Football Governance Bill

James Sunderland Excerpts

2nd reading
Tuesday 23rd April 2024 Commons Chamber

[James Sunderland (Bracknell) (Con)]

It is a huge privilege to speak on the long-awaited Football Governance Bill. Not only is this a matter of great importance to sports fans across the UK and beyond; it is also a personal passion and I commend everybody that has been involved in getting the Bill this far. Locally in Berkshire we have a proud football pedigree. Reading FC is the only league club in Berkshire. It has a proud history and has done brilliantly this season to survive in league one against all the odds. In my constituency, Bracknell Town and Sandhurst Town have also enjoyed strong seasons, and across the border in Hampshire, Aldershot Town are back on the map after their most exciting season for years. Well done to Tommy Widdrington and his players. I was at the Dagenham game on Saturday, which was brilliant. It was a pity that Dagenham did not quite make the national league play-offs, but next season will be even better.

As the father of two young sons who play to a decent level, I know that better regulation of the game is essential to their future, and to the future of all our clubs. This is the beautiful game, and it does need better regulation to ensure that football always comes home. We know what the Bill does: it seeks to establish an independent football regulator, and includes provisions that seek

“to protect and promote the sustainability of English football”

for the benefit of fans and local communities. That is very important, but I say to the Minister that regulation must be light-touch. Given the pre-eminence of football in the UK, we must not throw the baby out with the bathwater by inadvertently making the Premier League, the English Football League or the national league less attractive to owners, potential investors, the media or the fans. As we know, the Premier League is also the world's leading football brand, and is worth billions to the UK. If it ain’t broke, please don’t fix it.

Regulation, then, must be just enough. It must be balanced to protect clubs and fans from rogue owners, but without jeopardising the game. Recent history is littered with examples where it has gone badly wrong: Southend United, Wigan, Portsmouth, Bury, Colchester, Sheffield Wednesday, Hull, Derby and several others, but most recently and perhaps most spectacularly of all, Reading. For a fan such as me, the last few years have been galling. We have seen freefall from the premier league, 18 points of deductions, huge fines, players not being paid, bills not being settled and fans in despair, and I feel their pain. Let me put this on the record: I personally commend every single Reading fan. They have been magnificent, and they have supported the club through thick and thin. I should also mention the brilliant Sell Before We Dai group, which has been so instrumental in this regard.

Does lobbying work? Absolutely yes, and I give credit to Members as well—my right hon. Friends the Members for Reading West (Sir Alok Sharma) and for Ashford (Damian Green), my right hon. and learned Friend the Member for North East Hertfordshire (Sir Oliver Heald) and, in particular, the hon. Member for Reading East (Matt Rodda), with whom I have worked very closely in connection with Reading football club. Members have leant in, in respect of Reading and many other clubs. Pressure has been brought to bear on owners, and a cross-party approach really does work: politics is always at its best when MPs work together. As for the question of a pilot for the new regulator, I cannot think of a better example than Reading. The new regulator must cut his or her teeth on that particular club—and the Bill itself must have teeth, because a regulator without powers is of no use whatsoever. Let me say to the Minister that I look forward to seeing the terms of reference for the initial incumbent.

The aim of the Bill is to put fans back at the heart of the game. It is about running clubs and putting them back on their feet, and about heritage and future direction. As we have heard, it is also about sustainability, and about ensuring that we lay the foundations for clubs as we go forward in English football. It must apply across the whole pyramid, and not just to the top five leagues. It is right that new owners and directors will face stronger tests to stop clubs falling into the wrong hands, and will face the possibility of being removed and struck off from owning football clubs if they are found to be unsuitable—and much more; but the devil will be in the detail.

As for Reading football club, I have learnt several lessons this year. First, fans do matter and fan power does work. Fans have a voice, and they have used their voice this year and before in relation to Reading FC. Secondly, Reading Borough Council’s decision to list the Select Car Leasing stadium as an asset of community value under the Localism Act 2011 was a masterstroke. Dai Yongge is unable to sell the stadium, and rightly so. Lastly, I give full credit to Wokingham Borough Council for a little deed for the Bearwood Park training centre. If a club cannot legally sell its assets to another club, that club lives on. Once again, these measures have effectively stopped further asset stripping by Dai Yongge, and will lead to the successful future of Reading FC. Reading is now moving in the right direction. Bills are being paid for March, April and May; new owners are believed to be interested in the club, and we could yet survive. I thank everyone at Reading FC, and all the fans, for making this happen.

So what is not in the Bill? First, punitive action for owners who fail the test. I say to the Minister that they need not just to be banned from football but to be banned, full stop. They need to be banned from being directors, or banned by HMRC. The Bill does not address welfare provision for players. What are clubs doing to soften the blow for players who get rejected or suffer mental health issues? The Bill affects the top five leagues only; it needs to affect national leagues south, north and below because they are all worthy. The women’s game has been mentioned, but I feel strongly that the Bill needs to go further on the women’s game in due course.

