Cyber-attack: Microsoft

Lisa Nandy Excerpts

Tuesday 20th July 2021 Commons Chamber

[James Cleverly]

I thank my right hon. Friend for the points that he has made. The unanimity of voice among the international partners—the 39 countries that I listed—is incredibly important to us, and we will continue to seek to work collaboratively with our international partners in our response to this. My right hon. Friend makes the point about Chinese investment, or Chinese purchasing—specifically Newport Wafer Fab—and that is a decision that the Government are looking to review. He asks about the differential language between China and Russia. Our response is based on the actions, and we will continue to react robustly to any and all cyber-attacks that occur. He will understand, I am sure, that I am not necessarily going to go into details here and now about what further measures we might take, because to do so might undermine their effectiveness, but we will continue to work with international partners; and, as I said in my answer to his question, the Chinese Government should expect to be held to account if they do not come back into compliance with norms of behaviour.

With regard the Olympics, my right hon. Friend the Foreign Secretary has said that we have not as yet made a decision on formal attendance at the Olympics. The attendance of athletes is ultimately a decision for the British Olympic authorities. On intelligence matters, my right hon. Friend the Member for Chingford and Woodford Green (Sir Iain Duncan Smith) will understand that we do not discuss intelligence-related issues on the Floor of the Chamber, but I take his point about making sure that people who are potentially the target of overseas intelligence actions are given the opportunity to defend themselves against them.

[Lisa Nandy (Wigan) (Lab) [V]]

This is an unacceptable attack, costing businesses millions and raising the alarm for people across the country, who will be concerned that their personal information could be compromised. The Government confirmed yesterday that a quarter of a million servers were affected worldwide, but how many British businesses and organisations were victims of the attack and how many may still be vulnerable? What is the cost to British businesses of compromised data and were public bodies among those targeted? Can the Minister guarantee that hospitals, local authorities, universities and this Parliament have not and will not be compromised?

The Government have been repeatedly warned about this. A year after the Russian report was published, still no meaningful action has been taken. The Computer Misuse Act 1990 is now three decades old. It was written before smartphones, before Google—before the public could even use the web. When will the Government finally update it? The Minister says that this is a pattern of behaviour, and he is right, but Ministers have tried naming and shaming before. It did not work then, so why would it work now? Only weeks ago, President Xi said that those who expressed dissent about China’s actions would

“have their heads bashed bloody against the Great Wall Of Steel forged by over 1.4 billion Chinese people.”

Last year the Government were willing to act. They announced targeted sanctions against individuals involved in the Russian state-backed cyber-attack on the German Parliament. So why are there no sanctions in response to the Chinese state-backed cyber-attack on, among others, the Finnish Parliament?

The truth is that the Government are unable to send a clear, coherent message to Beijing because they are still arguing among themselves. Just two weeks ago, the Chancellor was telling Mansion House that it was time to realise the potential of our relationship with China. While the Foreign Secretary imposes sanctions, the Chancellor is cashing cheques. It is extraordinary that the Minister can stand at the Dispatch Box today and refuse to tell us how he will safeguard critical infrastructure, or whether he and his colleagues will board a plane to Beijing early next year to participate in a public relations exercise. The seriousness of this attack must concentrate minds. We need a coherent strategy. When are we likely to get one?

[James Cleverly]

In response to the specific questions that the hon. Lady raised, we estimate—we can only estimate—that 3,000 UK-based organisations were put at risk by this attack. It was an untargeted action. It was not targeted at specific sectors. We do not believe that Government organisations were a victim of it, and because it was an untargeted action it is not possible for me to give a credible assessment of the economic damage of this particular attack. The National Cyber Security Centre and Microsoft gave advice at the time and, as I say, by the end of March it was estimated that 92% of organisations had installed the patch to protect themselves. Advice is available to any organisation that still thinks it may be at risk in some way, both from the National Cyber Security Centre and from Microsoft.

With regard to our attendance at the winter Olympics, my right hon. Friend the Foreign Secretary answered that point in departmental questions. There is nothing more that I can add to that.

The hon. Lady asked about naming and shaming. The fact that 39 countries collectively put their name to the statement is unprecedented, and it sends a significant signal that countries are working together to steer China’s actions. China is a significant economic and political player. We cannot pretend that China does not exist. We want China to change its behaviour, and we will work with international partners to urge it to do so. As I say, we reserve the right to take further actions if necessary.