Cyber Security and Resilience (Network and Information Systems) Bill

Cameron Thomas Excerpts

2nd reading
Tuesday 6th January 2026 Commons Chamber

[Emily Darlington (Milton Keynes Central) (Lab)]

I welcome the Bill and the cyber action plan for public services, which was published today. As we have heard from right hon. and hon. Members’ many great speeches today, this is so important to the UK economy and public.

Despite being one of the smaller countries in the world, we are still one of the biggest targets for cyber-attacks. In the past 12 months, there has been some good news: only four in 10 businesses and three in 10 charities have had cyber-security breaches—the figures are down on the previous year. However, there has been a huge increase in nationally significant cyber-incidents, which have more than doubled in the past year, including the malicious cyber-attacks on critical infrastructure by Russia and China.

These matters are important to companies based in Milton Keynes Central, where one in three jobs are in technology. Milton Keynes is a leader in the development of AI and tech services, including in legal services, financial services and autonomous vehicles. Those companies have experienced cyber-attacks, so the Bill is very welcome. The difficulty is that it misses a huge portion of the discussion, and Ministers have somewhat neglected to mention sovereign technology in their comments or in the strategy. I hope that they will do so in the wind-up.

One role of sovereign technology is to fight cyber-crime. There are many definitions of sovereign technology, so what does it actually mean? To me, most of the public and the industry, it means UK innovation and technology. It is developed in the UK and is UK-owned intellectual property. It means a company paying UK taxes. Most importantly, it means a UK company being accountable to the UK. The Government have talked a lot about their commitment to developing and securing sovereignty, but that needs to be extended to all critical technology and infrastructure. Not only is that important in cyber-security terms, but it has other advantages, too: it is good for the economy, creates innovation and sets the highest standards, and it thereby gets public support and confidence and achieves small business support for absorbing the innovation. It achieves growth by creating not only UK customers, but—ambitiously—worldwide customers.

The Government have done that quite well in the past. They have created safe and secure solutions. Crown Hosting Data Centres is a really good example of a joint venture between the Government and Ark Data Centres. Unfortunately, only 3% to 4% of Government servers actually use it, and we must ask why. What are we doing to promote safe and secure solutions in the UK that would help us to fight for cyber-security and ensure that it is promoted across the public sector, and to ensure that those solutions gain support in the private sector? Instead of using Crown Hosting Data Centres, many are using ones run by foreign firms with securities and standards developed outside the UK. Outages at Amazon Web Services in cloud hosting have cost business millions.

Let us look at other areas where the public rightly worry about cyber-attacks and cyber-security, such as NHS data. We have heard about the impact of cyber-crimes on the NHS and on lives, but it also impacts public confidence. Palantir has a £330 million contract to bring together all NHS data. That is a fantastic initiative and really important, and the public support it because they do not want to have to repeat their health story to each and every doctor, nurse or other health professional that they meet. The difficulty is that using a foreign firm with some questionable alliances has led to an erosion of public trust and to a lack of trust among doctors, slowing the take-up of this important innovation in NHS services. That is partly because the co-founder of Palantir called our pride in the NHS “Stockholm syndrome”. Unfortunately, he misunderstands the very body to which he is selling services and is thereby eroding public trust. I know many UK firms that could have done just as good a job—and probably better, because trust among the public and doctors would have increased.

We hear that Palantir has just won a £240 million contract with the Ministry of Defence for

“data analytics capabilities supporting critical strategic, tactical and live operational decision making across classifications”.

Again, it is hugely important that we are using the latest technology to promote our MOD and that we are tying all that up. I do not think anybody in this House has concerns about the MOD making these kinds of investments; it is who we choose to partner with that drives the concern.

As I have already argued, the reality is that cyber-security has to be UK-focused. We have to protect our national interest and ensure that our partners put our national interest and cyber-security first and foremost. The views of organisations such as Palantir on the NHS and its integration into US Immigration and Customs Enforcement—otherwise known as ICE—lead us to worry that it does not share UK values. It creates a strategic vulnerability. That is what the sector is saying to us, and we should listen to it. Cyber-security is not just about reporting; it is about the investments we make ahead of time. Imagine if those two contracts and their economic opportunities had been given to UK firms. There would be enhanced UK-based cyber-security and greater confidence in our most critical areas of health and the military.

