Lords Grand Committee
Monday 7th September 2026
Skip to latest contribution
This debate has concluded
(began 2 weeks, 4 days ago)
Watch LiveSkip to latest contribution
This debate has concluded
15:46
Speaker 1
-
Speaker 1
They respond directly to the almost always authoritative recommendations, delegated powers and Regulatory Reform Committee in its seventh report of this session and are strongly supported by the principles laid down by the Select Committee on the Constitution in its third report. Together, these amendments seem to delete two deeply objectionable provisions that represent a classic example of secondary legislation creep provisions where the executive is seeking a blank check to unilaterally rewrite the rules. My Lords, let's first look at amendment 92, which targets clause 37 and seeks to leave out subsection seven on page 62, line 24, under the bill as drafted clause 377 grants the Secretary of State the unilateral power to make regulations to amend the act itself in order to change and potentially dilute the consultation and parliamentary scrutiny requirements that apply to a code of practice.
My Lords, this is a Henry the Eighth power of really quite an extensive kind in the government's original Delegated Powers Memorandum of November 2025. The Department, as it then was argued that this power was necessary to allow flexibility in case a 40 day parliamentary scrutiny period became, in their words, unfeasible or a detriment to the quality of the code. But my Lords, as the Delegated Powers Committee has correctly noted in its seventh report, the rules governing how Parliament scrutinises the executive must be set by Parliament in primary legislation.
They should not be subject to the administrative convenience of a minister, allowing a minister to use secondary legislation to alter or weaken the very procedural safeguards this House has debated. My Lords is not constitutionally correct. The committee's recommendation is clear and unambiguous. Section subsection seven must be removed. And this brings me to amendment 95 C, which seeks to leave out subsection five on page 64.
Line 18. Clause 40 requires the Secretary of State to lay a report before Parliament on the operation of this cyber security legislation. My Lords, however, subsection five grants the Secretary of State the power to amend this primary legislation via regulations to change the matters to be covered in those same reports again. In their original November 2025 memorandum, the government defended this by claiming they needed flexibility to ensure that reports could be expanded over time as technology matures.
My Lords, with the greatest respect, that argument is entirely spurious. If the government merely wishes to report on more things, they're already fully entitled to include voluntary supplementary chapters in their reports. But by granting themselves a statutory power to amend the legal requirements of clause 40, they're taking the power to delete or dilute the core mandatory reporting obligations that Parliament has put on the face of the Bill. My Lords, they would be legally empowered to write their own report cards, effectively deciding behind closed doors what they must disclose to Parliament, what they can quietly omit, including critical scrutiny over how they've used the vast delegated powers.
Under clause 29.1, the Delegated Powers Committee was again clear this power is inappropriate, lacks a coherent justification and should be deleted from the Bill. The Select Committee on the Constitution two, in its third report, expressed serious anxieties about the overall design of this legislation. They warned that this is a framework Bill that relies far too heavily on secondary regulations to establish the actual perimeters of national cyber resilience. When a bill already delegates such sweeping, unprecedented powers to the executive, amplified by the amendments to introduce a parallel high risk vendor framework laid on 24th August that we discussed on the first day of this Grand Committee, it is doubly important that the statutory channels of parliamentary oversight remain supreme.
We cannot allow the government to use secondary regulations to dismantle, dismantle the guardrails that keep them accountable. And I urge the noble Baroness to minister to accept these common sense, committee backed corrections and to agree to delete clause 377 and clause 45 before before report stage I beg to move.
My Lords, this is a Henry the Eighth power of really quite an extensive kind in the government's original Delegated Powers Memorandum of November 2025. The Department, as it then was argued that this power was necessary to allow flexibility in case a 40 day parliamentary scrutiny period became, in their words, unfeasible or a detriment to the quality of the code. But my Lords, as the Delegated Powers Committee has correctly noted in its seventh report, the rules governing how Parliament scrutinises the executive must be set by Parliament in primary legislation.
They should not be subject to the administrative convenience of a minister, allowing a minister to use secondary legislation to alter or weaken the very procedural safeguards this House has debated. My Lords is not constitutionally correct. The committee's recommendation is clear and unambiguous. Section subsection seven must be removed. And this brings me to amendment 95 C, which seeks to leave out subsection five on page 64.
Line 18. Clause 40 requires the Secretary of State to lay a report before Parliament on the operation of this cyber security legislation. My Lords, however, subsection five grants the Secretary of State the power to amend this primary legislation via regulations to change the matters to be covered in those same reports again. In their original November 2025 memorandum, the government defended this by claiming they needed flexibility to ensure that reports could be expanded over time as technology matures.
My Lords, with the greatest respect, that argument is entirely spurious. If the government merely wishes to report on more things, they're already fully entitled to include voluntary supplementary chapters in their reports. But by granting themselves a statutory power to amend the legal requirements of clause 40, they're taking the power to delete or dilute the core mandatory reporting obligations that Parliament has put on the face of the Bill. My Lords, they would be legally empowered to write their own report cards, effectively deciding behind closed doors what they must disclose to Parliament, what they can quietly omit, including critical scrutiny over how they've used the vast delegated powers.
Under clause 29.1, the Delegated Powers Committee was again clear this power is inappropriate, lacks a coherent justification and should be deleted from the Bill. The Select Committee on the Constitution two, in its third report, expressed serious anxieties about the overall design of this legislation. They warned that this is a framework Bill that relies far too heavily on secondary regulations to establish the actual perimeters of national cyber resilience. When a bill already delegates such sweeping, unprecedented powers to the executive, amplified by the amendments to introduce a parallel high risk vendor framework laid on 24th August that we discussed on the first day of this Grand Committee, it is doubly important that the statutory channels of parliamentary oversight remain supreme.
We cannot allow the government to use secondary regulations to dismantle, dismantle the guardrails that keep them accountable. And I urge the noble Baroness to minister to accept these common sense, committee backed corrections and to agree to delete clause 377 and clause 45 before before report stage I beg to move.
15:50
15:51
Speaker 3
-
Speaker 3
My Lords, I thank the noble Lord, Lord Clement-jones, for opening the final day of debate in this committee. I must say, for a bill of such importance. I'm surprised at the speed of our progress. But if quantity has been low, I think quality has more than compensated. My Lords, I. I do agree with the noble Lord that this House deserves rather more justification from the government as to the need for the powers it is granting itself.
The Delegated Powers and Regulatory Reform Committee described the clause 377 power as unusual and novel, capable of watering down requirements for consultation as it is not constrained by set criteria. The government's justification thus far for this power is that it allows them to, and I'm quoting, to prioritise the content of the code of practice rather than arbitrary requirements. Now, this sounds to me rather as if the government's position is that it sees any set requirements for consultations and codes of practice as arbitrary.
If this is the case, and I'd appreciate some clarification from the noble lady, the Minister. But if this is the case, I have to agree with the committee's description that the position is quite extraordinary. By the way, my Lords, I noted this morning that the Chancellor of the Duchy of Lancaster has demanded an end to the culture of consultation. I'm afraid this is going to be quite a wrench for the former desert functions, which launched four new consultations on just a single day in July and still have not responded to the more than 11,000 responses to the AI and copyright consultation.
We're already unclear about the machinery of government for the former desert. Could the minister now tell us whether it's existing and planned consultations will continue, or whether today's announcement represents a fundamental change of approach? My Lords, it's not clear why the power conferred by clause 45 has to be sufficiently broad so as to allow the government to water down the contents of reports on network and information systems. Could it not be amended, as the Committee has recommended, so that it cannot be used to reduce the requirements to report? I don't think it is unreasonable to question whether the government really needs these extensive powers.
I think at least your lordships House deserves more of a justification than just describing set criteria as arbitrary. Of course, I appreciate the need for flexible and adaptive approaches to legislating for fast moving technologies that must come with accountability, and I'm not sure we have the balance right at this point. I look forward to the noble lady. The minister's response.
The Delegated Powers and Regulatory Reform Committee described the clause 377 power as unusual and novel, capable of watering down requirements for consultation as it is not constrained by set criteria. The government's justification thus far for this power is that it allows them to, and I'm quoting, to prioritise the content of the code of practice rather than arbitrary requirements. Now, this sounds to me rather as if the government's position is that it sees any set requirements for consultations and codes of practice as arbitrary.
If this is the case, and I'd appreciate some clarification from the noble lady, the Minister. But if this is the case, I have to agree with the committee's description that the position is quite extraordinary. By the way, my Lords, I noted this morning that the Chancellor of the Duchy of Lancaster has demanded an end to the culture of consultation. I'm afraid this is going to be quite a wrench for the former desert functions, which launched four new consultations on just a single day in July and still have not responded to the more than 11,000 responses to the AI and copyright consultation.
We're already unclear about the machinery of government for the former desert. Could the minister now tell us whether it's existing and planned consultations will continue, or whether today's announcement represents a fundamental change of approach? My Lords, it's not clear why the power conferred by clause 45 has to be sufficiently broad so as to allow the government to water down the contents of reports on network and information systems. Could it not be amended, as the Committee has recommended, so that it cannot be used to reduce the requirements to report? I don't think it is unreasonable to question whether the government really needs these extensive powers.
I think at least your lordships House deserves more of a justification than just describing set criteria as arbitrary. Of course, I appreciate the need for flexible and adaptive approaches to legislating for fast moving technologies that must come with accountability, and I'm not sure we have the balance right at this point. I look forward to the noble lady. The minister's response.
15:54
Speaker 4
-
Speaker 4
I thank the noble Lord for his amendments 92 and 95. See, and I note these amendments were recommended by the Delegated Powers and Regulatory Reform Committee in their report for the 17th of July. I think noble Lords or some noble Lords at least, may be aware that until very recently I was the chair of that committee and I am wondering how best to describe myself. AM I gamekeeper turned poacher or poacher turned gamekeeper? I think I'd better let you decide at some point.
At the end of my responses, these delegated powers were included to prevent a scenario where procedure takes priority over the best possible products, whether that be a code of practice or a report on the legislation. The delegated powers won't allow ministers to bypass Parliament. It's about ensuring that government can respond quickly and effectively to new threats and new technologies that could undermine our national security. The law has always been slower than innovation and is unlikely to catch up unless we change our approach.
Ministers must provide clear justification and carry out assessments before regulations are laid before Parliament. On the Code of Practice, we anticipate that any, any, any code would be updated from time to time to remain effective in line with the latest recommended good practice, evolving threat information and emerging technologies, and any revisions and reissues of a code of practice must first be consulted upon with relevant stakeholders before it is effective . On consultations point.
I slightly think that might be above my pay grade to comment so soon after the Chancellor of the Duchy of Lancaster has commented, but I will. I'm sure that my noble friend the Minister will have a further response to that at some point, possibly in writing. I do want to assure noble Lords that the government is carefully considering the committee's recommendations and the views of noble Lords during today's report, and will be reflecting accordingly ahead of report.
My noble friend the Minister will respond formally to the Delegated Powers and Regulatory Reform Committee in the usual manner ahead of report stage.
At the end of my responses, these delegated powers were included to prevent a scenario where procedure takes priority over the best possible products, whether that be a code of practice or a report on the legislation. The delegated powers won't allow ministers to bypass Parliament. It's about ensuring that government can respond quickly and effectively to new threats and new technologies that could undermine our national security. The law has always been slower than innovation and is unlikely to catch up unless we change our approach.
Ministers must provide clear justification and carry out assessments before regulations are laid before Parliament. On the Code of Practice, we anticipate that any, any, any code would be updated from time to time to remain effective in line with the latest recommended good practice, evolving threat information and emerging technologies, and any revisions and reissues of a code of practice must first be consulted upon with relevant stakeholders before it is effective . On consultations point.
I slightly think that might be above my pay grade to comment so soon after the Chancellor of the Duchy of Lancaster has commented, but I will. I'm sure that my noble friend the Minister will have a further response to that at some point, possibly in writing. I do want to assure noble Lords that the government is carefully considering the committee's recommendations and the views of noble Lords during today's report, and will be reflecting accordingly ahead of report.
My noble friend the Minister will respond formally to the Delegated Powers and Regulatory Reform Committee in the usual manner ahead of report stage.
15:56
Speaker 1
-
Speaker 1
Well, it was the reverse of the usual ministerial response, so I thank the Minister for her response. The sting wasn't in the tail. The sting was at the beginning rather than the end, and it was the much more conciliatory at the end that the fact that the government will take on board the boys is going to consider taking on board the DPP. DPRCS recommendations before report stage, and I very much hope they do.
My Lords, at this stage in Grand Committee, of course, nothing gets decided, but I can assure that the. The minister, the noble Baroness, the Minister, that if this continues and the government don't respond in some shape or form to both those, you know, pretty solid recommendations by the committee that will be bringing it back at report stage. I mean, when I say sting, in the beginning of the response, my Lords, it was just a bit surprising, given that the minister has been the chair of the committee and she knows the seriousness with which we all take the recommendations of the committee.
I mean, a huge amount of work goes into the detail. She knows how much store we place on the recommendations. I just hope that the issue will use all her influence to make sure that we do introduce something, or the government introduces something along the lines of what I've produced for Report Stage. In the meantime, I beg leave to withdraw amendment 92.
My Lords, at this stage in Grand Committee, of course, nothing gets decided, but I can assure that the. The minister, the noble Baroness, the Minister, that if this continues and the government don't respond in some shape or form to both those, you know, pretty solid recommendations by the committee that will be bringing it back at report stage. I mean, when I say sting, in the beginning of the response, my Lords, it was just a bit surprising, given that the minister has been the chair of the committee and she knows the seriousness with which we all take the recommendations of the committee.
I mean, a huge amount of work goes into the detail. She knows how much store we place on the recommendations. I just hope that the issue will use all her influence to make sure that we do introduce something, or the government introduces something along the lines of what I've produced for Report Stage. In the meantime, I beg leave to withdraw amendment 92.
15:59
15:59
15:59
15:59
15:59
15:59
15:59
15:59
16:00
16:00
16:00
16:00
16:00
16:00
16:00
16:00
16:01
Speaker 5
-
Speaker 5
Thank you. I, I rise to move amendment 99 in my name, and all the amendments that I've put down to this bill are derived from evidence we received on the National Resilience Select Committee, and I am sorry that I wasn't here last week to address those that came up then, and I'm very grateful to my noble friend, Lord Clement-jones for presenting these for me. Several members of the Select committee, including me, were in Finland last week looking at their preparedness for attack.
Now they've faced the threat from their long border with Russia throughout the history of their country, and their preparedness on a whole of society basis is extremely impressive. While we don't have a long border with Russia to focus our minds, we know that cyber attacks can immediately undermine our whole society and economy. And one of the things we heard on our select committee is that not only are many companies unprepared for cyber attacks, but there is also a shortage of skills in this area, and this amendment is seeking to move things forward.
This new clause would give the UK Cyber Security Council statutory functions to validate, qualifications to monitor the supply of, and demand for cyber security professionals in the areas covered by the bill, and to audit whether regulated organisations employ certified professionals. A competent mandate for the regime, I. I have received some useful information from the sector who welcome my attempt to try to ensure that we do have sufficient cyber professionals and that there is a mechanism by which they are certified.
There are analogies with the certification of medical professionals, professionals, for example, their certification is conducted independently, and I recognise the importance of that. What I'm arguing here for here is the principle, and not necessarily the route suggested by my amendment. How this is best done can be further discussed between committee and report. The National Cyber Security Centre reported nationally, significant cyber institutes had more than doubled in a year, and according to their survey, only 7% of UK businesses have formally reviewed the potential cyber security risk presented by their wider supply chain.
An evidence to our select committee suggests that skills shortages are a key challenge here, especially for SMEs and those in the public sector. It's clear that cyber education, training and apprenticeships and so on must accompany these reforms. This bill places greater responsibility on organisations to identify and manage cyber risk. But beyond those technological solutions, these obligations will require skilled professionals to carry them out. The bill refers to the appointment of a skilled person in the context of a national security directive, but doesn't delve into what constitutes a skilled person, and I realize this will change over time, but there should be ways of addressing this.
Neither does the bill acknowledge the role of skilled persons in delivering the wider objectives of the bill. Those in the field have called on the government to amend, to require organisations to access cyber security work force that is qualified to to recognise professional standards. Now we know that this skills shortage exists, weakening our national resilience, and one report showed that 87% of organizations experienced at least one consequence due to skills need.
So therefore, it becomes strategically important to address this. The government should use the bill as an opportunity to professionalize the sector by committing to a cyber security workforce and skills strategy, and mandating that regulators and regulated entities use suitably skilled people for the purposes of compliance with the regulation. Recognised professional qualifications and certifications anchored in international standards should be required so that we are reassured and the regulators are reassured that that the work is being carried out to a certain standard.
The UK Cyber Security Council was granted Royal Charter status to establish a self-regulating, politically independent professional body structured on proven models of other professional bodies like the GMC. So the UK needs to transition from a fragmented patchwork of varying certifications to a unified national standard of professional competence and ethical conduct. Therefore, the Bill should recognise the council as the authority for setting and maintaining these standards. Given that the Bill aims to enhance the security and resilience of the UK and the critical sectors that underpin our economy, and that needs to be assisted with the suitable skilled workforce to implement this.
Of course, we need to take further action to make sure we have. We're training people, but this amendment is designed to help move this forward by ensuring that those in this area are sufficiently skilled. I beg to move. . Chair
Now they've faced the threat from their long border with Russia throughout the history of their country, and their preparedness on a whole of society basis is extremely impressive. While we don't have a long border with Russia to focus our minds, we know that cyber attacks can immediately undermine our whole society and economy. And one of the things we heard on our select committee is that not only are many companies unprepared for cyber attacks, but there is also a shortage of skills in this area, and this amendment is seeking to move things forward.
This new clause would give the UK Cyber Security Council statutory functions to validate, qualifications to monitor the supply of, and demand for cyber security professionals in the areas covered by the bill, and to audit whether regulated organisations employ certified professionals. A competent mandate for the regime, I. I have received some useful information from the sector who welcome my attempt to try to ensure that we do have sufficient cyber professionals and that there is a mechanism by which they are certified.
There are analogies with the certification of medical professionals, professionals, for example, their certification is conducted independently, and I recognise the importance of that. What I'm arguing here for here is the principle, and not necessarily the route suggested by my amendment. How this is best done can be further discussed between committee and report. The National Cyber Security Centre reported nationally, significant cyber institutes had more than doubled in a year, and according to their survey, only 7% of UK businesses have formally reviewed the potential cyber security risk presented by their wider supply chain.
