Ben Spencer MP: speeches

Speeches

• 19 Mar 2026 · Online Harms · Hansard source

  More

  I congratulate the hon. Member for St Neots and Mid Cambridgeshire (Ian Sollom) on securing this debate. As with so many debates over recent months, it has shown that online harms are a matter of paramount importance to Members on both sides of the House and in the other place. As was to be expected, every Member who spoke focused on online harms. I think only one Member, the hon. Member for Cowdenbeath and Kirkcaldy (Melanie Ward), spoke about some of the positives of the internet age. I would usually say that it has been a pleasure to listen to and take part in the debate, but it really has not been in this case, because it has been a pretty grim debate. We have had a tour de force discussion of all the horrors that young people and adults are exposed to on the internet, and we have heard about the importance for our society and country of tackling them. I am very proud of the steps that His Majesty’s official Opposition took in government to make the online environment a safer place, from bringing the Online Safety Act into force to the commendable and tenacious work of my noble Friends in the other place, especially Baroness Owen and Baroness Bertin, who are the staunchest of advocates for protections from digital forms of abuse for women and girls. Members will know that Baroness Owen secured important amendments to the Sexual Offences Act 2003 to criminalise the solicitation of sexually explicit deepfake images. Baroness Bertin’s report and campaigning has resulted in amendments being tabled to the Crime and Policing Bill concerning nudification apps. That is by no means the extent of their important work. The aim of the Conservatives’ Online Safety Act was to build an environment where adults could access legal content freely and where children enjoy greater protections. I welcome in particular the entry into force last year of Ofcom’s protection of children codes. I also welcome the enforcement action that Ofcom has already taken under the Act to tackle file-sharing sites disseminating child sexual abuse material and pornography sites that have failed to put in place highly effective age-assurance measures to prevent children from accessing content. However, we know that concerns regarding children’s social media use go well beyond content that is explicitly harmful and subject to restrictions under the Online Safety Act. As a result of addictive algorithms that drive excessive use and unhealthy patterns of behaviour, parents across the country are rightly concerned about their children’s social and emotional development. That is why we called for a social media ban for children under the age of 16. This month, the Government regrettably voted down amendments to the Children’s Wellbeing and Schools Bill, which were secured in the other place by my noble Friend Lord Nash, to bring such a ban into effect. In response to pressure from His Majesty’s loyal Opposition and other Members across the House, the Government have now launched their own consultation on measures to restrict access to social media for under 16s, alongside several other online safety matters. If the Government had accepted our amendment to the Data (Use and Access) Act 2025, such a review would be well under way by now, and we would be closer to a solution on this generationally important issue, but we are where we are. Consultation is no substitute for action, and I sincerely hope that the Government will deliver on the timescales set out for responding and bringing in measures after their consultation concludes in May. As with any rapidly evolving technology, social media and other online tools develop new apps and sites that pose novel threats and demand a response from Government and regulators. We have seen most recently in AI chatbots, some of which may fall outside the scope of the regulatory framework in promoting self-harm content to young people. A particular harm that I have raised with Ministers and Ofcom, of which there has been a disturbing increase, is the use of AI chatbots to obtain medical or other advice that should be sought from regulated professionals. The hon. Member for Winchester (Dr Chambers) mentioned that in his speech. Last year, the Medicines and Healthcare products Regulatory Agency established a national commission, which ran a call for evidence on the suitability of the UK’s framework for regulating AI in healthcare. The call for evidence closed last month, and I look forward to seeing the commission’s conclusions and the Government’s proposals for dealing with the risks that will no doubt be highlighted. A fundamentally important aspect of online harm that has attracted comparably less media attention and debating time in Parliament is the threat to democracy of online disinformation campaigns perpetrated by hostile state actors and their affiliates. The Science, Innovation and Technology Committee reported last year that online foreign interference and disinformation campaigns are putting UK citizens at risk. We also had credible reports last year of Iranian state-backed digital interference in the Scottish independence referendum. The risk posed by that type of activity is intensifying, as artificial intelligence tools provide the capability to generate deepfake content purporting to represent politicians or campaigns, amplified by foreign, hostile, state-controlled bot accounts. As people—particularly young people—increasingly obtain their news online, it is more important than ever that we consider the potential of digital watermarking tools that can be used to demonstrate the provenance and authenticity of content published on the internet. This danger is likely to increase as a result of geopolitical tensions. In their report on artificial intelligence and copyright, which was published yesterday, the Government recognised the risks posed by digital replicas and deepfakes in spreading convincing disinformation online, and committed to exploring options to address the growing problem. The Government also discussed the need to label AI-generated content to make disinformation easier for users to spot. Will the Minister provide timescales for that further work, and an update on the Government’s broader strategy on countering AI-generated democratic interference material? What role does Minister think digital watermarking tools will play in countering the proliferation and impact of deepfake videos and content?

