Ben Spencer MP: speeches

Speeches

• 16 Jun 2026 · Cyber Security and Resilience (Network and Information Systems) Bill · Hansard source

  More

  I thank the hon. Gentleman for the knowledge and experience he brings to the background of that particular case. I entirely agree that it is incumbent on all parties across the House to strengthen our national security and to be clear-eyed about the threat of hostile state actors. I will continue to develop that point in my wind-up speech. The evidence is clear that we face an increasing threat from foreign state actors. We need to take action to recognise those risks and to prevent such attacks. Cyber-security should be at the forefront of our defences, and for that reason, His Majesty’s loyal Opposition have focused again on amending the Bill, particularly with new clauses 14 and 15. We table them in the hope that the Government will not squander another opportunity to act in this Bill. New clause 14 would require the Government to directly identify the threats we face, ending the prevarication we have seen in recent months by obliging the Secretary of State to establish and maintain by regulation a list of foreign powers presenting a significant cyber-security risk to the UK. The amendment would strengthen the link between intelligence agencies and policy enforcement, ensuring that decisions by the Secretary of State to deploy special national security direction powers are based on GCHQ’s verified risk assessments regarding hostile states and state-affiliated groups. It is not about reacting after an attack occurs, but creating a proactive framework to evaluate and mitigate threats, built directly into UK supply chains. That would ensure that the UK is better prepared to deal with cyber-threats and attacks from hostile state actors. With the risks continuing to grow, these decisions cannot remain at the political whim of a Government who are reluctant to act. Let us talk about the dragon in the room. In 2024, the National Cyber Security Centre confirmed that China state-affiliated actors were responsible for cyber-attacks on the UK’s Electoral Commission and Parliament in 2021 and 2022, yet this Government continue to refuse to recognise China as a threat to the UK. New clause 14 would compel the Government to recognise formally what is readily apparent to those on these Benches, to our security services and to the many Members across both Houses who have expressed urgent concern about the security risks that China and other foreign state actors pose to the United Kingdom. The new clause would force the Government to acknowledge that China is a threat. In view of this established and growing threat, our new clause 15 would compel the Secretary of State to review state-sponsored cyber-threats to the UK’s infrastructure, including the cyber-security risk to surrounding critical networks in the vicinity of the super-embassy site in the City of London. As I said in Committee, there is simply no point in granting the Secretary of State powers to issue directions on the basis of national security if the Government are not willing to be clear-eyed about the most critical national and cyber-security threats to this nation. The new clause also strikes an important balance between ensuring parliamentary scrutiny and recognising and protecting the sensitive nature of some of the material that may be unearthed, by making provision for such information to be sent to the Intelligence and Security Committee of Parliament. I am pleased that, having resisted calls to address this risk during previous stages of the Bill’s progress, the Government have now taken some action to address risks from foreign state actors. The publication last week of their National Security (State Threats) Bill comes in response to a sharp spike in state-backed intelligence operations, sabotage and proxy violence. Their own explanatory notes to that Bill state: “Threats to the UK from foreign states are persistent and take many forms, including espionage, foreign interference in the UK’s political system, sabotage, disinformation, cyber operations, and even assassinations. Collectively these are referred to by the Government as state threats.” However, the Bill itself does not once mention cyber-security, and contains no provision requiring assessment of the risks posed. It does not apply to states themselves, and therefore can only be complemented and strengthened by new clauses 14 and 15, which no responsible Government or Member of the House could vote against. Amendment 3, which would insert a provision headed “Exemption from disclosure: right to a fair trial”, was tabled by my right hon. Friend the Member for Chingford and Woodford Green (Sir Iain Duncan Smith). As a Member of Parliament whose constituency includes Runnymede, I am proud both to call him a friend and to work with him on, in particular, his fight for the rule of law and fair trials. The amendment would prevent the sharing of information with overseas authorities for the purpose of prosecuting crimes not committed in the UK, if the Secretary of State determined that the receiving country was one in which the right to a fair trial could not be guaranteed. It would address genuine human rights concerns, and would close a loophole in the Bill that currently fails to anticipate politically motivated requests from authoritarian states. It would help to block hostile state actors such as Russia, China and Iran from probing our systems to detect firmware back doors or vulnerabilities within, for instance, the UK’s utility networks, healthcare systems and data centres. It would also create a statutory duty for the Secretary of State to submit an annual report to Parliament justifying decisions on which foreign jurisdictions are trusted or barred from intelligence sharing. That alone would be invaluable, and would end the many fruitless hours of questions and debate in the Chamber initiated by Conservative Members seeking a clear answer from the Government on whether they see countries such as China as a threat—per my earlier remarks. I am therefore pleased, on behalf of His Majesty’s Opposition, to support my right hon. Friend’s amendment. Let me also pay tribute to the Chair of the Science, Innovation and Technology Committee, the hon. Member for Newcastle upon Tyne Central and West (Dame Chi Onwurah). I thank her for her comments, which were echoed by others, about the risk from the internet of things and cellular modules. That is an important area, and we need to get it right. I will conclude by addressing the amendments tabled by our Liberal Democrat colleagues regarding digital sovereignty and the impact that this approach could have on the UK. New clause 13 is the clearest demonstration to date that the Liberal Democrats do not understand the tech sector or global supply chains. Of course it is right to support British business, but it is not feasible or possible to achieve full sovereignty in a global market or supply chain. Rather, we should prioritise capacities and capabilities, and ensure that the UK has an indispensable role in global supply chains.