An evidence to our select committee suggests that skills shortages are a key challenge here, especially for SMEs and those in the public sector. It's clear that cyber education, training and apprenticeships and so on must accompany these reforms. This bill places greater responsibility on organisations to identify and manage cyber risk. But beyond those technological solutions, these obligations will require skilled professionals to carry them out. The bill refers to the appointment of a skilled person in the context of a national security directive, but doesn't delve into what constitutes a skilled person, and I realize this will change over time, but there should be ways of addressing this.
Neither does the bill acknowledge the role of skilled persons in delivering the wider objectives of the bill. Those in the field have called on the government to amend, to require organisations to access cyber security work force that is qualified to to recognise professional standards. Now we know that this skills shortage exists, weakening our national resilience, and one report showed that 87% of organizations experienced at least one consequence due to skills need.
So therefore, it becomes strategically important to address this. The government should use the bill as an opportunity to professionalize the sector by committing to a cyber security workforce and skills strategy, and mandating that regulators and regulated entities use suitably skilled people for the purposes of compliance with the regulation. Recognised professional qualifications and certifications anchored in international standards should be required so that we are reassured and the regulators are reassured that that the work is being carried out to a certain standard.
The UK Cyber Security Council was granted Royal Charter status to establish a self-regulating, politically independent professional body structured on proven models of other professional bodies like the GMC. So the UK needs to transition from a fragmented patchwork of varying certifications to a unified national standard of professional competence and ethical conduct. Therefore, the Bill should recognise the council as the authority for setting and maintaining these standards. Given that the Bill aims to enhance the security and resilience of the UK and the critical sectors that underpin our economy, and that needs to be assisted with the suitable skilled workforce to implement this.
Of course, we need to take further action to make sure we have. We're training people, but this amendment is designed to help move this forward by ensuring that those in this area are sufficiently skilled. I beg to move. . Chair
16:06
16:06
Speaker 1
-
Speaker 1
My Lord sir, I was hoping they were going to be other contributors, so it'll be a double banking on this particular amendment, but I do rise to support the amendment 99, tabled by my noble friend. Throughout our deliberations on this bill, the government has placed enormous emphasis on imposing tough outcomes based statutory duties on operators and suppliers across our critical infrastructure. But, my Lords, you must we must confront an uncomfortable truth. You can pass the most sophisticated cyber security regulations in the world, but if our economy lacks the trained, qualified human beings required to design, implement and maintain those defences, those regulations remain completely meaningless without a professional workforce capability, this bill merely codifies what IFC two has rightly termed compliance theatre, an expensive, box ticking exercise that produces mountains of paperwork without making our national networks one bit safer.
My Lords, looking at the scale of the crisis facing our domestic cyber workforce in their landmark 2025 2026 Cyber Security Workforce Study, Isc2 revealed that 52% of UK cyber security professionals identify a severe identify severe skill shortages as their single greatest barrier to complying with cyber regulations. Furthermore, 58% of organisations reported a critical or significant skills deficit, with an astonishing 87% suffering direct operational consequences from missed system patches and delayed vulnerability remediation to active security oversights across the civilian economy.
The UK is currently facing an 88% shortage of certified cyber practitioners. In an environment of such extreme scarcity, how on earth does the government expect regulated water utilities, transport operators and medium sized managed service providers to fulfil the heavy duties created by this bill? Amendment 99, in the name of my noble friend, provides the structural solution to this workforce crisis by placing the UK Cyber Security Council on a formal statutory footing.
And crucially, as my noble friend explains, this connects directly to the definition of a skilled person under clause 43. If the government is serious about raising our national resilience floor, it must recognise that human competence is just as vital as technological hardware. By embedding the UK Cyber Security Council's competence mandate onto the face of primary legislation, amendment 99 would ensure our cyber laws are backed by the skilled workforce needed to defend us.
I strongly urge the Minister to accept this amendment by professionalising our cyber workforce. We elevate this bill from more than a compliance exercise into a genuine national capability.
My Lords, looking at the scale of the crisis facing our domestic cyber workforce in their landmark 2025 2026 Cyber Security Workforce Study, Isc2 revealed that 52% of UK cyber security professionals identify a severe identify severe skill shortages as their single greatest barrier to complying with cyber regulations. Furthermore, 58% of organisations reported a critical or significant skills deficit, with an astonishing 87% suffering direct operational consequences from missed system patches and delayed vulnerability remediation to active security oversights across the civilian economy.
The UK is currently facing an 88% shortage of certified cyber practitioners. In an environment of such extreme scarcity, how on earth does the government expect regulated water utilities, transport operators and medium sized managed service providers to fulfil the heavy duties created by this bill? Amendment 99, in the name of my noble friend, provides the structural solution to this workforce crisis by placing the UK Cyber Security Council on a formal statutory footing.
And crucially, as my noble friend explains, this connects directly to the definition of a skilled person under clause 43. If the government is serious about raising our national resilience floor, it must recognise that human competence is just as vital as technological hardware. By embedding the UK Cyber Security Council's competence mandate onto the face of primary legislation, amendment 99 would ensure our cyber laws are backed by the skilled workforce needed to defend us.
I strongly urge the Minister to accept this amendment by professionalising our cyber workforce. We elevate this bill from more than a compliance exercise into a genuine national capability.
16:10
Speaker 6
-
Speaker 6
My Lords, I wonder if I could intervene and support Baroness Northover amendment. I don't want the Liberal Democrats to be on their own. So I hear the call from the noble Lord, Lord Clement-jones. And it brings me back to coalition days when I think Baroness Northover and myself were once ministers in the same department. So it's a heartfelt support, but I also want to support the substance of the amendment. As Baroness Northover says.
The noble Baroness says it may not necessarily be the right amendment, but the spirit behind it is absolutely a spirit that the government should recognise. I was a bit concerned when she was outlining the intention behind the amendment, whether it could perhaps be seen as a burden on business, particularly when we talk about small businesses and the need to audit their preparedness in terms of cyber. But to recall my contribution in second reading, I said at the time that while we tend to debate cyber in this chamber and other places as a great threat that we need to address, it is also a fantastic economic opportunity.
I should perhaps declare that I'm an adviser to a company called Digital Futures that trains software developers. We don't train them in cyber, but obviously the need to build up a skilled workforce in cyber is absolutely essential. And so when Baroness Northover referred to the patchwork of qualifications that exist in this area, it does seem to me that government has a clear opportunity and a clear role to guide us through the maze and to put the National Cyber Security Centre on a statutory footing, to give it, as it were, the ultimate role in deciding what are the appropriate qualifications in cyber , and to begin a sustained campaign to show young people or people returning to the workforce, or people who are considering a new career, that there is a route through to well recognised, well set out cyber qualifications which will contribute to the national economy and to our cyber resilience.
So I therefore wholeheartedly back this amendment. Yeah, yeah.
The noble Baroness says it may not necessarily be the right amendment, but the spirit behind it is absolutely a spirit that the government should recognise. I was a bit concerned when she was outlining the intention behind the amendment, whether it could perhaps be seen as a burden on business, particularly when we talk about small businesses and the need to audit their preparedness in terms of cyber. But to recall my contribution in second reading, I said at the time that while we tend to debate cyber in this chamber and other places as a great threat that we need to address, it is also a fantastic economic opportunity.
I should perhaps declare that I'm an adviser to a company called Digital Futures that trains software developers. We don't train them in cyber, but obviously the need to build up a skilled workforce in cyber is absolutely essential. And so when Baroness Northover referred to the patchwork of qualifications that exist in this area, it does seem to me that government has a clear opportunity and a clear role to guide us through the maze and to put the National Cyber Security Centre on a statutory footing, to give it, as it were, the ultimate role in deciding what are the appropriate qualifications in cyber , and to begin a sustained campaign to show young people or people returning to the workforce, or people who are considering a new career, that there is a route through to well recognised, well set out cyber qualifications which will contribute to the national economy and to our cyber resilience.
So I therefore wholeheartedly back this amendment. Yeah, yeah.
16:12
Speaker 7
-
Speaker 7
My Lords, I very much hope the government will accept the Lady Northover amendment. It strikes me as being a very practical and actually important contribution to this bill, in addition to the points that have been made by noble colleagues, I think there's one more thought to be added, which is that one of the weaknesses of the present situation and the present marketplace in which the skills are operating is the. The cost and the affordability of advice and help to SMEs on security issues.
It is costly. I mean, you know, security doesn't come cheap. And many of these small businesses that are nevertheless providing very sophisticated services are up against it when it comes actually to, to making an adequate profit to stay in business, therefore, a source of guidance and help of the kind that's being suggested by this structure, I think, is a real contribution not only to the viability of these small firms, but also for the general security of.
Of cyber security services generally. We should never forget that these small SMEs feed into the bigger ones. And it's very often an outlying and outlying service provided to a bigger provider that actually is the cause of a fault and a cause of, you know, somebody's an essential service actually proving insecure. So I think that to help the SMEs in this way will not only make them more secure, it will make the market generally more secure.
So I think this is a very important and helpful amendment, which I hope the government will accept. Yes.
It is costly. I mean, you know, security doesn't come cheap. And many of these small businesses that are nevertheless providing very sophisticated services are up against it when it comes actually to, to making an adequate profit to stay in business, therefore, a source of guidance and help of the kind that's being suggested by this structure, I think, is a real contribution not only to the viability of these small firms, but also for the general security of.
Of cyber security services generally. We should never forget that these small SMEs feed into the bigger ones. And it's very often an outlying and outlying service provided to a bigger provider that actually is the cause of a fault and a cause of, you know, somebody's an essential service actually proving insecure. So I think that to help the SMEs in this way will not only make them more secure, it will make the market generally more secure.
So I think this is a very important and helpful amendment, which I hope the government will accept. Yes.
16:14
Speaker 8
-
Speaker 8
My Lords, I thank the noble Baroness, Lady Northover, for bringing forward amendment 99 throughout our consideration of the Bill. I returned several times to the distinction between cyber compliance and cyber capability. I think this amendment goes directly to that issue. We can oppose any more duties upon businesses, require ever more reports, give regulators even more powers. But ultimately, our cyber resilience depends on having enough people with the skills to prevent attacks, to protect them and respond when they occur.
That is why I support the principle. Like many other noble lords behind the amendment. Indeed, the previous government supported the establishment and development of the UK Cyber Security Council precisely because we recognise the need to professionalise the cyber workforce, establish recognized standards and qualifications and build the skills base we need. But I would sound one note of caution we must not replace one form of box ticking with another. A certificate can be good evidence of capability, but is not the capability itself.
There are highly experienced cyber professionals who may not hold a particular qualification. And ultimately, what matters is whether an organisation has the people, skills and the necessary capability to protect its systems, not whether it can tick a box saying that somebody has the right to occur. So I support the noble Baroness objectives around professional standards, and particularly monitoring the supply and demand for cyber skills, and perhaps a little more cautious about giving the council an additional audit role, which could overlap with responsibilities of existing regulators.
But there is a more fundamental question here for the government. This bill substantially increases both the number of organisations subject to cyber regulation and the duties placed upon them. Has the government actually assessed how many additional skilled cyber professionals will be required to deliver all of this? Because if we create more cyber obligations without ensuring that we have the people capable of delivering them, we will have increased compliance without necessarily increasing our resilience. If the government does not believe that the UK Cyber Security Council should have the role proposed by amendment 99, perhaps the noble lady, the Minister can tell us who is responsible for assessing the capability gap and what the government intends to do to do that.
That is why I support the principle. Like many other noble lords behind the amendment. Indeed, the previous government supported the establishment and development of the UK Cyber Security Council precisely because we recognise the need to professionalise the cyber workforce, establish recognized standards and qualifications and build the skills base we need. But I would sound one note of caution we must not replace one form of box ticking with another. A certificate can be good evidence of capability, but is not the capability itself.
There are highly experienced cyber professionals who may not hold a particular qualification. And ultimately, what matters is whether an organisation has the people, skills and the necessary capability to protect its systems, not whether it can tick a box saying that somebody has the right to occur. So I support the noble Baroness objectives around professional standards, and particularly monitoring the supply and demand for cyber skills, and perhaps a little more cautious about giving the council an additional audit role, which could overlap with responsibilities of existing regulators.
But there is a more fundamental question here for the government. This bill substantially increases both the number of organisations subject to cyber regulation and the duties placed upon them. Has the government actually assessed how many additional skilled cyber professionals will be required to deliver all of this? Because if we create more cyber obligations without ensuring that we have the people capable of delivering them, we will have increased compliance without necessarily increasing our resilience. If the government does not believe that the UK Cyber Security Council should have the role proposed by amendment 99, perhaps the noble lady, the Minister can tell us who is responsible for assessing the capability gap and what the government intends to do to do that.
16:18
16:18
Speaker 2
-
Speaker 2
The noble Baroness for her amendment and more particularly, her focus on the importance of the skills and competence of the UK cyber security professional professionals that we all rely on and will continue to. In the economy. And as the noble Lord. Lord said that there is an important aspect here which is about the spirit behind her amendment. With this focus on the skill set and the professionalisation of the.
Of these individuals, which we wholeheartedly agree with, is incredibly important. Just to talk about the council itself for a moment, the Council is an independent royal chartered body. It unites government, industry and other sectors to boost the professionalism of the entire cyber sector, and the government does important work which already encompasses the majority of functions named in the amendment. It sets professional standards and maintains a register of UK's accredited cyber professionals.
It establishes pathways for cyber professionals, experienced and new entrants to have an easier route into quality cyber roles. We, however, I think, disagree on whether there is a necessity for. To put this on a statutory footing, the government considers the Council to be akin to other professional bodies in the UK, and while there are some professional bodies with a statutory role and oversight, either government or Parliament, it's standard practice in technical fields for an organisation to be recognised through a Royal Charter and afforded operational independence from government.
This includes the Engineering Council and Science Council equivalents. So if we were to go down the route that the amendment proposes, that would undermine the council's independence and that could affect the relationship with the sector. But that doesn't that is a separate point to the importance and the government's strong support for the need to professionalise the cyber sector and the government's support for this. Indeed, the government has committed to funding the UK Cyber Security Council over the spending review period until it becomes self sustainable.
Working closely with stakeholders across the profession and wider workforce, we believe in that way. Professional standards, accreditation and professional titles in cyber security will improve our cyber resilience and moreover, to the points raised by the noble Lord, Lord Clement-jones and others, the. And the noble Lord, Lord Markham, that on the adequacy of skilled persons this is remains important. The government's Tech First programme is helping to build the pipeline of talent for all frontier technologies.
It's available to all secondary schools across the UK. This month, approximately 1300 undergraduate and master's students are starting in the tech first scholarship programme, including over 300 students on a cyber security pathway. And the question about the adequacy of this and how the government monitors this. The government publishes an annual data on the state of the UK cyber security workforce and. The supply of cyber skills is increasing. There is a.
Currently, a net annual shortfall of approximately 3800 people in the UK cyber security market, but the second. For the second year running, the workforce gap has remained markedly lower than our previous estimates, which were so 3800 now, compared to 11,120 23 and 14,120 22. So the importance of focusing on the skills pipeline is incredibly important, and it is something that the government is backing. Equally, the government agrees with the noble Baroness that the regulatory authorities must have regard to the information and standards provided by the Council.
Indeed, we stated the need to align with the Council standards in the Government Cyber Action Plan, and the government has already worked with regulators to embed cybersecurity accreditation and professional standards into their guidance. And we want to go further, which is why we intend to use the bill's powers to introduce security and resilience requirements in secondary legislation. These are designed to be consistent with the NCS Cyber Assessment Framework, and we propose these requirements will address relevant training skills and professional standards, and we will be consulting on these proposals later in the year to ensure that the industries, large and small, covered by the regulated sectors, will be able to feed back on these, as will the regulators who will be responsible in this area.
And to the questions raised for SMEs by the noble Baroness Neville-jones. SMEs, whether inside or outside, whether they are or are not regulated entities have access to NCS and Cyber Resilience Centres and I'm sure that we will go on shortly to discuss in the context of the noble Baroness subsequent amendment, further support we can provide to those SMEs. So we are very committed to the role and function of the UK Cyber Security Council as a wide reaching and effective independent body, and we continue to support skills development in the UK.
As such, we are not convinced that there is a need to put it on a statutory footing at this stage.
Of these individuals, which we wholeheartedly agree with, is incredibly important. Just to talk about the council itself for a moment, the Council is an independent royal chartered body. It unites government, industry and other sectors to boost the professionalism of the entire cyber sector, and the government does important work which already encompasses the majority of functions named in the amendment. It sets professional standards and maintains a register of UK's accredited cyber professionals.
It establishes pathways for cyber professionals, experienced and new entrants to have an easier route into quality cyber roles. We, however, I think, disagree on whether there is a necessity for. To put this on a statutory footing, the government considers the Council to be akin to other professional bodies in the UK, and while there are some professional bodies with a statutory role and oversight, either government or Parliament, it's standard practice in technical fields for an organisation to be recognised through a Royal Charter and afforded operational independence from government.
This includes the Engineering Council and Science Council equivalents. So if we were to go down the route that the amendment proposes, that would undermine the council's independence and that could affect the relationship with the sector. But that doesn't that is a separate point to the importance and the government's strong support for the need to professionalise the cyber sector and the government's support for this. Indeed, the government has committed to funding the UK Cyber Security Council over the spending review period until it becomes self sustainable.
Working closely with stakeholders across the profession and wider workforce, we believe in that way. Professional standards, accreditation and professional titles in cyber security will improve our cyber resilience and moreover, to the points raised by the noble Lord, Lord Clement-jones and others, the. And the noble Lord, Lord Markham, that on the adequacy of skilled persons this is remains important. The government's Tech First programme is helping to build the pipeline of talent for all frontier technologies.
It's available to all secondary schools across the UK. This month, approximately 1300 undergraduate and master's students are starting in the tech first scholarship programme, including over 300 students on a cyber security pathway. And the question about the adequacy of this and how the government monitors this. The government publishes an annual data on the state of the UK cyber security workforce and. The supply of cyber skills is increasing. There is a.
Currently, a net annual shortfall of approximately 3800 people in the UK cyber security market, but the second. For the second year running, the workforce gap has remained markedly lower than our previous estimates, which were so 3800 now, compared to 11,120 23 and 14,120 22. So the importance of focusing on the skills pipeline is incredibly important, and it is something that the government is backing. Equally, the government agrees with the noble Baroness that the regulatory authorities must have regard to the information and standards provided by the Council.
Indeed, we stated the need to align with the Council standards in the Government Cyber Action Plan, and the government has already worked with regulators to embed cybersecurity accreditation and professional standards into their guidance. And we want to go further, which is why we intend to use the bill's powers to introduce security and resilience requirements in secondary legislation. These are designed to be consistent with the NCS Cyber Assessment Framework, and we propose these requirements will address relevant training skills and professional standards, and we will be consulting on these proposals later in the year to ensure that the industries, large and small, covered by the regulated sectors, will be able to feed back on these, as will the regulators who will be responsible in this area.