• 24 Feb 2026 · Cyber Security and Resilience (Network and Information Systems) Bill (Seventh sitting) · Hansard source

  More

  I beg to move, That the clause be read a Second time. The National Audit Office’s 2025 report on cyber-resilience highlighted that Government Departments and agencies are among the weakest links in the UK’s cyber-security ecosystem and lack a credible plan to become cyber-resilient in the short to medium term. The Government play a key role in the management of certain critical national industries, but the continuing cyber-security vulnerabilities in the IT systems used to operate CNI expose the UK to the threat of serious attacks that could undermine national security and the economy. That is not to mention the risk to enormous amounts of highly sensitive data held on Government systems. Dr Sanjana Mehta of ISC2 said in her oral evidence that the Department for Work and Pensions administered £288 billion of benefits over the past year, with more than 23 million people claiming benefits of some kind. That activity involves processing vast amounts of personal, medical and financial data, which presents rich pickings for malicious actors. The feedback from industry stakeholders, many of whom are being asked by the Government to take on onerous security and reporting obligations under this Bill, echoes those concerns regarding Government cyber-immaturity. There is a strong sentiment that the Government should be leading by example, as Chris Anley of the NCC Group commented in the Committee’s oral evidence sessions. In view of the growing risk posed to UK cyber-security by hostile state actors, by their affiliates and by criminal gangs, improving Government cyber-security is urgent. It is clear from the NAO’s findings and other recent reports that Government Departments have lacked the clear goals and necessary accountability to incentivise tackling this significant challenge. In his letter of 19 February to members of the Committee, the Minister said: “Government will be held to equivalent cyber security requirements that we expect of the essential and digital services in scope of the Cyber Security and Resilience (Network and Information Systems) Bill.” But as matters stand, there are no effective legal mechanisms for accountability to Parliament on increasing Government cyber-resilience to the standards necessary to meet the intensifying threats facing our Government Departments and agencies. New clause 5 would compel the Secretary of State to make yearly reports to Parliament setting out the Government’s progress towards meeting the recommendations of the National Audit Office’s 2025 report on Government cyber-resilience and towards meeting the standards they set themselves in their recent cyber action plan. Where necessary, the Secretary of State would have to account for failures to meet deadlines for implementation and issue a new plan to achieve compliance. In moving this new clause, I am aware of the challenges that successive Governments have faced in driving up cyber-resilience standards. There are serious practical and budgetary obstacles that can impede progress, such as the vast amount of legacy IT equipment that remains in use, which is inherently more vulnerable to attack. Moreover, there is the ongoing problem of recruiting highly skilled cyber-security professionals to work in these roles, given the competition in the recruitment market and constraints on public sector salaries. Illustrative of that challenge is the worrying statistic, cited by Chris Anley of the NCC Group, that “almost a third of cyber-security posts in Government are presently unfilled”. –– [ Official Report, Cyber Security and Resilience (Network and Information Systems) Public Bill Committee, 3 February 2026; c. 24, Q29.] None the less, the Government have now put in place a plan that they consider achievable, and they should be held to account for it. The new clause creates a mechanism for that much-needed accountability.

