Commons Chamber

Tuesday 6th January 2026

(began 1 day, 7 hours ago)

Share Debate
Watch Live
Skip to latest contribution
This debate has concluded
11:33
11:34
None Portrait Oral questions: Energy Security and Net Zero
-

Richard Foord number one, please, Mr. Speaker.
11:34
None Portrait Q1. What steps he is taking to help the transition away from fossil fuels. (907139)
-

you and to colleagues across the House. I've temporarily lost the hearing in one of my ears. So if
11:34
11:34
11:35
11:35
11:36
11:37
11:37
11:38
11:39
11:39
11:40
11:40
11:41
11:42
11:42
11:43
11:44
11:44
11:45
11:46
11:46
11:47
11:47
11:48
11:48
11:49
11:49
11:50
11:50
11:50
11:51
11:52
11:52
11:52
11:53
11:53
11:54
11:55
11:55
11:56
11:56
11:57
11:57
11:57
11:58
11:58
11:59
12:00
12:00
12:00
12:01
12:01
12:02
12:02
12:03
12:03
12:04
12:04
12:05
12:05
12:06
12:06
12:07
12:07
12:08
12:08
12:09
12:09
12:10
12:10
12:11
12:12
12:12
12:12
12:13
12:13
12:13
12:14
12:15
12:15
12:16
12:16
12:17
12:18
12:18
12:18
12:19
12:19
12:20
12:20
12:21
12:21
12:22
12:22
12:22
12:23
12:23
12:24
12:24
12:25
12:25
12:26
12:26
12:26
12:27
12:27
12:28
12:28
12:28
12:29
12:29
12:30
12:30
12:30
12:31
12:31
12:31
12:32
12:32
12:32
12:33
12:33
12:34
12:34
12:34
12:35
12:35
12:36
12:36
12:36
12:37
12:37
12:38
12:38
12:38
12:38
12:39
12:39
12:39
12:40
12:40
12:40
12:40
12:41
12:41
12:41
12:42
12:42
12:42
12:42
12:43
12:43
Jodie Gosling Portrait Jodie Gosling MP (Nuneaton, Labour)
-
-
Friday, the 16th of January. >> Friday, the 16th of January. Thank you. We now come to the ten minute rule motion property. We start with Jodie Gosling.

**** Possible New Speaker ****

start with Jodie Gosling. Thank you, Mr. Speaker. Happy New Year to yourself and all your team. Mr. speaker, I beg to move team. Mr. speaker, I beg to move that leave be given to bring a bill to make provision about the requirements relating to the registration and valuation of domestic and non-domestic properties, to make provision about exemptions from such requirements and for connected purposes. For thriving communities, we need to have warm homes, safe places where people can live, thrive and survive, bring up their children and start their businesses.

We want to see our local businesses championed with spaces to grow and support to make their dreams a reality. We want to see our high streets thriving, every shop filled, restored to the proud places they once were. The beating hearts of our communities. My residents in Nuneaton have grown all too used to high streets and residential areas littered with empty properties, shuttered up shops, empty storefronts on our local high street deter shoppers and much needed investment. Vacant homes in disrepair are wasteful and leave hundreds of residents on waiting lists for housing and young families struggling to get on the property ladder.

In my local area, figures have shown that Nuneaton and Bedworth Borough Council have over 1800 empty properties. That's equivalent to one in every 24 local leaders in Nuneaton, including council leader, council leader Chris Watkins and Councillor Steve Hay, have fought to address this issue, recognising the deep impact it has on our communities. It is literally a waste of space. Instead of providing hope and security, I know that they are supportive of the second home surplus as well as the additional charges on long term empty properties.

These are important levers for local authorities that have been strengthened by this Labour government. However, these measures alone do not account for the full picture or scale of the problem that authorities like Nuneaton and Bedworth face. When a property is derelict, it is often removed from the valuation list. This is because it is no longer considered habitable or usable. It is no longer an asset. It was originally intended that these measures enable renovations to take place and properties without incurring additional costs.

We support some of this and we do not wish to remove the whole legislation, merely time limits that exclusion. As a result, a deregistered property does not appear on the valuation list unless it is brought back into use. This has led to a situation where properties can lie homes have stood empty while we face a national housing crisis and children sleep in temporary accommodation, Nuneaton is growing. It is building the houses that we need, but we also have to use those that we already have.

We need to use the properties that we have effectively. Nationally, there are an estimated 260,000 residences long term empty, a quarter of a million, many of which have been zero rated and do not pay back to their local councils. I know my honourable colleagues will have the pleasure of getting the train through my constituency each week as they travel down the West Coast Main Line to Westminster. Those who venture further into Nuneaton will see first hand the real impacts that these regulations are having.

Nuneaton transformation transformed town centre Grayson Place is due to open later this year. A real opportunity to redefine our town. And yet the town, the town end of Carlton Road. As people enter the redeveloped brilliant site, there is a row of empty properties buddleia sprouting out of their roofs. Three of those properties are nil rated. They hold no value, preventing the council from charging an empty properties levy and holding the owners to account for the neglect of the buildings that blight my community.

At the other end of Cotton Road, next to the Carlton Arches. Honourable colleagues will also find the core, formerly a church left to fall into disrepair despite the property no longer being owned by the church, and the property still receives its place of worship exemption again, meaning that it pays nothing. There is no incentive to bring it back from the brink or make these properties the assets that my town needs them to be. No responsibility for the impact on the area.

And further to this, once a property is left the register, it becomes increasingly difficult to trace those responsible. Nuneaton and Bedworth Council very much welcomes increased powers, but this can only do so much. Like many councils, after a decade of harsh austerity, they lack the financial capacity to compulsory purchase or restore the sheer number of properties. Nuneaton and Bedworth council leaders view the reorganisation. The Valuation Office and the Valuation Office Agency as a welcome step forward, but it is clear that current registration and exempt regimes and exemption regimes need to be updated to ensure that councils have the power to hold the owners of these empty properties accountable for the state of their buildings and turn these eyesores back into assets.

That is why my bill proposes that all properties should remain on the register, unless they are demolished, and that all properties be given a value, and that all exemptions be time limited, ensuring that these properties are used. The exemptions are used for their exact purpose. As noted by my hon. Friend the member from North Durham, this is an issue that impacts almost all of our constituencies. Updating our current registration and exemption rules will provide us with the tools to embrace regeneration, and to remove the barriers that hold us back.

My hon. Friends and colleagues, I hope that you will support this Bill today and the measures within it. We want to see the effective use of our assets to make sure that all of our buildings are put to use to house our residents who need homes, and to ensure that our high streets are ensure that our high streets are

**** Possible New Speaker ****

open for business. Thank you, Mr. Speaker. The hon. Member have leave to

**** Possible New Speaker ****

The hon. Member have leave to bring in the bill. I do not quite. The question is that the hon. The question is that the hon. Member have led to bring in the bill, or as many of that opinion say, aye. The contrary. No, I think say, aye. The contrary. No, I think the ayes have it. The ayes have it. Who will prepare to bring in the bill?

**** Possible New Speaker ****

bill? Rachel Taylor Cat Eccles and myself, Mr. Speaker.

**** Possible New Speaker ****

Jodie Gosling. Property Registration and Valuation Bill.

**** Possible New Speaker ****

Second Reading. What day? 16th of January 2026.

**** Possible New Speaker ****

16th of January 2026. Thank you. Right. I will now proceed to

**** Possible New Speaker ****

read the orders of the day. Cyber Security and Resilience Network and Information Systems

**** Possible New Speaker ****

bill, Second Reading. Now Minister to move Second Reading Minister.
12:52
None Portrait Legislation: Second Reading of the Cyber Security and Resilience (Network and Information Systems) Bill
-

Mr. speaker, thank. all the House staff. It's the. >> First opportunity I've had to say that to you. And I beg to move that this bill be. Now read a that this bill be. Now read a second time. Mr. speaker, on the 3rd of June, 2024, a busy Monday morning in south east London, criminals attacked Synovis, an organisation that processes blood tests on behalf of our National Health Service. They did not turn up physically, but logged on to computers thousands of miles away and set off ransomware, malicious software that encrypts files from afar, making them unusable.

The attack had a ripple effect across London hospitals. It delayed 11,000 appointments, blood transfusions had to be suspended, and the company lost tens of millions of pounds. This was not an isolated case. In the year leading up to September 2025, the National Cyber Security Centre has dealt with 204 and I quote, nationally significant incidents, meaning they seriously disrupted central government or our critical public services. That is more than double the 89 of 2024. No one disputes that we must do everything we can to protect the UK from these attacks.

And why? Well, the UK is the most targeted country for cyber attacks in Europe. The UK was the fifth most targeted nation in 2024 by nation state affiliated threat actors. In 2024, it is estimated that the UK businesses experienced over 8.5 million cyber crimes in the 12 months preceding that survey, and also of that year over 4 in 10, 43% of UK businesses were subject to a cyber attack. Over 600,000 businesses in total and significantly Mr Speaker cyber attacks are estimated to cause UK businesses almost £15 billion each year, equivalent to 0.5% of the UK's annual GDP.

Notwithstanding the wider economic or IP theft or the experience of patients, as in the first example, the average cost of a significant cyber attack for an individual business in the United Kingdom is estimated to be just over £190,000. There has been a 200% increase in global cyber attacks on rail systems in the past five years, increasing the likelihood of severe disruption to both the economies and people's

**** Possible New Speaker ****

daily lives. On that point, I'm happy to give way. Yes. Thank you, Mr. Speaker, and I thank the Minister for giving way thank the Minister for giving way on that point. Would he agree as we become more and more reliant on IT systems? I think in particularly systems? I think in particularly for my in my constituency of Harlow, the Princess Alexandra Hospital and the, the the new system they have the, the the new system they have for patient registration, that it's more and more important that actually we combat the issue of potential cyber attacks from potential cyber attacks from particularly from I'm thinking from from from foreign powers and enemies of this country.

And that's why this bill is so crucial.

**** Possible New Speaker ****

Yes. I couldn't agree more. And the example that I gave of the Synovis incident brought blood transfusion in London to a halt, which affected thousands of patients. So our everyday lives are patients. So our everyday lives are affected by that. And as we modernise and digitise our economy, as we modernise and digitise government, we have to make sure government, we have to make sure that our systems are as secure as possible. And indeed, cyber security is right at the heart of that.

And it is not a defensive issue. It's actually very much an economic growth issue as well. If you see the impact it has on our economy and our public services on the day to day lives of people, and indeed on the issue that I just gave before he intervened on our that.
12:55
Ian Murray Portrait Rt Hon Ian Murray MP (Edinburgh South, Labour)
-
-
I'm grateful to my hon. Friend for giving way, and great to see him in his post on the point of him in his post on the point of economic growth. Can he tell us how he has sought within this bill to he has sought within this bill to balance the absolute need to have a regulatory framework that businesses can have confidence in, alongside being able to attract the continued investment and ensuring that we don't end up with a regulatory framework that stifles investment.

Can you tell us how

**** Possible New Speaker ****

he's found that balance? Well, this builds on the 2018 regulations, which was a hangover regulations, which was a hangover from the EU in terms of adopting those into this country. And this expands on that, and very much to the intervention from my hon. Friend previously, this is about an economic growth issue. It's about protecting our system. So we have to find a balance between making sure that our regulators have the sure that our regulators have the powers and tools to regulate properly, but also give businesses and our public services the confidence that they can use digital technology, knowing that they have the most secure cyber security in Europe, if not the world.

And we're very, very good at this stuff. So that is the balance to be sought. But it's very much this bill is about economic growth rather than about overregulation for businesses. And I don't mean to say this flippantly, but cyber security is one of those areas. Mr. speaker, if everything is working, nobody notices. And when it isn't working, suddenly everyone notices and it's everyone's problem. And that's why we're bringing this scope of this bill forward in order for us to be able to extend that.



**** Possible New Speaker ****

I'm very happy to give way to. Mr. Speaker. Can I thank the Minister very much for what he's saying and what he's bringing forward? There's much he's bringing forward? There's much in the bill tonight to, to to be encouraged for us. But the Minister I know is a regular visitor to I know is a regular visitor to Northern Ireland, and Northern Ireland is the home to 130 cyber security companies with some 2750 employees. It is therefore employees. It is therefore essential that this legislation protects those jobs and enhances capacity for more.

So does and is administrable. Or does he believe that this bill both protects and provides opportunity for growth in

**** Possible New Speaker ****

Northern Ireland, and indeed across the whole of the United Kingdom? Thank you. Indeed it does. And it's one of

**** Possible New Speaker ****

Indeed it does. And it's one of a number of provisions that the government are bringing forward to create growth across the country, but not just in Northern Ireland. but not just in Northern Ireland. The Secretary of State's passion is to make sure that those jobs are everywhere across the United Kingdom, including in Northern Ireland. And my friend the Minister has been in Northern Ireland, in Belfast recently discussing this, Belfast recently discussing this, this legislation and wider cyber security issues with the industry in Northern Ireland.

So I can

**** Possible New Speaker ****

assure the hon. Gentleman that that is indeed the case. I thank my right hon. Friend for giving way. Mr. speaker, Hackney giving way. Mr. speaker, Hackney Council was the subject of a major cyber attack in 2020. It did a good job, though very slow because of job, though very slow because of the nature of the challenge, getting things back up and running. So this bill is very welcome. But pursuant to the answer to the pursuant to the answer to the question of my right hon.

My hon. Friend the Member for Chesterfield, there are challenges for some of there are challenges for some of the smaller companies I represent, Shoreditch and all those tech companies that need to also maintain a standard on cyber security, but are small. And so how is he going to balance the regulation for those smaller companies to make sure that they can keep abreast of things, but are not so dampened down as my hon. Friend from Chesterfield highlighted, they can't progress

**** Possible New Speaker ****

and grow. But making sure we extend the 2018 regulations and the scope of those into other parts of the economy. And I'll come on to that in part of my contribution. And indeed, it's about also reporting things quicker to make sure that things quicker to make sure that the attacks can be seen and, and action can be taken quicker, and also that reporting into their regulators. So it's giving the regulators. So it's giving the regulators the confidence and the powers across a whole wider scope of sectors in the economy, but also giving businesses the confidence that those sectors are having to report to regulators when things are going wrong and therefore swifter action can be taken.

And you can see from a whole host of the high profile issues that have happened in recent times, including in Hackney Council, that the right hon. Lady, my right hon. Friend mentions why it is so important to make sure that these pieces of legislation go through, go through quickly, and indeed do the job that they're entitled to do. So I'm very happy to give.

**** Possible New Speaker ****

I thank the Minister for giving way and I apologise for keeping him. But I just wondered, is there a piece of work that we need to do as piece of work that we need to do as well in terms of the culture and the fact that, you know, when, when, when businesses or the public when businesses or the public sector are victims of cybercrime, there's a danger that employees may feel embarrassed and nervous about feel embarrassed and nervous about actual reporting their concerns.

And I think we need to do a job, you know, to to actually encourage you know, to to actually encourage people that if they are victims of cybercrime, to come forward more quickly and recognise the challenges rather than sort of

**** Possible New Speaker ****

perhaps trying to, you know, hide it away and actually the issue become worse. Well, thank you to my hon.

**** Possible New Speaker ****

Well, thank you to my hon. Friend for that intervention, because whilst physical security and national security is all of our issues, indeed so is cyber security. issues, indeed so is cyber security. And what this is trying to do is to build on the 2018 regulations in order for us to widen the scope order for us to widen the scope into other areas of the economy that have become much more prevalent, like data centres, for example. And I hope that that gives industries and sectors the confidence, including employees, to make sure that they can report things into their regulators.

The regulators are doing this to and giving the powers to the regulators to give businesses confidence that they can report stuff in. It's not a regulatory heavy hand. In order for us to be dampening businesses, I hope I can give him and the rest of the the house the assurance on that. Mr. Speaker, before those significant number of interventions, I was talking about why this matters and gave some statistics to the recent cyber security activity in the United Kingdom. But it is why, because of all of that, after the election, one of the very first things we did as a new government was announced this new cyber security bill, it just ten working days in.

And since then, the department has been talking to cyber experts, businesses and regulators to turn these proposals into a comprehensive, serious and proportionate piece of legislation that we present here for Second Reading today, one that protects the public and strengthens national security without placing undue burdens on businesses. And I hope I can just repeat that again, one that protects the public and strengthens our national security without placing undue burdens on business. And I do appreciate that that is a very fine balance, but I hope this bill finds that balance.

So I'm confident that the whole

**** Possible New Speaker ****

House will support it. I'm very the. Minister for giving me we support this bill in its efforts to. support this bill in its efforts to. Tackle cyber security. What it does not do is address the the mass, unauthorised scraping of trusted news content by generative AI systems. This is content, as he knows, is often taken without knows, is often taken without consent and compensation. So as the bill progresses, will he be prepared to look at some measures, prepared to look at some measures, maybe something like a bot register where people have to declare their intent when it comes to this type of activity? And will they look at this seriously so that news could be protected in this new

**** Possible New Speaker ****

environment? Well, Mr. Speaker, the hon. Gentleman is very ingenious in the Gentleman is very ingenious in the way in which he uses interventions on pieces of legislation. I know AI copyright is very close to his heart. Being a former professional heart. Being a former professional musician, maybe a professional musician, and indeed one of the key musicians in MP for. So let's not push that to Division Mr Speaker. But the AI copyright issue is, of But the AI copyright issue is, of course, a key issue that the government is currently looking at.

Both Secretaries of State at the Department of Science, Innovation and Technology and Culture, Media and Sport are working very closely together on this issue. There will be a. Be coming forward. The I think the legislation means that there has to be a report to Parliament in March of this year. I'm sure he'll be very interested in that. And we're bringing together the industry and the tech companies to try and find a way through that particular issue. We know it's a huge issue. It's not covered in the scope of this bill.

This bill has been kept in terms of the scope, very tight in order to deal with the specific issues and the serious issues of cyber security debates and issues. So, as we know, the first duty of government is to keep people safe. And the question is how precisely the bill achieves that goal? The answer is simple. The UK's main cyber roles, the Network and Information Systems Regulations of 2018, or the NIS regime, were first introduced seven years ago and have not been updated since.

These rules require the operators of essential services like energy, water and hospitals, as well as some digital service providers like online search engines to take steps to protect the service they provide and the data they hold from cyber threats. But as you might expect in the last eight years, a lot has changed in the cyber landscape. We've had the rise of AI, which cyber criminals are using to their advantage. Data centres have become a firm fixture of modern life and we want to see more.

And since the rules were introduced, we have seen criminals evolve new tactics to exploit loopholes in the regulations, like the attack on the NHS supplier that I mentioned that revealed how hackers can target third parties like IT companies or supply chains as a backdoor to bring down a wider system. So there is always the story is one of technology and cyber threats moving faster than policymakers can possibly keep up with? I am happy

**** Possible New Speaker ****

to give way. Thank you, Mr. Speaker. I thank my hon. Friend for giving way. And he's right to mention the impact on supply chains here and in the West Midlands. We've recently had the Midlands. We've recently had the cyber attack on the JLR company that had a significant impact, not just on that company, but on the supply chain, which has its roots right through the West Midlands. It's an essential part of our economy that was brought to a economy that was brought to a grinding halt by a cyber attack.

So I'm just wondering if he can confirm to the House that this bill will help prevent such instances in

**** Possible New Speaker ****

the future. I'm very grateful to my hon. Friend, can I thank him for all he Friend, can I thank him for all he did in terms of the issues in Jaguar Land Rover? I know it's very close to his heart, and indeed it close to his heart, and indeed it was a really big issue across the country. Mr. speaker, of how a cyber attack can really just not cyber attack can really just not just affect one company, but the ripple effect throughout the economy.

And of course, the government stepped in to unlock a £1.5 billion bolster to Jaguar Land Rover's cash reserves in order to help them through that particular problem. I will say to the hon. Gentleman, I will come on to this slightly later that the Jaguar Land Rover and other private organisations are not covered by the scope of this particular bill. The reason for that is that individual private companies should be taking their own cybersecurity seriously, and making sure that those incidents and threats are the risks to those are minimised as much as possible.

And this particular bill is widening the scope of the regulations, existing which do not take into that. But of course, the government is working very closely with Jaguar Land Rover, Marks and Spencer and others who have been in high profile cases. And because we know from those big high profile cases the real impact they can have on our economy. But indeed, the had the government not stepped in and had this issue not been resolved, the impact on Jaguar Land Rover itself and the tens of thousands of employees at the plants and indeed in the supply chain would have been catastrophic and not really worth thinking about.

So I thank my hon. Friend for raising that particular issue. Mr. speaker, as always, the story, of course, as I've said, is one of technology and cyber threats moving faster than policymakers can keep up with. But today we are fixing that. So the first change in the bill is to widen the scope of the existing 2018 regulations to keep up with the changes of the last eight years. We are adding a new a few new things to that list, starting with large load controllers.

This includes any organisation that manages a significant flow of electricity to or from a smart appliance. It might be a company that supports electric car charging, for example. Bringing those entities into scope will safeguard our power supply and give consumers confidence in using energy smart appliances, all of which is critical as we advance towards our Clean Power 2030 mission and net zero. We are also adding large data centres as number two in recognition of their growing importance to our day to day lives and to the economy.

These are vast digital warehouses for the United Kingdom, home to servers that host everything from patient records to their bank details. This is the data that underpins modern life, underpins all of our lives and our communities, and it must be protected. And we are expanding the scope of the regulations to include managed service providers as well. These are organisations that provide ongoing functions like an IT help desk to an outside client. Their access makes them an attractive target for cyber attacks, as criminals can find one weak spot and bring countless organisations down.

In 2024, an attack on a service provider for the Ministry of Defence, for example, compromised the personal data of around 270,000 people, military personnel, reservists and veterans. As organisations rely more and more on outsourced tech, we have to close this gap. In fact, weaknesses in the supply chain have become such a risk that we are going even further and allowing regulators to designate certain organisations as critical suppliers. This includes certain suppliers to essential services that can have significant impact on the economy or society as a whole.

Key suppliers to water companies, grid operators or air traffic control, for example, these critical suppliers will be subject to cybersecurity duties, which we will set out in secondary legislation. I'm happy to give you Meg Hillier.

**** Possible New Speaker ****

In last year, the Treasury Select Committee wrote to the top ten banks in the UK because there have been a number of outages that have been a number of outages that no suggestion that cyber security is involved in most cases, but a trend coming back from the trend coming back from the responses was that our third party software providers were often the source of the issue. What is his source of the issue. What is his thinking about how to involve the banking sector in the scope of this bill?

**** Possible New Speaker ****

bill? Well, the banking sector are obviously in the scope of the regulators in terms of cyber security, and there has been a number of outages that the right hon. Lady mentions, but I think the the general principle here is that cyber attacks are no longer coming in through the front door. They're coming in through third parties, they're coming in through suppliers. And we've seen that in the recent incidents at Heathrow, for example, in cloud outages with AWS and other companies like that.

So they are covered by their own regulations. And similar to my the answer to my hon. Friend about Jaguar Land Rover, they will not be in the scope of this particular bill, but we do hope that the financial services sector, who are leaders in cyber security for a whole host of fairly obvious reasons, take that forward. Let me also say, Mr. Speaker, I know that the recent attacks on British icons, as we've discussed at Marks and Spencer and Jaguar Land Rover, will loom large in people's minds.

And indeed, many members across the chamber have already mentioned them. Supply chains were thrown into chaos this morning, businesses paying the price, and that shows the ripple effect across the economy. When one part of the system is attacked, that ripple effect into other businesses, into smaller businesses, into patients. In terms of our public service examples earlier are really quite clear. So we are clear all businesses and that covers both financial services. Jaguar Land Rover, Marks and Spencers and others must take immediate steps to protect themselves.

That is why in October, members of the Cabinet wrote to the FTSE 350 companies, urging them to strengthen their defences by doing three things firstly, to make cyber risk a board priority. Secondly, to require suppliers to have a Cyber Essentials certificate. And thirdly, sign up to their early warning service. This was followed by a similar letter to entrepreneurs and small businesses in November, with bespoke advice for smaller teams. We know these actions work. Organisations with Cyber Essentials are 92% less likely to claim on cyber insurance than those who don't.

Businesses who best know how to protect themselves. So we're not here to regulate for the sake of regulating. Government is taking action to and I announce this morning the government's cyber Action Plan sets a radically new model for how government will strengthen its cyber resilience. Backed by over £210 million of investment, government departments will be held to equivalent standards to those set out in this bill. And that is why the public sector and the government is not included in the scope of the bill.

Because of the cyber action plan. The government should not need to legislate for itself, but just get on with making sure that we are leading the charge and making sure that the Cyber Action Plan strengthens our own government. Cyber. I don't know if that was an attempt at an intervention from the opposition front bench, but I'm

**** Possible New Speaker ****

happy to take it. It's a very happy to go. Well, I welcome the Minister's comments about the obligation on comments about the obligation on the the private, the public sector. However, I would caution him that in my experience, cyber security is one of those things that Ministers talk about, but then other priorities overtake it. And the advantage of legislative advantage of legislative requirements is it forces Ministers to think about it. So I would just urge, Minister, as this bill passes urge, Minister, as this bill passes through Parliament to look again at that point, I think there is a case for putting more stringent requirements on the public sector in order to force Ministers minds

**** Possible New Speaker ****

on the point. Can I thank the hon. Gentleman for that intervention? I know he would have had some involvement in would have had some involvement in this when he was on this side of the chamber. And indeed the 2018 regulations came out of the previous government, and we are all previous government, and we are all trying to make sure that we are catching up with the technology as quickly as it moves. It's a very interesting point that he makes, which I'm very conscious of and happy to take away.

I hope the Cybersecurity Action Plan today, Cybersecurity Action Plan today, which is backed by £210 million, we are determined to deliver that. I am determined to deliver that. And I know the previous actions that the previous government took did not come to fruition in terms of that 2030 target that they that they had, which is why we have refreshed the action plan and brought it forward with some significant cash. So it's really important for us to make sure as Ministers, we take that forward, and I hope that he will hold us to account to ensure that we are fulfilling that promise in the cybersecurity action plan, because I do feel that public services, and indeed central government, must take the leading role to show businesses that this is the real.

The real approach is to take is to make sure all our systems are as secure as possible for not just economic grounds, but for the people that we all seek to represent. Mr. speaker, I'm very

**** Possible New Speaker ****

happy to give it to you. Thank the Minister for. Giving way, and also for the excellent points he's making with excellent points he's making with regard to the importance of cyber security and the cyber Security Action Plan. Could you perhaps say Action Plan. Could you perhaps say a little bit about the way in which the cyber success of the Cyber Security Action Plan will be measured, monitored and measured, monitored and communicated back to this House? He is probably aware that only 33,000 is probably aware that only 33,000 Cyber Essentials certificates were issued, for example, in 2024, and so an increased take up of of of cyber Essentials and the guidance

**** Possible New Speaker ****

well. Mr. speaker, in the action plan itself, there are some key dates in there to monitor progress. And I there to monitor progress. And I wrote to the hon. Lady, the chair of the Select Committee this morning at the publication of the morning at the publication of the action plan to lay out some of those issues so the letter will be landing. Very happy to come to the select Committee to discuss that in select Committee to discuss that in more detail in front of the committee, and hope that the committee, and indeed the opposition benches hold us to opposition benches hold us to account for delivering on this, because it is so fundamentally important to government, whether it be digitisation, modernising government, winning the case with the public about why digitisation is so important and why government should be as secure as it possibly can be, and leading the charge on that across all of the economy.

So I hope that we can take that forward and the committee can take that forward in the weeks and months ahead. Mr. speaker, I was talking about the launch of the Government Cyber Action Plan this morning, backed by over £210 million of investment, government departments will be held to equivalent standards to those that are set out in this bill. And I hope that partially answers the question from my hon. Friend, the chair of the Select Committee. But while the focus of this bill is on essential services, it will also indirectly help businesses, including those damaged by the recent attacks and government.

Almost all organisations today rely on data centres or outsourced IT or some kind of external supplier. So by extending the bill's oversight, we're preventing attacks that could, in theory, reach thousands of organisations. The second change in the bill is to give new powers to our regulators responsible for enforcing the NIS framework. Effective compliance is crucial to the success of any regime. These reforms could be world leading on paper, but without proper enforcement they are meaningless.

**** Possible New Speaker ****

So the bill will very actively. Clarification point. So we've talked about the regulators having new powers to designate critical national infrastructure in regard to cyber security threats. Who actually has accountability? actually has accountability? Because I've been looking at the bill now. It says regulation made by the Secretary of State, which Secretary of State is that when

**** Possible New Speaker ****

Secretary of State is that when this is a cross-departmental and cross-government approach. Cyber security is the

**** Possible New Speaker ****

Cyber security is the responsibility of the Department of Science, innovation, Technology. But indeed, the Cabinet Office always has a clear resilience issue as well. And we will heard that from your right honourable colleague who was in the Cabinet Office previously. So the Secretary of State will be the DSIT Secretary of State will make those regulations. But there are a plethora of regulators involved in this process, because obviously, if you're talking about energy, if you're talking about water data centres, they all have different regulators.

So they are being empowered through this legislation, through the expanded scope of the number of sectors that are being brought into the legislation, for those regulators that regulate those particular sectors to take the responsibility, I have to give

**** Possible New Speaker ****

the. Julian Smith extremely way. On that. Point. About regulators.

**** Possible New Speaker ****

Point. About regulators. The industry have issued a. Brief which points out, quite sensibly, that these regulators are sensibly, that these regulators are going to have a lot of extra duties to perform and will therefore need extra resources to be able to extra resources to be able to perform those duties. But the extra resources they require will only be unlocked when the bill itself has passed. So is there not a danger of a transition period where duties will be laid on regulators to fulfil their role before they've

**** Possible New Speaker ****

got the resources to carry it out? Well, Mr. Speaker. We have to pass the legislation.

**** Possible New Speaker ****

We have to pass the legislation. Before the legislation may be amended. In this House, the legislation may change through the passage of its progress through passage of its progress through both houses, and therefore, the regulators, in that sense, will not know what they're regulating until the bill has actually passed. But the bill has actually passed. But we've been working, as I mentioned, at the start of my contribution with regulators, with businesses and with organisations and and with organisations and cybersecurity experts in the run up to producing this bill to make sure it is in the right place that is proportionate on businesses, proportionate on regulators.

But make sure mostly, which I think is the most important thing that is effective. So I'm sure we'll have those debates as we go through the whole of that. The process through the Committee stage and Third Reading in this House of those kinds of issues. But I very much acknowledge what the right hon. Gentleman has said. Mr. speaker, the bill will strengthen the powers of the NIS regulators, ranging from Ofgem to the Civil Aviation Authority, who together uphold the UK's cyber based rules across different sectors.

And the member took the intervention 10s too early in this particular contribution because they work together to uphold the UK's cyber rules across those different sectors. We are raising the maximum fine they can impose, for example, while simplifying the penalty bands to make them clearer. The key driving force for this measure is not to the punishment of rule breakers or raising revenue, but to incentivise firms to be vigilant. Our goal is 100% compliance and zero fines. We will also be asking regulated organisations to change the way they report attacks, expand both the types of instance they have to report and the time frame in which they have to report them.

This is a small but crucial change. Under the current rules, regulators only get notified about a breach once it has already caused significant disruption when traffic lights have failed or the heating has shut off. But the system does not include cases where the potential to cause a crisis much later, like a hospital's computer system quietly being spied on as hackers wait for their moment to strike. Under the bill, if you are in scope, you will have to tell your regulator and the National Cyber Security Centre about these types of breaches within 24 hours and provide a full report within three days.

Pace and speed is of the essence. This will not only give us better information, but how agencies warn others if they need to, before they become the next target. The bill will also allow the government to set clear and consistent outcomes for regulations to work towards. One of the virtues of having a regime enforced by different agencies is that each has sector specific expertise. Ofgem understands the complex digital systems that underpin the national grid. The Aviation Authority knows the precise threats to air traffic control, but this approach has sometimes led to inconsistencies in how the regime is applied, with some bodies interpreting the rules differently from others.

Today's bill aims to fix that with a single set of objectives issued by central government. Across the board will send a message that no sector is an easy target in the UK. We will also be improving the way regulators, intelligence agencies and law enforcement share information with each other by providing greater clarity on what information regulators can share and receive, and it is important that regulators have the resources to do their job. Going to the point from the right hon. Gentleman.

So the Bill will also give them new powers to recover the full costs associated with their regulatory duties and to ensure transparency, regulators will consult on how those fees will be calculated and publish a statement each year to show how these funds were being used. Together, the measures add up to a much more consistent and effective regime, with better reporting and much clearer guidance for all involved. Mr. speaker, this bill ensures the UK's cyber security regime is not only fit for today, but is flexible enough to head off future threats as well.

I mentioned a few of the things that have changed in the last eight years shifts in technology and the nature of cyber attacks, artificial intelligence data centres the economy. But one of the biggest changes, of course, was Brexit. Since our official exit from the European Union in January 2020, we have been unable to amend the NIS regulations without primary legislation because the rules were originally part of European Union law. This has made it slow and difficult for us to keep pace with new emerging threats and technology.

Meanwhile, Brussels is pressing ahead with NIS 2 their forward looking update. While we lag behind, this procedural quirk has left essential UK services more exposed, which perhaps tells us something about why the UK has such appalling figures in comparison to some of our EU counterparts. As hackers and cyber criminals exploit gaps in outdated laws, it is an unacceptable risk. So today's bill includes new powers for the government to update the NIS regime via secondary legislation in future, to make it quicker and more agile to moving technologies.

If we need to respond quickly, for example, to a new type of cyber threat. This is not to override Parliament. In almost all cases, the government still be required to consult on any changes and Parliament will have the final say over any legislation made under this power. But delegated powers are essential for keeping us as responsive as possible. When national security is on the line, we need the ability to act fast and decisively. In fact, in extreme cases, some threats emerge so rapidly that even secretary legislation is too slow.

If an ally were to be invaded by a hostile state, for example, suddenly escalating the cyber risk to the UK. So the government will also be given powers to direct regulators or regulated entities where national security is threatened to issue specific cyber security guidance in a crisis, for example, these powers are intended as a last resort to protect our national security, and safeguards are built into the bill to make sure they are used accordingly. But let me end by saying this, Mr.

Speaker, the UK's cyber sector is the third largest in the world. We heard that from our friend from Northern Ireland. It achieves double digit growth year on year. We have fast growing clusters of expertise in Cheltenham and in Manchester, and this legislation will supercharge that success, doubling down on one of our nation's greatest assets. And at its core, this bill is about protecting the essential services that we all rely on. So the lights always stay switched on, clean water always runs in the tap, and hospitals have always safe and secure when we need them.

The real life community issues that we all encounter every single day, and all of our constituents encounter every single day. This is more than a technical upgrade. It is a bold commitment from government to protect one of our biggest economic strengths, and to keep the UK safe and a rapidly evolving digital world together. Working towards a future for security is not a hope but a guarantee, and I commend this bill to the House here.

**** Possible New Speaker ****

The question is to the bill now be read a second time. So the Secretary of State Julia Lopez. Thank you, Mr. Speaker. Happy

**** Possible New Speaker ****

Thank you, Mr. Speaker. Happy New Year to you, and thank you very much for putting the heating on. And I'm grateful to the Minister And I'm grateful to the Minister for setting out the government's rationale for this legislation instead of the Secretary of State. instead of the Secretary of State. I don't know why he was demoted either, but I want him to know that we appreciate him. We as the we appreciate him. We as the opposition, recognise the scale of the cyber security challenge that the country faces.

If the pandemic accelerated the adoption of digital technology at a pace we'd never before seen, then the advent of artificial intelligence will embed that technology into our economy in wholly new ways, ways that bring opportunity, of course, but also unprecedented risk. AI and automation will not only transform productivity, they will equip hostile states, criminal gangs and opportunists alike with tools capable of eroding our national defences at speed and at scale. It is right that Parliament is legislating to raise the collective security bar we on this House, we on this side of the House, support that principle.

But legislation of this kind does not come around often. Cyber law takes time to
13:25
Julia Lopez Portrait Julia Lopez MP (Hornchurch and Upminster, Conservative)
-
-
develop, and once this bill passes, it's unlikely that Parliament will return to this territory for some years. That means we must ask two years. That means we must ask two very simple but very serious questions today. Will this law work? And is it enough? Before answering those questions, it's worth reminding ourselves of the real world consequences of failure, because cyber risk is neither abstract nor theoretical, nor theoretical. Last year, the UK theoretical. Last year, the UK experienced what is widely regarded as our most economically damaging cyber incident to date.

When Jaguar Land Rover suffered a major attack. This was not a sophisticated act of cyber warfare against the state, though such acts are happening with increasing regularity. It was by a band of hackers, but the consequences were enormous. For five weeks, Jaguar Land Rover was unable to operate its automated manufacturing lines. Cyber related costs mounted to nearly £200 million National economic output was visibly affected in that month alone, but the real damage did not stop at the factory gates. Hundreds of SMEs in the supply chain, many operating on thin margins, were pushed to the brink.

Workers faced uncertainty, contractors had their work paused, and ultimately the government had to step in with £1.5 billion worth of loan guarantees to prevent wider economic fallout. So when we consider this bill, we must ask whether it would have done anything to strengthen our collective resilience. That is one of the tests this legislation ought to meet. And it's not yet clear that it does. Indeed. Certainly, JLR would not have been stopped as an attack, as the Minister himself has made clear, because it would not have been in scope.

The cyber threat landscape is evolving at an extraordinary pace. New research shows that cyber attacks now cost our economy nearly £15 billion every year. High profile breaches of businesses like Marks and Spencers and the co-op have demonstrated how quickly consumer confidence, jobs and supply chains can be put at risk. Last year alone, insurers paid out £197 million to help businesses recover from cyber incidents. In fact, the FTSE 100 collective cyber insurance bill is now larger than the defence R&D budget. The bill seeks to respond to one aspect of this reality by expanding the scope of existing regulations, data centres, managed service providers, load controllers and designated critical suppliers will now fall within its ambit.

That is a welcome acknowledgement that digitalisation has introduced systemic risks, that the original regulations of 2018 did not adequately cover. The bill also strengthens the powers of regulators, introducing cost recovery mechanisms, and it tightens incident reporting requirements. These measures are intended to modernise our cyber framework and address clear shortcomings identified in reviews of the regime in both 2020 and 2022, and on paper, that all sounds sensible, but intent alone is not enough. Which brings me back to our central concern will this law work in practice in raising the standard of our collective resilience? The uncomfortable truth is that in some of the most high profile cases of cyber attack, penetration of systems happened by attackers who used valid credentials systems behaved normally.

The breaches looked like legitimate access until it was too late. Human frailties were exploited, help desks persuaded to reset passwords. Staff or contractors impersonated. This bill mainly helps after an attack, not before by mandating reporting, improving intelligence sharing and increasing accountability. And as I

**** Possible New Speaker ****

say once again, as the Minister has, certainly. Prime Minister, it's a friendly intervention. I always like to get intervention. I always like to get a bit of cross-party agreement in the House where possible. And the question I ask the Minister with regard to the importance of regard to the importance of changing the culture to employees to make sure they do report cyber attacks and feel confident to

**** Possible New Speaker ****

attacks and feel confident to report cyber attacks, would she agree with that? I agree with that. And he is

**** Possible New Speaker ****

I agree with that. And he is fundamentally correct that this is about culture. And this is the point I'm making, that as many regulations as we can pass, a lot of the holes in our cyber security systems come down to to human frailties. And this is one of the challenges. That means it's not just about new laws. This is about changing a whole number of things to make us more resilient in this space. It's right not to dictate technical standards in primary law that will soon be outdated in the fast moving world of technology.

So the question really is whether this law is the right mix of carrot and stick to make affected firms act in a way that that raises the security bar. Now, there are several areas where we fear it may not. First, there is potentially an enforcement paradox. The bill expands regulatory powers and increases the scale of potential fines. But the evidence from the existing regime does not suggest definitively that finds a new regulations deliver us greater cyber resilience. Under the current regulations, enforcement has been slow, inconsistent and often toothless.

Very few significant penalties have been issued, and where they have, the delay between incident and sanction is sometimes stretched beyond two years. That delay matters because it actively undermines deterrence. It disconnects accountability from operational reality, simply widening the scope of regulation without ensuring that regulators are properly resourced, empowered and required to act quickly risks creating obligations that exist on paper but lack any real world bite. We also have concerns about the bill's cost recovery model, funding regulators through levies on the organisations they oversee risks unintended consequences in terms of improving our resilience.

For large firms, the cost burden may be manageable, but for smaller enterprises it amounts to an additional operational tax that could divert scarce capital away from cyber defence staff training and innovation. There's also a structural risk here. Regulators reliant on fee income may face incentives to expand scope and complexity unnecessarily, creating bureaucratic drag that crowds out voluntary, market led initiatives that often raise standards more effectively than prescriptive regulation. I also worry more generally that this will play into tech monopolies.

The companies that thrive under this kind of environment are the ones with big compliance and legal departments that concentrates risk and makes our tech economy less diverse, with serious implications that I shall come on to. There may be reporting challenges, too. Again, a two stage reporting process within 24 and 72 hours may be achievable for large, well resourced organisations within house cyber teams, but for smaller operators, this risk creating compliance culture focussed on speed, not substance. There's also the danger of duplication.

Many organisations already face overlapping reporting obligations under UK GDPR, sectoral rules and existing legislation. Without simplification and proportionality, the administrative load could be significant, once again diverting attention and resource from the very cyber threat management the bill seeks to improve. We need to avoid this becoming a something must be done bill that misses the mark. The bill also fails to grapple properly with the human factor in cyber security, already talked about by the honourable the hon. Gentleman for Harlow, technology alone does not keep organisations safe.

Governance matters. Yet board level ownership of cyber risk is moving in the wrong direction. Only 27% of businesses now have a board member explicitly responsible for cybersecurity. That is down from 38% just three years ago. Without mechanisms to ensure senior accountability, fines risk becoming little more than a cost of doing business. Directors remain insulated while operational teams are left to carry the can. National cyber resilience depends not just on systems and software, but on leadership, on culture and accountability at the very top.

For those reasons, ahead of Bill committee, we are on, we on this side of the House are examining how the legislation can be strengthened while continuing to support its core objectives. In the meantime, regulators must be properly equipped with the right powers, resources and clarity from Parliament on the law's intent. Sanctions must be applied swiftly and consistently, and guidance must be clear. So enforcement is credible and deterrence is real. The government should also look at how reporting obligations are calibrated. A one size fits fits all approach may place disproportionate burdens on smaller firms, and it may be better to ensure reporting thresholds reflect the size, complexity and risk profile of an organisation.

Equally, the funding of regulators must be transparent and predictable. There have to be safeguards against regulatory expansion for its own sake, and firm assurances that funds raised are reinvested directly into improving national cyber resilience, not absorbed by administrative overheads. While the bill rightly prioritises critical national infrastructure, it cannot afford to ignore high risk sectors that sit beyond its immediate scope. There's also a major role for market based solutions cyber insurance sector wide intelligence sharing and collaborative resilience initiatives can all complement regulation.

These tools can reduce risk and improve preparedness without adding unnecessary legislative complexity. Finally, the review cycle set out in the bill may be too slow for the threat landscape we face and the pace of technological change. Annual or biennial reviews might allow Parliament to scrutinise effectiveness, respond to emerging threats and ensure the legislation remains fit for purpose. I'd like to finish by making some more general points about the government's approach to cyber security and resilience. If I may, Madam Deputy Speaker, issues about the risk of dependence and threat from adversaries.

I see no evidence from this government that it is thinking with any clarity about the risks of long term technological dependency and lock in. In fact, quite the opposite. Large parts of our economy now depend on secure, high quality digital infrastructure, a reliance that will only increase as AI advances. Whoever provides that infrastructure will wield huge future leverage. It was that reality which ultimately drove the change of heart over Chinese tech, sitting in the core of our 5G telecom networks a few years ago.

Now, however, the government is seemingly betting every chip on us hyperscalers. They provide our data centres, they supply the platforms on which government departments are now run. They, more often than not, are the ones winning all the government contracts. These investments will, of course, provide our companies with things they need, from compute power to increasingly sophisticated AI platforms. But the UK is doing little simultaneously to mitigate against our increased technological dependency. And when I say technological, we need to understand that technology is what we now run.

Our defence systems, factories, energy networks and communications on technology is the plumbing of our nation. During September's much crowed about state visit by President Trump, this government was visibly begging for good economic headlines. After humiliating resignations of the Deputy Prime Minister and US ambassador, not to mention the uncontainable mess of the Chancellor's first budget and the threat of her second. The US, UK tech partnership was the result, with a huge amount of smoke and mirrors deployed over what had actually contained whatever substance lay within it.

We heard just before Christmas that it had been paused, used as leverage by the US while other trade negotiations are underway. I'm not criticising the US administration for skilfully playing its hand in its national interest. I am asking this government rapidly to wake up to the reality of a new world in which the post-war settlement is coming to an end, a new world that's been given clues to its existence for many years now, long before President Trump came into office. The United States remains a vital ally.

But in this new era, Britain must be very clear eyed about risk, the reality of hard power, and the need to protect our sovereign interests. Cyber risk requires as much thought about the fundamentals of plumbing as it does about the laws that try to manage how humans use or exploit technology. The UK government has a vast procurement budget, for which our own firms ought to be able to make a successful bid, but UK tech tells me consistently that for all the talk of the government's AI strategy of sovereign tech capability, they have not got a look in since Labour has been in power.

I'm concerned that this bill does not introduce new burdensome regulation for UK firms in a way that benefits non-UK incumbents with giant compliance teams and legal resources, in a way that could exacerbate the risk of vendor lock in. Let us turn to another risk. The private sector will have noticed that the new obligations within this bill broadly do not touch the public sector, where cyber risk remains red, light flashing large notwithstanding, as I say, the public cyber strategy that was thrown out today in implicit acknowledgement of that gaping hole, knowing that the public sector holds such enormous cyber risk, this Labour government chooses not to minimise it, but to create a brand new one, a hulking great identity system mandated for anyone who wants a job.

And now we hear, possibly for newborn babies mandatory identity by stealth, not consent, and with no honesty about it. It is not to be against the ability of people to verify themselves digitally for banking, or to access certain online services, or to stop fraud. To think that Labour's mandated digital identity plan is a complete rotter. The Association of Digital Verification Professionals called what Labour inherited on digital identity a world leading model for data sovereignty that digitised liberty rather than diluted it.

The citizen, not government in control. Now this naive government is crowding out private sector expertise and making everyone have one of these identities by stealth. It has no idea what this system will cost, and it will not be honest about what it will be used for. And what are the cyber security of this system? Well, the system on which this digital identity will be run was breached during red team testing last year. When I asked the Secretary of State if that system has now met the NCSC cybersecurity standard, no answers came.

Whistleblowers. Blowers have continued to speak out about the vulnerabilities of the system, and there is no sense whatsoever from government that the dodgy, dodgy digital identity plan will be paused until such point that they are confident about cyber security.

**** Possible New Speaker ****

Certainly absolutely. Staggered, madam Deputy Speaker.

**** Possible New Speaker ****

To hear the shadow Minister talk about standard. Software testing. Practices as though as though someone is doing wrong.

**** Possible New Speaker ****

someone is doing wrong. By trying to penetrate systems and trying to I'm trying to find flaws in it. Isn't isn't the.

**** Possible New Speaker ****

Isn't isn't the. Whole point of software testing to find the flaws in the system and get them fixed, rather than parading them in front of the House parading them in front of the House of Commons as though it's some sort of failure. Yeah.

**** Possible New Speaker ****

I think the hon. Gentleman is wilfully misinterpreting. What I'm saying is there's not an issue with saying is there's not an issue with having systems tested. There is an issue with the fact that the system tests failed, and there is no tests failed, and there is no evidence that the government has therefore acted to deal with those systemic failures. The whistleblowers continue to talk about the serious concerns about the the structures on which the government's digital identity platform will be built.