And to the questions raised for SMEs by the noble Baroness Neville-jones. SMEs, whether inside or outside, whether they are or are not regulated entities have access to NCS and Cyber Resilience Centres and I'm sure that we will go on shortly to discuss in the context of the noble Baroness subsequent amendment, further support we can provide to those SMEs. So we are very committed to the role and function of the UK Cyber Security Council as a wide reaching and effective independent body, and we continue to support skills development in the UK.
As such, we are not convinced that there is a need to put it on a statutory footing at this stage.
16:29
Speaker 5
-
Speaker 5
I thank the noble lady, the Minister, for her thoughtful reply and I thank other noble Lords for their support here. And clearly we're all sort of seeking to move in, in the same direction that there is a challenge here, which is incredibly important. There are risks here and whether this is the right way forward, we'll have to see. I'm very grateful to those organisations who fed into our select committee, which led me to put this amendment down.
I think this is an area that we will need to look at before report stage and to to look carefully at whether the drivers that the noble lady the Minister has mentioned there are actually sufficient. And so. But at this stage I beg leave to withdraw the amendment.
I think this is an area that we will need to look at before report stage and to to look carefully at whether the drivers that the noble lady the Minister has mentioned there are actually sufficient. And so. But at this stage I beg leave to withdraw the amendment.
16:31
16:31
Speaker 5
-
Speaker 5
And I rise to move. Amendment 100 in my name on the order paper. And again, this comes out of evidence that was submitted to our Select Committee on National Resilience. It's been reported. We've heard it all, that many SMEs think that they're too small to be a target. Yet government research and that was reported again at second reading, is that 50% of UK SMEs faced some kind of cyber breach or attack in 2025.
And it's also reported that for many small businesses, a cyber incident can be existential and that roughly 60% of SMEs who fall victim to a cyber attack go out of business within six months. So in this amendment, I'm seeking to address the position of SMEs coming from the insurance sector. The Association of British Insurers feels that the bill is narrow in scope and to quote large parts of the economy, including organisations that are economically significant during due to their scale, interconnectedness or role in supply chains will remain outside this regulatory perimeter.
And they note that the government's approach to these unregulated sectors relies primarily on voluntary governance mechanisms, including its new cyber governance code of practice. They feel that without stronger incentives, measurement and accountability, the risks that that won't deliver consistent improvements. And that's obviously something which is concerning a number of people. There are warnings we know this, that cyber risk is inherently systemic. Disruption is rarely confined to a single organisation or sector, but is increasingly transmitted through supply chains.
And so, as I mentioned in the last group, according to the Cyber Security Breaches survey, only 7% of UK businesses have formally reviewed the potential cyber security risk presented by the wider supply chain. So how do we bring in greater protection in a way that does start? As the noble Baroness, Baroness Neville-jones and Lord Vaizey have just mentioned, doesn't overwhelm the SMEs, my. This new clause would require the Secretary of State to establish a national free at point of use, cyber Security support and incident response service for relevant SMEs modelled on comparable overseas services such as the small business support provided by the Australian Cyber Security Centre.
Now. The Abi notes that the Bill rightly focuses on building resilience in our critical national infrastructure, but therefore more must be done to address the cyber resilience of SMEs. And not surprisingly, as I say, they're concerned about cyber insurance. They. They point out that the take up of cyber insurance amongst UK SMEs is very low, somewhere between 10 and 40%, and they argue that cyber insurance can help to prevent and alleviate the impact of cyber attacks on.
For SMEs. But obviously there is a. There is a cost to that. As cyber risks continue to go to grow, SMEs are typically more vulnerable and less less well placed than larger businesses to respond to cyber threats due to overstretched resources, including IT and potential security gaps and skills gaps. We do have to be careful that to make sure that reporting isn't too onerous for SMEs, and it's suggested that, for example, maybe the timelines for them reporting should be not as as as short as for bigger companies, and also that there should be better clarification of what is an actual or suspected cyber incident so that things which aren't as significant aren't sort of as it were, clogging up the system.
But I think that everybody agrees that we need to make sure that SMEs are better supported. And I welcome the fact that the government has set up some some support in this area. There's a Cyber Action Toolkit, which was launched in March 2026, which includes a helpline, and the Cyber Adviser scheme, which offers a 330 a free 30 minute session. And there's a small business guide for response and recovery. But when you look at what they're suggesting, they are pushing companies towards the commercial market.
So there's going to be a cost to that. And also down the line towards fraud analysis and law enforcement. And we know how challenging that is in so many areas. So that doesn't seem necessarily the most helpful or robust system. And the reason that I mentioned the Australian Cyber Resilience Service, and I've had a look at what they do, it it does go further than we are now going. And I would hope that the government would give thought to extending this in the way that the Australian system does.
So there's free, tailored person to person support with two functions helping small businesses assess and build resilience and helping them to recover after an incident such as account compromise, phishing or ransomware, where with case management and device remediation. So it's much more it's it's much more supportive than we currently have in the United Kingdom. So clearly, much more needs to be done to ensure that SMEs are aware of the risks and don't simply wait until they've been hit, but also that they are actively assisted.
That's important for them, but it's also important for the wider economy given how interlinked we all are. This is clearly an evolving area, and I look forward to hearing what the minister has to say about how we can move this forward, given how significant this is. I beg to move that amendment 100 in my name on the order paper. . After
And it's also reported that for many small businesses, a cyber incident can be existential and that roughly 60% of SMEs who fall victim to a cyber attack go out of business within six months. So in this amendment, I'm seeking to address the position of SMEs coming from the insurance sector. The Association of British Insurers feels that the bill is narrow in scope and to quote large parts of the economy, including organisations that are economically significant during due to their scale, interconnectedness or role in supply chains will remain outside this regulatory perimeter.
And they note that the government's approach to these unregulated sectors relies primarily on voluntary governance mechanisms, including its new cyber governance code of practice. They feel that without stronger incentives, measurement and accountability, the risks that that won't deliver consistent improvements. And that's obviously something which is concerning a number of people. There are warnings we know this, that cyber risk is inherently systemic. Disruption is rarely confined to a single organisation or sector, but is increasingly transmitted through supply chains.
And so, as I mentioned in the last group, according to the Cyber Security Breaches survey, only 7% of UK businesses have formally reviewed the potential cyber security risk presented by the wider supply chain. So how do we bring in greater protection in a way that does start? As the noble Baroness, Baroness Neville-jones and Lord Vaizey have just mentioned, doesn't overwhelm the SMEs, my. This new clause would require the Secretary of State to establish a national free at point of use, cyber Security support and incident response service for relevant SMEs modelled on comparable overseas services such as the small business support provided by the Australian Cyber Security Centre.
Now. The Abi notes that the Bill rightly focuses on building resilience in our critical national infrastructure, but therefore more must be done to address the cyber resilience of SMEs. And not surprisingly, as I say, they're concerned about cyber insurance. They. They point out that the take up of cyber insurance amongst UK SMEs is very low, somewhere between 10 and 40%, and they argue that cyber insurance can help to prevent and alleviate the impact of cyber attacks on.
For SMEs. But obviously there is a. There is a cost to that. As cyber risks continue to go to grow, SMEs are typically more vulnerable and less less well placed than larger businesses to respond to cyber threats due to overstretched resources, including IT and potential security gaps and skills gaps. We do have to be careful that to make sure that reporting isn't too onerous for SMEs, and it's suggested that, for example, maybe the timelines for them reporting should be not as as as short as for bigger companies, and also that there should be better clarification of what is an actual or suspected cyber incident so that things which aren't as significant aren't sort of as it were, clogging up the system.
But I think that everybody agrees that we need to make sure that SMEs are better supported. And I welcome the fact that the government has set up some some support in this area. There's a Cyber Action Toolkit, which was launched in March 2026, which includes a helpline, and the Cyber Adviser scheme, which offers a 330 a free 30 minute session. And there's a small business guide for response and recovery. But when you look at what they're suggesting, they are pushing companies towards the commercial market.
So there's going to be a cost to that. And also down the line towards fraud analysis and law enforcement. And we know how challenging that is in so many areas. So that doesn't seem necessarily the most helpful or robust system. And the reason that I mentioned the Australian Cyber Resilience Service, and I've had a look at what they do, it it does go further than we are now going. And I would hope that the government would give thought to extending this in the way that the Australian system does.
So there's free, tailored person to person support with two functions helping small businesses assess and build resilience and helping them to recover after an incident such as account compromise, phishing or ransomware, where with case management and device remediation. So it's much more it's it's much more supportive than we currently have in the United Kingdom. So clearly, much more needs to be done to ensure that SMEs are aware of the risks and don't simply wait until they've been hit, but also that they are actively assisted.
That's important for them, but it's also important for the wider economy given how interlinked we all are. This is clearly an evolving area, and I look forward to hearing what the minister has to say about how we can move this forward, given how significant this is. I beg to move that amendment 100 in my name on the order paper. . After
16:45
16:45
Speaker 6
-
Speaker 6
My Lords, I rise early to support Baroness Northover amendment, partly to spare the stress to the noble Baron, Lord Clement-jones, and also because there is a Liberal Democrat amendment imminent in the chamber. Although we of course will be abstaining, our solidarity with the Liberal Democrats does not extend too far, but it does on this amendment, which I think ties well with the noble Baroness earlier amendment to do with qualifications. And I was fascinated to hear her referring to the Australian Cyber Service, which I had not heard about before, and I would be fascinated to know more.
And it would be interesting to hear from the minister what other lessons there may be for us to learn from similar jurisdictions around the globe. I suspect the Canadians, for example, and indeed some of our European partners and indeed some of the South East Asian nations, like Singapore or South Korea, will probably have very advanced and sophisticated bureaucracies, if I can put it that way, or institutions looking at the cyber threat. And again, if I could address, rather than the technical detail of the noble Baroness amendment, but the spirit with which it is brought and why it Which it is brought and why it fits so well with her earlier amendment.
It is about injecting a sense of urgency in how we raise our game in cyber, in terms of our economy. Because when the noble Baroness mentioned the small business, the Cyber Action Toolkit, it took me back to the days when I was one of the cyber ministers in the coalition government. My responsibility was towards small businesses, and we launched endless small business toolkits, I think mainly because we wanted to say that we had launched a small business toolkit.
We certainly never put in place any mechanisms for auditing its impact or its success. And I think the reference constantly to about 7% of SMEs now having cyber policies in place may point to my abject failure in that role, and perhaps those of some of my successors. But I was the more I've listened to this debate, the more it takes me back to my childhood, when we would get leaflets about a possible nuclear conflagration. And I know that ministers and the government is now telling people to stockpile water and baked beans because of the impact of El Nino.
But we do know that it's the same cyber attack on the UK would cripple our economy and cripple essential public services. So it is akin, in my view, given the geopolitical situation , to a national emergency. The noble Baroness mentioned the views of the Association of British Insurers, and again, that was part of the toolkit. The feeling was that the professional services would drive small businesses towards becoming more skilled in assessing their cyber risks, that you couldn't get insurance or indeed cyber insurance unless you had clear policies to deal with cyber attacks.
You professional services firms, you couldn't necessarily get legal liability insurance, you know, for a data breach, which isn't necessarily going to cripple your business but will affect your customers and therefore leave you open to liability unless you had proper could demonstrate that you had proper processes in place to protect your data. So there is a whole ecosystem, it seems to me, that needs to be brought to bear to support the uptake of cyber skills and cyber audits by small businesses.
We cannot be complacent and assume that 7% is an acceptable figure, and that it should be allowed to evolve. So, to a certain extent, the noble Baroness amendment is one about the after effects. If you like that if you suffer a cyber attack, you should be able to call on skill people who we hope will have achieved the kind of qualifications, recognised qualifications that the noble Baroness talked about earlier. She compared them to doctors. I was thinking as I thought more about amendment, I was thinking more about plumbers and electricians, technical qualifications that you need to have to do a technical and difficult job and.
But I think we also need to also look at the. Before. How do we increase the number of small businesses that put in place policies that will protect them from cyber attacks, and that involves using the private sector, using the insurance companies, using the professional services firms to push forward clear protocols to which small businesses should be expected to adhere in order to receive the cover that they need to carry on doing business.
And it would be interesting to hear from the minister what other lessons there may be for us to learn from similar jurisdictions around the globe. I suspect the Canadians, for example, and indeed some of our European partners and indeed some of the South East Asian nations, like Singapore or South Korea, will probably have very advanced and sophisticated bureaucracies, if I can put it that way, or institutions looking at the cyber threat. And again, if I could address, rather than the technical detail of the noble Baroness amendment, but the spirit with which it is brought and why it Which it is brought and why it fits so well with her earlier amendment.
It is about injecting a sense of urgency in how we raise our game in cyber, in terms of our economy. Because when the noble Baroness mentioned the small business, the Cyber Action Toolkit, it took me back to the days when I was one of the cyber ministers in the coalition government. My responsibility was towards small businesses, and we launched endless small business toolkits, I think mainly because we wanted to say that we had launched a small business toolkit.
We certainly never put in place any mechanisms for auditing its impact or its success. And I think the reference constantly to about 7% of SMEs now having cyber policies in place may point to my abject failure in that role, and perhaps those of some of my successors. But I was the more I've listened to this debate, the more it takes me back to my childhood, when we would get leaflets about a possible nuclear conflagration. And I know that ministers and the government is now telling people to stockpile water and baked beans because of the impact of El Nino.
But we do know that it's the same cyber attack on the UK would cripple our economy and cripple essential public services. So it is akin, in my view, given the geopolitical situation , to a national emergency. The noble Baroness mentioned the views of the Association of British Insurers, and again, that was part of the toolkit. The feeling was that the professional services would drive small businesses towards becoming more skilled in assessing their cyber risks, that you couldn't get insurance or indeed cyber insurance unless you had clear policies to deal with cyber attacks.
You professional services firms, you couldn't necessarily get legal liability insurance, you know, for a data breach, which isn't necessarily going to cripple your business but will affect your customers and therefore leave you open to liability unless you had proper could demonstrate that you had proper processes in place to protect your data. So there is a whole ecosystem, it seems to me, that needs to be brought to bear to support the uptake of cyber skills and cyber audits by small businesses.
We cannot be complacent and assume that 7% is an acceptable figure, and that it should be allowed to evolve. So, to a certain extent, the noble Baroness amendment is one about the after effects. If you like that if you suffer a cyber attack, you should be able to call on skill people who we hope will have achieved the kind of qualifications, recognised qualifications that the noble Baroness talked about earlier. She compared them to doctors. I was thinking as I thought more about amendment, I was thinking more about plumbers and electricians, technical qualifications that you need to have to do a technical and difficult job and.
But I think we also need to also look at the. Before. How do we increase the number of small businesses that put in place policies that will protect them from cyber attacks, and that involves using the private sector, using the insurance companies, using the professional services firms to push forward clear protocols to which small businesses should be expected to adhere in order to receive the cover that they need to carry on doing business.
16:55
Speaker 10
-
Speaker 10
My Lords, I rise to speak in support of amendment 100, in the name of the noble lady, Baroness Northover. I did actually speak in support of this type of amendment in the second reading, and I still support its intentions, but I am going to give it an added twist, if you may. So the question in my mind is where this resource for SMEs should sit and whether indeed it should have any statutory powers or simply be an information and advisory centre.
There's no doubt that cyber security is needed, because here's another scary statistic 96% of all successful cyber attacks in the UK are perpetrated on SMEs, which represent soft targets for hackers, and I suggest that this resource should sit. Taking you back to day one, a committee within the proposed office for Cyber Security, as proposed by the noble Lord Clement-jones and my noble friend Lord Birt. Indeed, this is yet another example of the need to establish a body like an OCR.
Given the disturbingly fragmented approach to cyber security in this bill. And let me ask what. Where can we sensibly draw the line between SMEs across all sectors and the rest of the business world? For instance, advice given to a medium sized company with, say, 200 staff will overlap hugely with that of a company with 2000 staff. And in the minds of the hackers and the ransomware merchants, there's very little distinction.
And I would argue our economy needs a coherent, joined up approach run by a single, competent authority with statutory teeth for the benefit of SMEs and other companies and sectors. And I'm afraid, as it stands, this bill is a recipe for chaos, in my view. Cooks and broth would be a kind analogy. There's barely any room in the kitchen for the number of departments, teams, councils, centres and agencies involved.
The last count I heard was 30 or so, but I believe a few more have cropped up since. I think we will all.
There's no doubt that cyber security is needed, because here's another scary statistic 96% of all successful cyber attacks in the UK are perpetrated on SMEs, which represent soft targets for hackers, and I suggest that this resource should sit. Taking you back to day one, a committee within the proposed office for Cyber Security, as proposed by the noble Lord Clement-jones and my noble friend Lord Birt. Indeed, this is yet another example of the need to establish a body like an OCR.
Given the disturbingly fragmented approach to cyber security in this bill. And let me ask what. Where can we sensibly draw the line between SMEs across all sectors and the rest of the business world? For instance, advice given to a medium sized company with, say, 200 staff will overlap hugely with that of a company with 2000 staff. And in the minds of the hackers and the ransomware merchants, there's very little distinction.
And I would argue our economy needs a coherent, joined up approach run by a single, competent authority with statutory teeth for the benefit of SMEs and other companies and sectors. And I'm afraid, as it stands, this bill is a recipe for chaos, in my view. Cooks and broth would be a kind analogy. There's barely any room in the kitchen for the number of departments, teams, councils, centres and agencies involved.
The last count I heard was 30 or so, but I believe a few more have cropped up since. I think we will all.
17:00
Speaker 11
-
Speaker 11
Share the sympathy that Baroness has identified that SMEs need. There are 5.7 million SMEs in the UK. They. Many of them. Indeed, most of them will purchase what are relatively complex platforms, but will not be able. I mean, Lord Londesborough is extremely experienced in the SME sector. I have less experience than him, but some. Some experience. Hardly any of them will be able to employ anybody who is either able to understand the complexity of the platform that they have purchased, or the highly dynamic threats to that platform that exists.
And I think there are many ways in which we we need to raise our game and, and, and to help. I personally think that in the at least in the the short term, the most important thing, which we haven't discussed enough so far, is to require providers to supply safe products. And moreover, when they become vulnerable, which they become vulnerable the whole time, often unexpectedly, to patch those products for their customers immediately.
