Lords Chamber

Monday 26th October 2026

(began 2 hours, 48 minutes ago)

Share Debate
Watch Live
Skip to latest contribution
14:37
14:41
14:41
None Portrait Introduction(s): The Lord Bishop of Durham
-

14:41
None Portrait Oral questions: Environmental, social and governance rule reforms to ensure financial institutions cannot deny services to the UK defence sector
-

14:41
14:42
14:43
14:43
14:44
14:44
14:45
14:46
14:47
14:48
14:48
14:49
14:50
14:51
14:52
14:52
None Portrait Oral questions: Government-approved list of AI tools that meet school safeguarding and data protection standards
-

I beg leave to ask the question. >> I beg leave to ask the question. Standing in my name on the Order Paper. >> My Lords, the government is
14:52
14:53
14:54
14:54
14:55
14:55
14:56
14:57
14:57
14:58
14:59
15:00
15:01
15:01
15:02
15:03
15:03
15:03
15:04
15:04
15:05
15:05
15:06
15:07
15:07
15:08
15:08
15:09
15:09
15:09
15:10
15:11
15:12
15:12
15:13
15:13
15:13
15:14
15:16
15:17
15:18
Lord Pitt-Watson Portrait Lord Pitt-Watson, The Parliamentary Secretary, HM Treasury (Labour)
-
-
Look, I'm. I'm absolutely sure they will. But a. It. If if I can they will. But a. It. If if I can be clear about the evidence here, if we look at the difference in spend by foreign visitors in the UK, a. From 2019 to 2024 in the major

**** Possible New Speaker ****

and it is at some cost. My Lord, my Lords, given. My Lords, the Minister is someone who understands calculation. someone who understands calculation. Now, my understanding is that the Treasury and the OBR have not Treasury and the OBR have not calculated the lost revenue from the higher visitor activity in the the higher visitor activity in the UK that would have resulted had the scheme not been withdrawn. Have not calculated the potential revenue from the spend, that those additional visitors that would have, additional visitors that would have, which would have led to revenue to the Treasury from from those additional visitors.

And that that additional visitors. And that that number, according to the industry, is roughly £2 billion a year. Now, will he go back and try and will he go back and try and understand why the OBR and Treasury do not include those calculations do not include those calculations when they are CSIRT that they are saving money by scrapping the scheme? But it looks to everybody scheme? But it looks to everybody that at the. At the worst it would be a wash and. And that. And that if the industry is indeed even if the industry is indeed even vaguely correct, that Treasury is actually losing money on this way.

**** Possible New Speaker ****

Yeah. So let me reassure the noble Baroness that the £540 million figure that I gave, which is a Treasury figure, fully includes all the knock on systematic effects of. I can assure the noble Baroness that the £540 million includes all the knock on effects of a. The. A introduction of a. The tax free shopping scheme for non-EU citizens.
15:20
15:20
Lord Pitt-Watson Portrait Lord Pitt-Watson, The Parliamentary Secretary, HM Treasury (Labour)
-
-
consulted. >> Labour, labour, Labour. >> My Lords. >> I hear what my noble friend. I hear what my noble friend says, and I certainly don't have any answers. And I remind noble Lords of my Register of Members interests. However, it is the case. I know, that many visitors from far away, far away overseas, who used to come and spend, say, 5 or 6 days in this country, visit lots of wonderful attractions, do a lot of shopping and then go home now. Come here for three days, visit some attractions and they go to Paris, Milan and other places to do their shopping.

 Therefore, I would ask my noble friend to perhaps look again at

**** Possible New Speaker ****

this at some stage. So. So if I can come back on that, I mean, I think we all that, I mean, I think we all understand that visitors can still reclaim VAT for purchases. They just need to have them shipped just need to have them shipped directly. And of course, if they're shipped directly, then they're caught by customs in the in the caught by customs in the in the country to to which they're shipped. But let me be clear about some of But let me be clear about some of the statistics. This is the 2029 to 2024 statistics UK tourism receipts recovered to 111% of their 2019 levels after adjusting for inflation in France, 107% in Italy, 103%, 83% in Germany and only beaten by Spain for 117%.

So the notion that there were loads of people who were coming here who were not coming here now is difficult to stand up on the evidence. I think.
15:22
15:23
15:23
15:24
15:24
15:24
15:25
15:26
15:27
15:28
15:28
15:29
15:29
15:30
15:30
15:31
15:31
15:32
15:32
15:33
15:33
15:34
15:34
15:35
15:35
15:36
15:36
15:36
15:37
15:37
15:38
15:39
15:39
15:40
15:40
15:41
15:41
15:42
15:43
15:44
15:45
15:45
15:46
15:46
15:47
15:47
Baroness Antrobus Portrait Baroness Antrobus (Labour)
-
-
I thank the noble Lord, Lord >> I thank the noble Lord, Lord Robertson, for adding his his thoughts for Saudi Arabia's thoughts for Saudi Arabia's predicament at the moment. And, you know, our priority remains condemn the action of the Houthis, support our Saudi Arabian allies, help to protect the civilians on the ground. And, of course, there are British nationals involved and at risk as well. And we're communicating with British civilians in the area. And I would encourage any civilians there to ensure that they are registered for alerts. We will continue, though, as well as this immediate response to a critical incident, which in many ways demonstrates, I would say this, wouldn't I, the way that air power can react so fast to changing and moving situations and.

But there is a longer term need for diplomatic solutions. Military solutions won't end this. And and those are all areas that have led to the reason that we've provided the support to

**** Possible New Speaker ****

Saudi Arabia. In terms of other defence partners with Saudi Arabia in partners with Saudi Arabia in particular, I talk about the the Mecca Joint Defence agreement between Pakistan, Turkey and Saudi between Pakistan, Turkey and Saudi Arabia. How does the UK deployment interact and cooperate with that agreement and their deployment to

**** Possible New Speaker ****

agreement and their deployment to also support Saudi Arabia in its defence? Well, as the noble Lord probably

**** Possible New Speaker ****

Well, as the noble Lord probably knows, the Mecca countries have discussed and met Turkey, Pakistan and Saudi Arabia, and that that is obviously a completely separate alliance to our own. But our conversations, as I think I mentioned earlier, are with allies in the region, with other allies that are also offering support. There have been reports of both France and Italy offering support, though I cannot confirm, and it's not my place to say what that will be.