And he's sitting there looking absolutely outraged that I might suggest that there are some concerns about the cybersecurity risk of a national digital identity platform. And personally, I find that absolutely extraordinary. The idea that I'm talking about my concerns that a system might be tested, of course, every system must be robustly tested. That is not the point I'm trying to make. And I think he is being wilfully ludicrous in trying to suggest otherwise. So I ask Madam Deputy Speaker can this Prime Minister run an economy? No.

Can this Prime Minister keep promises? No. Can this Prime Minister control his backbenches? No. Can he control his frontbenches? No. So how on earth does anybody think he can run a secure digital identity system? So at the same time as risking technological lock in by friendly allies, we are creating new vulnerabilities for adversaries to attack. Just before Christmas, UK intelligence agencies warned about increasing large scale cyber espionage from China, targeting commercial and political information. We discovered from Ministers that the Foreign Office itself was subject of a major cyber attack in October, which officials believe was carried out by Chinese hackers.

This in the midst of a major row between the government and CPS over the prosecution of spies operating here in Parliament. We will be looking closely at this legislation for where government should be addressing this cyber reality with much greater force, an approach to cyber resilience that looks only at introducing new regulations and compliance burdens without thinking through risks like a mandated identity scheme, dependency on non-sovereign suppliers, the malign intent of other nations, and a failure to build up our own workforce and skills is one which will fail.

In conclusion, Madam Deputy Speaker, we support this cyber.

**** Possible New Speaker ****

Certainly my. Friend, but as she is. Coming to the end of her remarks. I don't think I heard anything

**** Possible New Speaker ****

I don't think I heard anything mentioned by the Minister about risks of cyber attacks on local government. That is another potentially juicy target for people who wish to cause major mischief.

**** Possible New Speaker ****

Does she agree, sir? Well, I, hon. Friend, will be aware that this is outside the aware that this is outside the scope of the bill. But it is a very juicy target, and there's much in the public sector that remains a very juicy target. And I think, as I say, in acknowledgement of those juicy targets the government whipped out very quickly this morning, a strategy that's meant to give us assurances about public sector resilience when it comes to cyber.

And I'm not sure that it will provide much reassurance. And this is why I think it's important that we understand that this cyber bill can only be one part of a much wider arsenal that looks at tightening gaps where they exist, both in the private sector but also in the public sector, certainly.

**** Possible New Speaker ****

Madam Deputy Speaker, I think it's really worth clarifying for the House that we've brought forward the government cyber forward the government cyber security strategy this morning because the 2022 consultation that was brought forward by the previous was brought forward by the previous conservative government was not acted upon. This government is acting on those threats, bringing acting on those threats, bringing forward a plan that we will then subsequently see through. And I think she should acknowledge that the hon. Lady should acknowledge that.



**** Possible New Speaker ****

that. Well, I welcome it, but I haven't actually had the chance to to have a good look at it, because you always the government always seems to publish these sorts of documents right at the last minute. It's a remarkable. The only way to get any information out of this government is to apply some pressure in this House. And then, remarkably, things things come flying out of the cupboard and I will be very interested to see what this strategy looks like and whether it really is up to up to the challenge that faces us now since we were in government, the the problems and risks of cyber have markedly increased because of the advent of AI technology.

That is changing the changing the picture very, very rapidly. Just as the defence picture is changing very, very rapidly. And my concern is that this government is not taking seriously enough the various defence and security challenges that face this House. Prioritising spend on welfare payments and union payments and all other manner of things. And, you know, it's one thing to get a strategy out of the door. Madam Deputy Speaker, it's another thing to actually put in the measures that will will implement the strategy.

And I think, well, basically what we've seen in the last 18 months is strategy documents and not a great deal of delivery. It's one of the reasons why the government is so rapidly losing public confidence. In conclusion, Madam Deputy Speaker, we do support this cyber bill. In principle. The threat is real and growing and it demands actions, but it can be seen as only a tool, not a cure all. A government that's trying to close down gaps in one place while wilfully opening up huge new risks in a different corner, is being negligent in its approach.

Further, if this legislation is to command confidence, it must be practical, proportionate and genuinely effective. Without meaningful improvements. This bill risks placing new burdens on business while delivering only marginal gains when it comes to our national resilience, cyber security is a shared responsibility between government, regulators, industry and the public. But leadership must come from the top and that is where this bill currently falls short, with the private sector taking the lion's share of the load while gaping holes remain in public sector cyber defences.

The bill begs obvious questions about the confidence citizens should have in flagship government projects, like the Prime Minister's mandatory digital identity. As it stands, this bill would not have prevented high profile cyber shutdowns. Like Jaguar Land Rover's. It does little to address the chronic vulnerabilities in the public sector, and it certainly will not make Labour's dodgy ID database any more secure. This is why, as this bill makes its journey through Parliament, we will be pressing this government to ensure it delivers genuine security, proper accountability and raise cyber defences across the board while taking them to task on major mistakes like mandatory ID for cyber security is no longer a niche compliance exercise.

It is about protecting the fundamental economic and defence interests of our nation.
13:45
Matt Western Portrait Matt Western MP (Warwick and Leamington, Labour)
-
-
EA Matt Western. >> EA Matt Western. >> Thank you, Madam Deputy Speaker, and may I start by welcoming this bill? It's a serious step forward bill? It's a serious step forward in protecting the United Kingdom from the cyber attacks that we face daily, and a great number each day. But this legislation, as we just heard from my right hon. Friend, is long overdue. Back in April 2022, when a consultation had just started, in January of that year, the then government identified issues and I was slightly bemused that my right hon.

I consider my right hon. Friend not to have covered that in her speech, but there were serious issues and limitations identified through that consultation, and so it was then a further two over two years during which the previous government failed to act. And, Madam Deputy Speaker, as we heard from my right hon. Friend the Minister, this has proved very costly, as he illustrated in his speech the past couple of years, we have seen that cyber security is not just paramount to our everyday lives.

It is crucial. It ensures food on our supermarket shelves. It's the light staying on. It's critical to every corner of the UK, but now we have to move at pace, not just with this legislation, but I would urge us to go further, for if we are to protect ourselves from our adversaries, we need to develop a true whole of society approach to cyber security and start a national conversation on security at home. This legislation is clearly a first step, an important first step, a first chapter, if you if you will.

But there must be many more written. If we are to going to we are going to seriously address our national security. And I mean here our social and economic security. Increasingly this past decade, we have seen a blurring of war and peace with the emergence of hybrid warfare and the widening of the grey zone. We are living in a cyber no man's land where states or state sponsored actors proxies can act with relative ease and impunity, leaving the world a more dangerous place.

And it is the cyber realm that is and will remain a key battleground. And it is one we must seize. We, the United Kingdom, need to wake up to this. And I mean every one of us, particularly with the development of AI and quantum computing and the extraordinary threats that will come from those developments, because when it comes to being the target of these cyber attacks, the United Kingdom. Madam Deputy Speaker now ranks third of all nations globally in 2024 alone.

The National Cyber Security Centre, the NCSC, handled an average of four major serious attacks every week. These are the really serious attacks and the impact on the economy is staggering. In that same year, it cost the British economy £15 billion, or 0.5% of GDP. And when you're trying to increase GDP by 1% or 2%, whatever you think that that hit of 0.5%, how significant that is now, while 43% of businesses have reported having any kind of security breach or attack in the last 12 months, for medium and large businesses, this figure rises to 67 and 74%.

Every attack inflicts more pain on the United Kingdom plc, and that means lower economic growth and lower tax receipts to fund our public services. And the effects, as we heard earlier, rippled through our whole society. We're talking about Jaguar Land Rover just then and the attack, the summit, of course, it cost the company an estimated £500 million, affected over 5000 businesses and thousands of jobs, with many of those employees based in my constituency. Constituency of Warwick and Leamington.

The impact is significant. Right across it could be cafes, restaurants, pubs, shops, all these being affected by the the downturn that was immediately led with the shutdown of the factories. Now there was the attack also on Collins Aerospace that was was referenced or alluded to earlier that crippled Heathrow Airport and I think Stansted was affected, but but less so. That scuppered thousands of hard earned family holidays. In in in autumn of last year, and the ramifications for the for the travel sector were significant.

Of course, it's not just businesses. We've seen the attacks on councils, as we've heard, and charities. Even the British Library, which was knocked out two years ago, which has meant that so much of our research potential in this country has been impacted across our higher education university institutions, really significantly affecting the UK. The Electoral Commission got knocked out by an attack by Chinese state sponsored. Actors, and there have been so many others. Even our NHS is not safe.

As my right hon. Friend mentioned about the attack on Synovis. But then last year, over 11,000 NHS appointments were lost due to cyber attacks. The attack in June 2024 on London hospitals by the Russian group kiln saw 1100 cancer treatments delayed, 2000 outpatient appointments cancelled and more than 1000 operations postponed. And tragically, the death of a patient. The message from across our international partners and the UK

**** Possible New Speaker ****

security services is clear and I'll give way. I thank my hon. Friend for giving way with regard to the giving way with regard to the attack on the NHS. Prior to being elected to this place, I worked for ten years in health and social care and so I witnessed that attack taking place. And nothing could be taking place. And nothing could be a more stark demonstration of the impact on productivity that cyber attacks have on our on our country attacks have on our on our country and our society.

Does he as there was a meeting of senior at the time, CCG and other health trust executives in Hertfordshire, and one by one they were forced to leave the room like lights blinking out as the impact of the attack became clear. So does he agree with me that this bill is essential in order that our legislation keeps up to date with the new methods of attack that bad actors are using on our state and infrastructure. As as

**** Possible New Speaker ****

as online technology evolves. I thank my hon. Friend for his intervention and his lived experience. Really through this, I can only relate to having spoken to organisations through the Business and Trade Select Committee, but and Trade Select Committee, but also in my role on the National, the Committee for National Security the Committee for National Security Strategy, where hearing from those organisations that have been impacted, how paralysing it is. The immediate aftermath of such an attack and how it challenges an organisation.

So these these kind of red team, blue team scenarios are crucial that they get played out. But when it's actually happening and you are facing an entire shutdown of your systems, it is really very difficult to to navigate. But and this is where we talked, many have talked about the change of culture that is needed. We do need to to embrace this urgently. And as he says, that experience in the NHS was was good, good example. But these attacks Madam Deputy Speaker are the new normal and we must be better prepared.

In September 2024, led by both the FBI and the NSA, the United Kingdom, Germany, Estonia, Canada and the plethora of other allies released their clearest articulation of the threat posed by Russia and Putin in particular. They said, and I quote, Russia is responsible for computer network operations against global targets for the purposes of espionage, sabotage and reputational harm. Since at least 2020. And the NCSC annual review in 2024 called the landscape diffuse and dangerous. While the 2025 review could not have been clearer.

It's time to act, they said in the defining text on the front cover, Richard Horne, head of the NCSC, said and I quote, empty shells and steel production lines are a stark reminder that cyber attacks no longer just affect computers and data, but real businesses, real products and real lives. The recent cyber attacks must act as a wake up call. And just last week, Andrew Bailey, governor of the Bank of England, said cyber attacks were one of the biggest threats to UK financial stability and stressed the critically important need for collaborative defence.

The reality should be clear to everyone here. The front line is everywhere. It's our phone, it's at our desk, it's our businesses, it's our infrastructure. It's even here at the heart of our democracy. And such a threat requires a whole of society response. Of course, we are not the first to have been targeted back in 2007, let's say 18 years ago, Russia launched a cyber attack on Estonia. It was a damaging and debilitating to their society and economy. The cyber attack was a call to action for Estonia and they responded at pace.

It brought about cultural change, which has been talked about in the chamber. In the opening remarks, they overhauled their legal, political and strategic framework, even looking at their education, and adopted a whole of society approach to cybersecurity, and developed a serious public private partnership to counter the threats posed by Russia. Now, no doubt the Minister will have looked at this case in more detail to understand what learnings could be applied here and to our cyber security strategy more widely to ensure whole of society resilience.

Because the reality, Madam Deputy Speaker is that cyber attacks target the weakest link. And so it was welcome to hear my right hon. Friend talk about the initiatives with the FTSE 350 companies and some of the smaller businesses, and how they should be engaging with these threats. Madam Deputy Speaker it cannot be

**** Possible New Speaker ****

acceptable that the most popular password in the United Kingdom is, and I quote, password. No.

**** Possible New Speaker ****

No. It is ridiculous. Every one of us must act as guardian against our cyber adversaries. Turning to the bill itself, there are valuable and desperately needed provisions laid out. The extended scope of the bill is hugely welcome, bringing in data centres, large local controllers and managed service providers under the NIS regulations protects more of the economy from cyber attacks and I'm particularly pleased to see the inclusion of MSPs, given the vulnerabilities that organisations often face from external IT suppliers or their supply base.

The amendments to the regulatory framework are a positive step forward in improving the reporting of incidents, will allow the government to respond at pace and be agile to the evolving threats and shared vulnerabilities. That said, during the last Parliament, the Joint Committee of National Security Strategy, which I now chair called for one cross-sector cyber regulator and I would echo those calls as I believe it will enable far greater regulation and enforcement. Finally, the improved resilience and security enabled through additional powers granted to the Secretary of State are crucial to enable the government to act quickly in real times of crisis.

Now, despite all the positive aspects of the Bill, and I congratulate Ministers after the years of dithering by its predecessor government, it does leave large parts of the economy outside its scope. As I've mentioned already, how can we incorporate a whole of society approach to cyber security like that of Estonia? There will be many different levers for the government to pull. Now, this bill, I believe, is just one part, and I trust that others will follow swiftly. It's worth noting that the EU's NIS 2 Directive is broadly parallel to the bill before us.

However, the EU does go further on cyber resilience, having added sectors, having added sectors such as manufacturing, food distribution and waste water. Now, having witnessed such devastating attacks in these sectors this past year, I would urge us to act swiftly with further legislation to address these areas. Madam Deputy Speaker, in, in in summary, I would I would just restate I absolutely welcome the bill and that the three key pillars of the legislation the expanded scope, improving regulation and strengthening resilience are hugely welcome, as is the importance of experience reporting and sharing by victims.

The cyber attacks we've suffered this past year must be our inflection point, our call to action. Like Estonia's in 2007, we have an opportunity to reinvigorate our cyber defences and ensure the whole of society is resilient. And now the shadow Minister mentioned about the digital ID, what I would gently say is that the opportunity was seized upon by Estonia at that time. They since introduced digital ID it is secure as it is in Denmark. They they looked at the opportunity presented by that, that challenge, that attack that they faced.

And those systems do work. It's been demonstrated by both those countries now, as the NCS annual review rightly asserts, the UK's cyber security is a shared responsibility where everyone needs to play a part. As parliamentarians, we have a duty to raise the salience of this and bring about a national conversation to ensure everyone plays their part. Finally, may I gently encourage the Minister to go further and faster and to look at the broader cyber landscape, as Estonia did, and the EU is doing with its NIS to legislation and to look to introduce legislation to cover food production and distribution, manufacturing and other critical sectors.

But as I say, this bill is an important first step in that development, and I look forward to working constructively with the Minister to ensure that the UK and its citizens are secure and resilient to any future cyber attacks.

**** Possible New Speaker ****

EA Liberal Democrat spokesperson Victoria Collins. Thank you, Madam Deputy Speaker, and a happy New Year to yourself and a happy New Year to yourself and everyone else in the chamber and it is a pleasure to finally and it is a pleasure to finally address the long awaited Cyber Security and Resilience Bill. And indeed, as has been mentioned today, indeed, as has been mentioned today, the importance of this is significant. The National Cyber Security Centre reported that nationally significant cyber nationally significant cyber incidents have more than doubled since the year before this past year's surge in cyber attacks, from supply chains to hospitals to critical infrastructure, has made one fact clear there is no economic or societal security without cyber security.

14.7 billion. That's what cyber attacks cost the UK economy annually. And behind that are attacks on companies like Jaguar Land Rover, M&S and more importantly, the impact on the real economy. Thousands of jobs, businesses hanging in the balance and it's impacting our public services and our private data. And as the Minister mentioned this morning, the NHS Synovis ransomware attack resulted in more than 11,000 postponed appointments and procedures and has even been linked to one patient's death, which is attributed to that delay.

This matters. We must do all that we can to upgrade protection on our security because jobs, economy and lives depend on it and our economy. Imagine it, if you will, as a house is under attack. The Liberal Democrats welcome the bill's intent to upgrade our home security. The addition of data centres, managed service providers and large local controllers mean we're building stronger fences and that companies who have a master key to all of our doors have stronger security, while the wiring is also been upgraded and the alarm system is getting an upgrade with increased incident
14:02
Victoria Collins Portrait Victoria Collins MP (Harpenden and Berkhamsted, Liberal Democrat)
-
-
reporting. But the bill is leaving the back doors wide open by leaving out key sectors. Our alarm system out key sectors. Our alarm system isn't sure when it's supposed to ring, and we've got the companies who have the keys to our doors using our house, asking for simplicity and clarity and support so that they can do their job properly. While no single cyber security legislation can act as a silver bullet, these are the gaps silver bullet, these are the gaps that we must address by failing to take the whole economy approach, which was mentioned by the hon.

Member. We're leaving out public sector and economically significant retail sectors like retail and manufacturing. And indeed, this bill therefore leaves the back doors wide open. The bill stated aims are to protect the organisation so essential that their disruption would affect our daily lives. Yet the government apparently doesn't consider its own public services. Local authorities essential enough for protection. The £10 million Redcar Council incident proves voluntary schemes are failing local authorities. But after this bill passes, government institutions and councils will still lack statutory protections and the ring fence funding.

And this is all while council budgets are getting tighter. I have no doubt that members of the public whose data in the form of electoral rolls or social care records sit in these systems, would also would object to their inclusion. But we're also talking about, as has been mentioned, a potential digital ID system, a mandatory ID system for the whole of this country, which the government have already mentioned, would be built by a sovereign by home made technology. Where will the cyber protection be in that? What's more, leaving out sectors like retail and manufacturing mean that JLS and M&S cyber attacks remain out of scope.

These are significant sectors, major employers, major parts of our supply chains and handle significant amounts of personal data. As it stands, this bill marks a failure of ambition. The government claimed in response to a letter that we sent on the topic. They do not need to wait or rely on legislation to implement cyber security requirements from the public sector, and will instead use the Government Action Plan to ensure the very same requirements written in this bill will be applied to the public sector. My question, Madam Deputy Speaker, is why do we have to have this two tiered approach? Why leave out an economically and socially significant sector such as the public sector? So does the Minister agree that we need mandatory cyber security standards for these sectors of our society, governance and economy? If we're serious about national resilience, about protecting citizens data, about aligning the European partners, then let us vote on it here in this chamber with full transparency and accountability in the primary legislation.

A further critical gap in this bill is the failure to embed security by design, to ensure and also a lack of clear accountability where this should be board led to ensure that each lock, each door, each window of our house is built securely. In 2019, NCSC published Design Principles. Last October, the government itself launched a secure by design framework as core to its cyber security standard. Yet this bill not only excludes government from critical national infrastructure, it abandons this key principle, failing to mention by design.

This matters, especially given the research by Isc2 suggesting that skills shortages are the number one challenge for complying with cyber regulation in the UK, with 88% of respondents experiencing at least one cyber security breach as a result of skills shortages. This is also a missed opportunity for our economy and our cyber security sector. Prioritising security by design would alternatively provide the baseline protection our critical infrastructure desperately needs. So what considerations does the government have to ensure this security? By design, an effective regulation doesn't just mean future proofing, it must be workable.

While we welcome the expanded incident, reporting the current definition risks creating significant regulatory burden over reporting that will overwhelm rather than strengthen our cyber security systems. Those coming to upgrade our security are not being given the clear directions. The current definition of reportable incident is so broad could that it even link to every phishing email. So how will the NCSC feasibly manage this administrative burden when the alarm may be ringing non-stop? Other critical terms lack clarity for the industry, including managed service provider and the criteria for digital critical suppliers.

As highlighted by techUK and others. These aren't just technical details to be ironed out later, they're the difference between a bill that works and one that doesn't, and the industry needs clarity on how to comply. So will the Minister work with us in industry to tighten these definitions so it's workable? Will the Minister consider the best way to ensure simplicity and effectiveness for incident reporting? Furthermore, what is being done to support Home-grown cyber security in the UK? What is being done to defend from hostile foreign interference? What with one of the latest defence contracts going to Palantir? What is being done to support UK tech? Would the government support a digital sovereign strategy, as highlighted by the Open Rights Group, this is yet another missed opportunity to support our domestic tech sector at a time when we should be building UK cyber security capabilities and creating high skilled jobs here at home.

How can we claim to be serious about national resilience when the very infrastructure protecting our critical systems could be entirely outsourced abroad, and supporting UK tech and businesses isn't just about the providers in this bill, it's about the thousands of SMEs who form the backbone of our economy. For those few SMEs and start ups who are directly affected by this bill, it creates a red, glittery thicket of overlapping rules, different timelines and multiple bodies. Cyber security is complicated, and for this legislation to work, it must be simple and easily implementable for UK SMEs.

So what support will there be for SMEs and Start-Ups that are impacted? Furthermore, it would be remiss not to mention the wider cyber crime landscape. SMEs make up 99.8% of UK businesses and are often the most vulnerable link in cyber supply chains. The NCC Group confirms manufacturing, retail and leisure dominated by SMEs with the most targeted for ransomware in 2024. This is why the Liberal Democrats are calling on the government to establish a digital safety net for SMEs. A nationwide first responder service that provides free point of view support to small businesses that have been victims of a cyber attack.

Australia is already doing this, providing person to person support during and after attacks. So if Australia can do that, why can't we? And on top of this, Madam Deputy Speaker, the biggest threat is actually fraud and cost the economy hundreds of billions a year. Two thirds of all fraud begins online and many through social media companies with no liability. Which is why the Liberal Democrats are calling for social media platforms to be made financially viable for fraud on their sites, creating a clear line of accountability for criminal activity.

More than that, fraud is a cyber security issue. It exploits weak systems and inadequate protections. Families lose life savings. Elderly people fall victim to sophisticated phishing. Small businesses shut down while we have the cyber security bill that protects infrastructure by leaving the back door open. It also ignores the billions of savings lost and livelihoods amended due to online fraud. The government must address in its long awaited fraud strategy. We cannot protect systems but abandon our businesses and everyday people. This bill is progress, but it's not the finish line.

The cyber threat is real, evolving and urgent. The Liberal Democrats will work constructively to strengthen it through amendments, but we must ensure that we're not leaving the back door open, that we're future proofing our security. We owe it to our businesses, families and our

**** Possible New Speaker ****

national security to get this right. Thank you. Chi Onwurah.

**** Possible New Speaker ****

Chi Onwurah. Thank you, Madam Deputy Speaker, and a happy New Year to you and to and a happy New Year to you and to all in the House and to the staff as well. And it is appropriate that as well. And it is appropriate that we begin 2026 by talking about an issue in this House, which is of grave importance to all our constituents, but which we do not. It's not talked about enough here, or for that matter, across the country.

And that is, of course, cyber security. At the start of this century, of this millennium, only a quarter of the UK and 6% of the world were online. Today, almost 98% of the UK and 68% of the world use the internet, according to Ofcom. We each spend between 3 and 6 hours online per day, depending on our age and interests.
14:11
14:11
14:11
Chi Onwurah Portrait Dame Chi Onwurah MP (Newcastle upon Tyne Central and West, Labour)
-
-
whether you use online banking or not. Your bank account details will be stored in some cloud somewhere. The same is true of your health The same is true of your health records, your electricity bills, your child's school records, the your child's school records, the safety sensors on our nuclear power plants, your Christmas marks and Spencer's order, your last Uber ride. The Prime Minister said that national security is the first responsibility of any government. I hope the House can all agree that government must ensure the security of the British people.

As we go about our increasingly online lives, and that previous governments have not taken this issue seriously enough or done enough to protect our citizens. So that's why, as chair of the science, Innovation and Technology Select Committee and a self-confessed tech evangelist, I welcome this legislation and I'm pleased to see other members of the select committee here. The committee has not examined cyber security in detail specifically, but we have expressed significant concerns as regard to public sector data management.

For example, after the Afghan data breach came to light. Currently, as we have heard, the UK's only cost cutting cyber security legislation is that inherited from the European Union. Since Brexit, the European Union has updated these regulations, leaving the UK working under an outdated framework. Meanwhile, nationally significant cyber incidents as measured by the National Cyber Security Centre more than doubled last year. The NSS NCSC also warns that AI will almost certainly increase both the scale and impact of attacks.

And let us remember that when everyone can code, thanks to AI, everyone can hack and we need to respond to that because these attacks threaten not only our national security, but our economy. And in November, the Bank of England cited for the first time a major cyber attack that on Jaguar Land Rover as a factor in its decision to hold interest rates. The JLR breaches, estimated to have cost the country the economy almost £2 billion. So that's why I welcome this bill, which seeks to expand the scope, the scope of to new sectors, making regulators more effective and grant the government additional powers to respond to the ever evolving threat landscape.

However, I must be clear there is more to be done. My main concerns relate to the scope of the legislation. So as we have heard, the bill brings data centres, large load controllers and managed service providers in scope of regulations, which is right and grants competent authorities the power to designate critical suppliers who are vital to the services provided. Yet, as we have heard, some of our most significant sectors remain outside of its core obligations. Retail is the UK's largest private sector employer, handles huge volumes of sensitive customer data, runs complex supply chains, relies on legacy IT systems, often making it a prime target for cyber criminals.

Yet it is outside the scope of the bill, so the legislation would not have done anything to prevent the attacks on Marks and Spencers, the Co-op or Jaguar Land Rover, which impacted our constituents. So much. So now I welcome the government's plan to promote the new Cyber Governance Code of practice to improve preparedness in sectors like retail. But even after high profile breaches, cyber security is still not prioritised at board level. And a recent report by the Information Systems Audit and Control Association ISACA, shows only 56% of company boards take cyber security seriously enough, and that is after JLR.

So the the the Minister in his excellent speech, did say that it was up to private sector companies should to manage their own cyber security. I agree with that. But I wonder if you would address how he will, how the government will assess that that is actually happening and what he will do, what the government will do. If there is evidence that companies are not managing their, their their cyber security effectively and that our citizens are not adequately protected as a result, because without a way to monitor and enforce government standards, large parts of our economy remain exposed.

ISACA recommends a statutory review of the uptake and effectiveness of the Cyber Governance Code. Powers for regulators to mandate periodic external resilience assessments, including penetration testing and scenario based exercises, as well as requiring organisations to appoint an accountable individual who meets defined competency standards. Now, government departments, local administrations and public bodies such as the BBC are also outside the scope, so the bill does nothing to address long standing weaknesses in public sector data management, which have been highlighted by my select committee.

Now, as the National Audit Office declared last year, the cyber threat to the UK government is severe and advancing quickly. And we had the cyber attack on the Fcdo in October, which is a clear example of how rapidly these attacks are escalating. We need greater rigour to prevent future attacks and build the public trust that is needed for the implementation of programmes such as digital ID and other digital transformation projects. Now I've not been able to study in any detail the the action plan, which the government published this morning, but I, I will look for clear measures of success when it comes to implementing the government's action plan and ways in which cultural change which we have spoken about in this debate, which is needed within the public sector as well as a private as well as the private sector, will be achieved.

And the Secretary of State recently told my committee that the government would, and I quote, assess the improvements the cyber security bill brings to the UK cyber defences through Post-implementation reviews, regular engagement with NIS regulators and industry, and monitoring the incidence and cost of any future cyber attacks. So I would welcome I would welcome the Minister's clarifying where these commitments reflect the statutory requirements within the Bill. Clauses 20 to 22 or the additional policy commitments and how they will be funded.

Finally, small businesses. So the bill rightly focuses on critical national infrastructure. But as we all know, you are only as secure as your weakest, weakest link and the supply chains for our critical national infrastructure involve many small businesses who may or may not be within the scope of this bill, depending on whether and how and whether they are designated as such. Can the Minister say at how quickly he envisages businesses knowing whether they have been designated as critical suppliers? Now, I support the bill's proposals for mandatory cyber incident reporting.

I recognise the value of government collecting and publishing data on ransomware and other attacks, but I share concerns raised by the Abi and other speakers about the feasibility of small businesses meeting the proposed two stage reporting, particularly submitting full reports to regulators and the NCSC within 72 hours. We have seen that Cyber Essentials take up, so the the programme to help businesses, particularly small businesses, achieve the cyber security that needs cyber essentials take up, is is low amongst businesses.

As I is low amongst businesses. As I said, 30, 33,000 in in 2024, cyber insurance take up is also low amongst small businesses, so leaving them vulnerable both in terms of skills and protection. Can the Minister say a little bit about plans to address this? If this bill is to succeed, implementation must be done with industry, not to industry. So I echo techUK calls for clearer guidance on information sharing and additional support to help small businesses meet compliance costs.

So, Madam Deputy Speaker, I hope in his in his closing, the Minister can address the following points. Specifically, will the government consider extending the bill to economically significant businesses outside its current scope and empowering regulators to mandate stronger cyber governance and resilience assessments? Will the government consider including direct measures to strengthen cyber security and resilience in public administrations, including local authorities and government departments? Will the government clarify whether the Post-implementation reviews monitoring of cyber incidents and engagements with regulators and industries? She has outlined to my committee reflect the existing statutory requirements within the bill.

Will the Minister ensure that the new cyber incident reporting and information sharing requirements are implemented in a practical and proportionate way for small businesses? Will they take steps to support cyber insurance taker in? Finally, will they ensure there is clear guidance on information sharing requirements and provide additional support to help businesses meet compliance costs? Madam Deputy Speaker, we need to talk more about cyber and cyber security and I have not touched on some of the national security implications which my which the Minister and my hon.

Friend the Member for Warwick and Leamington, described very well in his speech. But this is clear. This is this is an issue which is only going to get more important both from a national security and economic security and personal safety and security perspective. So if we can get the implementation of this bill right, extending it as necessary, working with industry, supporting smaller businesses, supporting public trust and public security, then I hope we can build a nation that is not just cyber security, but paired prepared for

**** Possible New Speaker ****

the many challenges which lie ahead. Sir Oliver Dowden. Thank you, Madam Deputy Speaker,

**** Possible New Speaker ****

Thank you, Madam Deputy Speaker, and it's a pleasure to follow the hon. Lady for hon. Member for Newcastle upon Tyne, who has brought tremendous expertise to brought tremendous expertise to this debate. In my previous role overseeing national resilience and overseeing national resilience and cross-government coordination of national security threats. Cyber security was probably the one area that caused me the greatest number of sleepless nights. There's been a lot of talk in recent months and years about the increased need to defend the realm, and the steps that need to be taken to address the defence of the realm.

We all
14:23
Oliver Dowden Portrait Rt Hon Sir Oliver Dowden MP (Hertsmere, Conservative)
-
-
know from past experience that the first line of attack of any attack on the defence of the realm is highly likely to be through cyber attacks. And indeed, in a completely different context, we only need to look at the public comments of the president of the United States a couple of days ago, in terms of the first steps that the United States took in its intervention in Venezuela, he talked about capabilities that the United States had to knock out power supply there.

And if we look at our adversaries, particularly Russia, North Korea and Iran, we can see that they are actively inculcating and encouraging environments where cyber attacks can be planned and take place, whether that's explicitly private sector individuals or with the connivance of the state. A deliberate grey zone is created there with the desire to increase knowledge of the risks to cyber in the United Kingdom and our allies, and to carry out penetrative attacks to that effect.

And we are likely to see this grey zone warfare continue to increase as a result of actions that we see in Ukraine and elsewhere, and we just have to look at our own experience of this. If one looks at what happened after the attack, and many hon. Members have made this point, how the initial attack rapidly cascaded and affected many others in the supply chain, and certainly from the government's own research and testing of this. And again, it's in the public domain that one rapidly sees that one cyber attack can cascade into other areas.

So, for example, when we tested the impact of a cyber attack on our electricity system that rapidly cascades into our water system, which is dependent on electricity, clearly it also rapidly cascades into our transport system. So before long, a small cyber attack becomes a very, very large cyber attack. And in common with most other, in fact, all other advanced countries, the United Kingdom is highly exposed to cyber attacks, something that a point that I made repeatedly from the despatch box in this House.

I do welcome that the steps that the Minister has outlined today and this legislation, I would just like to gently caution against what the Minister said, and I don't think it was his intention, but he said that this legislation will fix the cyber security problem. It won't fix the cyber security problem. No single piece of legislation is ever going to fix the cyber security problem. Nor is this a question of good guys and bad guys. The government, the last government did nothing.

This government is doing nothing. Each government has to a fresh look at the challenges of cybersecurity and take necessary and proportionate steps to address the risks of cyber security. So in that context, I just want to make a few. Yes, I will give give way to the hon. Member.

**** Possible New Speaker ****

I thank the right hon. Member for giving way given his extensive experience. It's very interesting experience. It's very interesting to to hear what he says if he had his time again. And this is not to criticise the previous government, but but if the here and now does he think that this area needs an absolute focus from across absolute focus from across government but from across society, because it is such a crucial part of our defence?

**** Possible New Speaker ****

of our defence? I totally agree with him. And indeed, that is what the National Cyber Security Centre, working in conjunction with the last government and I believe and I know continuing under the current government, has one national cyber security centre set out the whole of government approach. It can't just be the actions of individual government Ministers or individual actors in the private sector. The whole of government needs to act together in terms of further steps we could and should have taken.

This goes to the intervention I made on the Minister. I do think that more pressure needs to be brought to bear on Ministers in terms of their accountability for cyber security, and I fear that the risk if we don't put this into primary legislation, it's something that can slip further and further down. Ministers in trees, whilst Ministers have a desire to address it. Other, more pressing, immediate problems distract their attention. So the some constructive suggestions about things that that could be improved in respect of this proposed legislation.

The first is this point about many of the powers being delegated to to secondary legislation on ministerial direction. I don't have a problem with that. I think that's it's essential that we have a framework piece of legislation, and then we have the flexibility to allow secondary legislation to be brought forward to address challenges as they arise. I would, though, urge that Ministers undertake a meaningful and mandatory consultation on any secondary legislation that comes forward so that businesses and others can contribute to it.

I would also caution against Ministers devolving and forgetting to regulators their duties in respect of cyber security. Too often I've seen this, that and this is again in with governments of both colours that regulators are empowered to address cyber security problems or any other problems. They then charge off in one direction. They fail to take into account questions such as proportionality. So the impact of these regulations versus the economic burden of them, and Parliament ceases to have a significant role and Ministers cease to have a significant role.

So I would urge Ministers to keep a tight grip on regulators and the instructions that they give them. I would also be a little cautious about some of the arguments made by other hon. Members about the need to constantly expand the scope of this legislation to further and further areas of the private sector. It's all very easy for us in this chamber to talk about the need for further legislation. When one is a small business faced with a huge piece of legislation being required to interpret it, it looks a very, very daunting prospect.

So my preference would be to continue the sort of cooperation that we've seen through the whole of society approach that the NCSC has advocated. Also, in terms of proportionality of this, I would urge Ministers to embrace AI. The the opportunities that using AI, for example, to triage incoming attacks to avoid duplication. I think there's a lot that can be done in that area in terms of streamlining the system. On the flip side of AI, I think we have to take very, very seriously the risk that Agentic artificial intelligence poses in terms of cyber attacks.

And it appears that we reach an inflection point in November last year, November 2025, when anthropic reported disrupting what it described as the first large scale cyber espionage campaign executed largely via Agentic AI, we are likely to see much, much more of this. So I'd welcome from the Minister in his concluding remarks what the government intends to do to ensure that we keep up with this threat, because we are only in the foothills of the risk that Agentic AI poses.

Further to this point on the role of the public sector, 40% of incidents handled by the National Cyber Security Centre when I was the responsible Minister were from the the public sector. So I do question the exclusion of the public sector from this. I appreciate there's this this plan that the government has announced. I haven't had a chance to to look at the plan, but I can imagine broadly what would be contained in it. I think the the key thing, though, is what's the stick that is applied to public officials and Ministers outside the core government departments responsible for this, to make sure that they actually take their responsibilities seriously? So I think some legislative proposals may be needed in that area.

Similarly, in relation to budgets, this again, the the the core responsible departments for the Cabinet Office and the DSIT will prioritise cyber security. I fear that other government departments may not. So I think there is a strong argument for ring fencing, cybersecurity budgets for all departments that can't be transferred to more pressing short term problems, as was often the case, particularly, for example in the NHS. I also think it's very important that we don't overlook the basics. It's very easy to talk about legislation.

It's very easy to talk in high level terms about threats. Probably the single biggest thing we could do in this country to deal with cyber risks is to make sure that every time, every single business and every single private individual gets one of those annoying pings on their phone that says, you need to upgrade your software to the latest operating system. Same with your PCs and your iPads and so on. That's being done by providers because they know that there is a cyber risk there, and it's a patch to address it.

If that patch is dealt with immediately, that can have a huge effect in terms of the resilience of the the whole of society. And that's a message that the NCSC constantly puts out. I think we also need to look at our resilience as societies as a whole, for when we have a major cyber attack. Now we have had major cyber attacks, but they have tended to be just in one sector, albeit with cascading effects, as was with the case with JLR. We haven't yet had a whole of society cyber attack.

That is one that either flows out of control from a criminal attack, or is a deliberate attack from a hostile state that cascades widely across all of society, affecting our electricity, water supplies and so on. I fear it is only a matter of time that that will happen, and I think we do need to look at the resilience of individuals to that, whether that's the ability to have non-analog systems such as electric torches and battery powered torches and so on. I think more work, which I started as a Minister, needs to be done in that space.

And I also think we need to look at the question of emergency communications. Certainly my experience, I think that public sector broadcasters such as the BBC are not required to take emergency communications from government in such situations. I think that is a loophole that could be exposed in such a situation. And finally, just more broadly in terms of resilience, again, we are at the foothills of the impact of AI. We are going to see vast impacts in terms of employment, how people can lead meaningful lives as AI advances more and more rapidly, and in terms of resilience of our society, I think this House needs to have a much wider debate, not for this piece of legislation, but more generally about how we how we address these epoch changing challenges that we're facing.

So, in conclusion, Madam Deputy Speaker, I think this is a welcome piece of legislation. It's an important step forward. There are very important challenges, which my right hon. Friend, the lead spokesperson for the opposition, correctly highlighted, that needed to be addressed as this legislation passes through the House, but I think it is an important step forward. But it's only one step. And once this legislation is over, we need to be prepared to return to this issue again and again and again.

Thank you.

**** Possible New Speaker ****

Anna Gelderd. Thank you, Madam Deputy Speaker, I'm pleased to support this bill as the MP for South East Cornwall, a constituency of hard working rural and coastal communities where digital access remains a problem digital access remains a problem and where long distances between services and alternatives when systems fail. As we know, digital connectivity is a growing necessity for daily life, from traditional farming and phishing businesses to farming and phishing businesses to carers supporting vulnerable residents, access to online job sites, online government websites and access to NHS services and emergency support are all part of our new daily existence.

So reliable digital infrastructure, one that is protected from disruption and from attack, is essential for our economy, for our public services and our community safety. That is why I'm supportive
14:36
Anna Gelderd Portrait Anna Gelderd MP (South East Cornwall, Labour)
-
-
of the action that this government has taken to improve the lives of my communities. Actions such as the my communities. Actions such as the Digital Inclusion Fund, which Labour has put in place to tackle the barriers that stop people getting online in the first place. getting online in the first place. The rollout of Project Gigabit, ensuring that rural and hard to reach areas are not left behind, reach areas are not left behind, and the shared rural network, an important landmark partnership between government and mobile network operators that Labour network operators that Labour continues to support to eliminate so-called not spots, which I have to say I know only too well in South East Cornwall and improve 4G coverage across rural areas like mine.

Improved connectivity and cybersecurity, can support small businesses, enables remote working, improves access to those NHS services we all need, and helps young people build their futures through online training, job opportunities and government support. It can also strengthen our rural resilience, ensuring communities stay connected during emergencies and are better able to adapt to future challenges. My goal for South East Cornwall is to become a digitally connected, resilient and safe constituency where no one is left behind because of their rural postcode, and I'm pleased to have been raising constituents concerns with Ministers and working with them to improve this for local residents.

Those digital systems must also be secure. Cyber attacks carry real costs for both individual businesses and our wider economy. Businesses in South East Cornwall work hard to provide those services, create local jobs and support our local communities. And there are practical steps that businesses can take. The National Cyber Security Centre provides excellent guidance, but it also matters that businesses know that their government is acting to protect them as they navigate the growing risks that online work faces. This is why I welcome the action that this bill takes to strengthen our cyber resilience.

And I ask the Minister what is being done on recovery and response planning should incidents occur as the reality for rural and coastal communities is that outages often last longer and the impacts are felt more sharply. The bill also presents an opportunity to grow skills, learning and employment across the country, improving cyber security standards increases demand for skilled professionals. It creates pathways into good jobs and long term careers that matters for us in South East Cornwall, where we want our young people to see a future locally without needing to leave to succeed it all.

It also matters for diversity. Our services are stronger when they are designed and protected by people with different backgrounds, different experiences and different perspectives. Work in this area can open the doors for young girls and women into Stem careers, and help break down the longstanding barriers that have been felt by women underrepresented in tech, whether at entry level, in mid-career progression, or in leadership roles. The Secretary of State for science, Innovation and Technology recently welcomed the Women in Taskforce to bring government and industry together to identify and dismantle those barriers, and I look forward to seeing the benefits reaching the women and girls in south.

It is also important to recognise that cyber resilience is now a key element of our national security and our defence readiness. Staying up to date and agile is essential, particularly as advances in AI and quantum computing create new methods for testing for strengthening and securing our systems, but also present new challenges that we must face. We have world class research facilities in the UK with brilliant minds that can support our national security and ensure that the UK is at the forefront and prepared for those future attacks.

The work that this government is doing through the bill updates the UK's existing frameworks so that we can respond to new and emerging threats and better protect our communities, as well as safeguarding sensitive information and personal data. But of course, there is room for further work in the future. And with the nationally important Devonport Dockyard just across the river from South East Cornwall, many of my local residents cross the Tamar each day to work on site, and a serious cyber attack could disrupt supply chains.

It could compromise secure communications and undermine operational readiness with real consequences for local safety. My local livelihoods and our national defence. So supply chain resilience is especially important here in South East Cornwall, as many Cornish businesses support larger providers in defence, energy and infrastructure. So ensuring that our services and our local systems are resilient protects both local suppliers and national partners, and it is essential that UK defends itself and protects security at home and abroad. So can I ask the Minister how will you look into creating clear expectations on those wider supply chain? Cyber resilience, practical support for smaller suppliers such as those in south east Cornwall, and strong incident recovery planning so that both major defence infrastructure and the SMEs that support it are protected.

For South East Cornwall, this speaks to resilience in the broadest sense. It supports secure services, a stronger economy, new opportunities for skills and jobs, new opportunities for women and girls, and the confidence that the systems we rely on every day are protected. So I'm glad to support it. And the action that this

**** Possible New Speaker ****

government is taking to keep our digital future safe. David Reed.

**** Possible New Speaker ****

David Reed. Thank you, Madam Deputy Speaker, and I very much welcome the opportunity to speak at the Second Reading of the Cybersecurity and Reading of the Cybersecurity and Resilience Bill, a bill that addresses one of the most defining national security challenges of our national security challenges of our age. And we've heard many valuable contributions from honourable and right hon. Members across this right hon. Members across this House so far. Today, before entering Parliament. Madam speaker, I spent several years working to protect our country from cyber risks.

My background in software engineering gave me a rare view under the bonnet of the systems that underpin almost every aspect of our daily lives. I saw first hand how our digital infrastructure works, and just how vulnerable much of it remains. I really love that work, and I'm proud to say that as a country, we are genuine world leaders. But I would be dishonest if I said that I did not. It did not leave me deeply worried at times, not because of any single threat or actor, but because of the sheer scale, complexity and relentlessness of cyber risk we face.

Those risks are only accelerating. With advances in artificial intelligence, automation, and the advent of quantum computing. These technologies have heard today will revolutionise our lives in ways that we are only just
14:42
David Reed Portrait David Reed MP (Exmouth and Exeter East, Conservative)
-
-
beginning to understand, and we must adapt alongside them if we are to remain a serious technological to remain a serious technological and economic power. Our lives are now dependent on the digital now dependent on the digital systems at every level, from water treatment plants and electricity networks to transport, financial markets, healthcare and the wider economy. And I think it's fair to say that we are no longer merely supported by digital infrastructure. supported by digital infrastructure. We are built upon it. And when those systems fail, the consequences are not abstract, they are immediate, they are human, and they can be devastating.

And we've already seen that reality play out in this country. We cast our mind back to May 2017. The WannaCry ransomware attack tore through the National Health Service. Tens of thousands of computers were infected. Staff were locked out of patient records, diagnostic systems and telephony. Ambulances were diverted. Thousands of appointments and operations were council, including urgent cancer referrals. At the time, the estimated cost for the NHS was 92 million. But the human cost, the stress, the disruption, the loss of confidence cannot be measured in pounds and pence.

And the crucial point that we've heard this from contributions today. The attack was not targeted at the NHS, but the NHS was particularly vulnerable because it was reliant on outdated and unpatched systems and the fragmented digital assets owned. It was a warning shot that should never be forgotten. More recently, the private sector has faced similar sobering lessons. Capita very recently was fined 14 million following a cyber attack that compromised the data of more than 6 million people. British Airways and Marriott International suffered major breaches affecting hundreds of thousands of customers, resulting in substantial penalties and lasting reputational damage.

These were not small firms. They were sophisticated organisations with scale, expertise and resources. And yet they were still exposed. That is why this bill matters and why I want to work constructively with the government to ensure we get it right first time and, crucially, that we build the ability to adapt and update this framework. As the technology and threats continue to evolve. Whilst referring to the point made by my right hon. Friend the Hertsmere not making this burdensome on businesses and organisations as the UK's first piece of legislation to include cyber security in its title, the Cyber Security and Resilience Bill represents an important step forward.

It modernises the Network and Information Systems framework brings new sectors into scope, including data centres, managed service providers and critical suppliers. Strengthening incident reporting requirements enhances enforcement powers and allows government to act decisively. I hope when national security is at risk. I welcome these objectives, in particular recognising that managed service providers and supply chains are now critical attack vectors. And that is an absolutely correct point. Cyber threats do not respect organisational boundaries and our regulatory framework must reflect that reality.

However, Madam Deputy Speaker, this bill must not be treated as some sort of elixir. Cybersecurity is not solved by regulation alone. And while the bill strengthens protections for critical national infrastructure, it leaves significant questions unanswered questions we must address if we are serious about national resilience. One of the most pressing concerns raised by industry is the growing complexity of incident reporting. Organisations already face overlapping, overlapping obligations under data protection law, sector specific regulation and soon economy wide ransomware reporting requirements as that multiple voluntary reporting channels and the landscape becomes fragmented and very confusing.

And having been a small business owner before, when you are dealing with marketing, marketing, advertising, pay payments for staff, it becomes almost a difficult position to be in when you're having to have these extra layers and complexity. With reporting added on. The first hours of cyber incidents are chaotic, systems are down, decisions are time critical, staff are under immense pressure and forcing organisations to navigate multiple reporting regimes in that moment risks distracting them from the most important task, which is, as we all know, containing the attack and restoring services.

A unified reporting framework with a single point of contact and aligned timelines would reduce burdens on businesses whilst improving the quality of information available to governments. This bill should move us closer to that outcome, not further away from it, and I look forward to the next passage of this bill to working with government to ensure that happens. We must also be honest about the limits of sector based regulation, and the Minister referred to this in his opening remarks. While the bill focuses rightly on critical national infrastructure infrastructure, many of the most damaging attacks in recent years have occurred outside its scope.

