Cyber Security and Resilience (Network and Information Systems) Bill

Lord Birt Excerpts

2nd reading
Tuesday 14th July 2026 Lords Chamber

[Lord Birt (CB)]

My Lords, the Government’s own cyber survey reports that 43% of UK businesses experienced a cyber attack last year, costing the UK economy an estimated £15 billion. Here are just a few examples of those many attacks: a deepfake video call cost Arup £20 million; Marks & Spencer was attacked in Easter last year, losing an estimated £300 million, with operations fully restored only three months later; and, most impactful of all so far, Jaguar Land Rover suffered an attack, had to halt production for around five weeks, was unable fully to restore its supply chains for four months and lost around £500 million. Moreover, the Government had to step in and guarantee a loan of £1.5 billion to stabilise JLR’s extensive supply chain. Yet our economy is barely touched by the Bill, as the noble Baroness, Lady Northover, just identified.

I think that a lot of people, untutored, have a mental model of a technology platform as something you might offload off the back of an HGV; in reality, any technology platform, even in a medium-sized business, can be a highly complex network composed of hundreds of providers, any component of which can present a vulnerability. Just two examples among very many are the widespread reliance by providers on free-to-use but vulnerable open-source software maintained by volunteers, and the external software providers bolted on to a technology platform offering a myriad of services —for example, payroll, finance, logistics, e-commerce or customer relationship management.

There is a possible vulnerability in every part of this complex network of providers, with many doors to pry open. Once one door is opened by a bad actor—a fraudster, a foreign power, a hacktivist or a ransom gang—there is the potential to explore and disable much or all of the system. Entry can be through a clever phishing email, perhaps AI-personalised with stolen data, or through application, network and infrastructure vendors failing to close down vulnerabilities immediately they are identified.

Here is a frightening example: a Chinese entity was able to penetrate a large number of services provided by Microsoft to the US Government. As a result, the mailboxes of the Secretary of Commerce and the US ambassador to China, among many, were read. In a coruscating report, the Cyber Safety Review Board, the US government agency that investigated the breach, concluded that

“Microsoft’s security culture was inadequate”

and that the incident resulted from

“the cascade of Microsoft’s avoidable errors”.

We need to act now, to protect our wider economy as well as our public sector institutions.

I am not a technologist, but for three decades I have had to deal constantly with digital technologies and technologists from a position of authority in many large organisations in the public and private sectors, at national, European and global level. I have discussed the Bill extensively with technology and cyber experts who I know and respect, and it has become perfectly clear to me that the Bill as constructed does not begin to match the threats that we in the UK face, which will only grow.

For instance, AI will increasingly empower malign reconnaissance, enabling attacks that probe, diagnose and bypass defences. At some point, quantum computing, with its awesome power, will fatally undermine our current approach to encryption. This is a highly demanding and ever-changing environment, and it is, frankly, preposterous to suppose that the 12 existing sector-specific regulators of our national infrastructure can acquire and constantly update the knowledge effectively to regulate cyber resilience.

I conclude emphatically that we need a single, focused, dedicated and expert regulator, which I suggest we call the office for cyber resilience—OCR—to span both the public and private sectors, including organisations and, vitally, those who supply them with the technologies they use. For clarity, the OCR should also regulate the national infrastructure providers.

First, I propose that the OCR should regulate platform and software providers to ensure that they sell and vouchsafe secure products up front and update them immediately when vulnerabilities become apparent. That does not happen at the moment. The Office for Product Safety and Standards does that in the UK for consumer goods and the Vehicle Certification Agency does it for cars. Why should there not be protection for our vital technology?

Secondly, companies and institutions of a significant size are currently required under statute to face an annual external audit, the purpose of which is to maintain high standards in financial reporting and corporate governance, under a code set by the FRC—Financial Reporting Council. We should extend the remit of that audit, under the auspices of the OCR, to report on the audited organisations’ and their suppliers’ management of cyber security and thus bring company boards clearly into play.

Thirdly and finally, we need to professionalise the skills of the cyber and IT community, which are highly variable. Every profession of which I am aware that can have a significantly adverse impact on individuals or society faces a hierarchy of qualification before a professional can operate at different levels—whether physician, lawyer, chartered accountant, architect or airline pilot.

How far across the economy would the OCR’s remit reach? It would extend precisely to the same extent as the obligation to have a statutory audit; that is, to companies with an annual turnover of about £15 million that have in excess of 50 employees. I have a perhaps surprising statistic for the noble Earl, Lord Effingham: that would mean only 2% of UK companies. But those companies represent around 70% to 80% of the UK economy.

To conclude, we simply must be bolder. We must take the opportunity that the Bill presents better to enable every kind of organisation in the UK to withstand the ever-growing and deeply disruptive threat of cyber attack.

