(6 years, 2 months ago)
Lords ChamberMy Lords, I congratulate the noble Viscount, Lord Waverley, on instigating a debate on this important topic. We have had a mention of Drake’s drum, so it would be remiss of me not to mention the Battle of Trafalgar, which took place this week, 213 years ago—no cyber there, I have to say.
I had the privilege of being the UK’s first ever Minister for Cyber Security and produced UK’s first cyber security strategy in 2009. Then, very few people acknowledged the risk. There is no such problem today, because the word cyber is on everyone’s lips. It is a huge topic, as we heard from the opening speech of the noble Viscount, and I shall raise only two points.
Cyber security has become shrouded in mystique and fear. Threat awareness is too often tilted dangerously close to scaremongering. We ignore the basic reality that cyber security is about risk management, and it is well within our capabilities to manage that risk. But it must be owned by all of us. We need to understand the risks and take simple actions to manage them.
One thing that the most sophisticated and the low-sophistication but more prolific attack have in common is that they tend to exploit basic weaknesses in defence, so the most pressing need and strategically important question is to find ways to raise the basic defences of organisations throughout our country and across the world. That is why I am delighted that the NCSC has started to implement its active cyber defence programme. The NCSC is an amazing set-up and has done incredible work. This gives a framework for UK cybersecurity that takes away most of the harm from most of the people most of the time. It is identifying ingenious solutions to spoofing—it has done that on a huge scale already. It involves partnerships such as threat sharing with CSPs, which already block tens of millions of attacks automatically every month.
It recognises the importance of the individual in all this, which is my first point. We have not made it easy for our people. We must be serious about understanding the human being and stop blaming humans for being the weakest link in cybersecurity: they are the most important. They often are weak but we should not blame them for that. Human factors techniques can maximise human performance while ensuring safety and security. We must design technology that fits a person’s physical and mental abilities: in other words, fitting the task to the human, not the other way around. There must be much wider recognition of the importance of the user.
In the active cyber defence programme, one of the drivers is that users had guidance fatigue. I am not surprised: there was always something they were doing wrong, had not done or should not have been doing. My children tell me that all the time when I am on the computer. Basically, we want to make it easy for people to do these things. That is why there was a change to the unworkable password guidance. Now, we encourage people to protect heavily what they cannot afford to lose and do what they can with everything else. My goodness me, look at these passwords! If you want to get a train ticket, go to the opera or do anything, you have to have a bloody password—sorry, you have to have a password. It is a complete nightmare.
We need to make sure that everyone using a network understands easily how to use it safely. This is just as important as investing in network security technology. Networks have users, and if users cannot do their work effectively while understanding how to do it safely, security is compromised.
My second point relates to our nation’s move towards 5G and the inherent risks in how we are moving forward. The Huawei equipment fitted in our communications systems is a perfect conduit for the exfiltration of data and, as newer systems have come into operation, updated remotely by software from China, so our experts have found it increasingly difficult to be sure that they are constantly safe for use. In view of the ease of supply, cost and quality, the decision was that Huawei equipment should be used in UK systems, and I think that that decision was correct when it was made. It is clear that Huawei is very conscious of security concerns and has tried to alleviate them by more openness and by employing UK experts, many from GCHQ, to monitor its equipment on our behalf.
However, that does not remove all my concerns, and events have moved on. Huawei is set to lead the global charge into 5G, originally in conjunction with another Chinese company, ZTE. Huawei, of course, is not owned directly by China, but ZTE is, and Huawei has signed a deal to provide the next generation of mobile broadband kit to British Telecom. Yet the Huawei Cyber Security Evaluation Centre, overseen by GCHQ, has identified issues with Huawei’s engineering processes that lead to new risks in the UK tele-communications networks. Indeed, GCHQ says it cannot guarantee their security. In addition, GCHQ has effectively banned the use of ZTE by UK firms. A letter was produced saying that we should not use it.