• 16 Jun 2026 · Cyber Security and Resilience (Network and Information Systems) Bill · Hansard source

  More

  Before I begin, I would also like to make some remarks in commemoration of the 10th anniversary of the murder of Jo Cox. I never met Jo Cox. I never knew Jo Cox, and I am very sad that I did not, because having seen the impact she has had on our politics, on this place and on the people who knew her, she was clearly an incredible person. I do not think anyone can disagree with what she stood for, and in particular, that we have more in common in our politics. Our politics is worse off without her. Yet again, we return to this Government’s vacant vacillation regarding our national security. I urge the Minister again to take this opportunity to strengthen UK cyber-security from the threat posed by foreign state actors. Protecting the UK and its citizens is the primary responsibility of Government, but still, in the face of clear evidence of increasing threats, this Government fail to act. The risk of physical threats and the need to invest in defence are clear to all, yet the Government prioritise increasing welfare spending over the safety and security of armed forces personnel and our country. The situation is so serious that the Defence Secretary had to resign, as he could not defend the inaction of this Government or the risks they are taking. While the dangers presented to our cyber-security may be less visible, they are no less real. Hostile state actors are working every single hour of every single day to undermine our democracy and our security. These are risks that every Member across this House will be aware of. It is chilling to know that when Iran shut down its internet access, social media accounts purporting to be pro-independence Scottish people stopped tweeting. Expert analysis has estimated that thousands of similar accounts could originate in Iran and that as much as 26% of such accounts could be fake. Social media is now a weapon. We know that hostile state actors have sought to attack and undermine Parliament. Just last week we were told that spyware had been discovered in Government buildings linked to recent high-profile decisions regarding China’s controversial mega-embassy project in London.

• 1 Jun 2026 · Health Bill · Hansard source

  More

  It is a real pleasure to follow the hon. Member for Glasgow South West (Dr Ahmed). I did not agree with everything in his speech, but I know of his passion for NHS services and I am grateful for the work that he did as a Minister, particularly in helping me to advocate for my constituents, which I will come to in the main part of my speech. I should start with the standard declarations: I am a former NHS doctor and my wife is a current NHS doctor. There is a lot of good and very reasonable stuff in this Bill. I very much support the abolition of NHS England and I am glad that is being taken forward. The single care record makes complete sense. It is pretty crazy that we do not already have a national system in place. I think there will be some speed bumps in terms of administration, and the question I have is this: how is it going to encode sex data? What data is the record going to use as sex data, given the problems and the discussion that we had just before this debate? For me, the problem is about accountability. I have a local integrated care board. I also have NHS trusts, one of which is Surrey and Borders, which has been failing to deliver rapid, timely autism spectrum disorder and attention deficit hyperactivity disorder assessments for children. Frankly, that failure to provide a speedy assessment for ASD or ADHD locally is a disgrace. I have been putting pressure on my local trust to try to change that. My constituents expect me to do that. Some of my constituents expect me, as an MP, to be able to click my fingers to make this happen, but of course I cannot do that because this is the NHS trust, the chief executive and the ICB. I raised this issue in Parliament with the then Secretary of State, asking him to investigate my local mental health trust and look at the failings, and I am grateful that the then Minister, the hon. Member for Glasgow South West, responded to me and wrote to my ICB. The response I got was that this was within the ICB’s framework, and that what ICBs do is essentially up to them. My ability to go about changing this is therefore very limited. I get the point about clause 11 and the Secretary of State taking a few more powers to direct ICBs, but that is a very blunt tool. In reality, it will not be accountability. I cannot quite believe that it will work in such a way that, if I raise something in Parliament, a directive will force my ICB to deliver better for my patients. I cannot quite see that that will happen in reality—or perhaps I am wrong and it will. In that case, Parliament will essentially become a forum for MPs—all of whose constituents will expect them to be able to give directives to our NHS trusts and ICBs—to raise these issues so that the Secretary of State can take forward a directive. It would be far better if ICBs were directly accountable to local politicians. I heard the response that the plan is for ICBs to be accountable to mayors, but we do not have a mayor in Surrey and, even though many of us have been calling for a mayor, there is no timescale for getting one. ICBs need to be directly accountable to locally elected representatives in some way, shape or form, and the logical group is Members of Parliament, because that is what the public believe and expect. I hope that, as the Bill goes through, we will investigate the local accountability of ICBs in the NHS and that perception. One of the biggest dangers is the sense that we, as MPs, can deliver direct changes in day-to-day clinical commissioning, from which, of course, we have a degree of distance. I reiterate that, at the moment, the public perspective and public belief is that that is what we are empowered to do. We therefore have to be empowered to do that, or we have to have mechanisms to make it clear to people that local NHS care is not in the direct control of myself or anyone else here, apart from Ministers on the Front Bench. Patient groups are an important mechanism, but they are also important in terms of consultation. I worry about what will happen when ICBs consult on plans. What is the number? What is the survey? What is the metric? Who is appointing the ICB chair? Who is appointing the NHS foundation trust chair? Who is appointing the members of all these quangos? Where do democratically elected representatives sit in these appointment decisions? Given the time limit, I will finish on this point. Accountability is critical in getting this right. Care models need accountability. I have raised this matter in Parliament for many years now. I hope that we can use the Bill as an opportunity to give our constituents the accountability they need and deserve in the delivery of local health care.