Let me raise another example which, if The Daily Telegraph is correct, I am sure will raise significant public trust concerns. It has reported today that the Government are considering using Starlink for the emergency services network, replacing the existing radio set-up that is used by ambulances, police and the fire service in an emergency—our most critical infrastructure. This company is controlled by a man who has shown his willingness to turn off satellites in Ukraine at his own political whim.

[Cameron Thomas (Tewkesbury) (LD)]

The hon. Lady is making a really important point about Elon Musk’s Starlink system, but will she go a little further and recognise that not only has Elon Musk switched off Starlink in Ukraine at will, but he has done so on occasions that might have turned the tide of the war?

[Emily Darlington]

I thank the hon. Member for raising that point. It is important to note that Elon Musk turned off Starlink at very strategic points for the Ukrainian military when it was advancing on Russian-held territory. It is not just that he chose to turn it off; he chose to turn it off at a critical time for the Ukrainian military. I worry that somebody who chooses to do that, and who encourages violence among the UK public at a far-right rally, at which he said,

“Whether you choose violence or not, violence is coming to you. You either fight back or you die”,

is not an appropriate or safe partner for our emergency services.

I absolutely support the comments made by my right hon. Friend the Member for Oxford East (Anneliese Dodds) about transparency, and about some of the actions being taken by those who have been willing to stand up to these companies and demand transparency. While that is probably not the subject of today’s debate, I think we must take those actions as a warning for what is to come.

I welcome the Bill and the action plan, but to truly make the UK safe and secure from state-sponsored or criminal cyber-attacks, we need to ensure that there is a UK sovereign infrastructure, capacity and capability. The Government can lead the way through their own procurement practices by making sure we are partnering with UK sovereign firms. That is good for security, good for protecting us against cyber-attacks, and good for the economy and public trust.

[Andrew Cooper (Mid Cheshire) (Lab)]

It is a privilege to follow my hon. Friend the Member for Milton Keynes Central (Emily Darlington), who made a fantastic speech. I do not think mine will be of quite the same quality, but I will do my best.

Having spent my career prior to entering this place as a software developer, it is perhaps not so much a pleasure as a blast of nostalgia to be speaking on this Bill today. The Bill provides for an important and long-overdue update to the NIS regulations, and provides the means to keep those regulations up to date more quickly as new threats emerge. That was a massive gap in our capability left behind by the rather haphazard and cavalier manner of our departure from the EU, and it is absolutely right that we resolve it as soon as we can.

It is a cliché to say that the nature of the threats we face has changed. Whether it is state-sponsored cyber-attacks, hacktivism, identity theft or ransomware attacks, those threats can have a widespread and significant impact on people’s lives, on the wider economy, and on our safety and security. Many Members from across the House have noted the cyber-attack on Jaguar Land Rover —which led to that company posting a loss of £485 million last year and, as I think we heard earlier, to a £2 billion impact on the wider economy—and the Co-op infiltration, which cost that retailer at least £206 million. However, this is not a new issue, and virtually no area of the economy has not experienced attempts to penetrate its systems and cause disruption or steal data.

[Cameron Thomas]

The hon. Member speaks of the cyber-attacks on Jaguar Land Rover and the Co-op. Those who pay council tax to Gloucester city council have concerns that following a Russian cyber-attack in 2021, that council recently discovered a £17.5 million deficit. Will the hon. Member recognise that too?

[Andrew Cooper]

I thank the hon. Member for his intervention. I confess that I am not an expert on the IT of Gloucester city council, but I am sure the Minister has heard his intervention, and may wish to respond in his summing up.