Manufacturing, retail and consumer services have been heavily targeted, and the attack on Jaguar Land Rover, as it's been referred to by many honourable and right hon. Members, today estimated to cause up to 2 billion in economic damage across the company and its supply chain, is a stark example, and I want to put this point on record that I'm also deeply concerned about the precedent being set when the British taxpayer is effectively required to act as an insurer of last resort for major companies that have failed to adequately adequately defend themselves.

For large firms that are critical to our economy, the expectation that the public will step in cannot become the norm. Responsibility must sit squarely with the boards and executives to invest properly in cyber security resilience or face the consequences. And I am glad to see that the government have made the initial steps to having that conversation with industry. At the same time, small and medium sized enterprises, which make up the vast majority of our economy, are particularly exposed. They often lack the skills, budgets and capacity to implement proportionate cyber defences.

Yet they sit deep within the critical supply chains, as a single weak link can have cascading consequences far beyond the organisational organisation directly attacked. If cybersecurity is economic security, I think we all agree that it is. We need a whole economy approach. That means combining regulation with incentives, support and standards that uplift resilience across the UK plc, not just at the very top. This should include stronger, secure by design requirement for technology products embedded through procurement and standards, and practical, accessible support for smaller businesses, potentially including considerations of a national First responder model to help small firms recover quickly from cyber attacks.

We must also address the skills challenges head on. Cyber skills shortages are already undermining resilience and compliance and regulators themselves. If we are to give them more powers to investigate these things, we'll need additional technical and enforcement capacity to deliver the expanded responsibility set out in this bill. That capacity cannot be assumed. It must be planned for, funded and developed far in advance. Finally, Madam Speaker, I want to raise the issue of cyber crime law. The Computer Misuse Act dates back to the 1990s, a time when fewer than 1% of the population had access to the internet.

Its blanket prohibition on unauthorised access fails to distinguish between malicious attackers and legitimate cyber security professionals acting in the public's interest. Now that matters, vulnerability research and threat intelligence are essential to defending our systems. Yet many professionals in that industry operate in a legal grey area where carrying out work that ultimately strengthens our national security. Updating that framework, including introducing protections for reasonable research, would modernise the law without weakening it. In conclusion, Madam Speaker, the bill is an important foundation.

It strengthens protections for critical services and sends a clear signal that cyber security is a core responsibility of a modern state. But legislation alone will not deliver that resilience that requires coordination, clarity, capability and sustained investment, and an honest understanding of where this bill must be strengthened as it moves through. Parliament's cyber threats do not stand still, and neither can we, and I support the direction of travel set out in this bill, and I urge the government to engage constructively as it progresses, so that we can deliver a framework that provides real, lasting protections for our country and our economy.

And the British citizens.
14:51
Anneliese Dodds Portrait Rt Hon Anneliese Dodds MP (Oxford East, Labour )
-
-
Thank you, Dame Anneliese Dodds. >> Thank you, Dame Anneliese Dodds. >> Thank you. >> Very much, Madam Deputy. >> Speaker. >> And a very happy New Year to you, to all the parliamentary staff and indeed to all members in this chamber. It's a real pleasure to chamber. It's a real pleasure to rise to speak in favour of this crucial Bill, which I am really pleased to see now having its Second Reading, and, of course, a pleasure also to follow on from the Member for Nick Smith and Exeter East.

He, of course, set out many of the stakes that are so critical here. And we also saw that, of course, in the opening speech from my right hon. Friend for Edinburgh South, he described a number of really disturbing cases, as have other members during this debate, and he set out some of the scale of the impact of cyber attacks with some really concerning figures. And just as with my friend for Warwick and Leamington in particular, I was struck by the 0.5% hit to GDP coming from cyber attacks and the fact that our country has been the third most severely impacted worldwide by cyber attacks.

It is therefore very welcome that this bill focuses on a faster, more joined up approach to deter and deal with cyber attacks. I believe it has gone alongside a really strong grip from the new government. On the need for a sectoral approach to dealing with cyber attacks. Of course, unfortunately, we had to see that given the attack on JLR and I was pleased to see the previous Secretary of State. I know the current Secretary of State has continued this, really engaging with the automotive sector on these issues, on the challenges and lessons that need to come out of that attack on JLR.

And that's particularly important in my constituency. Given the significance of BMW Cowley for employment in Oxford East. Madam Deputy Speaker, I believe it is critical that we assess cyber security alongside other forms of cyber criminality, as indeed, I note, the head of MI5 has argued for us to do. Cyber attacks are increasingly being carried out by quasi non-state actors that operate in the kind of grey zone that the right hon. Member for Hertsmere has just left the chamber talked about, often implicitly backed by Russia or by other adversaries.

They are taking place at the same time as a rise in cryptocurrency laundering and disinformation operations. And I have to say that, sadly, I am forced to share the assessment of Globsec, the security focussed think tank, that the pattern of Russia's hybrid war has persisted without an effective Western response. There has been an escalation in cyber attacks and also in sabotage, disinformation and political interference. But we have not seen the kind of joined up approach across like minded democracies that is needed here.

I was assured recently by my right hon. Friend for Torfaen that the government is working with the EU on combating foreign interference. That work clearly needs to be intensified, especially when we see what is happening to other democracies not so very far away from where we are now. I saw the threat from myself directly in Moldova, where cyber criminal methods are often being used in combination. A cyber attack on the election regulator coincided with a disinformation campaign sponsored by Russia, and disruptions like bomb hoaxes in real life.

So while I welcome this legislation, it must be coordinated with broader work to protect our country's resilience and digital sovereignty, and to secure transparency on foreign interference. In that regard. Madam Deputy Speaker, I want to end by mentioning a concerning development, the sanctioning of two British citizens by the United States over the Christmas period. Both have worked to deliver transparency, including on foreign interference, clearly relevant to this bill. Imran Ahmed is from the centre for Countering Digital Hate.

It's dispassionate, evidence based analysis has uncovered the spread of disinformation, violent racism and material that poses harms to children. Claire Young Salford is from the Global Disinformation Index. It provides information about the extent of polarisation and disinformation, so companies can make informed choices about where to advertise. A free market approach to providing transparency. My right hon. Friend for Edinburgh South stated at the beginning of this debate that when national security is on the line, we must be ready to act, and I strongly agree a number of members in this chamber during this debate have said how important it is that we have a cross economy and cross society approach to these issues.

I believe the sanctioning of these individuals risks chilling transparency, including potentially transparency that can uncover foreign interference. So lastly, I hope the government will resist all attempts to reduce transparency. The welcome efforts in this bill on cyber resilience must be accompanied with work to counter other cyber and information related threats to our national digital sovereignty and, more broadly, threats to our national security and interests. Thank you.
14:56
Bradley Thomas Portrait Bradley Thomas MP (Bromsgrove, Conservative)
-
-
Yeah. >> Thank you. Madam Deputy Speaker, I'd like to start by putting on record my broad support for the principles within this bill. This principles within this bill. This is one of the biggest threats that our country faces, and we're living in the grey zone right now. Every day, there are thousands of cyber attacks that take place on private companies, publicly owned companies, infrastructure. This is probably the most profound wave of attacks, hostility that we face, that are in plain sight, that the vast majority of the country and our constituents are unaware of.

And that's a good reason. That's because there are many good people out there working in the National Cyber Security Centre, in the intelligence agencies and the military, across government, across private industry, do so much to keep us safe. But that does not mitigate the fact that the threat is real, present, and it's only ever increasing and it's only ever increasing, not just because of criminality in a cyber form, but because of the threats that come from nefarious states, particularly Russia, China, Iran and others that have been mentioned.

JLR is particularly prominent in everyone's minds. The Jaguar Land Rover attack, whilst it affected the whole country and affected global supply chains, it had a particularly profound effect in my constituency, where many of the Jaguar Land Rover workforce are based and we've seen what happens if we fail to invest sufficiently in our cyber defences. Such a deficiency in investment only seeks to enable those who seek to do us harm. And the point has been made that our lives are not just they're not just sort of somewhat digital.

They are fundamentally digital in almost every facet of life. For all of us. Madam Deputy Speaker, there's a couple of points in particular that I'd like to emphasise, one that I haven't heard spoken about very much, which I think is within the scope of this and somewhat adjacent to at the same time, which is around the role of foreign technology in our supply chains, particularly kill switches. We're seeing increasing numbers of news articles about these, particularly relating to energy installations.

Questions have been raised on numerous occasions on the floor of this House around the prevalence of kill switches in Chinese technology in particular, and the risk of the risk of exposure to an adversarial state abroad that could destabilise our energy systems. And I particularly would like to see a joined up approach from government across the whole of government in tackling the broader threat, not just viewing this through one single lens. And I know that Ministers will be looking at it across the board, but I would appreciate if the Minister, when he's winding up, could address how cross-government this is being looked at.

Another particular case is the rise of Chinese made cars. It struck me around 12 months ago. I rarely saw a jku car or an MoD car on our streets. Now they seem to be everywhere, and I cannot help but suspect that given the links that these manufacturers have to the Chinese Communist Party, that there are potentially kill switches within those vehicles, but more importantly, that these vehicles are sending back data to a foreign adversarial state around users mobility habits. And the implications of that are particularly profound.

The final point that I'd like to make, very briefly, is around the reporting regime. I introduced a ten minute rule bill to this House a couple of months ago that touched upon the broad principles within this, and calling upon government to have a pragmatic approach with regard to the reporting obligations on particularly small companies. I suggested a threshold of £25 million of turnover before a company would be within the scope of my proposed bill. The reason I chose that threshold is that it would have omitted the vast majority of small, small, family owned businesses unless they were designated within a one of the 13 critical industries.

And the reason for that was simply a fear that obligations reporting obligations on small businesses are ever growing. And for many businesses, additional obligations with regard to cybersecurity could result in significant additional headcount that they may not be able to afford. So I'd actively encourage the Minister to engage as much as possible with representatives of small business to ensure that the reporting obligations are as minimal as possible, whilst capturing the broad principles of the Bill. But to put on record, Madam Deputy Speaker, I support the broad principle of this.

I think it's a step in the right direction. I hope that government will adopt a cross government approach. This is a wider societal issue that all of us have an obligation and a duty to fulfil, and I look forward to seeing its progress and contributing as the Bill makes its

**** Possible New Speaker ****

way through Parliament. Sarah Russell. Thank you, Madam Deputy Speaker, and Happy New Year to you, your team and everyone else in the House. It is no overstatement, I don't It is no overstatement, I don't think, to say that this is one of the most pressing issues of our time, and I suspect that if we weren't bringing forward this legislation, it would only become apparent quite how pressing it had been when there was a major incident that lay it there.

And I think it's one of the marks of successful government that hopefully we are managing. And I touch wood as I say this, but to stay ahead of the curve on these incidents, national security relating to critical infrastructure, there's just there is nothing more, more important. And I think it's exactly what our constituents want to see us doing. And I wish they saw more of us doing this, discussing it on a cross-party
15:02
Sarah Russell Portrait Sarah Russell MP (Congleton, Labour)
-
-
basis with broad agreement. So it's welcome to see the government taking the steps that they are. And taking the steps that they are. And I particularly want to discuss the enhanced incident reporting duties enhanced incident reporting duties on the digital service providers in the bill and the duties to inform customers. In short, I have real concerns about how these will play out in practice because my out in practice because my experience of having advised whistleblowers in the financial sector is that when there are obligations of this nature, that unfortunately some corporations take more efforts to avoid complying with them than they do to actually comply with them.

Now, it's an excellent piece of legislation. I'm not suggesting that the government should have drafted it in any other way than it has currently been drafted, but I think we need to look at our whistleblowing laws alongside it, because at the moment we don't have strong enough protections for whistleblowers within UK law, in employment and outside of employment sector setting. So in relation to contractors and and other third party bodies, and if we don't make sure that people have the mechanisms by which they can anonymously report breaches of these sorts of obligations and the right protections for them when their employers, when they are raising the concerns internally in the first place, then we will not be able to make adequate use of the excellent provisions that this bill contains.

So I just want to impress upon the Minister how very, very important I think it is that this legislation is looked at in that wider context. Also, within that wider context, there is a sort of a broader debate that lots of us have sort of touched on here without really specifically identifying it about how we balance the risk across society and the costs of those risks about risk to individuals, risk to national security, risk to individual businesses, risk to individuals within those businesses.

So whether that's directors or other senior leaders, and about how we ensure that what doesn't happen within our country is that large tech companies, major data centres and other big private sector businesses take the economic benefits and that we we need those businesses. They're absolutely crucial to us, but that they take the economic benefits of operating in our advanced economy whilst the government and therefore the taxpayer, carries all of the risk and the burden of the regulation. And it's great to see that this bill contains provisions allowing for financial recovery in terms of that enforcement action that we want to take.

And it's also fantastic that the enforcement provisions and the finances associated with that. We're looking at up to 4% of global turnover in terms of potential fines for not complying. So in terms of, you know, my position as a former lawyer is always that I want to know that things are enforceable. And I think there are good enforcement mechanisms here and there's plenty of money, you know, that could could potentially be at risk. That incentivises the kind of compliance that we would want to see.

But as I said, I think we need to look at that kind of broader societal piece about how we balance the risks and opportunities in relation to tech in general. Now, I was going to talk quite a bit about my concerns about my local public services and how they can better manage cyber security and the legal aid agency Cyber Attack managed to enable criminals to steal the details of anyone who'd applied for legal aid between 2007 and 2025. I mean, the scale of the financial risks to those individuals can't be overstated.

The amount of personal data that involved was absolutely huge. Six out of ten secondary schools are now subject to cyber attacks. We have the Cheshire Cyber Security Programme, which is in place to help local small businesses to manage their cyber risk and provides training for up to five members of of staff and small businesses. So, so our local police powers are being used to try and take proactive steps to improve the situation for our local small businesses. Schools in academy trusts are spending really quite a lot of money on cyber insurance to try and protect these risks.

And we've seen schools across the country shut down by their inability to open following cyber attacks. So the public sector action plan that the government's published this morning is incredibly welcome in terms of cyber risk. And I really look forward to the opportunity to go through it in more detail. But we again need to look at where the balance is of cost within our society. I would like to add to those who have suggested that we should be reviewing the Computer Misuse Act 1990, in terms of how the lack of current protections for researchers doing important work in this area.

We obviously have several institutions that are currently engaged in cyber security work. The Alan Turing Institute and Cyber Security Centre. We need to make sure that those have the right remit. And because actually this is an area that is only going to expand with the complexities of AI adding in here and ensure that we are making sure that everyone is protected to do their job effectively in protecting individuals, businesses and our wider society. So lastly, I would just like us to say that we need to move as quickly as we can on this, and it's great that we are maintaining our EU alignment, because realistically, the only way that we can continue to be a major player and to have considerable influence over companies, many of which have now got much larger budgets than major economies, is if we work in conjunction with other countries.

And I think that that's what our relationship with the ongoing relationship with the EU should really be about. So thank you to everyone who's been involved in the work on this bill. I think it is absolutely excellent and it's completely the right direction of travel. I think it is a shame that this doesn't get more, more publicity. The fact that the government is doing the right thing every day, even when it frankly is not likely to grab very many headlines. It's about doing the work, getting the right structures in place, moving forward productively, cross-party, where humanly possible, securing our nation and ensuring that our economy is on a strong footing.

And there's everything to be said in favour of that. Thank you.

**** Possible New Speaker ****

David Chadwick. Thank you, Madam Deputy Speaker. Cyber attacks are a growing menace for British businesses. Cyber for British businesses. Cyber attacks cause chaos for all types of businesses and organisations, both small and large, and the both small and large, and the consequences of those attacks have hit our economy hard. The disruption caused by cyber attacks on Jaguar Land Rover, M&S and the co-op were felt by many businesses co-op were felt by many businesses further down their supply chains.

For instance, the disruption that hit JLR resulted in a freeze for their steel supply chain, much of it in Wales. So much of our economy relies on well-functioning digital platforms and functions. Last year, many Lloyds Bank customers found themselves unable to access money or pay their bills due to app outages. That was a problem that was compounded by their decision to close high street branches. Yet, bizarrely, Lloyds still decided to pay its CEO, Charlie Nunn, £5 million in 2024. I make this point just to illustrate the lack of accountability that we're seeing at the positions at the top of these organisations, despite the massive numbers of people who are reliant on those services, a successful cyber attack often ends, of course, in people having their personal data stolen.

And that's why it's welcome that this bill highlights sensible requirements to ensure businesses properly consider supply chain risks and their usage of managed service providers, as well as many others. On the other hand, it will be a mystery to many why more sectors have not been included, such as finance, food and drink and retail, particularly considering as those sectors have been hit hard recently, the government would clearly like to achieve security, and to do that, it would help if the bill could be improved to provide greater certainty and clarity for businesses.

For instance, how are businesses supposed to manage relationships with managed service providers? For five years I worked in the cyber security industry, starting with the introduction of the GDPR, which of course happened at the same time as the original NIS Directive. And I found that the cyber security sector is a well connected community, one underpinned by a very welcome commitment to sharing knowledge and best practice. For instance, Cyber Wales is a representative body that brings together the Welsh cyber community.

It's an industry that requires input from academia, law enforcement agencies, defence and
15:11
David Chadwick Portrait David Chadwick MP (Brecon, Radnor and Cwm Tawe, Liberal Democrat)
-
-
businesses. There are clusters of success across Wales, including in my constituency. Partnerships built my constituency. Partnerships built in academia often create spin off companies that generate jobs. For instance, in Wales, the University of South Wales and Swansea University have done a lot to build up our local cyber security ecosystem and as this bill progresses, the government would be wise to continue to consult regularly with the this very regularly with the this very engaged community and it would be helpful to hear what sort of consultations have taken place so far, and how many.

It would also be helpful to hear the government respond to ISACA ISACA proposals, particularly regarding giving regulators the power to suggest mandatory penetration testing. The growing cyber security sector should be a route for much needed economic growth and well-paid jobs in Wales. Many of these jobs can be done remotely from anywhere with an internet connection. Recent research from Infosecurity suggests that there are 17,000 vacancies in the cyber security industry right now, a figure growing at a rate of 10 to 12% a year.

That's a huge opportunity for a country like Wales. Having an effective skills base is one way that we can guard ourselves against cyber attacks. Keeping Britain safe from cyber attacks requires a trained workforce who can marry technical expertise with regulatory competence. I've seen in my professional experience how many people from many other sectors were able to retrain and upskill to work in cyber security? People with experience in project management or managing processes are very capable of retraining to work in the cyber security industry.

Special thoughts should be paid to military veterans in particular, who are very well suited to those jobs. And one of the questions for government here should be how to help more British people into these jobs, whilst also ensuring that our education system is equipped to help children pick this sector. And that's why I'm calling on the government to ensure funding is available for all schools in Wales to take part in the highly successful Cyber First

**** Possible New Speaker ****

Wales scheme. Mike Reader. Thank you, Madam Deputy Speaker.

**** Possible New Speaker ****

Thank you, Madam Deputy Speaker. Madam speaker, I'd like to start with a story and this is a real story, but I've changed the names story, but I've changed the names for obvious reasons. So it was a Tuesday afternoon. I had a call from our CEO, David, and David said from our CEO, David, and David said to me, Mike, I'm jumping on a plane, but I need you to speak to a law firm I've been working with. This firm I've been working with.

This lady called Sandra is going to ring you from a law firm. I want you to speak to her. She's going to talk to you about a project that we've been working on. Sorry I've not been able to read you in until now. And Sandra then rings me on WhatsApp. I think this is a bit strange. You know, David's a very busy man, but why would he ring me jumping on a plane? Sandra rings me. Seems pretty legit. We have a chat. Turns out we we may know someone in common.

I look her up on LinkedIn. Her firm is legit. She's there. She's got similar connections to mine. She tells me I need to sign an NDA so we can talk to you about this opportunity that we're working
15:14
Mike Reader Portrait Mike Reader MP (Northampton South, Labour)
-
-
on with David. And I said, fine. So I signed the NDA and they sent me a team, and I joined the call. And on team, and I joined the call. And on the call was Sandra and some of her colleagues. And also on the call was was David, my chief exec. Now was was David, my chief exec. Now his signal wasn't very good. And he said, Mike, I'm on a plane. But I've tried to join just to say, you know, thanks so much for being a part of this.

We're looking at an acquisition in your business area. I want you to work with Ana Legal I want you to work with Ana Legal Partners to make sure that they've got the information they need. This is a real opportunity for us to grow. You know, we've been looking to grow the business. And then a signal dropped off, and I carried on the conversation with Sandra and her partners. And then they start asking questions about information that maybe they didn't need operational matters about how the business worked.

And then they followed up with another call, started asking about financial information about some of our clients, and then they follow up another call and ask about financial information about the business. And at that point, I thought I'd better ring David and just make sure this is legit. And when I rang David, he had no idea this was going on. Our business was being attacked through a deep fake intrusion where they mirrored our chief exec, used his voice for a call, uses image for a team's call, and had had I.

The story is actually a friend of mine. Had I not called my boss to say, is this legit? They could have got away with goodness knows what. And that seemed quite far fetched. But at the same time, another big British firm, Arup, got done by a very, very similar deep fake scam. But they lost £25 million to scammers. So the reason I started that, that story, and it is a real legitimate story that happened to one of my colleagues is because this bill is really important, and it is a framework bill that will set out how we put in force better standards, procedures, controls.

But actually the key thing where many businesses fall down with their data centre providers, MSPs or many of those already covered by legislation is the human in the loop. And we've heard already the very first intervention from my colleague, the hon. Member from Harlow, about how to get culture right and how to get people considered in the future legislation, the future guidance that will come on the back of this bill. And I just wanted to open up and make that point on the record that we can do all we can in terms of the technical processes, the procedures that come out the back of this bill.

But actually what is really important is we focus on the human in the loop, the human aspect, because quite often that is where these major attacks start. So I'm really pleased to support the the bill. Cybersecurity and cyber crime impacts our daily lives. I won't repeat the stats that we've heard from many of my colleagues in the House on both sides. It impacts on the businesses that support our economy. It impacts on our public services, our banking sector, all those things that we use every day.

And it's right that after a considerable amount of delay after 2022, work from the previous government, and this now comes forward and I'm very pleased, it seems, to have cross-party support. The Bill recognises that attacks come from a wider, a wider range of methods, including data centres, outsourced IT providers and complex supply chains working in the sector. I think that's really, really critical for my constituents in Northampton, Northamptonshire, on the data superhighway coming out of London, moving north, we've seen over £1 billion announced in terms of investments of new data centres, both from the public sector and private, in the last six months.

And I think the the Minister and his department, for all their hard work in securing that investment, that will create new jobs in my constituency, but without improved regulation and clarity, which is what this bill delivers. You know, that investment still remains slightly uncertain. And this bill definitely improves clarity and certainty for the sector as well as, of course, with all the many businesses that already work in my constituency that may either rely on a managed service provider for their IT or those who provide data centres, and particularly important for all the MPs in the House, because the control centre looks after your security is in my constituency, so you'd want to think that the data security is particularly important for our personal well-being as well.

And I looked at this as well from a perspective of the businesses in my constituency on how many of them use managed service providers for their IT and actually large businesses do. In my previous business, we had MSP that provided our help desk that provided many of the services when I had a problem ordering. You know, we're talking a business of 7 or 8000 people, so expanding it there to include managed service providers, I think is absolutely critical to give us better protection, improving standards and resilience, and therefore reducing burdens on the businesses that use them, particularly their cyber insurance costs.

The two asks. I make for government at that point, though, is we do it proportionately. I think some other members have made that point. The impact on small businesses have changed in this area may be considerable in terms of both their costs from those MSPs, but also the direct costs to them, and also that we do really work hard to make sure we consider how this legislation works with international law, where particularly those MSPs, help desk, etc. use overseas workforces. And I personally experience I really welcome the stronger reporting requirements.

I think actually recognise the point made by a member who talked about his bill he brought forward on regulation and reporting. But from a business perspective, as long as there is clarity, and I think this bill sets out that there will be better clarity for business. We get honesty and trust, and we get a business environment that people understand what they have to do when they have to do it, and this bill moves it forward. I also really welcome that in the bill. There's much stronger enforcement powers, and I think it sends a real message to criminals that that, you know, there are there are significant risks to them, but also to businesses, I would say money talks.

And when there are stronger enforcement risks to your business, all of a sudden cyber security will end up higher up your corporate risk register than perhaps it was before. So I think as this bill is implemented, I'd ask that we do see genuine consultation with industry. What's particularly important here

**** Possible New Speaker ****

now is that this is very much yes, of course I have to give way. He's making a very interesting

**** Possible New Speaker ****

He's making a very interesting and pertinent speech, I think, to the to the bill. One of the issues that I hope he would welcome in the that I hope he would welcome in the bill that is strengthened is the requirement for companies not only to look at prevention, but to have an adequate recovery plan in place. And I wonder whether he thinks that in the bill, there's enough kind of adequate sanction contained for those companies which don't are deemed not to have an adequate recovery bill, because I think my reading at the moment is that regulators can't necessarily find for a negligent recovery.

But as you said, the human factor so often matters. But that matters much in recovery as it does in prevention. Surely.

**** Possible New Speaker ****

I think the bill goes some way. And I think it's very clear that the the future legislation, the guidance that comes around this guidance that comes around this will start to frame that. There are other ways, of course, that we can drive businesses to improve their drive businesses to improve their business resilience planning. And, you know, it's part of the standard procurement process of government to require business continuity planning to be demonstrated to government. And many large businesses in all our constituencies will be trying to constituencies will be trying to transact with government, with its local government, national government and NHS, etc.

So there's other ways within the way that government, the state, impacts with business, that business resilience is also required. And I think procurement particularly and particularly as my background is one of those, those key areas. So I was just saying to the Minister, you know, as I kind of sum up, I guess, you know, the one concern I have is that we this is a framework, bill. There's lots of future guidance and things that will come, and we need to see continued consultation. And I think that message has already been made by others as well, that the standards are really clear.

One of the reasons this is coming forward is because the legislation was getting quite messy, and we want to make it a lot clearer, and we're really clear with business of how we engage, and also that we give early notice to organisations so they can adjust that this isn't sprung on business as we push to address what is a real threat that's been recognised right across industry. And of course, I'll come back to my original point that we consider the human in the loop when we set guidance, when we set requirements, that we are looking at how businesses think about the human aspect, as well as just the technocratic solutions that would be in a business continuity plan or similar.

So this is a very necessary bill. I think it I support its aims and focus, and I think it signals real confidence to the market, those already operating in it and those now who are coming to invest in great places like Northampton to build the future data centres and other

**** Possible New Speaker ****

infrastructure we need. Thank you Alison Griffiths. Thank you. Madam Deputy Speaker.

**** Possible New Speaker ****

I refer the. House to my register of interests and before I start, I'd just like to commend my start, I'd just like to commend my right honourable and hon. Friends, the members for Hertsmere and the members for Hertsmere and Exmouth and Exeter East, for their excellent speeches, and particularly to associate myself particularly to associate myself with their comments on the Computer Misuse Act of 1990 and the need for an extension to our cyber skills in this country. Before entering this place, I worked professionally in cybersecurity and operational resilience, advising businesses of all sizes on how to reduce the risk of cyber attacks and helping them understand how far reaching the consequences of a cyber breach can be from a commercial perspective, not just a technical one.

As vice chair of the Business and Trade Select Committee, we've heard direct evidence for our report on economic security from Marks and Spencer Co-op and Jaguar Land Rover, all of whom suffered catastrophic breaches last year. And whilst the attacks were different in form and impact, as my hon. Friend, the Shadow Secretary of State has said, they shared a common feature. They were driven by social engineering, not technical failure. Human access was exploited, trust was abused and controls failed.

Further up the chain. The outcomes, however, were very different at co-op, a more modern, secure by design IT infrastructure enabled an early containment strategy limiting the impact on customers, stores and the bottom line. Marks and Spencer, which hadn't prioritised early replacement of legacy infrastructure, suffered months of major disruption to customer facing services and retail logistics. The financial impact alone for M&S is in the region of £300 million, or 45% of their prior year pre-tax profits.

Jaguar Land Rover was in a different category altogether. There, the attack cut into operational technology systems tightly integrated with manufacturing operations, bringing production lines to a standstill and disrupting just in time supply chains that shut down cascaded far beyond a single company, directly impacting numerous suppliers in the Midlands regional economy. As many members have already mentioned, as well as contributing to a measurable fall in UK GDP, estimated to be in the region of £2 billion, these cases demonstrate that cyber risk manifests in three ways operational risk, financial risk and reputational risk.

Too often, even at Footsie level, businesses and boards fail to grasp that this is a potentially devastating combination. I hear the same message repeatedly from industry, including at the Financial Times Cyber Resilience Summit in London, where I spoke at the end of last year. There is frustration from CISOs, chief information security officers and security vendors that it can be difficult to develop conversations with boards and audit chairs to assign the appropriate resources and strategic prioritisation. Businesses accept that standards must rise, but what they want is regulation that is targeted, proportionate and focussed on prevention rather than paperwork.

This bill does some things well, updating the 2018 NIST framework, expanding coverage where it is genuinely needed, and strengthening enforcement powers are all sensible in principle. Faster incident reporting has value, but reporting alone is not resilience. There are gaps that matter. First, the bill does not go far enough on governance. Cyber failures are governance failures. Responsibility sits not only at board level, but clearly and specifically with chairs and audit and risk committees.

Yet the bill stops short of driving meaningful accountability there. Without that pressure, cyber will continue to be delegated downward to IT and operations teams rather than owned at the top. Second, there is a risk of confusing activity with preparedness, increasing reporting obligations after an incident does nothing to stop the incident
15:28
Alison Griffiths Portrait Alison Griffiths MP (Bognor Regis and Littlehampton, Conservative)
-
-
occurring. Prevention is always better than cure, and this legislation needs a stronger legislation needs a stronger emphasis on baseline capability, risk, maturity, and early risk, maturity, and early intervention. Thirdly, we must be careful about cost, capacity and careful about cost, capacity and particularly enforcement. The implications for SMEs are significant, particularly those significant, particularly those pulled into scope through supply chains. At the same time, regulators cannot enforce what they are not resourced to oversee. Without credible enforcement, this bill risks becoming a paper exercise and boards will respond accordingly.

Fourthly, the bill needs to recognise both the connection and to draw a clear distinction between IT and operational technology. What works for enterprise IT systems may be inappropriate or even dangerous in OT environments such as manufacturing, critical national infrastructure, energy or logistics segregation, architecture and configuration of security devices must be assessed. Risk profiles differ, controls differ, and that nuance matters. I want to be clear. We on this side of the House support the aims of this bill.

In principle, cyber resilience requires a whole of society approach involving government, regulators, businesses and boards working together. But if this legislation is to drive real change, it must be enforceable, proportionate and grounded in how operations organisations actually operate. Board and audit committees must feel the weight of responsibility. Regulators must have the tools and resources to act, and prevention must be prioritised over post-incident form filling. The National Cyber Security Centre has produced clear practical guidance for boards, and that should sit at the heart of our approach.

We need smarter regulation, properly enforced, not just more of it. Amanda Martin.

**** Possible New Speaker ****

Thank you, Madam Deputy Speaker, I want to start by saying Happy New Year to you and to the staff and to Year to you and to the staff and to all in this house and to the residents of Portsmouth. I want to thank the Minister for his introduction to the Bill and introduction to the Bill and highlighting some of the major concerns of cyber insecurity has caused this country and continues caused this country and continues to cause Madam Deputy Speaker. I welcome the Cyber Security and Resilience Network and Information Systems bill because it reflects a clear change of direction under a Labour government, moving from a fragmented and often reactive approach to cyber security, one that is strategic, cross-government, resilient and focus on national capability and everyday solutions.

We've heard it said many times in
15:31
Amanda Martin Portrait Amanda Martin MP (Portsmouth North, Labour)
-
-
this House that the first duty of any government is to protect its citizens, and in the modern world, citizens, and in the modern world, that duty must extend to the digital systems. We all rely on. Cyber attacks now pose a daily Cyber attacks now pose a daily threat, not just to government systems, but to the livelihoods and security of people in Portsmouth, where major employers, manufacturers, ports and supply chains are attacked and the consequences are immediate and personal, production can stop overnight.

Wages can be put at risk and sensitive personal data can be exposed. Constituents in my city who work for supply or depend on companies such as Jaguar Land Rover have seen this reality firsthand. Madam Deputy Speaker, when large engineering, retail and manufacturing firms are targeted, the impact ripples far beyond their head offices, reaching workers on the shop floor, contractors, small local suppliers and customers whose orders are delayed or indeed cancelled. For a city like Portsmouth built on defence, maritime work, engineering skills and complex supply chains, cyber resilience is not an abstract policy or a technical exercise.

It is about protecting jobs, safeguarding family incomes, maintaining confidence in the system that keep our city working, and ensuring the security of the public services people depend on every day, and ensuring that our city's residents are kept safe. Madam Deputy Speaker, like other members in the House today, Portsmouth City Council has been a target in late 2020 for the city council's website was hit by a cyber attack called DDoS, a distributed distributed denial of service attack by a pro Russian hacking group.

The attack made it very difficult for residents to access council services online, and for a period of time it was for a period of time. Unfortunately. Unfortunately, no personal or council services were compromised, but the attack did demonstrate that even local public infrastructure in places like Portsmouth is a real target for cyber actors, and not just an abstract risk. Local crime statistics show cyber crime is also a lived experience for Portsmouth residents. Around 60% of our residents reported experienced crime in a 12 month period, including phishing attempts, online fraud and accounts being hacked.

And as my friend from Harlow noted, not all of these crimes are reported as people are embarrassed, feel alone, feel foolish. And that, Madam Deputy Speaker, is how these crimes continue to proliferate through our society. Local police crime figures also show significant levels of harassment, malicious communications and other online offences are often instigated through cyber attacks. These are not just techy problems, they translate into financial losses, practical inconveniences and, most alarmingly, psychological harms. And in some cases, people attempting to take their own lives because of the damage that's been caused.

So, Madam Deputy Speaker, yes, there is an economic cost to cyber crime, but there is also a human cost, and that is why this bill matters. It modernises the UK cyber security framework by strengthening baseline requirements, improving incident reporting and extending protections to a wider range of essential services and supply chains. And its three pillars are welcome. It recognises that weaknesses in one organisation can rapidly cascade across the entire economy, whether through cyber criminals or foreign hostile foreign actors. It recognises that cyber crime is real and its effects are devastating.

And this is not just about big, big business cyber attacks have we heard today disrupt NHS appointments, threaten energy and water supplies and prevent people living their daily lives. Last year alone, 11,000 NHS appointments were lost due to cyber attacks and since 2024, at least five direct cyber attacks have been targeted on UK water supplies, Southern water being one. And in 2025 reported that 62% of our UK energy organisations experienced cyber attacks. Crucial Labour. Crucially, Labour recognises that cyber security is not only a technical issue, but a workforce and an economic one.

Clearer standards and stronger oversight give businesses the confidence to invest, raise resilience across the economy and ensure organisations are not left to face increasingly sophisticated threats alone. The bill also rightly ensures breaches are reported swiftly within 24 hours, because pace and speed are vital if we are to minimise the domino effect of cyber crime. The bill also rightly gives regulators the flexibility and powers they need to act as new threats emerge. This is the. This is with the assurance of the assurance of resources and transparency as to a more consistent strategy and evidence, wider clarity.

This is particularly important for Portsmouth. Our city is home to the Royal Navy, with one of the one of Europe's most significant naval bases, alongside a major, major commercial port. Advanced engineering and manufacturing activity, and a university that recognises expertise in cybercrime and digital security. Madam Deputy Speaker, we as a city, when we were blitzed in the Second World War, we could see it and we could act on it. Cyber crime needs to be brought to the light in the same way, so that we can all act on the attacks that are happening, so that we can create a different culture where people don't hide behind and aren't embarrassed to tell what has happened to them, their businesses or their community.

Madam Deputy Speaker, I know that Portsmouth already plays a vital role in our national security and industrial base. It's not just a target but a part of the solution. I'm proud that the University of Portsmouth is recognised as a centre of cyber expertise, with the leading research and collaboration on cybercrime, digital security and economic crime. Its centre, Madam Deputy Speaker for Cyber Crime and Economic Crime, brings together multidisciplinary experts studying cyber crime courses, prevention and resilience, and works with community groups, schools and local businesses to raise awareness and protect people from cyber crime.

The university also conducts advanced research into cyber security systems and threat detection through computing and behavioural science, helping develop real world, real world solutions that improve organisation and national resilience. These efforts not only support local House of Lords employees, but also grow the skilled cyber workforce that the UK needs, linking directly to the economic and security objectives of this bill. Madam Deputy Speaker, the bill lays the foundations for a more secure and more resilient Britain and I am pleased to support its Second Reading.

And in doing so, I seek reassurances and clarity from the Minister on four key points. Firstly, how the whole of government will work together to ensure that Portsmouth, with its defence, maritime and manufacturing base, alongside thousands of small businesses, local services and public sector are supported to benefit fully from this bill. Two how will government will work with and reach all employers to strengthen knowledge and skills to strengthen both cyber security and long term economic resilience and accountability and their responsibility? And three how will the bill be limited? How will the bill be linked to investment in cyber skills and training? So we are not left without the people needed to make the changing world an easier place to live.

And finally, Madam Deputy Speaker, how can we ensure that this is just the start of the conversation? And how can we use this bill to help change the culture around cyber attacks so individuals and organisations can, yes, take responsibility and ownership, but in an environment that is supported rather than laying the blame, for instance, and how across the House, as we as MPs can we encourage openness amongst our constituents, small businesses and large employers and the public sector alike, so that together we can carry out the government's first duty, which is to protect its citizens in a modern, ever changing world.

Thank you.
15:39
Ben Lake Portrait Ben Lake MP (Ceredigion Preseli, Plaid Cymru)
-
-
Like Madam Speaker, it's a >> Like Madam Speaker, it's a pleasure to speak in the Second Reading of this bill, and I'm very pleased to to say that I support the government's introduction of the Cyber Security and Resilience Bill and welcome it, for it is a very important first step in strengthening the protections of UK's critical national infrastructure. And for it because it also addresses many of the gaps that have been identified in numerous implementation reviews in recent years.

And as other hon. Members and right hon. Members have already made the point this afternoon, Madam Deputy Speaker the risk and the the harm inflicted by cyber attacks are significant and very real. Others have already cited the impact that it has on a whole host of businesses and industrial sectors, and also society. We've heard of the impact of the harm that is inflicted on NHS services, for example, and also many members have referenced the attacks on JLR, the co-op and and indeed on Marks and Spencers, the impact that they had not only on those businesses but also the wider supply chains and local economies.

Significant. And I think the Minister indeed referenced in opening the debate that it is estimated that some £114.7 billion worth is lost to the UK economy annually due to cyber attacks, and that's equivalent of 0.5% of GDP. And so it is right that the government acts to try to address these risks and these harms. And in doing so, they comply with one of the causes of the Strategic Defence Review, which stated that the world has changed, and enlisting the other sort of more conventional threats that the country faces also specifies the daily cyber attacks at home, something that we need to take very seriously.

And so I think the government is right to to bring forward this bill. And as other members have made very clear, the the nature of cyber crime, cyber attacks and the threat that they pose are ever evolving. And so I do have a great deal of sympathy with the government in that they are endeavouring to try to keep up with what is a very quickly and rapidly developing industry and nature of threat. And although I support the Bill and look forward to working with Ministers as the as the legislation passes through the House, I would like to to raise just two points on which I'd welcome clarity or indeed further consideration of the Minister's.

A few members have mentioned the importance of looking at our cyber resilience in a more holistic manner, and that whilst technical security and safety is very important, and I think the bill goes a long way to address those matters, it could perhaps be strengthened in terms of looking at our digital sovereignty, if you, like other members, have have made the very important point that we do need to consider supplier concentration in this field and the domestic capability, because if we fail to do so, we do risk long term dependency.

Now, there are few examples that I could draw upon. Perhaps the one that I will is that of when Microsoft decided to suspend the use of some of its services to Justice and International Criminal Court. Now, I'm not saying that Microsoft are going to threaten the UK government or any of our services, but it does illustrate the risk that if we are overdependent or if our aspects of our economy or businesses are overly dependent on certain suppliers, then we are vulnerable.

And then I think it is right that the government has a way of looking to try to prepare contingency plans for that, or at the very least, consider the potential impact of overdependence on certain suppliers. And in that regard, I wonder whether actually part three of the bill in which the legislation stipulates that a statement of strategic priorities will be will be made by Ministers, whether this is a consideration that could be included as part of that statement. And we could then bring about a way in which the statement not only looks at the technical security as part of cyber resilience approach, but also this digital sovereignty and domestic capability.

And I do think in that regard, it's not too dissimilar to some of the efforts we're starting to see from European partners. I think France and Germany are starting to look to undertake similar strategies and reviews of their own domestic capability and and potential over reliance on certain suppliers. The second and final point I raise, and perhaps this is more for clarity. Looking for clarity from the Minister, perhaps when when they're summing up relates to part four of the bill and the directions to certain bodies and persons for national security purposes, I do feel as though, if we accept that, that the nature of the cyber threat and the risk to cyber security are ever evolving, it will be impossible for anyone legislation to to hope to encompass all possible dangers that we may face.

And so in order to try and future proof the bill, especially in terms of national emergencies or crises, I wonder whether Ministers should consider even further powers in terms of the last resort powers, particularly to perhaps direct or enable them to direct the shutdown of any domestic data centres or AI systems in the event of a security or operational emergency. I ask this because I'm not entirely clear whether the powers listed in the bill already allow them to do that or not, but if not, I'd ask whether they'd be willing to consider such powers just so that the government is able in the future.

In the event of of a such a national crisis or emergency, to intervene appropriately if those emergencies are caused by AI centres and AI systems out of particular data centres that could have or could cause large scale harm to the public, especially under those very rare and hopefully unlikely scenario in which the designated people and persons that are otherwise responsible for those systems refuse to cooperate with the government. But in raising those two points, Madam Deputy Speaker, I also want to underline my support for the government's efforts in this regard and very

**** Possible New Speaker ****

much welcome the Bill and the Second Reading today. Darlington.

**** Possible New Speaker ****

Darlington. Thank you, Madam Deputy Speaker, and Happy New Year to you. I welcome the Bill and the Cyber welcome the Bill and the Cyber Action Plan for public services that's been published today. We know, and we've heard from the many know, and we've heard from the many great speeches that we've heard from honourable and right hon. Members today in this House about Members today in this House about how important this is to the UK economy and to the UK public.

Despite despite being one of the smaller economies in the world, we are still one of the most cyber attack countries in the world. And last 12 months we've seen some good news. With only 4 in 10 businesses and 3 in 10 charities having cyber security breaches, which is down from the previous year. Yet we are seeing a huge increase in those that are nationally significant cyber incidents, which are more than double than last year, and this includes the malicious cyber attacks of critical infrastructure by Russia and China.

This is really
15:46
15:46
15:46
Emily Darlington Portrait Emily Darlington MP (Milton Keynes Central, Labour)
-
-
development of AI and tech services, including legal services, financial services and of course, autonomous services and of course, autonomous vehicles. But all of this good and they are companies that have they are companies that have experienced cyber attacks. So this is a very, very welcome bill. The difficulty we have is that it's missing a huge portion in the discussion, and it was also somewhat neglected in the minister's comments and the strategy set out. And I'm hoping that it will be addressed in the comments at the end.

Summing up today's debate, it is the role of sovereign technology in order to fight cyber crime. And what does sovereignty actually mean? Because it's quite clear that there are many definitions about what sovereign technology actually means, what it means to myself and to most of the public and the industry is that it is UK innovation and UK technology. It's been developed in the UK and it's UK owned intellectual property. It is a company paying UK taxes and most importantly it is a UK company accountable to the UK.

Now the government's talked a lot about its commitment to developing and securing sovereign AI, but this needs to be extended to all critical technology and infrastructure. This is not just something that is is important in terms of cyber security. It also has its other advantages. It's good for the economy. It creates innovation. It sets the highest standards and thereby gets public support and confidence and achieves small business support in terms of absorbing innovation. It achieves growth not only by creating UK customers, but ambitiously creating worldwide customers.

And the government has in the past done this quite well. It has created safe and secure solutions. The Crown Hosting Data Centres is a really good example of a joint venture between government and our data centres, but unfortunately it's only providing 3 to 4% of government of government servers actually use Crown hosting. And you've got to ask why. So I asked the Minister, what are we doing to promote these UK safe and secure that would help us fight cyber security and ensure that's promoted across the public sector.

But these solutions also gain support within the private sector. Instead of using these Crown hosting data centres, many are using ones run by foreign firms with securities and standards developed outside of the UK. Outages at AWS and cloud hosting has cost business millions. And if we also look at other areas where the public rightly, rightly worries about cyber security attacks, NHS data we've heard about the impact of cyber crimes against the NHS and the impact that it's had on lives, but it also impacts public confidence.

Palantir has had a 330 million contract for all NHS data, bringing it together, which is a fantastic initiative and really important, and the public support that because they don't want to repeat their health story to each and every doctor or nurse to each and every doctor or nurse or other health professional meet. T foreign firm with some questionable alliances has led to the public trust being eroded. It's also led to the public trust and to the trust being eroded by doctors, slowing the take up of this important innovation in NHS services.

This is partly because the co-founder of Palantir called our pride in the NHS Stockholm Syndrome. Now, unfortunately, he misunderstands the very service in which he is trying to sell our services and thereby eroding public trust. Now, I know many UK firms that could have done just as good of a job and probably better because the public trust, the doctor's trust would have increased. Now we hear that Palantir has just had a £240 million contract with the Mod for data analytics capability, supporting critical, strategic, strategic, tactical and operational decision making across classification.

That sorry, that is a direct quote. Again, hugely important that we are using the latest technology in this to promote our mod. Hugely important that we are tying all of that up. I don't think anybody in this House has concerns that the Mod is making these kinds of investments. It is the partners that we choose to partner with that drives the concern. And the reality is cyber security, as I've already argued, has to be UK focussed. We have to protect our national interest and we have to ensure that our partners have our national interests, our cyber security, first and foremost.

And the reality is organisations like Palantir, their views on the NHS, but also their integration, their integration into the US Immigration and Customs Enforcement Agency, otherwise known as Ice, leads us to worry that they do not share UK values. It creates a strategic vulnerability. That is what the sector is saying to us and we should listen to them, because cyber security isn't just about reporting, it's about the investments we are making ahead of time. So imagine if those two contracts were given to UK firms and the economic opportunities for those UK firms, including enhancing the UK based cyber security, having confidence in our most critical areas of health and the military.

I'd like to raise another area where there, I'm sure, if the Telegraph reporting today is correct, will have significant, significant concerns in public trust. They are reporting today that the government is considering using Starlink for the emergency services network, replacing the existing radio setup. This is the system used by ambulance, police and fire in an emergency. Our most critical infrastructure, a company that's controlled by a man who has shown his willingness to turn off satellites at his own political

**** Possible New Speaker ****

whim in Ukraine. Yes. She's making a really, really important point about Elon Musk's Starlink system. But will she go a little bit further and recognise little bit further and recognise that not only has Elon Musk switched off Starlink in Ukraine his own will, but he's done so at on occasions that may have turned the tide of the war.

**** Possible New Speaker ****

the tide of the war. Mid Ulster I thank the hon. Member for raising that point. He did turn it off at very strategic points for the Ukraine military when they were advancing on Russian held territory, and I think that's important to put. On note, it wasn't just that he chose to turn it off. He chose to turn it off at a critical time for the Ukrainian military. So I worry that somebody who chooses to do that, somebody who encourages the UK public to violence at a far right rally where he said, whether you choose violence or not, violence is coming to you.

You either fight back or you die is not appropriate or a safe partner for our emergency services. I also want to say I absolutely support the comments from the member. The honourable the right hon. Member from Oxford East on transparency and some of the actions being taken by those who have been willing to stand up to these companies and demand transparency. And I think, while probably not the subject of today's debate, I do think is a really, really important action that we must take as a warning for future action that can come.

