Product Security and Telecommunications Infrastructure Bill

Baroness Winterton of Doncaster Excerpts

Report stage
Wednesday 25th May 2022 Commons Chamber

[The Minister for Media, Data and Digital Infrastructure (Julia Lopez)]

I beg to move, That the clause be read a Second time.

[Madam Deputy Speaker (Dame Rosie Winterton)]

With this it will be convenient to discuss the following:

Government new clause 2—Jurisdiction of First-tier Tribunal in relation to code proceedings in Wales.

Government amendments 1 to 3.

Amendment 14, in clause 59, page 42, line 11, after “agreement”, insert

“other than with a private landlord”.

This amendment, together with Amendments 15, 16 and 17, would apply a different regime under the Electronic Communications Code to private landlords, giving automatic upgrade rights for operators to properties owned by private landlords subject to the condition that the upgrading imposes no additional burden on the other party to the agreement.

Amendment 15, page 43, line 39, at end insert—

“(5B) Paragraph 17 of the new code (power for operator to upgrade or share apparatus) applies in relation to an operator who is a party to a subsisting agreement with a private landlord, but as if for sub-paragraphs (1) to (6) there were substituted—

‘(1) This paragraph applies where—

(a) an operator (“the main operator”) keeps electronic communications apparatus installed on, under or over land, and

(b) the main operator is a party to a subsisting agreement in relation to the electronic communications apparatus.

(2) If the conditions in sub-paragraphs (3), (4) and (6) are met, the main operator may—

(a) upgrade the electronic communications apparatus, or

(b) share the use of the electronic communications apparatus with another operator.

(3) The first condition is that any changes as a result of the upgrading or sharing to the electronic communications apparatus to which the agreement relates have no adverse impact, or no more than a minimal adverse impact, on its appearance.

(4) The second condition is that the upgrading or sharing imposes no additional burden on the other party to the agreement.

(5) For the purposes of sub-paragraph (4) a burden includes anything that—

(a) has an adverse effect on the person’s enjoyment of the land, or

(b) causes loss, damage or expense to the person.

(6) The third condition is that, before the beginning of the period of 21 days ending with the day on which the main operator begins to upgrade the electronic communications apparatus or (as the case may be) share its use, the main operator attaches a notice, in a secure and durable manner, to a conspicuous object on the relevant land.

(7) A notice attached for the purposes of sub-paragraph (6) must—

(a) be attached in a position where it is reasonably legible,

(b) state that the main operator intends to upgrade the electronic communications apparatus or (as the case may be) share its use with another operator,

(c) state the date on which the main operator intends to begin to upgrade the electronic communications apparatus or (as the case may be) share its use with another operator,

(d) state, in a case where the main operator intends to share the use of the electronic communications apparatus with another operator, the name of the other operator, and

(e) give the name of the main operator and an address in the United Kingdom at which the main operator may be contacted about the upgrading or sharing.

(8) Any person giving a notice at that address in respect of that electronic communications apparatus is to be treated as having been given that address for the purposes of paragraph 91(2).

(9) Any agreement under Part 2 of this code is void to the extent that—

(a) it prevents or limits the upgrading or sharing, in a case where the conditions mentioned in sub-paragraphs (3), (4) and (6) are met, of any electronic communications apparatus to which the agreement relates that is installed on, over or under land, or

(b) it makes upgrading or sharing of such electronic communications apparatus subject to conditions to be met by the operator (including a condition requiring the payment of money).

(10) Nothing in this paragraph is to be read as conferring a right on the main operator to enter the land which the main operator would not otherwise have, when upgrading or sharing the use of the electronic communications apparatus.

(11) References in this paragraph to sharing electronic communications apparatus include carrying out works to the electronic communications apparatus to enable such sharing to take place.

(12) In this paragraph—

“the relevant land” means—

(a) in a case where the main operator has a right to enter the land, that land;

(b) in any other case, the land on which works will be carried out to enable the upgrading or sharing to take place or, where there is more than one set of works, the land on which each set of works will be carried out;

“subsisting agreement” has the meaning given by paragraph 1(4) of Schedule 2 to the Digital Economy Act 2017.’”

This amendment, together with Amendments 14, 16 and 17, would apply a different regime under the Electronic Communications Code to private landlords, giving automatic upgrade rights for operators to properties owned by private landlords subject to the condition that the upgrading imposes no additional burden on the other party to the agreement.