• 21 May 2026 · Women’s Health and Wellbeing: Online Censorship · Hansard source

  More

  It is a pleasure to serve under your chairmanship, Mr Stringer. As we are discussing health, I should declare that I am a former NHS doctor and my wife is an NHS doctor. I thank the hon. Member for Milton Keynes Central (Emily Darlington) for her detailed and highly researched speech, as well as all other Members who have spoken. This has been a most concerning debate in relation to the systemic impact of health promotion, and it has thrown up bigger, more fundamental challenges that we, as a society, must start to grapple with. I will come to that later in my remarks. My first job in the psychiatric training scheme—and my first consultant job—was on a women’s ward in south-east London. That was one of the most amazing jobs I have ever done: looking after very poorly women and doing my bit to deal with complex physical health issues and to promote women’s health. I totally appreciate and agree about the importance of reducing what is—let us face it—ridiculous stigma and social taboo around women’s health issues, but I come at this as a doctor, so I have a particular perspective. Equally, I am mindful that my perspective—how I look at society—has changed during my 44 years. If someone had asked the Ben of 20 years ago, “Do you think we live in a society that is equal for men and women?” he would have said, “Yes, of course we do.” In the past 15 years, I have come to know that that is completely wrong, things are nowhere near where they should be and we still have a huge amount of work to do. Sadly, what we have heard in this debate, and the list of de-promoted words that the hon. Member for Milton Keynes Central handed to me, are further evidence of the challenges that we must tackle. She is 100% right to raise this topic, among others, and to call out what has been happening. But—and there is a “but”—this issue is not simply about access to information. This is not just a question of whether the information should or should not be accessible—in my view, it absolutely should be—or of how to determine the threshold between adult content and factual material. The debate also relates to decisions made by private companies to impose limits on what they permit or promote on their sites. That is the nub of the issue: should companies be allowed to make those decisions, or should it be the role of Government to regulate those choices or actions? To be clear, I do not believe that this debate is about the scope of the Online Safety Act, which does not restrict companies in the publication of factual health information. At no point does that Act says that information on breasts, vaginas, fertility, menstruation or menopause, or on any other body part, condition or medical term, should be restricted or classified as adult material. The way that that information or imagery is presented may indeed come within the scope of the Act, but its existence does not. Inappropriate adult content should not be accessible to children—that is right—but factual and educational material should not meet that criterion. It is also worth bearing in mind that, in some ways, this is not a new issue. I am sure that, just as people looked at information in anatomy textbooks for educational purposes before the internet, plenty of people looked at it for other purposes—but, again, that is not a matter for Parliament or the Online Safety Act. Under our current legal framework, private companies have the right to choose what information they permit on their websites. That is a commercial decision, and if we are not happy with such a decision—my very strong view is that we should not support the restriction of information relating to women’s health—we should call them out and persuade them to change their position. Algorithmic transparency is important, but it is also critical, given the evidence that we have heard in this debate, that companies are not able to hide behind the Online Safety Act. A bigger problem that we will have to tackle or process at some point is the status of social media in our society. Is it private or is it something bigger? Should it be regulated, like news outlets? That would be a huge change in our position, creating such regulatory burdens as to make the UK wholly uncompetitive in the market and having an extreme impact on people’s access to information. It would also be counterproductive, because it is nigh-on impossible to do. I look forward to hearing from the Minister, whom I welcome to his place. This is the first time I have had the pleasure of being opposite him at the Dispatch Box. I reiterate the Opposition’s strong support for what Members from both sides of the House have said about the importance of destigmatising these matters. I hate even using the word “destigmatise” because I worry that that is stigmatising in itself—it is ridiculous, in some ways, that we have to have this debate in the modern age, but we are where we are. We must ensure that everyone has access to sensible and appropriate information, without the biases that have been mentioned in the debate. Finally, as a former NHS mental health doctor, I point out that social media is not the only online source of health information. I signpost people who have questions to the NHS website, where there is plenty of stuff on all health areas—I looked it up on my phone during the debate. We do not have to rely on big-tech social media; we have plenty of services in which other information is available.

• 21 Apr 2026 · English Devolution and Community Empowerment Bill · Hansard source

  More

  The Minister will be aware that the election campaigns for the Surrey West and Surrey East unitaries are ongoing as a consequence of this legislation, but we still have not had an announcement on whether we will get a mayor for Surrey. That will be critical for protecting our green belt if the Conservatives do not retain power after the elections. Can she update the House on the importance of protecting our green belt and getting a mayor for Surrey who can do so?

• 19 Mar 2026 · Online Harms · Hansard source

  More

  I congratulate the hon. Member for St Neots and Mid Cambridgeshire (Ian Sollom) on securing this debate. As with so many debates over recent months, it has shown that online harms are a matter of paramount importance to Members on both sides of the House and in the other place. As was to be expected, every Member who spoke focused on online harms. I think only one Member, the hon. Member for Cowdenbeath and Kirkcaldy (Melanie Ward), spoke about some of the positives of the internet age. I would usually say that it has been a pleasure to listen to and take part in the debate, but it really has not been in this case, because it has been a pretty grim debate. We have had a tour de force discussion of all the horrors that young people and adults are exposed to on the internet, and we have heard about the importance for our society and country of tackling them. I am very proud of the steps that His Majesty’s official Opposition took in government to make the online environment a safer place, from bringing the Online Safety Act into force to the commendable and tenacious work of my noble Friends in the other place, especially Baroness Owen and Baroness Bertin, who are the staunchest of advocates for protections from digital forms of abuse for women and girls. Members will know that Baroness Owen secured important amendments to the Sexual Offences Act 2003 to criminalise the solicitation of sexually explicit deepfake images. Baroness Bertin’s report and campaigning has resulted in amendments being tabled to the Crime and Policing Bill concerning nudification apps. That is by no means the extent of their important work. The aim of the Conservatives’ Online Safety Act was to build an environment where adults could access legal content freely and where children enjoy greater protections. I welcome in particular the entry into force last year of Ofcom’s protection of children codes. I also welcome the enforcement action that Ofcom has already taken under the Act to tackle file-sharing sites disseminating child sexual abuse material and pornography sites that have failed to put in place highly effective age-assurance measures to prevent children from accessing content. However, we know that concerns regarding children’s social media use go well beyond content that is explicitly harmful and subject to restrictions under the Online Safety Act. As a result of addictive algorithms that drive excessive use and unhealthy patterns of behaviour, parents across the country are rightly concerned about their children’s social and emotional development. That is why we called for a social media ban for children under the age of 16. This month, the Government regrettably voted down amendments to the Children’s Wellbeing and Schools Bill, which were secured in the other place by my noble Friend Lord Nash, to bring such a ban into effect. In response to pressure from His Majesty’s loyal Opposition and other Members across the House, the Government have now launched their own consultation on measures to restrict access to social media for under 16s, alongside several other online safety matters. If the Government had accepted our amendment to the Data (Use and Access) Act 2025, such a review would be well under way by now, and we would be closer to a solution on this generationally important issue, but we are where we are. Consultation is no substitute for action, and I sincerely hope that the Government will deliver on the timescales set out for responding and bringing in measures after their consultation concludes in May. As with any rapidly evolving technology, social media and other online tools develop new apps and sites that pose novel threats and demand a response from Government and regulators. We have seen most recently in AI chatbots, some of which may fall outside the scope of the regulatory framework in promoting self-harm content to young people. A particular harm that I have raised with Ministers and Ofcom, of which there has been a disturbing increase, is the use of AI chatbots to obtain medical or other advice that should be sought from regulated professionals. The hon. Member for Winchester (Dr Chambers) mentioned that in his speech. Last year, the Medicines and Healthcare products Regulatory Agency established a national commission, which ran a call for evidence on the suitability of the UK’s framework for regulating AI in healthcare. The call for evidence closed last month, and I look forward to seeing the commission’s conclusions and the Government’s proposals for dealing with the risks that will no doubt be highlighted. A fundamentally important aspect of online harm that has attracted comparably less media attention and debating time in Parliament is the threat to democracy of online disinformation campaigns perpetrated by hostile state actors and their affiliates. The Science, Innovation and Technology Committee reported last year that online foreign interference and disinformation campaigns are putting UK citizens at risk. We also had credible reports last year of Iranian state-backed digital interference in the Scottish independence referendum. The risk posed by that type of activity is intensifying, as artificial intelligence tools provide the capability to generate deepfake content purporting to represent politicians or campaigns, amplified by foreign, hostile, state-controlled bot accounts. As people—particularly young people—increasingly obtain their news online, it is more important than ever that we consider the potential of digital watermarking tools that can be used to demonstrate the provenance and authenticity of content published on the internet. This danger is likely to increase as a result of geopolitical tensions. In their report on artificial intelligence and copyright, which was published yesterday, the Government recognised the risks posed by digital replicas and deepfakes in spreading convincing disinformation online, and committed to exploring options to address the growing problem. The Government also discussed the need to label AI-generated content to make disinformation easier for users to spot. Will the Minister provide timescales for that further work, and an update on the Government’s broader strategy on countering AI-generated democratic interference material? What role does Minister think digital watermarking tools will play in countering the proliferation and impact of deepfake videos and content?