So I welcome this bill and I welcome the action plan. But to truly make the UK safe and secure from state sponsored or criminal cyber attacks, we need to ensure that as a UK sovereign infrastructure, a UK sovereign capacity and capability, and the government can lead the way in this in its own procurement practices by making sure that we are partnering with UK sovereign firms. This is good for security, good to protect us against cyber attacks.

It's also good for the economy and good for

**** Possible New Speaker ****

public trust. Thank you Andrew Cooper. Thank you, Madam Deputy Speaker, and what a privilege to follow my and what a privilege to follow my hon. Friend, the Member for Milton Keynes Central, who made a fantastic speech just then, and I fantastic speech just then, and I don't think mine will follow quite with the same quality, but I'll do my best. Having spent my career as my best. Having spent my career as a software developer prior to entering this place, it's perhaps not so much a pleasure, but maybe a
15:57
Andrew Cooper Portrait Andrew Cooper MP (Mid Cheshire, Labour)
-
-
not so much a pleasure, but maybe a blast of nostalgia to be speaking on this bill today. This bill provides for an important and long overdue update to the NIS regulations, and provides the means to keep them up to date more quickly as new threats emerge. This was a massive gap in our capability left behind through the rather haphazard and cavalier manner of our departure from the EU. And it's absolutely right that we resolve this as soon as we can. It's a cliche, isn't it, to say that the nature of threats that we face has changed, whether it's state sponsored cyber attacks, hacktivism, identity theft or ransomware attacks, these threats can have a widespread and significant impact on people's lives, on the wider economy and on our safety and security.

And as many members from across the House have noted today, the cyber attack on Jaguar Land Rover that led to them posting a loss of £485 million last year and I think we heard earlier a 2 billion impact on the wider economy or the co-op infiltration, which cost them at least £206 million. But this is not a new issue, and there's virtually no area of the economy that has not experienced attempts to penetrate its systems and cause disruption, or to steal data.

On that point, I'd be happy to.

**** Possible New Speaker ****

I thank you very much for giving way, Madam Deputy Speaker. And he speaks of the cyber attacks on speaks of the cyber attacks on Jaguar Land Rover and the co-op. The council tax payers at The council tax payers at Gloucester City Council have concerns that following a Russian cyber attack in 2021, the council cyber attack in 2021, the council recently discovered a £17.5 million deficit. And I wonder if you'll

**** Possible New Speaker ****

recognise that too. Thank you, thank you. I thank him for his intervention. I confess I'm not an expert on the IT of Gloucestershire City Council, but I'm sure the front bench has heard and they may wish to respond in their summing up. Turning to the measures in this bill, I welcome the measures to bring managed service providers and data centre infrastructure into scope. And when I began my career working on hotel reservation systems and legacy on premise infrastructure was the standard operating practice.

Some organisations would develop their own line of business systems, some would buy in, but virtually all would be hosted on their own servers, with often clever names like Spartacus or Xena or Buffy the Vampire Slayer. As I worked with over the years for a whole pile of reasons, such as the need to support more public access, the requirement to facilitate more home working, huge increases in the speed of domestic and business broadband, the need to provide failover, redundancy and scaling, shifting away from big capital investment and towards a more infrastructure as a service, and wanting to benefit from more rapid rollout of features and applications that require significant server infrastructure behind them.

Like like we've seen more recently with AI, systems have been moving virtually wholesale to those that are managed remotely and sandboxed to multiple organisations, and towards virtual servers or services and data centres, rather than on premise tin. So bringing these two areas into scope is obvious, and it's long, long overdue. On this part of the bill, I'd like to offer a note of caution, and that is around the threshold at which the regulations apply. For MSPs managed service providers, we need to ensure that we're providing appropriate levels of cyber security without blocking new entrants to the market, and that applies to critical suppliers too, because the risk there is that we end up boosting the hegemony of the big Outsourcers and IT suppliers, rather than being able to support new entrants, domestic new entrants.

The risk of vendor lock in that we've heard several times today. And equally on data centres, the threshold appears, to me at least, to have been set so high that only larger data centres will be in scope. And I really hope that the Minister will keep both of these points under review as the bill progresses, and think about how we can strengthen this and strike the right balance. The the other area of the bill that I want to talk about was about the regulators.

Now, the Minister set out in his opening remarks why he believes a sectoral approach is appropriate and there is merit to this argument. Sectoral regulators have deep, long standing institutional knowledge, and they understand how the processes work in their sector. However, as I touched on earlier, the consequences of failure are enormous, with real world impacts to people's everyday lives. And we shouldn't expect, whilst we shouldn't expect an overarching cyber regulator to have the domain specific knowledge of the water sector or the air traffic control sector.

But nor should we expect every sectoral regulator to carry the expertise of how modern, scalable data centres that detect faults automatically and will automatically fail over to different regions or different jurisdictions work, and I think we just need to think about what the priority of an individual sectoral regulator will be, and it won't necessarily be cyber security. So we have to get this balance right. And I think we do need to listen to the sectoral expertise on this. In conclusion, Madam Deputy Speaker, this is an important and long overdue update to the UK's cyber security framework.

I look forward to working with the government to get the scope and scale of these regulations right, and to ensure that all the systems that we rely on every day are secure in the face of current and emerging threats.

**** Possible New Speaker ****

Thank you. Minister. Doctor Ben Spencer. Yeah.

**** Possible New Speaker ****

Thank you. Madam Deputy Speaker. So the cyber bill should be one of the cyber bill should be one of the most fundamentally important pieces of legislation the House will consider in this Parliament, consider in this Parliament, because the UK's cyber resilience is a cornerstone of the foremost is a cornerstone of the foremost duty of government, the protection of the people. My hon. Friend, the Shadow Secretary of State has already made clear that His Majesty's Official Opposition appreciates the urgent need to act to protect our society, our economy and our security in the face of growing and evolving cyber security risks.

But cyber Bill is the bill of missed opportunities. It would not have stopped the JLR or Marks and Spencer's cyber attacks. It is silent on the threats from hostile state actors, and it does not answer the fundamental question. If Niswan was not enforced, what
16:04
Ben Spencer Portrait Dr Ben Spencer MP (Runnymede and Weybridge, Conservative)
-
-
difference will further regulations make? Cyber security is key to our make? Cyber security is key to our national security. It's too important an issue to play partisan politics. As a responsible opposition, we will work with the government to get the approach to government to get the approach to this legislation correct. Now, many hon. Members have made very insightful contributions to today's debate. The right hon. Member for Hertsmere, who has great experience and raised the issue about hostile state actors and gave some practical advice to the Ministers, which I hope they reflect on.

The Member for Exmouth and Exeter East, who also talked about his professional experience and the need for proportionate regulations, and modifying the Computer Misuse Act, which was raised by several other members. The Member for Bromsgrove, who importantly pointed out the issue regarding physical technology and the risk of threats from cellular modules. The Member for Bognor Regis and Littlehampton, who spoke also about her experience, particularly the importance of government, to get make sure we actually have impact from this bill.

And I'd like to also mention the Member for cardigan, Preseli, who mentioned digital sovereignty, an important issue that I know we've discussed many times in this place, amongst many other colleagues across the House who took part in this debate. Member for Warwick and Leamington. The chair of the Select Committee for Newcastle on Tyne Central, Central and West. The Member for South East Cornwall for Oxford East Congleton, Northampton South, Portsmouth North, Milton Keynes Central and Mid Cheshire. Madam Deputy Speaker, the gravest and the most pernicious risks to UK cyber security go completely unaddressed by this bill.

Cyber is the emerging battlefield of state security, with hostile state actors ramping up their efforts to disrupt our society, our economy and our democracy at pace, time and time again in this Parliament, the government has baulked at acknowledging the elephant or in this case, the dragon in the room of matters of national security. Last year, the director of GCHQ, the UK's intelligence and also Cyber Security Agency, confirmed that the votes more resource to China than any other single mission.

The evidence is clear. The Chinese Communist Party is one of the greatest national security threats our country faces. In November last year, Mr. Speaker, took the exceptional step of circulating a briefing from MI5 warning of the widespread efforts of individuals and organisations working on behalf of the Chinese Ministry of State Security to target Parliament for intelligence gathering. In the intervening weeks, we have learned that the Home Office systems were accessed, apparently by Chinese state affiliated group. Reports have circulated that the attack is linked to the Chinese gang storm 1849, previously connected with cyber attacks on MPs and the Electoral Commission.

Further, in December 2025, the government confirmed that it sanctioned two Chinese companies for perpetrating what it described as indiscriminate cyber attacks on the UK public and private sector IT systems. These are not isolated incidents. They are evidence of a concerted and intensifying campaign on the part of the Chinese Communist Party and its affiliates to undermine vital public services and UK businesses. How our country and how our democratic allies and partners face the threat of hostile state actors working in concert is an epoch defining challenge.

It's a challenge we must meet or we will live to regret it. It's no coincidence that several recent cyber incidents have targeted organs of government with malicious actors, rightly perceiving that many of our government departments are the weakest links in the cybersecurity ecosystem. The National Audit Office 2025 report on government cyber resilience laid bare the inconsistent and, in some cases, glacial, progress of government in making effective improvements in cyber resilience. Last month's attack on the Home Office IT systems is a stark reminder of the urgency of improvement.

Government, cyber security, his Majesty's Official Opposition has received a clear message from cyber industry stakeholders that the government should be leading from the front and setting the standard for effective cyber resilience. Now, while I am pleased that the government has managed at the last moment to push out the Cyber Action Plan today and it acknowledges the challenge, but how it will ensure change is delivered is unclear. Now, finally, Madam Deputy Speaker, attacks on household names retailers such as Jaguar Land Rover, Marks and Spencers and Co-op have raised public awareness of the risks we are facing, with consumer supply chains interrupted and jobs put in peril.

But this bill would not have prevented those attacks had it been enforced at the time they took place. Given the constraints on public finances as a result of the Chancellor's reckless budget decisions, the government needs to ask itself how many cyber attacks of the magnitude of JLR can we afford to bankroll? The government must undertake an urgent review to identify companies whose failure as a result of a cyber attack would present a risk to the UK economy of a comparable scale to JLR.

Madam Deputy Speaker failing to address all these urgent problems would leave an open goal for malicious cyber actors to undermine the UK's security and prosperity. This House is unlikely to revisit cyber security legislation for some time. The threat to our economy and national security for malicious cyber actors is amongst the most serious we face as a country. In the parliamentary debate following MI5's China espionage briefing, the Minister for security pledged to strengthen the legislative tools available to disrupt the threat.

So why not use this opportunity now presented by this bill to address it head on? We stand ready to work with the government to stand up for and protect our country and prevent this bill becoming yet another missed opportunity.
16:11
Kanishka Narayan Portrait Kanishka Narayan MP, Parliamentary Under Secretary of State (Department for Science, Innovation and Technology) (Vale of Glamorgan, Labour)
-
-
EA Mr. Kanishka Narayan. Yes. >> Thank you, Madam Deputy Speaker, I would like to first and foremost, thank all members right across the House for their contributions throughout this session. I am glad throughout this session. I am glad to see that the House has welcomed this Bill with deep expertise, represented right across the House by members and right hon. Members. They have, of course, raised questions which I will seek to share the government approach on. But before that, Madam Deputy Speaker, let me set out what is at stake.

The UK is the most cyber attacked country in Europe in 2024, over 600,000 businesses were subject to a cyber attack. The average cost of a cyber attack is just under just over £190,000. The cost to UK businesses in aggregate of cyber attacks, was estimated at 14.7 billion every year. The personal experiences shared by the my hon. Friend from Northampton South in particular is on my mind, as well as the particular facts shared by the hon. Friend from Warwick and Leamington, talking about the most common password in this country being password, and indeed my hon.

Friend from Mid Cheshire talking about Buffy the Vampire Slayer as a very effective name, being deployed in some of these contexts as well. The combination of those aggregate impacts as well as those personal experiences. Madam Deputy Speaker, the motivation for this bill. National security is the first responsibility of any government. As cyber threats grow, and the failure of the opposition in government to have moved fast enough. In light of that growth, this government has acting robustly to make sure the British public is secure.

The big message is this let's ditch legacy systems and platforms and move to a more secure future. We've done it by ditching the Conservative Party. It's time we do it right across our economy. Let me turn, Madam Deputy Speaker, to some of the themes raised by members and right hon. Members, in particular, the question of looking to the future, and in particular, the threats from AI emerging in the future raised by both the Shadow Benchers, the right hon. Member from Hertsmere, as well as my hon.

Friend from Congleton. AI will almost certainly continue to make elements of cyber intrusion operations more effective and efficient, making cyber threats more frequent, more intense. That is why, fundamentally, it is important that organisations take step steps to bolster their cyber defences. And that is why, under these regulations, organisations must have regard to the state of the art when maintaining the security of their network and information systems. This applies not only to cyber defences but also to cyber threats, and I am conscious in particular that in response to my to the point raised by the right hon.

Member for Hertsmere, a genetic AI will be a particular risk for cyber, I think a very significant source of mitigation in that context has to be the quality of our capability, both in the private sector but particularly the public sector in that context. I pay tribute to the work of the AI Security Institute, right at the frontier in understanding the risks of AI as well. A number of members right across the House raised questions of scope. Let me start by clarifying it. There is, of course, a significant sense of risk right across different parts of our economy.

We have chosen to focus, as the NIS Regulations historically have, on essential services. The failure of whose network and information systems pose imminent threat of life to the British public. And it is for that reason that the scope of the bill is as tight as it is. That is not to say that all other businesses shouldn't be doing a great deal to protect themselves against cyber attacks. The government needs assurances that essential services, whose disruption would have the most profound consequences for public safety, national security and economic stability are the ones that are prioritised in their resilience to cyber attack.

Businesses outside the scope of this bill should make it, of course, a critical business priority to gain the same level of assurance without the need for as much government intervention. I'm very aware of the particular points by my hon. Friends from Lichfield for Warwick and Leamington, the chair of the Joint Committee on National Security Strategy, as well as my hon. Friend, the chair for the science, Innovation and Technology Committee around Jaguar Land Rover. In that instance, the government acted swiftly, acted swiftly in very exceptional circumstances, providing a £1.5 billion loan guarantee to protect jobs, support businesses and the supply chain and preserve this vital part of British industry.

However, as my the hon. Member for Exmouth and Exeter East noted, this should not be the expectation on government. Businesses must look to their own defences as a matter of corporate responsibility. I might just make a bit of progress for now. I'm also conscious that my hon. Friend from Warwick and Leamington raised the particular issue of the food sector and food retailers in light of recent attacks. Following the particularly recent attacks on Marks and Spencer and Harrods, I know that my hon. Friend, the Minister of State for Food Security and Rural Affairs, has written and engaged deeply with the CEOs of major food retailers to advise on how the food sector can best protect itself from cyber threats as well.

There's a broader question as to sectors that are not regulated in this bill that has been raised by numerous members across the House. A sector not being regulated under this bill does not mean the relevant organisations cannot protect themselves against cyber attacks. This bill is not designed, as I said, to cover every sector where the sectors are covered by existing regulations or where government does not consider it essential to regulate the sector through these regulations. We have taken a proportionate approach.

Introducing blanket coverage for whole new sectors would create extensive regulatory burdens for more of our economy, stifling economic growth at the same time. Madam Deputy Speaker, this bill will enable the government to bring more sectors into scope in the future and take swift action if national security is at risk. That is also sitting alongside a series of actions that the government has taken. And can I highlight in particular the the act of the government, having written to UK businesses and trade bodies right across sectors to make sure that they are one, embedding cyber essentials across their supply chains to making cyber resilience a board level priority.

And three, that the NCSC early warning system and advice is heeded in those organisational contexts as well. I'm conscious, Madam Deputy Speaker, that both the Shadow Benches and the Liberal Democrat spokesperson, as well as my hon. Friend from Congleton, raised the particular question of the public sector's coverage. The public sector requires a significant step change in cyber and digital resilience. Today we have published the government's Cyber Action Plan, as has been mentioned numerous times, backed by £210 million of investment The plan takes decisive action and holds government departments accountable for their cyber security and resilience, as well as providing them with more direct support and services, as well as co-ordinating responses to fast moving incidents.

I will take up the shared cause that the that my hon. Member for the New Forest East raised around the juiciness of local government digital provision, a phrase on which I share very much his enthusiasm. The Government Cyber Action Plan does take into account wider government and public sector coverage. In fact, it strengthens, clarifies and joins up how lead government departments hold wider public sector, including local government, to account for improved and equivalent cyber resilience, and also make a particular observation on the points made on scope around not just reporting and assessment, but recovery and resilience as well.

And can I flag to hon. Members right across the House that the proposals that we have in place for securing for security, as well as resilience requirements are being prepared for secondary legislation and they will align with the NCSC Cyber Assessment Framework relating very much to effective response and recovery, with consultation, consultation likely in the year ahead. Madam Deputy Speaker, there are a series of questions and comments raised about regulators and both proportionate as well as effective regulation in this particular context.

This bill will allow regulators foremost to make sure that they are well resourced in order to carry out the duties of the bill. This will be through charging reasonable fees to cover more of the cost of their activities under the regime, and to enhance their impact through clearer information gateways, increased incident reporting and establishing a unified set of objectives. I'm conscious that the shadow Secretary of State talked about both regulators not finding enough, and equally that they might find too much.

I will let her work out the obvious contradiction in her position. But in response to the right hon. Member from Hertsmere in particular, I think there is very clear scope for AI capability to be used in triage, and I would very much hope that the reviews embedded in the requirements of the bill that the Secretary of State must undertake will ensure that we're also looking at efficient ways in which regulators can do so. In response to the point made by my hon. Friend, the chair of the science, Innovation and Technology Committee, around the frequency and quality of the reviews for the regime in this bill.

DSIT will monitor and evaluate the new framework to review the effectiveness of the regime. The bill requires the Secretary of State to lay a report on the operation of certain NIS legislation before Parliament, and to publish at least every five years. It will be an extensive review, and as a result of that, we want to make sure that as proportionate rather than overly frequent, the particular commitments made by the Secretary of State to the chair relate primarily to those in the legislation.

In response to the points made by my hon. Friends from Warwick and Leamington, as well as Mid Cheshire about the possibility of a cross-sectoral cyber regulation approach. Can I flag that 12 regulators are responsible for enforcing this regime, because different sectors rely on different technologies with very different risk attitudes and vulnerabilities in responses. And in that context, it is right that we utilise sector expertise to address those sector specific issues. I'm conscious that my hon. Member for Bognor Regis and Littlehampton made an appropriate point about enterprise, IT and OT being differentiated, and indeed it is why we have taken a sectoral lens as a very tractable way of differentiating some of these particular risk factors.

And so for that reason, Madam Deputy Speaker, we have set out both a sectoral approach, but that is not to preclude the possibility of the Secretary of State setting out in a statement of strategic priorities to set out the possibility of coordination and information sharing across regulators as well, in response to the particular points made by the Liberal Democrat spokesperson, as well as the hon. Member for Exmouth and Exeter East around making sure that incident thresholds are clear and proportionate. The 24 hour light touch notification requirement is a proportionate requirement.

It only needs information to alert the regulator and National Cyber Security Centre of the nature of the incident, and it doesn't rely on overregulation in particular, with the exception of data centres, reportable incidents that affect operators of essential services would need to have affected the operation of significant network and information systems right across the entity and to have significant national security impact that is extremely unlikely to include minor thresholds, such as the receipt of a phishing email. I'm conscious that my hon.

Friend, the chair of the Treasury Select Committee, had raised a point around financial services organisations in particular, and I wanted to respond to that simply to flag that UK financial services are resilient against cyber threats. The threats are, of course, growing, but the regulatory context of the Financial Conduct Authority, the Prudential Regulation Authority and the Bank of England are indeed some of the sources are in terms of the approach that we have taken to this particular Bill as well. And just to continue on the theme of regulatory overlap that has been brought up, this government will, of course, make sure that some businesses, which have to navigate multiple regulatory frameworks with multiple services, are facing the minimal burdens.

And we will make sure that we work with our regulators and international authorities, including those in the EU, on the implementation of the bill as well. Madam speaker, if I turn now to the impact on business to make sure that it is both security as well as proportionality that the legislation takes in this context, this government will only regulate when it is necessary to protect our economy and our country from serious harm. A single attack can disrupt hospitals, transport vital services, putting lives at risk.

We will not gamble with our economy or our people's safety. The cost of doing nothing is, of course, too great. As I mentioned, cyber attacks drain almost 15 billion a year from UK businesses. At the same time, this approach makes sure that there is a proportionate approach to ensuring the safety of British people. The question of board level responsibility has been brought up by a number of members across the House, and I would say simply on that front, that all business leaders need to take responsibility for their organisations cyber resilience.

On the 13th of October last year, the government had written to CEOs requesting that they make cybersecurity a board level responsibility. The government's new Cyber Governance Code of practice focuses on governance of cyber risk specifically, and we are, of course, going to consider the use of secondary legislation to require companies to clarify their cyber security responsibilities at the board level as well. I am conscious that a number of members had raised the point about the effect on small and medium sized businesses as well.

Growth is the government's number one mission. Small businesses are the engine room for that growth. They provide many of our most important services. That is exactly why small and in particular micro sized managed or digital services are exempt from regulation under this bill. They can only be regulated if they are designated as critical suppliers, for which there will be an extremely high bar for designation, which should allow the point raised by my hon. Friend from Mid Cheshire around particular companies which meet that bar for designation as well.

A point was raised around the ability for small businesses to tell whether they are in scope quickly or not. The regulator will complete an investigation process, including notices and consultations with relevant businesses, prior to confirming whether an organisation meets the criteria for being in scope. That process needs to be robust, but of course, we would hope to make sure that those regulatory processes are proportionate to Madam Deputy Speaker. I want to turn now to a really critical question raised by my hon.

Friend from Milton Keynes Central, the right hon. Member for Oxford East, as well as the hon. Member for cardigan. Preseli around long term sovereignty and and capability in this country. Madam Deputy Speaker, I felt over the last decade and a half, the party opposite in government sold this country's strategic leverage away when it came to the primary sector, software and digital infrastructure. We will not repeat that mistake. We have already committed right across the board to extremely robust digital sovereignty measures as well. We have committed 500 million to a sovereign AI fund.

We have made sure that there are tens of billions of pounds pouring into this country to make sure this country has the capital infrastructure for AI, in particular with British firms like N-scale right at the heart of it. There is an advance market commitment for cloud compute to make sure that British companies are right at the heart of provision of core infrastructure in the future, through the British Business Bank, we are committing tens of billions. I'm very happy to

**** Possible New Speaker ****

give way. sovereign. Capability, but how can we have fully sovereign capability when we

**** Possible New Speaker ****

fully sovereign capability when we don't own the means of production for the most advanced chips? Minister. Well, I would I would point my I

**** Possible New Speaker ****

Well, I would I would point my I would point the hon. Member to both a very thriving compound semiconductor cluster in South Wales, as well as a series of chip Wales, as well as a series of chip design as well as chip manufacturing companies. If he's if he doubts the advancement of ARM as the primary chip design company in the primary chip design company in the world, I would point him to go and read a primer on the chip company supply chain again as well.

And so, Madam Deputy Speaker, there is a very clear sense of digital sovereignty that this government is pursuing. And I want to flag, in particular in the context of China, that we are taking strong action to protect our national security, including our critical national infrastructure, as well as making sure that we're appropriate. We are looking at opportunities for cooperation, the National Security strategy, the independent review of state legislation, and our new powers on counter-terrorism will make sure to do that. I'm conscious.

I'm testing your patience, Madam Deputy Speaker. And so I will flag simply. I will simply the the final point, which is the whole society approach. A number of members and right hon. Members made. We are making a series of investments in skills, in making sure young people are inspired to pursue careers in cyber security, and to the points made by my hon. Friends from South East Cornwall and Portsmouth North. I am deeply passionate about. To ensure that young people and young women and girls in particular, in those areas in Wales and right across the country, pursue thriving careers in cyber security.

Madam Deputy Speaker, National security is the first responsibility of this government. This bill could not be more necessary in confronting the developments in global cyber threats. I would like to thank all members and hon. Members for their engagement on the Bill. As it progresses. I encourage them to engage deeply in doing so. To all rogue organisations with hackers at the helm. And I don't just mean the Conservative Party. I say this your

**** Possible New Speaker ****

time is now up with this bill. We will make sure the British public is secure. In here.

**** Possible New Speaker ****

In here. The question is that the bill be now read a second time. As many as now read a second time. As many as are of that opinion say I. I of the contrary. No, I think the ayes have

**** Possible New Speaker ****

contrary. No, I think the ayes have it. The ayes have it. Programme motion to be moved formally. I beg to move.

**** Possible New Speaker ****

I beg to move. The question is as on the Order Paper, as many as are of that opinion, say I. I of the contrary.

**** Possible New Speaker ****

No, I think the ayes have it. The ayes have it. Money motion to be moved formally. I beg to move.

**** Possible New Speaker ****

I beg to move. The question is as on the Order Paper, as many as of that opinion Paper, as many as of that opinion say I of the contrary. No, I think the ayes have it. The ayes have it. formally.

**** Possible New Speaker ****

formally. I beg to move. The question is, as on the Order Paper, as many as are of that Paper, as many as are of that No, I think the ayes have it. The

**** Possible New Speaker ****

I's have it. We now come to the carry over motion to be moved formally. I beg to move. The question is as on the Order

**** Possible New Speaker ****

The question is as on the Order Paper, as many as are of that opinion, say I. I of the contrary.

**** Possible New Speaker ****

opinion, say I. I of the contrary. No, I think the ayes have it, the ayes have it. I beg to move that this house do.

**** Possible New Speaker ****

I beg to move that this house do. Now the question is that this House do now adjourn. Calum Miller. Thank you, Madam Deputy Speaker.

**** Possible New Speaker ****

Thank you, Madam Deputy Speaker. It is my privilege to represent a beautiful part of England's countryside, stretching from the Chilterns in the east to the Cotswolds and the west. It is crisscrossed by a network of rivers that define the geography of the area. The largest of these is the River Cherwell, which flows from its origin in Northamptonshire, about 40 miles south, where it joins the Thames in Oxford. My constituency also hosts two major highways, the M40 and the A34.

It is the proximity of the A34 to the River Cherwell that created both the setting and the opportunity for a major environmental crime to be committed. Madam Deputy Speaker. In late October, I was knocking on doors in Kidlington when the conversation opened my eyes. The
16:29
16:29
Calum Miller Portrait Calum Miller MP (Bicester and Woodstock, Liberal Democrat)
-
-
This was not fly tipping, it was industrial scale, organised criminal dumping. It quickly became clear that this was not new. Billy and others had been raising concerns for months. The Environment Agency had visited the site on the 2nd of July with local council officers, and determined it was a major incident which the EA took responsibility for addressing. Yet local anglers, farmers and residents had seen dumping continue through the summer. What had emerged was staggering. Around 20,000 tonnes of waste dumped illegally on a floodplain beside the River Cherwell, close to the A34.

You had to see it to believe it and many people did thanks to media coverage that went viral due to its shocking nature, this mountain of waste represented one of the most serious cases anywhere in the country. We quickly had an energetic response from from local councillors like Laura Gordon and Gemma Cotton, and campaigners stepped up to environmental groups including friends of the Thames helped amplify these concerns across Oxfordshire and nationally. Around Kidlington, a parliamentary petition gathered nearly 1000 signatures, which I presented here on the 9th of December.

This followed a series of interventions. My oral question to the Minister on the 13th of November. My urgent question on the 17th of November, the question of the right hon. Member for Kingston and Surbiton, to the Prime Minister on 19th of November, and my meeting with the Minister on the 2nd of December. I want to take the opportunity to thank the Minister for her engagement with this issue from the start, and for her work with officials to ensure the risks were identified and managed locally.

Following my initial question in the media coverage that followed, the Environment Agency had convened key partners from councils and emergency services to develop a strategy for the site. Last month, the Environment Agency confirmed it will take the exceptional step of clearing the site itself, citing serious fire and public safety risks. That is highly unusual and entirely reflective of the sheer amount of effort and support local councillors, campaigners and activists put in to raise the alarm. But this should never have been allowed to reach this scale.

It shows what local, determined people, backed by political pressure can achieve. And so, Madam Deputy Speaker, we come to the situation today. The River Cherwell is thankfully not high by its winter standards, yet it still laps against the sandbags and fencing installed by the Environment Agency. Water testing has thankfully not shown any significant increase in chemical pollutants downstream from the site. I am truly grateful that we appear to be averting environmental catastrophe for now, but now that the winter trees have shed their leaves and revealed the scale of the illegal waste site, it is invisible to my constituents and a constant reminder of the damage already done and the risks ahead.

So my constituents continue to ask what is being done to avert an environmental disaster of the waste contaminating the River Cherwell? Can the Minister please tell them whether the measures to contain the waste have been designed to cope with the rise in water levels, equivalent to the peak of a further two metres recorded at the nearest EA measuring station at Thrupp in November 2024. What action will be taken by the Environment Agency if water testing reveals that chemical pollutants are leaching into the River Cherwell, and what steps have been taken to reduce the risk of fire at the site.

The December decision to clear the site was warmly welcomed by all the campaigners who had fought for it. Yet the factor that led the Environment Agency to authorise the clearance of this site the risk of fire from combustible and decomposing waste remains, and local people remain angry that criminals did this to our countryside and deeply frustrated that more than six months after it was first visited by the Environment Agency, the waste is still there. The key question that my constituents continue to ask is when will the waste be removed? On the 11th of December, the press release from the Environment Agency in DEFRA stated, and I quote, preparatory works for clearance will begin imminently.

Further details on the timeframe for clearance will be set out shortly. To the best of my knowledge, no physical preparatory works have commenced and the timeframe for clearance has not yet been set out. So can the Minister please tell my constituents what steps have been taken since the 11th of December? When will the timetable for clearance be published? When will the first lorry remove waste from the site, and when does she estimate that the site will be finally cleared? Finally, my constituents are concerned to know who will bear the cost for this clear up.

So can the Minister please confirm that all efforts are being made to identify the criminals responsible and recover costs from them? That in the meantime, the Environment Agency will meet the cost of clearance and this will not fall to local taxpayers. And whether she has an estimate of what this total cost will be. Since news broke of the illegal waste dump in my constituency, there has been concerted media focus on the scandal of industrial scale criminal waste dumping up and down the country.

Like many people, I had no idea that this was so widespread. I've been shocked to learn of how many communities are afflicted by it. Research commissioned by Liberal Democrats in December indicated that 20% of UK adults have witnessed large scale illegal dumping in their own local areas, and that of these, 3 in 5 say the problem has got worse in the last year. This is truly an epidemic of criminal activity which damages our natural spaces and harms the lives of local residents, people who play by the rules, who dispose of their own litter carefully and take their household waste to council run tips, are rightly appalled that gangs are doing this and are too often getting away with it.

I know that this is less of a surprise to the Minister, who has been working on these issues for some time. She will know that the House of Lords Environment and Climate Change Committee, led by my noble friend Baroness Sheehan, has been critical of the government's response to its inquiry and recommendations of October 2025. I do not intend to cover those points extensively, but I do want to highlight three which directly reflect the experience in my constituency. First, we need to make it easier for people to report waste crime.

In this case, constituents have told me that they had suspicions or even evidence in the form of number plates or a description of unusual activity, but they did not know what to do with it. Should they call the council, the police, the Environment Agency? They did not know, and that stopped them from acting. Early detection of sites is key to stopping the criminals before they get started, and we should make it as easy as possible for people to report concerns. So will the Minister look again at creating a single national hotline for reporting waste crime? Second, it is clear that the Environment Agency is grossly under-resourced to tackle waste crime.

When I first raised this with the Minister on the 13th of November, she said in the House that the budget for waste crime enforcement had been more than increased by 50% this year. This took that budget to £15.6 million. Yet, as this case shows, the cost of clearance can be close to that full amount. And at the same time, the Treasury received £486 million in revenue from landfill tax in 20 2425. So I'd like to ask the Minister, has the government conducted an assessment of how much additional landfill tax revenue is generated for each pound spent on tackling waste crime? Has Defra pressed the Treasury to allocate a larger share of the revenue from landfill tax to waste crime budget? And given the government's response to the House of Lords Environment and Climate Change Committee, can the Minister set out a clear timetable for the publication of the revised national metrics on waste crime and confirm whether interim reporting will be put in place while those indicators are developed? Third, in this case, it is clear that the Environment Agency prioritised investigating the crime over protecting the site by containing the waste on it.

Between the 2nd of July and the 15th of October, the Joint Waste Crime Unit worked to establish who the landowner was and and collected evidence about the crimes. I am glad that that led to an arrest last year. However, nothing was done to anticipate the risks to the site, either from the waste entering the River Cherwell or a fire hazard. It was only after my question to the Minister on the 13th of November, that work began to put in barriers to prevent the waste entering the Cherwell.

I want to be clear, the EA has worked swiftly since November to to prevent further environmental damage and working with other local partners, they identified the risks of the site, which led to the decision to remove all the waste from it. But my concern is that, perhaps for financial reasons in this case, the EA prioritised investigation ahead of early protective action on the site. So does the Minister think the EA should reassess the balance between investigation and environmental protection when it identifies such large scale sites? And is the Minister satisfied that the EA has the resources and expertise to tackle serious, organised criminals who are committing waste crimes? Or should the National Crime Agency

**** Possible New Speaker ****

take over major investigations? Happily? Okay. Madam speaker, the hon.

**** Possible New Speaker ****

Madam speaker, the hon. Gentleman for giving way. I realise that the A34 goes through his constituency as it does mine. Madam Speaker Newcastle-under-Lyme will have to do a road trip sometime. But I congratulate him on his excellent speech. The Minister won't be surprised to see me here, won't be surprised to see me here, because in Newcastle we lived with the very worst example of waste, crime and profit over people. That was Walley's problem. We've just was Walley's problem. We've just marked a year since the landfill site was closed and the cowboy operators driven out of town, but I wonder whether the hon.

Gentleman will agree with me in terms of further questions to Minister that

**** Possible New Speaker ****

we need a stand alone strategy for waste crime, and we need it quick. I'm grateful to the hon. Gentleman for his intervention, and Gentleman for his intervention, and perhaps we can look forward to joining up at some point on the A34 in future. I agree with him. We in future. I agree with him. We need an approach to this which is truly national and truly strategic. What I have witnessed in my What I have witnessed in my constituency is the piecemeal approach, best efforts by an under-resourced agency, unable to under-resourced agency, unable to join the dots, and despite the hard work of many people within that agency, a failure to conduct, on the one hand, the investigation, on the other hand, the preventative measures, it's clear that the estimates of the scale of the criminal activity justify a robust and fulsome national strategy, and I would agree with him and hope the Minister will respond to his question.

Madam Deputy Speaker, strange as it may seem, my constituents and I have been lucky, insomuch as this site met the narrow criteria for exceptional intervention. There are many communities up and down the country, such as the one just cited, who also face the blight of criminal waste dumping, yet do not have exceptional circumstances that allow the EA under current resourcing and rules, to clear their sites. The site chosen by criminals to dump waste in my constituency suited them as it had easy, undetected access to the A34, but its very proximity to the A34 became the reason that exceptional action has now been approved to remove the waste.

What has struck me most about this toxic crime is how strongly people feel this is wrong. Wrong to be so arrogant as to despoil our beautiful countryside. Wrong that too many people get away with it, and that the penalties are not higher and wrong. That it takes too long to clear up these sites. When Billy told me about this site, I vowed I would work to see the waste contained and then cleared. I am glad that's happening now, and I hope the Minister will be able to confirm it will be delivered with urgency.

When I learnt how widespread the issue was, I vowed to work with all those, like the Minister, who cared deeply about it, to ensure that we make real progress in stopping this crime from blighting so many communities. I look forward to continuing that work with colleagues across the House.

**** Possible New Speaker ****

The Minister Mary Creagh, thank you very much indeed, Madam Deputy Speaker, and it's lovely to be here with you again to celebrate the New Year. Can I wish you and all colleagues in the House a very colleagues in the House a very happy New Year. And what a shame it is that we're starting with the the is that we're starting with the the trash from last year. And of course, as we've just celebrated Christmas and the holiday periods, we will and the holiday periods, we will have seen our bins, our recycling facilities overflowing with the Christmas excesses.

And we have faith in our systems that when it is taken away, it is responsibly dealt with. So I want to begin by thanking the hon. Member for Bicester and Woodstock for raising this important issue. I share his anger and the public's anger about this very serious crime and its impact. Because waste crime blights our communities. As I know from my own work as a constituency MP in Coventry, these waste criminals, damage the environment and in the worst case can actually directly threaten our health and life and limb.

These criminals undermine legitimate businesses and they deprive the exchequer of tax income, which is why this government is committed to tackling waste crime. We will crack down on the waste criminals and the organised crime groups who have moved into this lucrative space, and we will ensure they are brought to justice. I can confirm that the criminal investigation into the Kidlington site is moving forward at pace, working closely with the police, Environment agency officials have taken samples of the waste materials on site for forensic examination, and there's a lot we can divine from some of these materials as to where they actually originated from.

Those forensic results will be available by the end of January, and the Environment Agency is working very closely alongside partners including Oxfordshire County Council, police and fire and Rescue Services as part of the Sites Strategic
16:43
Mary Creagh Portrait Mary Creagh MP (Coventry East, Labour)
-
-
Co-ordinating Group and the Tactical Co-ordinating Group. So the strategic Group has set the the strategic Group has set the overall goals for this major incident, supporting the Gold Commander with advice, analysis and Commander with advice, analysis and community links and the Tactical Co-ordinating Group implements these goals at the scene. The these goals at the scene. The strategic Group has local and operational expertise, and it is they who have determined the scale of the fire risk sets this case apart from the other illegal waste dumps in England.

This location presents an overriding public imperative. That is why the Environment Agency therefore took the exceptional decision to clear the waste, and is why they are working rapidly to implement a safe, systematic and focussed clearance plan. And it's important to stress, Madam Deputy Speaker, that in the past five years only two other sites have been cleared by the Environment Agency Hoads Wood, via a ministerial direction, and Twyford House in Stoke on Trent, which is where lots of flammable liquids were stored, very close to the West Coast Main Line, so you can see some of the similarities there.

The Environment Agency will continue to closely monitor the site whilst preparatory work takes place. They have informed me today that prep work will begin shortly, and clearance of the waste is expected to start in February. Further updates on the timeline will follow from the Environment Agency. It is important the site's vast amount of waste is handled correctly, moved to the right facilities without causing damage to the environment. The Environment Agency is monitoring risks at the site and will respond to any change in situation promptly.

It is important that people do not enter the site, whether as members of the public or well-meaning journalists. It is a crime scene, it is an environmental crime, but it is dangerous to climb on the waste. In doing so, people are putting themselves at risk and compromising the criminal investigation and compromising a criminal investigation is in itself a criminal offence. So we don't need to add extra problems to the very big problem that is already there. There is now 24 hour surveillance in place.

The Environment Agency's approach and action is always based on evidence and with the containment and clearance actions were taken in response to a changing risk level and the potential for a rise in the water levels. The Environment Agency was on site within days of receiving photographic evidence from a member of the public, and immediately visited the site with the local authority and confirmed it as a high risk illegal waste site. Over 80% of the waste on site was there before the Environment Agency visited it on the 2nd of July, so the vast majority happened before they were alerted when further waste movements were reported in September.

The EA swiftly obtained a restriction order in October. The current risk of waste entering the river is very low because a barrier has been installed at the site to prevent it entering the river, both to safeguard the environment and public safety. In the event of river levels rising or in the event of flooding, the Environment Agency has carried out water quality sampling of the River Cherwell to check for potential impacts of runoff or leaching from the waste, having sampled upstream and downstream of the site, they have found no indication of pollution entering the Cherwell as a result of the waste.

Now, the clear up of illegal waste sites by the Environment Agency should only be a last resort, undertaken in exceptional circumstances to protect the public and the environment, because criminals who disregard the law undercut legitimate businesses and blight communities and the environment must pay the penalty in accordance with the polluter pays principle, not we as taxpayers. We do not wish to create a perverse incentive for some people to dump or facilitate the dumping of waste. It should be for the polluters, not taxpayers, to clean up and pay the costs of clean up.

But I do acknowledge the frustrations, and I know from my hon. Friend for Newcastle underline the huge frustrations that this approach takes, and in some cases this can undermine public confidence or create a protection somehow that this isn't taken seriously or tackled swiftly. But as with any police investigation, there is no running commentary provided either by police, law enforcement or by Ministers. I can confirm, though, that I am vigorously pursuing all avenues on this and on other waste crime sites.

We are absolutely committed to bearing down on these cynical waste criminals who damage our environment, harm businesses, and blight our communities. Now, I'm going to go through each of his questions in advance. I do request the patience of the house and do feel free to cough if it if it goes on too long. Madam Deputy Speaker, but I believe we have until 730. So strapping. So he asked, how are we tackling the blight on this country, on the country caused by waste crime? So we are pursuing a series of reforms that will have lasting impact on reducing waste crime.

We are bringing in reforms to the carrier, broker and dealer regimes, which is going to shrink the number of people that can actually handle waste. So that's the first thing. We're changing the waste permit exemption regimes, because at the moment, certain activities do not need a permit. And we're shutting down those exemptions. And we're introducing digital waste tracking, which is coming in this year. So these are things that I have done as a Minister that have been consulted on as far back as 2018, but have not been enacted by successive governments.

We think these three movements, this pincer movement, if you like, are the most effective way to drive criminality away from the waste sector because it's all about knowing the chain of custody for these materials. Alongside this, we have, as he said, increased the budget for waste crime enforcement by over 50% this year to £15.6 million. That is the investigatory part of what the EA does, and that's all the stuff around misdescribed waste, waste shipments, you know, all of the the difficult business.

And this work is very time consuming, very painstaking, because it has to be done to a criminal standard of proof that will stand up in a court of law. So obviously he asked, we we know that we have digital. So yes, I just want to go on a bit more detail about this because they, they, they were deprioritized. These reforms were deprioritized and stalled under this government. These reforms are being accelerated. So mandatory digital waste tracking will replace outdated methods for monitoring waste movements and to unify fragmented processes.

It will provide a single comprehensive view of waste, types of waste quantities and of waste destinations, and the lack of digital record keeping in the waste industry is frequently exploited by organised criminals, who undercut legitimate businesses through mishandling waste, through illegal exports, and through simple fly tipping. Data in the new system will help regulators check that waste is ending up at legitimate, licensed site sites, and it will enable quicker investigation of illegal activity. This digital waste tracking system is being phased in this year, beginning with the introduction of assistant, a system for waste receiving sites, for example landfills and with planned expansion to other waste operators such as waste carriers in 2027 2027.

Subject to further

**** Possible New Speaker ****

funding, I will. Thank you, Madam Speaker. I'm very grateful to the Minister for very grateful to the Minister for giving way and for sharing with the House this important step forward. It only worries me that if this had It only worries me that if this had been done before and we're talking back to 2018, some of the issues that I've hassled her since I was that I've hassled her since I was elected to this place in July 2024, in relation to Walleys quarry, could have been dealt with a lot sooner.

So this raises many questions, both about the impact on my constituents back home in Newcastle line and the previous government, who clearly and we can discuss this further outside of this House. Madam speaker, we're

**** Possible New Speaker ****

missing in action. I thank him, I pay tribute to his assiduousness on the issue of his assiduousness on the issue of Walleys Quarry, which is also now being run by the Environment Agency, and where the risk of odour that and where the risk of odour that his constituents were suffering in such, you know, really grievously such, you know, really grievously suffering, that the risk of that odour is now extremely low. But odour is now extremely low. But that has come at a cost.

As he rightly says, this is nothing new. And in a way, when there's a problem and no action is taken and no new policy is created, the problem is that people, people think, well, it's a victimless crime. I can carry on, I can carry on making money. And then they tell their friends and guess what? It's pretty soon many flowers are blooming and you know these are the wrong sort of flowers in terms of illegal businesses. And it creates incentives. And then of course, the legitimate businesses are like, hang on, why am I paying all these fees and doing it? If all I need to do is buy a field, dig it up and dump it so it creates disincentives for legitimate operators as well.

And I am only too aware of this. It is. I think it is. It was something that was starting sort of post 20 1617 leaving the EU government focussed on, on, on, you know, very, very large international issues. But I was always concerned and I was chairing the select committee in this House to the Environmental Audit Committee, and I was always very worried about what was going to happen to waste, including chemical waste as well. Once we put up a border with our nearest neighbours.

So that was a digital waste tracking. Second, the reform of waste management and transport. So instead of going from a light touch registration system, it is now going to be a permitted system. So we're going to move from a system that was so lax that people were able to sign up Oscar the dead dog to be a waste carrier. So Oscar the dead dog was was able to be signed up. And this is, you know, and activists were doing this back in I think it was 2018, 2019.

So we've known about these problems. Paper any anyone can anyone can falsify a bit of paper. We're going to introduce tougher background checks for operators and tougher penalties for those who break the law. We will also require vehicles to transport waste. So the the man with the van to display their permit numbers on their vehicles and on their advertising, so service users can be reassured that their waste is being handled by accredited businesses rather than criminals. And the reform will also introduce mandatory technical competence for all permit holders, meaning anyone transporting or making decisions about waste will have to demonstrate they are competent to do so, rather than simply just going on a register.

So it means if I can just finish my sentence so that waste will be managed by authorised persons only way.

**** Possible New Speaker ****

I thank the. Minister for giving way. I'm fascinated and really, really happy fascinated and really, really happy to hear what what's being proposed? Is it going to be possible for members of the public to check an online database for that permit? Because there is something about somebody picking something up from your home showing you their permit. And actually people feel quite vulnerable going online, checking vulnerable going online, checking it against the local authority or central database would actually give people a lot more confidence.



**** Possible New Speaker ****

I will get back to her, if I may on that in terms of but the but the on that in terms of but the but the point, I suppose, of a digital waste tracking system is that everything is digitised. The problem has been there. It's a problem has been there. It's a paper based register. So how can you check at the moment? So my understanding is the move to the digital system. But I will get back digital system. But I will get back to her.

I don't want to mislead her or the House. Madam Deputy Speaker or the House. Madam Deputy Speaker and perhaps box officials can enlighten all of us while I go through the third reform of the waste permit exemptions, which is at the moment, there are exemptions for three high risk areas end of life vehicles. So car scrappage, end of life tyres and scrap metal. And these have long caused problems, these exemptions and they have been abused. And we're going to replace them with a requirement for a full environmental permit for all of those activities.

So we will introduce greater record keeping requirements for all waste exemption holders and impose controls on how exemptions can be managed at one site. So at the moment there are other waste exemptions. There are seven of them. One is around construction waste, one is around preparatory treatments, one is around treatment of waste wood, one is around manual treatment, one is around burning vegetation at the place of production only. That's essentially for farmers. One is around storage and containers and storage in a safe place.

So those are the exemptions. And and we have, as I mentioned earlier, increased the Waste Crime Investigation Unit budget. So it now has 43 full time staff. People have often asked me about enabling the Environment Agency to use environmental permit income to tackle waste crime. There are rules set out by the Treasury in managing public money about how the income raised by public bodies may be used. These rules ensure transparency to us as parliamentarians, and to ensure that fees and charges are not set higher than necessary to cover activity which should properly should be funded from taxation.

So we instead looked at innovative ideas and we are consulting. The EA has consulted on the implementation of a 10% levy to generate a further £3.2 million of waste enforcement funding each year, and this would enable a further 30% increase in enforcement activity to be targeted at activities identified by the Environment Agency as waste crime priorities. These include tackling organised crime groups, increasing enforcement activity around specific areas of concern such as landfill sites, closing down illegal sites more quickly, using intelligence more effectively and delivering successful major criminal investigations.

I am going to. I will.