Bearing in mind the huge impact of banning ZTE and Chinese companies in foreign policy, BEIS and trade terms, I ask the Minister: was this a Cabinet decision, or was it made by an official in GCHQ? Fifth-generation mobile services will eventually underpin the new digital landscape, as has already been mentioned. It will transform lives and economies as data analysis, artificial intelligence, the internet of things and quantum computing permeate all areas of human endeavour. We are hoping to start the move towards 5G next year—indeed, we need to. We have to get ahead of all this, particularly with Brexit. We are good at these things, and we need to get ahead.
These changes will bring huge benefits to us all. They will transform healthcare, create smart, energy-efficient cities, make work lives more productive and revolutionise the relationship between business and the consumer. But they bring risks that, if unchecked, could make us more vulnerable to terrorists, hostile states and serious criminals.
I have no doubt that China’s dominance of the technology that will power the next generation of superfast mobile broadband threatens to leave the UK vulnerable to Chinese espionage. However, we probably need to use it so we must identify means of ameliorating the risks. As an aside, I am also very concerned about the spread of Chinese Hikvision equipment, thousands of pieces of which are already installed across the country and connected to our networks. They will all be enabled by 5G. There will be not only cameras, but sound as well. They will sit in every office, see everything on every desk and record everything that is going on, once 5G is linked.
Is the Minister happy that a part of the parliamentary estate is scheduled to have Hikvision installed in January next year? I believe that there is an urgent need to have a small cell set up in the Cabinet Office reporting through the National Security Adviser directly to the Prime Minister to establish what level of risk the UK is willing to accept and to advise what amelioration is required. Banning Huawei and other Chinese firms totally is not a realistic option. Resilience, not IP theft, is our major concern.
Finally, I ask the Minister: is work going on to consider early, robust and fair solutions to what is a global challenge of balancing investment, trade and security, as we will have to protect some parts of our infrastructure by exclusion?
I was referring to the responsibilities of the Department for Education. The relevant Minister is sitting at my side and will have heard that. We will write to the noble Lord, giving a more detailed reply on the role of that department, if that is what he wants.
The Government actively manage potential risks to UK infrastructure—a point on CNI raised by the noble Lord, Lord Fox. This includes risks related to foreign equipment used in our telecoms industry. This important issue was raised by the noble Lord, Lord West, who expressed concerns about our telecoms structures. I want to make it clear that the Government have not banned ZTE. The NCSC has raised its concerns about the ability to manage the risk of having more Chinese-supplied equipment on UK infrastructure undermining existing mitigations, including those around Huawei. The noble Lord is right that we cannot ban our way out of this, but I can confirm that the Department for Digital, Culture, Media and Sport, with the NCSC, is leading the review into the security and resilience of our telecoms supply chain.
Has this been debated at Cabinet level? Bearing in mind that it has an impact on so many departments, it really needs to be looked at in the round, so I would be grateful for an answer.
I am sure the noble Lord would be grateful for an answer, but I do not have one. I do not know whether it has been debated in Cabinet or in a Cabinet sub-committee. However, within the constraints of what happens within the machinery of government, which the noble Lord will be familiar with, I will see whether I can shed some light on the important issue he has raised.
The noble Lord also raised the issue of Chinese investment that meets stringent legal and regulatory standards. At the heart of this is the recognition that we need confidence in our ability to get the right balance between security in our critical infrastructure and the growth, productivity and inward investment opportunities. The findings of the review will report to the Prime Minister and the National Security Adviser. It is right that in the face of these shared threats the UK works alongside its international partners and allies to expose, confront and disrupt hostile or malicious activity.
Is the Minister concerned about H1K and the fact that CCTV will now have sound and that when it is 5G enabled every one of those things will be able to take down data and pass it on? Where do we stand on this?
When we discussed this yesterday, the noble Lord was concerned about the installation within the Palace of Westminster of this capacity, which could indeed read stuff that was on my desk. I think this is primarily a matter for the authorities within the parliamentary estate. I will share with them the noble Lord’s concerns and get a considered reply, possibly from the noble Lord, Lord McFall.