Lastly, the FA cup decision on replays being stopped from round one is outrageous. It is nothing less than cultural vandalism of the world’s greatest cup competition. If the larger clubs have to play replays with the huge resources they have got, so what? I have no sympathy whatsoever. Having watched so many FA cup exploits over the years, not least at Sutton United and Woking, I do not buy the FA’s logic. These cup ties are the stuff of legends. Magic does exist in sports. Admittedly, no Government can regulate this, but if FA officials are watching, I urge them to rethink that appalling decision.

[Dame Tracey Crouch]

There is a larger point about FA cup replays. Those lucrative replays are once in a lifetime opportunities, but the fact that there are clubs that are relying on those lucrative replays demonstrates why we have a problem with finances in the football pyramid. Although my hon. Friend says that the Government cannot regulate on the matter, the Bill gives the Secretary of State some amazing powers to bring the FA cup into conversations. Does my hon. Friend agree that while it is not something that I particularly favour, it is something that can be done?

[James Sunderland]

I agree wholeheartedly. Anything that we can do in terms of the regulation is worth pursuing. I was at the Aldershot-West Brom game earlier this year, which was an incredible day out. That could have been a third round replay. The money raised from such occasions is extraordinary. While clubs cannot depend upon that lifeline, it is a fantastic bonus when it happens. Certainly, it helped Aldershot massively with its finances this year.

To conclude, I strongly support the Bill. I commend the DCMS, the Minister, the authors of the Bill and my fantastic hon. Friend the Member for Chatham and Aylesford (Dame Tracey Crouch). The Bill is long overdue, but it is here now. I am also reassured that the Conservative Government have done this. It will make a huge difference to all clubs and fans—let’s bring it on.

Telegraph Media Group: Proposed Sale to RedBird IMI

James Sunderland Excerpts

Tuesday 30th January 2024 Commons Chamber

[Julia Lopez]

Perhaps not.

[James Sunderland (Bracknell) (Con)]

I am sure that many Members are, like me, concerned about foreign ownership of our institutions and businesses. Our national resilience, strategic independence and critical infrastructure, as well as our media, are vital. To quote the well-known album, how do we ensure that we do not end up selling England by the pound?

[Julia Lopez]

As I have said in answers to similar questions, we have powers to look into some of those investment and ownership questions, and they do not relate just to the media. We now have much broader national security and investment powers in relation to questions such as these and to other areas in which there is a critical national interest in the ownership of a particular asset. It would be wrong for Members to leave the Chamber with the belief that there are no such powers and that all these acquisitions can go ahead regardless of security and other implications.

BBC Funding

James Sunderland Excerpts

Thursday 7th December 2023 Commons Chamber

[Lucy Frazer]

I do not accept anything that the right hon. Gentleman has just said. The purpose of the review is to ensure that the BBC can continue to provide its exceptional and outstanding service for decades to come. If we just sit on our hands and do nothing, it will be overtaken by other media outlets that are competing in the world. We need to ensure that the BBC has a sustainable financial platform from which to provide its outstanding service.

[James Sunderland (Bracknell) (Con)]

I have always loved the BBC. As a kid growing up and since, I have been blown away by the quality of its broadcasting; by its sport, music, culture, radio, nature, news and, of course, humour—even though I feel we have lost something with this endless thirst for political correctness. However, I have been increasingly concerned in recent months by the political bias creeping in, notably with individual commentary from presenters, through tweets and with inaccuracies in reporting. The BBC is a public service broadcaster; it is not a political organisation. So does the Secretary of State agree that the BBC has much more to do here to fully justify its publicly funded licence fee?

[Lucy Frazer]

The heart of my hon. Friend’s question is about the BBC’s impartiality. I know that the BBC strives hard to maintain impartiality, with its 10-point plan, but at its heart the BBC needs to provide an impartial service, because if it does not do so, it should not be getting licence fee payers’ money and it is just the same as every other organisation. That is why it needs to continue to strive, as I know it does, to ensure that it provides impartial output.

BBC Licence Fee Non-Payment (Decriminalisation for Over-75s) Bill

James Sunderland Excerpts

2nd reading
Friday 20th October 2023 Commons Chamber

[Sir John Whittingdale]

I will take advantage of the hon. Gentleman’s intervention to make two points. First, he will be aware—and it is a cast-iron principle—that the Government do not interfere in the editorial decisions of the BBC. It is not for Government to tell the BBC what they can and cannot broadcast, but that does not mean that the Government do not have views.

Secondly, I will take this opportunity to say from the Dispatch Box that the Government are very disappointed at the attitude taken by the BBC to the coverage of events in Israel and Gaza. The BBC’s refusal to describe this as a terrorist act is something the Government profoundly disagree with. My right hon. Friend the Secretary of State, while reiterating that we do not tell the BBC what to do, has made it clear that the Government’s view is that the BBC should describe it as what it is: terrorism. The suggestion that, in doing so, the BBC would somehow be in breach of the Ofcom broadcasting code is clearly not the case. Ofcom has made it clear that it is an editorial matter for the BBC. There are plenty of previous examples where the BBC has called terrorism “terrorism”, and our view remains that it should do so in this case.