• 24 Feb 2026 · Cyber Security and Resilience (Network and Information Systems) Bill (Seventh sitting) · Hansard source

  More

  New clause 16 would require active board oversight of security and resilience measures and accountability for board members where they fail in those oversight duties, whereas new clause 17 would require regulated entities to carry out proportionate, periodic testing of the security and resilience of their network and information systems, and provide the results to regulatory bodies upon request. On board accountability, as we have already discussed in this Committee, the existing regulatory model under NIS regulations has not been sufficiently effective in driving up cyber-resilience standards to meet emerging threats. Board engagement is a key part of that, but the stat I quoted previously in this Committee indicates that engagement is going in the wrong direction. What assessment has the Minister made of the potential advantages and disadvantages of direct accountability in the adoption of effective cyber-resilience measures, based on a roll-out of the NIS2 regulations? Proportionate testing of systems may be a useful tool in detecting and managing cyber-security risk. What consideration has the Minister’s Department given to how that topic should be approached in the Secretary of State’s code of practice?

• 24 Feb 2026 · Cyber Security and Resilience (Network and Information Systems) Bill (Seventh sitting) · Hansard source

  More

  I beg to move, That the clause be read a Second time. The National Audit Office’s 2025 report on cyber-resilience highlighted that Government Departments and agencies are among the weakest links in the UK’s cyber-security ecosystem and lack a credible plan to become cyber-resilient in the short to medium term. The Government play a key role in the management of certain critical national industries, but the continuing cyber-security vulnerabilities in the IT systems used to operate CNI expose the UK to the threat of serious attacks that could undermine national security and the economy. That is not to mention the risk to enormous amounts of highly sensitive data held on Government systems. Dr Sanjana Mehta of ISC2 said in her oral evidence that the Department for Work and Pensions administered £288 billion of benefits over the past year, with more than 23 million people claiming benefits of some kind. That activity involves processing vast amounts of personal, medical and financial data, which presents rich pickings for malicious actors. The feedback from industry stakeholders, many of whom are being asked by the Government to take on onerous security and reporting obligations under this Bill, echoes those concerns regarding Government cyber-immaturity. There is a strong sentiment that the Government should be leading by example, as Chris Anley of the NCC Group commented in the Committee’s oral evidence sessions. In view of the growing risk posed to UK cyber-security by hostile state actors, by their affiliates and by criminal gangs, improving Government cyber-security is urgent. It is clear from the NAO’s findings and other recent reports that Government Departments have lacked the clear goals and necessary accountability to incentivise tackling this significant challenge. In his letter of 19 February to members of the Committee, the Minister said: “Government will be held to equivalent cyber security requirements that we expect of the essential and digital services in scope of the Cyber Security and Resilience (Network and Information Systems) Bill.” But as matters stand, there are no effective legal mechanisms for accountability to Parliament on increasing Government cyber-resilience to the standards necessary to meet the intensifying threats facing our Government Departments and agencies. New clause 5 would compel the Secretary of State to make yearly reports to Parliament setting out the Government’s progress towards meeting the recommendations of the National Audit Office’s 2025 report on Government cyber-resilience and towards meeting the standards they set themselves in their recent cyber action plan. Where necessary, the Secretary of State would have to account for failures to meet deadlines for implementation and issue a new plan to achieve compliance. In moving this new clause, I am aware of the challenges that successive Governments have faced in driving up cyber-resilience standards. There are serious practical and budgetary obstacles that can impede progress, such as the vast amount of legacy IT equipment that remains in use, which is inherently more vulnerable to attack. Moreover, there is the ongoing problem of recruiting highly skilled cyber-security professionals to work in these roles, given the competition in the recruitment market and constraints on public sector salaries. Illustrative of that challenge is the worrying statistic, cited by Chris Anley of the NCC Group, that “almost a third of cyber-security posts in Government are presently unfilled”. –– [ Official Report, Cyber Security and Resilience (Network and Information Systems) Public Bill Committee, 3 February 2026; c. 24, Q29.] None the less, the Government have now put in place a plan that they consider achievable, and they should be held to account for it. The new clause creates a mechanism for that much-needed accountability.

• 24 Feb 2026 · Cyber Security and Resilience (Network and Information Systems) Bill (Seventh sitting) · Hansard source

  More

  I am grateful to the Minister for his response, but we have seen over the past six months, especially with the alleged spying incidents in Parliament, the Government’s resistance to recognising the Chinese Communist party as a threat. When it comes to our new clause 3 and concerns over transparency, we have also seen, in the last few weeks, that there are mechanisms—for example, the Intelligence and Security Committee—to ensure the disclosure of documents, while preserving national security. I would therefore like to press new clauses 2 and 3 to a vote. Question put, That the clause be read a Second time.

