Cyber Security and Resilience (Network and Information Systems) Bill

Debate between Lord Clement-Jones and Lord Russell of Liverpool

Committee stage
Thursday 3rd September 2026 Grand Committee

[Lord Russell of Liverpool (CB)]

My Lords, just quickly, I will back up the noble Baroness, Lady Ludford, on Amendment 168. I, like many other noble Lords, have been involved with a variety of charities that were impacted by the cyber security breach at Beacon CRM, which has about 1,500 charities that store an enormous amount of personal data. I looked at its website, and perhaps this will emphasise to the Minister the problem that we face. This is what this website, which had a major security breach in the past, says about its security:

“The secure choice for security-conscious charities. Beacon has all of the security certifications and features that you should expect from your CRM, and we’re adding more all the time”.


It says that it is ISO 27001:2022 certified and Cyber Essentials Plus certified and that

“Cyber Essentials Plus is the highest level of certification in the UK government’s Cyber Essentials scheme, and includes a technical audit of the Beacon team’s endpoint devices”.

It says that it has “World-class infrastructure” and that it is “A UK-based system”. If I was a potential customer of Beacon reading all that, I would feel a very false sense of security about the level of knowledge and defence that its systems have. That is clearly not the case. There is a clear, major mismatch between the degree of confidence that organisations such as Beacon have in their own cyber security and the reality of how feeble and weak they actually are. Before this happens again and again, it would be helpful to look at this more closely and see whether we need to do more.

[Lord Clement-Jones (LD)]

My Lords, the noble Lord, Lord Birt, was right to remind us that we perhaps need something rather more generic and comprehensive when we are assessing whether a particular sector should be brought into the Bill, but that does not mean that we should not use this group of amendments to illustrate that the Bill at the moment is not nearly comprehensive enough in the way it is structured and the sectors that it contains.

The Bill remains stubbornly wedded to what we might call the traditional 2018 five utilities model: water, energy, transport, health and core telecoms. But we have moved on from that world. Today, systemic digital risk does not respect what might be called 20th century arbitrary utility boundaries for critical national infrastructure. An adversary seeking to disrupt our society or blackmail the UK does not need to compromise a power station; it can strike our democratic institutions, food distribution networks, university research labs, orbital satellites or software supply chains.

Amendment 79, tabled by my noble friend Lady Ludford, designates services supporting registered political parties as essential activities. Hostile state actors, from Russian GRU units to Chinese state-sponsored espionage networks, are actively targeting our political parties. As my honourable friend and my noble friend have argued strongly, political parties are a vital part of our constitutional machinery, yet they operate on shoestring budgets with high staff turnovers, heavily reliant on consumer-grade IT and voluntary workers, while holding vast tranches of confidential voter files, donor databases and what we might call strategic policy intelligence. If a hostile power exfiltrates or manipulates a major political party’s systems, the threat is not just a commercial data breach but the subversion of our electoral integrity and democratic sovereignty. To leave our political parties outside statutory NCSC cyber standards is an indefensible democratic blind spot that Amendment 79 would decisively rectify.

Amendment 80, tabled by my noble friend Lady Northover, who sadly cannot be present, addresses the fact that the Bill remains frozen in that 2018 world. It will bring critical manufacturing, industrial food production and large-scale food distribution networks under statutory cyber resilience duties. Our contemporary manufacturing and retail logistics networks are no longer purely mechanical operations; they are vast, hyper-automated cyber-physical systems. They run on automated warehouse robotics, internet-connected telemetry and algorithmic just-in-time delivery pipelines.

Consider the manufacturing of critical transport equipment. When Jaguar Land Rover suffered a catastrophic supply chain cyber breach, the damage was not confined to a single company balance sheet. Production lines were frozen for four months, hundreds of component manufacturers were dragged to the brink of collapse and the economic fallout cost between £1.6 billion and £2.1 billion, making it the costliest cyber attack in British history and forcing the state to step in with loan guarantees. In an economy that depends to a large extent on vehicle transport and haulage equipment, leaving critical automotive and transport manufacturing outside statutory NIS protections is an invitation to systemic economic blackmail.

