Cyber Security and Resilience (Network and Information Systems) Bill

Debate between Alex Sobel and Matt Western

Report stage
Tuesday 16th June 2026 Commons Chamber

[Matt Western (Warwick and Leamington) (Lab)]

It is a pleasure to follow the right hon. Member for Chingford and Woodford Green (Sir Iain Duncan Smith). I concur with the points he made on Jimmy Lai and Jagtar Singh Johal and, more widely, about the internet of things. I think of Norway and Denmark, which suddenly realised that hundreds of buses they had imported from China had kill switches, meaning that their entire public transport networks could potentially have been disabled, just like that. That is the reality of these new technologies, and we need to face up to it and have our eyes wide open in the contracts and deals that we sign.

On Second Reading five months ago, I welcomed the Cyber Security and Resilience (Network and Information Systems) Bill, but even in the short time since then, the world has become an ever more dangerous place, and the cyber-threat has only intensified. I commend the Government on their hard work in the intervening period, and in my remarks today I want to focus on the cyber-threat landscape, my two amendments—new clause 21 and amendment 28—and the need for a national conversation on national security, which of course includes cyber-security.

Let me start with the cyber-threat landscape. The UK is the most cyber-attacked nation in Europe and the third most cyber-attacked nation globally, with three in four businesses having suffered a cyber-attack in the past year. My hon. Friend the Member for Newcastle upon Tyne Central and West (Dame Chi Onwurah) talked about the attacks on Jaguar Land Rover, Marks & Spencer, the Co-op and others. Having spoken with those businesses with the Joint Committee on the National Security Strategy and individually, I know of the scale of the impact that was felt within their operation and how affected they were by these attacks. It is unimaginable, even for the most seasoned business and industry leaders, to suddenly find themselves under such attack, and the repercussions for the economy have been very significant.

In April, the CEO of the National Cyber Security Centre, Richard Horne, laid out the scale of cyber-attacks: on average, the NCSC deals with around four nationally significant incidents a week—that is not the hundreds of incidents that are occurring every day, but the really serious, significant ones. The threat of cyber-attacks will only intensify. Continued state-backed cyber-attacks from Russia, China and Iran, either directly or via proxies, are being fuelled by technological advancements in AI and quantum computing, increasing the complexity and sheer volume of such attacks. The reality is that major cyber-attacks are no longer rare one-offs but an operational reality facing every business and organisation—public and private—across the UK, as they are globally. It is important that we secure our systems to make them more robust and deter such attacks, so that those who wish to do us harm will go after others. It is in this context that the Bill has been introduced, and it takes serious, robust steps to increase the resilience of the UK.

However, given the escalating threat picture, I continue to have concerns about the scope and breadth of the Bill. That is why I have tabled new clause 21 and amendment 28, which I hope the Minister will reconsider. New clause 21 would bring those in the food supply chain within the scope of the NIS regulations and regulate them as “operators of essential services”, while excluding smaller businesses, to avoid an unnecessary administrative burden. I understand that the Minister addressed this on Second Reading, explaining that essential services would only include those sectors

“the failure of whose network and information systems poses imminent threat to life to the British public.”—[Official Report, 6 January 2026; Vol. 778, c. 225.]

I would gently suggest that the collapse or disruption of the food supply chain would pose an imminent threat to life. I say that in an honest and not patronising way. Those of us who have had conversations behind the scenes about what happened during the pandemic, and Opposition Members who were far closer to that when in government, will realise that the health threat was one element, but the collapse of society—not just the economy, but society—with the potential for civil unrest and rioting, due to the lack of food and toilet rolls on shelves and so on, would have been the most urgent and pressing issue. It is worth noting that the European Union’s NIS2 directive does include food distribution in its regulation, so it is feasible and recognised internationally as important. The Bill does grant the Secretary of State powers to bring in new sectors. Could the Minister reassure me that the Department will give this due consideration today and in the future?

Secondly, amendment 28 would ensure that relevant managed service providers do not provide services to manage the technology systems for a number of customers that exceeds a critical risk threshold within the same sector or subsector. The rationale behind this is simple: it is about building resilience and ensuring that if one RMSP fails or is breached, a whole sector is not hamstrung by it. I can envision a situation whereby one particular RMSP dominates a large category or small subsector that may be a crucial part of a supply chain, thereby crippling the whole chain. Indeed, my hon. Friend the Member for Newcastle upon Tyne Central and West cited the UK Government’s dependency on AWS and Microsoft as an example. Will the Minister please consider that?

