Cyber-attack: Microsoft

Iain Duncan Smith Excerpts

Tuesday 20th July 2021 Commons Chamber

[Sir Iain Duncan Smith (Chingford and Woodford Green) (Con)]

(Urgent Question): To ask the Secretary of State for Foreign, Commonwealth and Development Affairs if he will make a statement on the reported Chinese state-sponsored cyber-attack on Microsoft exchange servers.

[The Minister for the Middle East and North Africa (James Cleverly)]

I thank my right hon. Friend for asking this important and timely question. Yesterday, on 19 July, the UK Government joined like-minded partners to confirm that Chinese state-backed actors were responsible for gaining access to computer networks around the world via Microsoft exchange servers. As the Foreign Secretary made clear in a statement yesterday, this cyber-attack by Chinese state-backed groups was reckless, but sadly a familiar pattern of behaviour. The Chinese Government must end this systematic cyber-sabotage and can expect to be held to account if they do not.

The attack was highly likely intended to enable large-scale espionage, including acquiring personally identifiable information and intellectual property. At the time of the attack, the UK quickly provided advice and recommended actions to those affected. Microsoft has reported that, at the end of March, 92% of customers had installed the updates that protected against the vulnerability.

As part of that announcement, the UK also attributed the Chinese Ministry of State Security as being behind activity known by cyber-security experts as APT40 and APT31. Widespread, credible evidence demonstrates that sustained irresponsible cyber activity emanating from China continues. The Chinese Government have ignored repeated calls to end their reckless campaign, instead allowing their state-backed actors to increase the scale of their attacks and act recklessly when caught.

Statements formally attributing Chinese responsibility for the Microsoft exchange attack and actions of APT40 and APT31 were issued by the EU, NATO, the UK, Canada, the US, Australia, New Zealand, Norway and Japan. That co-ordinated action by 39 countries sees the international community once again calling on the Chinese Government to take responsibility for their actions and respect the democratic institutions and personal commercial interests of those they seek to partner with. The UK is calling on China to reaffirm the commitment made to the UK in 2015 as part of the G20 not to conduct or support cyber-enabled theft of intellectual property or trade secrets.

[Sir Iain Duncan Smith]

I simply make the point that it is a surprise that it has taken you, Mr Speaker, to bring the Government to the Dispatch Box when they could have made a statement yesterday.

This is the latest form of Chinese attack—it is not a one-off—on the west, which has included espionage, economic sanctions against Australia, wolf warrior diplomacy and naval aggression in the South China sea to name but a few.

I have some questions for my right hon. Friend. Will he explain why the Government did not come to the House yesterday to make a statement? Given that this is an aggressive attack, why are the Government allowing the UK’s largest silicon chip manufacturer, Newport Wafer Fab, to be bought by a Chinese firm when they know very well what they are up to? Why is it that the US Justice Department, also with this, brought federal criminal charges against four named MSS officers over their role in the hacking of the American targets, yet no such charges have been brought against operatives here?

The integrated review said clearly that Russia was a threat to the UK, but China was merely a competitor. I wonder why, if China goes on attacking us and trashing us, we continue with this deceit when it is quite clear that China is a clear and present threat. Beyond tearing up the treaty, conducting a genocide and upsetting the international order, China has now been found to be conducting systematic attacks on targets in the UK. Will the Government now finally agree to a diplomatic boycott of the Beijing winter Olympics to make their statement clear?

On a personal note, you will know, Mr Speaker, that I set up, with others, the Inter-Parliamentary Alliance on China—politicians left and right in 20 countries who are concerned about China’s activities. There are over 200 members. I understand now that there is intelligence from Five Eyes sources that shows that a very active and direct threat from the Chinese Government is aimed directly at the co-chairs of the Inter-Parliamentary Alliance on China. Some of the co-chairs, of which I am one, have now been warned by their intelligence services in receipt of this that they should be very careful and that they will be supported. Can I ask my right hon. Friend to confirm whether his Government are in receipt of this same intelligence and, if so, why have they not informed the co-chairs and others here in the UK, as other allies have done?

Finally, Mr Speaker, China is not just a competitor. These attacks tell us that they are a clear and present threat to the United Kingdom and to our beliefs in freedom, justice, democracy and the rule of law and human rights. It is time that the Government stood up, made that clear and boycotted these Olympic games.

[James Cleverly]

I thank my right hon. Friend for the points that he has made. The unanimity of voice among the international partners—the 39 countries that I listed—is incredibly important to us, and we will continue to seek to work collaboratively with our international partners in our response to this. My right hon. Friend makes the point about Chinese investment, or Chinese purchasing—specifically Newport Wafer Fab—and that is a decision that the Government are looking to review. He asks about the differential language between China and Russia. Our response is based on the actions, and we will continue to react robustly to any and all cyber-attacks that occur. He will understand, I am sure, that I am not necessarily going to go into details here and now about what further measures we might take, because to do so might undermine their effectiveness, but we will continue to work with international partners; and, as I said in my answer to his question, the Chinese Government should expect to be held to account if they do not come back into compliance with norms of behaviour.

With regard the Olympics, my right hon. Friend the Foreign Secretary has said that we have not as yet made a decision on formal attendance at the Olympics. The attendance of athletes is ultimately a decision for the British Olympic authorities. On intelligence matters, my right hon. Friend the Member for Chingford and Woodford Green (Sir Iain Duncan Smith) will understand that we do not discuss intelligence-related issues on the Floor of the Chamber, but I take his point about making sure that people who are potentially the target of overseas intelligence actions are given the opportunity to defend themselves against them.