Cyberattacks: EU Committee Report

Lord Harris of Haringey Excerpts

Thursday 14th October 2010 Lords Chamber

[Lord Harris of Haringey]

My Lords, it is an enormous pleasure to follow my noble friend Lord Reid of Cardowan and his maiden speech, in the course of which he paid a very graceful tribute to his successor as Member of Parliament. He told us that she had already attained the ripe old age of 25. I am informed that the noble Lord started his political career some considerable period earlier than 25. I am told, in fact, that he led his first strike at the age of about 14 and a half when he was still at school and was objecting to the practice of the fairly disciplinarian head teacher that the children should be kept outside, irrespective of the weather, until the school started. He called a strike of his fellow pupils on the basis that, if they were not allowed in until nine o’clock, they would not go in after nine o’clock. My understanding is that he was successful in that, which demonstrates a robustness and forceful nature, which we have seen in this afternoon’s speech. However, we have also seen the noble Lord’s other side—his erudite and thoughtful nature. I understand that it is that side that comes in particularly useful in his latter-day role as chairman of Celtic Football Club, where erudition and thoughtfulness are particularly important.

The noble Lord has had 10 years in very senior roles as a member of Her Majesty's Government. He was in the last Government what I think should be described as a “big beast”, with the emphasis on some occasions on the word “beast”. I worked closely with him in a number of those roles, in particular in his time at the Home Office. One of the achievements of that period is a lasting one: the creation of the Office for Security and Counter-Terrorism. This country will learn to realise how significant and important it has been, and that is down to my noble friend. His contribution today has demonstrated the qualities of robustness and erudition that we will all expect to hear much more of in the time ahead. We do indeed look forward to many further contributions of a similar nature.

I am grateful to the noble Lord, Lord Jopling, for his introduction of the report and his work, and the work of his colleagues, in pulling together the report which we have had. It is a very important Select Committee report, and I had the privilege of sitting in on a couple of the evidence sessions to hear the discussion. As the noble Lord pointed out, we are having quite a timely debate following the reported comments of the director of GCHQ in the past few days. He has talked about the significant level of attacks on government systems, many of them precisely and deliberately targeted at those systems. The debate is unfortunately not quite as timely as it might be in that we do not yet have the benefits of the results of the security and defence review or the comprehensive spending review. We will have to wait a few more days for those. However, I hope that that fact of timing will not prevent the Minister from providing us with some more information on how the Government’s thinking on these matters is developing.

I have high hopes for the noble Baroness, Lady Neville-Jones, because I am aware of her continued personal interest in matters of cybersecurity and information assurance. I have attended so many meetings over the past few years which she has been at, and which have discussed these matters, that I know that she takes these matters extremely seriously. That includes, for example, her chairing for a period the Information Assurance Advisory Council, which brought—and continues to bring—together industry, academia and government to talk about these matters. We have high expectations of the Minister in what is going to be done in this field over the months and years to come, and I am sure that she will not disappoint us today in her response to this debate.

It is important that we recognise several elements in the issues around cyberattacks and the matters which this report has covered. A few years ago, a lot of these matters were dismissed as the actions of teenage cyberjuvenile delinquents who were merely interested in getting into systems because they were there and, perhaps, in gaining some element of self-respect by leaving their mark on those systems, proving that they had been there—a sort of petty vandalism, expressed in the cyberworld as opposed to the physical world that other juvenile delinquents might be engaged in. Yet we have to recognise that those juvenile delinquents have grown up. Some have grown out of those issues, but others have started their own criminal enterprises; some have been bought up by much more organised and serious criminal enterprises; some have, no doubt, become fundamentalist in their religious views; others are being employed by nation states. We have to recognise the scale and effectiveness of the targeting that can now be done.