[James Sunderland (Bracknell) (Con)]

rose—

[Andrew Bridgen]

rose—

[Sir John Whittingdale]

I will give way to my hon. Friend the Member for Bracknell (James Sunderland), who has not yet had a chance to speak.

[James Sunderland]

Given that the Government are effectively choosing to enforce the licence fee in law by not decriminalising over-75s, does the Minister agree that the BBC has an equivalent duty to raise its own standards of impartiality and to justify the licence fee?

[Sir John Whittingdale]

I agree with my hon. Friend. The issue of impartiality is central to the BBC’s reputation, and it is in the top line of the public purposes of the BBC contained in the charter. It is a matter that the Government have kept under review. When the charter was set back in 2017, it was agreed that there should be a mid-term review of its delivery by the BBC and, in particular, the governance arrangements, which include impartiality. We have since had a number of internal BBC reviews. In particular, there was the review conducted by the senior independent board member, Nick Serota, which agreed to strengthening the impartiality requirements.

However, the Government have considered what more could and needs to be done. In the next few weeks we will also publish the outcome of the mid-term review, which will look at this point. My hon. Friend the Member for Bracknell is completely right that the BBC’s reputation for impartiality is paramount, in justifying the need to pay the licence fee and in protecting its reputation, and not just in this country but around the world. We will say more about that in due course.

For the reasons I have described, I do think that in future the licence fee will become harder to maintain and that we now need to start thinking about the alternatives. That is linked to the way in which people receive television. There will probably come a time when television is delivered exclusively via the internet. That will first require everybody to have access to ultrafast broadband in order to receive it—that is another of my present responsibilities—and the technology will need to develop a little more, but we already have internet protocol television becoming more widely spread. Of course, once we get to that moment, subscription becomes viable. We cannot currently have subscription services on Freeview, but we can on the internet, which is why an awful lot of people who have access to that choose to subscribe to Netflix, Disney, Amazon and the rest.

These issues will therefore become more important and more possible as we move towards that future, but we have not got there yet. However, the Government have started to think about those options through the future funding review. Therefore, while I am afraid that we are not in a position to support the Bill, my hon. Friend the Member for Christchurch does touch on extremely relevant points where we think more thought will need to be given in time. I thank him for giving us the opportunity to debate the matter today.

Oral Answers to Questions

James Sunderland Excerpts

Thursday 26th May 2022 Commons Chamber

[Jerome Mayhew (Broadland) (Con)]

4. What assessment she has made of the Serious Fraud Office’s ability to tackle serious economic crime in 2022-23.

[James Sunderland (Bracknell) (Con)]

6. What assessment she has made of the Serious Fraud Office’s ability to tackle serious economic crime in 2022-23.

[The Solicitor General (Alex Chalk)]

In the past five years, the Serious Fraud Office has secured reparations for criminal behaviour from organisations it has investigated totalling over £1.3 billion. That sum is over and above the cost of running the SFO itself. In addition to recent convictions leading to fines and confiscation orders totalling more than £100 million, just this week Glencore Energy has indicated that it intends to plead guilty to seven bribery counts brought by the SFO in relation to its oil operations in Africa.

[The Solicitor General]

My hon. Friend is absolutely right. We cannot have a situation where, just because the fraud is complex, it is beyond the reach of the law. That is why I am pleased that this year the SFO is taking forward seven prosecutions involving 20 defendants on a total of 80 counts, comprising alleged fraud valued at over £500 million. The alleged frauds include investment fraud, fraudulent trading and money laundering.

[James Sunderland]

The Solicitor General will be aware that the Serious Fraud Office has recently suffered a series of humiliating defeats in the courts and received heavy criticism from judges, not least in the ENRC case last week, in which the High Court criticised a former SFO director for

“gross and deliberate breach of duty”.

Given that the taxpayer now faces a significant bill, will my hon. and learned Friend ensure that the report commissioned from Sir David Calvert-Smith is published in full so that this House can consider his recommendations?

[The Solicitor General]

My hon. Friend has raised two points: ENRC and the Sir David Calvert-Smith review. Those are, of course, separate matters, because the Unaoil matter is distinct. In respect of ENRC’s civil case against the SFO, it is important to note that the judge found against ENRC on the overwhelming majority of its allegations against the SFO. My hon. Friend is correct about the review being led by Sir David Calvert-Smith, which is focusing on the findings of the Court of Appeal in the Unaoil case. The Attorney General has committed to publishing the findings of the review, and I am happy to restate that commitment today.

Telecommunications (Security) Bill

James Sunderland Excerpts

Report stage & 3rd reading
Tuesday 25th May 2021 Commons Chamber

[Mr Deputy Speaker (Mr Nigel Evans)]

We heard you loud and clear, Colonel Bob.

[James Sunderland (Bracknell) (Con)]

It is a great pleasure to follow my eminent right hon. Friend the Member for Beckenham (Bob Stewart)—if only I were as good.