The providers have a level of sophistication that the customers aren't, and we've insufficiently focused on that in our discussion so far. And I think this the second thing to mention, and this is not really part of the bill, is that the, the, the, the government's cyber essentials programme is very sound. I forgot I think the minister quoted the other day, a figure, but only a trivial number of businesses have have signed up, have taken the pledge, and I think it just needs very, very much more publicity, much more dynamism from within government to raise the understanding of the level of threat that SMEs face.
And I think there are many ways in which we we need to raise our game and, and, and to help. I personally think that in the at least in the the short term, the most important thing, which we haven't discussed enough so far, is to require providers to supply safe products. And moreover, when they become vulnerable, which they become vulnerable the whole time, often unexpectedly, to patch those products for their customers immediately.
The providers have a level of sophistication that the customers aren't, and we've insufficiently focused on that in our discussion so far. And I think this the second thing to mention, and this is not really part of the bill, is that the, the, the, the government's cyber essentials programme is very sound. I forgot I think the minister quoted the other day, a figure, but only a trivial number of businesses have have signed up, have taken the pledge, and I think it just needs very, very much more publicity, much more dynamism from within government to raise the understanding of the level of threat that SMEs face.
17:05
Speaker 1
-
Speaker 1
My Lords, I too rise to support amendment 100 in the name of my noble friend Baroness Northover, and to add my support to some very useful speeches by the noble Lord, noble Lord Burton, noble Lord Londesborough, I entirely agree, noble Lord Vaizey, about the need to inject a sense of urgency into this. And , of course, the noble Lord and Lord Londesborough have asked some very fair questions. Really, going back to some of the debate we had on single regulator and product liability, my Lords, all of which are relevant to the kinds of duties that SMEs are under.
I also welcome what the noble Baroness, the Minister, had to say about their consciousness of the needs of SMEs. But, my Lords, I do think that this amendment really does provide a blueprint for a much better form of support for SMEs. They account for 99% of all private sector businesses. But as the NCC Group and industry experts have repeatedly warned, they do represent what might be described as the soft underbelly of our national supply chains.
They're the prime targets for cyber criminals seeking a back door into critical infrastructure, and it's completely unrealistic to expect a 60 person small supplier to bear the same heavy compliance overheads as a multinational utility. A single ransomware attack can permanently destroy a small, firm, hostile state. Actors and ransomware syndicates are no longer focusing exclusively on attacking the fortified perimeters of FTSE 100 utilities or government departments. Instead, they deliberately target smaller resource poor suppliers and niche contractors embedded in tier two or tier three of critical supply chains, using them as an easy, undefended backdoor into our critical national infrastructure .
And under the expanded critical supplier provisions in 12 and the managed services duties in clause nine, thousands of medium sized businesses and specialised tech vendors will now be pulled directly into the statutory Niss regime , facing severe regulatory requirements under threat of multi-million pound penalties. But as the government's own impact assessment acknowledged, there is a staggering what might be called resource asymmetry across UK businesses. A 50% specialised component manufacturer or regional logistics provider does not have a dedicated CIA chief information security officer does not possess a 24 over seven security operations centre and cannot afford to hire elite forensic incident response teams on £500 an hour retainers when a sophisticated ransomware attack hits a small business, it is frequently an existential event that forces permanent insolvency during committee stages in the Commons.
When my own friend Freddie Van Mierlo MP brought forward this proposal that the Commons minister, the Minister in the Commons, rejected it on the grounds that the government already provides a voluntary advice online. My Lords, a downloadable PDF checklist on gov.uk is not an incident response service. When a small critical supplier is locked out of its servers by Russian ransomware gang at 2:00 on a Sunday morning, a generic website checklist is completely useless.
They do not need advice to check their passwords. They need an active human technical first responder to help them contain the malware, isolate compromised systems and safely recover their data. Amendment 100 bridges this capability gap by mandating a dedicated national support service modelled as My Noble friend, explained directly on the proven, globally respected Australian Cyber Security Centre framework in Australia, the Federal Government provides small and medium businesses with free direct phone in emergency technical support, active breach triage and hands on recovery assistance.
It has achieved extraordinary success in hardening Australia's.
I also welcome what the noble Baroness, the Minister, had to say about their consciousness of the needs of SMEs. But, my Lords, I do think that this amendment really does provide a blueprint for a much better form of support for SMEs. They account for 99% of all private sector businesses. But as the NCC Group and industry experts have repeatedly warned, they do represent what might be described as the soft underbelly of our national supply chains.
They're the prime targets for cyber criminals seeking a back door into critical infrastructure, and it's completely unrealistic to expect a 60 person small supplier to bear the same heavy compliance overheads as a multinational utility. A single ransomware attack can permanently destroy a small, firm, hostile state. Actors and ransomware syndicates are no longer focusing exclusively on attacking the fortified perimeters of FTSE 100 utilities or government departments. Instead, they deliberately target smaller resource poor suppliers and niche contractors embedded in tier two or tier three of critical supply chains, using them as an easy, undefended backdoor into our critical national infrastructure .
And under the expanded critical supplier provisions in 12 and the managed services duties in clause nine, thousands of medium sized businesses and specialised tech vendors will now be pulled directly into the statutory Niss regime , facing severe regulatory requirements under threat of multi-million pound penalties. But as the government's own impact assessment acknowledged, there is a staggering what might be called resource asymmetry across UK businesses. A 50% specialised component manufacturer or regional logistics provider does not have a dedicated CIA chief information security officer does not possess a 24 over seven security operations centre and cannot afford to hire elite forensic incident response teams on £500 an hour retainers when a sophisticated ransomware attack hits a small business, it is frequently an existential event that forces permanent insolvency during committee stages in the Commons.
When my own friend Freddie Van Mierlo MP brought forward this proposal that the Commons minister, the Minister in the Commons, rejected it on the grounds that the government already provides a voluntary advice online. My Lords, a downloadable PDF checklist on gov.uk is not an incident response service. When a small critical supplier is locked out of its servers by Russian ransomware gang at 2:00 on a Sunday morning, a generic website checklist is completely useless.
They do not need advice to check their passwords. They need an active human technical first responder to help them contain the malware, isolate compromised systems and safely recover their data. Amendment 100 bridges this capability gap by mandating a dedicated national support service modelled as My Noble friend, explained directly on the proven, globally respected Australian Cyber Security Centre framework in Australia, the Federal Government provides small and medium businesses with free direct phone in emergency technical support, active breach triage and hands on recovery assistance.
It has achieved extraordinary success in hardening Australia's.
17:14
17:36
Speaker 1
-
Speaker 1
My Lord, just to continue from the previous speech, my Lords, if the state is going to impose heavily heavy, legally binding supply chain security duties on small businesses backed by turnover based fines, the state has a moral and strategic obligation to provide the operational tools needed to meet those standards by establishing a free, Australian style digital safety net under amendment 100, we turn this bill from a purely punitive compliance exercise into a genuine cooperative national partnership for cyber resilience, and I do urge the minister to accept this vital common sense amendment.
17:38
Speaker 3
-
Speaker 3
My Lords, I thank the noble Baroness, Lady Northover, for her amendment and, needless to say, support the intention behind it. I think it's clearly right that, having placed several new duties on businesses and their vendors, that the government considers how to ensure they are able to carry them out, and this is particularly the case for SMEs, who are often far less resilient, less well resourced and more vulnerable to cyber attacks than their larger counterparts.
But my Lords, when thinking through this idea, I was trying to come up with some sort of framework to estimate the costs of such a provision, and I just couldn't arrive at a satisfactory estimate, except that there would be very considerable, particularly given the urgency, complexity and difficulty of incident response. So as as I think, the noble Lord, Lord Clement-jones and others mentioned, providing advice on a government website is is pretty cheap and indeed useful.
Providing urgent incident response is pretty far from cheap. So then that begs the question would it be funded by the companies who are benefiting from this directly, or would it be funded by the taxpayer? I'm not sure. Either is wholly satisfactory. And of course, my Lords, the actual costs of running such a programme are going to depend largely on how it would operate and the terms of service that it would actually offer.
And I must confess, I was very grateful to the noble lady, Lady Northover, for pointing out the Australian example. I had been unaware of it before, and I would be very interested to know what, what service it actually provides and to what level. But it is incredibly hard to estimate how it's going to operate, what terms of service it's going to offer. The rate of cyber attacks is, of course, non-linear.
The scale and nature and complexity of each attack is going to vary significantly, and the amount of staff needed or resources available for response at any one time would need to be necessarily volatile and unpredictable. I also worry that a free service provided in this way might actually be a disincentive for SMEs and other firms to protect themselves properly. So I'm guided, I think, towards what I hope would be the same outcome, but with a slightly different entry point, which is to say, as we've heard from a number of speakers throughout second reading and indeed committee look at measures to promote the cyber insurance market.
Now, I indeed, the noble lady is right to say that uptake of cyber insurance by SMEs is far too low, but I think my. I personally feel it would make more sense to try and raise that uptake of cyber insurance, particularly by SMEs that would, I suggest, be far more efficient, sustainable and flexible in ensuring the resilience and protection of smaller businesses. Perhaps, for instance, we could think about reducing the premium tax on cyber insurers in order to promote the growth of their services or otherwise subsidising the uptake of cyber insurance for those companies that we want to see.
Taking it up, I think the best protection against cyber attack is the behaviour of firms and their staff, and the best way to drive safe behaviour is through insurance. The collective cost insurance is certainly no greater than that of a national cyber response service, and that cost is insured by those who benefit the most directly. All that said, I look forward to the noble Baroness. The minister's response.
But my Lords, when thinking through this idea, I was trying to come up with some sort of framework to estimate the costs of such a provision, and I just couldn't arrive at a satisfactory estimate, except that there would be very considerable, particularly given the urgency, complexity and difficulty of incident response. So as as I think, the noble Lord, Lord Clement-jones and others mentioned, providing advice on a government website is is pretty cheap and indeed useful.
Providing urgent incident response is pretty far from cheap. So then that begs the question would it be funded by the companies who are benefiting from this directly, or would it be funded by the taxpayer? I'm not sure. Either is wholly satisfactory. And of course, my Lords, the actual costs of running such a programme are going to depend largely on how it would operate and the terms of service that it would actually offer.
And I must confess, I was very grateful to the noble lady, Lady Northover, for pointing out the Australian example. I had been unaware of it before, and I would be very interested to know what, what service it actually provides and to what level. But it is incredibly hard to estimate how it's going to operate, what terms of service it's going to offer. The rate of cyber attacks is, of course, non-linear.
The scale and nature and complexity of each attack is going to vary significantly, and the amount of staff needed or resources available for response at any one time would need to be necessarily volatile and unpredictable. I also worry that a free service provided in this way might actually be a disincentive for SMEs and other firms to protect themselves properly. So I'm guided, I think, towards what I hope would be the same outcome, but with a slightly different entry point, which is to say, as we've heard from a number of speakers throughout second reading and indeed committee look at measures to promote the cyber insurance market.
Now, I indeed, the noble lady is right to say that uptake of cyber insurance by SMEs is far too low, but I think my. I personally feel it would make more sense to try and raise that uptake of cyber insurance, particularly by SMEs that would, I suggest, be far more efficient, sustainable and flexible in ensuring the resilience and protection of smaller businesses. Perhaps, for instance, we could think about reducing the premium tax on cyber insurers in order to promote the growth of their services or otherwise subsidising the uptake of cyber insurance for those companies that we want to see.
Taking it up, I think the best protection against cyber attack is the behaviour of firms and their staff, and the best way to drive safe behaviour is through insurance. The collective cost insurance is certainly no greater than that of a national cyber response service, and that cost is insured by those who benefit the most directly. All that said, I look forward to the noble Baroness. The minister's response.
17:46
Speaker 2
-
Speaker 2
I thank the noble Baroness for her amendment and, moreover, for linking the issue of cyber security with the wider questions on national resilience. I think she's absolutely right to situate it in that space, and indeed to introducing the topic of the right degree, the right amount of cyber security support for SMEs who are regulated under the Bill. And indeed, as the discussion has led to SMEs who are not regulated under the Bill, we know that SMEs require dedicated cyber security support, and that is why there are a wide range of free tools, guidance and training to help SMEs implement cyber security measures, and these resources are available to any business, not just those regulated under the regime.
This includes, as the noble Lord Lord mentioned, the Cyber Action Toolkit, designed to scale nationally to empower millions of small organisations through tailored cyber security advice with certified cyber advisers . And a number of noble lords, have referenced the importance of cyber essentials and noble also have also mentioned the importance of insurance and the importance of incident response. The. If you have got cyber essentials as an SME, you also have cyber insurance cover of up to 2500 £0 for those businesses under 20 of under £20 million turnover.
In order to incentivise and to link the process of getting cyber essentials with the benefits of insurance. Likewise, you get cyber incident support 24 over seven with cyber essentials and to the point that the noble Lord Vaizey meant, and indeed Lord and noble Lord Burt, about the sort of push we are indeed encouraging, maybe not pushing the private sector through the cyber pledge. This is outside of the regulated entities,
This includes, as the noble Lord Lord mentioned, the Cyber Action Toolkit, designed to scale nationally to empower millions of small organisations through tailored cyber security advice with certified cyber advisers . And a number of noble lords, have referenced the importance of cyber essentials and noble also have also mentioned the importance of insurance and the importance of incident response. The. If you have got cyber essentials as an SME, you also have cyber insurance cover of up to 2500 £0 for those businesses under 20 of under £20 million turnover.
In order to incentivise and to link the process of getting cyber essentials with the benefits of insurance. Likewise, you get cyber incident support 24 over seven with cyber essentials and to the point that the noble Lord Vaizey meant, and indeed Lord and noble Lord Burt, about the sort of push we are indeed encouraging, maybe not pushing the private sector through the cyber pledge. This is outside of the regulated entities,
17:51
Speaker 4
-
Speaker 4
Of the regulated entities outside of the regulated scope to indeed engage their supply chain. That is one of the key elements of the cyber pledge. Likewise, under the GCap, the Government Action Plan, cyber essentials or equivalent are needed for government procurements using official data. So these are mechanisms by which we are encouraging large organisations to look at their supply chains, to the point that the noble Lord, Lord Clement Jones, made about the interconnectedness of all of our organisations today and encouraging the uptake of cyber essentials, and with these very, very tangible benefits, and to the, I think, very fair question about what is the best way to provide cyber support to organisations.
And I heard a at least one noble Lord saying that. You know, different provision is not what what SMEs like. I think that many SMEs really prefer or if asked, would would request for local trusted advisers. And that is exactly what the cyber the regional Cyber Resilience Centres offer. They offer free support to SMEs across England and Wales. They cover a wide range of services such as incident response and business continuity service.
Indeed, the support with cyber essentials and security training. So to the question that sort of the point that the noble Lord, Lord Londesborough, made about a sort of a central sort of monolithic model, or these local or regional models, I think there is a lot of merit in a regional model that has some common standards, but is located much nearer to the SMEs that they serve. And I'd just like to sort of reiterate the point around the fact that small and micro organisations are exempt from being regulated as relevant digital service providers or relevant managed service providers, and they can only be regulated if they are operators of essential services or designated as a critical supplier for which there is a high bar.
So to the picture that Lord Clement-jones raised. We do not think there will be a very huge number of small enterprises in scope of this legislation, but all businesses, all small businesses, would benefit from the current provision, but they would not necessarily benefit from the model proposed by the amendment. The amendment also requires the Secretary of State to have regard to international regimes. We are indeed aware of such schemes such as the Australia Small Business Cyber Resilience Service.
Many of the offerings that that service provides, such as tailored support and practical incident recovery support, do already exist in the UK. As I have set out , and we do learn from international best practice, but we also tailor it to our local economy. The threats that we see and the the way to support businesses to best meet the needs of UK businesses and to best interact with UK regulations. So I hope that I have set out that the guidance and support for small and medium sized organisations is already available through existing UK support.
We are doing more to look at supply chains through discussions with large firms, through the GCap and indeed through this bill, and we think that a new dedicated service could potentially divert resources from these existing services and potentially impact on their efficacy. So to the the very central point that the noble Baroness started with the topics that she raises, we are absolutely in accordance with the importance of providing support to small and medium sized enterprises under the bill, and of ensuring that they have everything they need to be resilient and and respond to incidents.
And I heard a at least one noble Lord saying that. You know, different provision is not what what SMEs like. I think that many SMEs really prefer or if asked, would would request for local trusted advisers. And that is exactly what the cyber the regional Cyber Resilience Centres offer. They offer free support to SMEs across England and Wales. They cover a wide range of services such as incident response and business continuity service.
Indeed, the support with cyber essentials and security training. So to the question that sort of the point that the noble Lord, Lord Londesborough, made about a sort of a central sort of monolithic model, or these local or regional models, I think there is a lot of merit in a regional model that has some common standards, but is located much nearer to the SMEs that they serve. And I'd just like to sort of reiterate the point around the fact that small and micro organisations are exempt from being regulated as relevant digital service providers or relevant managed service providers, and they can only be regulated if they are operators of essential services or designated as a critical supplier for which there is a high bar.
So to the picture that Lord Clement-jones raised. We do not think there will be a very huge number of small enterprises in scope of this legislation, but all businesses, all small businesses, would benefit from the current provision, but they would not necessarily benefit from the model proposed by the amendment. The amendment also requires the Secretary of State to have regard to international regimes. We are indeed aware of such schemes such as the Australia Small Business Cyber Resilience Service.
Many of the offerings that that service provides, such as tailored support and practical incident recovery support, do already exist in the UK. As I have set out , and we do learn from international best practice, but we also tailor it to our local economy. The threats that we see and the the way to support businesses to best meet the needs of UK businesses and to best interact with UK regulations. So I hope that I have set out that the guidance and support for small and medium sized organisations is already available through existing UK support.
We are doing more to look at supply chains through discussions with large firms, through the GCap and indeed through this bill, and we think that a new dedicated service could potentially divert resources from these existing services and potentially impact on their efficacy. So to the the very central point that the noble Baroness started with the topics that she raises, we are absolutely in accordance with the importance of providing support to small and medium sized enterprises under the bill, and of ensuring that they have everything they need to be resilient and and respond to incidents.
17:59
Speaker 7
-
Speaker 7
I'd like to thank the noble lady, the Minister and Noble Lords for their support, and this is clearly an area where we agree that there is a problem. Clearly, we are very vulnerable in the United Kingdom. What we have in place is clearly not working sufficiently well. If 60% of SMEs who are hit by cyber attacks go under. And that's the context in which we ought to be looking at what proposals might seek to address that.
We clearly need to take SMEs forward in a way that doesn't overburden them. I hear the point about extending insurance cover, and we can indeed take more than one track. But there is a cost to not supporting SMEs. If they're going to go under. That's going to be an economic cost to the country, and if we don't support them, they are likely to be hit by cyber attacks, taking them and others under any way with with the effect upon our economy.