**** Possible New Speaker ****

Such a comprehensive response on this question of funding the 15.6 this question of funding the 15.6 million that is in the budget for this year for tackling waste crime, as she said, is for the officers as she said, is for the officers who are engaged in investigation. But it still strikes me as a small amount of money with 43 officers for a crime that is now taking place up and down the country. Can she clarify whether the additional 5.6 million is is now permanently 5.6 million is is now permanently in that budget and will be going forward, such that the additional funds she's referred to in terms of permitting would be over and above that sum.

And fundamentally, does she think that this is enough?

**** Possible New Speaker ****

Well, my aim is not to spend further taxpayers money on crime. My aim is to stop it happening in My aim is to stop it happening in the first place. And obviously all budget decisions are subject to the normal business planning. But what normal business planning. But what we hope is that through our three year spending review, we can give the Environment Agency a three year the Environment Agency a three year settlement or indicative settlement, which will enable them to plan rather than this annual process of, rather than this annual process of, you know, up this year, down next year.

So there will be a long range line of sight planning. But as I say, they are consulting at the moment on this additional extra revenue. So if that goes through then that would would see an uplift to their funding as well. I have the answer for the hon. Lady to the question about checking the database. It is already possible to check the online database for permits. We are we are happy to inform you. So that's that's all good news there. So I've mentioned about the different the different reforms I've mentioned.

I think I've mentioned I think I've answered all of his questions. But I'm pretty much coming to the end of my speech. But if there's something that I haven't organised, oh, steps taken since the 11th of September. Yes. So you're to his specific questions. The rise in water level of up to two metres, equivalent to the peak recorded at Throp in November 24th. It is within a large floodplain, and the floodplain can store a substantial volume of water during heavy rain.

The EA has carried out more detailed flood risk assessment to understand any changes in water levels due to the illegal waste, and have determined there will not be any increased flood risk to local properties. And my understanding is there are sandbags there and a fence there. In order to protect the river. They have also carried out regular water quality sampling of the river to check for impacts of runoff or leaching, and have found no indication of pollution. If any pollutants are found in the watercourse, the action would obviously depend on the nature and type of the pollutants found on fire risk at the site.

EA officials have been working with the Fire and Rescue Service, who are leading on monitoring the temperatures of the waste and planning appropriately, but obviously, the fire risk was one of the main reasons that an exceptional decision was taken to Progress works to entirely clear the site, so analysis on how the site would be cleared, including ecology, service surveys, have all been carried out and with partners and the Environment Agency to get contracts in place as soon as possible. But we need to follow legal process to ensure the waste is disposed of correctly.

So the clearance timetable has been finalised and will shortly be published on the engagement HQ website. As I said, clearance to begin, we hope in February. Early indications and scoping indicates that full clearance will take approximately 6 to 9 months where possible. We are seeking to recover our costs from those responsible in accordance with the legislation and the polluter pays principle, and and the EA is working with the Economic Crime Unit to target the finances of waste criminals. That unit can freeze bank accounts, seize assets and investigate cases

**** Possible New Speaker ****

of money laundering linked to waste crime. I will. I'm very grateful to the Minister for setting out so clearly how seriously she's taking this issue, and that will be of continued reassurance to people continued reassurance to people about coming to Newcastle. But in many examples, waste crime is rural crime. So I wonder whether she can crime. So I wonder whether she can both clearly and the hon. Gentleman's condition, particularly for me back home as well. So I wonder whether the Minister can wonder whether the Minister can touch a little bit on, as she talks about working together and the importance of cooperation and partnership work about with the Home Office to make sure that we're getting that right, because clearly, in many communities up and down the country, people think in rural communities where there are fewer people around and all the rest,

**** Possible New Speaker ****

they can get away with doing whatever they want. And we've got quick. So I do agree with him, and I

**** Possible New Speaker ****

So I do agree with him, and I think what one of the things that I'm very interested in exploring is what is the playbook? The hon. what is the playbook? The hon. Gentleman said, you know, who do we report it to? Well, the problem is, if you're not clear, then people do nothing. And the most important nothing. And the most important thing, when any crime is being carried out, wherever it is happening, is to do something, whether that's, you know, on the whether that's, you know, on the tube or wherever we see things happening, it is for us as citizens to do something.

And I think whether you report it to your council or you report it to the local police or you report it to the Environment Agency, and their hotline is 880 70, 60 is the EA's hotline number. Thank you to my officials for getting that through. So we've got that into the public record as well. So it is important. But I think the playbook is important because once you've reported it, well, what does the local authority do? What does the police do? What does the EA do and what is the definition of a major site? Because I've obviously visited sites, I've visited a site in Staffordshire, in Water Lane where people were locked in their homes.

It was two vanloads of fly tipping, and it was not classified as a major problem, and it fell to the local authority to clear it. But people were in their homes physically unable to leave through this, through the road. I mean, absolutely extraordinary position for people to find themselves in. So what is the playbook? What are the definitions, and where do national agencies step in? The Environment Agency expects to fund the clearance efforts through making efficiencies in its operations, without impacting or scaling back any other services.

But of course, it is not funded to clear up waste sites nationally and only makes these types of decisions in truly exceptional circumstances. He asked about additional landfill tax revenue. The Waste Crime survey that EA has carried out says 20% of waste is handled illegally. HMRC estimates that 23% of landfill tax is evaded, contributing to an annual waste crime cost of roughly £1 billion a year, including a £150 million landfill tax gap, which is 23% of the theoretical liability.

I hope everyone can understand that, but it's £1 billion a year. This is big business. That's a that's a that's a profitable and lucrative business. And it's us who are all paying. And we're paying twice because we're losing the billion and then we're clearing it up, you

**** Possible New Speaker ****

know. So it's a double whammy for us. It's maddening. Right. Very grateful to the Minister

**** Possible New Speaker ****

Very grateful to the Minister for setting out those figures so clearly. And that really was the point I was driving at in terms of point I was driving at in terms of the budget for waste crime, not so much that I, like anybody else, wants to spend money dealing with criminals. But that's a relatively criminals. But that's a relatively modest investment in the in the detection investigation could yield a higher proportion of that missing a higher proportion of that missing tax gap.

So the billion pounds that we lose every year for a relatively modest increase in the Waste Crime Unit's budget or through the National Crime Agency doing more, could potentially bring in more of the revenue that should actually be

**** Possible New Speaker ****

there for legitimate taxpayers to be used in all of our benefit. Is that. I completely agree with him. And

**** Possible New Speaker ****

I completely agree with him. And I think we're we're both in passionate agreement. I'm sure everyone in the chamber and watching at home is in agreement. What I would say, though, is when you have a big business, you use all available resources to protect the income. And so, you know, these are sophisticated businesses, some of them are registered companies. And so, you know, they have their own ways of making law enforcement's life difficult. So, you know, I think we don't we're in a bit of a David and Goliath situation with some of these very large and problematic groups.

And, you know, they've been very good at, at doing this. And so these are this is not this is not simple. This is complex crime. And complex crime does take quite a lot of time to unpick and unravel. We continue to work with Treasury on the best approach to fiscal policies, to support how we can tackle and reduce waste crime. And let me just conclude by saying that the Joint Unit for Waste Crime is a UK wide partnership working with the Environment Agency, HMRC, National Crime Agency, the police and others, and shares intelligence powers and resources to disrupt these waste.

Criminal and this unit has doubled in size thanks to our extra funding. It was launched in 2024 and it uses proceeds of crime action and asset freezes. And of course, people can. Also, anyone with intelligence about waste crime can also report it to Crimestoppers on 805 55111. So let me conclude by saying, Madam Deputy Speaker, that my message to his constituents and our constituents around the country is that this is an absolute top priority for this government.

My message to the waste criminals is we are coming for you and we are going to shut you down. My message to the legitimate waste operators is thank you for what you do. Thank you for the work you do to provide safe, healthy and clean environments in our town and help us put pride into our places. And let's all make sure that we work together to create a truly circular economy where this sort of terrible crime is unthinkable and these people are put out of business.



**** Possible New Speaker ****

Thank you. Yeah. The question is that this House do now adjourn. As many as of that do now adjourn. As many as of that opinion say are the ayes have it.
11:00
None Portrait Oral questions: Energy Security and Net Zero
-

House House of House of Commons House of Commons - House of Commons - 6 House of Commons - 6 January Right. We start with Oral Questions,

**** Possible New Speaker ****

the Secretary of State for Richard Foord.

**** Possible New Speaker ****

Richard Foord. Number one, please, Mr. Speaker. Minister. Thank you, Mr. Speaker, and a happy New Year to you

**** Possible New Speaker ****

Speaker, and a happy New Year to you and to colleagues across the House. I've temporarily lost So if I'm shouting or I don't hear So if I'm shouting or I don't hear I apologise in advance. Mr. speaker, this government is determined speaker, this government is determined to strengthen our energy security by moving away from volatile fossil fuels and delivering a clean power system. We've switched off the last and have consented enough the equivalent of 7.5 million homes. That is how we will tackle strengthen our energy security

**** Possible New Speaker ****

Jean-Paul. The International Renewable

**** Possible New Speaker ****

The International Renewable China installed five times more China installed five times more and eight times more renewable And in the same year, for the UK, And in the same year, for the UK, more than two thirds of our liquid natural gas came from the United States. gas came from the United States. So in the difficult geopolitical how is the government making the UK more

**** Possible New Speaker ****

self-sufficient for our energy supply? Well, it's a hugely important question and an increasingly uncertain world. Our energy security becomes Our energy security becomes and that is why we are we build a clean power system we build a clean power system crisis the planet faces but also so that this is home- grown power but also so that this is home- grown power here in the UK that we control. That is hugely important. So every step that we are taking So every step that we are taking to invest in a new generation But it's also, of course,

**** Possible New Speaker ****

which delivers our energy security Chair, the Select

**** Possible New Speaker ****

Chair, the Select Thank you very much, Mr. Speaker. Happy New Year, and Happy New Year, and in his New Year's resolutions, will commit to building will commit to building transition through the secure jobs, the public the secure jobs, the public reduced emissions and indeed But does he agree that those are denying our children And will he endeavour to fight against the misinformation, the disinformation, the outright myths peddled by some of those opposite?

**** Possible New Speaker ****

Yeah. Well, typically my hon. Friend is is right on these points. Friend is is right on these points. And yes, it is one of my and I suspect my ministerial for us to redouble our efforts for us to redouble our efforts And indeed, just this morning, I was reading about yet I was reading about yet we underestimate the level of support in the general public for climate action. And we have to remember that, And we have to remember that, that while there is a lot of the reality is that the climate and it is not just for future Friend rightly says,

**** Possible New Speaker ****

security and for good jobs as well. Dave Doogan. Thank you, Mr. Speaker. Refined hydrocarbon fuels are Refined hydrocarbon fuels are carbon border adjustment mechanism, meaning that while UK meaning that while UK energy ETS costs of £50 per tonne, This is clearly incomprehensibly damaging This is clearly incomprehensibly damaging in economic terms and is self-evidently counterproductive in climate goals counterproductive in climate goals It is pure madness. Refining at Grangemouth of Labour's failure to So will the government now act to protect the four remaining refineries on GB, or will Labour continue with their dressed up as decarbonisation?

**** Possible New Speaker ****

Minister well, I say Gentleman and his sunny disposition Gentleman and his sunny disposition First of all, first of all, let me say that we let me say that we looking at the CBAM inclusion Second of all, of course, I've been Second of all, of course, I've been to make sure that they are to make sure that they are And thirdly, I think he come here and talk about when his party has failed to have For 18 years they've been in power and they published just before Christmas the flimsiest of flimsy plans for which was mostly made up by

**** Possible New Speaker ****

They have absolutely no credibility Chair of the Environmental

**** Possible New Speaker ****

Chair of the Environmental Thank you very. Much, Mr. Speaker. There are many corporate customers There are many corporate customers but find that grid five and more years stand in their way. five and more years stand in their way. So can the Minister tell speed up business connections to the grid, speed up business connections to the grid, and also what he's doing to make sure we prioritise those business customers who are going to make biggest

**** Possible New Speaker ****

Minister. My hon. Friend raises a hugely important point, Friend raises a hugely important point, and the future of the grid is to not only how we get clean to not only how we get clean across the country to bring down bills, but actually how we deliver the economic growth the country needs as well. growth the country needs as well. That is why we have taken two key actions. First of all, to build the grid opposed by some of those opposite us, opposed by some of those opposite us, that future grid is critical also clearing out the connections queue so that there is space in the connections queue for more projects like Both of these actions are and those who oppose the building of new grid infrastructure oppose

**** Possible New Speaker ****

My hon. Friend just mentioned. Richard Tice. Mr. speaker, could the Minister explain why speaker, could the Minister explain why the government has the Lindsey Oil refinery that would have the Lindsey Oil refinery that would have kept jobs open, kept the refinery open, attracted more investment in favour of attracted more investment in favour of a lower bid that is destroying jobs, mothballing the refinery mothballing the refinery interest that the government professes. And could he confirm whether

**** Possible New Speaker ****

the decommissioning liabilities Minister.

**** Possible New Speaker ****

Minister. Well, firstly, on a positive note, Gentleman had some good and I congratulate him on that. and I congratulate him on that. But he's quite wrong on And look, first of all, I should set out, And look, first of all, I should set out, as I did in my oral statement This was an insolvency process This was an insolvency process receiver to conclude the sales They have taken the highest and they and now P66 will take forward in a sustainable way the future of that site, and I will continue to work On the question about the government does not retain

**** Possible New Speaker ****

They were part of the deal, and P66 Doctor Jeevun Sandher. Thank you, Mr. Speaker, and happy New Year. We're facing an affordability We're facing an affordability indeed across high income nations, because of our dependence on fossil fuels. That's why energy prices That's why energy prices So our constituents feel But more importantly, it's also But more importantly, it's also across this nation have in our across this nation have in our So can the Minister set to fossil fuels will help to resolve the affordability

**** Possible New Speaker ****

restore faith in this place? Minister? Well, it's an important

**** Possible New Speaker ****

Well, it's an important He rightly mentions that the transition important for our energy security important for our energy security And we in this place, I think, have And we in this place, I think, have the future of our planet for But the second point he makes But the second point he makes need to make the case for It's the way we get off so many of our constituents are and it's also the way communities right across the country.

So the tens of thousands of through renewables are already in place. But the hundreds of thousands see by building much more in the UK is how we get as well as the energy security.

**** Possible New Speaker ****

Harriet Cross Shadow Minister. Thank you very much, Mr. Speaker. Mr. speaker, in the future of speaker, in the future of the government defined a barrel for oil a barrel for oil Can the Minister tell me

**** Possible New Speaker ****

Can the Minister tell me Mr. Well. We've been really clear that the energy profits levy comes to an end in 2030. profits levy comes to an end in 2030. We've put in place what like to give certainty for And of course, the energy profits levy was introduced by her party in government. And so we've been really clear that an end in 2030 unless the price But her party also have to say if they are in favour of scrapping it today, where will the billions of pounds In order to fund the public services

**** Possible New Speaker ****

Harriet Cross. Mr. Speaker, even the Minister doesn't Speaker, even the Minister doesn't want to tell us oil today is want to tell us oil today is a firm up to a third lower itself defines as windfall prices. But despite this, they're still But despite this, they're still massive windfall taxes and the cost massive windfall taxes and the cost production set to halve and almost complete dependence on foreign imports of oil and gas by 2030. Mr.

speaker, this government is the death of one of our So will the government now end

**** Possible New Speaker ****

scrap the mad ban on new licences, Minister. Well, I think there are a number of areas there that I would challenge. areas there that I would challenge. First of all, the level in government and we haven't changed that. in government and we haven't changed that. The floor was set by Second of all, she talks about Second of all, she talks about I think that is an important study It is not a reflection It is not a reflection happened in the last few months.

So although I absolutely take I think we do need to of what has actually happened. And every single job hugely distressing for those communities. But she should also talk up because she says that we are In fact, it's her party that repeatedly that can happen in in carbon capture and storage work in oil and gas and much, much more. She should talk those the future of the North

**** Possible New Speaker ****

Not to Danny Chambers. Mr. Speaker. Thank you, Mr. Speaker. Happy New Year and happy epiphany.

**** Possible New Speaker ****

Happy New Year and happy epiphany. And I am my right hon. Friend, the energy and to slashing energy costs for to slashing energy costs for and energy intensive and energy intensive in compensation for with 90% of costs being covered. We are also consulting on a British We are also consulting on a British which includes our plan to exempt

**** Possible New Speaker ****

the costs of some of Danny Chambers.

**** Possible New Speaker ****

Danny Chambers. Mr Speaker. Small and medium. Sized businesses are and many of them like the amazing Berlin, and many of them like the amazing Berlin, which is a Spanish cafe in Winchester. I spent a lot of time in it, actually, the sort of beating hearts the sort of beating hearts Mr. speaker, small businesses. The average electricity The average electricity 92% of these businesses say prices to deal with energy volatility. And unlike households, Mr. Speaker, businesses don't and so they are effectively dealing Does the Minister agree with me that and will he commit to reviewing how we end

**** Possible New Speaker ****

this wild west of energy regulation? Thank you, Mr.

**** Possible New Speaker ****

Thank you, Mr. Speaker. I thank him for his question. And he points to the issue And hopefully it was clear from And hopefully it was clear from is not satisfied with And of course, this energy volatility And of course, this energy volatility our reliance on on oil and gas our reliance on on oil and gas Clearly, a policy that the And it is this government's clean power mission that will ensure that we have energy security for the future. And unlike the climate denying policies which will destroy jobs we will deliver energy security

**** Possible New Speaker ****

small and large businesses Rachel Taylor thank you, Mr.

**** Possible New Speaker ****

Rachel Taylor thank you, Mr. Speaker. I am sure that many schools have and that is why I'm delighted and that is why I'm delighted Saint Michael's CVE Academy in C of E Academy and Ash C of E Academy and Ash received funding to install solar panels. Can the Minister outline Can the Minister outline schools will receive and how this will help our

**** Possible New Speaker ****

It's kind of like education. Can you speak into business, Minister?

**** Possible New Speaker ****

Can you speak into business, Minister? Thank you, Mr. Speaker, but I think I think it is to supporting reducing costs is to supporting reducing costs including education and health, with including education and health, with And we saw last year the massive increase in solar installations in the UK, equivalent to enough energy equivalent to enough energy So a benefit not only for our green energy as well with but also ensuring that by

**** Possible New Speaker ****

such as in in schools and hospitals, Thank you colleagues. Thank you, Mr.

**** Possible New Speaker ****

Thank you, Mr. Speaker. Happy New Year. Mr. Speaker. And with your permission, I'll And with your permission, I'll the 2023 Generation Cost Report, shows the levelized cost shows the levelized cost and operate a new gas fired power station to be significantly higher to be significantly higher solar and offshore wind. In the most recent Renewables are a cheaper and operate the new gas Tom Collins. Thank you, Mr. Speaker. NESO Clean Power 2030 plan relies without a clear plan for their The forthcoming hydrogen strategy to set long term goals for including hydrogen fired ccgt generation and long term stock Will that strategy include milestones for transitioning transitioning dispatchable power capacity, and will need to be this pathway into its planning? Sarah Sackman.

Well, my hon. Friend asked a really, really Speaker. And if you look at our we precisely talk about dispatchable power as a way forward. And I'm really proud of what is happening with our plans and net zero Teesside.

**** Possible New Speaker ****

And additionally, as he part of our forthcoming hydrogen strategy. Polly Billington. Thank you, Mr. Speaker. Current global instability from Current global instability from the vital importance of having the vital importance of having Does the Secretary of State in renewables will help both in renewables will help both particularly because they are as well as providing us with that vital energy security in an uncertain world.

**** Possible New Speaker ****

energy security in an uncertain world. My friends. Right. The figures that came out from that we have got extra equivalent to powering 2 million homes. That's 2 million homes which will And that gives us never had under the previous government. And this fundamental lesson at

**** Possible New Speaker ****

is home-grown clean power is what We are Hamas. Thank you, Mr.

**** Possible New Speaker ****

Thank you, Mr. Speaker. According to government projects costs around compared to roughly £114 Of the lifespan cost of new gas power. I know the Secretary of State that clean energy remains

**** Possible New Speaker ****

But how do we make sure that Well, I think the hon.

**** Possible New Speaker ****

Well, I think the hon. Lady just did a good job of And she gets to the crucial point. And she gets to the crucial point. Mr. speaker, which is those those speaker, which is those those That reject onshore wind. That reject offshore wind. They are rejecting cheap, clean, home-grown power for the British people. home-grown power for the British people. That's what we're in favour Jim Shannon. Thank you, Mr. Speaker. Can I thank the Minister very Not only is it important to comes to looking at at it's also important to have an input into the planning process.

Can I ask the Minister, the the formation of any gas And has the Minister had and information with who wish to look at the possibilities for them in Northern Ireland as well? Thank you. We obviously have regular discussion Assembly on a range of Mr. speaker, on his point about nationally it's absolutely right that communities And certainly in the case of we also want communities because by hosting infrastructure, including low carbon infrastructure,

**** Possible New Speaker ****

communities are doing Yes. Shadow Secretary of State. Claire Coutinho. Yes.

**** Possible New Speaker ****

Yes. Thank you. And happy New Year. Mr. Speaker. This is just nonsense on stilts This is just nonsense on stilts And we know this because the biggest said that they will need gas said that they will need gas So if a company wants to build at no cost to the British taxpayer, at no cost to the British taxpayer, the warped green ideology of this with domestic emissions above Those emissions will still exist. That company will start somewhere, So does the Secretary of State mad reason to block

**** Possible New Speaker ****

First. I don't really understand what but we're in favour of AI and we're but we're in favour of AI and we're But I have to say, I have to say I'm because she's been rumbled by because she's been rumbled by Speaker, because they came out Speaker, because they came out She goes round saying how much Actually, the figures that she Actually, the figures that she is cheaper to build and operate And she used to believe jumped on the latest passing bandwagon, which is suddenly to

**** Possible New Speaker ****

Question number four, Mr. Speaker. Minister.

**** Possible New Speaker ****

Minister. Thank you, Mr. Speaker. Energy resilience is one of my top and I understand the particular and I understand the particular which do see more frequent which do see more frequent We work with industry and with investment is made into investment is made into but also that support is provided And I also want to pass those engineers and support staff who work in difficult circumstances

**** Possible New Speaker ****

when power failure does occur. With increased frequency as a result of climate change, as a result of climate change, the rural communities familiar with long periods without power. What is the government doing to What is the government doing to residents get the support And will he commit to

**** Possible New Speaker ****

And will he commit to improve the resilience Minister.

**** Possible New Speaker ****

Minister. Well, we do review lessons significant power failure, So there was a significant review But we review after every storm to look at whether there are areas we can improve. I meet regularly with who do much of the work with the nose to make sure our welfare provisions, in particular they are provided as There is much more we can do, we have to do is invest in And that does mean building and improving existing And members across the House have

**** Possible New Speaker ****

if they want to see us resilient Mr. Chris Vince. Thank you, Mr.

**** Possible New Speaker ****

Thank you, Mr. Speaker. In my constituency of Harlow is home to many rural businesses, including, as I mentioned before, recess, as I mentioned before, recess, And they say to me that actually one is the considerable increase in cost is the considerable increase in cost So can I ask the Minister how he So can I ask the Minister how he Competitive Scheme can In my constituency of Harlow,

**** Possible New Speaker ****

Well, I thank my hon. Friend and congratulate the businesses in his constituency doing such a good job. We are absolutely determined We are absolutely determined for households and businesses Schemes like the one he mentions Schemes like the one he mentions But also, of course, in the budget that households in the budget that households right across the country will As the decisions that we As the decisions that we to tackle the cost of living crisis. But we are determined to support And, of course, the long term way that we reduce the bills of businesses, of industry and of households right across the country is to remove to deliver that clean power of us have energy security

**** Possible New Speaker ****

Question five please. Mr. speaker, my right hon. Friend, the Chancellor's Friend, the Chancellor's £150 of cost off people's April is a reflection of to tackle the cost of living crisis. to tackle the cost of living crisis. It will make a difference to and is estimated to reduce by over

**** Possible New Speaker ****

and is estimated to reduce by over needing to pay more than 10% of To remove.

**** Possible New Speaker ****

To remove. Whereas, Mr. Speaker, can. Sir, based in. My Camborne and Redruth is the largest manufacturer heat pumps to neighbourhoods And I know the Secretary of State This technology delivers low but the sector requires policy Now, I know Ministers have been very but would the Secretary of State meet with me again to discuss how we can provide that certainty and commitment

**** Possible New Speaker ****

supporting this technology? Well, I really enjoyed Mr. speaker, I recommend all members to go. speaker, I recommend all members to go. It's a really innovative company. They're leading in heat pump They're leading in heat pump will shortly be publishing And that will be really, really And that will be really, really heat pump uptake and indeed heat pump uptake and indeed because there's a massive job Doctor Caroline Johnson.

**** Possible New Speaker ****

Thank you, Mr. Speaker. Mr. speaker, socialists do have and then asking them to be grateful and then asking them to be grateful So could the Secretary of If you're a tax, if one is a taxpayer,

**** Possible New Speaker ****

If you're a tax, if one is a taxpayer, how much will £150 reduction in Yeah, I'll tell her.

**** Possible New Speaker ****

Yeah, I'll tell her. We're really proud of we raised taxes on the wealthy for millions of families for millions of families And and I'm so grateful because this illustrates the difference. This wasn't an easy thing to do. It was a decision made by this this country has been run for the wealthy and powerful by that party opposite. We are changing that,

**** Possible New Speaker ****

millions of families Them to the. Dispatch Box shadow. Minister, Bradley Thomas.

**** Possible New Speaker ****

Minister, Bradley Thomas. Thank you, Mr. Speaker. This government's promise to cut This government's promise to cut the water as bills are now £190 the water as bills are now £190 Now their big idea is the eyes of the British public by moving some of the costs of some of the costs of energy bill to their tax bill. So can the Minister answer their supposed bill cut will the average energy bill be higher or

**** Possible New Speaker ****

lower than when Labour came to power? I can tell you the bills are going to be lower because if you look across, be lower because if you look across, if he just listens, if you look if he just listens, if you look energy bills are lower in real and the price cap is lower than in 2024. and the price cap is lower than in 2024. And we will be making that bills are still too high bills are still too high And I just want to and I just want to just want to highlight this point, Mr.

Speaker, because they opposed Friend, the Chancellor's budget. Yet they also say they You can't have both. It's this government that is delivering

**** Possible New Speaker ****

Well. I'm. Intrigued with numbers.

**** Possible New Speaker ****

Intrigued with numbers. Question six has been transferred. It's even. Got on to the Order Paper. Why is it so late for Why is it so late for it's been transferred and I hope it won't happen again.

**** Possible New Speaker ****

and I hope it won't happen again. Steve Yemm number seven, Mr. Speaker. Thank you, Mr. Speaker. In the Autumn budget, the Chancellor In the Autumn budget, the Chancellor billion reserve to members of the British Coal Staff Superannuation Scheme. Almost 40,000 former mineworkers their first bonus increase with an average uplift of lump sum for backdated pensions. That's the difference that

**** Possible New Speaker ****

is making to coalfield communities. Steve Yemm. Thank you, Mr. Speaker. And again.

**** Possible New Speaker ****

And again. On behalf of many former who have had that pension who have had that pension I want to thank for supporting coalfield for supporting coalfield He will also be aware of my letter last month asking about the future sharing month asking about the future sharing arrangements for scheme surpluses for both the NPS and BC triple S schemes. I wonder if the Minister could provide some clarity on how the government intends to proceed to resolve this

**** Possible New Speaker ****

Thank you, Mr. Speaker, and I'd like to thank my hon. Friend for the leadership that he's Friend for the leadership that he's And I do thank him for for his And I can inform him that I'm And I can inform him that I'm of the Mineworkers Pension of February and of the British of February and of the British Scheme on the 18th of February as well. The focus of both of those The focus of both of those with this issue of of surplus and I'm keen that this will be

**** Possible New Speaker ****

Peter Lamb. Mr. speaker. Mr. speaker, the government inherited a legacy speaker, the government inherited a legacy of huge under-investment in the grid, which piled up constraint costs and a chaotic system for grid connection, a chaotic system for grid connection, which left crucial projects We're tackling this with a programme We're tackling this with a programme including sweeping change to which saw NESO last month set out which saw NESO last month set out cutting its size by two to the generation projects we need.



**** Possible New Speaker ****

Mr. speaker, I thank Despite his rural setting, Crawley Despite his rural setting, Crawley a larger economy than many Despite this fact, it has been held Despite this fact, it has been held of grid capacity at its major connection resulting in the loss of several major resulting in the loss of several major investments under the last government. Could Minister could look into

**** Possible New Speaker ****

Could Minister could look into connection point and unleash So I think my hon. Friend makes a really crucial point, Mr. Speaker, that because there where we had something like five times as much capacity as was and the and the wrong We had massive problems for this very significant Overhauling the queue, something that will then free up demand and I hope very much that projects in his

**** Possible New Speaker ****

constituency can benefit John Milne. Thank you, Mr.

**** Possible New Speaker ****

Thank you, Mr. Speaker. Access to the grid for is very patchy across the country, and this leads to and this leads to and battery energy farm such as near the village of Cowfold such as near the village of Cowfold So what action will a fair distribution of

**** Possible New Speaker ****

a fair distribution of Well, I do know from my hon. Friend that he's had Member, and it is important that we Members. I think one of the important one slightly for the Trainspotters Speaker, is the Strategic which is going to set out power in the coming And as part of that, we should be

**** Possible New Speaker ****

the country where the right the right places to put the power that we need. Noah Law. Question nine Mr. Speaker.

**** Possible New Speaker ****

Thank you, Mr. Speaker. I am happy New Year to Members. I am proud that the Labour I am proud that the Labour the Warm Homes Discount to an extra 2.7 million households, extending million households, extending Unlike the party opposite, this is going to make a vital difference this is going to make a vital difference to so many families this winter, including approximately households in the South West.

**** Possible New Speaker ****

That is almost double that were supported year on year. Noah Law thank you, Mr.

**** Possible New Speaker ****

Noah Law thank you, Mr. Speaker, and I greatly welcome and not notwithstanding those and not notwithstanding those many of my constituents live in areas that are not live in areas that are not gas grid and where with implementing renewable with implementing renewable be prohibitively expensive to people. So could the scope of the Warm Homes in geological resources but exposed are able to benefit from geothermal reduced bills on the back of

**** Possible New Speaker ****

Hear, hear. Minister. Thank you, Mr. Speaker. I know my hon. Friend is not just a champion Friend is not just a champion but a champion for Cornwall as a whole. And in terms of the government's approach, And in terms of the government's approach, we support the development of recognise that geothermal heat recognise that geothermal heat as a low carbon source for heat networks. And obviously we will be publishing And obviously we will be publishing have more to say about that in

**** Possible New Speaker ****

Thank you, Mr. Speaker, since the advice Homes Discount has not energy bills and will struggle to touch energy bills and will struggle to touch the sides for families in energy debt, so will the Minister so will the Minister reviewing whether the £150 Warm Homes Discount provides sufficient support for families who really need it right now?

**** Possible New Speaker ****

families who really need it right now? Minister. Thank you, Mr. Speaker. This government is absolutely gripped This government is absolutely gripped And that is why in April, the cost of energy for And why? This year we extended the Warm Homes almost doubling that across the country. And we will continue to bills for people across our country.

**** Possible New Speaker ****

Josh Babarinde. Question number ten. Mr. speaker. Happy New Year, Mr.

**** Possible New Speaker ****

Happy New Year, Mr. Speaker, and I thank the hon. Gentleman for his question. DESNZ works very closely with the MHCLG. DESNZ works very closely with the MHCLG. Support for councils to the local net zero hubs like net zero hub that covers net zero hub that covers and Great British Energy, enabling councils and communities to build enabling councils and communities to build a pipeline of local clean energy projects, bringing growth and attracting

**** Possible New Speaker ****

Mr. speaker, and to the Minister to Like Lauren on Winchcombe

**** Possible New Speaker ****

Like Lauren on Winchcombe an electric vehicle to But they're being let But they're being let East Sussex County Council that has failed to invest in pavement to invest in pavement electric vehicle charging across street. So will the Minister urge So will the Minister urge and her colleagues at MHCLG to do so? To follow the lead of Lib

**** Possible New Speaker ****

and pilot across pavement electric Minister. Well, I thank you for your question.

**** Possible New Speaker ****

Well, I thank you for your question. Local councils do play I work very closely with the local I work very closely with the local and I've been very fortunate to to visit Leeds and Sheffield Labour run councils Leeds and Sheffield Labour run councils to see the excellent work they have I think he raises an excellent point on I think he raises an excellent point on ensuring that councils support local people to deliver on what they want to do and have the EV infrastructure, and I think it sounds like opportunities to learn

**** Possible New Speaker ****

Anna Dixon thank you, Mr. Speaker. And a happy New Year. In addition to those In addition to those I hope she'll join me in commending Bradford Council for its ambitious Bradford Council for its ambitious which sets out a pathway to net which sets out a pathway to net With really innovative projects in there such as the district heat network. such as the district heat network. The new investment in a low carbon jobs and a massive conversion

**** Possible New Speaker ****

So will she agree with me that other like Bradford and how to get to I thank the hon.

**** Possible New Speaker ****

I thank the hon. Lady for her excellent question of Bradford Council of Bradford Council District heat is a massive seen that firsthand for seen that firsthand for And it leads, but also, as I Secretary State was referring to in Cornwall, they've got some excellent projects. they've got some excellent projects. I think it's great to see as I mentioned in my earlier question. UK 100 and the councils at the cutting edge of and it's great to learn from them.

**** Possible New Speaker ****

Baggy Shanker. Question number 11. Mr. Speaker. Mr. Thank you, Mr. Speaker. Tackling fuel poverty is Tackling fuel poverty is We will publish a new fuel poverty We will publish a new fuel poverty that many more fuel poor and that will be at the same and that will be at the same We have also expanded to nearly 6 million households, adding an approximate 2.7 million

**** Possible New Speaker ****

adding an approximate 2.7 million Baggy Shanker. Thank you, Mr. Speaker. Everyone deserves a warm But for 20% of families in Derby this week's cold snap is a nightmare as they struggle to heat their homes. Could the Minister outline what so that families can see the benefits

**** Possible New Speaker ****

so they're not dreading Minister. I thank my hon. Friend for that question. It's a really important question, It's a really important question, and it's because of the dither and delay from the party opposite that we The energy prices are still far too high. The energy prices are still far too high. No one should have to make What this government is doing is What this government is doing is the cost of energy down and making the cost of energy down and making That includes the £150 off the removal of those costs from bills and the extension of We are also working with other to data so that we can properly and we will come forward

**** Possible New Speaker ****

Not Ellie Chowns. Thank you, Mr. Speaker. Charities estimate that households in the UK live in fuel poverty. The Minister, in his answer, didn't The Minister, in his answer, didn't but he talked about dither and delay. but he talked about dither and delay. His government has repeatedly postponed publication of the Warm Homes plan. It's cancelled previous It's cancelled previous and not replace them with So when will he publish? Finally, the Warm Homes plan? And how many of those 6 million households in fuel poverty will benefit from it?

**** Possible New Speaker ****

Thank you, Mr. Speaker. I would say to the hon. Lady is that it is worth waiting Lady is that it is worth waiting which is going to be published very soon. And as I said, alongside that will And as I said, alongside that will This will be an ambitious plan. The Chancellor has already announced £15 The Chancellor has already announced £15 billion worth of funding for that, and it will be an ambitious plan and I look forward to having

**** Possible New Speaker ****

and I look forward to having with her about that when it is published. Pippa Heylings Liberal

**** Possible New Speaker ****

Thank you, Mr. Speaker, and happy New Year. It's freezing outside and tragically over 4000 households in my constituency 4000 households in my constituency of South Cambridgeshire are As we have just heard, As we have just heard, which was the key mechanism for delivering home insulation any details of what will replace it, any details of what will replace it, risks pushing more and the businesses and supply chains and the businesses and supply chains that have been fulfilling contracts for over a decade, you know, left in limbo.

We've just heard once again, So will the Minister or Secretary of State finally confirm when it will be released? So ending the uncertainty for

**** Possible New Speaker ****

Yes, Minister. Thank you, Mr. Speaker. The Warm Home Plan will be published soon, and I look forward to and I look forward to with her about how we roll out What I would say about eco What I would say about eco targeting those in fuel poverty enough. We were spending far too much on something We were spending far too much on something that wasn't delivering the right results. Instead, what we will have under billion of additional capital support billion of additional capital support and that is in addition to the local grants that already

**** Possible New Speaker ****

which are targeting billions of But more than happy to with her when the Warm Luke Charters New Year, Mr.

**** Possible New Speaker ****

Luke Charters New Year, Mr. Speaker, and question well please. Thursday. Mr Speaker clean energy mission offers a transformative opportunity to deliver a transformative opportunity to deliver thousands of high quality jobs In Yorkshire and the Humber, In Yorkshire and the Humber, we estimate up to 20,000 and there are opportunities

**** Possible New Speaker ****

and there are opportunities hydrogen and nuclear, as Luke Charters speaker. I'm proud of your college where talented students are that will power our clean energy future. York College is now considering college under the outstanding Would the Minister welcome this and visit it to see how it's leading the way in Fe?

**** Possible New Speaker ****

When it comes to preparing for Well, I congratulate York College

**** Possible New Speaker ****

Well, I congratulate York College and I know from my own constituency going to get a second UTC going to get a second UTC The importance of this and the excitement of young people about this future. And I think there's And I think there's Speaker, by turning their they are turning their they are turning their Parties opposite because This is one of We want this for Britain. We want it for York. We want it for Doncaster

**** Possible New Speaker ****

Martin Vickers. Thank you, Mr. Speaker. Sadly, it. Is not job creation. That face many of my constituents,

**** Possible New Speaker ****

That face many of my constituents, particularly those who work The Secretary of State is aware The Secretary of State is aware bids that would have continued bids that would have continued Could he undertake to? Well, instead, we now have Well, instead, we now have buys that transfers Could the Secretary of State undertake to come to the House to answer the many, to give a statement, to questions surrounding this deal?

**** Possible New Speaker ****

Well. Let me say to him, look, first of all, that what happened at that what happened at be clear that the responsibility lies with the owner that ran lies with the owner that ran is tragic for the workers And I've talked to those workers. He will know that because of the process. He will know that because of the process. And my hon. Friend has spoken to him about this. We have the official receiver who looked We have the official receiver who looked for the best and most viable bid.

There wasn't a viable bid to keep That's why P66 was chosen, to work with them to maximise

**** Possible New Speaker ****

the number of jobs that it can Christine Jardine.

**** Possible New Speaker ****

Christine Jardine. Thank you very much. Mr. Speaker. Question number 13, Minister. Thank you, Mr. Speaker. The transition to clean energy The transition to clean energy we have for good job creation we have for good job creation With 40,000 extra clean energy That's why we published the Clean That's why we published the Clean which sets out how we'll industry and trade unions

**** Possible New Speaker ****

Thank you, Mr. Speaker. Christine Jardine. Thank you very much. I appreciate the minister's answer. I appreciate the minister's answer. And those 40,000 jobs are vital, by the many thousands of jobs by the many thousands of jobs And we are seeing an increasing And we are seeing an increasing And increasingly, people are going the skills that we need for the skills that we need for So can the Minister tell us what

**** Possible New Speaker ****

transitional training and job Thank you, Mr. Speaker. This government recognises the importance of the North Sea oil and gas of the North Sea oil and gas industry and the importance of But we also recognise that the But we also recognise that the and that's why we published which supports which supports the North Sea into these And that's also why we're And that's also why we're And bonus as well, which businesses who are investing in offshore wind to ensure that those offshore A fundamental difference and the previous conservative government that was happy for those

**** Possible New Speaker ****

in other countries in Europe. Mr. Speaker. When it comes to creating

**** Possible New Speaker ****

When it comes to creating there is no better wind farm sector in my constituency. I welcome what the government has done I welcome what the government has done to to clean up the grid connection. Q but the community owned wind Q but the community owned wind is still stalled and can't get Everyone agrees NESO Ofgem. Everyone agrees NESO Ofgem. Private companies want to but unless Ministers direct give priority to community owned I would like to discuss but also ask them to come and see how community owned wind farming creates

**** Possible New Speaker ****

wealth and clean jobs in my area. An offer you can't refuse, I'm sure. Minister.

**** Possible New Speaker ****

Minister. Thank you. Thank you, Mr. Speaker. We do recognise the issues that have been around grid connections in the past, around grid connections in the past, and actually accelerating grid connections and prioritising grid connections is something on which this government is something on which this government has taken by the scruff of the neck. And I'm sure that my hon. Friend the Minister will be Friend the Minister will be and I think we'll be a fight together to see which to visit his most beautiful

**** Possible New Speaker ****

The contracts for creation and growth of creation and growth of Yet the latest round removed fence and cut emerging technology funding. fence and cut emerging technology funding. Can the Minister explain why And will he meet with me to discuss And will he meet with me to discuss moralising Ynys Mon can get

**** Possible New Speaker ****

moralising Ynys Mon can get Minister. Thank you very much, Mr. Speaker. Tidal stream is important. I want to be clear about that. We are keen to support it and we And the hon. Member did mention for difference in supporting this. I mentioned previously And that's exactly how we're doing that, using the contract for order to ensure that through

**** Possible New Speaker ****

those jobs land in the UK. Brian Leishman. Thank you very much.

**** Possible New Speaker ****

Thank you very much. Mr. Speaker. Excellent work by the Labour and saving 500 jobs in and saving 500 jobs in That's real Labour Party values in action. But we need to do more. But we need to do more. How about investing in How about investing in owning a sustainable aviation fuel The infrastructure is there,

**** Possible New Speaker ****

the need for staff is there Yes, Minister.

**** Possible New Speaker ****

Yes, Minister. Thank you, Mr. Speaker. Can I thank my hon. Friend, for welcoming that news. Friend, for welcoming that news. And I know it was a really And his dogged determination And his dogged determination He's seen both in his constituency Of course, we are supporting Grangemouth Of course, we are supporting Grangemouth which was announced by is exactly along He talks about investment in And we're seeing many private in sustainable aviation in Teesside and Humberside

**** Possible New Speaker ****

I'm sure we'll see more Now go to Carla Denyer. Happy New Year, Mr.

**** Possible New Speaker ****

Happy New Year, Mr. Speaker. Climate change made 20. I beg your pardon?

**** Possible New Speaker ****

I beg your pardon? Question one the topicals. First of all, it's the first time. Mr. Speaker. The affordability crisis is the number one The affordability crisis is the number one issue facing families across our country. That's why we've actually taken £150 of costs off bills for all families, of costs off bills for all families, an additional £150 through for 6 million households this winter. Thanks to our decisions, last year was a record year for wind and solar power, and we embarked on the biggest nuclear building programme for half a century.



**** Possible New Speaker ****

That's what it means to good jobs and energy security. Carla Denyer thank you, Mr.

**** Possible New Speaker ****

Carla Denyer thank you, Mr. Speaker. Climate change made 2025 Climate change made 2025 and fuelled deadly extreme We know that every drop of oil We know that every drop of oil So will the Secretary of So will the Secretary of more new oil and gas the tie backs that despite the new oil and gas ban? And when developers apply for will they be required emissions in their environmental impact?

**** Possible New Speaker ****

I have to say to the hon. Lady, we've produced a world I wish a Happy New Year, but I wish a Happy New Year, but We produced a world leading which combines the just transition, which combines the just transition, the just and prosperous transition keeping to our manifesto commitment not to keeping to our manifesto commitment not to issue new licences to explore new fields. Now, it's absolutely right that we also Now, it's absolutely right that we also do tiebacks to ensure that we ensure that existing oil and gas fields Obviously, the North Sea on the details of how but it's absolutely the right thing

**** Possible New Speaker ****

Meg Hillier thank. You, Mr. Speaker. Bannister House in my

**** Possible New Speaker ****

Bannister House in my Has was one of the first

**** Possible New Speaker ****

Has was one of the first Scheme in. Hackney with solar panels on the roof. And it's got the it's the UK's And it's got the it's the UK's The forthcoming Local Power The forthcoming Local Power for others to follow Could he give some detail so that we all know how we

**** Possible New Speaker ****

Well, I congratulate Hackney Council. Labour led Hackney Council Labour led Hackney Council it is doing in relation to green energy. Unlike some who just talk about it, Unlike some who just talk about it, they're actually delivering on it Absolutely. I see Hackney as being at I see Hackney as being at which will be coming out

**** Possible New Speaker ****

which will be coming out So the Secretary of Yeah, yeah, yeah. It's freezing cold outside and people are worried about their energy bills. Yet on top of all the other costs, It's reported that he's gas boilers to pay for So can he definitively rule out

**** Possible New Speaker ****

no new taxes on people So I can absolutely rule out new levies into the energy new levies into the energy Absolutely. These reports are complete nonsense, and I can tell what we are going and I can tell what we are going and that is to turn the page because we're going to because we're going to We have a plan where they didn't. We'll have proper oversight and regulation where they did, where they didn't.

**** Possible New Speaker ****

where they did, where they didn't. And we will tackle the cost of living crisis they call Secretary of State. We're on top of calls. I know you want to get

**** Possible New Speaker ****

New Year doesn't allow for it. Mr. speaker, the rumours are he's pitching speaker, the rumours are he's pitching himself to be the next Chancellor. He didn't rule out taxes on people heating their homes for this Parliament. their homes for this Parliament. He's shutting down the North Sea, a secret deal with China a secret deal with China Energy bills have risen Doesn't this show? He's got to be the only

**** Possible New Speaker ****

He's got to be the only could do a worse job than Oh dear, oh dear. What can I say to that, Mr. Speaker? I mean, look, there's nothing. Don't don't tempt me. Don't, don't, don't don't tempt me. Look, I do want to make 11. briefly that we will be investing which will come soon. 15 billion of public investment Now they can oppose it if they like. But I think this will be supported across the country because they were an absolute failure of energy

**** Possible New Speaker ****

and we're going to succeed. Luke Myer thank. You, Mr. Speaker. Since 2021. Energy network firms have pocketed

**** Possible New Speaker ****

Energy network firms have pocketed the previous price control regime the previous price control regime known as Riio two costs households through inflated energy bills. households through inflated energy bills. With Ofgem's new price control can the Minister confirm can the Minister confirm in place to both secure but also protect from

**** Possible New Speaker ****

value for money for bill payers? Minister. Well, network companies

**** Possible New Speaker ****

Well, network companies but Ofgem has moved to correct control period so that control period so that And we are working with to make sure that we bear

**** Possible New Speaker ****

to make sure that we bear energy and that consumers from cheaper bills as quickly as possible. Pippa Heylings Liberal

**** Possible New Speaker ****

Pippa Heylings Liberal Mr Speaker Brexit came at a huge cost, excluding us from the EU's costing the UK £350 million annually. So would the Secretary of will accelerate progress Electricity Trading Agreement and energy security in

**** Possible New Speaker ****

Well, I think the hon. Lady makes an important point, which Lady makes an important point, which that we take advantage of cooperating that we take advantage of cooperating And one of the ways that we can do that is in the internal electricity market, and we will be negotiating on that basis. and we will be negotiating on that basis. We obviously have to look at but anything we can do to lower costs, but anything we can do to lower costs, lower bills and cooperate for our advantage is

**** Possible New Speaker ****

Michelle Scrogham thank you, Mr. Speaker. Without any energy security and the regeneration of and the regeneration of it would be impossible to deliver. Does the Minister agree that Does the Minister agree that the Mesh Energy Storage can play an important role in delivering can play an important role in delivering the government's Clean strengthening energy security

**** Possible New Speaker ****

strengthening energy security And will he meet energy this project further Thursday. Well, sounds like a really Speaker, and my hon. Friend is absolutely right about this. There are huge opportunities. Opportunities abound when with our global neighbours, near neighbours Indeed, to help our energy clean power and bring down bills.