So the conversations are across different governments, different departments as well, and they will continue as you would expect.
15:50
15:50
Baroness Lloyd of Effra Portrait Baroness Lloyd of Effra, Parliamentary Under-Secretary of State (Department for Digital, Culture, Media and Sport) (Labour)
-
-
My Lords, I beg to move that this report. Do I need to wait for you? It might be wise.

**** Possible New Speaker ****

My My Lords, My Lords, I My Lords, I beg My Lords, I beg to My Lords, I beg to move My Lords, I beg to move that

**** Possible New Speaker ****

My Lords, I beg to move that this report be now received. The question is that. This report be now received. As

**** Possible New Speaker ****

This report be now received. As many as that opinion will say. Content Of the contrary, not content. the contents have it.

**** Possible New Speaker ****

Clause two. Amendment one. Baroness Lloyd of Effra. My Lords, I beg to move amendment one, after which I will amendment one, after which I will also speak to the other amendments in my name. As I said at Committee stage, the decision to introduce these amendments has not been taken lightly. This government will act on matters of national security, which is what this package seeks to protect. When vendors with links to third countries with the intent and capability to cause harm put our services and the citizens who use them at risk. Through such vendors, a third country can gain access to or control of critical systems.

Caused disruption to UK national infrastructure surveillance through access to data at scale or espionage through access to sensitive information. This package of amendments, supported by guidance and a voluntary referral scheme, provides operators and the government with the tools to mitigate these risks. This new power also supports the bill's existing powers of direction, enabling government to act before and after vendors become embedded in supply chains. I want to thank noble Lords for their valuable and productive engagement on this topic. Since the group of amendments was debated at Grand Committee, I also want to thank my officials and NCSC colleagues for hosting a technical briefing for peers.

In response, I have made several updates to the amendments at Committee stage. It was raised that the drafting referred to the Secretary of State and the Chancellor of the Duchy of Lancaster. This was purely to recognise that a Crown Minister is not a Secretary of State. Should they ever need to exercise the powers. Let me be clear these powers will sit with the DCMs Secretary of State. The DCMs Select Committee can provide oversight and scrutiny of the use of these powers where appropriate. As such, we have revised the wording of the amendments to remove all reference to the Chancellor of the Duchy of Lancaster.

Concern was also raised for parliamentary oversight in the government's exercise of these powers. After careful consideration, I have limited the procedure for bringing entities into scope of the national security powers. The Committee stage amendments enable these powers to be exercised through the made affirmative procedure. In an emergency scenario, the revised drafting removes the ability to use the made affirmative procedure, instead relying on the draft affirmative procedure. This means both houses must approve any regulations made under these powers before they take effect. I have also heard noble Lords representations on behalf of businesses and the importance of involving them in decision making, and whilst the government does not intend to exercise the power to introduce a mandatory scheme, I understand the reassurance being sought around consultation and oversight.

The amendment already requires the Secretary of State to consult in a manner they deem appropriate, but I am willing to go further and commit now to undertake a public consultation ahead of any consideration to introduce a mandatory referral mechanism. Additionally, I would like to explain one further change I've made to the amendment. Since the Committee stage. The amendments no longer include a statutory duty for regulators or the Secretary of State to notify an entity when they have been brought into scope of the vendor direction power. As part of the review of these powers, it has become clear that the statutory duty is not a helpful addition and could delay mitigation of a national security threat in scope.

 Entities will still be informed ahead of making regulations to bring entities into scope of the vendor related powers, the Secretary of State must consult relevant persons. Insofar as is practical, this is likely to involve consultation with the regulators and industry groups before bringing forward regulations using the draft affirmative procedure. Once made into law, the government will encourage entities to make use of the non-statutory guidance and voluntary referral route. The Secretary of State must also consult recipients and the vendor before issuing a direction, unless doing so would be contrary to national security. All of this means it is highly unlikely that an organisation would ever find out they're in scope of the vendor risk management framework by receiving a direction with no prior engagement with government, we intend to consult on the implementation of the wider vendor risk management framework in due course.

This will include the criteria for referral and how the mechanism will work in practice. I hope noble Lords will support these amendments. I beg to move.
15:55
Lord Clement-Jones Portrait Lord Clement-Jones (Liberal Democrat)
-
-
Amendment proposed clause two, page 2913. Leave out from page 2913. Leave out from directions to end of line 15 and insert in particular circumstances involving a risk to national involving a risk to national security interests.

**** Possible New Speaker ****

security interests. My Lords, can I thank the noble Baroness, the Minister, for setting out the government's revised framework on National security directions, and can I thank her, two and her officials for their engagement since Committee stage in Grand Committee, when 65 government amendments were introduced at the 11th hour on these benches, we made it clear that while we fully recognise the acute geopolitical threats posed by hostile states and compromised supply chains, we could not countenance sweeping executive market interventions devoid of statutory safeguards and judicial oversight. Now, my Lords, I do welcome the genuine concessions the Minister has made following our cross-party discussions, specifically removing the emergency made affirmative procedure so that bringing entities into scope is subject to draft affirmative parliamentary scrutiny.

But as set out in our amendments, 117, 118, 119, 145 146147 and 167. The government's revised framework still lacks the vital procedural guardrails needed to make these powers safe, workable and, in our view, compliant with the rule of law. Amendment 7117 requires national security directions to rest upon a credible evidential base and an assessment of less disruptive alternatives and a strict test of necessity and proportionality. Under amendment one, one eight affected suppliers must be given prior notice and a meaningful opportunity to propose risk mitigations before their technology is banned or ripped out. Protecting essential services from sudden operational collapse crucially, amendments 119 and 146 introduce independent judicial oversight where an order imposes enduring or irreversible restrictions such as stripping equipment out of live infrastructure, it must be authorised by a court with closed material procedures under the Justice and Security Act 2017, ensuring sensitive intelligence can be scrutinised safely.