I welcome the measures in the Bill to bring managed service providers and data centre infrastructure into scope. When I began my career working on hotel reservation systems, legacy on-premise infrastructure was the standard operating practice. Some organisations would develop their own line of business systems and some would buy in, but virtually all would be hosted on their own servers, often with clever names such as Spartacus, Xena or Buffy the Vampire Slayer—names that I worked with over the years.

That situation changed for a whole pile of reasons, such as the need to support more public access, the requirement to facilitate more home working, huge increases in the speed of domestic and business broadband, the need to provide failover, redundancy and scaling, the shift away from big capital investment towards infrastructure as a service, and wanting to benefit from more rapid roll-out of features and applications that require significant server infrastructure behind them, such as we have seen more recently with AI. Systems have been moving virtually wholesale to those that are managed remotely and sandboxed to multiple organisations, and towards virtual servers or services in data centres, rather than on-premise tin.

Bringing these two areas into scope is obvious, and it is long overdue. I offer a note of caution about this part of the Bill, and it relates to the threshold at which the regulations apply. For managed service providers, we need to ensure that we are providing appropriate levels of cyber-security without blocking new entrants to the market. That applies to critical suppliers, too. The risk is that we end up boosting the hegemony of the big outsourcers and IT suppliers, rather than being able to support new domestic entrants. There is a risk of vendor lock-in, as we have heard several times today. Equally, the threshold on data centres appears to have been set so high that only larger ones will be in scope. I hope that the Minister will keep both of those points under review as the Bill progresses and think about how we can strengthen this provision to strike the right balance.

The other area of the Bill that I want to talk about relates to the regulators. The Minister set out in his opening remarks why he believes a sectoral approach is appropriate, and there is merit to that argument. Sectoral regulators have deep, long-standing institutional knowledge and they understand how the processes work in their sector. However, as I touched on earlier, the consequences of failure are enormous, with real-world impacts on people’s everyday lives. We should not expect an overarching cyber regulator to have the domain-specific knowledge of the water sector or the air traffic control sector, and nor should we expect every sectoral regulator to carry the expertise of how modern scalable data centres that detect faults automatically and automatically failover to different regions or different jurisdictions work. We just need to think about what the priority of an individual sectoral regulator will be, because it will not necessarily be cyber-security. We have to get the balance right, and we need to listen to the sectoral expertise on that.

In conclusion, this Bill is an important and long-overdue update to the UK’s cyber-security framework. I look forward to working with the Government to get the scope and scale of these regulations right and to ensure that all the systems that we rely on every day are secure in the face of current and emerging threats.

BBC Charter Renewal

Cameron Thomas Excerpts

Tuesday 6th January 2026 Westminster Hall

[Sir John Whittingdale]

Whether or not it is value for money is a debate that the BBC has advanced for as long as I have been debating the BBC. The question is: what do we compare it with? Is 25p value for money, or is £1.50 value for money? Unless it is decided what the BBC should be doing, we cannot determine that.

The other big factor is that paying the licence fee is not a choice. People do not have the opportunity not to pay; if they want the BBC, and indeed live television at all, they are required by law to pay the licence fee. Saying, “Oh, it’s fantastic value for money,” is very difficult when nobody has ever been given the opportunity to demonstrate whether they think it is value for money by choosing whether to pay for it.

[Cameron Thomas (Tewkesbury) (LD)]

One thing I learned recently on the Culture, Media and Sport Committee is that one way the BBC provides value for money is by being one of the only sources—if not the only source—of income for children’s content creators. Without that income, we would not get quality content for our children. There is a way of looking at this not purely from an individual perspective, but as an investment in the future. Does the right hon. Gentleman agree with that?

Gambling: Regulatory Reform

Cameron Thomas Excerpts

Tuesday 2nd December 2025 Westminster Hall

[Cameron Thomas (Tewkesbury) (LD)]

In the absence of my hon. Friend the Member for Newbury (Mr Dillon), I thank you, Sir Desmond. I also thank my hon. Friend the Member for Witney (Charlie Maynard) for securing this important debate.