King’s Speech (4th Day)

Lord Birt Excerpts

Monday 22nd July 2024 Lords Chamber

[Lord Birt (CB)]

My Lords, we are at one of the most challenging moments for government in modern times, with high debt and taxation on the one hand and chronic underperformance in every part of the public realm on the other. Unsurprisingly, the public has become exceptionally disaffected, as we have just all witnessed. Turnout for the election was the second lowest since 1885. The share of the vote both for the Conservatives and the SNP almost halved; between them, they lost almost 300 seats. In the most striking sign of protest, Reform went from nowhere to a 15% share. We should not forget that the Lib Dem’s share of the vote barely changed from the 2019 election, or that although Labour gained handsomely in Scotland, there was no increase in its share of the vote in England. This mightily disaffected electorate is indeed hungry for change, yet it is simply impossible for a new Government quickly to put right all that is wrong.

Here lies a great danger: the politics will cry out for plenty of activism and for early signs of progress, but if we are to fix all that is broken, we need to embark in every single area on a long and most carefully considered journey. Of all the myriad issues that confront us, improving economic growth and productivity is by far the most critical, as it is the only way of materially improving both personal prosperity and our failing public services. But we cannot just sloganise about investing in AI and bioscience, vital though they are. We lack, and desperately need, a deep diagnosis of what is holding back the whole of our economy if we are to grow.

We should begin by trying to understand, for instance, why Germany and France have far higher productivity than we do. German workers, for instance, produce 17% more GDP per hour worked than those in the UK. One possible reason for this glaring gap—the noble Lord, Lord Inglewood, touched on it earlier—is the success of Germany’s Mittelstand, or SMEs, which produce a far higher proportion of Germany’s GDP than the UK’s own mid-ranking companies, which, though far less productive, provide 60% of UK jobs and are at the very heart of our working economy. We also need to understand, as the noble Lord, Lord Monks, raised earlier, what is driving our significant regional imbalance. London’s productivity, for instance, is an extraordinary 80% higher than the UK’s as a whole.

There are many other possible factors contributing to the UK’s lower economic performance. First, by common consent—much mentioned today—we take for ever in the UK to do anything where planning permission is needed. This must change. Secondly, the ONS reports that a remarkable 11 million Britons of working age do not have jobs and are therefore not contributing to the economy. Thirdly, our systems for meeting the skill needs of the economy at every level are lamentable; we have 1 million job vacancies and pronounced skill shortages in every sector, in almost all categories of skill. The noble Lord, Lord Mair, earlier emphasised one particular area. Shockingly, nearly 1 million of our young people aged 16 to 24 are not in jobs, education or training, and are not therefore acquiring the skills that our economy so desperately needs—fingers crossed for Skills England.

Fourthly, to echo the right reverend Prelate the Bishop of Leeds and others, we have by far the worst road and rail infrastructure of any major country, underinvested in for over half a century. I hope the new Government will produce a comprehensive long-term plan—many have mentioned this—for effectively travelling within and between our major industrial areas, both by road and by rail. I hope too that Labour will eventually resurrect its original vision for HS2, framed during its previous term in office, noting that, in the meantime, China has created an HSR network of around 40,000 kilometres and Spain one of 4,000 kilometres, while the UK has still not moved past a miserable 109 kilometres of HSR. The noble Baroness, Lady Randerson, will agree with that point, I am sure.

Finally—this is not an exhaustive list—in an act of extraordinary self-harm we have exited one of the world’s big three economic blocs, removing ourselves from a huge single market that we were chiefly instrumental in creating. In the process, we have introduced unwelcome complexity into much of our trading. Goldman Sachs estimated recently that our economy is now 5% poorer as a direct result. Plainly, we must do all we can to optimise the trading relationship with the EU for the benefit of both parties.

In sum, we need to analyse and to address all the many possible causes of our low productivity if we are to grow and to prosper. I hope the Minister will agree.

Emergency Communications

Lord Birt Excerpts

Monday 26th June 2023 Lords Chamber

[Viscount Camrose (Con)]

I pay tribute to the noble Lord’s frequent correspondence with me on this subject and recognise the importance of what he says. I do not want to prejudge the findings of the deep root-cause analysis that will now be going on at both BT and Ofcom level, but I will make sure that that question is at least asked, and asked forcefully.

[Lord Birt (CB)]

The Minister must be deeply troubled that not one but two critical technology platforms in our national security infrastructure have failed in a very short space of time—the Border Force as well as 999—and, in each case, as the noble Lord, Lord Clement-Jones, has just said, with no immediate back-up coming into play. Will the Government ascertain whether any deep common causes underlie these failures and, therefore, what other parts of our national technology structure, not just our national technology security infrastructure, may be at risk?

[Viscount Camrose (Con)]

Indeed, I recognise the risk that the noble Lord describes. One of the absolute priorities must be to identify whether there is a broader systemic risk of which the unfortunate events yesterday were a symptom or whether this is isolated; the ongoing investigation will absolutely establish that.