Furthermore, amendment 145 guarantees an ongoing right of review and renewal, while amendment 147 mandates aggregate parliamentary reporting on the economic and operational impact of these directions. Amendment 167 we ensure these safeguards take effect concurrently with the direction powers themselves, and we also strongly support amendment 164 in the names of the noble Viscount Lord Camoys and the noble Lord Markham, creating a transparent register of hostile state actors. My Lords, national security and procedural justice are not opposing forces. An executive power to direct private entities to dismantle digital contracts or hardware backed by severe financial penalties and non-disclosure.

 Gagging orders is an extraordinary power. It will only command confidence and withstand legal challenge if it is anchored in objective criteria and independent judicial scrutiny, and I do urge the Minister to incorporate these essential safeguards.
15:59
Viscount Camrose Portrait Viscount Camrose (Conservative)
-
-
My Lords, I, too, thank the noble Lady, the Minister, for reintroducing this group of amendments and kicking off what I have no doubt will be a productive Report stage. I will be brief both in this and future amendments that are future groups that I speak to, because I feel we've already debated many of these topics at length at Committee stage. We do appreciate the intent to allow more flexibility to address cyber security concerns, and I am grateful for the reassurances that the Minister gave the House, both at committee and since, particularly regarding the limited scope of the mandatory referral scheme.

Therefore, we do not oppose these amendments. That being said, I do recognise the concerns raised just now by the noble Lord Lord Clement-Jones. It is, of course, right that suppliers should be given notice should the situation allow it, and the use of the powers should be both overseen and scrutinised again, where possible. I hope the noble Baroness, the Minister, will confirm that there are mechanisms for these concerns already in place come the implementation of the new regime. My Lords, turning to amendment 164 in my name and the names of my noble friend Lord Mark my Lord Markham, and the noble Lord Lord Alton of Liverpool.

My Lords, we still consider the registration, monitoring and management of foreign powers a central concern regarding cyber security. I won't revisit at length the argument so clearly set out by my noble friend Lord Markham at Committee stage. But I will once again note that foreign states are responsible for three quarters of attacks on our critical national infrastructure. There is still an information gap regarding foreign threats, and this amendment would bring that much needed transparency. For the avoidance of doubt, this would not require the publication of sources, substance or method. Parliament would know simply that a designation had occurred and a subsequent review undertaken.

I believe this matter to be of pressing importance, and therefore, when amendment 164 is called, we will seek to test the opinion of the House.
16:01
Lord Markham Portrait Lord Markham (Conservative)
-
-
I'd like to join with the noble Lord, Viscount Viscount Camrose, and the noble Lord Lord Markham. I and the noble Lord Lord Markham. I have, as has been indicated, signed their amendment, but I echo also what the noble Lord Lord Clement-Jones has said about the Clement-Jones has said about the way in which the Minister has gone about dealing with this bill, and I won't be speaking on other groups of amendments. She'll be glad to know other than one. And that gave me a very good insight into the way that the noble Baroness Baroness Lloyd goes about things.

We had three separate meetings in the course of the recess. She's been exemplary, I think, in the way that she has tried to deal with the arguments and with members of your Lordships House, and I just want to put on record my gratitude to her for that. So why am I signing this amendment? Number 164 well, part four of the bill rightly equips the Secretary of State with formidable powers to issue directions in the interests of national security. Yet as the bill currently stands, those powers risk operating in a strategic vacuum. If we are to empower Ministers to intervene decisively, to protect our essential services and our critical supply chains, that intervention must be anchored to an objective statutory assessment of who actually threatens us.

We cannot defend what we value against an adversary whom we refuse to formally identify. So this amendment 164 provides that essential statutory spine by establishing a clear, maintained register of foreign powers that pose an acute risk to our critical network and information systems, something that I think came home to us last week when so many of our systems nationally were attacked. We don't necessarily know by whom, but we have no doubt guess. We certainly know that in the past, everything from the National Health Service onward have been subjected to attacks. In that case, by the regime in North Korea.

Critically, my Lords, this is not a political blacklist, though it's not subject to diplomatic wing whim. It's an intelligence led mechanism rooted in the hard objective assessments of Gchq, where our intelligence agencies have confirmed that a foreign state or its proxies has perpetrated attacks against our essential services within the last seven years, or where they issue clear warnings of imminent peril, then that state must be listed. That definition must be clear eyed about modern authoritarian governance. In the People's Republic of China, for instance, the state, the military and the Chinese Communist Party are inextricably fused to assess state backed cyber threats while ignoring the governing political party that directs them would be wilful blindness.

So this amendment closes that semantic loophole once and for all. And furthermore, my Lords, amendment 164 demands that we confront our own domestic vulnerabilities. It requires the Secretary of State to review not merely attacks launched from across oceans, but the profound risks inherent in foreign owned or foreign controlled infrastructure situated on our own soil. For far too long, across successive administrations, our critical national infrastructure has been treated with commercial naivety rather than strategic discipline. By requiring the government to conduct this review and lay a coherent action plan before Parliament within six months. This amendment ends the era of bureaucratic drift.

Let me end, my Lords, by referring to the inquiry that I chaired on behalf of the Joint Committee on Human Rights as an inquiry into transnational repression. And I think that our domestic policies failure is illustrated by the reluctance of the government to act on the recommendation that the Committee made unanimously, that the People's Republic of China, which we found to be the state that was the most responsible for transnational repression in the United Kingdom, even more than Russia or Kiran. But we have failed, unlike those two other countries, to place the People's Republic of China in the foreign influence registration schemes, top tier.

And I'd be grateful when the noble Baroness comes to reply, if she is able to give us any information about whether Mr. Dan Jarvis, who's responsible for security issues, who promised to continue to keep this issue under review, has done anything further to be able to act on our committee's recommendations and also the concerns that were raised by the Intelligence and Security Committee, and which the noble Lord Lord Beamish has often spoken about in your Lordships House. So, my Lords, strategic ambiguity, which is what I think has been the order of the day, doesn't deter authoritarian regimes.

