Cyber-attack: Microsoft

Lindsay Hoyle Excerpts

Tuesday 20th July 2021 Commons Chamber

[James Cleverly]

In response to the specific questions that the hon. Lady raised, we estimate—we can only estimate—that 3,000 UK-based organisations were put at risk by this attack. It was an untargeted action. It was not targeted at specific sectors. We do not believe that Government organisations were a victim of it, and because it was an untargeted action it is not possible for me to give a credible assessment of the economic damage of this particular attack. The National Cyber Security Centre and Microsoft gave advice at the time and, as I say, by the end of March it was estimated that 92% of organisations had installed the patch to protect themselves. Advice is available to any organisation that still thinks it may be at risk in some way, both from the National Cyber Security Centre and from Microsoft.

With regard to our attendance at the winter Olympics, my right hon. Friend the Foreign Secretary answered that point in departmental questions. There is nothing more that I can add to that.

The hon. Lady asked about naming and shaming. The fact that 39 countries collectively put their name to the statement is unprecedented, and it sends a significant signal that countries are working together to steer China’s actions. China is a significant economic and political player. We cannot pretend that China does not exist. We want China to change its behaviour, and we will work with international partners to urge it to do so. As I say, we reserve the right to take further actions if necessary.

[Mr Speaker]

I call the Chair of the Intelligence and Security Committee, Dr Julian Lewis.

[Dr Julian Lewis (New Forest East) (Con)]

As the ISC’s inquiry into China is still current, I shall limit myself to asking why the Government generally describe the communist Chinese system as authoritarian rather than totalitarian, what the Minister’s understanding is of the difference between the two, and whether the Chinese regime took any steps to close down the hacking group APT10, which was denounced in a similarly forceful statement by the then Foreign Secretary, my right hon. Friend the Member for South West Surrey (Jeremy Hunt), and our allies in December 2018.

[James Cleverly]

I understand the point that my right hon. Friend makes about the use of language. I am not in a position to have a debate on that specific point, but I make the broader point that the UK Government’s actions, and indeed the actions of our friends and allies around the world, are based on actions whether they be from Russia, China or wherever else, rather than on the narrow definition that may be found in international documents.

The reason that we put out this joint statement and attributed responsibility to state-backed Chinese actors is to let the Chinese Government know, to an extent, that we can tell what they are up to and we will not accept it. That is why taking actions in concert with our international partners is so important and will always be the foundation stone of whatever else we choose to do in response to the behaviour, if it does not change.

[Mr Speaker]

I call the SNP spokesperson, Alyn Smith.

[Alyn Smith (Stirling) (SNP)]

I warmly congratulate the right hon. Member for Chingford and Woodford Green (Sir Iain Duncan Smith) on raising this vital issue, and echo his concern about the fact that this was an urgent question rather than a statement made proactively by a representative of the Government.

I was glad to hear a Minister say that China can expect to be held to account for this truly breathtaking attack, which facilitated a range of attacks on private and public organisations on a broad scale by other actors. I applaud the statement that there will be sanctions—there will be measures—but I would like to hear what they are, because a somewhat homeopathic approach to date does not seem to have had much of an impact on stopping anything.

May I suggest that it is the UK Government’s breathtaking lack of policy coherence that is giving mixed signals to Beijing? I can give a fairly concrete example. China General Nuclear Power Group remains a significant stakeholder in the Hinkley Point C nuclear power plant, but the UK is pushing for another deal at Sizewell which will involve an even bigger Chinese state holding. May I also suggest that ending policy incoherence starts at home, and we should really see about that?

--- Later in debate ---

[James Cleverly]

I was not privy to the discussion about the statement, urgent question or otherwise. Yesterday’s statement was made by and in conjunction with international partners. I can assure my hon. Friend that I do not need to be dragged to the Dispatch Box to be questioned by colleagues and Opposition Members on this incredibly important issue.

[Mr Speaker]

Just to say—when statements are not forthcoming, I will continue to give UQs.

[Mr Tanmanjeet Singh Dhesi (Slough) (Lab)]

In March, the former head of the National Cyber Security Centre said that the Government have been confused in their approach to China. After the failed policies of the so-called golden era, the subsequent persecution of Uyghur Muslims in Xinjiang, the persecution of Buddhists and other minorities, the suppression of democracy and free speech in Hong Kong, the military aggression against its neighbours and now this state-sponsored cyber-attack on Microsoft Exchange servers, when will the Government finally lay out a consistent approach to dealing with China?

--- Later in debate ---

[James Cleverly]

The right hon. Lady is absolutely right that a comprehensive approach to cyber-security is incredibly important. As I say, the UK is proud of the fact that we are a global leader in cyber-security. The publication of the document she mentions, and others, will come in due course. I am not able to give her a precise date at the Dispatch Box at the moment.

[Mr Speaker]

Let me just say to all Members who have participated that my call list says that some were to be virtual and some physical, but nobody seems to be what I am being told on this list. A lot of effort goes into creating it—a lot of staff time—and staff need to know where Members are. If you intend to be physical, please let us know very early, and if you are going to go virtual, please also let us know. Do not let me have to start spotting who is here around the Chamber and who is not.