Clearly, the government agrees, hence putting in place the measures that the minister has outlined, and I'm suggesting from the evidence that we've received, that this needs to go further and faster. Exactly how we can discuss. But I think it's very clear that this is an escalating problem and that we need to do more to tackle it. And that's on the basis, in particular, of the concerns expressed to the National Resilience Select Committee.
And, as I say, from which which gave me the idea of putting this amendment forward. So I do think that we will need to return to this because it is a major problem. But in the meantime, I beg leave to withdraw the amendment. Is it your Lordship's.
We clearly need to take SMEs forward in a way that doesn't overburden them. I hear the point about extending insurance cover, and we can indeed take more than one track. But there is a cost to not supporting SMEs. If they're going to go under. That's going to be an economic cost to the country, and if we don't support them, they are likely to be hit by cyber attacks, taking them and others under any way with with the effect upon our economy.
Clearly, the government agrees, hence putting in place the measures that the minister has outlined, and I'm suggesting from the evidence that we've received, that this needs to go further and faster. Exactly how we can discuss. But I think it's very clear that this is an escalating problem and that we need to do more to tackle it. And that's on the basis, in particular, of the concerns expressed to the National Resilience Select Committee.
And, as I say, from which which gave me the idea of putting this amendment forward. So I do think that we will need to return to this because it is a major problem. But in the meantime, I beg leave to withdraw the amendment. Is it your Lordship's.
18:03
18:03
18:03
18:03
18:03
Speaker 9
-
Speaker 9
The question is that clause 43 stands part of the bill. As many are as of that opinion will say content. Content. The contrary not content. The contents have it. Government amendments 118 to 126 not moved. And the question is that clause 44 stand part of the bill. As many are as of that opinion will say content content to contrary, not content.
The contents have it. Government amendments 127 to 129. Not moved. Not moved. The question is that clause 45 stands part of the bill. As many as of that opinion will say content. Content. The contrary not content. The contents have it. The question is that clause 46 stands part of the bill. As many as of that opinion will say content.
Content. The contrary not content. The contents have it. Government amendments 130 to 139. Not moved. Not moved. The question is that clause 47 stands part of the bill. As many as of that opinion will say content.
The contents have it. Government amendments 127 to 129. Not moved. Not moved. The question is that clause 45 stands part of the bill. As many as of that opinion will say content. Content. The contrary not content. The contents have it. The question is that clause 46 stands part of the bill. As many as of that opinion will say content.
Content. The contrary not content. The contents have it. Government amendments 130 to 139. Not moved. Not moved. The question is that clause 47 stands part of the bill. As many as of that opinion will say content.
18:04
18:04
18:04
18:04
Speaker 9
-
Speaker 9
The question is that clause 48 stands part of the Bill. As many resolve that opinion will say, content to the contrary, not content. The contents have it. Government amendments 142 to 147. Not moved. Not moved. The question is that clause 49 stands part of the bill. As many as of that opinion will say content contrary, not content. The contents have it.
The question is that clause is 50 and 51 stand part of the bill en bloc? As many as of that opinion will say content the contrary not content. The contents have it. Amendment 148 not moved. The question is that clause 52 stands part of the bill. As many as of that opinion will say content. The contrary not content. The contents have it after clause 52.
Amendment 148. A Lord Clement Jones.
The question is that clause is 50 and 51 stand part of the bill en bloc? As many as of that opinion will say content the contrary not content. The contents have it. Amendment 148 not moved. The question is that clause 52 stands part of the bill. As many as of that opinion will say content. The contrary not content. The contents have it after clause 52.
Amendment 148. A Lord Clement Jones.
18:04
Speaker 1
-
Speaker 1
My Lords, I rise to move. Amendment 148 a standing in my name on the marshalled list. This amendment addresses profound structural and deeply concerning gap in the judicial oversight and democratic accountability of this bill. It represents the direct implementation of the authoritative recommendation of the Select Committee on the Constitution. In its third report of this session under clause 50, the Secretary of State, acting as the direct enforcement authority for national security directions, is empowered to issue a unilateral confirmation decision that potentially imposes hugely significant financial penalties upon non-compliant organisations.
Under clause 49, these penalties can reach a peak of up to £17 million, or 10% of global turnover for commercial undertakings, even for non undertakings such as our cash strapped NHS trusts, local government authorities or educational bodies, the penalty can be a crushing £17 million, with daily ongoing fines of up to 100 zero zero £0 per day. Yet under the bill, as currently drafted, the government expects us to accept that the only avenue of legal recourse for an affected organisation to challenge these business destroying fines is judicial review in the High Court.
My Lords, the government's own explanatory notes lay this bare. At paragraph 314, it says a penalty decision may only be appealed by judicial review heard in the High Court to deny a merit based right of appeal against a £17 million penalty is a severe, indefensible departure from our constitutional principles and the basic tenets of natural justice. As the Constitution Committee firmly pointed out, judicial review is entirely inadequate.
The penalties of this magnitude judicial review, by its very nature, is restricted to examining matters of legality, rationality and procedural propriety. The High Court cannot stand in the shoes of the decision maker. It cannot ask the fundamental question did this business actually commit the breach? It cannot ask is the calculation of this penalty fair on the facts, or is a multi-million pound fine truly proportionate to the actual national security risk presented under the current drafting? The Secretary of State acts as investigator, prosecutor, judge, jury and executioner.
My Lords, the executive branch determines that a breach has occurred, rejects the organisation's representations, issues the confirmation decision and demands a £17 million payment, with the High Court legally barred from reviewing the actual merits of that determination. My Lords, this constitutional danger is compounded by the extraordinary veil of secrecy being thrown over these proceedings. Under clause 50, subsections nine and ten, the Secretary of State can legally impose a strict nondisclosure requirement prohibiting an organisation from even disclosing the existence or the contents of a confirmation decision.
A breach of this gagging order carries its own eye watering penalty of up to £10 million, or £50,000 per day under clause 52. We're therefore contemplating a pretty terrifying scenario where a British business can be fined £17 million in complete statutory secrecy under a shadow regulatory regime operating entirely in the dark, with absolutely no right to have the merits of that devastating decision reviewed by an independent court of law.
My amendment, amendment 148 A , resolves this unacceptable scenario by establishing a clear statutory right of appeal to the upper tribunal. I'll ask why the upper tribunal? Because it is a senior court of record equivalent in status to the High Court, possessing specialised technical and legal expertise. Second, and most crucially, the upper tribunal already possesses established, highly robust tribunal procedure rules that are specifically designed to handle closed material proceedings, special advocates and classified national security material. This amendment explicitly provides in subsection six that rules must be made to secure that sensitive information, to secure that sensitive information is protected and not disclosed contrary to the interests of national security, including holding hearings in the absence of a party where absolutely necessary.
My Lords, we don't need to compromise our national security to guarantee a fair trial. The judicial machinery to balance these two imperatives is already built, tested and fully operational. Furthermore, this amendment introduces a vital safeguard. In subsection five. It mandates that when an appeal is brought, the requirement to pay the multi-million pound penalty is suspended until the independent tribunal has made its determination. Under the government's original punitive design, a business would be forced to pay a £17 million fine immediately while pursuing a restricted judicial review, which would bankrupt them before they even got a day in court.
My Lords, we cannot allow a compliance first justice Second culture to take root if we're to grant the executive the sweeping, unprecedented powers, we must match them with equivalent modern and constitutionally sound safeguards. We must ensure that the citizen and business are protected by a full merit based process, as recommended by our own Constitution Committee. And so I urge the noble Baroness, the Minister, to accept this vital constitutional correction. I beg to move.
Under clause 49, these penalties can reach a peak of up to £17 million, or 10% of global turnover for commercial undertakings, even for non undertakings such as our cash strapped NHS trusts, local government authorities or educational bodies, the penalty can be a crushing £17 million, with daily ongoing fines of up to 100 zero zero £0 per day. Yet under the bill, as currently drafted, the government expects us to accept that the only avenue of legal recourse for an affected organisation to challenge these business destroying fines is judicial review in the High Court.
My Lords, the government's own explanatory notes lay this bare. At paragraph 314, it says a penalty decision may only be appealed by judicial review heard in the High Court to deny a merit based right of appeal against a £17 million penalty is a severe, indefensible departure from our constitutional principles and the basic tenets of natural justice. As the Constitution Committee firmly pointed out, judicial review is entirely inadequate.
The penalties of this magnitude judicial review, by its very nature, is restricted to examining matters of legality, rationality and procedural propriety. The High Court cannot stand in the shoes of the decision maker. It cannot ask the fundamental question did this business actually commit the breach? It cannot ask is the calculation of this penalty fair on the facts, or is a multi-million pound fine truly proportionate to the actual national security risk presented under the current drafting? The Secretary of State acts as investigator, prosecutor, judge, jury and executioner.
My Lords, the executive branch determines that a breach has occurred, rejects the organisation's representations, issues the confirmation decision and demands a £17 million payment, with the High Court legally barred from reviewing the actual merits of that determination. My Lords, this constitutional danger is compounded by the extraordinary veil of secrecy being thrown over these proceedings. Under clause 50, subsections nine and ten, the Secretary of State can legally impose a strict nondisclosure requirement prohibiting an organisation from even disclosing the existence or the contents of a confirmation decision.
A breach of this gagging order carries its own eye watering penalty of up to £10 million, or £50,000 per day under clause 52. We're therefore contemplating a pretty terrifying scenario where a British business can be fined £17 million in complete statutory secrecy under a shadow regulatory regime operating entirely in the dark, with absolutely no right to have the merits of that devastating decision reviewed by an independent court of law.
My amendment, amendment 148 A , resolves this unacceptable scenario by establishing a clear statutory right of appeal to the upper tribunal. I'll ask why the upper tribunal? Because it is a senior court of record equivalent in status to the High Court, possessing specialised technical and legal expertise. Second, and most crucially, the upper tribunal already possesses established, highly robust tribunal procedure rules that are specifically designed to handle closed material proceedings, special advocates and classified national security material. This amendment explicitly provides in subsection six that rules must be made to secure that sensitive information, to secure that sensitive information is protected and not disclosed contrary to the interests of national security, including holding hearings in the absence of a party where absolutely necessary.
My Lords, we don't need to compromise our national security to guarantee a fair trial. The judicial machinery to balance these two imperatives is already built, tested and fully operational. Furthermore, this amendment introduces a vital safeguard. In subsection five. It mandates that when an appeal is brought, the requirement to pay the multi-million pound penalty is suspended until the independent tribunal has made its determination. Under the government's original punitive design, a business would be forced to pay a £17 million fine immediately while pursuing a restricted judicial review, which would bankrupt them before they even got a day in court.
My Lords, we cannot allow a compliance first justice Second culture to take root if we're to grant the executive the sweeping, unprecedented powers, we must match them with equivalent modern and constitutionally sound safeguards. We must ensure that the citizen and business are protected by a full merit based process, as recommended by our own Constitution Committee. And so I urge the noble Baroness, the Minister, to accept this vital constitutional correction. I beg to move.
18:07
18:07
Speaker 8
-
Speaker 8
My Lords, I rise early to address Lord Clement-jones amendment, but unfortunately it may increase his stress levels as I am opposing, which I guess means that I'm supporting the government. Unless the government is going to perform a volte face in the face of Lord Clement-jones strong arguments for a merit based review of any decision reached by the First tribunal, and I do so because it brings back memories. When I was the telecommunications Minister and therefore responsible for Ofcom , and at the time Ofcom or Ofcom, decisions were subject to a merit review in front of the Competition Appeals Tribunal, which meant that every decision they took regarding broadcasters or telecoms companies was effectively reheard at appeal.
And, as you can imagine, complex technical decisions on the charges being levied by wholesale carriers or in the case of Sky, the charges being levied on other broadcasters to carry, for example, the Premier League, were extremely complex and Ofcom faced an army of lawyers deployed by those companies and without wishing to give away too much confidences. I mean, it was ten years ago, so I don't think it's a matter of national security. Ofcom found itself extremely frustrated by this, and it was costing millions and millions and millions of pounds.
It was being used effectively as a delaying tactic and almost as a firepower tactic by commercial providers to put off decisions, you know, understandably, that were not in their commercial favour. And I resisted initially Ofcom's blandishments to say we should move away from merit based appeals, partly because I thought, we'll just start a whole new process of the courts feeling their way under the new system, and you'll end up getting a whole new set of delays, as the courts have to make effectively novel decisions under a novel regime.
But once Ofcom and indeed right on cue, one of the great telecom chief executives walks into the committee. Although I don't think she ever used her firepower in such a cynical way, perhaps as others did against Ofcom. I refer for the record to the noble my noble friend Baroness Harding in the. The changes did go through, and as far as I'm concerned and I haven't done my homework properly, things have settled down to a very straightforward process where a regular makes a decision based on the facts, and if that decision somehow can be seen as unlawful by the company in question, that decision can, of course, be judicially reviewed.
Removing merit based appeals does not remove. It has to be stressed the right of appeal. So it seems to me fairly obvious as it is in civil and criminal cases, that decisions are made on the facts, and a decision is as good at. But if that decision is somehow so outside the normal judicial process of making a decision so irrational as it were, which is what judicial review exists to review, then it can be reviewed. And I think that is a system that should be consistent across regulatory appeals.
I cannot necessarily comment on Lord Clement-jones effective points about the clandestine nature of some of the findings, but it may well be that, given issues to do with cyber security and attacks on critical national infrastructure and so on, that some elements of cases must be kept confidential. That is a matter , perhaps for further debate, but I would be extremely concerned if we were to go back to merits based reviews for regulatory appeals.
And, as you can imagine, complex technical decisions on the charges being levied by wholesale carriers or in the case of Sky, the charges being levied on other broadcasters to carry, for example, the Premier League, were extremely complex and Ofcom faced an army of lawyers deployed by those companies and without wishing to give away too much confidences. I mean, it was ten years ago, so I don't think it's a matter of national security. Ofcom found itself extremely frustrated by this, and it was costing millions and millions and millions of pounds.
It was being used effectively as a delaying tactic and almost as a firepower tactic by commercial providers to put off decisions, you know, understandably, that were not in their commercial favour. And I resisted initially Ofcom's blandishments to say we should move away from merit based appeals, partly because I thought, we'll just start a whole new process of the courts feeling their way under the new system, and you'll end up getting a whole new set of delays, as the courts have to make effectively novel decisions under a novel regime.
But once Ofcom and indeed right on cue, one of the great telecom chief executives walks into the committee. Although I don't think she ever used her firepower in such a cynical way, perhaps as others did against Ofcom. I refer for the record to the noble my noble friend Baroness Harding in the. The changes did go through, and as far as I'm concerned and I haven't done my homework properly, things have settled down to a very straightforward process where a regular makes a decision based on the facts, and if that decision somehow can be seen as unlawful by the company in question, that decision can, of course, be judicially reviewed.
Removing merit based appeals does not remove. It has to be stressed the right of appeal. So it seems to me fairly obvious as it is in civil and criminal cases, that decisions are made on the facts, and a decision is as good at. But if that decision is somehow so outside the normal judicial process of making a decision so irrational as it were, which is what judicial review exists to review, then it can be reviewed. And I think that is a system that should be consistent across regulatory appeals.
I cannot necessarily comment on Lord Clement-jones effective points about the clandestine nature of some of the findings, but it may well be that, given issues to do with cyber security and attacks on critical national infrastructure and so on, that some elements of cases must be kept confidential. That is a matter , perhaps for further debate, but I would be extremely concerned if we were to go back to merits based reviews for regulatory appeals.
18:08
Speaker 10
-
Speaker 10
My Lords, I thank the noble Lord, Lord Clement Jones, for introducing this important group and for all noble, noble lords for their contributions, beginning with the Noble Lords Amendment 148 a. I think it is reasonable to suggest that there should be a further right to appeal, given that we are talking about potentially large penalties of 17 million or 10% of their annual turnover. But like my noble friend Lord Vaizey, I too share concerns about whether we really can handle such a such a process by the upper tribunal system.
Right now, it has an open caseload of over 800 000, which is a 19% year on year increase, and disposals have decreased by 4%. As such, I'm hesitant to offer my support without being assured that the further pressure will not be placed on tribunals, and this is a workable mechanism. My Lords amendment 174 A and 174 B standing in my name and those of my noble friends, Viscount Camrose and Lord Holmes of Richmond, would require the Secretary of State to establish a register of foreign powers, posing a cyber security risk to this country, and to review and report on the extent of the risk posed by powers on that list.
Part four of this bill gives the Secretary of State significant new powers to intervene, where the use of vendors, goods and services or facilities pose a risk to national security. We support that objective, but power of that kind is only as good as the intelligence that informs it. And at present, the bill is silent on how Secretary of State is to identify in a systematic and transparent way which foreign powers actually present that risk. Amendment 174 A aims to fill that information gap, outlining a thorough set of criteria for inclusion.
A state confirmed a state confirmed by Gchq to have perpetrated or attempted a cyber attack against the UK in the preceding seven years, directed at an operator of an essential service or critical supplier and carried out through a State Department agency or affiliate or state that Gchq has separately warned poses a risk to such systems. My Lords, important to ensuring that we are fully informed of foreign threats can hardly be overstated. Just this year, the NSA's chief executive reported that three quarters of all attacks on our critical national infrastructure over the preceding 12 months were carried out by hostile states with Russia, China and Iran named specifically, the Nsc's annual review recorded 214 national significant incidents in the year to August 2025, more than double the previous year, with 18 rated highly significant.
For illustration, the cyber attack late last month. The shutdown of British power plant is reported to be committed by Iran backed hackers over the course of the last parliament, and this one, China has targeted parliament and comprised and compromised the Electoral Commission. Russia's SFB has targeted British parliamentary parliamentarians and successfully stolen and leaked politically sensitive documents. And the Iranian state actors have targeted British politicians, governments and defence who sustained cyber espionage campaigns.
My Lords, we are seeing a surge in cyber attacks driven largely by foreign threats. If the government are serious about security and resilience, tackling foreign interference must be a priority. As a start of published criteria, based register would bring much needed transparency and rigour to the process. My Lords Amendment 174 seeks to achieve such transparency. It would require the Secretary of State for each foreign power added to the register, to conduct a review of the extent and nature of the risk that power poses.
It also includes a built in safeguard for the government, where the Secretary of State considers that laying their report would be contrary to national security interests. They may instead make a statement to Parliament confirming that the review has taken place, and explaining that it cannot be published. It attempts to strike a balance between accountability and the sensitivities that intelligence assessments of this kind will naturally carry. My Lords, I anticipate the Minister may say that such a register already exists in substance within government and that formalising and publishing it risks informing those very powers of the extent of our knowledge.