• 24 Feb 2026 · Cyber Security and Resilience (Network and Information Systems) Bill (Seventh sitting) · Hansard source

  More

  I am a bit unclear about the hon. Gentleman’s intervention. The point I was making was that there is legitimate concern that people doing research into this area and doing threat assessments risk prosecution, so, across the whole of our society, that work is not being done. We have heard quite a lot of evidence from cyber campaigns about the benefits that changes to this law would make to the system, which is why we tabled the new clause. I commend new clause 19 to the Committee. I hope the Minister agrees that now is the time to address the issue. I suspect that this will be my last, or penultimate, time speaking to the Committee, so I would like to finish by thanking Members on both sides of the Committee for a fun and, at times, robust debate over the past month. I thank the Chairs, the Clerks and all the teams working on the Bill—and Sophie Thorley from my office, who has done incredible research on the Bill.

• 24 Feb 2026 · Cyber Security and Resilience (Network and Information Systems) Bill (Seventh sitting) · Hansard source

  More

  I will speak to new clause 19, tabled in my name on behalf of His Majesty’s official Opposition. The new clause would compel the Secretary of State, within 12 months of Royal Assent, to review the need for a statutory defence, encompassing legitimate cyber-research activities, to criminal offences under clause 1 of the Computer Misuse Act 1990, which is about unauthorised access to computer programs. The campaign for reform in this area, CyberUp, has argued that, in its current form, the CMA inadvertently criminalises critical activity such as vulnerability research and threat intelligence, both of which are essential for defending the nation’s digital systems. The new clause would also require the Secretary of State’s review to evaluate whether the creation of such a defence would enable regulated bodies to improve the resilience of their network and information systems via enhanced vulnerability testing and research. New clause 18, tabled by the hon. Member for Henley and Thame, relates to the same important topic and would require the Secretary of State to review, and report to Parliament within 12 months of the Bill’s entering into law, whether amending the Computer Misuse Act could improve the resilience of network and information systems. Hon. Members will recall the insightful oral evidence of Professor John Child of the University of Birmingham. Professor Child made a clear and compelling case for the need to amend the Computer Misuse Act to provide statutory defences for legitimate cyber-research—sometimes called ethical hacking activities. Likewise, campaign groups, industry specialists and parliamentarians have all argued that the Computer Misuse Act, which was written before the modern internet, is no longer fit for purpose. At present, the Act fails to distinguish between malicious attackers and cyber professionals acting in the public interest, inadvertently criminalising a large proportion of research that UK cyber-security professionals can carry out to protect UK critical infrastructure and the UK’s technological ecosystem. This means that cyber-security professionals working to defend UK organisations from real-world threats risk prosecution. That has created a chilling effect—talent is being lost, investment is stifled and security gaps are going unidentified. If we are to have true UK cyber-resilience—not just among regulated sectors, but across businesses of all types and throughout society—we need a multifaceted approach. Industry and private sector-led initiatives will play a strong role in that. Professor Child made clear that countries that have implemented more favourable regimes, such as the US and Israel, are benefiting from increased cyber-resilience as a result of cyber-research activity. The Government have acknowledged that reform of the CMA is a pressing issue. Indeed, the Home Office has been reviewing that question for some time. Further, the Minister for Security, the hon. Member for Barnsley North (Dan Jarvis), highlighted the urgent need for changes to the law in this area in a recent speech, stating that Government have “heard the criticisms about the Computer Misuse Act, and how it can leave many cyber security experts feeling constrained in the activity that they can undertake.” He went on to say: “These researchers play an important role in increasing the resilience of UK systems, and securing them from…vulnerabilities. We shouldn’t be shutting these people out, we should be welcoming them and their work.” Yet the Home Office has brought forward no specific proposals for reform. Parliament is unlikely to legislate again in the cyber-security domain for some considerable time; we cannot afford to kick the can down the road on this vital issue any longer if we are to have a credible plan for whole-of-society cyber-resilience.