• 24 Feb 2026 · Cyber Security and Resilience (Network and Information Systems) Bill (Seventh sitting) · Hansard source

  More

  I will speak to new clause 19, tabled in my name on behalf of His Majesty’s official Opposition. The new clause would compel the Secretary of State, within 12 months of Royal Assent, to review the need for a statutory defence, encompassing legitimate cyber-research activities, to criminal offences under clause 1 of the Computer Misuse Act 1990, which is about unauthorised access to computer programs. The campaign for reform in this area, CyberUp, has argued that, in its current form, the CMA inadvertently criminalises critical activity such as vulnerability research and threat intelligence, both of which are essential for defending the nation’s digital systems. The new clause would also require the Secretary of State’s review to evaluate whether the creation of such a defence would enable regulated bodies to improve the resilience of their network and information systems via enhanced vulnerability testing and research. New clause 18, tabled by the hon. Member for Henley and Thame, relates to the same important topic and would require the Secretary of State to review, and report to Parliament within 12 months of the Bill’s entering into law, whether amending the Computer Misuse Act could improve the resilience of network and information systems. Hon. Members will recall the insightful oral evidence of Professor John Child of the University of Birmingham. Professor Child made a clear and compelling case for the need to amend the Computer Misuse Act to provide statutory defences for legitimate cyber-research—sometimes called ethical hacking activities. Likewise, campaign groups, industry specialists and parliamentarians have all argued that the Computer Misuse Act, which was written before the modern internet, is no longer fit for purpose. At present, the Act fails to distinguish between malicious attackers and cyber professionals acting in the public interest, inadvertently criminalising a large proportion of research that UK cyber-security professionals can carry out to protect UK critical infrastructure and the UK’s technological ecosystem. This means that cyber-security professionals working to defend UK organisations from real-world threats risk prosecution. That has created a chilling effect—talent is being lost, investment is stifled and security gaps are going unidentified. If we are to have true UK cyber-resilience—not just among regulated sectors, but across businesses of all types and throughout society—we need a multifaceted approach. Industry and private sector-led initiatives will play a strong role in that. Professor Child made clear that countries that have implemented more favourable regimes, such as the US and Israel, are benefiting from increased cyber-resilience as a result of cyber-research activity. The Government have acknowledged that reform of the CMA is a pressing issue. Indeed, the Home Office has been reviewing that question for some time. Further, the Minister for Security, the hon. Member for Barnsley North (Dan Jarvis), highlighted the urgent need for changes to the law in this area in a recent speech, stating that Government have “heard the criticisms about the Computer Misuse Act, and how it can leave many cyber security experts feeling constrained in the activity that they can undertake.” He went on to say: “These researchers play an important role in increasing the resilience of UK systems, and securing them from…vulnerabilities. We shouldn’t be shutting these people out, we should be welcoming them and their work.” Yet the Home Office has brought forward no specific proposals for reform. Parliament is unlikely to legislate again in the cyber-security domain for some considerable time; we cannot afford to kick the can down the road on this vital issue any longer if we are to have a credible plan for whole-of-society cyber-resilience.

• 24 Feb 2026 · Cyber Security and Resilience (Network and Information Systems) Bill (Seventh sitting) · Hansard source

  More

  On a point of order, Ms McVey. I seek your advice with reference to the debate on clause 43, on 10 February. I draw Members’ attention to my question to the Minister in Hansard about parliamentary scrutiny of directions: “Even where they are redacted because of national security concerns, somebody, or some mechanism of Parliament, will be able to scrutinise them. Can the Minister confirm that?” –– [ Official Report, Cyber Security and Resilience (Network and Information Systems) Public Bill Committee, 10 February 2026; c. 212.] The Minister responded: “Yes.” We received a letter over the recess dated 19 February—we are very grateful to the Minister for writing to us—which states something slightly different: “The Government’s default position is that copies of directions will be laid in Parliament, to enable all parliamentarians to scrutinise the Government’s use of…powers. Where this is not possible for national security reasons, alternative options for scrutiny could be used, such as allowing for directions to be read in private reading rooms or briefing individual shadow ministers. As such, we are confident that alternative options are available for scrutiny when directions cannot be laid in Parliament for national security reasons.” “Will” is different from “could” and “are available”. Given that we have moved beyond the debate on clause 43, what options are there for the Minister to either clarify those remarks or correct the record?

• 10 Feb 2026 · Cyber Security and Resilience (Network and Information Systems) Bill (Sixth sitting) · Hansard source

  More

  It is a pleasure to serve under your chairmanship, Mr Stringer. Clause 25 introduces a power for the Secretary of State to issue a statement of the Government’s strategic priorities in relation to the security and resilience of network and information systems with regard to essential activities. The statement will set out the responsibilities of regulators and specify objectives to secure the Government’s priorities. Competent authorities must be consulted in the drafting of the statement, and the Secretary of State must issue a report in every 12-month period on regulators’ compliance with meeting the objectives within it. The changes aim to address important challenges around consistency in the approach to regulation that were identified by the previous Government’s second post-implementation review of the NIS regulations. Importantly, the measures also provide for a regular review of competent authorities’ approach to discharging their regulatory obligations. That measure is necessary given the inconsistent approach to oversight and enforcement of the NIS regulations so far. We know that there are existing challenges relating to the capacity of competent authorities and there is the ongoing issue of securing sufficient cyber-security professionals to staff the teams. It is all well and good making statements, but they need to be followed. What strategies does the Minister anticipate will be needed and used to support—and, where necessary, drive up—standards of regulatory oversight when competent authorities fall short of the aims set out in the statement?