 It merely invites opportunistic aggression. If we're serious about building genuine national cyber resilience, we must replace vague administrative discretion with an empirical, transparent and accountable framework. And I urge the government to embrace this vital measure and to accept amendment 164 in the names of the noble Viscount Lord Camoys and noble Lord Lord Markham.
16:06
16:07
Baroness Lloyd of Effra Portrait Baroness Lloyd of Effra, Parliamentary Under-Secretary of State (Department for Digital, Culture, Media and Sport) (Labour)
-
-
tabled have clear statutory tests. The Secretary of State can only give a direction if two conditions give a direction if two conditions are met. First, they must consider that a risk to national security arises or could arise from arises or could arise from operator's use of vendors, goods, services or facilities. And second, the direction is necessary and its the direction is necessary and its requirements are proportionate. The Secretary of State must consider whether other, less excessive whether other, less excessive measures would address the risk. Other regimes work the same way. We have designed the framework so that risks are managed early through non-statutory guidance and voluntary referral routes we want to avoid, so far as is possible, costly interventions such as replacing embedded vendors.

On the question of notices and representations, I agree that operators and vendors should have a say before a direction is given. That's why my amendments require the Secretary of State to consult both the operator and the vendor before giving a direction, unless doing so would be contrary to national security. I do not think a fixed period for representations in primary legislation is the right approach. Instead, my amendments include a delegated power for the Secretary of State to set statutory timelines in secondary legislation for deciding whether to give a direction. Under this approach, we must consult operators, vendors and all other stakeholders on what those timelines should be before regulations are made, and it gives us the flexibility to amend the timelines through secondary legislation.

Should we assess this as necessary on judicial authorisation? I must be clear the government cannot accept a requirement for a court to authorise a direction before it is given. These are national security judgements informed by advice from the intelligence community. They are rightly made by the Secretary of State who is accountable to Parliament. That does not mean there is no judicial oversight operators, and in most cases, vendors will be able to challenge directions and enforcement decisions by judicial review in the High Court on review and renewal. I understand the noble Lord wants directions to expire after a fixed period.

I do not think this is wise. A direction must be necessary and proportionate when it is given, and the same applies when it is varied. But businesses also need certainty and not frequent reviews. This approach follows established precedent under the Telecoms Security Act 2021 and the National Security and Investment Act 2021. The requirements on what a direction must contain also limit its scope. In practice, this means directions are likely to be tied to specific procurement decisions and mitigations, not ongoing reporting requirements. And on reporting. I agree that Parliament should be able to see how these powers are used.

I am proposing that the Secretary of State must lay an annual report before Parliament setting out how the powers being used. The Secretary of State must also publish a notice when the direction is given, varied or revoked, unless this would unreasonably harm national security or commercial interests. This follows the National Security and Investment Act model. For these reasons, I hope the noble Lord and the noble Viscount will feel reassured that the safeguards they seek are are built into this framework and. And that the noble Lord will not press his amendments. Turning to amendment 164, let me be clear.

This government is serious about protecting our essential services from hostile states. It is the central tenet of this bill and the amendments I have tabled to tabled. But I disagree with the noble Viscount Lord Camoys that a register of foreign powers aids us in that objective. Indeed, this House had this debate during the passage of the Telecoms Security Act, when it was agreed that a country specific approach is not appropriate. A register can create false certainty. National security threats do not come solely or consistently from a fixed group of foreign powers. For example, a company acting with hostile intent may have close ties to a hostile state while being registered elsewhere.

Hostile actors evolve and adapt, so we must focus on identifying and mitigating the risk itself, rather than maintaining a list of countries. Our assessment of risk will always be led by expert security advice, and it should not be constrained by an arbitrary list. However, I understand the important points made on clarity and information of where our threats are coming from, and the NCSC annual report highlights the risks posed by foreign actors, and we work with NCSC to mitigate those risks. The report clearly articulates the cyber effects from Russia, China, Iran and North Korea, as well as cyber criminals, which I hope addresses the point raised by the noble Lord Lord Alton.

And I also take the noble Viscount's point about providing information and the noble Lord Lord Clement-Jones point about addressing the information gap and providing businesses with information. That is exactly why the vendor risk framework will be underscored by guidance. This will support businesses to conduct an informed risk assessment of their supply chains, rather than cutting out countries on a list. Doing so would have economic impacts without actually addressing the national security risks. The worst of both worlds there is and always has been, a delicate balance between national security and economic and diplomatic cooperation. An arbitrary list cuts across this a case by case risk assessment, using guidance and based on expert security advice is the only sensible way to do this.

To address Lord Alton, the noble Lord. Lord Dalton's direct question to me about further deliberations by the government on his committee's report, I will need to write to him with an update on that. Following this debate. I am grateful to noble Lords for this debate. I believe we share the same aims. Decisions about vendors should be evidence based and proportionate, and they should be open to proper scrutiny. I hope I have provided reassurance that the Vendor Risk Management framework provides the safeguards, through its statutory tests, the duty to consult judicial review and reporting to Parliament.

I beg to

**** Possible New Speaker ****

move. The question. Is that amendment one be agreed

**** Possible New Speaker ****

Is that amendment one be agreed to? As many as that opinion will say content the country not content. The contents have it in clause nine.

**** Possible New Speaker ****

Amendment two. Lord Clement-Jones my Lords, I rise to move. Amendment two standing in my name and in doing so, to open the debate on this group addressing quite a wide range of
16:13
None Portrait Amendment:2 Lord Clement-Jones (Liberal Democrat)
-

addressing quite a wide range of issues regulatory scope, implementation, machinery, workforce capability and corporate governance across the bill. Amendment two tackles a vital question of regulatory proportionality. The definition of a managed service under clause nine. On these benches, we fully support bringing managed service providers RMSPs into the NIS regime. Third party IT suppliers frequently hold deep, interconnected access into critical networks, making them prime vectors for supply chain contagion. But as clause nine is currently drafted, the definition remains a regulatory dragnet. Amendment two provides a clear pro-enterprise statutory boundary, and I made the case for it on Grand Committee, and I will not repeat the case here, but to blur the lines risks swamping the Information Commissioner with compliance paperwork while diverting supervision from genuine systematic vulnerabilities.