• 10 Feb 2026 · Cyber Security and Resilience (Network and Information Systems) Bill (Fifth sitting) · Hansard source

  More

  Clause 18, which the Government seek to modify through amendments 14 to 18, creates new pathways for information sharing between regulators, public authorities and Government Departments. It also creates a power for NIS enforcement authorities to share information with relevant overseas authorities for specified purposes. The new regime is intended to remove gaps and ambiguities in the existing framework governing the sharing of information obtained in the course of competent authorities and the oversight role of NCSC, and to create legal certainty in this domain. In turn, it is anticipated that greater information sharing will assist with the detection of crime, enforcement activity and awareness of emerging cyber-risks and with ascertaining the effectiveness of the NIS regulations in building UK cyber-resilience. In particular, the Bill creates a new gateway to ensure that NIS regulators can share information with UK public authorities, and vice versa, as well as sharing and receiving information from organisations outside of the NIS framework, for example other regulators or bodies such as Companies House. The Bill strengthens safeguards on how information can be used once it has been shared under the NIS regulations by restricting onward disclosure. More effective information sharing will be vital for competent authorities to keep up to date with emerging risks and building resilience in their sectors, and the new measures were broadly welcomed by regulators in our oral evidence session. However, industry bodies such as techUK have called for further detail on the new information-sharing regime. What steps are the Government taking to ensure that regulators share responsibility for protecting sensitive data, and that information-sharing processes are coherent, proportionate and secure? Could the Minister elaborate on the discussions he has had with regulators on those matters, and on how secure information sharing will work in practice? Finally, on the detail of the text in Government amendment 14, proposed new paragraph (aa)(ii) refers to persons “otherwise in connection with…any other matter relating to cyber security and resilience,”. Given that this is an information-sharing power, that seems a remarkably broad “any other matter” provision. What disclosures that are not already covered in the Bill does the Minister conceive will come up in that scope? What guidance or consultation will the Minister produce to make sure that such powers are proportionate and not at risk of abuse?

• 10 Feb 2026 · Cyber Security and Resilience (Network and Information Systems) Bill (Fifth sitting) · Hansard source

  More

  The Opposition are trying to make it clear that ransomware needs to be in the scope of the reporting. It is really for the Minister to answer if he thinks there are problems with the new clause, and if so, how the Government will go about taking that forward. The widespread and highly damaging nature of ransomware attacks—which are often perpetrated by criminal groups at scale and speed—means that regulators need to have a detailed oversight of this area to prevent those attacks from being deployed more widely. Therefore, the new clause is intended to ensure that all ransomware attacks on regulated entities are reported, regardless of severity or potential severity, so that the risks are picked up. In tabling new clause 6, I am acutely aware of the existing reporting burden for regulated entities and regulators. Since tabling it, we have heard impactful evidence from Carla Baker from Palo Alto, who highlighted the number of cyber incidents and false positives that many companies encounter each day. As I said in response to an intervention, in the absence of measures brought forward by the Government to address the widespread and urgent risks presented by ransomware attacks—and as the Government themselves identify as part of the Home Office’s review—it would be proportionate to make specific reference to ransomware in the reporting requirements on regulated entities in the Bill. New clause 7 reflects the concerns of regulated bodies and industry representatives who have set out many, many times—in oral evidence and beyond—the need to ensure that reporting obligations are clear and, as far as possible, simplified across the many different incident reporting regimes that exist for providers of digital services. The new clause would compel the Secretary of State to publish an assessment of the impact of the new reporting regime on regulated entities in the Bill within 12 months of Royal Assent. Importantly, in line with the clear requests articulated by many stakeholders who gave evidence last Tuesday, it requires the Government to publish proposals for the creation of a single cyber incident reporting channel for relevant bodies.

• 5 Feb 2026 · Cyber Security and Resilience (Network and Information Systems) Bill (Third sitting) · Hansard source

  More

  I broadly agree. This is one of those difficult areas where there can be overlap. I have sympathy with the argument that it is important to use any opportunity, and in particular this Bill, to raise fraud. We focus on financial fraud, but this area is not limited to that, especially when we think about other malicious operators, and about ransomware and hacktivism, where the boundaries are particularly blurred. In a situation where a fraudulent operator, service, provider or organisation has material, whether on social media or subject to search engines, and the police or other competent authorities have flagged it to the provider as fraudulent—as illegal criminal activity—what duties does that provider have to remove it or take it down? Is that something that the Minister is aware of? Has he looked into it, and what is the Government’s plan to crack down on that activity?