As a teenaged boy, every morning on my way to school I would stop off at the home of my friend M and we would walk the last few hundred metres to school together. We shared a number of classes, and every lunch time we would abscond back to his house to play video games. As we became adults, we enjoyed betting on weekend football accumulators as we watched the live scores come in, at the small cost of a few pounds.

As I came to spend fewer weekends with our friendship group, and gradually lost interest in betting, M continued to bet more consistently and with ever greater stakes. The rise in online gambling firms was followed by increasingly invasive advertising campaigns, not only on the shirts of the footballers he watched or on the hoardings of premier league football stadiums, but increasingly in his social media feeds. Everywhere M looked, there was a betting company chipping away at his judgment, enticing him to put money down.

Adverts showed groups of young men cheering at TV screens in packed bars. They did not show dark bedrooms dimly illuminated by computer monitors or mobile phones. They did not show vulnerable young men in despair, having lost a pay packet on the first weekend of the month. M was well into his 20s by the time he realised he was a problem gambler. By the time he had reached his 30s, family members were protecting his wages from his addiction. By the time he was 40, he had twice lost deposits he had been saving to buy a home.

There is a sensible and nuanced course of action to be charted here. People such as my friend M need action, but establishments such as Cheltenham Racecourse in my constituency of Tewkesbury must not be conflated with online betting companies. Cheltenham Racecourse’s 250,000 annual visitors generate £274 million for the Gloucestershire economy, but the Jockey Club, which operates the racecourse in my Tewkesbury constituency, generates a tiny fraction of the huge profits enjoyed by large online gambling companies.

Taxation that fails to discriminate between such vastly different operations risks undermining the viability of horseracing, one of Britain’s oldest and most recognisable national sports, which contributes more than £3 billion annually to the British economy. I welcome the Government’s implementation of a Liberal Democrat policy in its increase to the remote gaming duty, though that money should be ringfenced to treat victims of gambling-related harms.

The most crucial action that must be taken, however, as my hon. Friend the Member for Witney said, is to restrict betting advertisement, particularly of the type that bombards sports viewers and seeks to blur the lines between sports and betting. Effective affordability checks could better protect those vulnerable to gambling addiction. I also note the speech by the right hon. Member for Chingford and Woodford Green (Sir Iain Duncan Smith), who said that a betting ombudsman is long overdue.

The Government should tackle gambling harms, but they must distinguish between those operations that prey on the vulnerable—at all hours, across all platforms—and those that genuinely contribute to our culture and economy.

Football Governance Bill [Lords]

Cameron Thomas Excerpts

2nd reading
Monday 28th April 2025 Commons Chamber

[Cameron Thomas (Tewkesbury) (LD)]

Supporters of lower league football clubs know the score: relegation all but confirmed, millionaire financiers abandoned, desperately clinging on to former glory, leaky at the back, midfield absent, not much going on up top, leadership completely out of their depth—but enough about the Conservative party. Despite the Conservatives’ attempt to turn this debate into a game of two faces, I have a serious point.

In 2008, business partners Yasuaki Kagami and George Synan became majority shareholders at Plymouth Argyle, which had been shortlisted to host games at the 2018 world cup, had England’s bid been successful. It was not, of course, so their interest in the club collapsed. Finances were withheld and Argyle, with one eye on the premier league, were relegated to the championship, then league one and then league two, in the space of three years. They were on the brink of insolvency before they were rescued by James Brent.

English football clubs such as Argyle should never become cash cows for vultures such as Kagami and Synan. Our largest clubs should never become money laundering operations for oligarchs tied to murderous dictators. Our football clubs are the beating hearts of our communities, around which local economies thrive; identities, friendships and rivalries are forged; and our culture is exported.

I broadly welcome this Bill for the regulation of ownership that it will introduce, but there are no mentions of slavery or human rights in the ownership test. Will the Government answer whether they consider those issues important in the fit and proper ownership of clubs?

I have one more point. It is unfortunate that the Government voted down an amendment from the Lords that would have reduced gambling advertisement and sponsorship in English football. There is an obvious opportunity here to protect our young people from a toxic industry that deliberately preys on the vulnerable. I do not often give too much credit to Arsenal alumni, but I know that Paul Merson would have wanted this. Will the Government tell me why they voted down that amendment?

