Cyber Security and Resilience (Network and Information Systems) Bill

Debate between Julia Lopez and Caroline Nokes

Report stage
Tuesday 16th June 2026 Commons Chamber

[Julia Lopez (Hornchurch and Upminster) (Con)]

I thank Members across the House for their contributions to this Bill over many months and for their relentless scrutiny. I have never known a Minister to be in such a rush, with three hours of protected time left. I am grateful to officials both in the Department for Science, Innovation and Technology and in Parliament for their hard work in getting this legislation to its final stage. I particularly recognise the hard work of my hon. Friend the Member for Runnymede and Weybridge (Dr Spencer) and his team in providing such top-notch scrutiny of the Bill during its passage through the House.

The Opposition have remained at all times supportive of the principles behind the Bill. It was the previous Government who recognised the need to increase cyber-resilience standards for critical digital infrastructure and services, including managed service providers and data centres. It is welcome that those entities—which are so vital to the functioning of the economy, public services and our daily lives—are now covered. However, I said on Second Reading that opportunities to legislate in this area are few and far between, and we need to ask two questions to assess whether this law is fit for purpose: will it work, and is it enough?

There was already an urgent need to strengthen our cyber-defences. However, AI is equipping hostile states, criminal gangs and opportunists alike with tools capable of eroding our national defences at speed and at scale, in ways that will affect businesses, the public sector and our infrastructure. It is right that Parliament legislates to raise the collective security bar, but the nature of the cyber-security risks that necessitated this Bill have developed rapidly as we have been taking it through this House. That demonstrates the difficulties we all face as legislators in dealing with the constantly shifting sands of the digital age. We may need to be ready to return to this subject sooner than we had hoped.

It is right that critical digital infrastructure such as data centres will fall within the scope of regulation, but we need to recognise that no security measures or standards are 100% effective. Government and businesses need to ensure that essential data and workloads are stored and processed in a way that keeps them secure and operational even when they are under attack. Resilience is key—the Islamic Revolutionary Guard Corps’ apparent targeting of Amazon Web Services sites in the United Arab Emirates and Bahrain earlier this year has shown that digital infrastructure is becoming a prime target in times of conflict. It would be irresponsible to assume that these facilities will not also be targets for cyber-warfare, which is why we have to look closely at concentration of risk, our overall resilience, and any leverage we can build in maintaining access to the best technology going forward. From work on the security of our telecoms infrastructure to scrutiny of the platforms on which critical Government services run, we must now be thinking extremely carefully about our procurement of digital technology.

A further significant development since this Bill was introduced is the rapid advance of AI systems capable of identifying cyber-vulnerabilities, particularly in poorly protected legacy IT across Government and public services, including the NHS. It highlights the urgent need to address the Government’s extensive legacy estate, which is especially exposed to exploitation. Nothing in the Bill addresses that need, yet the Government are creating a broader digital architecture for hackers to attack through their plan for Government-issued digital IDs.

If public trust is to be restored, especially after the Government’s abortive attempt to introduce mandatory ID last year—still, I fear, a risk by the back door—such systems must always remain both optional and secure. It is therefore concerning that the Public Accounts Committee felt compelled to write to the permanent secretary at the Department for Science, Innovation and Technology in April to criticise the lack of urgency in reviewing legacy IT equipment, given both the sensitivity of the data involved and the scale of the cyber-risk.

Earlier, my hon. Friend the Member for Runnymede and Weybridge set out one of the most significant threats that this Bill fails to address: the intensifying cyber-security risk posed by the Chinese Communist party and its affiliates. It is regrettable that the Government have, for a second time, voted down amendments that would have compelled the Secretary of State to create a register of hostile state actors threatening the cyber-security of essential networks and information systems. Those concerns are not restricted to Conservative Members, which is why the amendment tabled by my right hon. Friend the Member for Chingford and Woodford Green (Sir Iain Duncan Smith) attracted cross-party support.

The risks posed by cellular IOT modules have been set out expertly in the Chamber today. IOT modules supplied by Chinese manufacturers are now embedded in nearly all internet-connectable products and devices, from smart TVs to electric cars. They can be used to intercept data and track locations, and can even be controlled remotely. The scale of the cyber and physical security threat from IOT modules is the tip of the iceberg, with components that can be used for espionage or cyber-attacks or disabled remotely woven into countless aspects of our critical national infrastructure. This is an issue that is not going away.

In summary, although this Bill is necessary and goes some way towards enhancing our cyber-resilience in critical areas, it will not be enough in isolation. It heaps all the burden on the private sector, yet it would have been insufficient to prevent the Jaguar Land Rover incident. It does not address public sector vulnerabilities, and it falls far short of meeting the moment that the now former Defence Secretary, the right hon. Member for Rawmarsh and Conisbrough (John Healey), lamented that this Government were missing in their approach to our collective defence and security. It speaks to this Government’s continued inability to grapple with and address the red lights that are now flashing on the national dashboard.