• 3 Feb 2026 · Cyber Security and Resilience (Network and Information Systems) Bill (Second sitting) · Hansard source

  More

  Q Thank you very much for coming in to give us evidence this afternoon, and thank you for your service. I have two questions. Who are the main threat actors in cyber-attacks on UK networks and information systems—what do they break down into, in terms of state actors, affiliates and criminal gangs? Secondly, on ransomware attacks, you will know that the Government review states that ransomware is “the greatest of all serious and organised cybercrime threats”. In your view, what is the scale of that threat and what sectors and businesses are the primary targets? DCS Andrew Gould: To take the actors first, they are probably quite well known, in terms of the general groupings. Yes, we have our state actors—the traditional adversaries that we regularly talk about—and they generally offer very much a higher-end capability, as you will all be aware. The next biggest threat group is organised crime groups. You see a real diversity of capability within that. You will see some that are highly capable, often from foreign jurisdictions—Russian jurisdictions or Russian-speaking. The malware developers are often the more sophisticated as service-type offerings. We see more and more ransomware and other crime types almost operating as franchises—“Here is the capability, off you go, give us a cut.” Then they have less control over how those capabilities are used, so we are seeing a real diversification of the threat, particularly when it comes to ransomware. Then, where you have that proximity to state-directed, if not quite state-controlled—that crossover between some of those high-end crime groups and the state; I am thinking primarily of Russia—it is a lot harder to attribute the intent behind an attack. There is a blurring of who was it and for what purpose was it done, and there is that element of deniability because it is that one further step away. Moving back down the levels of the organised crime groups, you have a real profusion of less capable actors within that space, from all around the world, driving huge volumes, often using quite sophisticated tools but not really understanding how they work. What we have seen is almost like a fragmentation in the criminal marketplace. The barrier to criminal entry is probably lower than it has ever been. You can download these capabilities quite readily—you can watch a tutorial on YouTube or anywhere else on how to use them, and off you go, even if you do not necessarily understand the impact. We certainly saw a real shift post pandemic from traditional criminals and crime groups into more online crime, because it was easier and less risky. You look more broadly at hacktivists, terrorists—who are probably a lot less capable; they might have the intent but not so much the capability—and then the group that are sometimes slightly patronisingly described as script kiddies. These are young individuals with a real interest in developing their skills. They have an understanding that what they are doing is wrong, but they are probably not financially or criminally motivated. If they were not engaging in that kind of cyber-crime, they probably would not be engaging in other forms of criminality, but they can still do a lot of damage with the tools they can get their hands on, given that so many organisations seem to struggle to deliver even a basic level of cyber-resilience and cyber-security. One of the things that we really noticed changing over the last 18 months is the diversification of UK threats. Your traditional UK cyber-criminal, if there is such a thing, is primarily focused on hacking for personal benefit, ransomware and other activity. Now we are seeing a diversification, and more of a hybrid, cross-organised crime threat. There are often two factors to that. We often hear it described in the media or by us within law enforcement publicly as the common threat—this emerging community online—otherwise known as Scattered Spider. There, we are seeing two elements to those sorts of groups. You see an element of maybe more traditional cyber-skills engaged in hacking or using those skills for fraud, but we also see those skills being used for Computer Misuse Act offences, in order to enable other offences. One of the big areas for that at the moment that we see is around intimate image abuse. We see more and more UK-based criminals hacking individuals’ devices to access, they hope, intimate images. They then identify the subject of those intimate images, most predominantly women, and then engage in acts of extortion, bullying or harassment. We have seen some instances of real-world contact away from that online contact. Think of the scale of that and the challenge that presents to policing. I can think of cases in cyber-crime unit investigations across the country where you have got a handful of individuals who have victimised thousands of women in the UK and abroad. You have got these small cyber-crime units of a handful of people trying to manage 4,000 or 10,000 victims. It is very difficult and very challenging, but the flipside of that is that, if they are UK-based, we have a much better chance of getting hold of them, so we are seeing a lot more arrests for those cross-hybrid threats, which is a positive. There is definitely an emerging cohort that then starts to blend in with threats like Southport and violence-fixated individuals. There seems to be a real mishmash of online threat coming together and then separating apart in a way that we have never seen historically. That is a real change in the UK threat that is driving a lot of policing activity. Turning to your ransomware question, what is interesting, in terms of the kinds of organisations that are impacted by ransomware, a lot of the ransomware actors do not want to come to notice for hitting critical national infrastructure. They do not want to do the cloning of pipelines. They do not want to be taking out hospitals and the NHS. They know they will not get paid if they hit UK critical national infrastructure, for starters, so there is a disincentive, but they also do not want that level of Government or law enforcement attention. Think of the disruptive effect that the UK NCA and policing had on LockBit the year before last. LockBit went from being the No. 1 ransomware strain globally to being out of the top 10 and struggling to come back. We saw a real fragmentation of the ransomware market post that. There is no dominant strain or group within that that has emerged to cover that. A lot of those groups that are coming into that space may be a bit less skilled, sophisticated and successful. The overall threat to organisations is pretty much the same. The volume is the volume, but it is probably less CNI and more smaller organisations because they are more vulnerable and it is less likely to play out very publicly than if there is a big impact on the economy or critical national infrastructure. As such, there is probably not the level of impact in the areas that people would expect, notwithstanding some of the really high-profile incidents we had last year.