Even more acute is the vulnerability of our food supply. Modern food processing and supermarket distribution operate with less than 48 hours of inventory buffer. When Marks & Spencer was hit by a major ransomware incident, it cost £300 million to remediate and wiped 99% from its statutory pre-tax profits. As I said earlier, if a hostile state or sophisticated ransomware syndicate executes a co-ordinated attack against the central routeing software of two major distribution operators, supermarket shelves across our cities would begin emptying within two days.

Amendment 80 provides a clear, proportionate statutory safeguard. It includes an explicit turnover threshold of £12 million, ensuring that local bakeries, independent farmers and small shops face zero regulatory burden. It targets solely the industrial food processors and large-scale distributors whose distribution would threaten the daily functioning of society. In doing so, it aligns the UK with the EU’s NIS2 directive, which has already brought food production, processing and critical manufacturing under statutory cyber obligations. Our European neighbours recognise that you cannot have national resilience if your food supply can be halted by a single malicious click, so why are this Government leaving Britain’s food supply chain completely exposed?

That brings me to Amendment 81, also in the name of my noble friend Lady Northover, which designates the space and satellite sector as an essential activity under Part 3. The omission of the space sector from primary cyber security legislation in 2026 is nothing short of extraordinary. The space sector is formally identified in the Government’s own industrial strategy as a core national growth driver. Yet the Bill treats orbital infrastructure as if it were entirely invisible. Our entire critical national infrastructure, from financial transaction timestamps across the City of London and automated container port logistics, to emergency blue-light dispatch, cellular networks and high-voltage grid synchronisation, relies absolutely on satellite positioning, navigation and timing—PNT.

Ground-truth economic studies demonstrate that a five-day blackout of satellite positioning systems would inflict a staggering £5.2 billion direct loss on the UK economy. Furthermore, the UK possesses world-leading capability in earth observation and small satellite manufacturing, with sovereign launch facilities advancing at SaxaVord. But satellites, ground uplink stations and space telemetry are dual-use systems. As the House of Lords special inquiry committee on space, which I sat on, has heard throughout its evidence sessions, satellite communications and orbital command links are under relentless, daily cyber probing, jamming and spoofing by hostile state adversaries. An exploit deployed against the satellite operator’s ground command software can sever communications, blind environmental monitoring or hijack commercial orbital satellites.

Amendment 81 would rectify this strategic blind spot. It would place a statutory requirement on the Secretary of State, within six months, to make regulations bringing the space sector into scope as an essential activity. It specifically covers the operation of space objects and launch facilities, satellite communications, earth observation and critical PNT services, while requiring the Government to designate an appropriate regulatory authority such as the CAA or Ofcom to supervise compliance.

Before moving on to my own amendments, I welcome Amendment 81A, moved by the noble Baroness, Lady Berger, covering the education sector. Our world-class universities are the engines of the UK science and technology prowess, holding billions of pounds of cutting-edge IP, defence research and quantum computing prototypes. They are under relentless cyber espionage assault from foreign adversaries, while centralised bodies such as UCAS and qualification boards, as the noble Baroness said, hold sensitive data on millions of young people. Bringing education into scope under Part 3 is an urgent national security necessity.

I have tabled new amendments—Amendments 81B, 81C and 81D—which address the single most gaping, indefensible and dangerous structural failure of the Bill: the complete and absolute exclusion of central government, public authorities, local councils and our core democratic electoral infrastructure from the scope of our national cyber security perimeters. How can we claim to be building a genuinely cyber resilient nation when the public administration itself is left out entirely in the cold? I wish I had more time to expand on those three amendments, but I will content myself with hoping that the Minister will have considered those amendments and will come back with a positive response. Of course, we strongly look forward to an answer to my noble friend Lord Russell of Liverpool’s questions on Amendment 168.

