at that time—the state-of-the-art communications device—and was discontinued in 2009.
Meanwhile, at the same time, the Communications Act 2003 was introduced to regulate machines such as the Nokia 1100. This has not been discontinued but has enjoyed several patches along the way. As I have said, this is a probing amendment seeking to clarify the definition of “public electronic communications network” within the 2003 Act. I think you see what I have done; I have tried to illustrate that the world has changed a bit since 2003.
The amendment seeks to amend Section 151 of the Communications Act by adding a contemporary definition of the range of communication networks that increasingly have emerged since the Act was conceived, when Nokia ruled the roost. It would introduce a new clause to the Bill that would define the “public electronic communications network” as
“landline communications systems … mobile data, audio and video networks … digital surveillance networks … satellite delivered networks”.
My first question to the Minister is: in her opinion and that of the department, which of these categories is covered by the Bill and which is not? I also have some specific scenarios that I would like the Minister to consider. The noble Baroness, Lady Merron, will be pleased to note that they are focused on the consumer—an issue she addressed earlier in the week.
First, when broadband or 5G are delivered by satellite, whether by the BEIS-owned OneWeb or the Musk-owned SpaceX, to what extent is the satellite element covered by this legislation?
Secondly, when a facial recognition camera captures an image, sends that image to a database using a closed network and, in turn, contacts either a public sector or private sector operative via a smartphone, which part of this—if any—is covered by the legislation?
Thirdly, data is being relayed back and forth over smart speakers—Alexa and its, or her, colleagues—so do these transactions fall within the purview of the Communications Act or the Bill? For example, with smart speakers, does the Bill cover only the transmission and not the speaker itself? If that is true, what, if anything, covers the security integrity of the speaker and its software?
My fourth question concerns data travelling between smart meters, home thermostats, camera doorbells and the ever-increasing internet of things. How is their security and integrity protected by the Bill? If the answer is that they are not protected, where do these modern manifestations of communications fit in? How is the security of these things being protected for the consumers of today?
This is not just a piece of legislative housekeeping. The noble Lord, Lord Alton, raised other potentially risky companies in his speech on Amendment 1; at Second Reading I raised a range of other companies. I will not repeat them but they are in Hansard. These are just a few of the businesses involved in the sorts of activities that I have just outlined, so by understanding which activities are included in the Bill we may start to understand which companies and technologies it includes. It is about how satellites, cameras, smart speakers and the internet of things fit in the purview of what is now called communications. Times have changed since 2003. Can the Minister please update us? I beg to move.
Baroness Merron (Lab)
My Lords, I thank the noble Lords, Lord Fox, Lord Clement-Jones and Lord Alton, for tabling this amendment. The noble Lord, Lord Fox, has set out why they believe this definition of a public electronic communications network is needed. I also appreciated his reference to the importance of consumers, who, after all, are core in all our discussions.
It is important to hear from the Minister whether she believes that this definition is limiting for security purposes and what impact it would have. Perhaps she can advise on whether she feels that anything is missing which should be in there. Would this definition inhibit the future-proofing ability of the Bill? I look forward to hearing from the Minister.
Baroness Barran (Con)
This amendment seeks to clarify the definition of a public electronic communications network contained within Section 151 of the Communications Act 2003. I thank the noble Lord, Lord Fox, for moving it. It aims to do this by including specific examples of networks and systems covered by that definition.
In response to the noble Lord’s first question, three of the suggested examples in the amendment are already covered by the current definition of public electronic communications network, to the extent that they are electronic communications networks
“provided wholly or mainly for the purpose of making electronic communications services available to members of the public”.
These three examples are: landline communication systems; mobile data, audio and video networks; and satellite-delivered networks.
However, as the noble Lord explained, the amendment also refers to “digital surveillance networks”. I understand that the noble Lord is referring principally to CCTV and other similar technologies of the kind used by law enforcement and local authorities for specific surveillance purposes. These types of technologies have been raised by a number of noble Lords in previous debates, including the noble Lords, Lord Alton and Lord Fox. Such closed networks do not fall within the definition of a public electronic communications network as set out in Section 151 of the Communications Act. That definition refers to an electronic communications network that is provided
“wholly or mainly for the purpose of making electronic communications services available to members of the public”.