It is right that in the face of these shared threats the UK works alongside its international partners and allies to confront, expose and disrupt hostile or malicious activity. Noble Lords will have seen recently our attribution of a range of indiscriminate and reckless cyberattacks to the work of Russian military intelligence, and 21 other countries stood with us to call this out. That builds upon a host of cyberattacks that we and our international partners have attributed to North Korean actors, including the WannaCry incident, one of the most substantial to hit the UK in terms of scale and disruption.
We are absolutely clear that we must work together to show that states attempting to undermine the international rules-based system cannot act with impunity. The Foreign Secretary pressed this point with his counterparts at the Foreign Affairs Council earlier this week, and the Prime Minister is today encouraging the European Council to accelerate work to strengthen the EU response to malicious cyber activities, including a new regime of restrictive measures.
When necessary, we will defend ourselves. We are continuing to develop our offensive cyber capabilities as part of the toolkit that we use to deter our adversaries and deny them opportunities to attack us both in cyberspace and in the physical sphere. My noble friend Lord Borwick referred to this. If he looks at page 51 of the National Cyber Security Strategy 2016 to 2021, I hope he will be reassured by what we say about enhancing sovereign capabilities and offensive cyber, ensuring that we have at our disposal,
“appropriate offensive cyber capabilities that can be deployed at a time and place of our choosing, for both deterrence and operational purposes, in accordance with national and international law.”.
It is also vital that we continue to reaffirm our shared vision for an open, peaceful and secure digital world based on the rule of law and norms of behaviour. The noble Lord, Lord Ricketts, was right to refer to the speech by the previous Attorney-General saying that international law applied to cyberspace. It seems to me that if a foreign state were to drop a bomb on our airports we would have a right to reply, and likewise if our airports are immobilised through cyber we should equally have such a right, though of course that should be proportionate and legal. We do not concede ground to those who believe that existing international law does not apply, or who seek to impose controls through international fora as a means of restricting basic human rights.
Our work with international partners goes beyond joint operations and influencing. For example, the noble Viscount, Lord Waverley, asked about the work that we are doing with the Commonwealth. We have been scoping and piloting projects to date, but we are now accelerating delivery and expect to have spent £2.3 million by the end of this financial year. Much of this is in partnership with the private sector—for example, we are working with Citibank, an American bank, to build resilience in the Commonwealth finance sector.
I did not think we would get through the debate without Brexit being raised by the noble Lords, Lord Fox and Lord St John of Bletso. The cyber threat that the UK and its European allies face from state actors and cybercriminals remains significant and, as the noble Lord, Lord Kennedy, says, it knows no international boundaries. That is why the UK is seeking to maintain the broadest possible co-operation with our EU partners so that we can continue to share information with EU security institutions, deepen industrial collaboration and work together to develop cyber resilience in support of our collective security, values and democratic processes. Continued co-operation with the EU is not only in our interest; it is firmly in the interest of the EU as we look to respond to hostile state and non-state actors in cyberspace.
At this halfway point in the delivery of our national cyber security strategy, we have put in place many of the building blocks to transform the UK’s cybersecurity and resilience, already demonstrating results. However, we can never become complacent. Just as the threat from cyber criminals and nation states continues to evolve, so too must we continue to innovate and respond at scale and pace. We are therefore stepping up our protection of government systems, from the NCSC’s excellent active cyber defence measures to models adapted from those used by the finance sector to test the security of public services.
On the subject of defence, the noble Lord, Lord Browne, a previous Secretary of State, raised some important issues about the security of our defence systems. We have well-established processes in place to address cybersecurity and the protection of our weapons systems. We are continuing to invest—for example, through our £265 million programme of cyber vulnerability investigations for military equipment. On the specifics of responding to the report published in the US, I will happily write to the noble Lord. To allay his concerns on the UK’s use of equipment supplied by the United States, I refer him to the details of the NCSC’s support of the MoD’s Modernising Defence programme in its recent annual review, where examples include stringent testing of the new F35B fighter planes.
My Lords, I am sorry to ask the Minister to give way again. I do not always share the views of my noble friend Lord Browne on some of these issues, but on the Dreadnought programme, which is crucial, could the Minister maybe go back to the Secretary of State for Defence and say, “There really is a need for red-teaming regarding the threat of cyber to the Dreadnought programme, as it is in-build”?