Crime and Policing Bill

Debate between Lord Clement-Jones and Lord Russell of Liverpool

Report stage
Wednesday 18th March 2026 Lords Chamber

[Lord Russell of Liverpool (CB)]

My Lords, I will be brief. I entirely support the noble Baroness, Lady Kidron, on all her amendments. What I would say to the Government about their own amendment is that I have just had what I suppose is the privilege—although it sometimes seemed quite lengthy—of being a member of the Secondary Legislation Scrutiny Committee, and I can tell noble Lords that the quality of much secondary legislation is lamentable, varying by department. A lack of preparation, of any Explanatory Memorandum explaining anything relevant, and of any impact assessment whatsoever, is extremely frequent. In the last year, we have had several secondary instruments relating directly to the Online Safety Act, none of which has been particularly impressive, and some of which have been debated on the Floor of this House—my noble friend Lord Clement-Jones will be well aware of that. We have expressed our displeasure at the way in which this has been brought forward and explained.

All of us on the Cross Benches remember the late, lamented Lord Igor Judge. What he would think about a Government of this political hue bringing forward Henry VIII powers, to the power of 10, I cannot even imagine. If he is up there, he will be smiling wryly but he will not be impressed.

My only other point is rather strange. His Majesty’s occasionally loyal Opposition were extremely good at bringing in a variety of legislation which had a lot of Henry VIII powers. They have suddenly had a conversion on the road to Damascus, for which we should all be grateful. However, we need to think very carefully before we give the Government Henry VIII powers in an area as sensitive as this, and that is doing much harm as we speak.

[Lord Clement-Jones (LD)]

My Lords, I express from these Benches our very strong support for these comprehensive amendments tabled by the noble Baroness, Lady Kidron, which she has characteristically introduced so well and to which so many noble Lords have spoken so eloquently in support. I also want to express our concerns regarding the Government’s proposed alternative, Amendment 429B.

In this group, we confront digital harm that is not incidental but engineered by design. AI chatbots are no longer a futuristic curiosity but deeply embedded the lives of our children. They are designed not merely as tools but as confidantes, mentors, companions and, in some cases, explicit romantic partners. Their anthropomorphic features create dangerous emotional dependency. Without statutory safeguards, these bots can provide explicit information on how to self-harm. This is not a flaw but a design feature that drives engagement, and we cannot allow the generative power of AI to become a generator of despair.

We are not debating theoretical risks, as many noble Lords have said today. We are debating the forces that led to the tragic deaths of Sewell Setzer III, mentioned by a number of noble Lords, and Adam Raine, in the United States. Their families are pursuing legal action in the US on the basis that deceptively designed, inadequately safeguarded chatbots can be treated as defective products, and that developers should bear full legal liability when systems encourage, facilitate or fail to interrupt a user’s path to suicide.

I welcome the Government’s admission that a legal loophole exists in the UK. However, their proposed remedy, Amendment 429B, gives us a choice between the clarity of primary legislation through the amendments tabled by the noble Baroness, Lady Kidron, and the convenience of the Executive. In contrast, the noble Baroness’s amendments provide clarity and embed safety duties in the Bill. Like my noble friend, I highlight Amendment 433, which deals with targeting the engineered features that keep children hooked. We know that bots guilt-trip users who try to end conversations. For a child, this is not a user interface quirk; it is emotional manipulation. These amendments would prohibit such coercive engagement techniques and, crucially, require bots to signpost users to help when asked about health, suicide or self-harm.

The primary legislation route offered by these amendments is the only fully viable and responsible path. If the noble Baroness wants to test the opinion of the House, we will support her in the Lobby. Should we be unable to secure her amendments, we would need to take a view on Amendment 429B. Four specific binding assurances would be required before we could consider supporting it; without them, it is nothing but a dangerous blank cheque. As changing these sections effectively rewrites the criminal threshold of the Online Safety Act, the Government must commit to the equivalent of the super-affirmative procedure for all significant policy choices, including amendments to core definitions or the expansion of duties beyond priority legal content. Standard procedures will not give this House the scrutiny needed.