I also welcome amendment three from the noble Lord Ravensdale and amendment 62 from the noble Baroness, Lady Morgan and Lady Kidron, ensuring that size alone is not treated as an arbitrary proxy for risk. We must not fall into the false sense of security of the amendment the noble Baroness Morgan secured on the Online Safety Bill. Turning to the implementation amendments. In this group, effective resilience requires far more than statutory assertion. It requires capability and accountability on the workforce deficit. I pay tribute to the advocacy of my noble friend Baroness Northover on amendment 64, 81 and 107 in the form in which they were tabled in Grand Committee and now retabled alongside my own amendment 105/50 percent of cyber professionals cite skills shortages as their greatest hurdle to compliance.

Regulation needs competence. These amendments mandate that that covered entities, place primary system responsibility in the hands of accredited professionals registered with the UK Cyber Security Council and properly define an independent, skilled person under clause 43. I also commend my noble friend Baroness Northover. Amendment 90 establishing a free digital safety net for SMEs, as well as her amendment 84, which requires the Secretary of State States review to assess duplication and divergence with EU NIS. Two requirements for UK businesses trading across borders on corporate governance. Amendment 69 from the noble Baroness, Lady Morgan of Coates, supported by my noble friend Baroness Ludford, is indispensable on future proofing and statutory review.

I welcome the Government's Amendment 82, which concedes the Committee. Our committee arguments by reducing the clause 40 review period from five years to three years. But in a threat landscape moving at machine speed three years, my Lords, is still a long time amendment 83 in my name and that of the noble Lord Holmes, tests whether the government will commit to a two year review cycle, while the noble Lord Lord Ravensdale rightly embeds post-quantum cryptography migration timelines under amendments 58 to 60. My Lords, this group gives the Bill both its proper boundaries and its operational teeth.

I beg to move. Amendment two.
16:17
Lord Ravensdale Portrait Lord Ravensdale (Crossbench)
-
-
Amendment proposed clause nine, page nine. Line 20 at end. Insert page nine. Line 20 at end. Insert the words as printed on the Marshalled List. >> As the chief.

**** Possible New Speaker ****

As the chief. Engineer working for Atkins Wireless. And start with my amendment three. My Lords, very amendment three. My Lords, very briefly on this amendment. The central problem here remains that if I'm a small or mid-sized firm and SMEs. I can't currently tell within with any confidence whether I'm in the scope of this bill as a critical supplier. And my Lords, that uncertainty does create a cost. Because firms delay investments. Firms can over prepare or or even walk away from public service contracts altogether because they don't want to fall within the scope of this legislation.

And I would go back to my Lords to the impact assessment, which could not say how many SMEs would be designated within the powers of this bill. So, my Lords, I would simply ask the Minister as to whether she can provide any further clarity on SMEs, on critical suppliers, and who exactly will be within the scope of this bill, because that would be tremendously helpful for all of those small and medium sized businesses out there who are concerned about whether they will fall within the scope of the bill. My Lords, I'll come on to my my other amendments 58, 59 and 60, which all relate to quantum computing, quantum cryptography.

 Now, my Lords, noble Lords are quite rightly focussed on AI within the scope of this Bill. That is the the zeitgeist, the issue of issue of the moment. But AI doesn't fundamentally change the rules of the game in terms of protection of our information. But quantum computing fundamentally does change the rules of the game. We're talking about a technology that can potentially break the public key crypto that we rely on across financial services, across energy, across telecommunications. And my Lords, this is a technology that really is advancing tremendously quickly. I, I brought up the case in the example in committee of the Willow chip that Google have produced.

Industry are now analysing or have come up with a fully compiled end to end resource estimate for a 20,000 cubit system. Now that's the that's the class of system that can that can really break that. The 256 bit encryption that we use across many of our. Many of our services. And my Lords, we look across this more broadly in that in terms of organisations, in terms of what governments are doing. So Google is is now saying that by 2029, they are they are going to complete transition to post-quantum crypto. And in fact, the USA earlier this year brought forward an executive order that brings forward their federal migration timeline by 4 to 5 years.

So that was from a previous 2035 targets to now a 2030 target. So my Lords, this really indicates from all of those organisations who are sighted on how fast this technology is advancing the case for action. Now, the Minister will point to the the NCSC and the timescales we have published within the UK, but there is a very good opportunity within this Bill, within the guidance to this Bill to ensure, firstly, that regulators are aligned, they're aligned in the approach they're taking on post-quantum crypto, but secondly, that the priority of post-quantum crypto migration is set out within this this bill.

So really, my Lords, I'm after some confidence from the Minister on how it will work towards those objectives within the within the framework of this bill. My Lords, quantum really is, I believe, the elephants in the room, when we're talking about specific technologies, when the conversations we've had with AI. So I would welcome some comments from the Minister on how the government and on how the supporting documents within this bill will work towards this objective of really protecting our most sensitive information against these threats.
16:22
Lord Holmes of Richmond Portrait Lord Holmes of Richmond (Conservative)
-
-
My Lords, a pleasure to take >> My Lords, a pleasure to take part in this Report stage. In doing so, I declare my technology interests as set out in the register, as advisor to the Crown register, as advisor to the Crown Estate and Simmons and Simmons LLP. My Lords, I support all of the measures in this group. They're practical, proportionate and as a package will make a real difference, not just to the bill but to all those working in cyber security and all of us who they seek to protect, to take quantum. First of all, does the Minister believe that the current NCSC timetable now still looks right in the face of the threats we are now up against?

And indeed, the speed of advancement of quantum compute to the workforce issues that my noble friend Lord Clement-Jones referred to. We know there is a significant, a chronic, a worrying shortage of cyber professionals. Is the government satisfied that the measures within the Bill will do everything required to address this? We'll come on to other ways to protect those who seek to keep us safe, who work inside. But on later amendments. But the workforce question is more than pressing. My Lords, my amendment five in this group goes to the heart of so-called data poisoning. The bill has much in it to commend it in terms of cyber events.