We therefore have not only the continued action and vandalism of the juvenile delinquents but the issues around cyberactivism, of people trying to make a political or other point by mass cyberaction. We have small-scale crime, but more significantly we have an enormous wave of organised crime using the techniques that are now possible through the internet. That is now having an effect. We also have otherwise respectable businesses making use of these criminal techniques to inform themselves of their competitors’ activities and, indeed, trying to obtain intellectual property. Then we have state-sponsored activity, some of it at the commercial end but some of it much more about creating the opportunity to attack other nation states if that is necessary. The noble Lord, Lord Jopling, has talked about what happened to Estonia, and numerous incidents are now reported of what are perceived as being—although this is not necessarily the case—attacks sponsored by one nation state against another in this sphere. We have yet to see a serous terrorist act perpetrated through these means, but it is only a matter of time before terrorists also make use of these techniques as an adjunct, as part or as the main focus of their attack.

We therefore have to examine the issues raised by this report in a number of ways. First, while they might not quite meet the definition that the noble Lord, Lord Jopling, gave of a cyberattack, the activities of serious and organised criminality in terms of fraud and all the things that it is trying to do are of such a scale that Governments—national, Europe-wide and worldwide—should be taking them seriously and acting on them.

Secondly, we have to look at the scale of what is happening in terms of corporate raiders, intellectual property theft and the potential for industrial disruption. Again, some of this is by organised crime, but my understanding is that a significant proportion of that is carried out by nation states or at their behest.

Thirdly, and this is particularly important in terms of the responsibilities of our Government and the Minister, there are issues around the attacks on, and the vulnerability of, our own critical national infrastructure. Some of those attacks on government systems are about espionage, but some of them are about creating the potential for disruption.

I have a number of questions or issues that I hope the Minister will be able to respond to. The first relates to the sheer volume of criminality and whether as a nation we are equipping ourselves to keep up with those who are trying to defraud our citizens or otherwise cause problems. There has been a history of law-enforcement initiatives taken in this field. The National Hi-Tech Crime Unit, which was very successful, appeared to disappear when its responsibilities were taken over by the Serious Organised Crime Agency, so much so that the police had to set up a new unit, the Police Central E-Crime Unit—I declare an interest as someone who has been closely involved in that, as a member of both the Metropolitan Police Authority and the ACPO board that oversees it—which has had a series of successes, like the arrests a few months ago of the five men and one woman engaged in stealing the details of more than 10,000 bank accounts and allegedly netting themselves more than £3 million as a consequence. That unit, working with the private sector and levering in resources from it, has been remarkably successful, but it is still new and fairly fragile.

I understand that there are rumours that this unit should be subsumed into the proposed new national crime agency. I have no objection to the new agency, once it is established, maybe taking on this responsibility; it must certainly have a capacity to deal with these matters. My concern is that if we move too quickly to that process, the idea of subsuming a body that is only just beginning to work into a new body that will be going through its own birthing pains is not necessarily sensible. We have had evidence from the outgoing chief executive of the Child Exploitation and Online Protection Centre about the fragility of those structures and the private sector funding of them. He suggested that Microsoft may propose to withdraw the resources that it puts into CEOP because of the uncertainty about its future. I hope that the Minister will give us some assurances today about the continued budget to enable the police to play their role in fighting e-crime, that we will not see the fragile new arrangements subsumed too early into a national crime agency and that there will at least be time for any national crime agency to be established, and to establish itself, before such a change takes place—if that is what happens.

The second issue was referred to by the noble Lord, Lord Jopling, when he talked about the so-called Stuxnet attacks on the control systems of the Iranian nuclear power programme. I have been concerned, as have several noble Lords and others, about the vulnerability of SCADA systems to attack. Is the noble Baroness personally satisfied that enough is being done at present to protect such control systems for our critical national infrastructure, against both the sort of electronic attack that the Stuxnet attack seems to have been and the electromagnetic pulse attacks that the noble Lord, Lord Reid, referred to? He made the valid point that exploding a nuclear device might be rather a visible way of producing an electromagnetic pulse. However, there are regular cycles of sunspot activity that could produce the same sort of effects. The issue of protection remains, whether it is an external attack, a natural event or something triggered electronically.