As the final Back-Bench speaker this afternoon, it is incumbent on me to be supportive of the Government, which of course I am, and this excellent Bill. We are where we are today for two reasons. First, it shows that the Government do listen to Back Benchers. Secondly, the Bill is a pretty good bit of work and it ticks the box, as indeed it should. As defence and national security become ever more virtual and online, it has never been more important to secure our lines of communication, both domestically and internationally, with our allies. I urge all Members to consider the notion of strategic independence, which we have spoken a lot about during the covid crisis. As we go forward, it is really important that we aspire to be able to operate autonomously as a global nation alongside our allies.

I believe that the Bill is important for three reasons. First, it will allow for better security both domestically and internationally. It kicks out the high-risk vendors from our network—what’s not to like? Secondly, it placates our allies. New Zealand, Australia, the USA, Canada and others were quite noisy when Huawei was originally admitted to our network, so let us hope that this will placate them, cement that relationship and, perhaps in time, even enable us to admit Japan and other close allies. Thirdly, it opens the door for other 5G providers to come in, which is a good thing, and I support the UK’s diversification strategy.

Having sat on the Committee for this excellent Bill, it is a pleasure to see it back here on Report. The Bill takes forward the Government’s commitment to the UK telecoms supply chain review, introduces a new security framework, amends the Communications Act 2003, introduces new security duties, brings new powers to the Secretary of State and strengthens Ofcom’s regulatory powers, allowing it to enforce the new framework. That is all very positive. It also introduces new national security powers for the Government to impose, monitor and enforce controls. Again, that is a positive step.

I am pretty happy with the Bill as it stands, but in the interests of objectivity, I will talk to a number of the new clauses and amendments. On new clause 1, the Government are aware that the Bill gives Ofcom significant new responsibilities, and it will need to increase its resources and skills to meet those new demands. Ofcom’s budget is approved by its independent board, and the Minister has today confirmed that the budget limit set by the Government will be adjusted to allow Ofcom to carry out new functions effectively. Ofcom is already engaged in this space—we are already proactively looking over the horizon and scanning for future threats—so I am happy that the Government have got this about right.

New clause 2 would ensure that the Intelligence and Security Committee of Parliament is provided with information relating to a designated vendor direction. I am sympathetic to this, but the Government know what they are doing. As the Minister said, the ISC’s primary focus is to oversee the work of the security and intelligence agencies. Its remit is clearly defined in the Justice and Security Act 2013, so the Bill is not the appropriate place to achieve an overall enhanced role for the ISC.

[Dr Julian Lewis]

I am sorry to have to reiterate this point. There are other ways in which our concerns could be addressed, such as by adjusting our memorandum of understanding, rather than putting it on the face of the Bill, so I am with my hon. Friend as far as that is concerned. However, it is very clearly within our remit to oversee not only the agencies but those parts of other Departments where highly classified information is concerned. That is just a matter of fact—it is in the agreement between us and the Prime Minister.

[James Sunderland]

I empathise with my right hon. Friend’s view, and I agree that he has a point. My position is the same as the Government’s: I do not think that this Bill is necessarily the vehicle through which we should look at the future of how the ISC operates. I am a keen follower of the ISC and its output. Its work is eminent, and my right hon. Friend’s point is well made.

[Sir John Hayes]

Let me cement that point but also perhaps offer an olive branch to the Minister, if I might be so bold. If the Minister, when he sums up, were to make a firm and binding commitment that he, for example, and others will appear before the ISC at our request to be scrutinised on these and other matters, that might go some way—not the whole way, but some way—to assuaging doubts and fears.

[James Sunderland]

I thank my right hon. Friend for his intervention. Again, I empathise with the point. I will happily leave it to the Minister to make his view known in his summing-up later.

Covid-19: Cultural and Entertainment Sectors

James Sunderland Excerpts

Tuesday 2nd March 2021 Commons Chamber

[James Sunderland (Bracknell) (Con)]

This is a super opportunity to represent the people of Bracknell as we recover from covid. Some headlines, if I may: the £500 million film and TV production restart scheme; one year of business rates holiday worth over £10 billion plus temporary reduction of VAT; 200 independent cinemas across England being supported with £16 million of grants; Sport England announces £220 million of emergency funding for grassroots clubs. The list goes on. But we can, of course, do better. I really welcome the news from the Prime Minister that the road map will allow outdoor sports to resume from 29 March; the light at the end of the tunnel is almost with us, and that is very welcome, but I urge the Government to consider pushing this date to the left wherever possible.

Bracknell is blessed with some stunning golf courses of the highest quality, and it has been a real source of frustration to my constituents to see their sport lumped in with others. It is an outdoor sport and we can separate very easily, so let us get the courses open quickly, please. The same applies to grassroots sports, to tennis and to gymnasiums. Let us get our leisure activities up and running.

Elite football has kept many of us sane for the last few months, myself included. However, those not in the upper echelons of the elite have struggled immensely and are on their last legs. Without big-money television deals, non-league football relies on ticket sales to be viable. A year down the line, clubs have are still being asked to wait until 17 May before getting the fans back into their stadiums. That is just too late. These clubs also need grants, not loans. It is essential that these lifeblood clubs are properly supported right across the community.