**** Possible New Speaker ****

Vikki Slade Mr. Speaker. My constituents welcome particularly as it's now snowing. particularly as it's now snowing. But Andrew from Energy Arrow But Andrew from Energy Arrow of his heat pump and solar And although he says it needed reform, And although he says it needed reform, he's worried about what comes next. I welcome the Warm Homes plans coming, I welcome the Warm Homes plans coming, but what can you say to Andrew and H2 eco, another wonderful company, about the risk to jobs in

**** Possible New Speaker ****

Well, look, the hon. Lady asked an important question Lady asked an important question we've put, we're putting billion of public investment billion of public investment which I'm afraid was a failed scheme No disrespect to some of the installers, No disrespect to some of the installers, help bridge the transition for companies

**** Possible New Speaker ****

help bridge the transition for companies Sonia Kumar Mr Speaker. And I'm proud. That Dudley is home to.

**** Possible New Speaker ****

More energy and environmental scheme. That's the first net zero That's the first net zero the Richard Parker, Will my right hon. Friend set out what further Friend set out what further to improve energy upgrade energy infrastructure

**** Possible New Speaker ****

upgrade energy infrastructure he agrees the scheme should be expanded. Minister. Thank you, Mr. Speaker. Speaker. My hon. Friend is right to highlight the work of the Energy and Environmental Scheme, and I met recently with Richard and see some of these projects We'll soon publish the Warm out further plans to support but we've already allocated £1.8 billion to local authorities the Warm Homes Local grant and

**** Possible New Speaker ****

Peter Bedford, thank. You, Mr. Speaker. Since the government came to office, the average household energy the average household energy So the government's claim £150 rings somewhat hollow £150 rings somewhat hollow Now, will the Secretary of State and taxes that continue to drive up energy

**** Possible New Speaker ****

and taxes that continue to drive up energy prices for hard working families? Well, he's wrong if he

**** Possible New Speaker ****

Well, he's wrong if he because actually bills across and he should be welcoming our

**** Possible New Speaker ****

But I'm afraid his Alex Mayer. Absolutely. Mr. Speaker. A W group in my constituency has A W group in my constituency has which is creating what I think which is creating what I think But currently it gets muddled in with But currently it gets muddled in with and the company cannot have Would the Minister consider Would the Minister consider being able to sell direct

**** Possible New Speaker ****

Yeah. Well, this is exactly looking at as part of We are determined, as my hon. We are determined, as my hon. Friend rightly points out, to owned energy and to make owned energy and to make communities to connect to just the clean energy that just the clean energy that but the real social and economic too, and will publish

**** Possible New Speaker ****

too, and will publish Olly Glover Mr Speaker on Harwell campus in Oxfordshire. Constituency of Didcot commercial space based Given what we've heard today about AI growth zones and the very high does the Secretary of State recognise the potential of space based solar, and will he support British excellence and leadership in this emerging field?

**** Possible New Speaker ****

Well. We're genuinely excited about any So innovation like that, of course, So innovation like that, of course, we're very interested of technologies to achieve our targets. So I'm very happy to So I'm very happy to And I'm trying to work out whether to somewhere in space to see

**** Possible New Speaker ****

to somewhere in space to see Rachael Maskell Mr Speaker. We're really excited about We're really excited about work in developing deep geothermal heat, and believe that greater be achieved through sequencing projects, especially with hiring So, can the Minister say how he is driving efficiencies and deep geothermal, so it's more viable for future

**** Possible New Speaker ****

Yes, Minister. Well, I was really Friend recently to talk about Friend recently to talk about York and the wider developments We do see the huge potential from We do see the huge potential from about how we structure these projects, to get them forward as to get them forward as My hon. Friend Lord Whitehead in this forward with a particular

**** Possible New Speaker ****

this forward with a particular and I'm sure he'll be very Market will have gone Sarah Olney.

**** Possible New Speaker ****

Thank you very much, Mr. Speaker. We owe it to future generations, not just to have good not just to have good but to act on them. And that's why I will be voting And that's why I will be voting Not my words, Mr. Speaker, but the words of Given that Heathrow is Given that Heathrow is source of carbon emissions in the UK, and expansion will add an extra 8 to 9 megatons of CO2 to our atmosphere. 9 megatons of CO2 to our atmosphere.

Can he confirm it is still his any expansion of the third

**** Possible New Speaker ****

The Secretary of State colleagues about these issues on Heathrow. This government is absolutely clear that This government is absolutely clear that any expansion must be compatible with our legally binding We are committed to ensuring We are committed to ensuring are delivered in line with our

**** Possible New Speaker ****

are delivered in line with our Chris Webb thank. You. Paul and the College that are training young that are training young the vital renewable energy equipment but there's no jobs for them locally. So will the Secretary of me to discuss how we can

**** Possible New Speaker ****

And he's welcome any time to a sunny come and see those students So what will my hon. Friend is a brilliant advocate for his Friend is a brilliant advocate for his constituency and indeed for Blackpool, and I'd be very happy to meet with him and talk about how we can make sure that

**** Possible New Speaker ****

and talk about how we can make sure that those jobs that those young people Dawn Butler Luke Charters.

**** Possible New Speaker ****

Dawn Butler Luke Charters. If you're in Hinckley and Burbage. You can look. One way and see lots. Of. Rooftops of logistics because we're

**** Possible New Speaker ****

Rooftops of logistics because we're the heart of the logistics sector. Looking the other way you see agricultural land So my constituents rightfully say, why can't we have more solar What's the government doing with MHCLG to make sure

**** Possible New Speaker ****

Minister. Well, the hon. Gentleman is right. We should have many, many more We should have many, many more We agree with them on that. I met with the UK Warehousing the technical difficulties around the technical difficulties around We want to do whatever we can We've got rooftops across

**** Possible New Speaker ****

We've got rooftops across part in helping us achieve Tom Hayes.

**** Possible New Speaker ****

Tom Hayes. Thank you. The political situation. Is stabilised in Venezuela. Once foreign companies somewhere between 100 and £200 billion. It will take emergency repairs, and retraining and many more things to get that infrastructure and industry in Venezuela up to historical peak capacity. It could take up to 2040. Is it not easier and speedier for renewable and nuclear to guarantee

**** Possible New Speaker ****

off the fossil fuel rollercoaster, Please these topicals?

**** Possible New Speaker ****

Please these topicals? Secretary. Yes, my hon. Friend is entirely right. Home grown, clean power is always

**** Possible New Speaker ****

Home grown, clean power is always Helen Maguire Mr Speaker

**** Possible New Speaker ****

Helen Maguire Mr Speaker diesel powered transport refrigeration consuming around 235,000,000l consuming around 235,000,000l Compared with emissions these generators emit up to 400 High emitting diesel engines face a significant burden on But there is a solution zero Refrigeration technology and can be manufactured in the UK today. Government intervention would help. So will the Secretary of State

**** Possible New Speaker ****

work of sunspot who are My constituency. And can he. Order!

**** Possible New Speaker ****

Order! Order! Order, please. You've got to do topicals. And that is definitely not a topical. Minister. Thank you, Mr.

**** Possible New Speaker ****

Thank you, Mr. Speaker. Having slightly strayed into the area of the Department for Education earlier, I think it best that I stay out of I think it best that I stay out of the area of the Department for transport. I will, however, ensure that on to the relevant

**** Possible New Speaker ****

on to the relevant Doctor Beccy Cooper. Thank you, Mr. Speaker. My home town of Worthing is network but is not yet designated Could the Minister please at the earliest possible opportunity, and ensure that grid designation for advanced schemes?

**** Possible New Speaker ****

Yeah, Minister. Thank you, Mr. Speaker. Heat networks are crucial

**** Possible New Speaker ****

Heat networks are crucial I'd be more than happy to meet with Iqbal Mohamed. Thank you, Mr.

**** Possible New Speaker ****

Thank you, Mr. Speaker. Positive energy is in my constituency of Dewsbury and Batley. It has provided inaccurate It has provided inaccurate trying to build them for It has disconnected electricity It has disconnected electricity and fraudulently sent electricity bills And now Positive Electric of the standing charge for a metre. Will the Secretary of State.

**** Possible New Speaker ****

Will the Secretary of rogue suppliers and advise how we will. Protect the question?

**** Possible New Speaker ****

Protect the question? Ofcom Minister. And thank you, Mr. Speaker. If the member has details I'm more than happy to look into that. I'm more than happy to look into that. This would be a matter for Ofgem, but there's also a recourse available

**** Possible New Speaker ****

but there's also a recourse available Alistair Strathern. I'm delighted. We're investing in more supporting deployment on supporting deployment on in my constituency my requirement to have But how can we make sure that from we're not missing out on

**** Possible New Speaker ****

these rooftops could pose to Minister? My hon. Friend is absolutely right. Look, we need a mix of technologies Look, we need a mix of technologies and rooftops are And I think there's broad consensus, And I think there's broad consensus, even from those who around how much we can utilise rooftops around how much we can utilise rooftops GB invested to bring down the bills But we want to see much,

**** Possible New Speaker ****

But we want to see much, and warehouses everywhere we possibly can. Caroline Voaden Mr. Speaker, and a Happy New Year to you. This weekend, 4600 properties gas supply cut off on Now, I'd like to commend have worked tirelessly to but their efforts have been hampered by the inability to communicate effectively with residents as they relationship with their customers. And they've had to rely on social media, which is not great in an area We've also been hampered by and engineers have not been able to

**** Possible New Speaker ****

So would the Minister meet providers such as Wales Can the member order, order? I think the Minister will

**** Possible New Speaker ****

I think the Minister will Well, can I thank the hon. Lady and can I thank for engaging with me over the weekend on this issue? me over the weekend on this issue? And I'm genuinely sorry so many customers that aren't connected. The engineers are doing a fantastic job. The engineers are doing a fantastic job. But she rightly says until households are present to disconnect

**** Possible New Speaker ****

until households are present to disconnect and that is causing really but they are doing everything they can. I'm very happy. To Harlow.

**** Possible New Speaker ****

Thank you, Mr. Speaker. Bracknell Forest Council To the Heat Network Delivery

**** Possible New Speaker ****

To the Heat Network Delivery a district heat network to Would my hon. Friend agree that schemes like

**** Possible New Speaker ****

Friend agree that schemes like and residents to cut Yes. Thank you, Mr.

**** Possible New Speaker ****

Thank you, Mr. Speaker. The member will have heard heat networks are to decarbonisation. I am more than happy to meet I am more than happy to meet and they play such of providing energy across our country.

**** Possible New Speaker ****

Lee Anderson thank you, Mr. Speaker. In November last year, the energy Secretary and his entourage the energy Secretary and his entourage This was an event where the Energy Secretary could

**** Possible New Speaker ****

the Energy Secretary could Does he understand So I. Don't understand the hon.

**** Possible New Speaker ****

Don't understand the hon. Gentleman, if I'm honest. I mean, look, basically the truth is He would sell them down the river. He would sell them down the river. He'd sell down the river. Today's generations, future generations

**** Possible New Speaker ****

I don't think that's a very Tim Farron. Thank you, Mr. Speaker. 25% of the houses in my 25% of the houses in my They are expensive to heat. They are very difficult to insulate. They are very difficult to insulate. When will there be a bespoke properties with the right materials and, crucially, installed by specialists?

**** Possible New Speaker ****

crucially, installed by specialists? Yes, Minister. Thank you, Mr. Speaker. I've had very constructive conversations I've had very constructive conversations and the Warm Homes Plan and we'll have something to say on that. Thank you.

**** Possible New Speaker ****

Andrew Lewin. Thank you, Mr. Speaker. Happy New Year. To you and your team. It was a happy start.

**** Possible New Speaker ****

It was a happy start. To the New Year because we. Learned that in. 2025. More renewable energy was generated in this country than at any time on.

**** Possible New Speaker ****

in this country than at any time on. Record. Driven in particular So would my right hon.

**** Possible New Speaker ****

So would my right hon. Friend give me his New Year's resolution to continue to drive forward

**** Possible New Speaker ****

to continue to drive forward Absolutely. Mr. speaker, this is about on what we were elected. Home grown, clean power to get bills down, create jobs, give us energy security, and crucially, do the right

**** Possible New Speaker ****

Max Wilkinson thank you, Mr. Speaker. Almost a year. Ago, the Housing

**** Possible New Speaker ****

Ago, the Housing a really wonderful discussion which would see all new homes, which would see all new homes, I understand the government is on the cusp of making an announcement about this. of making an announcement about this. Can we be reassured that this is the year when we're finally going to force all of the developers to make us

**** Possible New Speaker ****

all of the developers to make us Thank you. I thank the hon. Gentleman for his question. I enjoyed being part of I've been very excited with the Minister of State for housing, who is with us this morning, and we look forward to that future home standards coming soon, very shortly.

**** Possible New Speaker ****

Final question Darren Paffey. Thank you, Mr. Speaker. Southampton is Europe's It's the second biggest container It's the second biggest container and our industry stands ready to and our industry stands ready to But they are being held up at the Nurseling supply point. So will the Minister meet with me in local So will the Minister meet with me in local industry leaders to see how we can unlock the very obvious benefits that this would bring?

**** Possible New Speaker ****

benefits that this would bring? Yes, Mr. Speaker, our team will be And I think what this shows, is the huge opportunities we have including in fantastic Southampton.

**** Possible New Speaker ****

Point of order Bradley Thomas. It is on the question. Okay. Thank you, Mr. Speaker. In response to my question In response to my question in April 2026 will be the Secretary of State the Secretary of State However, the price cut It was £1,568 in July 2024. It was £1,568 in July 2024. It's projected to be 1620 in April 26th. Can you advise on how this House can

**** Possible New Speaker ****

Can you advise on how this House can Look, we're not going But what I would say is you've unless the Minister wants to It does.

**** Possible New Speaker ****

I'm happy to respond because we're Speaker, which is that bills will lower Speaker, which is that bills will lower in 2025 than in 2024, in real terms. And the price cap was lower. And of course, making a seasonal

**** Possible New Speaker ****

And of course, making a seasonal So so absolutely we're going Sarah Olney point of order. Mr. Speaker. Speaker. I ask the Secretary of State a direct question about his former statements and how they conflict with

**** Possible New Speaker ****

and how they conflict with Would you agree with me, Mr. Speaker? The Secretary of State should I don't have an opinion. I'm not responsible. But I've certainly said that Right. Let us move on. Take care. Thank you. Beautiful. Thank you, thank you, thank you.

**** Possible New Speaker ****

It's nice to start with Universal credit.

**** Possible New Speaker ****

Universal credit. British Coal Order, order. Minister, please, Minister, you've just walked right you've just walked right Come on, let's get right to it. Get it right, please.

**** Possible New Speaker ****

Get it right, please. Universal Credit British citizens bill. Second Reading. What day? Friday, 16th January.

**** Possible New Speaker ****

Friday, 16th January. Friday, the 16th of January. Richard Tice.

**** Possible New Speaker ****

Local Government and Elections Bill. Second Reading. What day? Friday, 16th January.

**** Possible New Speaker ****

Friday, 16th January. Friday, the 16th of January. Thank you. We now come to the ten

**** Possible New Speaker ****

We now come to the ten We start with Jodie Gosling. Thank you, Mr.

**** Possible New Speaker ****

Thank you, Mr. Speaker. Happy New Year to yourself Mr. speaker, I beg to move that speaker, I beg to move that a bill to make provision relating to the registration and valuation of domestic and non-domestic properties, to make provision about requirements and for connected purposes. For thriving communities, safe places where people can live, thrive and survive, bring up their We want to see our local to grow and support to make We want to see our high streets restored to the proud The beating hearts of our communities.

My residents in Nuneaton have grown and residential areas littered shuttered up shops, empty street deter shoppers Vacant homes in disrepair are wasteful and leave hundreds of residents on waiting lists for housing to get on the property ladder. In my local area, figures have Borough Council have over That's equivalent to one in every including council leader, council leader Chris Watkins have fought to address this issue, recognising the deep impact It is literally a waste of space.

Instead of providing hope and security, I know that they are home surplus as well as the additional charges on long term empty properties. These are important levers have been strengthened by However, these measures for the full picture or scale of the problem that authorities When a property is derelict, it is often removed from the valuation list. This is because it is no longer It is no longer an asset. It was originally intended that to take place and properties without We support some of this and we do not wish to remove the whole legislation, merely time limits that exclusion.

As a result, a deregistered the valuation list unless it This has led to a situation can lie unoccupied for years. Potential wasted and eyesore, attracting anti-social the local authorities our neighbourhoods and our high streets. In Nuneaton case, we have seen with the former King's Home pub having stood empty since 20 sorry since 2008, and two houses on Stoney Road were removed from the valuation list in the year 2000. A quarter of a century stood empty while we crisis and children sleep Nuneaton is growing.

It is building the houses that we need, but we also have to use We need to use the properties Nationally, there are an estimated 260,000 residences long term empty, many of which have been zero rated and do not pay back to their local councils. I know my honourable colleagues will have the pleasure of getting constituency each week as they travel down the West Coast Main Line to Westminster. Those who venture further into the real impacts that these Nuneaton transformation Grayson Place is due to A real opportunity to redefine our town.

And yet the town, As people enter there is a row of empty sprouting out of their roofs. Three of those properties are nil rated. They hold no value, charging an empty the owners to account for the neglect of the buildings that blight my community. At the other end of Cotton Road, Honourable colleagues formerly a church left to fall into disrepair despite the property and the property still receives its meaning that it pays nothing. There is no incentive to bring these properties the assets No responsibility for And further to this, once it becomes increasingly difficult Nuneaton and Bedworth Council very but this can only do so much.

Like many councils, after they lack the financial or restore the sheer number of properties. Nuneaton and Bedworth council The Valuation Office Agency as a welcome step forward, but it is clear that current regimes and exemption to ensure that councils the owners of these empty for the state of their buildings and turn these eyesores back into assets. That is why my bill proposes remain on the register, and that all properties be given a value, and that all exemptions be time limited, ensuring that these properties are used.

The exemptions are used As noted by my hon. Friend the member from North Durham, this is an issue that impacts Updating our current registration provide us with the tools and to remove the barriers My hon. Friends and colleagues, this Bill today and We want to see the effective use of our buildings are put to use to

**** Possible New Speaker ****

and to ensure that our high Thank you, Mr. Speaker. The hon. Member have leave to bring in the bill. I do not quite. The question is that the hon. Member have led to bring in the bill, Member have led to bring in the bill, or as many of that opinion say, aye. The contrary. No, I think the ayes have it.

**** Possible New Speaker ****

No, I think the ayes have it. The ayes have it. Who will prepare to bring in the bill? Rachel Taylor Cat

**** Possible New Speaker ****

Rachel Taylor Cat Speaker.

**** Possible New Speaker ****

Speaker. Jodie Gosling. Property Registration Second Reading.

**** Possible New Speaker ****

Second Reading. What day? 16th of January 2026.

**** Possible New Speaker ****

16th of January 2026. Thank you. Right. I will now proceed to read

**** Possible New Speaker ****

I will now proceed to read Cyber Security and Resilience Network and Information Systems

**** Possible New Speaker ****

Now Minister to move Mr. speaker, thank. You very much indeed. And happy New Year to you

**** Possible New Speaker ****

And happy New Year to you It's the. First opportunity I've And I beg to move that this bill be. Now read a second time. Now read a second time. Mr. speaker, on the 3rd of June, 2024, a busy Monday morning criminals attacked Synovis, criminals attacked Synovis, an organisation that processes blood tests on behalf of our National Health Service. on behalf of our National Health Service. They did not turn up physically, thousands of miles away malicious software that encrypts files The attack had a ripple effect It delayed 11,000 appointments, blood and the company lost tens This was not an isolated case.

In the year leading up to September 2025, the National Cyber Security Centre nationally significant incidents, central government or our That is more than double the 89 of 2024. No one disputes that we can to protect the UK from these attacks. And why? Well, the UK is the most targeted The UK was the fifth most by nation state affiliated threat actors. In 2024, it is estimated that million cyber crimes in the 12 and also of that year over 4 in 10, 43% of UK businesses were Over 600,000 businesses in Mr Speaker cyber attacks are estimated to cause UK businesses almost equivalent to 0.5% of the UK's annual GDP.

Notwithstanding the wider economic or IP theft or the experience of patients, as in the first example, the average cost of a significant cyber attack for an individual business in the United Kingdom is estimated There has been a 200% increase on rail systems in the past five years, increasing the likelihood both the economies

**** Possible New Speaker ****

On that point, I'm happy to give way. Yes. Thank you, Mr. Speaker, and I thank the Minister Speaker, and I thank the Minister Would he agree as we become more I think in particularly for my I think in particularly for my the Princess Alexandra Hospital and the, the the new system they have the the new system they have that it's more and more we combat the issue of we combat the issue of from particularly from I'm foreign powers And that's why this bill is so crucial.



**** Possible New Speaker ****

Yes. I couldn't agree more. And the example that I gave brought blood transfusion brought blood transfusion which affected thousands of patients. So our everyday lives So our everyday lives And as we modernise as we modernise and digitise government, we have to make sure that our we have to make sure that our And indeed, cyber security is And indeed, cyber security is And it is not a defensive issue. It's actually very much If you see the impact it public services on the day and indeed on the issue

**** Possible New Speaker ****

he intervened on our train system. I'm very happy with that. I'm grateful to my hon. Friend for giving way, Friend for giving way, his post on the point of economic growth. his post on the point of economic growth. Can he tell us how he has sought within this bill to balance the absolute need this bill to balance the absolute need to have a regulatory framework that to have a regulatory framework that alongside being able to investment and ensuring that we don't end up with a regulatory Can you tell us how he's

**** Possible New Speaker ****

Well, this builds on which was a hangover from the EU in terms which was a hangover from the EU in terms of adopting those into this country. And this expands on that, and very And this expands on that, and very Friend previously, this is about Friend previously, this is about It's about protecting our system. So we have to find a balance between So we have to find a balance between have the powers and tools but also give businesses the confidence that they can knowing that they have security in Europe, if not the world.

And we're very, very good at this stuff. So that is the balance to be sought. But it's very much this bill rather than about And I don't mean to say this flippantly, but cyber security is one of those areas. Mr. speaker, if everything is And when it isn't working, suddenly everyone notices And that's why we're bringing forward in order for us to I'm very happy to give way to.

**** Possible New Speaker ****

Mr. Speaker. Can I thank the Minister he's saying and what he's saying and what There's much in the bill tonight But the Minister I know is a regular But the Minister I know is a regular and Northern Ireland is security companies with security companies with It is therefore essential that those jobs and enhances capacity for more. So does and is administrable. So does and is administrable. Or does he believe that this opportunity for growth

**** Possible New Speaker ****

and indeed across the whole Thank you. Indeed it does. And it's one of a number And it's one of a number the government are bringing forward to create growth across the country, to create growth across the country, The Secretary of State's those jobs are everywhere those jobs are everywhere including in Northern Ireland. And my friend the Minister has in Belfast recently discussing this, in Belfast recently discussing this, this legislation and wider with the industry in Northern Ireland.

**** Possible New Speaker ****

So I can assure the hon. Gentleman that that is indeed the case. I thank my right hon. Friend for giving way. Friend for giving way. Mr. speaker, Hackney Council was the subject of a major cyber attack in 2020. It did a good job, It did a good job, of the nature of the challenge, getting things back up and running. So this bill is very welcome. But pursuant to the answer to But pursuant to the answer to My hon. Friend the Member for Chesterfield, there are challenges for some of there are challenges for some of Shoreditch and all those tech maintain a standard on cyber And so how is he going to for those smaller companies to make sure that they can keep abreast of things, but are not so dampened down as my hon.

Friend from Chesterfield highlighted,

**** Possible New Speaker ****

But making sure we and the scope of those into and the scope of those into And I'll come on to that in And I'll come on to that in And indeed, it's about also to make sure that to make sure that and action can be taken quicker, and also that reporting So it's giving the regulators So it's giving the regulators across a whole wider scope but also giving businesses those sectors are having to report to regulators when things are going wrong and therefore swifter action can be taken.

And you can see from a whole issues that have happened in recent times, including in Hackney Lady, my right hon. Friend mentions why it is that these pieces of go through quickly, and indeed do So I'm very happy to give.

**** Possible New Speaker ****

I thank the Minister for giving But I just wondered, is there a piece But I just wondered, is there a piece in terms of the culture and when businesses or the public when businesses or the public there's a danger that employees and nervous about actual and nervous about actual And I think we need to do a job, you know, to to actually encourage people that to to actually encourage people that to come forward more quickly rather than sort of perhaps trying to,

**** Possible New Speaker ****

you know, hide it away Well, thank you to my hon.

**** Possible New Speaker ****

Well, thank you to my hon. Friend for that intervention, because whilst physical security is all of our issues, security is all of our issues, And what this is trying to regulations in order for regulations in order for other areas of the economy that like data centres, for example. like data centres, for example. And I hope that that gives industries including employees, to make sure that they can report The regulators are doing this to to give businesses confidence It's not a regulatory heavy hand.

In order for us to be I hope I can give him and the rest of the the house the assurance on that. Mr. Speaker, before those significant I was talking about why this matters and gave some statistics security activity in the United Kingdom. But it is why, because of all one of the very first things was announced this new it just ten working days in. And since then, the department has businesses and regulators to turn serious and proportionate that we present here for one that protects the public security without placing And I hope I can just repeat that again, one that protects our national security without And I do appreciate that but I hope this bill finds that balance.

So I'm confident that

**** Possible New Speaker ****

I'm very happy to give way. Very grateful to the. Minister for giving me we support

**** Possible New Speaker ****

Minister for giving me we support Tackle cyber security. What it does not do is unauthorised scraping of trusted news unauthorised scraping of trusted news This is content, as he This is content, as he without consent and compensation. So as the bill progresses, will he be So as the bill progresses, will he be maybe something like a bot register their intent when it comes And will they look at this could be protected in

**** Possible New Speaker ****

Well, Mr. Speaker, the hon. Gentleman is very ingenious he uses interventions on he uses interventions on I know AI copyright is Being a former professional musician, Being a former professional musician, and indeed one of the key and indeed one of the key So let's not push that But the AI copyright issue is, of course, But the AI copyright issue is, of course, a key issue that the government Both Secretaries of State at Innovation and Technology and Culture, Media and Sport are working very There will be a.

Be coming forward. The I think the legislation be a report to Parliament I'm sure he'll be very interested in that. And we're bringing together to try and find a way through We know it's a huge issue. It's not covered in This bill has been kept very tight in order to deal with the specific issues and the serious issues of cyber security debates and issues. So, as we know, the first duty of And the question is how precisely The answer is simple.

The UK's main cyber roles, the Network and Information Systems or the NIS regime, were years ago and have not been updated since. These rules require services like energy, water and hospitals, as well as some digital service providers like online search engines to take steps to protect the service they provide and the data they hold from cyber threats. But as you might expect a lot has changed in the cyber landscape. We've had the rise of AI, are using to their advantage.

Data centres have become a firm fixture of modern life and we want to see more. And since the rules were introduced, we have seen criminals evolve new tactics to exploit loopholes in the regulations, like the attack on the NHS that revealed how hackers can target third parties like IT companies a backdoor to bring down a wider system. So there is always the story is one

**** Possible New Speaker ****

moving faster than policymakers I am happy to give way. Thank you, Mr. Speaker. I thank my hon. Friend for giving way. And he's right to mention And he's right to mention chains here and in the West Midlands. We've recently had the cyber attack on the JLR company that had the JLR company that had not just on that company, which has its roots right which has its roots right It's an essential part brought to a grinding brought to a grinding So I'm just wondering if he this bill will help prevent

**** Possible New Speaker ****

I'm very grateful to my hon. Friend, can I thank him for all he did in Friend, can I thank him for all he did in terms of the issues in Jaguar Land Rover? I know it's very close to his heart, and indeed it was a really big and indeed it was a really big Mr. speaker, of how a cyber attack can really speaker, of how a cyber attack can really just not just affect one company, but the ripple effect And of course, the government And of course, the government billion bolster to Jaguar order to help them through I will say to the hon.

Gentleman, I will come on to this slightly later that the Jaguar Land Rover and other private organisations are not covered by the scope of this particular bill. The reason for that is that should be taking their own and making sure that those the risks to those are And this particular bill is widening existing which do not take into that. But of course, the government is working very closely with Jaguar Land Rover, Marks and Spencer and others who And because we know from the real impact they can But indeed, the had in and had this issue not been resolved, the impact on Jaguar Land Rover itself and the tens of thousands of and indeed in the supply chain and not really worth thinking about.

So I thank my hon. Friend for raising that particular issue. Mr. speaker, as always, the story, is one of technology faster than policymakers can keep up with. But today we are fixing that. So the first change in the bill is 2018 regulations to keep up with We are adding a new a few starting with large load controllers. This includes any organisation flow of electricity to It might be a company that supports Bringing those entities into scope and give consumers confidence in all of which is critical our Clean Power 2030 mission and net zero.

We are also adding large data centres their growing importance to our day These are vast digital warehouses home to servers that host everything from patient records to their bank details. This is the data that underpins all of our lives and it must be protected. And we are expanding to include managed service These are organisations that like an IT help desk to an outside client. Their access makes them as criminals can find one weak spot and bring countless organisations down.

In 2024, an attack on the Ministry of Defence, for example, compromised the personal data military personnel, As organisations rely more we have to close this gap. In fact, weaknesses in such a risk that we are going even further and allowing regulators organisations as critical suppliers. This includes certain suppliers have significant impact on Key suppliers to water companies, grid operators or air traffic these critical suppliers will be

**** Possible New Speaker ****

which we will set out in I'm happy to give you Meg Hillier. In last year, the Treasury

**** Possible New Speaker ****

In last year, the Treasury to the top ten banks in have been a number of have been a number of that cyber security is but a trend coming back from but a trend coming back from party software providers were What is his thinking about how to involve What is his thinking about how to involve the banking sector in

**** Possible New Speaker ****

Well, the banking sector of the regulators in of the regulators in and there has been a number of Lady mentions, but I think the Lady mentions, but I think the cyber attacks are no longer They're coming in through third parties, They're coming in through third parties, they're coming in through suppliers. And we've seen that in the recent And we've seen that in the recent in cloud outages with AWS So they are covered by And similar to my the answer to my hon.

Friend about Jaguar Land Rover, they will not be in the scope but we do hope that who are leaders in cyber of fairly obvious reasons, Let me also say, Mr. Speaker, I know that the recent as we've discussed at Marks will loom large in people's minds. And indeed, many members across Supply chains were thrown businesses paying the price, and that shows the ripple When one part of the system is attacked, that ripple effect into other businesses, into smaller businesses, into patients.

In terms of our public service examples So we are clear all businesses Jaguar Land Rover, Marks must take immediate steps That is why in October, wrote to the FTSE 350 companies, urging them to strengthen their to make cyber risk a board priority. Secondly, to require suppliers to And thirdly, sign up to their This was followed by a similar and small businesses in November, with bespoke advice for smaller teams. We know these actions work. Organisations with Cyber to claim on cyber insurance Businesses who best know So we're not here to regulate Government is taking this morning the government's cyber Action Plan sets a radically new will strengthen its cyber resilience.

Backed by over £210 million of investment, government departments standards to those set out in this bill. And that is why the public is not included in the scope of the bill. Because of the cyber action plan. The government should not but just get on with leading the charge Action Plan strengthens Cyber. I don't know if that was the opposition front bench,

**** Possible New Speaker ****

It's a very happy to go. Well, I welcome the obligation on the the obligation on the However, I would caution cyber security is one of those cyber security is one of those but then other priorities overtake it. And the advantage of And the advantage of is it forces Ministers to think about it. So I would just urge, So I would just urge, through Parliament to I think there is a case for putting

**** Possible New Speaker ****

the public sector in order to force Can I thank the hon. Gentleman for that intervention? I know he would have had I know he would have had when he was on this side of the chamber. And indeed the 2018 regulations came and we are all trying to make and we are all trying to make up with the technology It's a very interesting It's a very interesting which I'm very conscious I hope the Cybersecurity I hope the Cybersecurity which is backed by £210 million, we are determined to deliver that.

I am determined to deliver that. And I know the previous actions that the previous government took did not come to fruition in terms of that which is why we have and brought it forward with So it's really important for we take that forward, and I hope that he will hold us fulfilling that promise in because I do feel that public services, must take the leading role to show The real approach is to take is are as secure as possible for

**** Possible New Speaker ****

but for the people that Mr. speaker, I'm very happy to give it to you. Thank the Minister for.

**** Possible New Speaker ****

Thank the Minister for. Giving way, and also for the excellent to the importance of cyber security to the importance of cyber security Could you perhaps say a little bit Could you perhaps say a little bit success of the Cyber Security monitored and communicated monitored and communicated He is probably aware that only 33,000 Cyber Essentials certificates were and so an increased take up

**** Possible New Speaker ****

and the guidance in the action Mr. speaker, in the action plan itself, there are some key dates in there are some key dates in And I wrote to the hon. Lady, the chair of the Select Committee this morning at the publication of this morning at the publication of the action plan to lay out some of those issues so the letter will be landing. Very happy to come to the select Very happy to come to the select detail in front of the committee, and indeed the opposition benches hold and indeed the opposition benches hold us to account for delivering on this, because it is so fundamentally whether it be digitisation, winning the case with the public about and why government should be as and leading the charge on that So I hope that we can take can take that forward in Mr.

speaker, I was talking about the launch of the Government Cyber backed by over £210 million of investment, government departments standards to those that And I hope that partially answers Friend, the chair of the Select Committee. But while the focus of this it will also indirectly help businesses, including those damaged by Almost all organisations or outsourced IT or some So by extending the bill's oversight, we're preventing attacks that could, in theory, reach thousands The second change in the bill regulators responsible for Effective compliance is crucial These reforms could be but without proper enforcement So the bill will very actively.



**** Possible New Speaker ****

Clarification point. So we've talked about new powers to designate critical new powers to designate critical national infrastructure in regard Who actually has accountability? Who actually has accountability? Because I've been looking at the bill now. It says regulation made by which Secretary of State is that

**** Possible New Speaker ****

which Secretary of State is that and cross-government approach. Cyber security is the responsibility of

**** Possible New Speaker ****

Cyber security is the responsibility of the Department of Science, But indeed, the Cabinet Office always has a clear resilience issue as well. And we will heard that from who was in the Cabinet Office previously. So the Secretary of State of State will make those regulations. But there are a plethora of because obviously, if you're if you're talking about they all have different regulators. So they are being empowered through the expanded scope that are being brought for those regulators that to take the responsibility, Julian Smith extremely grateful

**** Possible New Speaker ****

On that. Point. About regulators. The industry have issued a.

**** Possible New Speaker ****

The industry have issued a. Brief which points out, quite sensibly, that these regulators are duties to perform duties to perform resources to be able to But the extra resources But the extra resources be unlocked when So is there not a danger So is there not a danger where duties will be laid on regulators to fulfil their role before they've

**** Possible New Speaker ****

Well, Mr. Speaker. We have to pass the legislation.

**** Possible New Speaker ****

We have to pass the legislation. Before the legislation may be amended. In this House, the legislation of its progress through of its progress through the regulators, in that sense, regulating until the bill regulating until the bill But we've been working, as I mentioned, at the start of my at the start of my with businesses and with experts in the run up to make sure it is in the right place proportionate on regulators. But make sure mostly, which I think is the most important thing So I'm sure we'll have those debates The process through Reading in this House of But I very much acknowledge Gentleman has said.

Mr. speaker, the bill will strengthen ranging from Ofgem to who together uphold the UK's cyber And the member took in this particular contribution because they work together to rules across those different sectors. We are raising the maximum fine while simplifying the penalty The key driving force for the punishment of rule but to incentivise firms to be vigilant. Our goal is 100% We will also be asking to change the way they report attacks, expand both the types of and the time frame in which This is a small but crucial change.

Under the current rules, about a breach once it has already caused significant disruption when traffic lights have failed or the heating has shut off. But the system does not the potential to cause like a hospital's computer on as hackers wait for Under the bill, if you are in scope, you will have to tell your regulator Centre about these types of and provide a full report Pace and speed is of the essence. This will not only give but how agencies warn before they become the next target.

The bill will also allow and consistent outcomes for One of the virtues of having agencies is that each has Ofgem understands that underpin the national grid. The Aviation Authority knows the precise but this approach has sometimes in how the regime is applied, with some bodies interpreting Today's bill aims to fix of objectives issued Across the board will send a message that no sector is an easy target in the UK. We will also be improving intelligence agencies and law with each other by providing information regulators and it is important that regulators Going to the point from the right hon.

Gentleman. So the Bill will also give them new associated with their regulatory regulators will consult on how those a statement each year to show how Together, the measures add up to a much more consistent and effective regime, with better reporting and much Mr. speaker, this bill ensures regime is not only fit for today, but is flexible enough to head I mentioned a few of the things years shifts in technology artificial intelligence But one of the biggest changes, Since our official exit from we have been unable to amend the NIS regulations without primary the rules were originally This has made it slow pace with new emerging Meanwhile, Brussels is pressing ahead with NIS 2 their forward looking update.

While we lag behind, this left essential UK services more exposed, which perhaps tells us something figures in comparison to As hackers and cyber criminals it is an unacceptable risk. So today's bill includes new powers the NIS regime via secondary to make it quicker and more If we need to respond to a new type of cyber threat. This is not to override Parliament. In almost all cases, the government still be required to consult on any changes and Parliament will any legislation made under this power.

But delegated powers are essential for keeping us as responsive as possible. When national security is on the line, we need the ability to In fact, in extreme cases, that even secretary If an ally were to be invaded by suddenly escalating So the government will direct regulators national security is cyber security guidance in a crisis, for example, these powers resort to protect our national security, and safeguards are built into the bill to make sure they are used accordingly. But let me end by saying this, Mr.

Speaker, the UK's cyber sector is It achieves double digit We have fast growing clusters of expertise in Cheltenham and in Manchester, and this legislation will doubling down on one of our And at its core, this the essential services So the lights always stay switched on, clean water always runs in the tap, and hospitals have always safe The real life community issues that This is more than a technical upgrade. It is a bold commitment one of our biggest economic strengths, and to keep the UK safe and a rapidly Working towards a future for security

**** Possible New Speaker ****

and I commend this bill to the House here. The question is to the bill

**** Possible New Speaker ****

The question is to the bill So the Secretary of State Julia Lopez. Thank you, Mr.

**** Possible New Speaker ****

Thank you, Mr. Speaker. Happy New Year to you, and thank you very much for putting the heating on. And I'm grateful to the Minister And I'm grateful to the Minister rationale for this legislation rationale for this legislation I don't know why he was demoted either, but I want him to know We as the opposition, the cyber security challenge If the pandemic accelerated technology at a pace then the advent of artificial that technology into our ways that bring opportunity, of AI and automation will not they will equip hostile states, criminal gangs and opportunists of eroding our national It is right that Parliament the collective security we on this side of the House, But legislation of this kind Cyber law takes time to develop, it's unlikely that Parliament will return to this territory for some years.

That means we must ask two very simple Will this law work? And is it enough? Before answering those questions, it's worth reminding ourselves of the real world consequences of failure, because cyber risk is neither abstract Last year, the UK experienced our most economically damaging When Jaguar Land Rover This was not a sophisticated act of though such acts are happening It was by a band of hackers, For five weeks, Jaguar operate its automated manufacturing lines. Cyber related costs mounted National economic output was visibly but the real damage did not Hundreds of SMEs in the supply chain, many operating on thin margins, Workers faced uncertainty, and ultimately the government billion worth of loan guarantees So when we consider this bill, have done anything to strengthen That is one of the tests this And it's not yet clear that it does.

Indeed. Certainly, JLR would not have as the Minister himself has made clear, because it would not have been in scope. The cyber threat landscape is New research shows that our economy nearly £15 billion every year. High profile breaches of and the co-op have demonstrated jobs and supply chains can be put at risk. Last year alone, insurers help businesses recover In fact, the FTSE 100 bill is now larger than The bill seeks to respond to expanding the scope of existing managed service providers, load critical suppliers will now That is a welcome acknowledgement has introduced systemic risks, that the original regulations of The bill also strengthens introducing cost recovery mechanisms, and it tightens incident These measures are intended to modernise our cyber framework and address clear shortcomings identified in reviews and on paper, that all sounds sensible, Which brings me back to our central practice in raising the standard The uncomfortable truth is that in some of the most high profile penetration of systems used valid credentials The breaches looked like legitimate Staff or contractors impersonated.

This bill mainly helps after an attack, not before by mandating reporting, improving intelligence sharing And as I say once again, as

**** Possible New Speaker ****

Prime Minister, it's I always like to get a bit of cross-party I always like to get a bit of cross-party agreement in the House where possible. And the question I ask the Minister And the question I ask the Minister of changing the culture sure they do report cyber to report cyber attacks,

**** Possible New Speaker ****

to report cyber attacks, I agree with that. And he is fundamentally correct And he is fundamentally correct And this is the point I'm making, that as many regulations as we can pass, a lot of the holes in our cyber security systems come down to to human frailties. And this is one of the challenges. That means it's not just about new laws. This is about changing to make us more resilient in this space. It's right not to dictate technical will soon be outdated in So the question really is whether this law is the right mix of carrot and stick to make affected firms act in a way Now, there are several areas First, there is potentially The bill expands regulatory the scale of potential fines.

But the evidence from the existing that finds a new regulations deliver Under the current regulations, inconsistent and often toothless. Very few significant penalties have the delay between incident and sanction is sometimes stretched beyond two years. That delay matters because it It disconnects accountability simply widening the scope of that regulators are properly resourced, empowered and required to act that exist on paper We also have concerns about funding regulators through levies on the organisations they oversee in terms of improving our resilience.

For large firms, the cost but for smaller enterprises operational tax that could from cyber defence staff There's also a structural risk here. Regulators reliant on fee to expand scope creating bureaucratic drag market led initiatives more effectively than I also worry more generally that The companies that thrive under the ones with big compliance concentrates risk and makes our with serious implications There may be reporting challenges, too. Again, a two stage reporting and 72 hours may be achievable for large, well resourced organisations but for smaller operators, culture focussed on speed, not substance.

There's also the danger of duplication. Many organisations reporting obligations under UK GDPR, sectoral rules and existing legislation. Without simplification the administrative load once again diverting attention cyber threat management We need to avoid this becoming a something must be done bill that misses the mark. The bill also fails to the human factor in cyber security, already talked about by Gentleman for Harlow, technology alone Governance matters. Yet board level ownership of cyber risk is moving in the wrong direction.

Only 27% of businesses explicitly responsible for cybersecurity. That is down from 38% Without mechanisms to ensure fines risk becoming little more Directors remain insulated teams are left to carry the can. National cyber resilience depends but on leadership, on culture For those reasons, ahead of we on this side of the House are examining how the legislation can continuing to support its core objectives. In the meantime, regulators equipped with the right powers, resources and clarity from Sanctions must be applied and guidance must be clear.

So enforcement is credible The government should also look at how reporting obligations are calibrated. A one size fits fits disproportionate burdens on smaller firms, and it may be better to ensure complexity and risk profile Equally, the funding of regulators There have to be safeguards expansion for its own sake, and firm assurances that directly into improving not absorbed by administrative overheads. While the bill rightly prioritises it cannot afford to that sit beyond its immediate scope. There's also a major role cyber insurance sector wide intelligence sharing and collaborative can all complement regulation.

These tools can reduce risk without adding unnecessary Finally, the review cycle set out the threat landscape we face Annual or biennial reviews to scrutinise effectiveness, respond to emerging threats and ensure the legislation remains fit for purpose. I'd like to finish by making the government's approach to If I may, Madam Deputy Speaker, issues about the risk of dependence I see no evidence from this government that it is thinking with any clarity about the risks of long term In fact, quite the opposite.

Large parts of our economy high quality digital infrastructure, a reliance that will only Whoever provides that infrastructure It was that reality which ultimately drove the change of heart over Chinese tech, sitting in the core of our 5G Now, however, the government is seemingly betting every chip on us hyperscalers. They provide our data centres, on which government They, more often than not, are the ones winning all These investments will, of course, provide our companies from compute power to increasingly But the UK is doing little against our increased And when I say technological, that technology is what we now run.

Our defence systems, factories, on technology is During September's much crowed about this government was visibly begging After humiliating Prime Minister and US ambassador, not to mention the uncontainable first budget and the threat of her second. The US, UK tech partnership with a huge amount of smoke and mirrors deployed over what had actually contained whatever substance lay within it. We heard just before Christmas used as leverage by the US while other I'm not criticising the US playing its hand in its national interest.

I am asking this government rapidly a new world in which the post-war a new world that's been given clues long before President The United States remains a vital ally. But in this new era, Britain must the reality of hard power, and the need to protect Cyber risk requires as much thought about the fundamentals of plumbing as it does about the laws that try to manage how humans use or exploit technology. The UK government has for which our own firms ought to but UK tech tells me consistently the government's AI strategy they have not got a look in I'm concerned that this new burdensome regulation for UK firms in a way that benefits non-UK compliance teams and legal resources, in a way that could exacerbate Let us turn to another risk.

The private sector will have noticed that the new obligations within this bill broadly do not touch the public light flashing large the public cyber strategy in implicit acknowledgement knowing that the public sector this Labour government but to create a brand new system mandated for And now we hear, possibly for newborn babies mandatory identity by stealth, not consent, and with no honesty about it. It is not to be against to verify themselves or to access certain online To think that Labour's mandated digital identity plan is a complete rotter.

The Association of Digital called what Labour inherited a world leading model for digitised liberty rather than diluted it. The citizen, not government in control. Now this naive government is crowding and making everyone have one of It has no idea what this system will cost, and it will not be honest about And what are the cyber Well, the system on which run was breached during red When I asked the Secretary of met the NCSC cybersecurity Whistleblowers.

Blowers have continued to speak out about the vulnerabilities of the system, and there is no sense whatsoever dodgy digital identity plan point that they are confident

**** Possible New Speaker ****

Certainly absolutely. Staggered, madam Deputy Speaker. To hear the shadow

**** Possible New Speaker ****

To hear the shadow Software testing. Practices as though as

**** Possible New Speaker ****

Practices as though as By trying to penetrate to I'm trying to find flaws in it. Isn't isn't the. Whole point of software testing to find

**** Possible New Speaker ****

Whole point of software testing to find the flaws in the system rather than parading them

**** Possible New Speaker ****

rather than parading them of Commons as though it's Yeah. I think the hon. Gentleman is wilfully misinterpreting. What I'm saying is there's not There is an issue with the fact and there is no evidence that acted to deal with those The whistleblowers continue to talk about the serious concerns on which the government's digital And he's sitting there that I might suggest that there are some concerns about the cybersecurity risk of a national digital identity platform.

And personally, I find that The idea that I'm talking that a system might be tested, of course, every system That is not the point I'm trying to make. And I think he is being wilfully ludicrous in trying to suggest otherwise. So I ask Madam Deputy Speaker can No. Can this Prime Minister keep promises? No. Can this Prime Minister No. Can he control his frontbenches? No. So how on earth does anybody think he can run a secure digital identity system? So at the same time as risking we are creating new vulnerabilities Just before Christmas, UK increasing large scale cyber targeting commercial We discovered from Ministers was subject of a major which officials believe was This in the midst of a major row over the prosecution of spies We will be looking closely at this should be addressing this cyber an approach to cyber resilience that looks only at introducing new regulations and compliance burdens risks like a mandated identity scheme, dependency on non-sovereign suppliers, the malign intent of other nations, and a failure to build and skills is one which will fail.

In conclusion, Madam Deputy

**** Possible New Speaker ****

Certainly my. Friend, but as she is. Coming to the end of her remarks. I don't think I heard anything

**** Possible New Speaker ****

I don't think I heard anything about risks of cyber attacks about risks of cyber attacks That is another potentially people who wish to cause major mischief.