I would gently observe that the amendment does not require publication of intelligence sources, substance or methods only. The fact of designation against published criteria, and a reviewed assessment of risk. Given the scale of the threat. The NCS itself describes, and given the very significant powers this part confers, I believe Parliament is entitled to ask that those powers rested on clear evidence and reviewable basis. I look forward to the noble Baroness. The minister's response.
Right now, it has an open caseload of over 800 000, which is a 19% year on year increase, and disposals have decreased by 4%. As such, I'm hesitant to offer my support without being assured that the further pressure will not be placed on tribunals, and this is a workable mechanism. My Lords amendment 174 A and 174 B standing in my name and those of my noble friends, Viscount Camrose and Lord Holmes of Richmond, would require the Secretary of State to establish a register of foreign powers, posing a cyber security risk to this country, and to review and report on the extent of the risk posed by powers on that list.
Part four of this bill gives the Secretary of State significant new powers to intervene, where the use of vendors, goods and services or facilities pose a risk to national security. We support that objective, but power of that kind is only as good as the intelligence that informs it. And at present, the bill is silent on how Secretary of State is to identify in a systematic and transparent way which foreign powers actually present that risk. Amendment 174 A aims to fill that information gap, outlining a thorough set of criteria for inclusion.
A state confirmed a state confirmed by Gchq to have perpetrated or attempted a cyber attack against the UK in the preceding seven years, directed at an operator of an essential service or critical supplier and carried out through a State Department agency or affiliate or state that Gchq has separately warned poses a risk to such systems. My Lords, important to ensuring that we are fully informed of foreign threats can hardly be overstated. Just this year, the NSA's chief executive reported that three quarters of all attacks on our critical national infrastructure over the preceding 12 months were carried out by hostile states with Russia, China and Iran named specifically, the Nsc's annual review recorded 214 national significant incidents in the year to August 2025, more than double the previous year, with 18 rated highly significant.
For illustration, the cyber attack late last month. The shutdown of British power plant is reported to be committed by Iran backed hackers over the course of the last parliament, and this one, China has targeted parliament and comprised and compromised the Electoral Commission. Russia's SFB has targeted British parliamentary parliamentarians and successfully stolen and leaked politically sensitive documents. And the Iranian state actors have targeted British politicians, governments and defence who sustained cyber espionage campaigns.
My Lords, we are seeing a surge in cyber attacks driven largely by foreign threats. If the government are serious about security and resilience, tackling foreign interference must be a priority. As a start of published criteria, based register would bring much needed transparency and rigour to the process. My Lords Amendment 174 seeks to achieve such transparency. It would require the Secretary of State for each foreign power added to the register, to conduct a review of the extent and nature of the risk that power poses.
It also includes a built in safeguard for the government, where the Secretary of State considers that laying their report would be contrary to national security interests. They may instead make a statement to Parliament confirming that the review has taken place, and explaining that it cannot be published. It attempts to strike a balance between accountability and the sensitivities that intelligence assessments of this kind will naturally carry. My Lords, I anticipate the Minister may say that such a register already exists in substance within government and that formalising and publishing it risks informing those very powers of the extent of our knowledge.
I would gently observe that the amendment does not require publication of intelligence sources, substance or methods only. The fact of designation against published criteria, and a reviewed assessment of risk. Given the scale of the threat. The NCS itself describes, and given the very significant powers this part confers, I believe Parliament is entitled to ask that those powers rested on clear evidence and reviewable basis. I look forward to the noble Baroness. The minister's response.
18:14
Speaker 4
-
Speaker 4
I thank the noble Lords for their amendments, starting with amendment 148 from the noble Lord, Lord Clement Jones, which indeed is in line with the recommendation from the Constitution Committee. And I thank the Constitution Committee for their report and for their detailed scrutiny of this legislation. As the noble Lord points out, part four of this bill enables the Secretary of State to issue penalties for regulated entities that do not comply with directions. The High Court will have jurisdiction to review the lawfulness of a particular penalty issued under part four of the Bill.
The. The noble Lord, Lord VC, referred to precedent and to consistency. Our assessment is that the High Court is the appropriate route for hearing sensitive national security cases, and that is consistent with the approach that previous governments have taken to national security legislation. Telecoms, the Telecommunications Security Act, the National Security and Investment Act and the Procurement Act . All key pieces of national security legislation all follow this approach, and that is the reason we have adopted it as well.
And to the the point around parliamentary scrutiny of directions, the government's default position is that copies of directions will be laid in Parliament to enable all parliamentarians to scrutinise the government's use of these powers. I am, of course, preparing a formal response to the Constitution Committee, which will be sent in due course. I now turn to the amendments.
The. The noble Lord, Lord VC, referred to precedent and to consistency. Our assessment is that the High Court is the appropriate route for hearing sensitive national security cases, and that is consistent with the approach that previous governments have taken to national security legislation. Telecoms, the Telecommunications Security Act, the National Security and Investment Act and the Procurement Act . All key pieces of national security legislation all follow this approach, and that is the reason we have adopted it as well.
And to the the point around parliamentary scrutiny of directions, the government's default position is that copies of directions will be laid in Parliament to enable all parliamentarians to scrutinise the government's use of these powers. I am, of course, preparing a formal response to the Constitution Committee, which will be sent in due course. I now turn to the amendments.
18:18
18:18
18:23
18:23
Speaker 4
-
Speaker 4
I resume at amendment 174 A and 174 B. Introduced and spoken to by Lord Markham. They would require the Secretary of State to create a register of foreign powers which pose a threat to UK cybersecurity. Review this register and lay the report in Parliament. This is intended to inform the use of the powers granted under part four of the Bill. The noble Lord is right that hostile foreign actors pose a clear risk to our essential services.
National security is the first responsibility of any government, and that's why we're addressing these risks actively, including through this bill. This bill grants the Secretary of State important new powers to issue national security directions to regulated entities or regulators, where their compromise poses a national security risk, and we will seek to strengthen the government's national security toolkit further to protect our supply chains from hostile actors. That's why we put forward a package of amendments to introduce new powers that would enable the UK to address vendor related cyber risks by hostile actors in our critical infrastructure supply chains, and I look forward to engaging noble lords further on this essential package ahead of report stage.
Any decision to use the powers in this Bill would be informed by expert national security advice, including from Gchq. The direction has provided a strategic case by case basis to safeguarding our national security, irrespective of the specific actor. As a result, a country specific approach lacks the nuance required to comprehensively assess and respond to all relevant risks. We also need to proceed responsibly in how we categorise and present these risks in the public sphere.
That is not to say that we shirk transparency about these kinds of risks. The government is already able to communicate with Parliament and the public about such cyber risks, where it is appropriate to do so. As the noble Lord Markham has set out in the NCS Annual Report, highlights highlights risks posed by foreign actors and we work with NCS to mitigate these risks. I note also that noble Lords have confronted this question before, most notably during the passage of the Telecommunications Security Act, where there was cross-party support for vendors to be assessed on a case by case basis rather than by designating nations themselves as hostile actors.
I hope in that vein, noble lords are reassured that the government has the tools to act strategically, acting on the right intelligence where hostile states seek to do us harm.
National security is the first responsibility of any government, and that's why we're addressing these risks actively, including through this bill. This bill grants the Secretary of State important new powers to issue national security directions to regulated entities or regulators, where their compromise poses a national security risk, and we will seek to strengthen the government's national security toolkit further to protect our supply chains from hostile actors. That's why we put forward a package of amendments to introduce new powers that would enable the UK to address vendor related cyber risks by hostile actors in our critical infrastructure supply chains, and I look forward to engaging noble lords further on this essential package ahead of report stage.
Any decision to use the powers in this Bill would be informed by expert national security advice, including from Gchq. The direction has provided a strategic case by case basis to safeguarding our national security, irrespective of the specific actor. As a result, a country specific approach lacks the nuance required to comprehensively assess and respond to all relevant risks. We also need to proceed responsibly in how we categorise and present these risks in the public sphere.
That is not to say that we shirk transparency about these kinds of risks. The government is already able to communicate with Parliament and the public about such cyber risks, where it is appropriate to do so. As the noble Lord Markham has set out in the NCS Annual Report, highlights highlights risks posed by foreign actors and we work with NCS to mitigate these risks. I note also that noble Lords have confronted this question before, most notably during the passage of the Telecommunications Security Act, where there was cross-party support for vendors to be assessed on a case by case basis rather than by designating nations themselves as hostile actors.
I hope in that vein, noble lords are reassured that the government has the tools to act strategically, acting on the right intelligence where hostile states seek to do us harm.
18:24
Speaker 1
-
Speaker 1
And I thank the Minister for her response. And I thank the noble Lord, VC and noble Lord Markham for their contributions. I can't help feeling that the noble Lord Vaz's approach to this is very coloured by his history as a minister, and I can understand that, my Lords, because I saw the frustration that was within Ofcom with the type of judicial review. It was a particular type of judicial review. It wasn't a full merit appeal, but it allowed merits to be considered as part of the judicial review process, and subsequently that was changed .
And it probably has calmed the the, the, the the way that appeals are carried on. It calmed it down. But my Lords, in this particular case, and he said that he wasn't cited as to the secrecy aspects of this. But really what we're saying here, and I was quite interested in what the noble Markham had to say, because he started off by saying that he actually supported the amendment and then, I think, rather coloured by Lord Vaz's response.
I think his speech originally was written in support, and he did a bit of a U-turn halfway through, my Lord. So I'm sure he knows in his heart that this is the right. It really. The argument is expediency versus justice, my Lords, in this case. And I think choosing expediency, especially in the light of what the Constitution Committee had to say, would be extremely inadvisable. But I was encouraged by the fact that the minister is producing a memorandum in response to the Constitution Committee, and I think we'll all wait with bated breath for when that arrives.
My Lords. In the meantime, I beg leave to withdraw my amendment.
And it probably has calmed the the, the, the the way that appeals are carried on. It calmed it down. But my Lords, in this particular case, and he said that he wasn't cited as to the secrecy aspects of this. But really what we're saying here, and I was quite interested in what the noble Markham had to say, because he started off by saying that he actually supported the amendment and then, I think, rather coloured by Lord Vaz's response.
I think his speech originally was written in support, and he did a bit of a U-turn halfway through, my Lord. So I'm sure he knows in his heart that this is the right. It really. The argument is expediency versus justice, my Lords, in this case. And I think choosing expediency, especially in the light of what the Constitution Committee had to say, would be extremely inadvisable. But I was encouraged by the fact that the minister is producing a memorandum in response to the Constitution Committee, and I think we'll all wait with bated breath for when that arrives.
My Lords. In the meantime, I beg leave to withdraw my amendment.
18:24
Speaker 9
-
Speaker 9
Is it your lordships pleasure that the amendment be withdrawn? The amendment is by leave withdrawn. The question is that clause 53 stand part of the Bill. As many as of that opinion will say content. Content. The contrary . Not content. The contents have it. Government amendments 149 to 152. Not moved. Not moved. Not moved. I cannot call, sorry.
The clerk is 54. Oh, I do apologize. The question is clause 54 stand. Part of the bill is as many as of that opinion will say content and the contrary. Not content. The contents have it. Government amendment 154 not moved. The question is that clause 55 stand part of the bill. As many as of that opinion will say content and the contrary . Not content. The contents have it.
The question is that clause 56 to 57 stand part of the bill on block. As many as of that opinion will say, content to the contrary, not content. The contents have it. Government amendments 155 to 163. Not moved yet. The question is that clause 58 stand part of the bill. As many as on that opinion will say content, content, content, content. The contents have it after clause 58.
Amendment 164. Lord Clement Jones.
The clerk is 54. Oh, I do apologize. The question is clause 54 stand. Part of the bill is as many as of that opinion will say content and the contrary. Not content. The contents have it. Government amendment 154 not moved. The question is that clause 55 stand part of the bill. As many as of that opinion will say content and the contrary . Not content. The contents have it.
The question is that clause 56 to 57 stand part of the bill on block. As many as of that opinion will say, content to the contrary, not content. The contents have it. Government amendments 155 to 163. Not moved yet. The question is that clause 58 stand part of the bill. As many as on that opinion will say content, content, content, content. The contents have it after clause 58.
Amendment 164. Lord Clement Jones.
18:25
Speaker 1
-
Speaker 1
My Lords, I rise to move amendment 164 standing in the Marshall List in my name, and I'm delighted to say that of the noble Lord, Lord Arbuthnot of Edrom as well, and. But sadly he's tied up next door with matters of national security. My Lords, I hope I'm not giving away any secrets. And he's unable to speak to this amendment, but I do value the support that he's given. As a long standing campaigner for changes to the Computer Misuse Act.
My Lords, this amendment addresses a long standing, globally recognised and increasingly dangerous absurdity in our criminal law. The fact that our crime statute, the Computer Misuse Act 1990, criminalizes the very cyber security professionals who are actively working to defend our country. The Computer Misuse Act is now 36 years old. It was drafted in 1990, an era before the World Wide Web had entered public consciousness, when less than half a percent of the British public had ever sent an electronic email.
And when the entire concept of proactive ethical vulnerability research was completely unimagined because the act was drafted at such a primitive stage of the digital revolution, it contains a blanket indiscriminate prohibition on all unauthorised access to computer material. In its current form, it draws no legal distinction whatsoever between a malicious hacker backed by a hostile foreign state, seeking to sabotage our critical national infrastructure and an ethical, good faith cyber security researcher if you like a white hat hacker seeking to discover and responsibly disclose vulnerabilities before criminals can exploit them.
My Lords, the real world consequence of this statutory black spot blind spot is that British cyber defenders are forced to operate with one hand tied behind their backs. Consider the day to day operational reality. If an ethical researcher in the UK scans an internet facing network, identifies a critical zero day vulnerability that leaves an NHS hospital data set, or a municipal water control system exposed, and takes the basic technical steps necessary to verify the flaw. They have technically technically committed a criminal offence under section one of the 1990 act.
They face prosecution and imprisonment even if their actions were undertaken entirely in good faith, strictly in the public interest and followed, followed by immediate responsible disclosure to the National Cyber Security Centre or the affected operator. My Lords, I and others have received overwhelmingly passionate representations from the Cyber Up campaign, representing what might be described as the elite of our domestic cyber security industry, alongside the Criminal Law Reform Now Network and the NCC Group.
Their evidence is stark. The chilling effect of the Computer Misuse Act is actively undermining our national cyber resilience. Leading UK cybersecurity companies are routinely forced to prohibit their researchers from conducting proactive threat intelligence gathering and vulnerability research on UK based infrastructure because the legal risks are unacceptable. When British researchers identify an active cyber threat originating abroad, they are legally constrained from investigating the command and control servers.
If doing so involves touching a remote system without explicit owner authorisation. Meanwhile, our international competitors have moved ahead. The United States updated its Department of Justice charging policies to explicitly protect good faith security. Research countries like Portugal, France and Australia have established clear legal safe harbors for ethical cyber defenders. As a direct result, British cyber talent and commercial investment are migrating overseas to jurisdictions where proactive defence is recognised as a public good rather than a criminal act.
During the bill's passage in the other place and during our second reading debate, the government's response was to agree with the principle of reform while arguing that this bill is not the appropriate vehicle, ministers pointed to an ongoing Home Office review and suggested that reform must wait for a hypothetical future security bill. My Lords, we've been waiting for the outcome of that Home Office review for over five years. The review was was kicked into the long grass of Whitehall inter-departmental delays while our critical network remained under siege.
My Lords, there is potentially a contradiction at the heart of the government's strategy on this. On the one hand, ministers are using this bill to impose sweeping new legal duties and heavy turnover based penalties on operators to secure their networks. On the other hand, the government continues to criminalise the very security professionals and ethical researchers whom these operators must hire to test and harden their systems. Amendment 164 resolves this competition in safety.
It inserts a direct, substantive statutory defence into sections one and three of the CMA. An individual charged under the Act will have a complete legal defence if they can prove that their conduct was reasonable for the detection or prevention of crime, or that they were carrying on legitimate cyber security activities specifically defined on the face of the bill as vulnerability research, penetration testing, threat intelligence gathering or responsible disclosure necessary to safeguard system security.
Crucially, my Lords, this amendment does not create a free for all or a loophole for malicious actors. Under subsection four, it empowers the Secretary of State to approve a statutory code of practice, setting out the precise standards, rules of engagement and reporting protocols that constitute legitimate good faith cyber security activity. Anyone who acts outside those clear standards remains fully subject to criminal prosecution, and must also consider the significant economic dividend of this reform.
Independent economic modelling from the Cyber Up campaign demonstrates that introducing a statutory defence for legitimate cyber security activities would add 9500 high skilled, high wage jobs and generate £2.5 billion in additional revenue for the UK economy. My Lords, we can't build a resilient nation by preserving laws written for the floppy disk era. In an age of automated AI exploits and state sponsored ransomware, we must unchain our cyber defenders. And my Lords, we have here been here before and the government's arguments for delay have run completely out of road.
During our debates and correspondence on the Crime and Policing Bill and previously on the Data Use and Access Bill, the government repeatedly acknowledged the strength of our case. The noble Lord Katz stood at the despatch box and conceded that the Computer Misuse Act is dangerously outdated, and that the Home Office is actively preparing a statutory defence under section one to protect ethical cyber security researchers. Indeed, in correspondence following those debates, ministers confirmed that engagement with industry and system owners was well advanced, but their stock excuse for resisting our amendments was always the same.
This is the wrong legislative vehicle. Wait for the upcoming cyber security legislation. Well, my Lords, here we are. This is the Cyber Security and Resilience Bill. If primary cyber legislation cannot fix the statute that actively criminalises our frontline cyber defenders, what on earth can, when the government updated law enforcement powers under the Crime and Policing Bill to seize domains and IP addresses, ministers were quick to assure us that police powers are tightly bounded by the Police and Criminal Evidence Act 1984 and statutory exemptions under section ten of the CMA.
Yet independent security researchers who discover over half of all critical system vulnerabilities before hostile state actors can weaponize them, enjoy zero statutory protections, they're left entirely at the whim of prosecutorial discretion and the threat of catastrophic legal action. Sir Patrick Valence's review recommended this defence three years ago. The Cyber Up campaign and tech UK have drafted the ethical safeguards in correspondence. Ministers have told us they agree in principle, it's time to honour those commitments and put a direct statutory defence on the face of this Bill.
So, my Lords, I do urge the Minister to support this vital amendment. I beg to move.
