Luke Myer

“My part of the world has already had a hard lesson in what a serious cyber-attack can do, and I thank the Liberal Democrat spokesperson, the hon. Member for Harpenden and Berkhamsted (Victoria Collins), for mentioning it. In 2020, Redcar and Cleveland council was hit by a cyber-attack that has been attributed to the Russian Conti syndicate, and around 135,000 residents were left without online public services. Systems were disrupted, and the cost was put at more than £10 million. That is a story that has been repeated across our public and private sectors, and we have heard other examples today—my hon. Friend the Member for Leeds Central and Headingley (Alex Sobel) spoke about the NHS, and my hon. Friend the Member for Warwick and Leamington (Matt Western) spoke about manufacturers such as JLR. I echo their calls in the amendments they have tabled today, particularly about the need for last-resort powers in relation to data centres, but also for a national conversation about these issues. I have had discussions with constituents who are sceptical that the Russian state might attack a little council like ours, and it is important to get across the point that it is precisely because ours was low-hanging fruit that it was such a target for Russia. That is exactly why this Bill is needed. Since the NIS regulations were introduced in 2018, the threat has changed; we are more interconnected and more reliant on cloud services, managed IT providers and data centres than ever before, often across long and complex supply chains. As such, it is very welcome that this Bill gives Ofcom a clearer role and brings significant data centre services into the regulatory framework, as well as relevant managed service providers and critical suppliers. The new reporting regime is a practical improvement as well—a 24-hour initial notification and a fuller report within 72 hours will help regulators and the National Cyber Security Centre to spot patterns, warn others and build a better national picture, which is especially important when we consider hostile states. Cyber-security is plainly now a frontline part of our national defence—we have seen how Russian military intelligence activity is targeting Government and critical infrastructure, and we need to be equipped to respond. I am sympathetic to new clause 3, which relates to the role of foreign state bodies, but it ought to be broadened beyond critical and essential services. I will give an example that concerns the security of British citizens’ data from foreign Governments. Right now, the largest leveraged buy-out in history is under way—the takeover of global videogames maker Electronic Arts by Saudi Arabia and Jared Kushner’s Affinity Partners. They are buying access to the sensitive personal and behavioural data of 700 million players worldwide, as well as the ability to expand foreign influence in Britain. I urge the Government—both DSIT and the Department for Culture, Media and Sport—and the CMA to look at this deal with their eyes wide open. Ministers should be prepared to stand up for UK data, UK jobs and UK security. The Chair of the Science, Innovation and Technology Committee, my hon. Friend the Member for Newcastle upon Tyne Central and West (Dame Chi Onwurah), mentioned interconnectedness between data security and national security. I endorse her amendments dealing with internet-of-things modules and the potential threat of hostile states switching off various pieces of infrastructure around our country. I also urge Ministers to keep pushing further on the threat of hostile state disinformation on social media, which has also been referenced in this debate. That is a fundamental security issue. Russia and others do not only try to knock systems offline; they also try to rot public trust, spread falsehoods and undermine democracy, so the technical threat and the information threat are part of the same hostile playbook. I do wonder whether regulators have sufficient resources to act, and I will listen carefully to the Minister’s remarks on new clause 7. Ultimately, this Bill does not solve every problem, but it is a serious and necessary step forward. It strengthens resilience, widens responsibility, improves reporting, and gives Government clearer powers where national security is at risk. As such, I support the Bill.”