As for entertainment in the round, it is imperative that our pubs and restaurants are opened quickly, as well as cinemas, theatres and the wedding industry. The live music sector contributed £4.5 billion to the economy in 2019, supporting 210,000 jobs and providing £1.6 billion in VAT receipts. The sector is too valuable to stay closed. Let us please get it open. Why not an extension of the 5% VAT rate for ticket sales? Why not a Government-backed insurance scheme, giving the industry the confidence to book shows? Why not an extension of business rates relief beyond April 2021?

The UK has a really proud motorsports industry that is essential for jobs and livelihoods, and is one of our best exports. Aside from the flagship Formula 1 series, it is imperative that the UK gets its round of the world rally championship back to our shores. May I please commend having a round of the rally in Northern Ireland in 2022? The infrastructure in place. The political benefits are absolute: the Union; protocols; Stormont; reconciliation; legacy. Let us please get it done. DCMS, please find some money.

Telecommunications (Security) Bill (Fifth sitting)

James Sunderland Excerpts

Committee stage & Committee Debate: 5th sitting: House of Commons
Thursday 21st January 2021 Public Bill Committees

The memorandum of understanding is between the Committee and the Prime Minister, as section 2(5) explains. It also explains that the MOU can be altered at any time. Therefore, all that is required is the Government’s activity in relation to defence and intelligence matters to be added to the list in the memorandum of understanding. There is a mechanism there—it already exists—to allow the ISC to look at that.

[James Sunderland (Bracknell) (Con)]

Given that most MPs do not fully understand what the ISC does, does the right hon. Gentleman not agree that the Government are probably best placed to make the decision on this particular matter?

[Mr Jones]

No, I do not. I know the hon. Gentleman is a new Member, and I actually quite like him, but what is he arguing for? A dictatorship? That the Executive should decide everything? Knowing you, Mr Hollobone, you would take a very dim view of that. You have form on holding the Executive to account—all Governments.

The ISC is there to look at information and provide parliamentary scrutiny. As for the nature of the information we receive, we have all the clearances from top secret going up to STRAP, including STRAP 3, which is intelligence that has a limited circulation and people have to be added to the list. We have access to that as well, which allows us to consider that information.

Our annual reports, which we supply to Parliament, can be debated by Parliament. We can produce reports. For example, most recently, there was the Russia report, which highlighted what the Government had not done rather than what it should have been doing. The contention from the Cabinet Office is that if information goes to the ISC, it is in the public domain. That is a little bit insulting. We do public reports, which have information that can be put into the public domain, but there are always secret annexes that go to the Prime Minister and are not made public, which allow us to question decisions and highlight issues that we think the Prime Minister should take notice of. It is a valuable mechanism for scrutiny.

The argument that will come from the Cabinet Office is that DCMS is not covered. It is. The memorandum of understanding says:

“The ISC is the only committee of Parliament that has regular access to protectively marked information that is sensitive for national security reasons: this means that only the ISC is in a position to scrutinise effectively the work of the Agencies and of those parts of”

the Government

“whose work is directly concerned with intelligence and security matters.”

I accept that DCMS’s day-to-day work is not covered in the description of national security, whether or not this is an issue of concern to individuals. I think it is. There could be an argument as to why the Department for Digital, Culture, Media and Sport got this legislation and whether it should perhaps be put in another Department. I do not agree with that, because I think the general issue of telecoms fits well into the Department’s wider briefs.

Increasingly, a number of Departments are getting involved in, or taking responsibility for, areas that involve national security. BEIS and the National Security and Investment Bill is a good example.

--- Later in debate ---

[James Sunderland]

Given that the Bill mandates that vendors could be fined up to 10% of annual turnover or £100,000 a day for violating the terms of their obligations, does the hon. Lady agree that a full audit of all goods and services supplied could be quite draconian and onerous?

Telecommunications (Security) Bill (Sixth sitting)

James Sunderland Excerpts

Committee stage & Committee Debate: 6th sitting: House of Commons
Thursday 21st January 2021 Public Bill Committees

[Mr Jones]

I do not disagree with my hon. Friend. That is why we need to get into the idea of the audit. As I said earlier, we basically need a level playing field for operators; we do not want one to have an advantage over another. We also need a clear picture of what we are asking in terms of the audit. On the point she makes regarding web services and the cloud, there is an issue there that I think is worth referring to. It links today’s Bill with the National Security and Investment Bill, which we were discussing yesterday. There was a lot of discussion around what we define as critical—a point she has already raised.

For yesterday’s Bill, the question was what is critical to national infrastructure—for example, a company that is developing software that is then acquired by a state that we deem is a security risk to us. If that equipment or software is being used in our telecommunications network, does that mean that the network is compromised, and how do we guard against that? There are provisions in the National Security and Investment Bill that enable the Government to stop the acquisition of companies that we consider vital to our national security, but unless we know that in advance, how will we make that decision?

If we have a situation where a small company is providing software for part of our critical national infrastructure for telecoms, how will that be joined up? How will we be able to use the provisions in the National Security and Investment Bill, so that the Business Secretary can block the sale? Likewise, how do we get that connection? We can do that only by the Minister and Ofcom having a very clear indication from day one—I do not think it will be possible from day one, but from some time into it—what is in our network, not just now, but into the future. That will be important.