**** Possible New Speaker ****

people who wish to cause major mischief. Does she agree, sir? Well, I, hon. Friend, will be aware that this Friend, will be aware that this But it is a very juicy the public sector that And I think, as I say, in the government whipped out a strategy that's meant to public sector resilience And I'm not sure that it will And this is why I think we understand that this be one part of a much at tightening gaps where they exist,

**** Possible New Speaker ****

both in the private sector but also Madam Deputy Speaker, I think it's really worth clarifying for the House that we've brought forward that we've brought forward this morning because the 2022 by the previous conservative by the previous conservative This government is bringing forward a plan that we bringing forward a plan that we And I think she should Lady should acknowledge that.

**** Possible New Speaker ****

Lady should acknowledge that. Well, I welcome it, but I haven't actually had because you always the government these sorts of documents It's a remarkable. The only way to get any information is to apply some pressure in this House. And then, remarkably, things things and I will be very interested looks like and whether it really that faces us now since the the problems and risks increased because of That is changing the changing Just as the defence picture is And my concern is that this government the various defence and security Prioritising spend on payments and all other manner of things.

And, you know, it's one thing to Madam Deputy Speaker, it's in the measures that will And I think, well, basically what is strategy documents and not It's one of the reasons why the government is so rapidly losing public confidence. In conclusion, Madam Deputy Speaker, In principle. The threat is real and growing but it can be seen as only A government that's trying to close down gaps in one place while wilfully opening up huge new risks in a different corner, is being negligent in its approach.

Further, if this legislation it must be practical, proportionate Without meaningful improvements. This bill risks placing new burdens only marginal gains when it comes cyber security is a shared regulators, industry and the public. But leadership must come is where this bill currently falls short, with the private sector taking while gaping holes remain in The bill begs obvious questions should have in flagship like the Prime Minister's As it stands, this bill high profile cyber shutdowns. Like Jaguar Land Rover's.

It does little to address the chronic vulnerabilities in the public sector, and it certainly will not make Labour's dodgy ID database any more secure. This is why, as this bill makes we will be pressing this government to ensure it delivers genuine security, proper accountability the board while taking mistakes like mandatory is no longer a niche compliance exercise. It is about protecting

**** Possible New Speaker ****

and defence interests of our nation. EA Matt Western. Thank you, Madam Deputy Speaker,

**** Possible New Speaker ****

Thank you, Madam Deputy Speaker, and may I start by welcoming this bill? It's a serious step forward in It's a serious step forward in the cyber attacks that we face the cyber attacks that we face But this legislation, as we But this legislation, as we Friend, is long overdue. Back in April 2022, when in January of that year, the then government identified issues and I was slightly bemused I consider my right hon. Friend not to have covered but there were serious identified through that consultation, and so it was then a further which the previous And, Madam Deputy Speaker, as Friend the Minister, this as he illustrated in his speech we have seen that cyber security is not just paramount to our everyday lives.

It is crucial. It ensures food on our It's the light staying on. It's critical to every corner of the UK, but now we have to move at pace, not just with this legislation, but I would urge us to go to protect ourselves from our adversaries, we need to develop a true whole of and start a national conversation This legislation is clearly a first a first chapter, if you if you will. But there must be many more written. If we are to going to we address our national security.

And I mean here our social Increasingly this past decade, we with the emergence of hybrid warfare We are living in a cyber states or state sponsored actors proxies can act with relative ease and impunity, leaving the world a more dangerous place. And it is the cyber realm that is And it is one we must seize. We, the United Kingdom, And I mean every one of us, particularly with computing and the extraordinary threats that will come from those developments, because when it comes to being the United Kingdom.

Madam Deputy Speaker now ranks third of all nations globally in 2024 alone. The National Cyber handled an average of four major These are the really serious attacks and the impact on In that same year, it cost the British economy £15 billion, or 0.5% of GDP. And when you're trying to whatever you think that that hit of while 43% of businesses have of security breach or attack for medium and large businesses, Every attack inflicts more pain and that means lower tax receipts to fund our public services.

And the effects, as we heard earlier, We're talking about Jaguar Land Rover just then and the attack, the summit, affected over 5000 businesses with many of those employees Constituency of Warwick and Leamington. The impact is significant. Right across it could be cafes, all these being affected by immediately led with Now there was the attack that was was referenced that crippled Heathrow Airport and I think Stansted was affected, but but less so. That scuppered thousands of In in in autumn of last year, and the ramifications for the for Of course, it's not just businesses.

We've seen the attacks on councils, Even the British Library, which which has meant that so much of country has been impacted education university institutions, really significantly affecting the UK. The Electoral Commission got knocked out by an attack by Chinese state sponsored. Actors, and there have Even our NHS is not safe. As my right hon. Friend mentioned about But then last year, over 11,000 NHS appointments were lost The attack in June 2024 on group kiln saw 1100 cancer 2000 outpatient appointments cancelled and more than 1000 operations postponed.

And tragically, the death of a patient. The message from across our and the UK security services

**** Possible New Speaker ****

I thank my hon. Friend for giving way with Friend for giving way with Prior to being elected to this place, Prior to being elected to this place, and social care and so I witnessed And nothing could be And nothing could be of the impact on productivity that cyber attacks have on our that cyber attacks have on our Does he as there was a meeting CCG and other health trust and one by one they were forced blinking out as the impact So does he agree with me in order that our legislation keeps up to date with the new methods are using on our state and infrastructure.

As as as online technology evolves.

**** Possible New Speaker ****

I thank my hon. Friend for his intervention Friend for his intervention Really through this, I can only relate to having spoken to organisations through the Business and Trade Select Committee, but also in my role on the National, but also in my role on the National, the Committee for National the Committee for National where hearing from those have been impacted, how paralysing it is. The immediate aftermath of such an attack and how it challenges an organisation. So these these kind of red team, blue team scenarios are crucial But when it's actually facing an entire shutdown of your systems, it is really very But and this is where we talked, many have talked about the change We do need to to embrace this urgently.

And as he says, that experience in But these attacks Madam Deputy Speaker are the new normal and we In September 2024, led by the United Kingdom, Germany, Estonia, Canada and the plethora of other allies released their clearest articulation of the threat posed by Russia They said, and I quote, for computer network operations against global targets for sabotage and reputational harm. Since at least 2020. And the NCSC annual review in 2024 called the landscape diffuse and dangerous.

While the 2025 review could It's time to act, they said in Richard Horne, head of empty shells and steel production that cyber attacks no longer but real businesses, real The recent cyber attacks And just last week, Andrew Bailey, said cyber attacks were one of the biggest threats to UK financial stability and stressed the critically important The reality should be The front line is everywhere. It's our phone, it's at our it's our infrastructure. It's even here at And such a threat requires Of course, we are not the first to let's say 18 years ago, Russia It was a damaging and debilitating The cyber attack was a call to action for Estonia and they responded at pace.

It brought about cultural change, which has been talked In the opening remarks, they political and strategic framework, and adopted a whole of society and developed a serious to counter the threats posed by Russia. Now, no doubt the Minister in more detail to understand be applied here and to our more widely to ensure whole Because the reality, that cyber attacks And so it was welcome Friend talk about companies and some of and how they should be Madam Deputy Speaker it cannot be password in the United Kingdom

**** Possible New Speaker ****

No. It is ridiculous. Every one of us must act as guardian Every one of us must act as guardian Turning to the bill itself, and desperately needed and desperately needed The extended scope of bringing in data centres, bringing in data centres, large local controllers under the NIS regulations protects more of the economy from cyber of the economy from cyber pleased to see the inclusion of MSPs, given the vulnerabilities from external IT suppliers The amendments to the regulatory step forward in improving will allow the government to to the evolving threats That said, during the last Parliament, the Joint Committee of which I now chair called cyber regulator and I would echo those calls as I believe it will enable far greater regulation and enforcement.

Finally, the improved through additional powers of State are crucial to to act quickly in real times of crisis. Now, despite all the positive and I congratulate of dithering by its it does leave large parts of As I've mentioned already, how society approach to cyber There will be many different Now, this bill, I believe, and I trust that others It's worth noting that is broadly parallel to the bill before us. However, the EU does go having added sectors, having added sectors food distribution and waste water.

Now, having witnessed in these sectors this past year, I would urge us to act legislation to address these areas. Madam Deputy Speaker, in, in in summary, I would I would just restate the bill and that the three key pillars of the legislation the expanded scope, improving regulation and strengthening as is the importance of experience The cyber attacks we've be our inflection point, Like Estonia's in 2007, we have cyber defences and ensure And now the shadow Minister what I would gently say was seized upon by Estonia at that time.

They since introduced digital ID They they looked at that challenge, that And those systems do work. It's been demonstrated by as the NCS annual review rightly asserts, the UK's cyber security is where everyone needs to play a part. As parliamentarians, we have a duty to raise the salience of this and bring about a national conversation to Finally, may I gently encourage and to look at the broader cyber and the EU is doing with and to look to introduce legislation to cover food production and distribution, manufacturing and other critical sectors.

But as I say, this bill is an important and I look forward to with the Minister to ensure that the UK and its citizens are secure

**** Possible New Speaker ****

and resilient to any future cyber attacks. EA Liberal Democrat

**** Possible New Speaker ****

EA Liberal Democrat Thank you, Madam Deputy Speaker, and a happy New Year to yourself and a happy New Year to yourself and it is a pleasure to and it is a pleasure to awaited Cyber Security And indeed, as has been mentioned today, the importance of this is significant. the importance of this is significant. The National Cyber that nationally significant have more than doubled this past year's surge in cyber attacks, from supply chains to hospitals has made one fact clear or societal security 14.7 billion.

That's what cyber attacks And behind that are attacks on M&S and more importantly, Thousands of jobs, businesses and it's impacting our public And as the Minister the NHS Synovis ransomware attack postponed appointments even been linked to one patient's death, which is attributed to that delay. This matters. We must do all that we can economy and lives depend Imagine it, if you will, as The Liberal Democrats welcome the bill's intent to upgrade our home security. The addition of data centres, managed service providers and large local controllers mean we're building stronger fences and that key to all of our doors while the wiring is also been is getting an upgrade with But the bill is leaving the back doors wide open by leaving out key sectors.

Our alarm system isn't sure and we've got the companies who have the keys to our doors using our house, asking for simplicity so that they can do their job properly. While no single cyber security these are the gaps that we to take the whole economy approach, which was mentioned by the hon. Member. We're leaving out public sector retail sectors like And indeed, this bill therefore The bill stated aims are to protect that their disruption would Yet the government apparently doesn't Local authorities essential The £10 million Redcar Council schemes are failing local authorities.

But after this bill passes, government still lack statutory protections And this is all while council I have no doubt that members of of electoral rolls or social care would also would object But we're also talking about, a potential digital ID system, a mandatory ID system for which the government would be built by a sovereign Where will the cyber What's more, leaving out sectors mean that JLS and M&S cyber These are significant major parts of our significant amounts of personal data.

As it stands, this bill marks The government claimed in response to a letter that we sent on the topic. They do not need to wait or rely cyber security requirements and will instead use the Government requirements written in this bill My question, Madam Deputy Speaker, is why do we have to have Why leave out an economically sector such as the public sector? So does the Minister agree that we need mandatory cyber security standards for these sectors of our If we're serious about about protecting citizens data, about aligning the European partners, then let us vote on it here in this and accountability in A further critical gap in this bill is the failure to embed security by design, to ensure and also a lack of this should be board led each door, each window of our In 2019, NCSC published Design Principles.

Last October, the government design framework as core to Yet this bill not only excludes government from critical national infrastructure, it abandons this key principle, This matters, especially by Isc2 suggesting that skills shortages are the number one challenge for complying with cyber regulation in the UK, with 88% of respondents This is also a missed opportunity for our economy and our cyber security sector. Prioritising security by design would protection our critical So what considerations does the government have to ensure this security? By design, an effective mean future proofing, it must be workable.

While we welcome the expanded definition risks creating burden over reporting that than strengthen our Those coming to upgrade our security are not being given the clear directions. The current definition of could that it even link So how will the NCSC feasibly burden when the alarm may Other critical terms lack including managed service provider and the criteria for digital As highlighted by techUK and others. These aren't just technical they're the difference between a bill and the industry needs So will the Minister work tighten these definitions Will the Minister consider and effectiveness for incident reporting? Furthermore, what is being done to support Home-grown cyber security in the UK? What is being done to defend from What with one of the latest defence What is being done to support UK tech? as highlighted by the Open Rights Group, this is yet another missed our domestic tech sector be building UK cyber security capabilities and creating high skilled How can we claim to be resilience when the very infrastructure protecting our critical systems could and supporting UK tech just about the providers in this bill, it's about the thousands of SMEs who For those few SMEs affected by this bill, it creates a red, glittery thicket of overlapping rules, different timelines and multiple bodies.

Cyber security is complicated, it must be simple and easily So what support will there be for Furthermore, it would be the wider cyber crime landscape. SMEs make up 99.8% of UK the most vulnerable link The NCC Group confirms manufacturing, by SMEs with the most targeted This is why the Liberal Democrats to establish a digital A nationwide first responder service support to small businesses that Australia is already doing this, providing person to person support So if Australia can do that, why can't we? And on top of this, Madam Deputy fraud and cost the economy Two thirds of all fraud begins social media companies with no liability.

Which is why the Liberal Democrats are calling for social media platforms to be made financially viable creating a clear line of More than that, fraud is It exploits weak systems Families lose life savings. Elderly people fall victim Small businesses shut down while that protects infrastructure It also ignores and livelihoods amended The government must address in We cannot protect systems but abandon our businesses and everyday people. This bill is progress, The cyber threat is real, The Liberal Democrats to strengthen it through amendments, but we must ensure that we're that we're future proofing our security.

We owe it to our businesses, families and our national

**** Possible New Speaker ****

Thank you. Chi Onwurah.

**** Possible New Speaker ****

Thank you, Madam Deputy Speaker, and a happy New Year to you and to all in the House and to the staff as well. in the House and to the staff as well. And it is appropriate that we begin 2026 And it is appropriate that we begin 2026 by talking about an issue in this House, which is of grave importance which is of grave importance but which we do not. It's not talked about enough here, or for that matter, across the country. And that is, of course, cyber security.

At the start of this only a quarter of the UK Today, almost 98% of the UK and 68% We each spend between 3 depending on our age and interests. And for many, perhaps too And even when you're not online, the infrastructure of your life is whether you use online banking or not. Your bank account details will be The same is true of your health your child's school records, the safety sensors on our your Christmas marks and Spencer's The Prime Minister said is the first responsibility I hope the House can all ensure the security of the British people.

As we go about our and that previous governments have enough or done enough to So that's why, as chair of the science, Innovation and Technology Select Committee and a self-confessed tech evangelist, I welcome this legislation other members of The committee has not examined cyber but we have expressed regard to public sector data management. For example, after the Afghan Currently, as we have heard, the UK's legislation is that inherited Since Brexit, the European Union leaving the UK working under Meanwhile, nationally significant the National Cyber Security Centre The NCSC also warns that increase both the scale And let us remember that when everyone can hack and we need to threaten not only our national And in November, the Bank of England cited for the first time a major cyber attack that on Jaguar Land Rover as a factor in its decision to hold interest rates.

The JLR breaches, estimated to have cost the country the economy almost £2 billion. So that's why I welcome this bill, the scope of to new sectors, making regulators more effective powers to respond to the ever However, I must be clear My main concerns relate to large load controllers and managed service providers in scope of regulations, which is right and grants competent critical suppliers who are vital Yet, as we have heard, some sectors remain outside Retail is the UK's largest handles huge volumes of runs complex supply chains, often making it a prime Yet it is outside the scope of the bill, so the legislation would to prevent the attacks the Co-op or Jaguar Land Rover, So much.

So now I welcome the government's plan to promote the new Cyber Governance Code of practice to improve But even after high profile breaches, cyber security is still not And a recent report by Audit and Control Association, ISACA, shows only 56% of company boards take and that is after JLR. So the the the Minister did say that it was up to should to manage their own cyber security. I agree with that. But I wonder if you would how the government will assess and what he will do, what If there is evidence that their their cyber security citizens are not adequately because without a way to monitor large parts of our economy remain exposed.

ISACA recommends a statutory and effectiveness of Powers for regulators to mandate periodic external resilience assessments, including penetration testing as well as requiring organisations individual who meets defined Now, government departments, bodies such as the BBC are weaknesses in public which have been highlighted Now, as the National Audit the cyber threat to the UK government And we had the cyber attack which is a clear example of how We need greater rigour to and build the public the implementation of ID and other digital Now I've not been able to study in which the government published I will look for clear it comes to implementing the government's action plan and ways in which we have spoken about in this debate, which is needed within the public as well as the private And the Secretary of State that the government would, and I quote, assess the improvements the UK cyber defences through regular engagement with NIS and monitoring the incidence So I would welcome I would welcome commitments reflect the statutory Clauses 20 to 22 or the additional policy commitments and how they will be funded.

Finally, small businesses. So the bill rightly focuses on But as we all know, you are weakest link and the supply national infrastructure involve many small businesses who may or may not depending on whether and how Can the Minister say at how quickly whether they have been designated Now, I support the bill's proposals for mandatory cyber incident reporting. I recognise the value of and publishing data on but I share concerns raised by the ABI and other speakers about the feasibility of small businesses meeting particularly submitting and the NCSC within 72 hours.

We have seen that Cyber so the the programme to help businesses, particularly small businesses, achieve the cyber security that is is low amongst businesses. As I said, 30, 33,000 in in 2024, cyber insurance take up is also so leaving them vulnerable both in Can the Minister say a little bit If this bill is to succeed, implementation must be done So I echo techUK calls for clearer and additional support to help small So, Madam Deputy Speaker, the Minister can address Specifically, will the bill to economically its current scope and empowering stronger cyber governance Will the government consider including cyber security and resilience including local authorities Will the government clarify whether the Post-implementation reviews monitoring of cyber incidents and engagements She has outlined to my statutory requirements within the bill.

Will the Minister ensure reporting and information are implemented in way for small businesses? Will they take steps to support Finally, will they ensure on information sharing requirements and provide additional support to help Madam Deputy Speaker, we cyber and cyber security on some of the national which my which the Minister and my hon. Friend the Member for described very well in his speech. But this is clear. This is this is an issue to get more important both from a national security and economic safety and security perspective.

So if we can get extending it as necessary, working with industry, supporting public trust then I hope we can build a nation

**** Possible New Speaker ****

but paired prepared for the many Sir Oliver Dowden. Thank you, Madam Deputy Speaker,

**** Possible New Speaker ****

Thank you, Madam Deputy Speaker, and it's a pleasure to follow the hon. Lady for hon. Member for Newcastle upon Member for Newcastle upon tremendous expertise to this debate. tremendous expertise to this debate. In my previous role overseeing national In my previous role overseeing national coordination of national security threats. Cyber security was probably me the greatest number There's been a lot of talk about the increased need and the steps that need to be taken We all know from past experience that the first line of attack of any attack on the defence of the realm is highly likely to be through cyber attacks.

And indeed, in a completely we only need to look at the public comments of the president of in terms of the first steps took in its intervention in Venezuela, he talked about capabilities States had to knock out And if we look at our North Korea and Iran, we can see that they are and encouraging environments where cyber attacks can be whether that's explicitly or with the connivance of the state. A deliberate grey zone is created there with the desire to increase knowledge of the risks to cyber in and to carry out penetrative And we are likely to see this grey as a result of actions that we and we just have to look at If one looks at what happened Members have made this point, cascaded and affected many and certainly from the government's And again, it's in the public that one cyber attack can electricity system that rapidly which is dependent on rapidly cascades into So before long, a small cyber very large cyber attack.

And in common with most other, in the United Kingdom is highly something that a point from the despatch box in this House. I do welcome that has outlined today and this legislation, I would just like to gently caution and I don't think it was his intention, but he said that this legislation It won't fix the cyber security problem. No single piece of to fix the cyber security problem. Nor is this a question of The government, the last This government is doing nothing.

Each government has to a fresh look at the challenges of cybersecurity and take necessary and proportionate steps to address the risks of cyber security. So in that context,

**** Possible New Speaker ****

Yes, I will give give way to the hon. Member. I thank the right hon.

**** Possible New Speaker ****

I thank the right hon. Member for giving way given It's very interesting to to hear what It's very interesting to to hear what And this is not to criticise but but if the here and now does but but if the here and now does an absolute focus from across an absolute focus from across because it is such a crucial

**** Possible New Speaker ****

I totally agree with him. And indeed, that is what And indeed, that is what working in conjunction with and I know continuing under and I know continuing under has one national cyber security centre set out the whole of government approach. It can't just be the actions It can't just be the actions Ministers or individual The whole of government needs The whole of government needs of further steps we could This goes to the intervention I do think that more pressure needs in terms of their accountability and I fear that the risk if we don't it's something that can slip Ministers in trees, whilst Ministers Other, more pressing, immediate So the some constructive could be improved in respect The first is this point about many to to secondary legislation I don't have a problem with that.

I think that's it's essential that we have a framework piece of legislation, and then we have the flexibility to be brought forward to address I would, though, urge a meaningful and mandatory secondary legislation that businesses and others I would also caution against to regulators their duties in Too often I've seen this, in with governments of both colours that regulators are empowered to address cyber security problems or any other problems. They then charge off in one direction. They fail to take into account So the impact of these regulations and Parliament ceases to and Ministers cease to So I would urge Ministers to and the instructions that they give them.

I would also be a little of the arguments made by other hon. Members about the need to constantly expand the scope of this legislation to further and further areas It's all very easy for talk about the need for When one is a small business of legislation being it looks a very, very daunting prospect. So my preference would be to continue seen through the whole of society Also, in terms of proportionality of this, I would urge Ministers to embrace AI.

The the opportunities that to triage incoming attacks I think there's a lot area in terms of streamlining the system. On the flip side of AI, very seriously the risk intelligence poses in And it appears that we in November last year, November 2025, when anthropic reported disrupting scale cyber espionage campaign we are likely to see So I'd welcome from the Minister in his concluding remarks what the government intends to do to ensure that because we are only in the foothills Further to this point on 40% of incidents handled by I was the responsible Minister So I do question the exclusion I appreciate there's this this plan I haven't had a chance but I can imagine broadly what I think the the key thing, though, is what's the stick that is and Ministers outside the core government departments responsible for this, to make sure that they actually take So I think some legislative proposals Similarly, in relation the the the core responsible departments for the Cabinet Office and the DSIT I fear that other government So I think there is a strong cybersecurity budgets for be transferred to more as was often the case, particularly, I also think it's very important It's very easy to talk about legislation.

It's very easy to talk in high Probably the single biggest thing to deal with cyber risks is every single business and every one of those annoying pings you need to upgrade your software Same with your PCs That's being done by providers is a cyber risk there, If that patch is dealt with immediately, in terms of the resilience And that's a message that I think we also need to look at our for when we have a major cyber attack. Now we have had major cyber attacks, but they have tended to albeit with cascading effects, That is one that either flows out or is a deliberate attack that cascades widely affecting our electricity, I fear it is only a matter of and I think we do need to look at whether that's the ability to as electric torches and battery I think more work, which needs to be done in that space.

And I also think we need to look at the question of emergency communications. Certainly my experience, sector broadcasters such as the BBC are not required to take from government in such situations. I think that is a loophole that could And finally, just more broadly again, we are at the foothills We are going to see vast impacts how people can lead meaningful lives as AI advances more and more rapidly, and in terms of resilience of our society, I think this House needs to not for this piece of legislation, but more generally about how epoch changing challenges So, in conclusion, Madam Deputy Speaker, I think this is a welcome It's an important step forward.

There are very important Friend, the lead spokesperson for that needed to be addressed passes through the House, but I think it is But it's only one step. And once this legislation is over, we need to be prepared to return to this issue again and again and again. Thank you.

**** Possible New Speaker ****

Anna Gelderd. Thank you, Madam Deputy Speaker, I'm pleased to support this bill I'm pleased to support this bill a constituency of hard communities where digital access remains communities where digital access remains a problem and where long and alternatives when systems fail. As we know, digital connectivity is As we know, digital connectivity is from traditional farming from traditional farming to carers supporting vulnerable residents, access to online job sites, online services and emergency support are So reliable digital protected from disruption and from attack, is essential for our services and our community safety.

That is why I'm supportive of has taken to improve Actions such as which Labour has put in place to tackle the barriers that stop people The rollout of Project Gigabit, reach areas are not left behind, an important landmark partnership between government and mobile network operators that Labour continues to support which I have to say I know only and improve 4G coverage Improved connectivity and cybersecurity, enables remote working, improves access to those and helps young people build their job opportunities and government support.

It can also strengthen ensuring communities stay and are better able to adapt My goal for South East Cornwall is resilient and safe left behind because of and I'm pleased to have been raising constituents concerns with Ministers and working with them to improve Those digital systems must also be secure. Cyber attacks carry real businesses and our wider economy. Businesses in South East Cornwall create local jobs and support And there are practical steps The National Cyber Security Centre but it also matters that businesses know that their government is acting to protect them as they navigate This is why I welcome takes to strengthen our cyber resilience.

And I ask the Minister what and response planning should for rural and coastal communities last longer and the impacts The bill also presents learning and employment improving cyber security demand for skilled professionals. It creates pathways into good that matters for us in where we want our young people without needing to leave It also matters for diversity. Our services are stronger and protected by people different experiences Work in this area can open the doors for young girls and women into Stem careers, and help break down have been felt by women whether at entry level, in or in leadership roles.

The Secretary of State for recently welcomed the Women in Taskforce to bring government and industry together to identify and dismantle those barriers, and I look forward to seeing the benefits reaching the women and girls in south. It is also important to recognise a key element of our national Staying up to date and agile is essential, particularly as advances in AI for testing for strengthening but also present new We have world class research brilliant minds that can security and ensure that and prepared for those future attacks.

The work that this the bill updates so that we can respond to and better protect our communities, as well as safeguarding sensitive But of course, there is room for And with the nationally just across the river many of my local residents cross and a serious cyber attack It could compromise secure readiness with real My local livelihoods So supply chain resilience is especially important here in South East Cornwall, as many Cornish businesses support energy and infrastructure.

So ensuring that our services protects both local suppliers and it is essential that UK defends itself and protects security at home and abroad. So can I ask the Minister how clear expectations on Cyber resilience, practical suppliers such as those and strong incident recovery infrastructure and the SMEs For South East Cornwall, this speaks to resilience It supports secure services, new opportunities for skills and jobs, new opportunities for women and girls, and the confidence that the systems So I'm glad to support it.

And the action that this

**** Possible New Speaker ****

to keep our digital future safe. David Reed. Thank you, Madam Deputy Speaker,

**** Possible New Speaker ****

Thank you, Madam Deputy Speaker, and I very much welcome the opportunity to speak at the Second Reading of the Cyber Security and Resilience Bill, the Cyber Security and Resilience Bill, a bill that addresses one national security challenges of our age. national security challenges of our age. And we've heard many from honourable and right hon. Members across this House so far. Members across this House so far. Today, before entering Parliament. Madam speaker, I spent to protect our country from cyber risks. My background in software engineering gave me a rare view under the bonnet of the systems that underpin almost I saw first hand how our and just how vulnerable I really love that work, and I'm we are genuine world leaders.

But I would be dishonest It did not leave me not because of any single threat or actor, but because of the sheer scale, complexity and relentlessness Those risks are only accelerating. With advances in artificial and the advent of quantum computing. These technologies have heard today in ways that we are only just and we must adapt alongside a serious technological Our lives are now dependent on from water treatment plants financial markets, healthcare And I think it's fair to merely supported by We are built upon it.

And when those systems fail, they are immediate, they are human, And we've already seen that We cast our mind back to May 2017. The WannaCry ransomware attack tore Tens of thousands of Staff were locked out of patient records, diagnostic systems and telephony. Ambulances were diverted. Thousands of appointments including urgent cancer referrals. At the time, the estimated cost But the human cost, the loss of confidence cannot be And the crucial point that we've The attack was not targeted at the NHS, but the NHS was particularly was reliant on outdated and the fragmented digital assets owned.

It was a warning shot that More recently, the private sector Capita very recently was fined 14 that compromised the data of British Airways and Marriott breaches affecting hundreds resulting in substantial penalties These were not small firms. They were sophisticated organisations with scale, expertise and resources. And yet they were still exposed. That is why this bill matters with the government to ensure crucially, that we build the ability As the technology Whilst referring to Friend the Hertsmere not on businesses and organisations as the UK's first piece of legislation to include cyber security in its title, the Cyber Security and Resilience Bill represents an important step forward.

It modernises the Network framework brings new sectors into scope, including data centres, managed service providers and critical suppliers. Strengthening incident reporting powers and allows government I hope when national security is at risk. I welcome these objectives, in particular recognising that managed service providers and supply chains are And that is an absolutely correct point. Cyber threats do not respect and our regulatory framework However, Madam Deputy Speaker, this bill must not be treated Cybersecurity is not solved And while the bill strengthens protections for critical national infrastructure, it leaves significant questions address if we are serious One of the most pressing is the growing complexity Organisations already face overlapping, overlapping obligations sector specific regulation reporting requirements as that multiple voluntary reporting becomes fragmented and very confusing.

And having been a small when you are dealing with marketing, marketing, advertising, it becomes almost a difficult having to have these extra With reporting added on. The first hours of cyber systems are down, decisions staff are under immense organisations to navigate regimes in that moment risks distracting them from the most important task, which is, as we all know, containing A unified reporting framework of contact and aligned burdens on businesses whilst of information available to governments.

This bill should move us not further away from it, and I look forward to to working with government We must also be honest about and the Minister referred to While the bill focuses rightly on critical national infrastructure infrastructure, many of the most damaging years have occurred outside its scope. Manufacturing, retail and consumer and the attack on Jaguar Land Rover, as it's been referred to by Members, today estimated to cause across the company and its supply and I want to put this point on record that I'm also deeply concerned about the precedent being set when required to act as an insurer of that have failed to adequately For large firms that are the expectation that the public will Responsibility must sit squarely with the boards and executives to invest properly in cyber security And I am glad to see that steps to having that At the same time, small which make up the vast are particularly exposed.

They often lack the skills, to implement proportionate cyber defences. Yet they sit deep within as a single weak link can have cascading consequences far beyond the organisational organisation directly attacked. If cybersecurity is economic security, We need a whole economy approach. That means combining support and standards across the UK plc, not This should include stronger, secure by design products embedded through procurement accessible support for smaller businesses, potentially including First responder model to help small firms recover quickly from cyber attacks.

We must also address Cyber skills shortages are and compliance and regulators themselves. If we are to give them more powers we'll need additional technical deliver the expanded responsibility That capacity cannot be assumed. It must be planned for, funded Finally, Madam Speaker, I want to The Computer Misuse Act a time when fewer than 1% of Its blanket prohibition on to distinguish between malicious attackers and legitimate cyber acting in the public's interest. Now that matters, vulnerability are essential to defending our systems.

Yet many professionals in that industry operate in a legal grey area where carrying out work that ultimately Updating that framework, protections for reasonable research, would modernise the law In conclusion, Madam Speaker, It strengthens protections for critical services and sends a clear signal that cyber security is a core But legislation alone resilience that requires coordination, clarity, capability and an honest understanding must be strengthened as it moves through. Parliament's cyber threats do not and I support the direction of and I urge the government to engage so that we can deliver lasting protections for our

**** Possible New Speaker ****

And the British citizens. Thank you, Dame Anneliese Dodds.

**** Possible New Speaker ****

Thank you, Dame Anneliese Dodds. Thank you. Very much, Madam Deputy. Speaker. And a very happy New Year to you, to all the parliamentary staff and indeed to all the parliamentary staff and indeed to all members in this chamber. It's a real pleasure to rise to speak It's a real pleasure to rise to speak which I am really pleased to see and, of course, a pleasure and, of course, a pleasure the Member for Nick Smith and Exeter East. He, of course, set out many of And we also saw that, of course, in the opening speech from my right hon.

Friend for Edinburgh South, he described a number of as have other members during this debate, and he set out some of attacks with some really And just as with my friend for Warwick I was struck by the 0.5% hit to GDP coming from cyber attacks been the third most severely It is therefore very welcome that more joined up approach to deter I believe it has gone alongside a really strong grip from the new government. On the need for a sectoral approach Of course, unfortunately, we had JLR and I was pleased to see I know the current Secretary really engaging with on the challenges and lessons that need to come out of that attack on JLR.

And that's particularly Given the significance of BMW Cowley Madam Deputy Speaker, I believe cyber security alongside other as indeed, I note, the head of Cyber attacks are increasingly being actors that operate in the kind Member for Hertsmere has just often implicitly backed by They are taking place at the same laundering and disinformation operations. And I have to say that, sadly, I am forced to share the security focussed think tank, without an effective Western response. There has been an escalation in disinformation and political interference.

But we have not seen across like minded democracies I was assured recently by my right hon. Friend for Torfaen that with the EU on combating That work clearly needs to be intensified, especially when we see what is happening to other democracies not so very I saw the threat from where cyber criminal methods are A cyber attack on the election a disinformation campaign and disruptions like bomb So while I welcome this legislation, work to protect our country's and to secure transparency In that regard.

Madam Deputy Speaker, I want to end by mentioning a concerning development, the sanctioning of two British citizens by the United States over Both have worked to deliver transparency, including on foreign interference, clearly relevant to this bill. Imran Ahmed is from the centre It's dispassionate, has uncovered the spread violent racism and material Claire Young Salford is from It provides information about the extent of polarisation and disinformation, so companies can make informed A free market approach to My right hon. Friend for Edinburgh South stated at when national security is on and I strongly agree chamber during this debate have said how important it is that we and cross society I believe the sanctioning risks chilling transparency, including potentially transparency that can uncover foreign interference.

So lastly, I hope all attempts to reduce transparency. The welcome efforts in this must be accompanied with work to counter other cyber and information to our national digital sovereignty and, more broadly, threats to our

**** Possible New Speaker ****

Thank you. Yeah. Bradley Thomas. Thank you. Madam Deputy Speaker, I'd like Madam Deputy Speaker, I'd like my broad support for my broad support for This is one of the biggest and we're living in Every day, there are Every day, there are that take place on private companies, that take place on private companies, publicly owned companies, infrastructure. This is probably the most hostility that we face, that the vast majority of the country and our constituents are unaware of.

And that's a good reason. That's because there are working in the National in the intelligence agencies across private industry, do But that does not mitigate the fact and it's only ever increasing not just because of but because of the threats that particularly Russia, China, Iran and others JLR is particularly prominent The Jaguar Land Rover the whole country and affected it had a particularly profound where many of the Jaguar Land Rover what happens if we fail to invest Such a deficiency in investment only seeks to enable those who seek to do us harm.

And the point has been made just they're not just They are fundamentally digital For all of us. Madam Deputy Speaker, in particular that I'd like to emphasise, one that I haven't heard which I think is within the scope of this and somewhat adjacent to at the same time, which is around the role of foreign particularly kill switches. We're seeing increasing numbers particularly relating to Questions have been raised on numerous occasions on the floor of this House around the prevalence of kill switches in Chinese technology in particular, and the risk of the risk of abroad that could destabilise And I particularly would like to see a joined up approach from government across the whole of government not just viewing this And I know that Ministers will be but I would appreciate if the Minister, when he's winding up, could this is being looked at.

Another particular case is It struck me around 12 months ago. I rarely saw a jku car Now they seem to be everywhere, and the links that these manufacturers that there are potentially kill but more importantly, that these vehicles are sending adversarial state around And the implications of that The final point that I'd is around the reporting regime. I introduced a ten minute rule bill ago that touched upon and calling upon government to have to the reporting obligations on I suggested a threshold of £25 a company would be within The reason I chose that have omitted the vast family owned businesses within a one of the 13 And the reason for that was simply obligations on small And for many businesses, with regard to cybersecurity could result in significant additional headcount that they may not be able to afford.

So I'd actively encourage possible with representatives that the reporting obligations whilst capturing the broad But to put on record, I support the broad principle of this. I think it's a step in I hope that government will adopt have an obligation and a duty to fulfil, and I look forward to seeing

**** Possible New Speaker ****

as the Bill makes its Sarah Russell. Thank you, Madam Deputy Speaker,

**** Possible New Speaker ****

Thank you, Madam Deputy Speaker, your team and everyone else in the House. It is no overstatement, I don't think, It is no overstatement, I don't think, to say that this is one of and I suspect that if we weren't and I suspect that if we weren't it would only become apparent been when there was a major been when there was a major And I think it's one of government that hopefully we are managing. And I touch wood as I say this, but to stay ahead of national security relating there's just there is nothing And I think it's exactly what our And I wish they saw more of us doing this, discussing it on a cross-party So it's welcome to see the government And I particularly want to discuss the enhanced incident reporting duties on the digital service providers in the bill and the duties to inform customers.

In short, I have real concerns out in practice because advised whistleblowers in that when there are that unfortunately some corporations complying with them than they do Now, it's an excellent I'm not suggesting that it in any other way than it but I think we need to look at our because at the moment we protections for in employment and outside of So in relation to contractors and if we don't make sure that they can anonymously report breaches and the right protections for when they are raising the concerns the excellent provisions So I just want to impress very important I think it is looked at in that wider context.

Also, within that wider context, that lots of us have sort of specifically identifying it about society and the costs of those risk to national security, risk to individuals So whether that's directors and about how we ensure within our country is that major data centres and other big the economic benefits and that They're absolutely crucial to us, but that they take in our advanced economy and therefore the taxpayer, carries all of the risk And it's great to see provisions allowing for financial recovery in terms of that enforcement And it's also fantastic that and the finances associated with that.

We're looking at up to terms of potential fines So in terms of, you know, my always that I want to know And I think there are good here and there's plenty of money, you know, that could could That incentivises the kind of But as I said, I think we need to look at that kind of broader societal piece about how we balance the risks and opportunities in relation to tech in general. Now, I was going to talk quite a bit public services and how they can the legal aid agency Cyber Attack the details of anyone who'd applied I mean, the scale of those individuals can't be overstated.

The amount of personal data that Six out of ten secondary schools We have the Cheshire Cyber which is in place to help local their cyber risk five members of of staff So, so our local police powers are steps to improve the situation Schools in academy trusts are money on cyber insurance to And we've seen schools by their inability to open So the public sector action plan this morning is incredibly And I really look forward to go through it in more detail.

But we again need to look at where the balance is of cost within our society. I would like to add to those we should be reviewing in terms of how the lack researchers doing important We obviously have several currently engaged in cyber security work. The Alan Turing Institute We need to make sure that And because actually this is with the complexities of AI adding making sure that everyone job effectively in protecting individuals, businesses and our wider society.

So lastly, I would just need to move as quickly as we can on this, and it's great that we are the only way that we can and to have considerable many of which have now got much is if we work in conjunction And I think that that's what our relationship with the EU So thank you to everyone who's been I think it is absolutely completely the right direction of travel. I think it is a shame that this The fact that the government is even when it frankly is not likely It's about doing the work, getting moving forward productively, cross-party, where humanly possible, securing that our economy is on a strong footing.



**** Possible New Speaker ****

And there's everything to Thank you. David Chadwick.

**** Possible New Speaker ****

David Chadwick. Thank you, Madam Deputy Speaker. Cyber attacks are a growing Cyber attacks are a growing Cyber attacks cause chaos for all types both small and large, both small and large, and the consequences of those The disruption caused by cyber The disruption caused by cyber M&S and the co-op were further down their supply chains. For instance, the disruption that for their steel supply So much of our economy digital platforms and functions. Last year, many Lloyds Bank to access money or pay their That was a problem that decision to close high street branches.

Yet, bizarrely, Lloyds still Charlie Nunn, £5 million in 2024. I make this point just to illustrate we're seeing at the positions at despite the massive numbers of people a successful cyber attack in people having their And that's why it's welcome sensible requirements to consider supply chain risks and their usage of managed service providers, as well as many others. On the other hand, it will be sectors have not been food and drink and retail, particularly considering as those the government would clearly like to it would help if the bill greater certainty For instance, how are relationships with managed For five years I worked in starting with which of course happened at the same And I found that the cyber security sector is a well connected community, one underpinned by to sharing knowledge and best practice.

For instance, Cyber Wales that brings together It's an industry that law enforcement agencies, There are clusters of including in my constituency. Partnerships built in spin off companies that generate jobs. For instance, in Wales, Wales and Swansea University have done a lot to build up our local cyber security ecosystem and as this bill progresses, the government would be regularly with the this and it would be helpful to hear have taken place so far, and how many.

It would also be helpful respond to ISACA ISACA proposals, particularly regarding to suggest mandatory penetration testing. The growing cyber security sector needed economic growth Many of these jobs can anywhere with an internet connection. Recent research from Infosecurity vacancies in the cyber a figure growing at That's a huge opportunity Having an effective skills we can guard ourselves Keeping Britain safe from cyber who can marry technical expertise I've seen in my professional experience sectors were able to retrain People with experience in project very capable of retraining to work Special thoughts should be paid to who are very well suited to those jobs.

And one of the questions be how to help more British whilst also ensuring that is equipped to help And that's why I'm calling to ensure funding is available for all schools in Wales to successful Cyber First Wales scheme.

**** Possible New Speaker ****

Mike Reader. Thank you, Madam Deputy Speaker. Madam speaker, I'd like to start with Madam speaker, I'd like to start with but I've changed the names but I've changed the names So it was a Tuesday afternoon. I had a call from our CEO, David, I had a call from our CEO, David, I'm jumping on a plane, to a law firm I've been working with. to a law firm I've been working with. This lady called Sandra is going I want you to speak to her.

She's going to talk to you about Sorry I've not been able And Sandra then rings me on WhatsApp. I think this is a bit strange. You know, David's a very busy man, but why would he ring Sandra rings me. Seems pretty legit. We have a chat. Turns out we we may I look her up on LinkedIn. Her firm is legit. She's there. She's got similar connections to mine. She tells me I need to sign about this opportunity that And I said, fine.

So I signed the NDA and they sent And on the call was Sandra And also on the call was Now his signal wasn't very good. And he said, Mike, I'm on a plane. But I've tried to join thanks so much for being a part of this. We're looking at an acquisition I want you to work with Ana sure that they've got This is a real opportunity for us to grow. You know, we've been looking And then a signal dropped the conversation with And then they start asking questions didn't need operational matters And then they followed started asking about financial and then they follow up financial information about the business.

And at that point, David and just make sure this is legit. And when I rang David, he had Our business was being intrusion where they used his voice for a call, uses image The story is actually a friend of mine. Had I not called my boss They could have got away And that seemed quite far fetched. But at the same time, another got done by a very, very But they lost £25 million to scammers. So the reason I started that, that story, and it is a real legitimate story that happened to one of my this bill is really important, and it is a framework how we put in force better standards, procedures, controls.

But actually the key thing fall down with their MSPs or many of those already covered by legislation is the human in the loop. And we've heard already from my colleague, the hon. Member from Harlow, about how to get people considered the future guidance that will And I just wanted to open up that we can do all we can in terms the procedures that come But actually what is really important is we focus on the human in the loop, the human aspect, because quite often that is where these major attacks start.

So I'm really pleased to Cybersecurity and cyber crime I won't repeat the stats of my colleagues in It impacts on the businesses It impacts on our public all those things that we use every day. And it's right that after a considerable work from the previous government, and this now comes forward it seems, to have cross-party support. The Bill recognises that a wider range of methods, including data centres, and complex supply chains I think that's really, really critical for my Northamptonshire, on the data superhighway coming we've seen over £1 billion of investments of new data centres, both from the public sector And I think the the Minister for all their hard work in that will create new but without improved which is what this bill delivers.

You know, that investment still And this bill definitely for the sector as well as, of course, with all the many businesses in my constituency that may either rely on a managed service provider for their IT or those who provide data centres, and particularly important for because the control centre looks after your security is in my constituency, so you'd want to think that important for our personal And I looked at this as of the businesses in many of them use managed their IT and actually large businesses do.

In my previous business, we had MSP provided many of the services You know, we're talking so expanding it there to include I think is absolutely critical improving standards and resilience, and therefore reducing burdens particularly their cyber insurance costs. The two asks. I make for government at that point, though, is we do it proportionately. I think some other members The impact on small in this area may be considerable in terms of both their costs from those MSPs, but also the direct costs to them, and also that we do really work how this legislation works where particularly those use overseas workforces.

And I personally experience the stronger reporting requirements. I think actually recognise about his bill he brought forward But from a business perspective, and I think this bill sets out that there will be better clarity for business. We get honesty and trust, environment that people understand what they have to do and this bill moves it forward. I also really welcome that in the bill. There's much stronger enforcement powers, and I think it sends a real message there are there are but also to businesses, And when there are stronger all of a sudden cyber security corporate risk register So I think as this bill is implemented, I'd ask that we do see genuine

**** Possible New Speaker ****

What's particularly important here of course I have to give way. He's making a very interesting

**** Possible New Speaker ****

He's making a very interesting I think, to the to the bill. One of the issues that One of the issues that the bill that is strengthened for companies not only but to have an adequate but to have an adequate And I wonder whether he there's enough kind of for those companies which don't are deemed not to have an adequate recovery bill, because I think my reading at can't necessarily find for But as you said, the human But that matters much in recovery

**** Possible New Speaker ****

Surely. I think the bill goes some way.

**** Possible New Speaker ****

I think the bill goes some way. And I think it's very clear that the guidance that comes around the guidance that comes around There are other ways, of course, to improve their business to improve their business And, you know, it's part of the standard procurement process of government procurement process of government to require business continuity planning to be demonstrated to government. And many large businesses will be trying to with its local government, So there's other ways within impacts with business, that business And I think procurement as my background is one of So I was just saying to as I kind of sum up, I guess, you know, the one concern I have is There's lots of future guidance and we need to see continued consultation.

And I think that message has already that the standards are really clear. One of the reasons this is the legislation was getting quite messy, and we want to make it a lot clearer, and we're really clear with and also that we give early they can adjust that this as we push to address what been recognised right across industry. And of course, I'll come back to the human in the loop when we set that we are looking at how businesses as well as just the technocratic be in a business continuity So this is a very necessary bill.

I think it I support its aims and focus, and I think it signals real those already operating who are coming to invest in great places like Northampton to build the future data centres and other infrastructure we need.

**** Possible New Speaker ****

Thank you Alison Griffiths. Thank you. Madam Deputy Speaker. I refer the.

**** Possible New Speaker ****

I refer the. House to my register of I'd just like to commend my I'd just like to commend my Friends, the members for Hertsmere Friends, the members for Hertsmere for their excellent speeches, and particularly to associate myself with their comments on the Computer Misuse their comments on the Computer Misuse Act of 1990 and the need for an extension to our cyber skills in this country. Before entering this place, in cybersecurity advising businesses of all sizes of cyber attacks and helping reaching the consequences can be from a commercial perspective, not just a technical one.

As vice chair of the Business we've heard direct evidence for from Marks and Spencer Co-op all of whom suffered And whilst the attacks were different Friend, the Shadow Secretary they shared a common feature. They were driven by social Human access was exploited, trust Further up the chain. The outcomes, however, were very secure by design IT infrastructure limiting the impact on customers, Marks and Spencer, which early replacement of suffered months of major facing services and retail logistics.

The financial impact alone for M&S or 45% of their prior Jaguar Land Rover was in There, the attack cut into tightly integrated with bringing production lines to supply chains that shut down cascaded directly impacting numerous suppliers As many members have already mentioned, as well as contributing to estimated to be in these cases demonstrate financial risk and reputational risk. Too often, even at Footsie level, businesses and boards is a potentially devastating combination. I hear the same message including at the Financial Times where I spoke at the end of last year.

There is frustration from CISOs, chief information security vendors that it can be difficult to develop conversations with boards the appropriate resources Businesses accept that but what they want is proportionate and focussed on This bill does some things well, expanding coverage where and strengthening enforcement powers but reporting alone is not resilience. There are gaps that matter. First, the bill does not go Cyber failures are governance failures. Responsibility sits not but clearly and specifically with Yet the bill stops short of driving Without that pressure, cyber will to IT and operations teams Second, there is a risk of confusing increasing reporting does nothing to stop Prevention is always better than cure, and this legislation needs a stronger risk, maturity, and early intervention.