• 3 Feb 2026 · Cyber Security and Resilience (Network and Information Systems) Bill (Second sitting) · Hansard source

  More

  Q What are the arguments against amending the CMA, and how would you deal with them? Professor John Child: There are obviously a number. It is always more comfortable when you have a beginning point of criminalisation. The argument to decriminalise in an environment where you want to protect against threats is sometimes a slightly unintuitive sell. Is the criminalisation that we have doing the necessary work in terms of actually fighting the threats? To some extent, yes, but it is limited. Is it doing harms? There is an argument to say that it is doing harms. This comes back to the point that was made earlier, which was perfectly sensible. When you speak to the CPS and others, their position as prosecutors is to say, “Very few people are being prosecuted, and we certainly don’t want to be prosecuting legitimate cyber-security experts, so there is no problem.” Admittedly, that means there is no problem in terms of actual criminalisation and prosecution, but that is the wrong problem. If you focus on the problem being the chilling effect of the existence of the criminalisation in the first place, you simply cannot solve that through prosecutorial discretion, and nor should you, when it comes to identifying what a wrong is that deserves to be criminalised. You certainly cannot resolve it through sentencing provisions. The only way that you can sensibly resolve this is either by changing the offence—that is very difficult, not least because, from a position of criminalisation, it might be where other civil jurisdictions begin—or by way of defence, which realistically is the best solve from the point we are at now. If you have a defence that can be specifically tailored for cyber-security and legitimate actors, you can build in reverse burdens of proof. You can build in objective standards of what is required in terms of public interest. The point here is that the worry is one of bad actors taking advantage. The reality is that that is very unlikely. The idea that the bad actors we identify within the system would be able to demonstrate how they are acting in the public best interest is almost ridiculous. Indeed, the prospect of better threat intelligence, better securities and so on provides more information and better information-sharing to the NCSC and others and actually leads to more potential for prosecution of nefarious actors rather than less. It is a more complicated story than we might like in terms of a standard case for changing the criminal law, but it is nevertheless an important one.

• 3 Feb 2026 · Cyber Security and Resilience (Network and Information Systems) Bill (Second sitting) · Hansard source

