Draft Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) (Amendment) Regulations 2024

Chi Onwurah Excerpts

Tuesday 21st May 2024 General Committees

[Chi Onwurah (Newcastle upon Tyne Central) (Lab)]

It is a pleasure to serve under your chairship, Ms Rees, I believe for the first time. I thank the Minister for setting out the draft regulations.

Before I start, I must declare an interest. I worked in technology for two decades before entering Parliament, the last six years of which I spent with Ofcom as head of telecommunications technology, which included internet security. I am proud to have been the first Member of Parliament to mention the internet of things—connected devices—in this place, in 2011 during a Westminster Hall debate I secured on machine-to-machine communications, partially as a consequence of my experience in the tech and regulatory sectors.

Over the years I have regularly called for better security for consumers with regard to this important enabling technology. Indeed, the exponential growth that I predicted in the number of connected devices in our homes, on our wrists and on our roads has taken place, and with it the need for robust protections has grown. We on the Opposition Benches are glad that the Government finally took action in 2022 and are building on that with these latest draft regulations, which will take the next steps towards a bespoke cyber-security regime for vehicles. Automated vehicles have the potential to create a market worth £42 billion by 2035, create 38,000 new jobs, and improve road safety and connectivity for all road users, including pedestrians and cyclists. It is right that this highly exciting sector is supported to grow with targeted pro-innovation and pro-consumer regulation.

Members will be glad to hear that I do not intend to detain the Committee long, but I want to address some of the fundamental concerns with the legislation. Above all else, safety is paramount. During the passage of both the Product Security and Telecommunications Infrastructure Act 2022 and the Automated Vehicles Act 2024, which received Royal Assent this week, Labour was crystal clear that the first duty of any Government is to keep their citizens safe. Our cyber-security is a No. 1 priority, and Labour would never play fast and loose with it.

As such, we welcomed the security aspects of the PSTI Act, as well as Government concessions to put the highest standards of safety on the face of the Automated Vehicles Act. The Government’s “Connected and automated vehicles: process for assuring safety and security”, or CAVPASS, with which I am sure the Minister is familiar, is intended to provide Government assurance of the safety and cyber-security of self-driving vehicles by 2025—that is, at the end of this year. Is the Minister confident that the Government are on track to achieve that goal? What assurances can she give the public in the meantime—in the next six months or so, until CAVPASS bears fruit, if that is when it will bear fruit—that automotive products with connected capabilities are being sold secure?

Are the Government taking steps to address the national security implications of connected vehicles, which is an increasing concern for the public? In the debate on the 2023 regulations last September, I highlighted how cellular internet-of-things modules, or CIMs, power much of the consumer connected device landscape by enabling internet access. China is attempting to corner the global market in CIMs, which could have immense national security implications, since, for example, when they are embedded in cars, they transmit location, route and even passenger video. With Chinese firms such as BYD and Geely becoming major players in automotive manufacturing, is the Minister assured that the regulatory regime is strong and flexible enough to protect the British public as the technology adapts and evolves?

Lastly, I want to raise the need for ongoing dialogue in this space. It is right that the Government have communicated to businesses years in advance their intention for automotive vehicles to be exempted from the PSTI regime. I also appreciate the extensive work by organisations such as the Centre for Connected and Autonomous Vehicles and the Law Commission in preparing for the Automated Vehicles Act.

The explanatory memorandum to the draft regulations leaves open a few options for the Government to regulate further, such as mandating UN regulation No. 155 on cyber-security, as the European Union has already done for some vehicles from July 2022. Given that we export 600,000 cars a year, have the Government considered alignment with international partners on cyber-security—the Minister seemed to suggest that she had—through the UN and other fora, and the implications for trade and exports? Can the Minister explain what the Government are doing to keep businesses abreast of their plans? It is vital that businesses, particularly in our incredibly important automotive industry, which is undergoing so many changes, can plan ahead for the next generation of cars.

On that subject, it was disappointing that the Government did not accept any of Labour’s amendments during Committee stage of the Automated Vehicles Bill, which would, in particular, have established an advisory council to aid the Act’s implementation and strengthened the accessibility of automated vehicles for disabled people. Will the Minister commit to consult regularly with business and trade unions during the roll-out of the connected and automated vehicles security regime, and to embed accessibility in all the safety regulations from day one?

Innovation in road transport will create huge opportunities for our economy and society, and we must embrace them. But we must make sure that security and safety are built into these technologies from the outset. Labour and the British people will accept nothing less. I thank the Minister in advance for her answers to my questions.