That brings us to the role of Ofcom. We have seen a development of regulators in this country. I am not a great fan of regulators, because I think it is a way for Ministers to palm off their responsibilities to third parties and then stand back and saying, “If it all goes wrong, it is nothing to do with me, guv—it is these independent organisations.” A long time ago—perhaps it is a bit old-fashioned—the General Post Office used to be responsible for this type of thing, and I am currently reading the excellent new history of GCHQ that has come out, which I recommend to everyone. It is fascinating to read about some of the challenges—things that apply to this Bill—such as, in the first world war, what was conceived as national security and who was responsible for it. Was it the GPO, the military or someone else?

How will Ofcom be able to look at a network and say, “Yes, we are satisfied that there is nothing in there that is a matter of national security”? They do not know. I do not think for one minute that we are going to have a situation whereby this Government or any future Government will suddenly throw so much money at Ofcom that a huge army of inspectors will be climbing up poles and going into operators’ offices to check source codes and so on. That is not going to happen.

From a practical point of view, the operators will have to be responsible for providing that information to Ofcom. Whether it is in the Bill or in the guidance, it must be clear what is expected of operators. It is no good looking back in hindsight and saying, “We should have done that,” when something happens. The operators will just say, “You did not tell us we had to do that,” or, “We didn’t know about that.” It has to be very clear, to prevent a competitive advantage between different companies, that there is one standard. They also have to know what we are asking for. Then, taking the telecoms hat off and putting the national security hat on, from the Government’s point of view, that needs to be very clear as well, because we need to be reassured that the components and software in those networks, now and in the future, are not a national security risk.

That brings us to an issue that I have already raised. I am not someone who thinks that every time we go to bed at night, we should look under the bed to see whether the Chinese are there, unlike some members of the China Research Group, but there is an issue about the way in which China will look at supply chains as a way of getting access, for two reasons. The first is national security. The second is commercial reasons—dominating the market, which is what China has done with Huawei. How will we identify that, without having some type of audit process? I do not think that everything to do with China is bad, but a huge number of the components in all our mobile phones in our pockets today will have come from China, including Ericsson and Nokia hardware.

[James Sunderland (Bracknell) (Con)]

I am enjoying the right hon. Gentleman’s logic. He talks a lot of sense, which is great. I am really intrigued by his insistence that the Government place these obligations on the National Cyber Security Centre and Ofcom. In my humble view, and knowing how those organisations work, it is likely to be the case that the Joint Forces Intelligence Group, GCHQ or the National Cyber Security Centre inform Government where there have been transgressions of security and breaches. I am intrigued by the counter-logic with where I think we need to be.

--- Later in debate ---

[Matt Warman]

The amendment would add to the general duty in clause 5 that places on Ofcom the duty to ensure that providers comply with their security duties. The duty as written in the Bill makes clear Ofcom’s increasing role. The duties imposed on public telecoms providers in the Bill are legally binding, so as the Bill is written providers should not be taking decisions that would prevent them from complying with those duties in the future. If they were not to comply, they would be in breach of their legal duties and liable for enforcement action, including the imposition of the significant penalties set out in the Bill.

The underlying purpose of the amendment—that Ofcom should take a proactive role in regulating the regime—is already core to what is in the Bill and the Government absolutely agree with the principle that the hon. Member for City of Chester set out. We need to ensure that Ofcom has the tools to be forward-looking so that, in a world of fast-changing technologies and threats, it can understand where operators are taking their networks and how that will affect their security. That is an absolutely essential part of the Bill.

[James Sunderland]

Does the Minister agree that the Bill in its current form is prescriptive enough already?

[Matt Warman]

I think the Bill is perfectly drafted down to every comma and punctuation mark. To be slightly more serious, what we have sought to do in the drafting is to strike the balance between proportionate regulations and the overarching requirements for national security. That is the balance that we have struck and it is exactly for that reason that we already do in the Bill what the hon. Member for City of Chester and the shadow Minister seek with the amendment.

In section 135 of the Communications Act 2003, as amended by clause 12, Ofcom is already allowed to require information from providers about the future development of networks and services that could have an impact on the security of the network or service they are providing. That would enable Ofcom, for instance, to assess the security risks arising from the deployment of a new technology or from the proposed deployment of a new technology. For those reasons, I hope that the hon. Members are reassured not just that the Bill does what they seek, but that previous drafts of the Communications Act already did so.

Telecommunications (Security) Bill (Third sitting)

James Sunderland Excerpts

Committee Debate: 3rd sitting: House of Commons
Tuesday 19th January 2021 Public Bill Committees

[Mr Jones]

Q Can I ask for your thoughts about Ofcom being the regulator of security? Has it got the capacity or culture to ensure the security of the network, particularly in light of the ISC’s 2013 report on critical national infrastructure? That suggested that civil servants did not even tell Ministers about security threats. Would it not be better to place security with an agency that is responsible for security, rather than with a regulator that has a wide range of responsibilities?