My Lords, this amendment addresses a long standing, globally recognised and increasingly dangerous absurdity in our criminal law. The fact that our crime statute, the Computer Misuse Act 1990, criminalizes the very cyber security professionals who are actively working to defend our country. The Computer Misuse Act is now 36 years old. It was drafted in 1990, an era before the World Wide Web had entered public consciousness, when less than half a percent of the British public had ever sent an electronic email.
And when the entire concept of proactive ethical vulnerability research was completely unimagined because the act was drafted at such a primitive stage of the digital revolution, it contains a blanket indiscriminate prohibition on all unauthorised access to computer material. In its current form, it draws no legal distinction whatsoever between a malicious hacker backed by a hostile foreign state, seeking to sabotage our critical national infrastructure and an ethical, good faith cyber security researcher if you like a white hat hacker seeking to discover and responsibly disclose vulnerabilities before criminals can exploit them.
My Lords, the real world consequence of this statutory black spot blind spot is that British cyber defenders are forced to operate with one hand tied behind their backs. Consider the day to day operational reality. If an ethical researcher in the UK scans an internet facing network, identifies a critical zero day vulnerability that leaves an NHS hospital data set, or a municipal water control system exposed, and takes the basic technical steps necessary to verify the flaw. They have technically technically committed a criminal offence under section one of the 1990 act.
They face prosecution and imprisonment even if their actions were undertaken entirely in good faith, strictly in the public interest and followed, followed by immediate responsible disclosure to the National Cyber Security Centre or the affected operator. My Lords, I and others have received overwhelmingly passionate representations from the Cyber Up campaign, representing what might be described as the elite of our domestic cyber security industry, alongside the Criminal Law Reform Now Network and the NCC Group.
Their evidence is stark. The chilling effect of the Computer Misuse Act is actively undermining our national cyber resilience. Leading UK cybersecurity companies are routinely forced to prohibit their researchers from conducting proactive threat intelligence gathering and vulnerability research on UK based infrastructure because the legal risks are unacceptable. When British researchers identify an active cyber threat originating abroad, they are legally constrained from investigating the command and control servers.
If doing so involves touching a remote system without explicit owner authorisation. Meanwhile, our international competitors have moved ahead. The United States updated its Department of Justice charging policies to explicitly protect good faith security. Research countries like Portugal, France and Australia have established clear legal safe harbors for ethical cyber defenders. As a direct result, British cyber talent and commercial investment are migrating overseas to jurisdictions where proactive defence is recognised as a public good rather than a criminal act.
During the bill's passage in the other place and during our second reading debate, the government's response was to agree with the principle of reform while arguing that this bill is not the appropriate vehicle, ministers pointed to an ongoing Home Office review and suggested that reform must wait for a hypothetical future security bill. My Lords, we've been waiting for the outcome of that Home Office review for over five years. The review was was kicked into the long grass of Whitehall inter-departmental delays while our critical network remained under siege.
My Lords, there is potentially a contradiction at the heart of the government's strategy on this. On the one hand, ministers are using this bill to impose sweeping new legal duties and heavy turnover based penalties on operators to secure their networks. On the other hand, the government continues to criminalise the very security professionals and ethical researchers whom these operators must hire to test and harden their systems. Amendment 164 resolves this competition in safety.
It inserts a direct, substantive statutory defence into sections one and three of the CMA. An individual charged under the Act will have a complete legal defence if they can prove that their conduct was reasonable for the detection or prevention of crime, or that they were carrying on legitimate cyber security activities specifically defined on the face of the bill as vulnerability research, penetration testing, threat intelligence gathering or responsible disclosure necessary to safeguard system security.
Crucially, my Lords, this amendment does not create a free for all or a loophole for malicious actors. Under subsection four, it empowers the Secretary of State to approve a statutory code of practice, setting out the precise standards, rules of engagement and reporting protocols that constitute legitimate good faith cyber security activity. Anyone who acts outside those clear standards remains fully subject to criminal prosecution, and must also consider the significant economic dividend of this reform.
Independent economic modelling from the Cyber Up campaign demonstrates that introducing a statutory defence for legitimate cyber security activities would add 9500 high skilled, high wage jobs and generate £2.5 billion in additional revenue for the UK economy. My Lords, we can't build a resilient nation by preserving laws written for the floppy disk era. In an age of automated AI exploits and state sponsored ransomware, we must unchain our cyber defenders. And my Lords, we have here been here before and the government's arguments for delay have run completely out of road.
During our debates and correspondence on the Crime and Policing Bill and previously on the Data Use and Access Bill, the government repeatedly acknowledged the strength of our case. The noble Lord Katz stood at the despatch box and conceded that the Computer Misuse Act is dangerously outdated, and that the Home Office is actively preparing a statutory defence under section one to protect ethical cyber security researchers. Indeed, in correspondence following those debates, ministers confirmed that engagement with industry and system owners was well advanced, but their stock excuse for resisting our amendments was always the same.
This is the wrong legislative vehicle. Wait for the upcoming cyber security legislation. Well, my Lords, here we are. This is the Cyber Security and Resilience Bill. If primary cyber legislation cannot fix the statute that actively criminalises our frontline cyber defenders, what on earth can, when the government updated law enforcement powers under the Crime and Policing Bill to seize domains and IP addresses, ministers were quick to assure us that police powers are tightly bounded by the Police and Criminal Evidence Act 1984 and statutory exemptions under section ten of the CMA.
Yet independent security researchers who discover over half of all critical system vulnerabilities before hostile state actors can weaponize them, enjoy zero statutory protections, they're left entirely at the whim of prosecutorial discretion and the threat of catastrophic legal action. Sir Patrick Valence's review recommended this defence three years ago. The Cyber Up campaign and tech UK have drafted the ethical safeguards in correspondence. Ministers have told us they agree in principle, it's time to honour those commitments and put a direct statutory defence on the face of this Bill.
So, my Lords, I do urge the Minister to support this vital amendment. I beg to move.
18:26
18:26
Speaker 8
-
Speaker 8
My Lords, I rise to strongly support Lord Clement James's amendment, whether technically or in spirit. I think he is quite right to point out how outdated the Computer Misuse Act is, and that its blanket prohibition on undertaking cyber security activities without any public interest. Defence is ridiculous. And I also rise really to say that I think Lord Clement Jones amendment goes to the heart of the frustrations that have been expressed by this bill, particularly at second reading.
I sadly wasn't able to attend committee last week, but I imagine they were reiterated again, which is this is an incremental bill. It's a technical bill, and it clears up some important anomalies. But time and time again, noble Lords have raised the point that it is missing the bigger picture. And it does seem to me absolutely extraordinary now that we live in a digital age where absolutely everything we depend on depends on digital infrastructure, that we are not taking a much bigger view on updating our legislation, our institutions, our resources, our skill base to make this core infrastructure fit for purpose.
And it seems extraordinary to me that the Computer Misuse Act has not been touched for 36 years, is well out of date. It may well be that there are other elements of the Computer Misuse Act which have to be looked at. So I know what the minister . We all know what the minister is going to say. She's going to say that this is the wrong bill for such an amendment, and she's going to tell us that there is a Home Office review.
So I hope that we will hold the minister to account for a date, a timeline for when this review might come out, and some semblance of co-ordination between government bodies on all the legislation and regulations that need to be brought together and updated to provide us with a framework that supports the work that needs to be done to protect our digital infrastructure, and an explanation of why there has been such a delay from the Home Office for such an urgent piece of legislation here.
I sadly wasn't able to attend committee last week, but I imagine they were reiterated again, which is this is an incremental bill. It's a technical bill, and it clears up some important anomalies. But time and time again, noble Lords have raised the point that it is missing the bigger picture. And it does seem to me absolutely extraordinary now that we live in a digital age where absolutely everything we depend on depends on digital infrastructure, that we are not taking a much bigger view on updating our legislation, our institutions, our resources, our skill base to make this core infrastructure fit for purpose.
And it seems extraordinary to me that the Computer Misuse Act has not been touched for 36 years, is well out of date. It may well be that there are other elements of the Computer Misuse Act which have to be looked at. So I know what the minister . We all know what the minister is going to say. She's going to say that this is the wrong bill for such an amendment, and she's going to tell us that there is a Home Office review.
So I hope that we will hold the minister to account for a date, a timeline for when this review might come out, and some semblance of co-ordination between government bodies on all the legislation and regulations that need to be brought together and updated to provide us with a framework that supports the work that needs to be done to protect our digital infrastructure, and an explanation of why there has been such a delay from the Home Office for such an urgent piece of legislation here.
18:27
Speaker 13
-
Speaker 13
My Lords, the campaign to get reform of the Computer Misuse Act is at least ten years old, not just five, and we have been among them working to try to get the amendment which is contained in Lords Lord amendment in front of us. I endorse every single word that he said, because it seemed to me he put the case precisely as it needs to be set out. It's absolutely anomalous that we still have this legislation on the statute book, and we need to have an update on it and put our our researchers and our, our and those who help, help protect, to keep us safe in a safe themselves in a safe position, which they're not at the moment.
They're actually subject to potential criminal prosecution, which is a, I mean, stupid and a great disincentive to actually doing what needs to be done. So I do very much hope that the noble lady, the minister, will be persuaded actually to take this opportunity, not reject it, take this opportunity of this legislation actually to put a clause or if you need modification, A in in a form that the government approves of in this legislation.
They're actually subject to potential criminal prosecution, which is a, I mean, stupid and a great disincentive to actually doing what needs to be done. So I do very much hope that the noble lady, the minister, will be persuaded actually to take this opportunity, not reject it, take this opportunity of this legislation actually to put a clause or if you need modification, A in in a form that the government approves of in this legislation.
18:27
18:27
Speaker 13
-
Speaker 13
just speak very. briefly also in support of the noble Lord Clement Jones amendment, which he so comprehensively set out. My Lords, I didn't mention this at second reading because I thought it was so self-evidently sensible that this needed to be fixed, and I didn't. I should know better. Having been in this place for a decade, that just because it's self-evidently sensible doesn't mean it would happen. But it it.
The last three days of committee for this bill have actually been rather depressing. And, and my noble friend Lord is lucky that he wasn't here. I think, though , he managed to give an excellent speech that suggested that he had at least been following us on, on Hansard or on TV, because it's been so clear over the last three days that the most important issues are not being addressed in this bill. This actually seems something really quite simple to fix.
There are much bigger issues. The complete gaping hole of absence of AI, the huge complexity that the noble Lord Birt has been setting out, all these different regimes. But I am of the view. You can't wait for the perfect. And there is a real risk that we are letting perfect be the enemy of good. This is a very straightforward and sensible proposal that the government, I think, has agreed with previously, but it just wasn't the right time.
It surely is the time for us actually to do things rather than keep kicking the can down the road.
The last three days of committee for this bill have actually been rather depressing. And, and my noble friend Lord is lucky that he wasn't here. I think, though , he managed to give an excellent speech that suggested that he had at least been following us on, on Hansard or on TV, because it's been so clear over the last three days that the most important issues are not being addressed in this bill. This actually seems something really quite simple to fix.
There are much bigger issues. The complete gaping hole of absence of AI, the huge complexity that the noble Lord Birt has been setting out, all these different regimes. But I am of the view. You can't wait for the perfect. And there is a real risk that we are letting perfect be the enemy of good. This is a very straightforward and sensible proposal that the government, I think, has agreed with previously, but it just wasn't the right time.
It surely is the time for us actually to do things rather than keep kicking the can down the road.
18:27
18:27
18:27
18:27
Speaker 14
-
Speaker 14
One of the advantages of being in this committee room for these debates during committee stage is that you can use Claude. I hope it is allowed to ask a question of what the cyber security community thinks about the Computer Misuse Act, and it comes back in bold. I will read the bold paragraph. The UK cyber security community view is that the Computer Misuse Act 1990 is dangerously out of date, and reform efforts so far don't go far enough.
I rest my case here.
I rest my case here.
18:28
Speaker 5
-
Speaker 5
My Lords, I thank the noble Lord, Lord Clement Jones, for introducing this amendment, and indeed the noble Lord, Lord Arbuthnot of Durham, who I see in his place. But sorry that he was unable to attend the beginning of this particular debate. But. But we're told for very good reasons, my Lords, I'm not going to try and reproduce the many overwhelmingly powerful arguments that we have already heard in favour of this amendment, which on these benches we are keen as well to support, as indeed we support any measure on the basis that it would help organisations protect themselves and their own systems.
Penetration testing and the wonderfully named bug bounties are excellent ways to identify and address the more technically difficult vulnerabilities before they are exploited to take one of the most widely used apps anywhere, Google Chrome has found that external researchers were responsible for almost a third of its patched and communicated vulnerabilities. The government's own consultation included respondents arguing that the Computer Misuse Act prevents cyber professionals, consumer groups and researchers undertaking this kind of legitimate public interest activity.
The amendment is wholly sensible in its design in that it does not commit the government to action. But it does begin the conversation on this small, but I think , hugely important and valuable change, supported avidly, as we have heard by by everybody, more or less within the cyber industry, which would explicitly condone good faith researchers and sanction ethical hackers to carry out their work. And I can't imagine why it would not at least be worth reviewing such a change on this basis.
Finally, I should add that I have some unsatisfied curiosity, which is that there are no published statistics showing how many Computer Misuse Act investigations, prosecutions or convictions involve good faith cybersecurity researchers, so it is hard to know how much of a dampening effect on ethical hacking the CMA is currently having. So if any of the signatories of the amendment or, of course, the noble lady, the minister herself could shed any statistical light on that, I would be most grateful.
But as I've said, this amendment would allow all such considerations to be taken into account without committing the government, and as such, I strongly support it.
Penetration testing and the wonderfully named bug bounties are excellent ways to identify and address the more technically difficult vulnerabilities before they are exploited to take one of the most widely used apps anywhere, Google Chrome has found that external researchers were responsible for almost a third of its patched and communicated vulnerabilities. The government's own consultation included respondents arguing that the Computer Misuse Act prevents cyber professionals, consumer groups and researchers undertaking this kind of legitimate public interest activity.
The amendment is wholly sensible in its design in that it does not commit the government to action. But it does begin the conversation on this small, but I think , hugely important and valuable change, supported avidly, as we have heard by by everybody, more or less within the cyber industry, which would explicitly condone good faith researchers and sanction ethical hackers to carry out their work. And I can't imagine why it would not at least be worth reviewing such a change on this basis.
Finally, I should add that I have some unsatisfied curiosity, which is that there are no published statistics showing how many Computer Misuse Act investigations, prosecutions or convictions involve good faith cybersecurity researchers, so it is hard to know how much of a dampening effect on ethical hacking the CMA is currently having. So if any of the signatories of the amendment or, of course, the noble lady, the minister herself could shed any statistical light on that, I would be most grateful.
But as I've said, this amendment would allow all such considerations to be taken into account without committing the government, and as such, I strongly support it.
18:28
Speaker 4
-
Speaker 4
I am grateful to the noble Lord for raising this topic through his amendment, and I also recognise the strength of feeling on. On reforming the Computer Misuse Act. I agree the UK should have the right legislative framework to allow us to tackle the threats posed by cyber criminals. The Home Office has already carefully reviewed the Computer Misuse Act, and are proposing to introduce a defence to section one for accredited cyber security researchers when carrying out certain cyber security activity that would be current would currently be unlawful under section one of the CMA, the Home Office have worked closely with the NCS, law enforcement and the cyber security industry to refine these proposals.
The noble Lord, Lord Clement-jones, was also briefed by Home Office officials on these proposals in February, and I hope that this is able to demonstrate meaningful progress the government is making on this issue. The Home Office recognised legislating in this area is a priority and will do so as parliamentary time allows. As the noble Lords here are all aware, the King's Speech in May included a commitment to a National Security Bill with measures to update the Computer Misuse Act, and the work is ongoing to bring forward this piece of legislation.
The review proposed by this particular amendment would be undesirable because it would be limited to the scope of the regulations. This would be too narrow for the scope of the Computer Misuse Act, and is also unlikely to provide the government with new information on how the act should be reformed. I am very sure the noble Lord and others in this room will be active in the passage of this legislation once introduced, and the government and I have read his correspondence with the Home Office and his expertise, including the activities that the noble Viscount Camrose referenced.
His expertise across all of these areas will be hugely welcomed once the legislation is introduced.
The noble Lord, Lord Clement-jones, was also briefed by Home Office officials on these proposals in February, and I hope that this is able to demonstrate meaningful progress the government is making on this issue. The Home Office recognised legislating in this area is a priority and will do so as parliamentary time allows. As the noble Lords here are all aware, the King's Speech in May included a commitment to a National Security Bill with measures to update the Computer Misuse Act, and the work is ongoing to bring forward this piece of legislation.
The review proposed by this particular amendment would be undesirable because it would be limited to the scope of the regulations. This would be too narrow for the scope of the Computer Misuse Act, and is also unlikely to provide the government with new information on how the act should be reformed. I am very sure the noble Lord and others in this room will be active in the passage of this legislation once introduced, and the government and I have read his correspondence with the Home Office and his expertise, including the activities that the noble Viscount Camrose referenced.
His expertise across all of these areas will be hugely welcomed once the legislation is introduced.
18:29
Speaker 1
-
Speaker 1
And I thank the Minister for that response. I . It wasn't that I. I mean, I think noble Lord Vaizey said. We know what the minister's going to say, that it will be in the future piece of legislation. So to that extent, my Lords, I think we're pleased that at least we have a commitment to it. But, my Lords, you know, this has been going on for an awfully long time.
The Crime and Policing Bill, we had amendments down. We had amendments down on the data use and access bill. There's been plenty of time for the Home Office or indeed any other department. I think it could have taken this by the scruff of the neck, my Lords, because it is such an egregious aspect of the the current legislation. And, you know, I'm pleased to hear the Minister's read the correspondence.
I hope she didn't fall asleep while doing so. But, you know, it's it is pretty interminable, my Lords. So she may well find that we come back at report stage because, as she said at the very beginning, you know, feelings are running very high about this, my Lords. You know, it's almost a demonstration of how not to run a government. If you can't get to grips with something as straightforward as this, my Lords, and as important as this, and just make a decision about it, that speaks volumes.
So, my Lords, I wanted to thank other noble lords who've spoken today as well, who've demonstrated the the support across the board. On a light hearted point, I would say to the noble Lord Tarasenko, of course, Claude said that it's trained on my speeches, my Lord. But.
The Crime and Policing Bill, we had amendments down. We had amendments down on the data use and access bill. There's been plenty of time for the Home Office or indeed any other department. I think it could have taken this by the scruff of the neck, my Lords, because it is such an egregious aspect of the the current legislation. And, you know, I'm pleased to hear the Minister's read the correspondence.