But what about where the data itself has been interfered with, has been poisoned, and there's no reporting requirements on the face of the bill. So if there's an interruption in service that is critical, and we've seen plenty of those, sadly, in recent history. But what about situations, circumstances where there's no interruption in service, but the data itself has been corrupted, manipulated, poisoned. So imagine those who seek to work or invest in financial markets, those who seek to work in education or health, or indeed any sector of our society or economy if they can't rely on the data which is being presented to them, because data poisoning is not set out on the face of the bill, then is that not as serious?

Perhaps in some ways more serious than the more obvious circumstances when there is a break, a breach or an interruption in the service itself? I look forward to the minister's response.
16:24
Baroness Morgan of Cotes Portrait Baroness Morgan of Cotes (Non-affiliated)
-
-
Lords, I want to speak to amendment 62 and 69, which are tabled in this, this group, and tabled in this, this group, and also to amendment 78, which I've added my name. I think the noble Lord Lord Clement-Jones is quite right to say this is quite a disparate group, but I think that just shows how complicated the issues are in this bill and also how fast moving this area is, which the Minister will know extremely well. And I would like to thank the noble Lady Minister for her engagement on these amendments and the conversations that we have had.

If I start with amendment 62, which is about not just being guided by the size of a provider, but but really the risk that it prevents, I move this this reflects an amendment that was discussed at Committee stage, and I moved it to clause 29 at the suggestion really of the of the Minister, because she pointed me to that clause. And actually I hadn't really spotted. But the noble Lord Lord Ravensdale amendment three is perhaps another way of looking at this, which is actually. I totally understand the point that he's making, which is that SMEs need to know whether they are caught by this bill and similar provisions in the future.

But the issue has to be, and it may not be quite as easy as telling them, whether in or out, but the issue really has to be. Now, when we're talking about cyber security and resilience, about the risk that these services pose to our essential or national infrastructure, because the reality is, even as we've seen just last week, the PHP attack, it might be the smallest element of software that causes some of the greatest harm. And it's it I'm going to return to these these issues, amendment 62 and 69 capture, because I don't think any governments have yet actually worked out how to legislate on the basis of the risk posed by these services.

It's exactly the same as noble, Lord Clement-Jones said in the debate we had on the Online Safety Act about categorisation of platforms, which is an issue that is not going to go away. We'll return to later on this week because actually you can have the smallest platform or service that presents the greatest risk. And we have got to work out a way to legislate or pass regulations that reflect this. So the regulations under clauses 29 and 30 could bring in smaller providers, but the power is discretionary. There isn't a risk test and it comes with no commitment to use it.

So I'm interested to hear the minister's response to that. The government's revised part four does extend to national security directions to persons beyond regulated persons, regardless of size. So risk based reach does therefore exist in the bill, but only for national security and not for wider resilience risks. If I move then on to amendment 69, which is about corporate governance, which might not seem the most exciting of subjects, but this bill is about the regulation of essential activity. And in clause 24, essential activity is defined as activity essential to the economy of the United Kingdom or the day to day functioning of society.

I do not think we can get much more essential than that, and I think we'll know about it if those activities and services are somehow massively undermined because of a lack of cyber resilience. And therefore I think it's only right. And again, this is an issue that I will return to. I don't intend to necessarily to test the will of the House on this today, but I think it is now impossible for the culture of organisations to change or for senior level accountability to exist. And I've discussed this, both the noble Lady and also with the AI Minister, without there being board level accountability for the services being provided by the companies those boards are responsible for, and a clear understanding of the risks that those services might provide.

Now, I mean, the noble Lady suggested when we spoke that perhaps there could be governance addressed in codes of practice. I'm not sure that goes far enough, but it could be a start. Or is a general duty of board oversight sufficient? I'm very happy to discuss this further. Both the noble Lady and with ministerial colleagues. But the government has indicated that it thinks that clause 29 already allows regulators to address governance in codes of practice. It won't accept an individual fiduciary duty, but a general duty aboard oversight does say it may be acceptable. So I'm interested to hear what the government's position is, but this is going to be relevant for all related tech or cyber resilience legislation.

And very briefly, let me just talk to amendment 78, which I've added my name. I support the principle that large businesses should report on cyber security and resilience plans. I am not sure that it goes far enough, but I think it starts the point where actually boards and senior managers take responsibility for what their services are doing, and I think that it will be a welcome step forward. And that's why I've been pleased to add my name. But I will look forward to hearing the minister's response on these issues, and I would very much welcome further conversations with her on these, because these are issues that are not going to go away.

Speak to amendment 64, 81, 84.
16:29
Baroness Northover Portrait Baroness Northover (Liberal Democrat)
-
-
90 and 107 in my name. And these >> 90 and 107 in my name. And these are all about the implementation of this legislation, including the standards that are now urgently required. As my noble friend Lord Clement-Jones laid out, all these amendments came out of the evidence given to us on the National Resilience Select Committee, and I thank the various expert organisations for their submissions and subsequent assistance. Given what has emerged in the last week or so, who can doubt the urgency of what they recommend? Amendment 64, 81 and 107 seek to drive up standards in terms of skills and companies being able to rely on skilled people in this complex field, a great deal of effort needs to be put into ensuring that we have an adequate number of people being suitably trained and registered.

Amendment 64 would ensure that the entities covered in this bill place primary responsibility for their systems in the hands of registered, ethically accountable professionals, amendment 107 would provide a definition of a skilled person in the context of clause 43, amendment 81 would require the Secretary of State within a year of this bill becoming an act to make regulations to establish an organisational cyber resilience framework and to recognise professional competence. Bench, the professional competence benchmark maintained by the UK Cyber Security Council. The noble Lady, the Minister placed great emphasis on the council, on the Council at Committee stage, and this seeks to ensure that it can drive and secure the necessary standards.

We need skilled professionals, we need them urgently and it's vital that they are properly accredited and regulated. Amendment 84 addresses another area we were told by experts in the field and businesses that it was important for the UK to align with the EU and the then relevant Minister, Minister Narayan, in the. In the other place pointed out that the EU was significantly ahead of us while we, as I quote him, lag behind. We need to assist businesses that operate across both the UK and the EU to reduce duplication and divergence. This amendment would require the Secretary of State to assess and report on any duplication with, or more particularly, divergence from the EU network and information security requirements for businesses which operate in both the UK and the EU.