• 10 Feb 2026 · Cyber Security and Resilience (Network and Information Systems) Bill (Sixth sitting) · Hansard source

  More

  Clause 43 grants the Secretary of State powers to issue directions to regulate entities where there is a risk to national security, or where an action must be taken in the interests of national security. Directions can include requirements relating to the management of systems, the yielding of information and the removal or modification of goods and services. The Secretary of State may also require a regulated entity to engage the services of a skilled person to comply with directions issued. The Secretary of State has wide discretion to dispense with providing reasons for directions or consulting with the affected parties on the basis of national security considerations. Clause 44 clarifies that the Secretary of State’s directions under part 4 prevail if there is a conflict between those directions and another statutory requirement. The exercise of these powers by the Secretary of State could have far-reaching consequences for businesses, which may experience interruption to their commercial activities, as well as the potentially considerable time and expense in adhering to a request made on national security grounds. I have spoken on several occasions in the House and in this Committee about the critical risks posed to our cyber-security and national security by hostile state actors and their affiliates. It is, of course, right that the Secretary of State should have this power, but it should be used only in extremis. Like other extensive powers granted to the Secretary of State under part 3, it must be subject to oversight and guardrails. A report to Parliament, which may well be redacted, on the exercise of functions under part 4 will not be sufficient to ensure that this power is used proportionately. Has the Department considered introducing an obligation for the Secretary of State to report to the Intelligence and Security Committee when she exercises powers under part 4? We discussed the Chinese super-embassy earlier. Later in the Committee’s proceedings, I will talk about an Opposition new clause that would deal with that problem effectively.

• 10 Feb 2026 · Cyber Security and Resilience (Network and Information Systems) Bill (Sixth sitting) · Hansard source

  More

  Clause 36 provides that the Secretary of State may issue a code of practice for regulated entities to set out measures that they should take to demonstrate compliance with their duties under the NIS regulations, or any requirements imposed by the Secretary of State under clause 29. If done well, the code could be a repository of best practice, setting proportionate, consistent and effective standards for regulated industries. That will require constructive and open consultation with regulated sectors to identify the challenges facing those sectors and how best to address them. One issue that came up in oral evidence was the question of the lag between regulation making and industry adoption. David Cook of DLA Piper commented that, after laws come into effect, the process of businesses understanding where they need to get to “often requires a multi-year programme of reform.” ––[ Official Report, Cyber Security and Resilience (Network and Information Systems) Public Bill Committee , 3 February 2026; c. 5, Q1.] The code of practice is not envisaged to be legally binding, in the sense that a failure to comply is not of itself evidence of a failure to meet obligations under the NIS regulations or the Bill. However, clause 38 states that it would be admissible as evidence in legal proceedings so, in that sense, the code is binding in all but name. In view of that, and the fact that codes can be revoked and reissued, can the Minister provide reassurance to regulated industries that a lead-in time will be built into any requirements to allow businesses to prepare to achieve full compliance?

• 10 Feb 2026 · Cyber Security and Resilience (Network and Information Systems) Bill (Sixth sitting) · Hansard source

  More

  Clause 53 would grant the Secretary of State powers to issue directions to regulators where this is necessary for national security reasons, and to allow a reasonable period for the regulator to comply with that direction. Clause 54 provides that directions may be amended or revoked by the Secretary of State. Under clause 55, directions to regulated entities or regulators must be laid before Parliament unless that “would be contrary to the interests of national security.” I repeat my earlier question about the ISC’s role regarding scrutiny. Clause 56 would permit the Secretary of State and regulatory authorities to share any information obtained under part 4 with each other and the NCSC. The provision also allows for the sharing of information with other UK or overseas public authorities with equivalent cyber-security or national security functions. Government amendments 23 and 24 seek to amend that clause to provide for directions and notices issued under this part to be sent by email to relevant persons who provided those contact details to regulatory authorities. Some reassurance on the extent of information sharing for businesses is delivered through provisions specifying that disclosures of information should be limited to that which is relevant and proportionate. However, those are high-level and subjective terms, open to interpretation by the authority sharing the information. Can the Minister provide any update on the development of protocols between authorities to ensure that information shared is limited to that which is necessary for effective oversight and enforcement in relation to national security risks?

• 10 Feb 2026 · Cyber Security and Resilience (Network and Information Systems) Bill (Sixth sitting) · Hansard source

  More

  New clause 2 contains an obligation for the Secretary of State to establish and maintain by regulation a list of foreign powers presenting a significant cyber-security risk to the UK. The list must include states that have been confirmed by GCHQ as having perpetrated a cyber-attack, whether by a state department, agency or affiliate, on the UK in the preceding seven years. It must also include foreign powers that GCHQ has warned pose a risk to the security or resilience of the network or information systems of one or more operators of an essential service or critical suppliers. New clause 3 would compel the Secretary of State to review and report to Parliament on the risk to networks and information systems posed by foreign powers appearing on the register under new clause 2, with specific regard to activities undertaken from abroad and the risk posed by locations or premises controlled by those states in the United Kingdom. New clauses 13 and 15, in the name of the hon. Member for Henley and Thame, look as if they have been tabled in the same spirit of genuine concern about the risk of foreign hostile state interference and control in critical systems and supply chains. There is an established precedent in UK legislation for maintaining registers or lists of hostile state actors and other entities presenting a threat to our national security for use by Government. That includes the foreign influence registration scheme under the National Security Act 2023, which came into effect last year. Russia and Iran were placed on an enhanced tier of the scheme, which applies to foreign powers considered to pose a risk to the UK’s safety or interests. The Government said that that was in response to those countries being identified as presenting an elevated national security risk. China was conspicuous by its absence, despite the director of GCHQ having confirmed in 2024 that her organisation devotes more resource to China than to any other single mission.

• 10 Feb 2026 · Cyber Security and Resilience (Network and Information Systems) Bill (Sixth sitting) · Hansard source

  More

  I do not want to repeat the discussion that we had a moment ago. I think it is complete lunacy to permit the building of a super-embassy—one of the biggest in the region—next to highly critical data transmission. I am also concerned by media reports that the Prime Minister’s recent visit to China was greenlighted only following the final approval of the embassy. I am deeply depressed that, following the visit, Jimmy Lai has been effectively sentenced for life. I respect the tone and constructive way in which the hon. Member for Harlow approaches this debate, but it is fair to say that the Government are sadly weak on standing up to hostile state actors such as the Chinese Communist party. As I said at the start, there is simply no point in granting the Secretary of State powers to issue directions on the basis of national security if the Government are not willing to be clear-eyed about the most critical cyber-security risks to the nation. I therefore submit that the new clauses are a vital addition to the Bill to focus the attentions of the Secretary of State to ensure that her functions under part 4 are carried out in the best interests of our national security. No responsible Government would or should vote against such provisions. Parliament should make it crystal clear that the Chinese Communist party is a threat to the United Kingdom. We must support new clauses 2 and 3. Ordered, That the debate be now adjourned. — (Taiwo Owatemi.)