Regarding mandatory supply chain transparency, we need a firm commitment that regulations will include a statutory mandate for providers to document and share their technical blueprints with Ofcom. Without this, the regulator cannot do its job. The Minister must confirm that the power will be used to tackle the issues raised by subsections (6) and (7) of Section 192 of the Online Safety Act, ensuring that chatbots cannot evade regulation simply because they lack a human mens rea. A bot does not intend harm, but it can be designed to cause it. The Minister must commit that any new regulations will explicitly disapply the requirement to prove human intent for AI-generated content. Regulations must define control across the entire AI supply chain so that accountability is not lost in a black box.

Finally, we would require a clear assurance that this power will not be used to alter the legal position of services that are not AI services. The scope of Amendment 429B must not drift beyond its stated purpose. If the Government are serious when they say that no platform gets a free pass, that must apply equally to generative AI models that, as we speak, are reshaping the childhoods of so many of our citizens. Safety by design must be the price of entry into the UK market, not an aspiration deferred to secondary legislation.

Data (Use and Access) Bill [HL]

Debate between Lord Clement-Jones and Lord Russell of Liverpool

Consideration of Commons amendments and / or reasons
Wednesday 11th June 2025 Lords Chamber

[Lord Russell of Liverpool (CB)]

My Lords, I address my comments to the Government Benches, particularly the Government Front Bench.

If one looks at Commons Hansard from yesterday, from the last round of ping-pong, several things stand out. First, although we have been through many rounds of ping-pong, yesterday was the first time ever in ping-pong that the noble Baroness, Lady Kidron, was named and acknowledged. This is the same noble Baroness who was accused by a spokesman for the department of trying to bully the Government because she is an activist. This was the first time that the Front Bench mentioned the noble Baroness’s name, which I find extraordinary and slightly disrespectful.

Secondly, yesterday, Sir Chris Bryant, who was obviously on fine form, managed to annoy no fewer than three chairs of Commons Select Committees. He managed to annoy Dame Meg Hillier, who is the chair of the Treasury Select Committee and the Liaison Committee, by the lastminute.com manner in which the department suddenly landed the culture and science Select Committees with this idea of a parliamentary liaison group with no prior warning whatever—they and the House more broadly knew absolutely nothing about it until an email went out early on Saturday morning.

This is not the way to manage this issue. Certain Back-Benchers on the Government side have spoken during the course of ping-pong to make clear their discomfort and the uncomfortable position they are put in between their loyalty to their party and Government and their clear concern about the manner in which the Ministers involved are currently managing this process.

I would just like to encourage all members of the governing party to try—and if anything I have said or that we have heard here rings a bell with them—to please find a way of getting the message through so they understand that it is not simply we who are not members of the governing party who are concerned, but that noble Lords and Members of another place are also deeply concerned. Frankly, we want and expect a change of attitude and pace, much greater focus and a much clearer demonstration to all these people who are so concerned about their future and their livelihood that the Government are on their side, are on the case, and will defend them in any way they can.

[Lord Clement-Jones (LD)]

My Lords, I declare an interest as the chair of the Authors’ Licensing and Collecting Society. We should all be grateful to the noble Lord, Lord Berkeley, for the very gracious way he introduced his amendment, particularly given the history of this inter-House discussion.

Whether it is betrayal, disrespect, negligence, bloody-mindedness, a bad dream or tone-deafness, whatever the reality, we find ourselves once again in this Chamber debating an issue that should have been settled long ago. I share the profound anger and frustration expressed by the noble Baroness, Lady Kidron, and admire her unwavering determination, even if she, for very honourable reasons, will not be voting today. As she pointed out, the Prime Minister, who entertained the tech industry at Chequers and Downing Street, is complicit in the situation we are in today.

We are here today because the Government have point-blank refused to move, repeatedly presenting the same proposition on three occasions while this House, by contrast, has put forward a series of genuine solutions in an attempt to find a way forward, as the noble Lord, Lord Forsyth, pointed out. The only new element seems to be a promise of a cross-party parliamentary working party, but what is so enticing about merely more talking when action is desperately needed?