I take very seriously such a warning coming from the noble Lord. I will share of course his concerns with my right honourable friend the Secretary of State for Defence and get him to write to him.
While it is difficult to avoid headlines about attacks and breaches, doing something about it is still often seen as too technical, too difficult or someone else’s problem. However, one of the themes that has emerged from our debate is that cybersecurity is everyone’s responsibility. We consider it vital that all organisations embrace and embed cybersecurity, from the boardroom down. That is why we have targeted efforts at driving long-term change, starting with helping boards to better understand the risks they face and to invest appropriately. This year’s cybersecurity breaches survey revealed that only 30% of businesses have a board member with responsibility for cybersecurity, and that is not good enough. We must ensure that boardrooms provide active leadership to ensure that cybersecurity is ingrained into organisational cultures and mindsets—a point well made by the noble Lord, Lord St John of Bletso, who also drew attention to the substantial fines that companies are now exposed to under GDPR if they do not comply with the new legislation. As the noble Lord, Lord Fox, highlighted, understanding exactly how secure data and systems are in complex organisations has never been more important.
I am conscious that I am not going to be able to get through all the points that have been raised within the allocated 20 minutes, so I will write to noble Lords to deal with the issues that I have not been able to address today. In conclusion, I hope I have been able to demonstrate not just that we understand the scale of the challenge that we face but that we are seeking to create the environment for everyone to be at their most collaborative and agile to respond, a point well made by the noble Earl, Lord Erroll. As we face new challenges in the year ahead, we need to ensure that we remain focused on reaching across organisational, political and geographical boundaries. As we face those challenges, I will ensure that we take on board the valuable suggestions that noble Lords have made in today’s debate so that we can continue to protect the economic and individual freedoms that make us stronger together.
(6 years, 6 months ago)
Lords ChamberOn the first question, the noble Lord will know that it is for the Electoral Commission to investigate any alleged irregularities concerning the referendum. It has already published a decision on Leave.EU and fined that body £70,000. Investigations continue into allegations that Vote Leave avoided the cap on election expenditure on the referendum by channelling resources into another, linked organisation, and that is a matter for the Electoral Commission to resolve. As far as the outcome is concerned, 1.3 million more people voted to leave than to remain, and I am not sure that one can attribute that fairly substantial margin to the activities of the Russian bots or, indeed, any other outside agencies.
My Lords, there is absolutely no doubt that the Russians are behaving in a dangerous and threatening way in cyberspace: we know that and it is a real threat to Europe. The noble Lord was no doubt celebrating yesterday the victory of 203 years ago, when we thrashed the French, in conjunction with the Prussians, at Waterloo; and the victory of 100 years ago this week, when, with the French, we thrashed the Germans at the second Battle of the Marne. We have expended a huge amount of blood and treasure on European security. Does the Minister not believe, in view of that, that the decision on Galileo is quite extraordinary?
If I may focus on the first part of the noble Lord’s question, which is about Russian involvement in covert activities, he may know that the Intelligence and Security Committee, on which two noble Lords sit, is currently investigating Russian involvement in the 2016 referendum and the 2017 general election. It makes sense to allow that important inquiry to be completed, and then we will have a clearer view of the impact, if any, of Russian involvement in the election, which is the subject of this Question. So far as Galileo is concerned, I commend the noble Lord’s ingenuity but I have listened to fellow Ministers give very adequate answers on Galileo and I will not attempt to rise to that level.
(6 years, 8 months ago)
Lords ChamberThe noble Lord raises a valid point. The Government’s industrial strategy, which was published a few months ago, says that the Government are providing industry with visibility in terms of potential procurement opportunities across 19 sectors, of which this is one. Improving pre-procurement dialogue is a key part of that process. I know that my noble friend the Minister at the Department for Transport and her colleagues are in touch with the automotive industry to make sure that it can respond to the challenges that are behind many of the questions that I have been asked this afternoon.