Professor Webb: I think that has already been mooted. I doubt Ofcom has that capability at the moment. In principle, it could acquire it and hire people who have that expertise, but the need for secrecy in many of these areas is always going to mean that we are better off with one centre of excellence, where the threats are analysed, assessed and understood. We have that, of course, in NCSC.

NCSC would advise Ofcom, perhaps at a high level. Perhaps they would not need to detail exactly what the issue was, but they could talk to Ofcom about the mitigation, and Ofcom could be the entity that performs the proportionality of understanding whether a threat needs to be addressed and to what extent, in the midst of all the other things. That is how I would arrange these organisations.

Emily Taylor: Thank you for this question, which goes to both the capabilities and the culture. With the capabilities, as I have said in earlier remarks, Ofcom is going to need to upskill. In reality, as Professor Webb has said, they are going to be reliant on expert advice from NCSC, at least in the medium term, until there is a significant transfer of skills and technology, and in terms of the need for secrecy and a broader view.

Ofcom’s historical role has been much less interventionist than is foreseen in this piece of legislation. Those cultural changes go deep into the organisation and into the character of the people who work there. Cultural change is always difficult and takes time, so I would not underestimate the challenge.

[James Sunderland (Bracknell) (Con)]

Q This is a very explicit question to finish with, but could I ask both of you whether, from a security perspective, you agree with the decision to kick out high-risk vendors from the network? If so, why?

[The Chair]

You have about 30 seconds each, I am afraid.

Emily Taylor: I think it was inevitable after the US sanctions on semiconductor chips. It is something I regret, because the more difficult part is what we had being trying to do for 17 years, which is to treat all the networks as potentially vulnerable and adopt an evidence-based approach.

I do not think there is a going back from there. Unfortunately, the effect of the US sanctions has not just been on our domestic market. It will have hardened the resolve of China to have an entirely indigenous supply chain, and therefore will hasten exactly the outcomes that it is intended to avoid. We need a much more positive approach, investing in innovation and research, matching the capability and advocating for the benefits for a single, open and free internet.

Professor Webb: I do not have strong views. I think it depends, but clearly if it is high risk then it is probably appropriate to exclude them. The worry I have is that you end up focusing predominantly on vendors that you think are high risk, rather than on the overall security challenge, which will be across all vendors.

--- Later in debate ---

[Mr Jones]

Q I do not disagree with you about the balancing act between security and economic development, which will be important. This Bill leaves it with the Secretary of State for Digital, Culture, Media and Sport, who is not a natural fit for security, and there will clearly be tension between the two. Do you therefore think that these key decisions—not the actual work on them—should not be vested with the Secretary of State, but should perhaps have the sign-off of the Cabinet and the NSC?

Dr Drew: I would agree with you. I believe that the decision needs to be taken on a security level first, because insecurity and the risk of a poorly made decision would have negative impacts on the economic outputs as well. I am not certain that where it is currently vested in this Bill is the best place for it, but I also believe that transparency is the other balancing component here. I have had some conversations with one of the companies mentioned quite predominantly in this literature, and their biggest press is that they feel that decisions are being made with a lack of transparency and a lack of technical justification, and that it is all politics. The best way to solve that is through transparency.

[James Sunderland]

Q Dr Drew, as a graduate of King’s College, it is great to have you with us. The Bill as currently written provides the Government with unprecedented new security powers. Might this in some way perhaps disincentivise new entries to the market?

Dr Drew: It potentially could, depending on the type of company that you are attempting to incentivise. It would have a different effect on those potentially two or more categories. If you take one category to be pre-existing companies that previously have not operated within the UK, such as NEC from Japan, they are likely not to be put off to such a great extent—they have already had to deal with some level of security commitment within their normal markets. However, I suggest that it could be more of a barrier to entry for the smaller companies that we are attempting to encourage to get into this market. Emerging companies would find a culture of components and cultural risk to how they view their work, as well as the technical and financial cost of meeting the new standards. Yes, I believe there would be an impact, but it would be different between types of vendors that you are seeking to encourage.

[Chi Onwurah]

Q We have talked a lot about 5G—indeed, we have been accused of fetishising 5G. The Government are currently consulting on security issues and fixed networks. Do you see major architectural differences or market differences in the security threats for fixed networks? Are they similar, and should a similar approach be taken to the removal of high-risk vendors? With regards to Ofcom, its principal duties are set out in the Communications Act 2003—I know this very well, having worked for it. They are

“to further the interests of citizens in relation to communications matters; and to further the interests of consumers in relevant markets, where appropriate by promoting competition.”

Do you think there is an argument to add a further security duty, if that is going to take such a large portion of Ofcom’s capacity?

Dr Drew: As to the second question first, I believe that security should be a component here. In fact, I believe it fits with what Ofcom is likely to be responsible for, and with the Online Harms White Paper as well. Security is fundamentally and inexorably linked with technology, culture and communications in the modern sense, so I believe that it would be important for that to be included as a key provision for DCMS.