Amendment 16, in clause 60, page 44, line 4, after “land”, insert

“not owned by a private landlord”.

This amendment, together with Amendments 14, 15 and 17, would apply a different regime under the Electronic Communications Code to private landlords, giving automatic upgrade rights for operators to properties owned by private landlords subject to the condition that the upgrading imposes no additional burden on the other party to the agreement.

Amendment 17, page 45, line 14, at end insert—

“17B (1) This paragraph applies where—

(a) an operator (‘the main operator’) keeps electronic communications apparatus installed on, under or over land owned by a private landlord,

(b) the main operator is not a party to an agreement under Part 2 of this code in relation to the electronic communications apparatus, and

(c) the electronic communications apparatus was installed before 29 December 2003.

(2) If the conditions in sub-paragraphs (3), (4) and (6) are met, the main operator may—

(a) upgrade the electronic communications apparatus, or

(b) share the use of the electronic communications apparatus with another operator.

(3) The first condition is that any changes as a result of the upgrading or sharing to the electronic communications apparatus to which any existing agreement between the operator and the landlord relates have no adverse impact, or no more than a minimal adverse impact, on its appearance.

(4) The second condition is that the upgrading or sharing imposes no additional burden on the landlord.

(5) For the purposes of sub-paragraph (4) a burden includes anything that—

(a) has an adverse effect on the person’s enjoyment of the land, or

(b) causes loss, damage or expense to the person.

(6) The third condition is that, before the beginning of the period of 21 days ending with the day on which the main operator begins to upgrade the electronic communications apparatus or (as the case may be) share its use, the main operator attaches a notice, in a secure and durable manner, to a conspicuous object on the relevant land.

(7) A notice attached for the purposes of sub-paragraph (6) must—

(a) be attached in a position where it is reasonably legible,

(b) state that the main operator intends to upgrade the electronic communications apparatus or (as the case may be) share its use with another operator,

(c) state the date on which the main operator intends to begin to upgrade the electronic communications apparatus or (as the case may be) share its use with another operator,

(d) state, in a case where the main operator intends to share the use of the electronic communications apparatus with another operator, the name of the other operator, and

(e) give the name of the main operator and an address in the United Kingdom at which the main operator may be contacted about the upgrading or sharing.

(8) Any person giving a notice at that address in respect of that electronic communications apparatus is to be treated as having been given that address for the purposes of paragraph 91(2).

(9) Nothing in this paragraph is to be read as conferring a right on the main operator to enter the land which the main operator would not otherwise have, when upgrading or sharing the use of the electronic communications apparatus.

(10) References in this paragraph to sharing electronic communications apparatus include carrying out works to the electronic communications apparatus to enable such sharing to take place.

(11) In this paragraph ‘the relevant land’ means—

(a) in a case where the main operator has a right to enter the land, that land;

(b) in any other case, the land on which works will be carried out to enable the upgrading or sharing to take place or, where there is more than one set of works, the land on which each set of works will be carried out.”

This amendment, together with Amendments 14, 15 and 16, would apply a different regime under the Electronic Communications Code to private landlords, giving automatic upgrade rights for operators to properties owned by private landlords subject to the condition that the upgrading imposes no additional burden on the other party to the agreement.

Amendment 12, page 45, line 18, leave out clause 61.

This amendment removes clause 61 of the Bill, which gives operators the ability to calculate rent based on ‘land value’ rather than ‘market value’ when renewing tenancies to host digital infrastructure on private land.

Amendment 13, page 46, line 42, leave out clause 62.

This amendment removes clause 62 of the Bill, which gives operators the ability to calculate rent based on ‘land value’ rather than ‘market value’ when renewing tenancies to host digital infrastructure on private land in Northern Ireland.

Amendment 9, in clause 68, page 58, line 38, leave out from “must” to “one” in line 39 and insert “use”.

This amendment, along with Amendments 10 and 11, seeks to ensure that operators engage in the alternative dispute resolution process by making it mandatory.

Government amendments 4 to 7.

Amendment 10, in clause 68, page 59, line 12, leave out from “must” to “one” in line 13 and insert “use”.

This amendment, along with Amendments 9 and 11, seeks to ensure that operators engage in the alternative dispute resolution process by making it mandatory.

Amendment 11, page 59, line 34, leave out from “must” to “one” in line 35 and insert “use”.

This amendment, along with Amendments 9 and 10, seeks to ensure that operators engage in the alternative dispute resolution process by making it mandatory.

Government amendment 8.