Thirdly, we must be careful about cost, capacity and particularly enforcement. The implications for SMEs are significant, particularly those pulled into At the same time, what they are not resourced to oversee. Without credible enforcement, a paper exercise and boards Fourthly, the bill needs to recognise draw a clear distinction between What works for enterprise IT even dangerous in OT environments critical national infrastructure, architecture and configuration of Risk profiles differ, controls I want to be clear. We on this side of the House In principle, cyber of society approach involving government, regulators, businesses But if this legislation is to drive proportionate and grounded organisations actually operate.

Board and audit committees must Regulators must have and prevention must be prioritised The National Cyber Security clear practical guidance for boards, and that should sit at We need smarter regulation, properly

**** Possible New Speaker ****

Amanda Martin. Thank you, Madam Deputy Speaker, I want to start by saying and to the staff and to all in this house and to the staff and to all in this house and to the residents of Portsmouth. I want to thank the Minister the Bill and highlighting the Bill and highlighting of cyber insecurity has and continues to cause and continues to cause I welcome the Cyber Network and Information Systems bill Network and Information Systems bill because it reflects a clear change of direction under a Labour government, moving from a fragmented and often one that is strategic, cross-government, resilient capability and everyday solutions.

We've heard it said many times duty of any government is and in the modern world, that duty We all rely on. Cyber attacks now pose a daily threat, but to the livelihoods where major employers, manufacturers, ports and the consequences are production can stop overnight. Wages can be put at risk and sensitive Constituents in my city who work such as Jaguar Land Rover have Madam Deputy Speaker, retail and manufacturing the impact ripples far reaching workers on small local suppliers and customers whose orders are delayed or indeed cancelled.

For a city like Portsmouth built engineering skills cyber resilience is not an abstract It is about protecting jobs, maintaining confidence in and ensuring the security of the public services people depend on every day, and ensuring that our city's Madam Deputy Speaker, like other Portsmouth City Council has the city council's website was hit a distributed distributed attack by a pro Russian hacking group. The attack made it very to access council services online, and for a period of time it Unfortunately.

Unfortunately, no personal but the attack did demonstrate infrastructure in places like Portsmouth is a real target for cyber actors, and not just an abstract risk. Local crime statistics a lived experience for Around 60% of our residents crime in a 12 month period, including phishing attempts, online And as my friend from Harlow reported as people are embarrassed, And that, Madam Deputy continue to proliferate Local police crime figures also show malicious communications are often instigated These are not just techy problems, practical inconveniences and, most And in some cases, people lives because of So, Madam Deputy Speaker, yes, there but there is also a human cost, It modernises the UK by strengthening baseline requirements, improving incident reporting a wider range of essential And its three pillars are welcome.

It recognises that weaknesses can rapidly cascade across whether through cyber criminals It recognises that cyber crime is And this is not just about big, big business cyber attacks have we threaten energy and water people living their daily lives. Last year alone, 11,000 NHS appointments were lost due at least five direct cyber on UK water supplies, And in 2025 reported that organisations experienced cyber attacks. Crucial Labour. Crucially, Labour recognises that cyber security is not only a technical issue, but a workforce and an economic one.

Clearer standards businesses the confidence to invest, raise resilience across the economy not left to face increasingly The bill also rightly ensures breaches are reported swiftly within 24 hours, because pace and speed minimise the domino effect of cyber crime. The bill also rightly gives and powers they need to act This is the. This is with the assurance of resources and transparency as to a more consistent strategy This is particularly Our city is home to the Royal Navy, with one of the one of Europe's alongside a major, major commercial port.

Advanced engineering and a university that recognises expertise in cybercrime and digital security. Madam Deputy Speaker, we as a city, when we were blitzed in we could see it and we could act on it. Cyber crime needs to be brought so that we can all act on so that we can create a different culture where people don't hide behind and aren't embarrassed to tell what their businesses or their community. Madam Deputy Speaker, I know a vital role in our national It's not just a target I'm proud that recognised as a centre of cyber expertise, with the leading research digital security and economic crime.

Its centre, Madam Deputy Speaker for brings together multidisciplinary prevention and resilience, schools and local businesses and protect people from cyber crime. The university also conducts advanced research into cyber security systems and threat detection through helping develop real world, improve organisation These efforts not only support but also grow the skilled cyber linking directly to the economic Madam Deputy Speaker, the bill lays and more resilient to support its Second Reading. And in doing so, I seek from the Minister on four key points.

Firstly, how the whole of government will work together to ensure that Portsmouth, with its defence, maritime alongside thousands of small sector are supported to Two how will government will work to strengthen knowledge both cyber security and long and accountability And three how will the bill be limited? How will the bill be linked to So we are not left without the changing world And finally, Madam Deputy Speaker, how can we ensure that this is just And how can we use this bill to cyber attacks so individuals yes, take responsibility and ownership, but in an environment that is supported for instance, and how across the House, as we as MPs can we encourage small businesses and large employers so that together we can carry out which is to protect its citizens

**** Possible New Speaker ****

Thank you. Like Madam Speaker, it's a pleasure to speak in the Second Reading of this bill, speak in the Second Reading of this bill, and I'm very pleased to to say that I support the government's introduction I support the government's introduction of the Cyber Security for it is a very important for it is a very important the protections of UK's critical the protections of UK's critical And for it because it also addresses identified in numerous implementation And as other hon.

Members and right hon. Members have already made Madam Deputy Speaker the risk by cyber attacks are Others have already cited of businesses and industrial We've heard of the impact of the harm for example, and also many members the co-op and and indeed the impact that they had not only on those businesses but also the wider supply chains and local economies. Significant. And I think the Minister the debate that it is billion worth is lost to the UK economy and that's equivalent of 0.5% of GDP.

And so it is right that try to address these And in doing so, they comply with one of the causes of which stated that the world has changed, and enlisting the other sort of the country faces also specifies something that we need And so I think the government is And as other members have made very clear, the the nature of cyber crime, cyber attacks and the threat that And so I do have a great the government in that they to keep up with what is developing industry and nature of threat.

And although I support the Bill Ministers as the as the legislation I would like to to raise just clarity or indeed further A few members have mentioned at our cyber resilience in and that whilst technical security and I think the bill goes a long it could perhaps be strengthened in terms of looking at our digital sovereignty, if you, like other members, have have made the very important supplier concentration in this because if we fail to do so, we Now, there are few examples Perhaps the one that I will is that the use of some of its services to Justice and International Criminal Court.

Now, I'm not saying that the UK government or any of our services, but it does illustrate overdependent or if our or businesses are overly then we are vulnerable. And then I think it is right of looking to try to prepare or at the very least, of overdependence on certain suppliers. And in that regard, I wonder three of the bill in which the legislation stipulates that a statement will be will be made by Ministers, whether this is a consideration that could be included as part of that statement.

And we could then bring about a way in which the statement not only looks at the technical security as part but also this digital sovereignty And I do think in that regard, of the efforts we're starting I think France and Germany to undertake similar of their own domestic over reliance on certain suppliers. The second and final point I raise, and perhaps this is more for clarity. Looking for clarity from the Minister, perhaps when when they're summing and the directions to certain national security purposes, if we accept that, that and the risk to cyber it will be impossible for to encompass all possible And so in order to try especially in terms of national I wonder whether Ministers powers in terms of the last resort powers, particularly to perhaps to direct the shutdown of any domestic data centres or AI systems in the event of a security or operational emergency.

I ask this because I'm not listed in the bill already but if not, I'd ask whether they'd powers just so that In the event of of a such to intervene appropriately AI centres and AI systems out could have or could cause large especially under those very scenario in which the designated people and persons that are otherwise systems refuse to cooperate But in raising those two I also want to underline my support for the government's efforts in

**** Possible New Speaker ****

welcome the Bill and Darlington.

**** Possible New Speaker ****

Darlington. Thank you, Madam Deputy Speaker, I welcome the Bill and I welcome the Bill and public services that's We know, and we've heard We know, and we've heard that we've heard from Members today in this Members today in this this is to the UK economy Despite despite being one of we are still one of the most cyber And last 12 months we've With only 4 in 10 businesses having cyber security breaches, which is down from the previous year.

Yet we are seeing a huge are nationally significant which are more than double than last year, and this includes critical infrastructure This is really important based in Milton Keynes Central, where 1 in 3 jobs are in technology. including legal services, financial services and of But all of this good that have experienced cyber attacks. So this is a very, very welcome bill. The difficulty we have a huge portion in the discussion, and it was also somewhat comments and the strategy set out.

And I'm hoping that it will be Summing up today's debate, technology in order to fight cyber crime. And what does sovereignty actually mean? Because it's quite clear that about what sovereign what it means to myself the industry is that it is UK It's been developed in the UK It is a company paying UK it is a UK company accountable to the UK. Now the government's talked to developing and securing sovereign AI, but this needs to be technology and infrastructure.

This is not just something that is is important in terms of cyber security. It also has its other advantages. It's good for the economy. It creates innovation. It sets the highest standards and thereby gets public support and confidence and achieves small business support It achieves growth not only but ambitiously creating And the government has in It has created safe and secure solutions. The Crown Hosting Data Centres a joint venture between but unfortunately it's only of government servers And you've got to ask why.

So I asked the Minister, promote these UK safe help us fight cyber promoted across the public sector. But these solutions also gain Instead of using these Crown many are using ones run by foreign firms with securities Outages at AWS and cloud hosting And if we also look at other rightly worries about NHS data we've heard about the impact and the impact that it's had on lives, but it also impacts public confidence. Palantir has had a 330 million bringing it together, which is a fantastic initiative and really important, and the public support that because they don't want to repeat their health story to each and every doctor or nurse or other health professional meet.

The difficulty is using foreign alliances has led to It's also led to the public trust and to the trust being eroded by doctors, slowing the take up of this important This is partly because called our pride in Now, unfortunately, he misunderstands is trying to sell our services Now, I know many UK firms that of a job and probably better the doctor's trust would have increased. Now we hear that Palantir contract with the Mod for supporting critical, strategic, strategic, tactical and operational decision That sorry, that is a direct quote.

Again, hugely important that we are using the latest technology in Hugely important that we I don't think anybody in the Mod is making these It is the partners that with that drives the concern. And the reality is cyber security, has to be UK focussed. We have to protect our national ensure that our partners our cyber security, first and foremost. And the reality is their views on the NHS, their integration into the US Immigration and Customs Enforcement Agency, otherwise known as Ice, leads us to worry that they do not share UK values.

It creates a strategic vulnerability. That is what the sector is saying because cyber security isn't it's about the investments So imagine if those two contracts and the economic opportunities including enhancing having confidence in our most critical I'd like to raise another if the Telegraph reporting will have significant, significant They are reporting today is considering using Starlink for the emergency services network, This is the system used by ambulance, Our most critical that's controlled by a man who has shown his willingness to turn off satellites

**** Possible New Speaker ****

at his own political whim in Ukraine. Yes. She's making a really, really important point about But will she go a little bit further But will she go a little bit further has Elon Musk switched off but he's done so at on occasions that

**** Possible New Speaker ****

but he's done so at on occasions that may have turned the tide of the war. Mid Ulster I thank the hon.

**** Possible New Speaker ****

Mid Ulster I thank the hon. Member for raising that point. He did turn it off at for the Ukraine military when they were advancing on Russian held territory, and I think that's important to put. On note, it wasn't just that He chose to turn it off at a critical So I worry that somebody somebody who encourages at a far right rally where he said, whether you choose violence You either fight back or a safe partner for I also want to say I absolutely The honourable the right hon.

Member from Oxford East on transparency and some of the actions who have been willing to stand up to these companies and demand transparency. And I think, while of today's debate, I do think is a really, really important action a warning for future action that can come. So I welcome this bill But to truly make state sponsored or criminal cyber attacks, we need to ensure that as a UK sovereign capacity and capability, and the government can lead the way in this in its own procurement practices by making sure that we are This is good for security, good to It's also good for the economy

**** Possible New Speaker ****

Thank you Andrew Cooper. Thank you, Madam Deputy Speaker, and what a privilege to follow my hon. and what a privilege to follow my hon. Friend, the Member for who made a fantastic speech just then, who made a fantastic speech just then, and I don't think mine will follow but I'll do my best. Having spent my career Having spent my career prior to entering this place, it's perhaps not so much a pleasure, it's perhaps not so much a pleasure, but maybe a blast of nostalgia to This bill provides for overdue update to the NIS regulations, and provides the means to keep them up to date more quickly as new threats emerge.

This was a massive gap in our capability haphazard and cavalier manner And it's absolutely right that we It's a cliche, isn't it, of threats that we face has changed, whether it's state sponsored identity theft or ransomware a widespread and significant on the wider economy and on the cyber attack on Jaguar Land Rover that led to them posting a loss of £485 million last year and I think we heard on the wider economy which cost them at least £206 million. But this is not a new issue, and there's virtually no area

**** Possible New Speaker ****

experienced attempts to and cause disruption, or to steal data. On that point, I'd be happy to. I thank you very much for

**** Possible New Speaker ****

I thank you very much for And he speaks of the cyber attacks And he speaks of the cyber attacks The council tax payers at Gloucester The council tax payers at Gloucester that following a Russian the council recently discovered the council recently discovered And I wonder if you'll recognise that too.

**** Possible New Speaker ****

Thank you, thank you. I thank him for his intervention. I confess I'm not an expert on I confess I'm not an expert on but I'm sure the front may wish to respond in their summing up. may wish to respond in their summing up. Turning to the measures in this bill, Turning to the measures in this bill, managed service providers and data And when I began my career working on hotel reservation systems and legacy on premise infrastructure was Some organisations would of business systems, some would buy in, but virtually all would be with often clever names like Spartacus or Xena or Buffy the Vampire Slayer.

As I worked with over the years such as the need to support the requirement to facilitate huge increases in the speed of domestic and business broadband, redundancy and scaling, shifting and towards a more and wanting to benefit from more rapid rollout of features and applications that require significant server Like like we've seen systems have been moving to those that are managed remotely and sandboxed to multiple organisations, and towards virtual servers rather than on premise tin. So bringing these two areas and it's long, long overdue.

On this part of the bill, I'd and that is around the threshold For MSPs managed service that we're providing security without blocking and that applies to because the risk there is the hegemony of the big rather than being able to support new The risk of vendor lock in that And equally on data centres, to have been set so high that only And I really hope that these points under review and think about how we can strengthen The the other area of the bill that I want to talk about was about the regulators.

Now, the Minister set out in his opening remarks why he believes a sectoral approach is appropriate and there Sectoral regulators have deep, long and they understand how However, as I touched on earlier, the consequences of failure are enormous, with real world impacts to And we shouldn't expect, an overarching cyber regulator to have the domain specific knowledge of the water sector or the air traffic control sector. But nor should we expect to carry the expertise of how modern, scalable data centres that detect faults automatically and will automatically fail over to different regions and I think we just need to of an individual sectoral and it won't necessarily So we have to get this balance right.

And I think we do need to listen In conclusion, Madam Deputy and long overdue update to I look forward to working the scope and scale of and to ensure that all the systems

**** Possible New Speaker ****

are secure in the face of Thank you. Minister. Doctor Ben Spencer. Yeah.

**** Possible New Speaker ****

Thank you. Madam Deputy Speaker. So the cyber bill should be one of So the cyber bill should be one of pieces of legislation the House pieces of legislation the House because the UK's cyber of the foremost duty of government, of the foremost duty of government, the protection of the people. My hon. Friend, the Shadow Secretary of State has already made clear that His Majesty's Official Opposition appreciates the urgent need to act to protect our society, our economy and our growing and evolving cyber security risks.

But cyber Bill is the bill It would not have stopped the JLR It is silent on the threats and it does not answer If Niswan was not will further regulations make? Cyber security is key to It's too important an issue As a responsible opposition, we to get the approach to Now, many hon. Members have made very insightful The right hon. Member for Hertsmere, who and raised the issue about hostile state actors and gave some practical which I hope they reflect on.

The Member for Exmouth and Exeter East, who also talked about his professional experience and the need for and modifying the Computer Misuse Act, which was raised by several other members. The Member for Bromsgrove, who importantly pointed out the issue regarding physical technology and the risk The Member for Bognor who spoke also about her experience, particularly the importance of government, to get make sure we actually And I'd like to also mention Preseli, who mentioned an important issue that I know we've amongst many other colleagues across the House who took part in this debate.

Member for Warwick and Leamington. The chair of the Select on Tyne Central, Central and West. The Member for South East Cornwall Northampton South, Portsmouth North, Milton Keynes Madam Deputy Speaker, the gravest to UK cyber security go completely Cyber is the emerging with hostile state actors ramping up their efforts to disrupt our society, our economy and our democracy at pace, time and time again in this Parliament, the government has the elephant or in this case, the dragon in the room of Last year, the director of GCHQ, the UK's intelligence confirmed that the votes more resource to China than any other single mission.

The evidence is clear. The Chinese Communist Party national security threats In November last year, Mr. Speaker, took the exceptional from MI5 warning of and organisations working on behalf Security to target Parliament In the intervening weeks, the Home Office systems were accessed, apparently by Chinese Reports have circulated that the attack is linked to the Chinese gang storm 1849, previously connected with cyber attacks on MPs and the Electoral Commission. Further, in December 2025, it sanctioned two Chinese what it described as on the UK public These are not isolated incidents.

They are evidence of campaign on the part of Party and its affiliates public services and UK businesses. How our country and how our democratic allies and partners face the threat of hostile state actors working in concert is an epoch defining challenge. It's a challenge we must meet It's no coincidence that several targeted organs of government rightly perceiving that many are the weakest links in The National Audit Office cyber resilience laid bare in some cases, glacial, progress effective improvements Last month's attack on a stark reminder of Government, cyber security, his has received a clear message that the government should and setting the standard for Now, while I am pleased has managed at the last moment to push out the Cyber Action Plan today and it acknowledges the challenge, but how it will ensure change Now, finally, Madam Deputy names retailers such as Jaguar Land Rover, Marks and Spencers awareness of the risks we are facing, with consumer supply chains But this bill would not have had it been enforced at Given the constraints on of the Chancellor's the government needs to ask of the magnitude of JLR can The government must undertake identify companies whose of a cyber attack would present a risk to the UK economy of Madam Deputy Speaker these urgent problems would leave an open goal for malicious cyber the UK's security and prosperity.

This House is unlikely to revisit cyber security legislation for some time. The threat to our economy In the parliamentary debate following the Minister for security the legislative tools available So why not use this by this bill to address it head on? We stand ready to work with the government to stand up for and protect our

**** Possible New Speaker ****

country and prevent this bill becoming EA Mr. Kanishka Narayan. Yes. Thank you, Madam Deputy Speaker,

**** Possible New Speaker ****

Thank you, Madam Deputy Speaker, thank all members right their contributions their contributions I am glad to see that this Bill with deep expertise, represented right across represented right across Members. They have, of course, I will seek to share I will seek to share But before that, Madam Deputy Speaker, The UK is the most cyber attacked over 600,000 businesses were The average cost of a cyber attack The cost to UK businesses in was estimated at 14.7 billion every year.

The personal experiences Friend from Northampton South as well as the particular Friend from Warwick and Leamington, password in this country being Friend from Mid Cheshire the Vampire Slayer as being deployed in some of The combination of those aggregate impacts as well as those personal experiences. Madam Deputy Speaker, National security is the first As cyber threats grow, and in government to have moved fast enough. In light of that growth, robustly to make sure The big message is this and platforms and move We've done it by ditching It's time we do it right Let me turn, Madam Deputy Speaker, to some of the themes raised Members, in particular, and in particular, the threats from AI emerging by both the Shadow Member from Hertsmere, as well as my hon.

Friend from Congleton. AI will almost certainly continue intrusion operations more making cyber threats more That is why, fundamentally, it take step steps to bolster And that is why, under these regulations, organisations must have of the art when maintaining their network and information systems. This applies not only to cyber and I am conscious in to my to the point Member for Hertsmere, a genetic AI I think a very significant context has to be both in the private the public sector in that context.

I pay tribute to the work of right at the frontier in understanding A number of members right across Let me start by clarifying it. There is, of course, right across different We have chosen to focus, as the NIS on essential services. The failure of whose network pose imminent threat of And it is for that reason that the scope of the bill is as tight as it is. That is not to say that all other a great deal to protect The government needs assurances whose disruption would consequences for public safety, national security and economic are prioritised in their Businesses outside the scope of this a critical business priority to without the need for as much I'm very aware of Friends from Lichfield for the chair of the Joint Committee as well as my hon.

Friend, the chair for the science, Innovation and Technology Committee In that instance, acted swiftly in very exceptional billion loan guarantee to protect jobs, support businesses and this vital part of British industry. However, as my the hon. Member for Exmouth and Exeter East noted, this should not be Businesses must look to their own defences as a matter of corporate responsibility. I might just make a bit I'm also conscious that my hon. Friend from Warwick and Leamington the food sector and food retailers Following the particularly and Spencer and Harrods, Friend, the Minister of State for has written and engaged deeply with the CEOs of major food retailers to advise on how the food sector can best protect itself from cyber threats as well.

There's a broader question as to bill that has been raised by A sector not being regulated under organisations cannot protect This bill is not designed, as I said, to cover every sector where the sectors are covered by existing regulations or where government does to regulate the sector We have taken a proportionate approach. Introducing blanket coverage for whole new sectors would create extensive regulatory burdens for more of our economy, stifling economic growth at the same time. Madam Deputy Speaker, the government to bring more sectors into scope in the future and take swift action if national security is at risk.

That is also sitting alongside a series of actions that the government has taken. And can I highlight in particular having written to UK businesses across sectors to make embedding cyber essentials to making cyber resilience And three, that the NCSC early is heeded in those I'm conscious, Madam Deputy Speaker, and the Liberal Democrat Friend from Congleton, question of the public sector's coverage. The public sector requires change in cyber and digital resilience. Today we have published as has been mentioned numerous times, backed by £210 million of investment.

The plan takes decisive action accountable for their cyber as well as providing them with as well as co-ordinating responses I will take up the shared Member for the New Forest the juiciness of local a phrase on which I share The Government Cyber Action wider government In fact, it strengthens, government departments including local government, to account for improved and equivalent cyber resilience, and also make a particular on scope around not just but recovery and resilience as well.

And can I flag to hon. Members right across that we have in place for as well as resilience requirements legislation and they will align Framework relating very much to with consultation, consultation Madam Deputy Speaker, there and comments raised about regulators and both proportionate regulation in this particular context. This bill will allow regulators well resourced in order to carry This will be through charging more of the cost of their and to enhance their impact through increased incident a unified set of objectives.

I'm conscious that talked about both regulators and equally that they might find too much. I will let her work out the obvious But in response to the right hon. Member from Hertsmere in clear scope for AI capability and I would very much hope the requirements of State must undertake will at efficient ways in which In response to the point made by my hon. Friend, the chair of the science, around the frequency and quality of the reviews for the regime in this bill.

DSIT will monitor to review the effectiveness of the regime. The bill requires the Secretary the operation of certain NIS and to publish at least every five years. It will be an extensive review, we want to make sure that as proportionate the particular commitments made the chair relate primarily In response to the points made by my hon. Friends from Warwick and Leamington, the possibility of a cross-sectoral Can I flag that 12 regulators are because different sectors rely on different risk attitudes And in that context, it is expertise to address those I'm conscious that my hon.

Member for Bognor Regis an appropriate point about enterprise, IT and OT being differentiated, and indeed it is why we have taken way of differentiating some of And so for that reason, we have set out both a sectoral approach, but that is not to preclude of State setting out in priorities to set out and information sharing in response to the particular points made by the Liberal Democrat spokesperson, as well as the hon. Member for Exmouth and Exeter that incident thresholds are The 24 hour light touch is a proportionate requirement.

It only needs information to Cyber Security Centre of and it doesn't rely on with the exception of data centres, reportable incidents that affect operators of essential services would need to have affected the operation and information systems right across the entity and to have significant that is extremely unlikely such as the receipt of a phishing email. I'm conscious that my hon. Friend, the chair of had raised a point around organisations in particular, and I wanted to respond to that services are resilient The threats are, of course, growing, but the regulatory context of the Prudential Regulation of England are indeed some of the sources are in terms of the approach that we have taken to this particular Bill as well.

And just to continue on overlap that has been brought up, this government will, of course, which have to navigate multiple regulatory frameworks with multiple services, are facing the minimal burdens. And we will make sure regulators and international authorities, including those in the EU, on Madam speaker, if I turn now to the impact on business to make sure that it is both security as well as proportionality that the legislation takes in this context, this government will only protect our economy and our A single attack can disrupt hospitals, transport vital services, We will not gamble with our The cost of doing nothing As I mentioned, cyber attacks drain almost 15 billion a year from UK businesses.

At the same time, this approach makes approach to ensuring The question of board level brought up by a number of and I would say simply on that front, that all business leaders for their organisations cyber resilience. On the 13th of October last year, the government had written that they make cybersecurity The government's new Cyber Governance governance of cyber risk going to consider the use of secondary legislation to require companies to clarify their cyber at the board level as well. I am conscious that a number of the effect on small and medium Growth is the government's Small businesses are They provide many of our That is exactly why small and in or digital services are exempt They can only be regulated if they are for which there will be an extremely which should allow Friend from Mid Cheshire which meet that bar for A point was raised around to tell whether they are The regulator will complete including notices and consultations prior to confirming meets the criteria for being in scope.

That process needs to be we would hope to make sure that those regulatory to Madam Deputy Speaker. I want to turn now to a really Friend from Milton Keynes Member for Oxford East, Member for cardigan. Preseli around long term sovereignty Madam Deputy Speaker, I felt the party opposite in government sold this country's strategic leverage away when it came to the primary sector, We will not repeat that mistake. We have already committed right robust digital sovereignty We have committed 500 million We have made sure that there are tens of billions of pounds pouring into this country to make sure this country has in particular with British firms like There is an advance market compute to make sure are right at the heart of provision of core infrastructure in the future, through the British Business Bank,

**** Possible New Speaker ****

I'm very happy to give way. David Reed. We talk about sovereign capability,

**** Possible New Speaker ****

We talk about sovereign capability, but how can we have fully when we don't own the means of

**** Possible New Speaker ****

when we don't own the means of Minister. Well, I would I would point Member to both a very thriving compound Member to both a very thriving compound semiconductor cluster in South Wales, as well as a series of chip design as well as chip manufacturing companies. well as chip manufacturing companies. If he's if he doubts the primary chip design I would point him to go the chip company supply And so, Madam Deputy Speaker, of digital sovereignty that And I want to flag, in particular that we are taking strong action including our critical as well as making sure We are looking at opportunities the National Security strategy, the independent review and our new powers on counter-terrorism I'm conscious.

I'm testing your patience, And so I will flag simply. I will simply the the final point, A number of members and right hon. Members made. We are making a series of in making sure young people are inspired to pursue careers in cyber security, and to the points made by my hon. Friends from South East I am deeply passionate about. To ensure that young people and young in those areas in Wales pursue thriving careers in cyber security. Madam Deputy Speaker, National security is the first responsibility This bill could not be more the developments in global cyber threats.

I would like to thank all members and hon. Members for their engagement on the Bill. As it progresses. I encourage them to engage To all rogue organisations And I don't just mean I say this your time is

**** Possible New Speaker ****

We will make sure The question is that

**** Possible New Speaker ****

The question is that As many as are of that opinion say I. I of the contrary. No, I think the ayes have it. The ayes have it. Programme motion to be moved formally.

**** Possible New Speaker ****

Programme motion to be moved formally. I beg to move. The question is as on the Order Paper, as many as are of that opinion, say I. as many as are of that opinion, say I. I of the contrary. No, I think the ayes have it. The ayes have it. Money motion to be moved formally.

**** Possible New Speaker ****

Money motion to be moved formally. I beg to move. The question is as on the Order Paper, as many as of that opinion No, I think the ayes have it. The ayes have it. Ways and means. Motion to be moved formally.

**** Possible New Speaker ****

I beg to move. The question is, as on the Order Paper, as many as are of that opinion, say I. as many as are of that opinion, say I. I of the contrary. No, I think the ayes have it. No, I think the ayes have it. The ayes have it. We now come to the carry over

**** Possible New Speaker ****

We now come to the carry over I beg to move. The question is as on the Order Paper,

**** Possible New Speaker ****

The question is as on the Order Paper, as many as are of that opinion, say I. I of the contrary. No, I think the ayes have

**** Possible New Speaker ****

I beg to move that this house do. Now the question is that Calum Miller. Thank you, Madam Deputy Speaker.

**** Possible New Speaker ****

Thank you, Madam Deputy Speaker. It is my privilege to part of England's countryside, part of England's countryside, stretching from the Chilterns in It is crisscrossed by a network of rivers It is crisscrossed by a network of rivers that define the geography of the area. The largest of these which flows from its origin which flows from its origin about 40 miles south, where it My constituency also hosts two major It is the proximity of Cherwell that created both the setting and the opportunity for a major Madam Deputy Speaker.

In late October, I was knocking when the conversation opened my eyes. The resident, not particularly was ready to close the door. Then he said, actually, my housemate He shouted upstairs and Billy came down. Billy Burnley is a local angler. He knows the River Cherwell inside out. He showed me photos and videos of This was not fly tipping, organised criminal dumping. It quickly became clear Billy and others had been The Environment Agency the 2nd of July with and determined it was the EA took responsibility for addressing.

Yet local anglers, farmers seen dumping continue through the summer. What had emerged was staggering. Around 20,000 tonnes of waste beside the River Cherwell, You had to see it to believe it media coverage that went viral this mountain of waste represented one of the most serious cases councillors like Laura and campaigners stepped up to the Thames helped amplify these concerns across Oxfordshire and nationally. Around Kidlington, gathered nearly 1000 signatures, which I presented here This followed a series of interventions.

My oral question to the Minister My urgent question on the question of the right hon. Member for Kingston and Surbiton, to the Prime Minister on 19th of November, and my meeting with the Minister I want to take the opportunity for her engagement with and for her work with officials to ensure the risks were identified Following my initial question in the Environment Agency had convened and emergency services to develop Last month, the Environment the exceptional step of citing serious fire That is highly unusual the sheer amount of effort campaigners and activists But this should never have been It shows what local, determined people, backed by political pressure can achieve.

And so, Madam Deputy Speaker, The River Cherwell is thankfully yet it still laps against installed by the Environment Agency. Water testing has thankfully not in chemical pollutants I am truly grateful that environmental catastrophe for now, but now that the winter trees and revealed the scale of it is invisible to my constituents of the damage already So my constituents continue to ask what disaster of the waste Can the Minister please tell them the waste have been designed to equivalent to the peak of the nearest EA measuring station What action will be taken Agency if water testing reveals that chemical pollutants are and what steps have been taken to The December decision to clear by all the campaigners Yet the factor that led the Environment Agency to authorise the clearance of this site the risk of and decomposing waste remains, and local people remain angry to our countryside than six months after it was first the waste is still there.

The key question that my to ask is when will the waste be removed? On the 11th of December, the Environment Agency in DEFRA stated, and I quote, preparatory works for Further details on the timeframe for To the best of my knowledge, no physical preparatory works have commenced and the timeframe for clearance So can the Minister please steps have been taken since When will the timetable for When will the first lorry and when does she estimate that Finally, my constituents who will bear the cost for this clear up.

So can the Minister please confirm to identify the criminals responsible That in the meantime, the Environment of clearance and this will And whether she has an estimate Since news broke of the illegal there has been concerted media scale criminal waste dumping Like many people, I had no idea I've been shocked to learn of how Research commissioned by Liberal Democrats in December indicated that 20% of UK adults have witnessed large scale illegal dumping in their own local areas, and that of these, 3 in 5 say the problem has got worse in the last year.

This is truly an epidemic which damages our natural spaces and harms the lives of local residents, who dispose of their own their household waste to council run tips, are rightly appalled that and are too often getting away with it. I know that this is less of who has been working on She will know that and Climate Change Committee, led by my noble friend Baroness Sheehan, has been critical of its inquiry and recommendations I do not intend to cover but I do want to highlight three which directly reflect First, we need to make it easier In this case, constituents had suspicions or even number plates or a description but they did not know what to do with it.

Should they call the council, They did not know, and that Early detection of sites the criminals before they get started, and we should make it as easy as So will the Minister look national hotline for Second, it is clear that grossly under-resourced When I first raised this with she said in the House that had been more than increased This took that budget to £15.6 million. Yet, as this case shows, can be close to that full amount.

And at the same time, million in revenue from So I'd like to ask conducted an assessment landfill tax revenue is generated for each pound spent on tackling waste crime? Has Defra pressed the Treasury of the revenue from landfill And given the government's Lords Environment can the Minister set out a clear of the revised national metrics on waste crime and confirm whether put in place while those Third, in this case, it is Agency prioritised investigating the crime over protecting the site Between the 2nd of July the Joint Waste Crime Unit worked was and and collected I am glad that that led However, nothing was done to either from the waste entering It was only after my question to that work began to put the waste entering the Cherwell.

I want to be clear, the EA has worked swiftly since November to to prevent further environmental damage they identified the risks of the site, which led to the decision to But my concern is that, perhaps for the EA prioritised investigation ahead of early protective action on the site. So does the Minister think the balance between investigation and environmental protection when it And is the Minister the resources and expertise organised criminals who are Or should the National Crime Agency

**** Possible New Speaker ****

Happily? Okay. Madam speaker, the hon. Gentleman for giving way. Gentleman for giving way. I realise that the A34 goes through Madam Speaker Newcastle-under-Lyme Madam Speaker Newcastle-under-Lyme But I congratulate him The Minister won't be The Minister won't be because in Newcastle we lived with crime and profit over people. crime and profit over people. That was Walley's problem. We've just marked a year since the cowboy operators driven out of Gentleman will agree with me in terms of further questions to Minister that

**** Possible New Speaker ****

we need a stand alone strategy for I'm grateful to the hon. Gentleman for his intervention, Gentleman for his intervention, to joining up at some point I agree with him. I agree with him. We need an approach to this which is What I have witnessed in my What I have witnessed in my best efforts by an under-resourced best efforts by an under-resourced and despite the hard work of a failure to conduct, on on the other hand, it's clear that the estimates of the scale of the criminal activity justify a robust and fulsome national strategy, and I would agree with him and hope the Minister will respond to his question.

Madam Deputy Speaker, my constituents and I have been lucky, insomuch as this site for exceptional intervention. There are many communities such as the one just cited, who also face the blight yet do not have exceptional under current resourcing The site chosen by criminals to suited them as it had easy, but its very proximity to the A34 action has now been approved What has struck me most is how strongly people feel this is wrong. Wrong to be so arrogant as to Wrong that too many and that the penalties are That it takes too long When Billy told me about this site, I vowed I would work to see I am glad that's happening now, be able to confirm it will When I learnt how I vowed to work with all those, like the Minister, who to ensure that we make this crime from blighting

**** Possible New Speaker ****

I look forward to continuing that work The Minister Mary Creagh. Thank you very much indeed, and it's lovely to be here with you and it's lovely to be here with you Can I wish you and all colleagues Can I wish you and all colleagues And what a shame it is that we're starting with the the trash from last year. with the the trash from last year. And of course, as we've just celebrated Christmas and the holiday periods, Christmas and the holiday periods, we will have seen our bins, our recycling facilities overflowing And we have faith in our systems it is responsibly dealt with.

So I want to begin by thanking the hon. Member for Bicester and Woodstock I share his anger and this very serious crime and its impact. Because waste crime As I know from my own work as these waste criminals, damage the environment and in directly threaten our These criminals undermine and they deprive which is why this government is We will crack down on the waste crime groups who have moved and we will ensure they I can confirm that the criminal site is moving forward at pace, Environment agency officials the waste materials on site and there's a lot we can divine as to where they actually originated from.

Those forensic results will be and the Environment Agency is partners including police and fire and Rescue Services Co-ordinating Group and So the strategic Group has set the overall goals for this major incident, supporting the Gold Commander with advice, analysis and community links Group implements these goals at the scene. The strategic Group has local and it is they who have determined this case apart from the other This location presents That is why the Environment the exceptional decision systematic and focussed clearance plan.

And it's important to stress, that in the past five years only two other sites have been cleared by via a ministerial direction, and Twyford House in Stoke on Trent, which is where lots of very close to the West Coast Main Line, so you can see some of The Environment Agency will the site whilst preparatory They have informed me today that and clearance of the waste is Further updates on the timeline will moved to the right facilities without The Environment Agency is and will respond to any It is important that people whether as members of the public It is a crime scene, it is but it is dangerous to climb on the waste.

In doing so, people are and compromising and compromising a criminal investigation is in itself a criminal offence. So we don't need to add extra problems to the very big problem There is now 24 hour The Environment Agency's approach on evidence and with actions were taken in response and the potential for The Environment Agency was on photographic evidence from and immediately visited and confirmed it as a high Over 80% of the waste on the Environment Agency visited so the vast majority happened further waste movements The EA swiftly obtained The current risk of waste entering the river is very low because a barrier has been installed at the site to both to safeguard In the event of river levels rising the Environment Agency quality sampling of the River Cherwell to check for potential impacts of having sampled upstream they have found no indication the Cherwell as a result of the waste.

Now, the clear up of illegal Agency should only be a last resort, undertaken in exceptional circumstances to protect the public and the environment, because criminals who legitimate businesses the environment must pay the polluter pays principle, We do not wish to create people to dump or facilitate It should be for to clean up and pay the costs of clean up. But I do acknowledge the frustrations, Friend for Newcastle underline the huge frustrations that this approach takes, and in some cases this confidence or create a protection somehow that this isn't taken But as with any police running commentary law enforcement or by Ministers.

I can confirm, though, that all avenues on this and on We are absolutely committed cynical waste criminals who harm businesses, Now, I'm going to go through each I do request the patience free to cough if it Madam Deputy Speaker, but So strapping. So he asked, how are we tackling on the country caused by waste crime? So we are pursuing a series have lasting impact on We are bringing in reforms to which is going to shrink the number of people that can actually handle waste.

So that's the first thing. We're changing the waste because at the moment, certain And we're shutting down those exemptions. And we're introducing which is coming in this year. So these are things that that have been consulted but have not been enacted We think these three movements, are the most effective away from the waste sector because it's all about knowing Alongside this, we have, as he said, crime enforcement by over 50% That is the investigatory and that's all the stuff waste shipments, you know, all And this work is very time because it has to be done of proof that will stand So obviously he asked, we we So yes, I just want to go on a bit they, they were deprioritized.

These reforms were deprioritized These reforms are being accelerated. So mandatory digital waste tracking for monitoring waste movements It will provide a single types of waste quantities and the lack of digital record is frequently exploited who undercut legitimate businesses through illegal exports, Data in the new system that waste is ending up at legitimate, licensed site sites, investigation of illegal activity. This digital waste tracking system beginning with a system for waste receiving sites, for example landfills and with waste operators such as waste

**** Possible New Speaker ****

Subject to further funding, I will. Thank you, Madam Speaker. I'm very grateful to I'm very grateful to sharing with the House this It only worries me that It only worries me that before and we're talking back to 2018, some of the issues that I was elected to this place in July 2024, I was elected to this place in July 2024, in relation to Walleys quarry, could in relation to Walleys quarry, could So this raises many questions, both back home in Newcastle line

**** Possible New Speaker ****

who clearly and we can discuss this Madam speaker, we're missing in action. I thank him, I pay tribute on the issue of Walleys Quarry, on the issue of Walleys Quarry, which is also now being run and where the risk of odour and where the risk of odour were suffering in such, you know, really grievously suffering, really grievously suffering, that the risk of that odour But that has come at a cost. But that has come at a cost. As he rightly says, this is nothing new.

And in a way, when there's is taken and no new policy is created, the problem is that people, people I can carry on, I can And then they tell their It's pretty soon many flowers are the wrong sort of flowers And it creates incentives. And then of course, hang on, why am I paying all If all I need to do is buy it creates disincentives for And I am only too aware of this. It is. I think it is.

It was something that was 20 1617 leaving the EU on, on, you know, very, very But I was always concerned and in this House to and I was always very worried about including chemical waste as well. Once we put up a border with So that was a digital waste tracking. Second, the reform of waste So instead of going from a light it is now going to be a permitted system. So we're going to move from were able to sign up Oscar So Oscar the dead dog was And this is, you know, this back in I think it was 2018, 2019.

So we've known about these problems. Paper any anyone can anyone We're going to introduce tougher and tougher penalties for We will also require So the the man with the van numbers on their vehicles so service users can be reassured handled by accredited businesses And the reform will also technical competence for meaning anyone transporting will have to demonstrate rather than simply just So it means if I can just finish be managed by authorised persons Happy to give way.

**** Possible New Speaker ****

I thank the Minister for giving way. I'm fascinated and really, really happy to hear what really happy to hear what Is it going to be possible Is it going to be possible to check an online Because there is something about Because there is something about up from your home showing And actually people feel quite And actually people feel quite checking it against the local would actually give people

**** Possible New Speaker ****

I will get back to her, on that in terms of but on that in terms of but of a digital waste tracking system The problem has been there. It's a paper based register. It's a paper based register. So how can you check at the moment? So my understanding is So my understanding is But I will get back to her. I don't want to mislead her or the House. Madam Deputy Speaker and perhaps box Madam Deputy Speaker and perhaps box while I go through the third reform which is at the moment, three high risk areas So car scrappage, end of And these have long caused problems, these exemptions And we're going to replace a full environmental permit requirements for all waste exemption holders and impose can be managed at one site.

So at the moment there are There are seven of them. One is around construction waste, one one is around treatment of waste wood, one is around manual treatment, vegetation at the place That's essentially for farmers. So those are the exemptions. And and we have, as I mentioned earlier, increased the Waste Crime So it now has 43 full time staff. People have often asked me about to use environmental permit There are rules set out by about how the income raised These rules ensure transparency and to ensure that fees set higher than necessary should properly should So we instead looked at innovative The EA has consulted on the implementation of a 10% levy to generate a further £3.2 million of waste enforcement and this would enable in enforcement activity to be targeted at activities identified Agency as waste crime priorities.

These include tackling increasing enforcement areas of concern such as landfill sites, closing down illegal sites more quickly, using intelligence more effectively and delivering successful major I am going to. I will.

**** Possible New Speaker ****

Such a comprehensive response on million that is in the budget for as she said, is for the officers as she said, is for the officers But it still strikes me as a small for a crime that is now taking for a crime that is now taking Can she clarify whether the additional 5.6 million is is now permanently in that million is is now permanently in that such that the additional funds of permitting would be of permitting would be And fundamentally, does she

**** Possible New Speaker ****

Well, my aim is not to spend My aim is to stop it happening My aim is to stop it happening And obviously all budget to the normal business planning. to the normal business planning. But what we hope is that through we can give the Environment Agency a three we can give the Environment Agency a three year settlement or indicative settlement, which will enable them to plan which will enable them to plan you know, up this year, down next year.

So there will be a long range But as I say, they are consulting at the moment on this So if that goes through see an uplift to their funding as well. I have the answer for the hon. Lady to the question about It is already possible to check We are we are happy to inform you. So that's that's all good news there. So I've mentioned about the different the different reforms I've mentioned. I think I've mentioned I think I've But I'm pretty much coming But if there's something oh, steps taken since Yes.

So you're to his specific questions. The rise in water level equivalent to the peak recorded It is within a large floodplain, store a substantial volume The EA has carried out more detailed any changes in water levels and have determined there will not be any increased flood risk to local properties. And my understanding is there are In order to protect the river. They have also carried out of the river to check for and have found no indication of pollution.

If any pollutants are the action would obviously of the pollutants found EA officials have been working who are leading on of the waste and planning appropriately, but obviously, the fire risk was one of the main reasons that an exceptional decision was taken to Progress so analysis on how including ecology, service surveys, have all been carried out Agency to get contracts in But we need to follow the waste is disposed of correctly. So the clearance timetable shortly be published on As I said, clearance to Early indications and scoping will take approximately 6 We are seeking to recover our costs with the legislation and and and the EA is working Unit to target the finances That unit can freeze bank accounts, cases of money laundering

**** Possible New Speaker ****

I will. I'm very grateful to

**** Possible New Speaker ****

I'm very grateful to so clearly how seriously and that will be of continued reassurance to people about coming to Newcastle. to people about coming to Newcastle. But in many examples, waste So I wonder whether she can So I wonder whether she can Gentleman's condition, particularly So I wonder whether the Minister So I wonder whether the Minister as she talks about working of cooperation and partnership Office to make sure that because clearly, in many communities people think in rural are fewer people around and all the rest, they can get away with

**** Possible New Speaker ****

And we've got to make sure So I do agree with him, and

**** Possible New Speaker ****

So I do agree with him, and I'm very interested in exploring The hon. The hon. Gentleman said, you know, Well, the problem is, if you're not Well, the problem is, if you're not And the most important thing, when wherever it is happening, is to wherever it is happening, is to you know, on the tube or wherever it is for us as citizens to do something. And I think whether you report it to the local police or you report and their hotline is 880 70, Thank you to my officials So we've got that into So it is important.

But I think the playbook is important well, what does the local authority do? What does the police do? What does the EA do and what is Because I've obviously visited sites, I've visited a site in Staffordshire, in Water Lane where people It was two vanloads of fly tipping, and it was not classified and it fell to the local But people were in their to leave through this, through the road. I mean, absolutely extraordinary position for people to find themselves in. So what is the playbook? What are the definitions, and where The Environment Agency expects through making efficiencies without impacting or scaling But of course, it is not funded to clear up waste sites nationally and only makes these types of decisions in He asked about additional The Waste Crime survey says 20% of waste is handled illegally.

HMRC estimates that 23% of contributing to an annual waste crime including a £150 million landfill tax gap, which is 23% of the theoretical liability. I hope everyone can understand This is big business. That's a that's a that's And it's us who are all paying. And we're paying twice because and then we're clearing it up, you know.

**** Possible New Speaker ****

So it's a double whammy for us. It's maddening. Right. Very grateful to

**** Possible New Speaker ****

Very grateful to out those figures so clearly. And that really was at in terms of the budget for waste crime, at in terms of the budget for waste crime, not so much that I, like anybody else, wants to spend money But that's a relatively modest investment But that's a relatively modest investment in the in the detection investigation could yield a higher proportion could yield a higher proportion So the billion pounds that we lose every year for a relatively modest increase in the Waste Crime Unit's budget or through the National Crime Agency doing more, could potentially bring in more of

**** Possible New Speaker ****

be there for legitimate taxpayers Minister. I completely agree with him.

**** Possible New Speaker ****

I completely agree with him. And I think we're we're both I'm sure everyone in the chamber I'm sure everyone in the chamber What I would say, though, is you use all available resources you use all available resources And so, you know, these are some of them are registered companies. some of them are registered companies. And so, you know, they making law enforcement's life difficult. So, you know, I think we don't we're situation with some of these very And, you know, they've been And so these are this is This is complex crime.

And complex crime does take quite We continue to work with Treasury on the best approach to fiscal policies, to support how we can tackle And let me just conclude by saying is a UK wide partnership working HMRC, National Crime Agency, and shares intelligence powers Criminal and this unit has doubled It was launched in 2024 of crime action and asset freezes. And of course, people can. Also, anyone with intelligence also report it to So let me conclude by saying, that my message to his constituents around an absolute top priority My message to the waste for you and we are going to shut you down.

My message to is thank you for what you do. Thank you for the work healthy and clean environments in our town and help us put pride into our places. And let's all make sure to create a truly circular economy where this sort of terrible crime is unthinkable

**** Possible New Speaker ****

and these people are put out of business. Thank you. The question is that As many as of that opinion As many as of that opinion Order.
This debate has concluded
Return to start of debate - Return to top of page