With regard to the differences between fixed networks and 5G and the implications of this Bill, in the efficacy of its methodology towards the other, there are technical differences in how 5G operates right now and how we perceive the next generation of telecommunications to operate, but those differences will change over time, I believe. They will become less distinct. It is likely that fixed networks will move towards the concept of computing on the edge, and this is indeed already happening in some senses.

As for the actual efforts to control security risk, I do not see any major differences between telecommunications suppliers and fixed network suppliers. There is the same potential risk. You mentioned the SolarWinds hack earlier. That was a fixed network supplier in a way—it was not telecommunications—but there was the same risk involved and the same means of access, through a diversified chain with limited oversight at Government level, because it is a private sector actor with limited responsibilities. That is as true in that case as it would be for a fixed network with Cisco, and as it would be with a telecoms provider by ZTE, Huawei, Ericsson or any other. I do not think there is a significant technical difference to mean that the goals and direction of this Bill could not, and perhaps should not, be applied to others.

--- Later in debate ---

[Chi Onwurah]

Q With regard to asset registry and expectations of having that, having spent a significant amount of time looking in the back offices of operators as to what they have, I know that they are certainly not up to date. We have heard from other witnesses that they do not always have up-to-date and comprehensive asset registers. To rely on an expectation seems a low bar.

Can I come on to duties? I have the Communications Act here, which has got a lot thicker since I left Ofcom. The two duties are the “interests of citizens” and the “interests of consumers” with regard to competition, but there is not a duty on security. Does that not suggest that if there is a conflict between competition or communication matters, that will be prioritised over security if there is not an explicit duty to maintain the security of our networks?

Lindsey Fussell: I think this legislation quite clearly does place explicit duties on us to monitor and enforce the compliance of operators on network security requirements. I do not see that there is any risk that we would downplay the importance of that duty in comparison with others. Clearly, it is for the Government to put forward any changes to legislation to change the balance of our duties or to add new ones, but I think the Government—and, indeed, Parliament—are asking us very clearly to take on those responsibilities through this new legislation.

To pick up on a point I made earlier, in terms of the interests of citizens and consumers, it is important to say that of course it is in the interest of citizens and consumers to have excellent networks functioning that provide them with great connectivity. If we have learned anything from this most recent period, it is how important connectivity is to everybody’s daily life. Of course, that comes across in pricing and support for more vulnerable consumers, and all those other things that we have responsibility for in telecoms.

Actually, promoting secure networks is absolutely in the interests of consumers and citizens as well, not just because of the really damaging consequences of cyber-attacks, but because, ultimately, if we are able to have better networks, that should enable greater economic innovation through 5G use cases and things like that, for example. I think in promoting the interests of citizens and consumers, telecoms security is clearly part of that.

[James Sunderland]

Q The Bill provides powers to fine vendors up to 10% of their annual turnover or up to £100,000 per day for failing to meet standards. Could I ask for your view, please, on how that compares internationally, and whether you feel that that is appropriate?

Lindsey Fussell: It is probably worth saying that, from an international perspective, although there are some other countries—notably Germany and Australia—that have started to explore strengthening their telecoms security framework, I am not aware of another country that is quite as forward leaning in terms of the framework that is being put forward in this legislation.

In terms of the fines, this is an important point—those fines match the level that we are currently able to levy in relation to our other telecoms requirements, such as breaches of our general conditions. Previously, under our past responsibilities, our fines were limited to £2 million, so really quite a small amount compared with the wealth of the largest operators. I think it is appropriate that the telecoms security fines match what we are able to do elsewhere.

The final point I would make is that fining is an incredibly useful power to have because it acts as a significant deterrent and a strong incentive for companies to comply. It is actually not the first lever that we reach for, certainly not maximum fines; it is there and we are ready to use it if we need to, but our starting point would be to work with operators on this journey as they move towards compliance as they respond to new and emerging threats.

[Matt Warman]

Q Thank you for all the work you have done on this matter so far. I wonder if you could just say a little bit more about the responsibilities that Ofcom has had, as you put it, since 2011 on telecoms security. I think that perhaps the extent of that is not as well understood as it could be.

Lindsey Fussell: Yes, of course, I am very happy to do that. As you say, we have responsibility now to monitor and enforce compliance on security. The difference, which is why I think this legislation is so welcome, is that at present we do not have any obligations set out as to how operators need to meet those security requirements. It has been basically up to them to decide what is necessary. While many companies have invested very heavily in their security—I would not want to suggest otherwise—clearly there is a journey to go on and improvements that need to be made. It is very welcome that we now have this much clearer framework, so that operators know what they need to do and we can enforce against it.

The other point that is worth bringing out is that, at present, operators are under a requirement to report incidents to us, but the nature of that reporting tends to be around incidents that cause outages. We do get a lot of those—caused not just by cyber-security but by wind, weather and other issues. Quite a lot of cyber-security incidents are, frankly, precisely designed not to cause outages, because it is in the interests of the malicious actor to allow the network to keep operating while they do whatever they are up to. The new requirements on operators are to tell us not just if there is an outage but if there is an incident where they believe their system may have been compromised. They are wider ranging and welcome powers.