[Julia Lopez]

It is a pleasure to be making such good progress on this Bill, which seeks to deliver world-class connectivity to our constituents and to improve the security of the devices that we all rely on. I will start by explaining the need for the Government amendments tabled in the name of the Secretary of State, as those amendments are relatively straightforward. I will then move on to the more substantial matter of the remaining amendments, which I suspect right hon. and hon. Members are keener to discuss.

Beginning with new clause 1, as I explained on Second Reading, some operators with apparatus on land are currently unable to follow an existing statutory process to renew their agreement once it comes to an end. These operators also cannot use the code to get an entirely new agreement, because only the occupier of land can grant code rights. An operator already occupying land clearly cannot enter into an agreement with itself. Clause 57 was intended to ensure that operators could obtain code rights from another party in these circumstances, but subsequent engagement with stakeholders has made it clear that the clause as drafted would not cover all scenarios and that a more focused approach is required. Some operators would still find themselves effectively stuck once their agreements ended, with no means of renewing their agreement and no reasonable or practical means of obtaining a new code agreement. This can have negative consequences for consumers, and as such it is unacceptable. New clause 1 therefore replaces clause 57.

The new clause will ensure that all operators in exclusive occupation of land who do not have a statutory renewal option can still seek a code agreement. The person who can grant those code rights will usually be the owner of the land, although the new drafting makes provision for less straightforward situations. As well as resolving the problem of “stuck” operators, new clause 1 also assists operators with an existing, ongoing agreement. Where such operators need additional code rights that are not already provided by their current agreement, the new clause ensures they can seek such rights. Currently, some such operators are unable to do so because they are in occupation of the land.

--- Later in debate ---

[Sir Desmond Swayne]

My amendments 9 to 11 are designed to address what was made clear in the House on Second Reading, which is that there are examples of egregious bullying by the operators and that there is a complete disproportion of power between those operators and the landowners. The Minister has spoken of her demand for more collaborative working and collaborative negotiation, but we are asking for the process of alternative dispute resolution to be a requirement from the outset precisely because the operators know that they have the power to overawe and frighten landowners with the threat of legal action.

The purpose of my amendments 11 and 12, which was spelt out very well by the Minister, is to return to the status quo ante 2017. Until 2017, compensation was based on market value, and in 2017 the new code changed it to land value, notwithstanding the explicit advice of the Law Commission not to do so. As was entirely predictable and as was predicted, the market dried up as a consequence and there were far fewer agreements. One of the purposes of this Bill is of course to address that problem of the reduction in agreements. Therefore, the obvious remedy is to restore the position as it was and return to market value, but far from doing that—far from seizing this opportunity to remedy the situation—the Government are compounding their error by wanting to make agreements previously made under the old regime renewable under land value, actually making the problem significantly worse as a consequence.

I do not know why the Government appear to have adopted the anarchist principle that property is theft. On the contrary, these measures, by denying landowners proper compensation on the basis of market value—compensation arrived at by a free and open market—and coercing them accordingly to give up their property rights, strike me as theft. These provisions in the Bill are in effect a conspiracy to promote theft: it is stealing. I just cannot understand how a Conservative Government have brought themselves to bring this measure before the House, changing the law retrospectively and so damaging property rights. I just assume that Ministers simply have not realised the enormity of the change they are making. Accordingly, I believe these amendments are vitally necessary for the Bill.

[Madam Deputy Speaker (Dame Rosie Winterton)]

I call the SNP spokesperson.

[Owen Thompson (Midlothian) (SNP)]

It is worth saying from the start that this Bill certainly takes aim at some of the key gaps in how we regulate product security, so I am genuinely grateful that the Minister is seeking to address some of the issues that have been raised. I put on record my thanks to my hon. Friend the Member for Ochil and South Perthshire (John Nicolson) for leading on Second Reading and in Committee, as well as for getting the phrase “malevolent toaster” into Hansard.

I have warned the Chamber a number of times about the various threats from technology and online spaces. For instance, I have campaigned for tougher action against so-called cyber-troops—organised malevolent forces that weaponise misinformation against our democracy. I definitely think that there has been major progress in building public awareness about the importance of cyber-security, and the experience of the botched Brexit referendum and Trump’s time in the White House was a crash course in taking online safety seriously.