Again, on another issue in relation to implementation, there has been considerable concern about the position of SMEs and this we raised last week in the light of the. The information that was emerging then. They are, of course, very important in the supply chain. But we also know that it isn't a matter of if an organisation will undergo a cyber attack. It's when. But that for SMEs suffering such attacks, over 60% can find that this is existential and they can go under. Therefore, amendment 90 would introduce a new clause which would require the Secretary of State to ensure that there is a free cyber security advice and incident response service for relevant small and medium sized enterprises, and the Secretary of State should report annually to Parliament on its use and effectiveness.

All of the provisions in these amendments are designed to strengthen our ability as a country to withstand cyber attacks, and I commend them to the House.
16:33
Baroness Ludford Portrait Baroness Ludford (Liberal Democrat)
-
-
My Lords, I just wanted to back up the noble Lady Baroness Morgan up the noble Lady Baroness Morgan of Cotes in her amendment 69 on board oversight of security and Resilience of network and Resilience of network and information systems. There was a recent data breach at the retailer Asos. It reportedly began not with a sophisticated technical exploit, but with someone impersonating a trusted contact to obtain an employee's login credentials from reporting last year. Although there's always coyness about exactly what has happened in these scenarios, I believe that the breach of Data Act Marks and Spencer happened in a similar way, and this does seem sort of bit elementary, my dear Watson, that that employees have not been sufficiently trained and and made aware of the absolute necessity not to fall for scams, especially as, you know, as consumers, we get these warnings all the time.

I noticed that. That just last week, the top regulator in the City of London, the Prudential Regulation Authority, the CEO there, Catherine Braddock, said that the PRA would significantly increase its focus on firms operational and cyber resilience. And she she said that the PRA and the Financial Conduct Authority would consult to clarify our expectations of firms. As we develop our experience and understanding. And that, of course,

**** Possible New Speaker ****

comes in the wake of. Disruptions and Breaches in websites and apps of businesses. Businesses including Lloyds, HSBC and Revolute on card Lloyds, HSBC and Revolute on card payments and cash transfers and and payments and cash transfers and and so on. So I think the what what I would be looking for, and I think Baroness Falkner is looking for Baroness Falkner is looking for from the government is a bit more of a, of a, of a specific focus on the responsibility of boards. After all, all the various duties they have under the under the companies acts of promoting the success of the company as a whole, exercising reasonable care, skill and diligence.

And, and so on. Stress, the need to maintain a reputation for high standard business contact. Think of the company's operations on the community, fostering the company's business relationships with suppliers, customers, and and others. So of course, a good board should be doing that anyway. But a statistic that I quoted at at committee was how the government's own Cyber Security Breaches survey had revealed that board level ownership of cyber risk in the UK had actually declined from 38% to just 27% over the last three years. So this this issue needs to zoom up the attention. That's not an awful pun.

The attention of of of of companies and inevitably of course, the board. So I think we're looking for a little bit more than a rather generalised response from the government which, which which claims that all this will be dealt with under the security and resilience requirement regulations. It does. It does need to be a lot more targeted on the board as as cyber health is such an important factor in the success of a company these days. I mean, eventually customers might well pass their verdict on a company which has poor cyber health, but perhaps the government should should help avoid solution.
16:37
Lord Markham Portrait Lord Markham (Conservative)
-
-
Yeah, yeah. Lords for their contribution. And every time it reminds me how fortunate we are in, in the Lords to have experts such as Lord Ravensdale and Lord Holmes, who can talk to us as well about the. Note the next level of threats around the corner and made the points very strongly around quantum. And of course that we have Lord Clement-Jones here today on his, I think, his 49th birthday. Is it? And he's here to to join. But I, I would like to actually start by also thanking, adding my thanks to the constructive approach that the noble Lady the Minister has has brought to the whole the whole process and the way that she really has listened and engaged and and looked to make changes, and that is much appreciated.

I know from from myself and all my colleagues as well, and thank her for meeting us at least partway on clause 36 and 40 in terms of the the timings of the intervals and the NIS regulations, although I still, you know, this is such a fast moving environment, I do have some sympathy for Lord Clement-Jones suggestion that maybe rather than three years, it should be. It should be two. I'd. I'd like to move mainly to my amendment. Amendment 78, supported by. Also in the names of my noble friends Viscount Camrose and Baroness Morgan of Ely, and very much similar in.

In intent to Baroness Morgan's amendments and. And her speech, which is very much looking at companies to encourage accountability on their side and really using the the kind of board reporting and annual reporting mechanisms to allow both the board and the shareholders to hold them to account. Because whilst a lot of what we've been talking about today is obviously government moves, actually, we all have seen the, the, the cyber security disruption in the private sector and actually making sure that any CEO is frankly, you know, embarrassed if they haven't, you know, they can't report in their annual report that they have got good plans in place so their own shareholders and board can hold them to account, I think has got to be a sensible way ahead.

 I think also, if I move to amendment 160 in my name and Viscount, my noble friend Viscount Camrose really looking to again see how we can use the information sharing and analysis centres to play their part in it. These again voluntary bodies and really trying to build you know, cyber security is everyone's job really. And it's really trying to use not just the government institutions but the wider institutions as well to play their role in cyber security. I'd also like to sort of finish up on my amendments of 162. Also in the name of my noble friend Viscount Camrose.

And whilst I, as I said earlier, I. I appreciate the constructive approach taken by the noble Baroness, the Minister. I must admit I am slightly disappointed that we haven't heard anything on my amendments on data minimisation and anonymization. I spoke about it in committee, so I'll be brief. But again, as the Health Minister at the time, many Lords will remember the massive disruption in the summer of 24 to our London hospitals in terms of, you know, the operations and, you know, critical operations being cancelled and the impact that had on the health of the capital.