Gambling Harms

Cameron Thomas Excerpts

Wednesday 5th February 2025 Westminster Hall

[Cameron Thomas (Tewkesbury) (LD)]

It is an honour to serve under your chairmanship, Mr Turner. I thank the hon. Member for Halesowen (Alex Ballinger) for securing this important debate.

Tewkesbury is home to the prestigious and internationally famed Cheltenham racecourse, which is one of the largest in the UK. Every year, more than 250,000 people visit the racecourse across four days of racing at Cheltenham festival, and many enjoy betting on the results. A 2023 study conducted by the University of Gloucestershire found that the economic benefit of Cheltenham festival was an estimated £274 million.

I consider myself a horseracing sceptic, but, as the Member of Parliament for Cheltenham racecourse, I must take a nuanced position. That £274 million is an astonishing figure, and I value that contribution. We must also consider the associated financial harms and the mental and physical health impacts of gambling on the UK economy, which cost £1.4 billion per year.

I am also acutely aware that problem gambling is a serious public health issue. I proudly submitted the Liberal Democrats’ contribution to the Gambling Act 2005 (Operating Licence Conditions) (Amendment) Regulations 2024 just last week, supporting financial caps on bets made online. Public Health England reports that approximately 246,000 people are problem gamblers in England alone, and a further 2.2 million people are at risk. Shockingly, it further reports that there are more than 400 gambling-related suicides per year.

My constituents deserve a Member of Parliament who puts their wellbeing ahead of the interests of private betting companies, while recognising the economic and social contribution of the industry. My residents deserve to be protected from exploitation by betting companies, which cannot be trusted, much less expected, to self-regulate. Our residents do not need another round of public consultations; they need action. I want to see significant restrictions on gambling advertising, including but not limited to that which plagues young people’s social media feeds and YouTube videos.

Gambling firms are at pains to present their industry as symbiotic with sport, deliberately placing their adverts around football broadcasts, stadiums and shirts.

[Abtisam Mohamed]

One particular gambling company says to people that when the fun stops, the betting should stop. Does the hon. Member agree that when the fun stops, it is far too late?

[Cameron Thomas]

I absolutely agree, but we should not leave it to gambling companies to make that statement. We should instead take action.

Gambling is not symbiotic with sport, and the companies should not be allowed to indoctrinate children, whose parents, like me, just want to introduce them to the beautiful game. We no longer allow fast food companies to align themselves with sport, and we should treat gambling companies in precisely the same way.

Draft Gambling Act 2005 (Operating Licence Conditions) (Amendment) Regulations 2024 Draft Gambling Levy Regulations 2025

Cameron Thomas Excerpts

Wednesday 29th January 2025 General Committees

[Cameron Thomas (Tewkesbury) (LD)]

The Liberal Democrats support the regulations. The stake limit will help to address gambling-related harm associated with online slots, which have rapid, repetitive play patterns and high average losses per customer. It reflects a commitment to tackling problem gambling and is a progressive step in the right direction, strengthening player protection.

Combating problem gambling is a topic the Liberal Democrats have campaigned on consistently. It is a serious public health issue, and it is vital that we take robust action to mitigate the risks. According to the latest Public Health England report on gambling, approximately 246,000 people are problem gamblers and 2.2 million are at risk.

The introduction of the statutory levy is a welcome step, as are the regulations, but I urge the Government to go further. We urgently need action to tackle pervasive gambling advertising and sponsorship. We also need action on black market gambling, and we need gaming products such as loot boxes to be regulated as gambling products to protect children from gambling harms.

Fundamentally, we need a commitment from Government to treat the issue as the public health issue it clearly is. That was the approach agreed in the 2023 White Paper, and it must give primacy to protecting the public from gambling harms. My party has also called for the remote gaming duty to be doubled, and I urge the Government to look carefully at that proposal.

It is evident that urgent action is needed, and the regulations are an important step forward. Therefore, the Liberal Democrats support them.