However, we do remain a bit behind when it comes to the so-called internet of things, which encompasses the many household objects we now connect to the internet, from security systems to smart fridges and, indeed, toasters. This is a real Achilles heel. Last year, there was a total of 1.5 billion attacks on the internet of things—up 100% in the first half of the year. When Which? set up a fake smart home, it found that it was exposed to 12,000 attacks a week, yet our slowness in recognising that threat has got us to a place where only one in five “internet of things” manufacturers are believed to embed strong security in their devices.

Discussions around the Online Safety Bill have shown as clear as day that many companies, and especially those in the big tech sector, need to be dragged kicking and screaming to implement the bare minimum level of safety for users, whether that is to age-regulate graphic content or to stop scammers. Of course, there are some exceptions, but in any such situation where the private sector prioritises profit over protection, the Government need to step up to protect users with at least a bare minimum level of safety. The Government’s decision to do so by enshrining the principle of security design is therefore very welcome on the SNP Benches.

It is also absolutely right that we embed the idea in the law that the onus should be on the manufacturers to provide security in the design of their products, bringing the UK framework into line with the Scottish Government’s cyber-resilience strategy, which has enshrined security by design as a foundational principle in Scotland’s cyber-landscape. And yet, oversights abound. I am sad to say that oversights were raised with the Government on Second Reading and in Committee, but a number still remain. Some of that points to the Government trying to push the Bill through at breakneck speed, but the Minister should caw canny about putting speed over consumer safety as that will only cause us all headaches further down the line.

One such oversight on Second Reading was the requirement for manufacturers to declare publicly security flaws in their products without requiring that fixes are carried out when the flaw is announced. Nor is there a requirement for automatic fixes to be in place. One without the other essentially has the effect of drawing a big red circle around the product’s flaws for hackers without giving users the tools to shore up their defences. We cannot expect users to be skilled in product patching, so a laissez-faire approach would be a serious mistake. Nobody should be fixing those flaws but the manufacturers, and nobody but the Government can require them to do so.

On Second Reading, the Minister was urged to implement a requirement for automatic patching or one for manufacturers to have a solution in place by the time that the product flaws are disclosed publicly. It is frustrating that no progress has been made on that front. I hope that the Minister can see that that is an urgent issue for public safety and that we all have to get it right. There has also been no progress in plugging the gaps in products left out of the Bill’s scope such as internet-connected ovens, medical devices, routers and second-hand products. On top of that, the Government have justified the exclusion of laptops and desktops by arguing that there is already a developed security software market. That may be the case, but only 58% of people in the UK use antivirus software. With home working on the rise, it is crucial that the Minister recognises the growing risk of laptops and desktops.

The somewhat unclear definition of “distributors” in the Bill also means that online marketplaces such as Amazon and eBay could argue that they are platforms or services, which would leave them outwith the Bill’s scope. That is a major oversight considering the number of unsafe products found on those sites. Closing that loophole would be a simple case of tidying up the language and explicitly including online marketplaces.

Although it is welcome that future regulations will require manufacturers to provide transparency on how their products receive security updates, leaving that up to the regulators feels like a bit of a cop-out. The Government have given no clarity on exactly what level of transparency will be required. Why not give us the details so that we can debate them fully in this place? Without those details, how can we expect enforcement to be in any way achievable?

Which? has been campaigning heavily on those two points, and I applaud its efforts to keep consumer protection at the top of the Government’s agenda. I urge the Minister to heed Tech UK’s call for the Government to undertake work to communicate the new framework to consumers. We risk causing a surge in electronic waste if the Bill causes consumers to perceive that their old devices are obsolete, so an effective comms strategy is needed to prevent an adverse environmental impact.

Before I wind up, I repeat the point made by my hon. Friend the Member for Ochil and South Perthshire on the Bill’s enforcement mechanisms. Clause 26(5) makes it clear that the Secretary of State will not be able to bring proceedings in Scotland, but the Bill will still establish enforcement mechanisms and a body to carry out enforcement. As the Scottish courts and legal system will have to manage enforcement action brought in Scotland, and as oversight of the Scottish legal system is devolved, it is only right that the Scottish Government should have a role in developing the enforcement mechanism. That is honestly just a bit of tidying up, and it is a bit tiring to have to remind the Government constantly not to treat Scotland as an afterthought, but sadly we are here again. What consideration has been given to the Scottish Government’s call for the inclusion of a duty to consult relevant Scottish Ministers when developing the enforcement mechanism and the security requirements to be enforced? On the topic of the devolved nations, I would appreciate it if the Minister set out what impact the Bill’s passage will have on the Scottish Government’s power to regulate products in Scotland, particularly in the light of the United Kingdom Internal Market Act 2020.