I hope she didn't fall asleep while doing so. But, you know, it's it is pretty interminable, my Lords. So she may well find that we come back at report stage because, as she said at the very beginning, you know, feelings are running very high about this, my Lords. You know, it's almost a demonstration of how not to run a government. If you can't get to grips with something as straightforward as this, my Lords, and as important as this, and just make a decision about it, that speaks volumes.
So, my Lords, I wanted to thank other noble lords who've spoken today as well, who've demonstrated the the support across the board. On a light hearted point, I would say to the noble Lord Tarasenko, of course, Claude said that it's trained on my speeches, my Lord. But.
18:29
18:29
Speaker 1
-
Speaker 1
Weekly as the noble Lord, as the noble Baroness Harding said, this is self-evidently sensible, I believe, my Lords, self-evidently to us. But, you know, we despair sometimes, and the perfect mustn't be the enemy of the good. And you know the objective is, as the noble Baroness Jones said, to put researchers in a safe position. And the noble Lord Vaizey finally exalted me to make sure we had a date and a timeline.
Well, my Lords, you know, when is this national security bill going to come forward? We saw it indeed in the Queen's Speech, but we haven't had any I haven't had any contact from anybody in the Home Office about what they might insert in this bill. I don't know whether anybody at this committee has had notice of when a bill might come forward. My Lords, I think the Minister recognises the sheer impatience that most of us feel in this field.
My Lords, and I very much hope that between committee and report, we can get some more clarity in this area for the benefit of all those researchers. In the meantime, I beg leave to withdraw the amendment.
Well, my Lords, you know, when is this national security bill going to come forward? We saw it indeed in the Queen's Speech, but we haven't had any I haven't had any contact from anybody in the Home Office about what they might insert in this bill. I don't know whether anybody at this committee has had notice of when a bill might come forward. My Lords, I think the Minister recognises the sheer impatience that most of us feel in this field.
My Lords, and I very much hope that between committee and report, we can get some more clarity in this area for the benefit of all those researchers. In the meantime, I beg leave to withdraw the amendment.
18:29
Speaker 9
-
Speaker 9
Is it your Lordship's pleasure that the amendment be withdrawn? The amendment is by leave withdrawn. Amendment 165. Lord Clement-jones not moved. Moved amendments one six 6 to 1 six eight in the name of Baroness Ludford. Presumably not moved. Amendments one six 9 to 1 seven four B in the name of Viscount Camrose. Not moved. We'll get there. 174 C and 174 D Lord Arbuthnot already debated, not moved.
18:29
18:29
Speaker 10
-
Speaker 10
I rise to speak to amendment 174 E in my name and my noble friends, Viscount Camrose and noble friend Lord Holmes. It builds on the points that I made in the debate last week on the Wednesday, and that is that the best defence, of course, in cyber, is not to present an attractive target in the first place. And I go back to the experience I had of the Cenovus hack when I was a health minister, where reality was they didn't need to hold any of the detail and the data that they had in the first place.
You know, when you're doing a diagnostic test of someone, you don't need to know their name. It can be a complete, you know, it can be a serial number that they can match up later on. But not only did they have their name, they had their whole medical records going back for years and years and years, and there was no deletion policy there either. So the whole fact that they were attractive target was because basically just very, very sloppy standards in terms of the data being held and, and the retention policy.
And I must admit, when I challenged the NHS on, on that, there really wasn't much appetite to address at all. And I think they probably would say, look, you know, we're meeting all the GDPR requirements. People have consented to their data being shared. And I'm sure that absolutely was the case. When you when you're presented on a diagnostic test that you, you know, you consent to your data being shared, you think it's being shared for a good reason.
The reality here is it didn't need to be shared at all. And of course, the real life consequences of all of this is it did make Cenovus a target for attack, which didn't need to be there. And the real life consequences of that is that thousands upon thousands of operations had to be cancelled, as the NHS in London had to go back to a paper and pen based system on, on, on the whole of this. So it did have real life consequences.
So what I'm suggesting here is a very, very modest amendment. Put this on the radar because, you know, this was just one example. I'm sure we've all, in our various public service examples, could come up with a lot more. And to be honest with you, as I say, my my experience, unfortunately at that time is there was very little interest in the NHS of really trying to tackle this issue.
And so it is a requirement to ask the Secretary of State to consult on achieving the minimisation of identifiable data and looking at deletion on terms of what needs to be kept. It's seen as constructive. Again, very happy to talk about the best ways about going about this, if there's other suggestions, but I would very much hope that all noble lords would see that this is a sensible and pragmatic approach to try and deal with a problem which can remove a lot of the juicy targets, for want of a better word, from an attack potential vector in the first place.
I beg to move.
You know, when you're doing a diagnostic test of someone, you don't need to know their name. It can be a complete, you know, it can be a serial number that they can match up later on. But not only did they have their name, they had their whole medical records going back for years and years and years, and there was no deletion policy there either. So the whole fact that they were attractive target was because basically just very, very sloppy standards in terms of the data being held and, and the retention policy.
And I must admit, when I challenged the NHS on, on that, there really wasn't much appetite to address at all. And I think they probably would say, look, you know, we're meeting all the GDPR requirements. People have consented to their data being shared. And I'm sure that absolutely was the case. When you when you're presented on a diagnostic test that you, you know, you consent to your data being shared, you think it's being shared for a good reason.
The reality here is it didn't need to be shared at all. And of course, the real life consequences of all of this is it did make Cenovus a target for attack, which didn't need to be there. And the real life consequences of that is that thousands upon thousands of operations had to be cancelled, as the NHS in London had to go back to a paper and pen based system on, on, on the whole of this. So it did have real life consequences.
So what I'm suggesting here is a very, very modest amendment. Put this on the radar because, you know, this was just one example. I'm sure we've all, in our various public service examples, could come up with a lot more. And to be honest with you, as I say, my my experience, unfortunately at that time is there was very little interest in the NHS of really trying to tackle this issue.
And so it is a requirement to ask the Secretary of State to consult on achieving the minimisation of identifiable data and looking at deletion on terms of what needs to be kept. It's seen as constructive. Again, very happy to talk about the best ways about going about this, if there's other suggestions, but I would very much hope that all noble lords would see that this is a sensible and pragmatic approach to try and deal with a problem which can remove a lot of the juicy targets, for want of a better word, from an attack potential vector in the first place.
I beg to move.
18:30
18:30
Speaker 1
-
Speaker 1
My Lord sir, I think despite the fact this is the last group, I think this is a really important area and this amendment rightly reflects that. And we strongly support amendment 174 E. The. It introduces a fundamental, elegant and highly necessary cybersecurity principle that this bill has otherwise completely ignored the principle of data minimization, the proactive reduction of our national. What's called our national data attack surface.
My Lords, the most sophisticated cyber defence system in the world, cannot protect data that has already been stolen. Conversely, the most ruthless ransomware gang or hostile state sponsored actor cannot compromise data that was never collected or which has already been securely deleted. In the realm of digital defence, we must move past the narrow defensive mindset, simply building thicker walls around our databases. We must begin to ask a more fundamental strategic question why are we keeping these massive, anonymised, highly vulnerable data honeypots in the first place? The empirical evidence from our public sector is deeply alarming.
We've received detailed coruscating briefings from the centre for Long Term Resilience and our technical authorities. The National Audit Office's January 2025 report on government cyber resilience revealed that approximately 28% of government technology is legacy software, leaving our public bodies highly vulnerable to attack. Consider the catastrophic ransomware attack on the British Library in October 2023, when the library refused to pay a ransom of 20 bitcoin, the residual ransomware group released 600GB of stolen customer and staff data onto the dark web.
The library's own subsequent post-mortem was clear their reliance on legacy applications and older network designs substantially and unnecessarily increased the volume of sensitive customer data sitting on the network. This was data hoarding, plain and simple, and the price paid by the British citizens whose personal details are now permanently compromised. Or consider the hack of Exile Exfil Squad, where normal teenagers living with their parents managed to breach a public database, leaking the sensitive personal details of 100,000 police officers and staff on the dark web.
Alongside data from the Ministry of Defence and the Department for education. How did they do it? They did not deploy supercomputers or advanced zero day exploits. They simply exploited a basic misconfigured Power Pages database. The hacker's own boast on the dark web was chilling. They said the data was accessible without any authentication whatsoever. And why are these databases so large? Because our public bodies routinely collect and indefinitely retain vast, sprawling and anonymized data sets from birth certificates and benefit records to housing benefits and electoral rolls, without any systematic statutory drive to minimise or anonymize them.
And this is why the Association of British Insurers and the NCC both advised that data encryption and data minimisation are critical to reducing the leverage a threat actor has in ransomware attacks. By rendering exfiltrated data unreadable through encryption or better yet, non-existent through deletion, we take away the hacker's ammunition. While the bill focuses heavily on the administrative paper exercise of incident reporting, it remains completely silent on the contents of the databases themselves.
Amendment 174 E provides the correct strategic corrective. It legally obliges the Secretary of State to open a public consultation within one month of the bill's passing, to evaluate the cyber resilience benefits of minimizing data collection and increasing data anonymization across our public bodies by forcing our public sector to lead by example, this amendment could begin the vital work of shifting the UK towards a genuine resilience by design model, and it would reduce our vulnerability, harden our national defences and protect the digital lives of our citizens.
And I do urge the Minister to accept this vital safeguard.
My Lords, the most sophisticated cyber defence system in the world, cannot protect data that has already been stolen. Conversely, the most ruthless ransomware gang or hostile state sponsored actor cannot compromise data that was never collected or which has already been securely deleted. In the realm of digital defence, we must move past the narrow defensive mindset, simply building thicker walls around our databases. We must begin to ask a more fundamental strategic question why are we keeping these massive, anonymised, highly vulnerable data honeypots in the first place? The empirical evidence from our public sector is deeply alarming.
We've received detailed coruscating briefings from the centre for Long Term Resilience and our technical authorities. The National Audit Office's January 2025 report on government cyber resilience revealed that approximately 28% of government technology is legacy software, leaving our public bodies highly vulnerable to attack. Consider the catastrophic ransomware attack on the British Library in October 2023, when the library refused to pay a ransom of 20 bitcoin, the residual ransomware group released 600GB of stolen customer and staff data onto the dark web.
The library's own subsequent post-mortem was clear their reliance on legacy applications and older network designs substantially and unnecessarily increased the volume of sensitive customer data sitting on the network. This was data hoarding, plain and simple, and the price paid by the British citizens whose personal details are now permanently compromised. Or consider the hack of Exile Exfil Squad, where normal teenagers living with their parents managed to breach a public database, leaking the sensitive personal details of 100,000 police officers and staff on the dark web.
Alongside data from the Ministry of Defence and the Department for education. How did they do it? They did not deploy supercomputers or advanced zero day exploits. They simply exploited a basic misconfigured Power Pages database. The hacker's own boast on the dark web was chilling. They said the data was accessible without any authentication whatsoever. And why are these databases so large? Because our public bodies routinely collect and indefinitely retain vast, sprawling and anonymized data sets from birth certificates and benefit records to housing benefits and electoral rolls, without any systematic statutory drive to minimise or anonymize them.
And this is why the Association of British Insurers and the NCC both advised that data encryption and data minimisation are critical to reducing the leverage a threat actor has in ransomware attacks. By rendering exfiltrated data unreadable through encryption or better yet, non-existent through deletion, we take away the hacker's ammunition. While the bill focuses heavily on the administrative paper exercise of incident reporting, it remains completely silent on the contents of the databases themselves.
Amendment 174 E provides the correct strategic corrective. It legally obliges the Secretary of State to open a public consultation within one month of the bill's passing, to evaluate the cyber resilience benefits of minimizing data collection and increasing data anonymization across our public bodies by forcing our public sector to lead by example, this amendment could begin the vital work of shifting the UK towards a genuine resilience by design model, and it would reduce our vulnerability, harden our national defences and protect the digital lives of our citizens.
And I do urge the Minister to accept this vital safeguard.
18:31
Speaker 4
-
Speaker 4
I thank the noble Lord, Lord Markham, for raising this important issue . Again, good data hygiene and security is essential to ensuring that public bodies are resilient to cyber attacks. Through the bill, we are better protecting data to make our essential services safer and more secure for all those who rely on them. This includes through the security and resilience requirements, which which will form part of the duties placed on regulated entities and which I've mentioned at previous sessions of this committee.
In our consultation later this year, we will propose that these requirements cover data security. But let me just emphasize that where personal data is concerned, all public bodies must already comply with the data protection principles in the UK. GDPR this includes requirements to keep personal data secure, to process only the minimum amount of information needed to deliver their objectives, to periodically review whether this data is relevant and adequate for the public bodies purposes, and not to retain this data for longer than is necessary.
The Information Commission regulates the data protection legislation independently of government. It has a range of powers at his disposal to investigate alleged breaches and require public bodies to address non-compliant practices. So there are significant obligations existing under UK, GDPR. And in addition, our upcoming consultation will examine measures to strengthen data security within the the Security and Resilience Regulations. So I believe a separate consultation as proposed by the noble Lord would not be the right route through, but I think it would be a good idea for us to meet and think about in the context of the.
What the most appropriate route for advice on within the S s on data security, what the right route would be there. So I would suggest that we focus our discussion on the S hours in the interfering in the intervening period. Is this the last time I speak during this session of committee? I just all did want to reflect some of the points that have been made by noble Lords during the course of this committee. Obviously, productivity is a big theme for all of us to grow the UK economy.
It is true that we have maybe progressed through the committee faster than people would have anticipated, but I have heard very clearly the points that have been made very succinctly, both on some fundamental structural issues, which I think, as I said, I think the approach in the bill is right, but I'm just logging that. I have absolutely heard the motivation for that around consistency and so on. And indeed, some of the more technical points that people have made about some of the details of the bill, some of which I have already undertaken to come back on.
So I want to thank the committee for their scrutiny and for the experience they have brought from their many practical walks of life to this Committee.
In our consultation later this year, we will propose that these requirements cover data security. But let me just emphasize that where personal data is concerned, all public bodies must already comply with the data protection principles in the UK. GDPR this includes requirements to keep personal data secure, to process only the minimum amount of information needed to deliver their objectives, to periodically review whether this data is relevant and adequate for the public bodies purposes, and not to retain this data for longer than is necessary.
The Information Commission regulates the data protection legislation independently of government. It has a range of powers at his disposal to investigate alleged breaches and require public bodies to address non-compliant practices. So there are significant obligations existing under UK, GDPR. And in addition, our upcoming consultation will examine measures to strengthen data security within the the Security and Resilience Regulations. So I believe a separate consultation as proposed by the noble Lord would not be the right route through, but I think it would be a good idea for us to meet and think about in the context of the.
What the most appropriate route for advice on within the S s on data security, what the right route would be there. So I would suggest that we focus our discussion on the S hours in the interfering in the intervening period. Is this the last time I speak during this session of committee? I just all did want to reflect some of the points that have been made by noble Lords during the course of this committee. Obviously, productivity is a big theme for all of us to grow the UK economy.
It is true that we have maybe progressed through the committee faster than people would have anticipated, but I have heard very clearly the points that have been made very succinctly, both on some fundamental structural issues, which I think, as I said, I think the approach in the bill is right, but I'm just logging that. I have absolutely heard the motivation for that around consistency and so on. And indeed, some of the more technical points that people have made about some of the details of the bill, some of which I have already undertaken to come back on.
So I want to thank the committee for their scrutiny and for the experience they have brought from their many practical walks of life to this Committee.
18:32
18:32
18:32
Speaker 10
-
Speaker 10
Nice try. Sir, I believe I do get the final word then. Well, firstly, I would like to thank Lord Clement-jones for his strong support of this. I think Honey Pot is a very descriptive and apt term from this, and I thank the noble lady, the Minister, for her comments and will definitely take up her offer for a meeting, because I must admit, the responses that she gave were almost exactly the responses that the NHS gave to me on all of this.
So she's absolutely right. Everything is being kept in terms of GDPR. And, you know, the, the, the word data security and how it was held was mentioned quite a few times. But unless I misheard, I didn't hear anything about data minimisation. And why are we collecting or keeping that data in the first place? And I think that is the, the hole, the gap in, in all of this, because as I say, a lot of this data doesn't need to be held or gathered in that way.
And it is just basic discipline. So I would very much like to take up that offer on how we can do it, because I don't believe, and maybe this is something that the noble lady, the minister can look at ahead of our meeting, but I don't think this issue is addressed anywhere in, in, in in the bill at that point. I do get the last word. I would like to thank everyone who has taken part in all of this. I think there are a number of important issues.
Really appreciate the willingness of the the minister and the noble lady, the minister to engage. And I know there's a number of follow up meetings that I think we will all want to have, because I think there's a lot that we need to to do and work on between now and and report to really make sure that this is the bill really does give us the sort of protection we would all hope to have, but at this stage, I'd like to withdraw my amendment.
So she's absolutely right. Everything is being kept in terms of GDPR. And, you know, the, the, the word data security and how it was held was mentioned quite a few times. But unless I misheard, I didn't hear anything about data minimisation. And why are we collecting or keeping that data in the first place? And I think that is the, the hole, the gap in, in all of this, because as I say, a lot of this data doesn't need to be held or gathered in that way.
And it is just basic discipline. So I would very much like to take up that offer on how we can do it, because I don't believe, and maybe this is something that the noble lady, the minister can look at ahead of our meeting, but I don't think this issue is addressed anywhere in, in, in in the bill at that point. I do get the last word. I would like to thank everyone who has taken part in all of this. I think there are a number of important issues.
Really appreciate the willingness of the the minister and the noble lady, the minister to engage. And I know there's a number of follow up meetings that I think we will all want to have, because I think there's a lot that we need to to do and work on between now and and report to really make sure that this is the bill really does give us the sort of protection we would all hope to have, but at this stage, I'd like to withdraw my amendment.
18:32
18:32
Speaker 9
-
Speaker 9
that the amendment be withdrawn? The amendment is by leave withdrawn. The question is that clause 59 stands part of the bill. As many as of that opinion will say content. Content. The contrary. Not content. The contents have it. Amendment 175. Not moved. Not moved. The question is that clause 60 stand part of the bill. As many as of that opinion will say content and the contrary.
Not content. The contents have it. The question is that clause 61 stands part of the Bill. As many as of that opinion will say content. Content contrary, not content. The contents have it. The question is that this be the title of the bill. As many as of that opinion will say content. Content. The contrary not content. The contents have it.
My Lords, that completes the business before the Committee this afternoon.
Not content. The contents have it. The question is that clause 61 stands part of the Bill. As many as of that opinion will say content. Content contrary, not content. The contents have it. The question is that this be the title of the bill. As many as of that opinion will say content. Content. The contrary not content. The contents have it.
My Lords, that completes the business before the Committee this afternoon.