My Lords, the Minister spotted that the word “fleet” got me rather excited, but my question relates to procurement. I have concerns, after my time in government, that departments play shops. For a particular department, it might make sense to go for a cheaper option, but the totality of the real cost for the country is never properly calculated by the Treasury. For example, not giving work to a certain factory means that it will go bust and we will have to pay money for unemployment and retraining, but these things are never taken into the calculation. We are very bad, sometimes, about making an overall decision about what is the best value for money for the nation, rather than a shortcut for a particular department. Is the Minister happy that the Treasury takes those factors into account when fleet—I am talking about car fleets, sadly—decisions are made?
The Government try to use their purchasing power to get the best value for money when it comes to investing in these vehicles. The Crown Commercial Service aggregates, through the vehicle purchase e-auction programme, the requirements across all government departments. It then has what is called a reverse auction three or four times a year to get the best bids for the vehicles that it needs. When it commissions the vehicles, it looks at the overall cost, not just the upfront cost. The contracts quite often go further than just the purchase and include servicing and repairs throughout the life of the vehicle.
(6 years, 8 months ago)
Lords ChamberI hate to disappoint the noble Lord but the introduction of ID cards is not on the Government’s agenda at the moment, nor do I think it will be in the near future.
My Lords, what advice does the Civil Contingencies Secretariat now give to households in case of emergencies? Until about 10 years ago quite detailed advice was given. Has this been updated recently and what provisions, et cetera, should households have in place should there be a crisis, particularly something affecting cyber and delivery, for example?
I may need to write to the noble Lord on that and how it relates to the civil contingencies unit. In some parts of the country there are arrangements whereby if there is an emergency, the landlines of those who live in the immediate vicinity are automatically contacted and they are given a message. But I would like to do some more work on the specific question the noble Lord asked and then write to him.
(6 years, 9 months ago)
Lords ChamberMy Lords, behind this, there is a serious issue. Democracy in this country depends on political parties. If there is to be a choice at a general election, we need a range of financially viable, credible political parties which train and nurture the people who lead this country and which provide an opportunity for engagement and debate at a national and local level. Given the limited taxpayer appetite to fund those activities and that political parties need to be resourced, we should be cautious about denigrating those who support political parties. We should encourage more people to join and financially support the political party that most closely reflects their values.
My Lords, is there not a fantastic opportunity here for a cross-party competition with listed politicians, to see who would pay most money not to have a meal with those politicians?
In the past, when I put up as a prize a meal with myself, my wife made absolutely certain that she bought it.
(6 years, 10 months ago)
Lords ChamberI speak from an intelligence background. Does the Minister agree that when one looks at patterns of operation, the way in which this whole affair has been dealt with by Russia is exactly the same way as it dealt with similar things when it was the Soviet Union—particularly its normal, KGB-type way of reacting and acting when these sorts of things happen?
I agree with the noble Lord. It is very disappointing that these practices have reappeared in the Soviet Union and have damaged our relationship with that country.
My noble friend Lord Robathan asked what we were doing to stop Russian criminals from exploiting the UK financial system. He may know that we passed the Criminal Finances Act 2017, which introduced criminal offences relating to companies that failed to prevent tax evasion. We made a commitment at the 2016 Anti-Corruption Summit to publish an anti-corruption strategy, setting out a work plan through to 2022. We have created a new National Economic Crime Centre within the National Crime Agency to bring together all our capabilities to fight economic crime, including the specific instances mentioned by my noble friend.
My noble friend may also know that we recently introduced unexplained wealth orders, so in addition to the action we have taken to deal with money laundering—such as the register of beneficial owners—we have taken powers to require people who own property that would ordinarily be beyond their obvious means to prove how they lawfully acquired it. On 31 January this year, the regulations that introduced UWOs came into force. A UWO requires a person who is reasonably suspected of involvement in—or connection to someone involved in—serious crime to explain the nature and extent of their interests in a particular property and to explain how the property was obtained where there are reasonable grounds to suspect that the respondent’s known, lawfully obtained income would be insufficient to allow the respondent to obtain the property.
The noble Baroness, Lady Kramer, asked whether cryptocurrency was included. In Schedule 2 of the order, “funds” is fairly embracing, meaning,
“including (but not limited to) … gold, cash, cheques, claims on money”,
et cetera, and Schedule 4, which deals with freezing prohibitions, refers to,
“making available the proceeds of realisation of property belonging to a specified person, and … making a payment to or for the benefit of a specified person”.