And when I dug into it, I found that actually it was all due to an attack on one of one of the suppliers of diagnostic tests who had loads of patient data that they never needed to hold in the first place. All that data could have been anonymized, and so they would never have been a target for that, for the the company to be attacked in the first place. So of course, always in these things, if you don't create a juicy target for people to attack, then there's nothing. And that's got to be the first rule of cyber security.

But I mention it then I've mentioned it all the way through. Now I really cannot find anyone in the NHS to really take this issue seriously. It's something that we will return to again in the in the health bill, because of course, the single patient record proposals, whilst again, I think are very, very good proposals and I completely support them in terms of patient benefits and patient health. They potentially create an even juicier target for hackers. And so I think we really need to look at what data are held by the different public and private sector bodies involved in the health service and government institutions, and really make sure that they are doing an audit to minimise all the data that they hold so they don't create a target for hackers in the first place.

At that, I look forward to hearing from the noble Baroness, the Minister.
16:43
Baroness Lloyd of Effra Portrait Baroness Lloyd of Effra, Parliamentary Under-Secretary of State (Department for Digital, Culture, Media and Sport) (Labour)
-
-
I thank noble Lords for the constructive debate we've had just constructive debate we've had just now, and I heartily concur with Lord Markham, not only on his happy returns to the noble Lord Lord Clement-Jones, but to the valuable contributions made by noble Lords who brought their expertise, their experience to this wide variety of points. Today these amendments all touch on a key point. The bill's potential will not be realised at Royal Assent, but through effective implementation and clear measures of success. Let me begin with the key principle. The regulations must be durable and equipped, regulated entities to respond to any threat or hazard now and in the future.

Neither the bill nor its implementation should narrowly focus on specific technologies or risks. These will soon become outdated and would undercut a holistic approach to risk through the security and resilience requirements, or SIS. We will take this purposeful all technologies, all threats, all hazards approach to protecting regulated services. And, as I've set out, these requirements will be introduced in secondary legislation and will be mandatory. We propose they will cover, amongst other topics, data security, risk management, board governance and incident response and recovery. We will be consulting on proposals in the coming months, and I thank the noble Lords who attended the Round table I hosted on the Grand Committee.

As such, I caution against singling out specific risks like data poisoning, as highlighted by the noble Lord, Lord Holmes, as it does not reflect the full risk range of risks that that each entity manages in respect of incident reporting that the noble Lord raised, that is already designed to capture incidents that have a significant impact on the authenticity and integrity of data. So that is already within the scope of the reporting framework. So the SR s will further touch upon a number of topics raised by noble Lords, which I will address in turn on data retention.

UK GDPR requires public organisations to implement appropriate measures to ensure the security of personal data. The Information Commission regulates the data protection legislation independently of government and under the existing NIS framework. Service operators can and do assess their data retention. For example, the health sector assesses compliance against a tailored cyber assessment framework objective on using and sharing information appropriately. This includes principles on transparency, using and sharing information and records management. But as a result of the focus on this that noble Lords, in particular the noble Lord Lord Markham, has brought. I will ensure the s s s proposals in the upcoming consultation cover data underpinning the provision of regulated services and include minimising unnecessary data collection and retention.

Turning to the points on governance raised by the noble Baroness, Lady Morgan of Cotes and Lady Ludford, I agree that boards and senior leaders should have clear sight of the cybersecurity and resilience risks that organisations face and be able to hold people responsible. The Government Cyber Code, Cyber Governance Code of Practice sets expectations for formal reporting on a quarterly basis at a minimum, setting suitable metrics to track cyber strategy and agreeing tolerances for risk appetite. Additionally, the UK's corporate reporting framework is undergoing wider modernisation efforts. We are seeking views as part of the current consultation on whether the existing risk reporting framework produces sufficient reporting on cyber risk management.

If introduced, this would also cover some businesses not in scope of this bill. But we are going further and proposed to introduce mandatory s s on governance and risk management to the point made by the noble Baroness, Lady Morgan of Coates. These will ensure clear board level accountability for risk management arrangements. This includes proposals for boards to establish and oversee their organisation, security and resilience framework, alongside requiring skilled and accredited individuals with senior accountability. So whilst I agree with the amendments objective of strengthening accountability and transparency, I believe the approaches we are developing by this bill and in the modern corporate reporting consultation, provide a more continuous means of achieving this.

Noble Lords, turning to the question of skills, I agree that effective governance must be underpinned by the right skills, both at the board level and at management level. We have committed to funding the UK Cyber Security Council over this spending period as it becomes self-sustainable. Working closely with stakeholders across both the profession and our wider workforce in the will take this even further. We propose they require skilled and accredited individuals with senior accountability for security and resilience, alongside role appropriate staff training and relevant up to date accreditation. Again, the requirements will be mandatory and regulated entities will be required to maintain evidence demonstrating compliance with these requirements.

With the Cyber Assessment Framework, as the government recommended method for assessing cyber security and resilience on amendments 105 and 107. Let me emphasise that a skilled person appointed under part four of the bill is defined, but with intentional flexibility. A skilled person will be appointed to assist with actions that are necessary to protect the protect the UK's national security. There is no limit to what threats could emerge to threaten our national security. It's therefore right that we do not restrict our options to mitigate these threats, and that the Secretary of State instead instead should appoint skilled persons on a case by case basis on the expert advice of of officials and our intelligence community on the statement of strategic priorities.

Let me reassure the noble Lord Lord Ravensdale that our intention is to designate the statement as soon as possible, following consultation with regulators and due consideration of Parliament. I expect this to be within a year of commencement. The noble Lord makes valuable points around post-quantum cryptography. The government will shortly publish guidance to support organisations to manage migration to post-quantum cryptography. This reflects the NCSC guidance on quantum and deadlines for migration. Later this year. We will test this guidance with organisations across the CNI sector. We also have worked with international partners in the G7 to produce a joint call to action statement.

I intend for the Statement of Strategic Priorities to address risks posed by emerging technologies. This could include quantum to drive consistency between regulators. We will consult the regulators to identify risks from emerging technology in their sectors. Additionally, the Srss will support regulated entities to manage the risks posed to their
Feed Live - Click to view video
Return to start of debate - Return to top of page