I would also like the noble Baroness to tell us whether enough is being done to protect the intellectual property of the United Kingdom against electronic attacks. In this context, is she satisfied that the major contractors that provide services to government departments are themselves adequately protected against this sort of penetration? I have heard stories about some of those major contractors being heavily penetrated in possibly state-sponsored incidents. If that is the case it is extremely serious. It is important that the noble Baroness should give us her assurance as to what can be done.

Finally, I hope the noble Baroness will give us, in the course of her remarks, a route map that tells us who is in charge of the various key elements of this matter. Who is in charge of setting the standards of security for our critical national infrastructure? Who is responsible for attributing where attacks are coming from? Who is responsible for managing resilience and recovery, should an attack take place? Who is responsible, if necessary, for retaliation or taking out those who are carrying out these attacks?

Policing

Lord Harris of Haringey Excerpts

Monday 26th July 2010 Lords Chamber

[Baroness Neville-Jones]

On the question of hire and fire, the noble Lord is right to say that those powers are contained in the proposed remit of the police and crime commissioner, who is himself potentially subject to recall. It is not the case that any police commissioner would be able to exercise his powers unreasonably or arbitrarily without himself thereby being called to account. The whole point of having him—I mean, these individuals; I hope that there will be some women, too—accountable to the local electorate is precisely so that unreasonable behaviour can be checked. I see no reason why an elected official in such a position should behave unreasonably any more than any other elected official.

I take note of what the noble Lord says about reserve powers, and will take that back to the Home Secretary.

[Lord Harris of Haringey]

I declare an interest as a member of the Metropolitan Police Authority, which I understand is to be abolished under these proposals. Could I ask about this brave new world of the police and crime commissioners? In parenthesis, calling somebody a crime commissioner implies that they commission crime, which seems a slightly strange thing for the Government to want to do. Given that the commissioners will apply to the forces that provide neighbourhood policing, which is essentially visible to local communities and for which there are already substantial arrangements for local dialogue with local communities, why are other areas of policing not to have the benefit—if benefit it be—of having their own police and crime commissioners? Why, for instance, is there no police and crime commissioner for the British Transport Police or the Civil Nuclear Constabulary or the Ministry of Defence Police—or, for that matter, the City of London Police? The Civil Nuclear Constabulary and the Ministry of Defence police are extremely heavily armed and the work they do raises important issues of public accountability. The City of London has its own slightly different means of democratic control from anywhere else. Why is there not that clarity? Could the Minister also tell the House about the accountability arrangements for the new national agency, given, again, that this will have very important but not essentially visible responsibilities for policing? These are precisely the areas in which strong, robust and transparent accountability mechanisms are necessary.

[Baroness Neville-Jones]

The noble Lord raised the question of other functions not covered by the police and crime commissioners and he is quite right to do so. The proposals make a distinction between those issues where we believe that local accountability is of the essence, in the area of neighbourhood and constabulary activity. Where we think that the functions have a much more national character—and certainly the police commissioners themselves must contribute to efficient national policing by collaboration—such as in counterterrorism, or in the powers that are going to be grouped under the National Crime Agency, different arrangements are needed. We will certainly have to put in place, subject to further consultation, the nature of the accountability arrangements that will be required. There will certainly be accountability arrangements but they have not yet been spelled out. Our purpose today is to make it clear that lying at the core of this is the need for accountability of local and neighbourhood policing.

On the British Transport Police, there is indeed a series of other protective policing powers and activities which are not covered by today’s proposal. We are looking at the rationality of present structures in that area with a view to seeing whether we cannot make them more efficient. Again, we will have to deal, in that instance also, with the question of accountability.

Terrorism Act 2000

Lord Harris of Haringey Excerpts

Thursday 8th July 2010 Lords Chamber

[Baroness Neville-Jones]

My Lords, I would not say that this situation is tidy; it is not tidy. I entirely accept that it is unfortunate that we get into a situation in which we have to give some interim guidance. The Government take no satisfaction in the present situation. I say to the noble and learned Lord that there are limits to what you can do in opposition. We made our position fairly clear on the desirability of the way in which these powers were drawn and their use at the time. We have always made clear our intention to look at this legislation with a view to amending it in the context of the review that we are undertaking of counterterrorism powers. What happened is that the judgment intercepted the work that we were in any case undertaking.