• 10 Feb 2026 · Cyber Security and Resilience (Network and Information Systems) Bill (Sixth sitting) · Hansard source

  More

  I really think we should be very critical about this. What we are doing now is parliamentary scrutiny. There will be directions in future, which we expect to be laid, and they will also be subject to parliamentary scrutiny. Even where they are redacted because of national security concerns, somebody, or some mechanism of Parliament, will be able to scrutinise them. Can the Minister confirm that?

• 10 Feb 2026 · Cyber Security and Resilience (Network and Information Systems) Bill (Sixth sitting) · Hansard source

  More

  For the sake of clarity on the legal status of the codes, I entirely agree with the Minister that it is important to get this right, and my understanding of codes of practice in a different area—statutory codes of practice relating to the Mental Health Act—is that case law says that deviation from the code of practice should be done only for cogent reasons. That is a pretty high bar to pass in terms of deviations. I should declare an interest as a former consultant psychiatrist and someone who operated subject to that particular code of practice. For absolute certainty, will the Minister write to the Committee and make the status very clear, along with reference to relevant case law in terms of other codes of practice? Does the clause override that jurisprudence or not? That would settle the question as the Bill goes through Parliament.

• 5 Feb 2026 · Cyber Security and Resilience (Network and Information Systems) Bill (Fourth sitting) · Hansard source

  More

  The Minister is, of course, within his rights to snarkily dismiss the questions that I have raised, but I should point out that the stuff that is debated in Parliament, whether in Committee or on the Floor of the Chamber, is relevant when it comes to future legal disputes after a Bill is passed. The questions I have asked about the application of the Bill’s provisions will be important parts of the legal disputes that I expect will arise after its implementation. When people look back through the Minister’s dismissive comments, I hope they have other resources that they can go to for settling legal arguments. However, he may choose to respond fully now, or in writing if he cannot provide me with an answer.

• 5 Feb 2026 · Cyber Security and Resilience (Network and Information Systems) Bill (Fourth sitting) · Hansard source

  More

  The scope and breadth of the organisations regulated by these provisions is one of the most important parts of the debate. If the hon. Member can wait a moment, that point will form the bulk of my speech. It was also mentioned by my constituency neighbour, my hon. Friend the Member for Spelthorne. The previous Government consulted on bringing MSPs within scope of regulation. Feedback on that consultation indicated strong support, with 86% of respondents in favour. As such, there is a sound policy rationale for imposing cyber-security and instant reporting regulations on MSPs over a certain threshold. Those MSPs will need to take appropriate and proportionate measures to manage risks to the security of the networks and information systems on which they rely to provide managed services in the UK. However, as I said at the outset and as many people said during evidence, the devil really is in the detail as to whether the Bill is effective in protecting the sectors it seeks to regulate. Several industry stakeholders, including officers of MSPs and industry representation bodies, have raised concerns about the broad definition of MSPs in clause 9. As drafted, that definition has the potential to cause confusion among businesses as to whether they are in scope or not. These relevant provisions will be brought into force with secondary legislation before Royal Assent, allowing time for consultation with industry and specific duties. Could the Minister clarify whether his Department will respond to concerns by consulting on a refined definition of what constitutes an MSP, to provide much-needed certainty to businesses operating in the sector? I will also take this opportunity to speak to amendment 10, which was tabled in the names of many Members, including the right hon. Member for Stone, Great Wyrley and Penkridge (Sir Gavin Williamson), who I know has a keen interest in this area. He represents an area in the west midlands, which, like many parts of the country, has suffered massively from the impact of the problems with Jaguar Land Rover. The amendment relates to legitimate concerns about the compound risk that could occur when MSP systems are accessed by malicious actors, and those MSPs are providing services to a large number of entities within a regulated sector. Clearly, there are many reservations about the desirability of this particular amendment, including its potential to interfere with customer choice and the inconsistency with the approach to freedom of enterprise in other regulated sectors in the Bill. It is noteworthy that several witnesses who gave evidence to the Committee pointed out the lack of skilled cyber-security professionals available in the UK employment market to help regulated entities with the effective implementation of the Bill. It is conceivable that many regulated businesses, particularly smaller ones, will be forced to look for external expertise to comply with their obligations, and we would not want to artificially restrict access to expertise, even when done with the best of intentions. The point is rightly made that large MSPs and those providing services to the most critical sectors should observe the highest cyber-security standards. A relevant MSP must have regard to any relevant guidance issued by the Information Commissioner when carrying out the duties imposed on it, so will the Minister confirm whether and to what extent the important issues raised by the amendment will be covered in consultation and industry guidance? The amendment, and some of the debate that we have had, goes to the heart of some of the thresholds and metrics that are being used as gatekeepers in the Bill when an entity is or is not being regulated. As I mentioned this morning, at least 70% of Government cloud procurement goes to the three big US tech actors. Those are clearly huge operators, but when it comes to the criticality of an MSP, as my hon. Friend the Member for Spelthorne mentioned, size does not in itself necessarily indicate its essentialness in the system. One can imagine that if a particular unique type of service was being offered, such as a cyber-security service, by a big company—Cloudflare and Salesforce, for example, had a substantial impact on the sector—not merely the size of an organisation, but what they provide, could be relevant in terms of producing systemic risks to our economy as a whole.