Amendment 49U, tabled by the noble Lord, Lord Berkeley, and designed to amend the 1988 copyright Act, is a reasoned compromise. It requires identifying the copyrighted works and the means by which they were accessed, unless the developer has obtained a licence. That seems to be a fair trade-off. The noble Lord also pointed out that Minister Bryant has rather inadvertently made it clear that today’s amendment does not invoke financial privilege on this occasion. The Government argue that legislating piecemeal would be problematic, but the historical precedent of the Napster clause in the Digital Economy Act 2010 demonstrates that Parliament can and should take powers to act when a sector is facing an existential threat. There is an exact parallel with where we are today.

This is not about picking a side between AI and creativity, as we have heard across the House today. It is about ensuring that both can thrive through fair collaboration based on consent and compensation. We must ensure that the incentive remains for the next generation of creators and innovators. Given how Ministers have behaved in the face of the strength of feeling of the creative industries, how can anyone in those industries trust this Government and these Ministers ever again? Will they trust their instincts to appease big tech? I suspect not. I do not regard the noble Baroness, Lady Jones, as personally liable in this respect, but I hope she feels ashamed of her colleagues in the Commons, of the behaviour of her department and of her Government. In this House we will not forget.

There is still time for the Government to listen, to act and to secure a future where human creativity is not plundered but valued and protected. If the noble Lord, Lord Berkeley, chooses to put this to a vote, on these Benches we will support him to the hilt. I urge all noble Lords from all Benches, if he does put it to a vote, to support the UK creative industries once again.

Data (Use and Access) Bill [HL]

Debate between Lord Clement-Jones and Lord Russell of Liverpool

3rd reading
Wednesday 5th February 2025 Lords Chamber

[Lord Russell of Liverpool (CB)]

My Lords, I rise briefly to congratulate the Minister and the noble Baroness, Lady Kidron, on the amazing work she has done. Furthermore, I appeal to the Government and all the different departments that may be involved in bringing before Parliament any legislation that in any way, shape or form involves children. We have repeatedly had to deal with Bills that have arrived in this House where it is quite clear that the needs and vulnerabilities of children are not being recognised right from the beginning in the way the legislation is put together. We have to pull it apart in this House and put it back together, because it has not been thought of properly in the first place.

I appeal to the Minister to ensure that the left hand knows what the right hand is doing. We need to learn the lessons of the battles that we have had to fight in recent years with a variety of Bills—largely successfully, mainly thanks to the noble Baroness, Lady Kidron. We do not want to keep on repeating those battles. We need to learn and do better.

[Lord Clement-Jones (LD)]

My Lords, it is a privilege to be part of the tech team and a pleasure to welcome a government amendment for a change. Although some of us might quibble with the rather convoluted paragraph 4, we should not stand on ceremony in that respect. I pay huge tribute to the tenacity of the noble Baroness, Lady Kidron, throughout a series of Bills, not just this one. Our motivation in pressing for this kind of amendment has been the safety of children, whether with the Online Safety Act or this Bill. This amendment takes the Bill a step further but, as the noble Baroness says, we will remain on the case. We look forward to engaging with the ICO on this as the Bill is implemented.

I echo the noble Baroness’s thanks to the Minister and the Government for putting forward the CSEA offence. As the noble Baroness said, that had its origin in this Bill but will now be in the crime and policing Bill. I thank the Government for taking that forward. Also, it is very nice to see the noble Baroness, Lady Jones of Whitchurch, back in her place.

Medicines and Medical Devices Bill

Debate between Lord Clement-Jones and Lord Russell of Liverpool

Report stage & Report: 2nd sitting (Hansard) & Report: 2nd sitting (Hansard): House of Lords
Thursday 14th January 2021 Lords Chamber

[The Deputy Speaker (Lord Russell of Liverpool) (CB)]

Does the noble Lord, Lord Clement-Jones, wish to move Amendment 20, as an amendment to Amendment 19?

[Lord Clement-Jones (LD) [V]]

[Inaudible]—very much about informed consent, but, nevertheless, I will not move the amendment.