Aside from my two amendments, it is clear that the Bill, in itself, is not the only answer to our cyber-resilience; multiple approaches are needed. Given that the Bill does not include large swathes of the economy or local government, it is even more important that we explain to businesses and the public the very real threats that we face. That brings me to my final point, which is on the need for a national conversation on national security. We can have the best crafted and tightest legislation and regulation, but unless we have a real cultural shift and acknowledgment of the cyber-threat and its impacts, from board level to entry-level positions, all of this will be wasted. I once again encourage the Department and the whole machinery of government to go further and faster in explaining the threat posed and the steps we can all take to boost resilience, because resilience starts with the mobile phone in our pocket, and cyber-security is only as strong as its weakest link.

The Joint Committee on the National Security Strategy, which I chair, has begun its inquiry into building national resilience through a national conversation. It is clear from the evidence we have heard from Taiwan, the Netherlands and other European nations I have spoken to that we need to explain the threat to people, build a stronger cultural sense of resilience and explain that we all have a role to play; it is not simply the state’s responsibility. I will update the House on our findings in due course, and I hope the Minister and the Government will find that useful when considering their plans for national resilience.

To conclude, this Bill is a substantial and serious step forward in protecting the UK from cyber-attacks. It makes us more resilient and strengthens our collective security, but there are areas where I encourage the Government to be more ambitious—namely, by bringing the food supply chain into the essential services classification, as Europe is doing; setting critical risk thresholds for RMSPs; and expanding the scope of the Bill to encompass more of the economy.

[Alex Sobel (Leeds Central and Headingley) (Lab/Co-op)]

It is a pleasure to follow such esteemed colleagues. My only declaration before I start my speech is that I hold a degree in information systems from the University of Leeds.

I have been sat here for the last two hours looking at the memorial plaque for Jo Cox, 10 years after the horrific day that we lost Jo. I was a West Yorkshire candidate alongside Jo in the run-up to the 2015 election. It is to my huge detriment that I never got to serve with her here. Today is such a difficult day for so many colleagues. I know that Jo would have dearly liked to see many of the things that Labour is doing in government. It is incumbent on us to try to push forward all the things that Jo strived for, to make this place better, to make the country better and to make the world better.

Let me now turn to cyber-security. Data centres are warehouse-like facilities that house the information technology equipment upon which almost all digital activity relies. The UK Government say that they

“underpin almost all economic activity and innovation, including the development of AI and other technology, public service delivery”

and modern-day communications. Europe’s largest data centre market is Greater London, where most of the UK data centres are concentrated. There are four types of data centre, one being AI data centres, which are facilities specialised for the high-performance computing needs of AI development and AI models. Having data centres based in the UK allows our Government to regulate them, such as by requiring them to meet cyber-security standards and reduce their environmental impact, which is obviously very important.

Data centres are an essential part of our critical national infrastructure. They have a huge environmental impact so must be managed carefully, but the benefits of having them on our home turf is that we can regulate them. In our current state of hybrid war with Russia, it is vital to protect those data centres from any nefarious actors or cyber-warfare, and to strengthen their protections against cyber-attacks spawned by AI. Otherwise, the impact on public safety, the economy and society could be catastrophic.

Automated and Electric Vehicles Bill

Debate between Alex Sobel and Matt Western

2nd reading: House of Commons & Ways and Means resolution: House of Commons
Monday 23rd October 2017 Commons Chamber

[Matt Western (Warwick and Leamington) (Lab)]

I refer to my entry in the Register of Members’ Financial Interests.

I welcome the Bill, although it is clearly much reduced from what was originally put forward. It is interesting how so much of our discussion has been around cars as vehicles, as opposed to vehicles more generally, and I draw attention in particular to electric bikes, scooters, taxis—which have been mentioned—vans and lorries, and in particular buses, which I will refer to again later.

I also welcome initiatives such as the Faraday challenge, which is a terrific example of how Government can work with academia and businesses to bring about change and revolution in a particular sector. That stimulus is crucial for major step changes such as electric vehicle technology and autonomous vehicles. A good example of that has been at Warwick Manufacturing Group, which although not in my constituency employs a good many of my constituents. It is very much at the cutting edge of the development of battery and fuel cell technology, working with many other universities across the country and vehicle manufacturers from the UK and around the world.

It is critical that we gain leadership in this sector. We need a competitive advantage over the likes of China, South Korea and Japan, which are very much the established dominant players in battery and fuel cell technology. To that end, we urgently need to establish a battery prototype centre that is able to adapt to the rapid change in this technology; as we see in other sectors, change can be so rapid that it is easy to be caught out by technological development. I hope that such a centre might be located at the heart of the automotive industry, which is very much in my constituency of Warwick and Leamington, and in Coventry and Warwickshire. They are at the heart of the development of connected vehicles. That would be a very welcome move indeed, and I look forward to an announcement on that matter.