The “corrosive complacency” that Lord Robertson called out in the Government’s approach to investment in defence can also be seen here, in the Government’s ongoing refusal to address the urgent threat to our national cyber-security caused by our reliance on technology and components from nations that have demonstrably malign intent. We are living with the uncomfortable reality that the end of history was a dangerous illusion; one that has led to us gradually outsourcing our critical industries to our geopolitical rivals and competitors, only to have their wares sold back to us in the form of latent time bombs.

That is why this legislation, which we support, can only be a discrete tool in addressing a much wider challenge. Cyber-security is no longer a niche compliance exercise; it is about protecting the fundamental economic and defence interests of our nation. That is why I suspect we will be returning to cyber issues in this House before too long, and with greater urgency.

[Madam Deputy Speaker (Caroline Nokes)]

I call the Liberal Democrat spokesperson.

Online Harm: Child Protection

Debate between Julia Lopez and Caroline Nokes

Tuesday 24th February 2026 Commons Chamber

[Julia Lopez]

I am sure the applicability of the legislation in Scotland is something that can be debated when the Bill comes before the House.

To give them credit, many Labour MPs understand the fact that there is an absence of any Government position, and they will not be taking their foot off the pedal. I suspect that many may have the guts to speak out today—although perhaps not. Those MPs recognised immediately that a consultation is a mechanism for a delay that goes beyond the summer and into another parliamentary year before the sniff of legislation. That holding position is now falling apart, as we have seen from the Minister here today. It is the threat of a very large group of Labour MPs backing the Conservatives’ Lords amendment that is pushing this Government into action—it is government by rebellion. We ask the Liberal Democrats not to let us be distracted from the moment of truth that is coming up, when we hope there will be cross-party support for the noble Lord Nash’s amendment.

For too long, the internet has been treated as a space that cannot be governed. It has functioned like a pioneer society, with extraordinary opportunity but minimal rules. However, pioneer societies improvise customs and eventually retrofit themselves with rules to sustain societies, often after hard-won experience and dispute. That is the process through which we are now going, and we are realising that, as the online society was built, we were not vigilant enough when it came to protecting childhood. We did not recognise that this new territory would bleed into the old world. [Interruption.] The Minister is shouting from the Front Bench that I am embarrassing myself. We as a Government brought forward the Online Safety Act, but there are gaps in it, and we have taken a clear position as the Opposition that we think children should not be on social media. He is looking very angry, but what is his view? Can he stand up and tell us what his personal view is? As the Minister with this responsibility, what does he think should be done, having launched his consultation with such earnestness? Come on, tell us! Would he like to tell us?

[Madam Deputy Speaker (Caroline Nokes)]

Order. Could I just be helpful? A lot of help has been needed this afternoon. The Minister has not asked to intervene, and the hon. Lady cannot force him to intervene on her.

[Julia Lopez]

Thank you, Madam Deputy Speaker. I was pointing out that the Minister has no manners, but wishes to shout from a sedentary position. I sat listening to him and waiting to see if I could decipher, in his very long and self-regarding diatribe, whether he actually has any opinions, but it turns out that he does not. He is very comfortable to sit on the Front Bench and chunter away at me. [Interruption.] You see, he again says that I am such an embarrassment.

--- Later in debate ---

[Julia Lopez]

I would not envisage that parents would be responsible for that. There are mechanisms to make sure that platforms would not be permitted to provide accounts to under 16-year-olds and they would have to have highly effective age-assurance techniques. In fact, I have spoken recently to representatives of a major platform who said that they had very effective techniques for testing whether somebody trying to open an account is the age that they say they are. I will not take further interventions for a little while so that I can make progress, as I know other people want to speak.

There are serious arguments against implementing a ban, some of which have been heard, and they deserve to be addressed and not dismissed. We are likely to hear more about those doubts today and they must be listened to respectfully. Indeed, I hold some of those anxieties and reservations myself. The first argument is that a ban would be unworkable and that teenagers would find workarounds through virtual private networks, foreign platforms or fake credentials. They will, of course, because teenagers have always tested boundaries. Fake IDs, sneaky booze and under-age rule-breaking are traditional parenting challenges, but we do not abandon age limits simply because they are imperfect. Instead, we impose them because they change norms, shift behaviours and offer parents reinforcement rather than resistance. Of course, the mandatory age limit will not remove every child overnight, but it will remove a critical mass and that matters.