So my advice is that the order includes cryptocurrency. I agree with the noble Baroness that it is unlikely that these individuals will come to the UK or indeed that they have any assets in the UK.
The freezing order applies to overseas banks. The noble Baroness asked a more specific question about shell companies. I would like to write to her about that, but if the money from a shell company went through a bank, it would be caught by the order. She also asked about the delay in introducing the freezing order. She will know that there was a sequence of events—the inquiry that culminated, eventually, in the Sir Robert Owen inquiry. It was some time before we knew who to go for after the tragic death of Litvinenko. I agree with what she and other noble Lords said about the widow, Mrs Litvinenko.
I am sorry that the noble Lord, Lord Tunnicliffe, has had to wait two years for an answer to the question that he asked last time. The Government decided not to implement asset-freezing orders against those individuals mentioned in the letter under this legislation with the exception of Lugovoy and Kovtun but, as was indicated in 2016, a number of individuals on the list provided by Mrs Litvinenko’s lawyers have been designated for other reasons under sanctions relating to Crimea and activities in Ukraine. There is an ongoing police investigation into the two individuals that we discuss this evening.
I will have to write to the noble Lord, Lord Hylton, in answer to his questions about the total volume of assets frozen under freezing orders. I think he went just beyond the order that we debate this evening and his question applied to all freezing orders, so I will write to him. I am sorry if I have not answered all the questions raised by noble Lords. I will write in respect of those that I have not been able to answer.
(7 years, 1 month ago)
Lords ChamberI think exit checks were reintroduced in May 2015. I will correct that in writing if that is not the case. The Government want tourists to be able to visit this country and not spend a disproportionate time going through passport or visa control. The last statistics I saw a few weeks ago indicated that the average time it takes to get through passport control was coming down, but I take note of the noble Lord’s representations. I agree that we should allow people to come in without undue delay.
My Lords, the Minister has not addressed the issue, which is that the Government are undertaking work at the moment and have tasked businesses with coming up with options to provide a means of identifying yourself online by using a card with biometrics. If you have a biometric card which identifies you, which is being used so that you can get online to all the government services we want to put online, what do you call it? It seems to me that it is an identity card. If we have one, why can we not use it more thoroughly?
I think what you call it is a voluntary system, as opposed to a compulsory one.
(8 years, 1 month ago)
Lords ChamberMy Lords, does the Minister think there might be merit in building a purpose-built ship, which would help British shipbuilders and British steel, could visit various parts of England when needed—and would be quite useful during recesses as well?
I think this is an excellent idea. The only problem is that I only have to step on a ship and I feel very seasick, so I might not be able to take part. As long as it was full of admirals, I am sure we would be in agreement.
(9 years ago)
Lords ChamberI can confirm that and draw the noble Lord’s attention to paragraph 7.7 on page 82 of the National Security Strategy and Strategic Defence and Security Review, which sets out a very nice organogram for who is responsible for what.
My Lords, will the Minister confirm that the firing chain for Trident is air-gapped in its entirety, as it certainly was until 2006, and is therefore invulnerable to cyberattack? Will he also confirm that any upgrades that may be planned for that firing chain will remain air-gapped? If not, there will clearly be a vulnerability.
The noble Lord speaks with immense experience in this area and I will write to him on the specific point. I cannot comment on the detail of the security arrangements for our nuclear deterrent but we can, and do, safeguard it from threats, including cyber.
(9 years, 2 months ago)
Lords ChamberAbsolutely, my Lords, and we need to continue to use our data better. It surprises me that we still have silos of data that we do not use and do not mine, and we need to continue to make the data more open and more available.
My Lords, one of the greatest challenges with digitisation is protecting personal data, and the ability to access government services is much easier when you can do that. Is any consideration being given to a card that will allow people to prove exactly who they are when they try to get this data?
As the noble Lord will know, there is a project underway led by GDS on Verify, but that is a very good point and I will draw it to the attention of GDS.