The ambition has to be matched by our legislative will as policymakers, and by the acknowledgement of the need to change consumer behaviour. There has been a lot of talk about that recently by Members on the other side of the Chamber. We have to encourage people through initiatives, exemptions, fiscal measures and perhaps scrappage schemes if we are to accelerate not only that change in behaviour but investment from manufacturers and investment in infrastructure.

Several weeks ago, I was lucky enough to be invited to the Jaguar Land Rover Tech Fest event here in London, at which the company announced that every new vehicle line would have electrified versions as of 2020. That is a terrific innovation coming from such a major employer and investor in this country. Even the E-type Jaguar will be retrofitted with a battery cell, so there is something for everyone in what the company offers. We have heard about the Nissan Leaf, which has been hugely successful and a terrific economic stimulus for the north-east. We have also heard about the electric versions of the Mini that are coming through. Reference has also been made to the Polestar range from Volvo and Geely. I think I am right in saying that Geely will be the first car manufacturer with an entirely electric vehicle range.

There need to be incentives, but if we look at other countries we see perhaps a greater degree of leadership in this area than there has been here so far. I believe that more than 10% of new vehicle sales in Norway’s total car market are pure electric vehicles, for example. That compares with just 2% or 3% in this country. We are really behind the curve compared with other European countries. Our ambition is to be non-petrol and non-diesel by 2040, but that will come a little too late.

[Alex Sobel (Leeds North West) (Lab/Co-op)]

Does my hon. Friend agree that, in order to stimulate the electric car market and ensure that we can move to a fully electric market, we will need a minimum density of electric charge points in residential and commercial areas?

[Matt Western]

I welcome my hon. Friend’s intervention, and I certainly agree that there needs to be a minimum density. That is an area of infrastructure on which we should insist in all development in our town centres, and also in our new-build housing. It relates to local plans, and it is a critical part of the framework. The Government and local authorities should be showing leadership in this area. This is a great opportunity and we need to accelerate the uptake in electric vehicle use over the next few years.

Buses have not yet been referred to. Our buses, lorries and vans are among the dirtiest vehicles in our urban areas and there is perhaps greater urgency to get them off the roads. I was recently proud to attend the launch of the new Volvo electric bus, which is now being tested in certain areas around the country, most recently in Greater Manchester, where it was extremely well received. These sorts of vehicles will change the air quality in our town centres dramatically, and we need to encourage and accelerate their adoption.

The challenges also lie in the power grid, which can be hard to access in many areas, particularly rural areas. A further issue for the adoption of electric buses is that of interoperability and the standardisation of on-route charging sites. This is an area in which our European peers are a little bit further ahead. It is rather like the VHS/Betamax debate many years ago, which many of us will remember. We need a general acceptance of standardisation, to ensure that we have the right sort of infrastructure in place in our town centres. At the same time, we need subsidies and fiscal incentives for bus operators to adopt electric buses. Bus operators receive public money in subsidies, so I urge that this is targeted through a progressive taper to advantage electric vehicles.

As was mentioned by the hon. Member for Milton Keynes South (Iain Stewart), there has been much debate about domestic, commercial and on-street charging points—my hon. Friend the Member for Leeds North West (Alex Sobel) also referred to them a moment ago—but I want to draw greater attention to the revolution that can be had with the advent of smarter cities, where streetlight columns and other street furniture can be used for charging. That is happening elsewhere, and the supply can be two-way, to the benefit of either the user or the municipality.

In summary, I welcome the Bill, but I urge more ambition in certain areas and more caution in others. In implementing the regulatory framework and incentives to accelerate electric vehicle adoption to arrest serious air quality problems and climate change, we must be as ambitious as India, the Netherlands and others in banning new petrol and diesel vehicles by 2030—2040 is too late. In considering the merits and needs of autonomous vehicles, I urge legislative caution. Yes, the legislation must be enabling, but as we see with sat nav systems even today, the concern is about the data and the software’s interpretation of it. By way of example, around the corner from where I live in my constituency is a narrow cul-de-sac called Clapham Terrace, which is regularly used erroneously by continental articulated lorries to access a local industrial estate. They must then reverse 300 metres back down a narrow street with a school on it. Finally, will Ministers ensure that the Bill is clearer about different types of vehicles? It should include lorries, buses, motorbikes, scooters and electric bicycles. In all other respects, I welcome the intent of the Bill.