Some fear that such a ban would require de facto compulsory digital ID, undermining anonymity and civil liberties, and again, that concern must be taken extremely seriously. However, as I have just suggested to the hon. Member for Stoke-on-Trent Central (Gareth Snell), age verification does not require a single state-mandated digital identification system. Other jurisdictions have explicitly prevented platforms from requiring accredited digital ID and instead mandated multiple verification techniques, with responsibility placed on platforms and not citizens. As I said, I was speaking to a major tech platform recently that set out some of those techniques, which can now be used very accurately to assess a user’s age. However, we must be clear that we do not have a surveillance state simply because 13-year-olds are kept off Facebook.

A third argument, and a point that has been made, is that social media provides vital support and connection for many children, particularly those who feel isolated offline. That can be true, but it is not an argument for leaving the entire system untouched. This is not about banning the internet, messaging, educational platforms, health support or professional development services; those places can and should remain accessible, and that is happening in other jurisdictions. This is about a specific category of platforms whose business models depend on maximising attention and emotional arousal and which are demonstrably harmful at scale. Another concern is the unintended consequence that children may be pushed into darker corners of the internet. That needs to be included in the Government’s consultation when it eventually sees the light of day, particularly whether there needs to be parental consent required for downloading certain apps.

Doing nothing already leaves children exposed, in plain sight, on platforms that we know are optimised against their wellbeing. Protection will never be perfect, but neither is inaction benign. Doing nothing is not neutral. It leaves parents despairing, schools firefighting and children navigating a digital frontier with no one by their side. There is also a broader freedom argument, which is that by keeping children off adult social media platforms we can restore freedom to adults online and will no longer need to contort those digital spaces to be universally child-friendly, which is where some of the challenges have come in.

Finally, this is about leadership. As I said earlier, a consultation without direction is not leadership, and a consultation that pushes real change 18 months down the line is, in truth, a decision to do nothing now. Labour MPs know that, which is why the coming moment will not rest on this rather nutty Lib Dem takeover attempt. Instead, it will rest on the Nash amendment, when this House will have a clear choice: to accept that the pioneer phase is over; to recognise the sanctity of childhood, which deserves clearer rules; and to acknowledge that giving parents support is not the same as the state stripping them of their ultimate responsibilities. Parents will and must always be the first line of defence. When harm is real and growing, leadership requires a decision, even when the answers are not perfect.

[Madam Deputy Speaker (Caroline Nokes)]

As Members will know, the debate has to conclude by 7 o’clock. There are slightly more than 10 people bobbing. I plan to move to the wind-ups at 6.40 pm, which should leave everyone plenty of time.

UK-EU Summit

Debate between Julia Lopez and Caroline Nokes

Tuesday 13th May 2025 Commons Chamber

[Madam Deputy Speaker]

Order. May I respectfully suggest to the hon. Lady that she needs to be very careful in the language that she chooses to use about the Prime Minister?

[Julia Lopez]

I was deliberately careful to adhere to the rules of the House, Madam Deputy Speaker, but I hope my intent was clear.

Let me be clear. I do not think that the Prime Minister is a straight dealer. He says what suits him, poses as a man of decency and hopes—

[Madam Deputy Speaker]

Order. I suggest the hon. Lady withdraw her comment, in which she has accused the Prime Minister of not being straight.

[Julia Lopez]

If that is outside the boundaries of what is acceptable, I will withdraw the comment.

My second lesson is that when Labour negotiates, Britain loses. We have already seen it in this Parliament, from the Chagos islands to the backroom deals with the unions. It is ideological naivety dressed up as serious and sober diplomacy. Labour thinks that signing a deal is the same as securing a good one. It is not, and all that will become clear.

Let us remind ourselves that Brexit was never a rejection of Europe and its people. It was a demand for democratic control over our laws, our borders, our trade and our future.

Employer National Insurance Contributions

Debate between Julia Lopez and Caroline Nokes

Wednesday 4th December 2024 Commons Chamber

[Julia Lopez]

No, I am afraid there is simply not enough time.

Finally, I want to mention a small private school in my constituency. Its pupils are some of the most vulnerable and deprived in our capital, as it is an alternative provision school. First, the Labour Government hit it with VAT. Now they are going to hit it with NICs and wage increases. Either it absorbs that cost or it passes it on to the local council. Those are four businesses from Harold Hill to Hornchurch providing critical services to my constituents, employing young people and giving working families opportunities. Now they are going to be hit by tens of thousands in extra costs, and that is before I even talk about the GPs, the pharmacists, the dentists, the charities, the shops, the restaurants and the pubs. It is for them that I am going to wholeheartedly—

[Madam Deputy Speaker (Caroline Nokes)]

Order. That brings us to the Front-Bench contributions.