--- Later in debate ---

[Madam Deputy Speaker (Dame Rosie Winterton)]

I call the shadow Minister, Chris Elmore.

[Chris Elmore]

I do not intend to detain the House for long. Her Majesty’s Opposition recognise that the first duty of any Government is to keep their citizens safe. That is why we are supporting the security elements of the Bill, which were developed by the Department in conjunction with the National Cyber Security Centre. As the digital sphere becomes ever more integral to our lives and livelihoods, it is of the utmost importance that citizens across the United Kingdom are protected from malign actors. We believe that the Bill will make some significant progress in that regard.

Although we think that measures in part 1, such as the ban on default passwords, are of paramount importance and will no doubt bring benefits, we have concerns about a number of other areas. The legislation establishes, through regulations, three core security requirements for “connectable products”. Rather than those three security requirements being left to be defined in future, we believe that they should be expressly set out in the Bill. That would speed up the entire process and ensure that consumers are protected sooner rather than later.

Similarly, we would like the Secretary of State for Digital, Culture, Media and Sport—it is a pleasure to see her in her place—if she is not too busy trashing another one of our great British institutions, to prepare and publish a report on the security risks to UK connected products. During an oral evidence session on the Bill, Professor Madeline Carr, a cyber-security expert, told us that she would not have an Alexa in her house due to the security risks and that there is nothing in the Bill that would change her mind. Due to that statement by an industry expert, and the prominent role that cyber-warfare is playing throughout the conflict zones of the world, we think that it is very much in the national interest to know how secure our connected products are, and we call on the Government to go much, much further.

The Prime Minister came into office promising “full-fibre” broadband by 2025. Due to a lack of application and grip from the Prime Minister and the Government that he leads, that target was quickly downgraded to full gigabit broadband by 2025. In what was a surprise to absolutely no one who follows this Administration closely, the target was downgraded again to 85% gigabit-capable broadband by 2025. There are still huge doubts—voiced by the Digital, Culture, Media and Sport Committee, the Public Accounts Committee and industry—that even that twice-reduced target will yet be achieved, selling Britain short at every opportunity.

I take no pleasure whatever in pointing out those failures. Indeed, I believe that they are hugely damaging to the future economic potential of our country and to the UK’s social fabric. That is because a digital divide exists in our country and it is only getting worse. One such divide is the fact that, when it comes to digital connectivity, many communities in rural and semi-rural areas, including my Ogmore constituency, are being left behind completely. With the increase in working from home and schoolwork being done over the internet since the pandemic, the Government urgently need to get a grip on this critical issue.

In detailing the Government’s failings when it comes to our telecommunications infrastructure, I think of our own Sir Tim Berners-Lee, who had a vision of the internet being “for everyone”. However, the Government’s inaction is ensuring that that is currently not the case. In 2010, the Labour party left behind a world-leading sector for communication and mobile phone roll-out. The Government have stagnated and stalled over the past 12 years and have failed to build on Labour’s success.

I repeat what I have said throughout the passage of the Bill: I support the Bill’s aim of both increasing the security of our connected devices and speeding up the roll-out of our telecommunications infrastructure. Our point of contention is that the Bill, as currently constituted, does not do either as well as it could. It does not deliver what people in this country desperately need: improved broadband.

As the Bill makes its passage to the other place, we hope that the issues raised about it can be taken up by their lordships to ensure that the improvements can be made and, hopefully, some amendments won. I echo what the Minister said about the constructive nature of our debates—I am not sure that we will be able to continue that with other Bills that she and I may spar over in the months ahead, but I am sure we will try.

I thank the Clerks and all House staff who worked so diligently during the Bill Committee, including the evidence sessions. I thank the witnesses for their expert advice, which was truly valuable. I thank my staff, including Alex Williams and James Small-Edwards, who did an enormous amount of work—I do not have the luxury of civil servants, but perhaps one day soon—[Interruption.] The Secretary of State says “Dream on”. She has certainly been having a few dreams of her own of late that are not working very well, particularly for the Prime Minister. I pay tribute to my staff, who have worked diligently during this process, and I thank all the Members who have played such an integral part in ensuring that the Bill passes through the House with civility and good humour throughout.

[Madam Deputy Speaker (Dame Rosie Winterton)]

I call the Scottish National party spokesperson, Owen Thompson.