• 5 Feb 2026 · Cyber Security and Resilience (Network and Information Systems) Bill (Third sitting) · Hansard source

  More

  Clause 3 will amend the relevant provisions of the NIS regulations, stipulating that operators of essential services are within scope of the regulations whether or not they are operating an essential service in the UK, and regardless of jurisdiction in which they are established. Providers of public electronic communications networks and public electronic communications services are excluded from characterisation as operators of essential services, as the Minister says, to avoid duplication with their sector-specific cyber-security regime. The clause is an important provision to ensure that entities providing essential services in the UK are compliant with domestic standards. Perhaps the most important aspect of the change is ensuring that serious cyber-security risks that appear within the systems of those entities are reported to the UK authorities for action. That is vital for the National Cyber Security Centre to keep abreast of emerging risks and be able to respond to them. Nevertheless, the complex maze of compliance and regulatory standards across jurisdictions is a growing challenge for businesses of all sizes and particularly for small and medium-sized enterprises. This is also a complicating factor facing UK companies when providing services abroad, particularly in the digital domain. Will the Minister lay out what discussions he has had with industry representatives about easing the complexity of cross-border digital service provision to ensure that the UK is a competitive and attractive place to do business?

• 5 Feb 2026 · Cyber Security and Resilience (Network and Information Systems) Bill (Third sitting) · Hansard source

  More

  That is a stark message. Going back to my previous point, I struggle to think how many small businesses can really put in the necessary resource to take these sorts of steps on cyber-security. There is a broader point here, which goes back to my opening remarks. A chunk of this involves hostile state actors that are attacking our companies, Parliament and the Government, whether directly or through their intermediaries. I find it quite ironic that it was announced earlier this week that our security services are going to work with China’s security services to deal with cyber-security threats. I thought, “Well, hang on a sec. What are they going to say, given that the Chinese Communist party is one of the main drivers of cyber-security threats in the UK?” Legislating in this area and deciding how to approach it as a society is a particular challenge, given that it is not merely criminals or hacktivists doing this stuff to our companies and institutions; there is also full-fat hostile state inference from Russia, Iran or the Chinese Communist party.

• 5 Feb 2026 · Cyber Security and Resilience (Network and Information Systems) Bill (Third sitting) · Hansard source

  More

  I am certainly going to come back to it a few times—if not other Members—and I will invite the Minister to come back to it a few times. Returning to the point about the dependency on particular sectors, I mentioned the impact that Amazon Web Services had on our society and systems; interestingly, the AWS outage was caused not by a cyber-attack, but it demonstrates the disruption to our lives and businesses that could occur in the event of such an attack. The last Government recognised the vital and growing importance of data centres to the UK economy and people’s lives, as well as the risks of serious interruption to these services. That led to a public consultation on enhancing the security and resilience of UK data infrastructure. The Conservatives therefore welcome that this vital element of our national infrastructure will be subject to cyber-security regulation. However, for regulation to be robust for cyber-resilience and regulator data centres it is essential that there are high rates of industry compliance. The Government stated in their impact assessment for this Bill that there is an ongoing engagement with the data centre sector. Could the Minister lay out what feedback he has received on the sector’s preparedness to meet the cyber-resilience standards set by the NIS regulations? Likewise, in terms of ensuring effective regulation, Ofcom will have a dramatically increased role in terms of cyber-security regulation when these provisions come into effect. In view of Ofcom’s current regulatory workload and the challenges with recruitment, which I mentioned earlier and highlighted in the evidence session this week, what ongoing engagement is the Minister having with Ofcom more broadly to make sure that it is sufficiently resourced to play its role? Before I move on to clause 6, on large load controllers, I feel I need to go back to the discussion about proportionality and the purpose and need for these regulations in the Bill. One of the biggest criticisms of the NIS regulations is that they have not really been enforced. I am not saying that a certain rate of enforcement is a marker of efficacy or compliance, but it is curious, and it has been raised to me, that the level of enforcement indicates that the NIS regulations have not really had teeth or changed anything. In one bad world, we have regulations that are completely disproportionate and place a huge and unnecessary burden on industry. But in some ways the worst of all worlds, or rather another problem that we would need to deal with, would be for us to legislate, produce this wonderful cyber-security Act, and go away happy as legislators—“Hey-ho, it’s all sorted and finished; we can sleep well in our beds about the cyber-security of the UK.” But if the companies cannot follow the legislation, will not follow it or do not have the resources to do so, then all we will have done is waste our time. Worse, we will have given ourselves a false sense of security, rather than delving into some of the real challenges and problems in the sector, which include overall education, encouraging businesses to take the issue more seriously and encouraging people to do Cyber Essentials.

• 3 Feb 2026 · Cyber Security and Resilience (Network and Information Systems) Bill (Second sitting) · Hansard source

  More

  Q Thank you for giving evidence to us. I want your help to get my head around what could fall under the Bill’s discretionary power on the designation of critical supply chain entities. Synnovis is used as the exemplar of why such a power is needed. From your perspective in the NHS, what do you think would come into scope? For example, would patient transport or taxis come under scope as critical for the delivery of your services? Would a hospital cleaner come under the scope of a critical supplier if the service was outsourced to a private sector organisation? Would food provision in your hospital come under scope? Would the provision of materials, medicines or medical devices provided by private companies come under scope? Would the provision of IT services—physical computers, not cloud services—come under scope? Would locum agencies come under scope? In fact, would any private provider not come under the scope as critical for the provision of services linked to your organisation’s IT system? Brian Miller: That is a good question. Some of our colleagues mentioned the follow-up secondary legislation that will help us to identify those kinds of things. I suppose there is no difference from where we are at now. We would look at any provision of services from a risk management perspective and say what security controls apply. For example, would they be critical suppliers in terms of infrastructure and cyber-security? Does a cleaning service hold identifiable data? What are the links? Is it intrinsically linked from a technological perspective? I mentioned looking at this through a “defenders win” lens. Yes, some of these technologies are covered. I saw some of the conversations earlier about local authorities not being in scope, but services are so intrinsically linked that they can well come into scope. It might well be that some of the suppliers you mentioned fall under the category of critical suppliers, but that might be the case just now. There might be provision of a new service for medical devices, which are a good example because they are unique and different compliance standards apply to them. For anything like that, where we stand just now—outside the Bill—we risk assess it. There is such an intrinsic link. A colleague on another panel mentioned data across the services; that is why Stewart is here alongside me. I look after the IT security element and Stewart looks after the data protection element.