I emphasise “wholly or mainly”, because the noble Lord gave examples of where services might be provided which could reach a member of the public, but not “wholly or mainly”.
The powers in the Bill are intended to create a stronger regulatory and legislative framework to protect against the security threats to our public electronic communications networks and services, such as those provided by companies such as BT and Vodafone. Public networks are those most widely used by businesses and the public and it is right that the Bill should focus on the protection of those networks. Furthermore, any change to the definition of public electronic communications networks to include CCTV and other similar networks to which the noble Lord referred would affect other sections of the Communications Act beyond those relating to security. That is because the current definition of a public electronic communications network is used across Chapter 1 of Part 2 of the Act, and not only in Sections 105A to 105D, which this Bill replaces.
The consequences of such a change would be wide-ranging. For example, Section 127 creates a criminal offence of improper use of public electronic communications networks, as defined by Section 151. If the definition changed, the scope of those caught by that offence would also change. It would also affect other legislation that makes reference to the Act’s definition, such as the Privacy and Electronic Communications (EC Directive) Regulations 2003 or the Insolvency Act 1986. Any such change to the definition would therefore have substantial unintended impacts for providers of digital surveillance networks and for many other entities, including Ofcom, of course.
The noble Lord also asked how the security of digital surveillance networks could be assured. There is of course already legislation and extensive guidance in place to assure security and prevent the abuse of information gathered by CCTV and surveillance camera networks. As noble Lords will be aware, the Information Commissioner’s Office is the UK’s independent regulator for data protection and is responsible for providing advice and guidance on compliance with the UK’s data protection laws. All organisations in the UK that process personal information must comply with the requirements of the UK General Data Protection Regulation and the Data Protection Act 2018. The Information Commissioner’s Office has issued a specific data protection code that provides recommendations on the use of CCTV systems to help organisations comply with the Data Protection Act.
The Information Commissioner’s Office’s code and the Data Protection Act ensure that any personal data gathered via CCTV and similar networks is kept confidential and subject to the highest protections, including secure encryption of data. Where closed networks, such as CCTV and other similar surveillance technology, are used by public bodies or within critical national infrastructure, there are specific arrangements in place. Lead government departments, advisory partners —including the National Cyber Security Centre—and regulators work with infrastructure owners and operators to manage and mitigate the risk of security issues. There are, therefore, already adequate measures in place regarding safe deployment of CCTV and other similar surveillance technologies within the UK. Indeed, we are strengthening the actions we can take in this area.
Lord Fox (LD)
My Lords, there are more Bills to follow; I fear that I am being drafted into the purchasing Bill and the other Bill that the Minister just mentioned.
The Minister is wrong to conflate data protection with security—we are talking not about data protection but about security. There is a big difference between the role of the ICO and that of security. I do not think that that helps answer the questions that I was asking.
Perhaps this is for the Bills to come rather than today’s Bill, but there is something about the collective threat. If everybody’s smart meter is shut down that is a national emergency, not a personal emergency. There is a national security issue around personal data devices and somewhere, whether in this Bill or those to come, there needs to be the recognition that collective security happens when everybody’s systems are secure from threat. If I were a terrorist, it would be much easier to do those kinds of things than doing some big, national thing that is protected by the National Cyber Security Centre.
That is the point of what I am putting forward. The internet of things increases the security risk to every home all the time. Similarly, every time someone turns on their GPS locator, they are putting themselves into a system that is followed. The Minister carefully used the phrase wholly or majority use data. Increasingly with cars and satellite navigation systems, and when we move to electric and autonomous locations, all that data is becoming publicly available. In other words, my car is fed into your car, which is fed into her car to make sure that we do not run into each other. The idea that somehow you can draw these lines and say that only 10% of the data is used in a public way and 90% is not starts to become irrelevant, if it is not already. That is what I am trying to highlight.
I did not expect for a minute the Minister to say that the Government would amend Section 105 of the Act. The point was to really highlight this issue, because if the Government do not address it in this way or another then personal security on a mass level is compromised, which then becomes a national security issue. That was the point of the amendment. Having raised it, I beg leave to withdraw the amendment.
The Deputy Chairman of Committees (Baroness Henig) (Lab)
My Lords, that concludes the Committee’s proceedings on the Bill. May I remind Members to sanitise their desks and chairs before leaving the Room?