[Lord Harris of Haringey]

My Lords—

[Lord Goodlad]

My Lords—

[Earl Attlee]

My Lords, I think that we should hear from the noble Lord, Lord Harris, first.

[Lord Harris of Haringey]

My Lords, I declare an interest as the Home Office representative on the Metropolitan Police Authority with responsibility for oversight of counterterrorism and security. The Statement which the noble Baroness repeated is probably helpful in the context of the judgments that we have had. I think that there has always been a lack of clarity about whether, in the circumstances, the powers being used in a large number of stops should more properly have been those under Section 43 rather than those under Section 44. I assume that the noble Baroness has described in essence a series of non-statutory guidelines, and that the statute remains in force until such time as Parliament changes it. What is the Government’s view of the use of what were Section 44 powers for target-hardening—that is, the random stop of individuals near a particular location—and is that something that they wish to maintain? In that context, will she comment on the Government’s intentions in respect of the 2012 Olympics? And will the guidelines that she has announced today have an impact on the search regimes around, for example, this building, No. 10 Downing Street and airports?

Samantha Stobbart

Lord Harris of Haringey Excerpts

Wednesday 7th July 2010 Lords Chamber

[Baroness Neville-Jones]

My Lords, the Northumbria Police are receiving mutual aid. My right honourable friend the Home Secretary has been in touch with the force. If it needs any further assistance, it will certainly be given it. As for the noble Lord’s basic question of whether it is a good idea for forces to help each other, we as a party are in favour of forces joining together, or indeed merging if they wish, provided there is local support for such a move.

[Lord Harris of Haringey]

My Lords, while I am mindful of the points made by the noble Lord, Lord Stevens of Kirkwhelpington, given that there has been newspaper criticism of the efficiency of the Prison Service in issuing a warning and whatever response there may have been by Northumbria Police, what safety guarantees can the noble Baroness give on behalf of the coalition Government that in a few years’ time, with 25 per cent fewer prison officers and a 25 per cent reduction in police grant, which will no doubt impact disproportionately on specialist resources, this sort of event will not recur, or is the answer that Raoul Moat would not have been in prison at all because his sentence was only 18 weeks and, as far as the coalition is concerned, people like him should roam the country freely?

[Baroness Neville-Jones]

This individual was in for a short custodial sentence. Under the regime that prevails at the moment, half that sentence was served. As things stand, under legislation that was not passed by this Government, the governor has no discretion to do anything other than release the individual. He performed a duty in warning the police.

Immigration

Lord Harris of Haringey Excerpts

Thursday 3rd June 2010 Lords Chamber

[Baroness Neville-Jones]

My Lords, the individuals who returned voluntarily did so many months ago, before the hearing. That fact is relevant to the subsequent consideration of the individuals referred to in the Question. The fact that they returned and were not ill treated was one of the reasons for the Government considering that Nasser and Khan would not be ill treated on return. However, the court took the view that this was not sufficiently reliable in their case. The ability to return the two men can be revisited if circumstances change, and we are working on creating the circumstances in which that might be possible.

[Lord Harris of Haringey]

My Lords, does not the issue whether these two individuals should be deported raise a number of fundamental questions about the way in which national security is to be pursued? First, had intercept been available as evidence, would it have provided a different route for dealing with the individuals? Secondly, do the costs associated with the regime being put around the individuals represent the most efficient way of managing individuals who are considered a severe threat to the UK?

[Baroness Neville-Jones]

My Lords, those are very good questions. I shall not trespass on the hypothetical question of whether it would have been different had we had intercept as evidence. It is clearly a relevant issue, which is one of the reasons why we want to explore its availability. As for control orders, cost is clearly one element in considering what we need to do to keep the people of this country safe. The efficiency of the regime is also an element. We are considering precisely those issues in our review of control orders.