  More

  Q Thank you for coming to give evidence this afternoon. I have a couple of questions. First, how can industry and cyber-security researchers collaborate more effectively to increase cyber-resilience in the network and information systems of regulated sectors? Secondly, and building on that, are there any model schemes or arrangements for reporting risks to affected companies that could incentivise legitimate research activities? Professor John Child: My specialism is in criminal law, so this is a bit of a side-step from a number of the pieces of evidence you have heard so far. Indeed, when it comes to the Bill, I will focus on—and the group I work for focuses on—the potential in complementary pieces of legislation, and particularly the Computer Misuse Act 1990, for criminalisation and the role of criminalisation in this field. I think that speaks directly to the first question, on effective collaboration. It is important to recognise in this field, where you have hostile actors and threats, that you have a process of potential criminalisation, which is obviously designed to be effective as a barrier. But the reality is that, where you have threats that are difficult to identify and mostly originating overseas, the actual potential for criminalisation and criminal prosecution is slight, and that is borne out in the statistics. The best way of protecting against threats is therefore very much through the use of our cyber-security expertise within the jurisdiction. When we think about pure numbers, and the 70,000-odd cyber-security private experts, compared with a matter of hundreds in the public sector, police and others, better collaboration is absolutely vital for effective resilience in the system. Yet what you have at the moment is a piece of legislation, the Computer Misuse Act, that—perfectly sensibly for 1990—went with a protective criminalisation across-the-board approach, whereby any unauthorised access becomes a criminal offence, without mechanisms to recognise a role for a private sector, because essentially there was not a private sector doing this kind of work at the time. When we think about potential collaboration, first and foremost for me—from a criminal law perspective—we should make sure we are not criminalising effective cyber-security. The reality is that, when we look at the current system, if any authorised access of any kind becomes a criminal offence, you are routinely criminalising engagement in legitimate cyber-security, which is a matter of course across the board. If you are encouraging those cyber-security experts to step back from those kinds of practices—which may make good sense—you are also lessening that level of protection and/or outsourcing to other jurisdictions or other cyber-security firms, with which you do not necessarily have that effective co-operation, reporting and so on. That is my perspective. Yes, you are absolutely right, but we now have mechanisms in place that actively disincentivise that close collaboration and professionalisation.

• 25 Nov 2025 · English Devolution and Community Empowerment Bill · Hansard source

  More

  Yesterday, my constituency neighbour, my hon. Friend the Member for Spelthorne (Lincoln Jopp), asked the Minister whether Surrey will get a mayor. He did not get much of an answer—we can only imagine what has led the Government over the past year to get cold feet on the election of mayors going forwards. I want to talk about new clause 1 and amendment 2, on consent for change, in the name of my hon. Friend the Member for Ruislip, Northwood and Pinner (David Simmonds) on behalf of the official Opposition. Surrey and others have been working with the Government to maximise the opportunities of devolution locally. As part of that, there has been quite a debate over the unitary model and whether there should be two, three or one unitary authorities. On the face of it, ideally, going for one unitary would mean savings, but the Government have decided that is not possible, so, through various processes, the decision has been made to have two unitaries. That has all been done in pursuit of a mayor. A mayor would make a big difference in ensuring that Surrey can, as the Government put it, unlock devolution. It is frustrating that we have got to this stage—all this work has been done—but there has still been no firm commitment that Surrey will get a mayor, particularly when a unitary model is being adopted purely to seek a mayor when, actually, a better model locally would be a single unitary. I see the Minister nodding; I am sure she can see that conundrum and how there is frustration about the fact that a mayor has not yet been announced. A mayor would bring huge benefits in leading on strategic projects such as the River Thames scheme that I have been trying to push to be built as soon as possible. It would also bring benefits in health, with accountability for integrated care boards—again, I have been calling for that—and on transport locally. I have been calling for a duty to co-ordinate, which I think a mayor with powers would also be able to deliver for Surrey. In housing, I am calling for the prevention of inappropriate local development, which is blighting areas across Runnymede and Weybridge and which will affect both the east and west unitaries when they are set up. In policing, given that the Government have announced that they will wrap up the police and crime commissioners, we need a mayor to take on the role at the cut-off date of 2028. I beg the Minister to announce, either in winding up, via a written ministerial statement or otherwise the confirmation of a mayor for Surrey and a guarantee that next year’s elections will go ahead. Will she also explain how my constituents can be shielded from other councils’ debt as part of the unitary reforms that are going ahead?

• 16 Sept 2025 · Topical Questions · Hansard source

  More

  T3. My team and I support many families navigating the special educational needs and disabilities system, and one of the challenges is delays in getting access to tribunal justice. As the Secretary of State gets to grips with his new role, will he make shortening those delays one of his priorities, and can he update the House accordingly?

• 21 Jul 2025 · Victory over Japan: 80th Anniversary · Hansard source

  More

  On 8 May 1945 at 3 pm, Prime Minister Winston Churchill made a radio announcement that Germany had surrendered and the war in Europe had come to an end. In towns and cities across the nation, people gathered in their communities to remember those they had lost and, for so many, to rejoice that the war in Europe was over. At the same time, half a world away, thousands of British, Commonwealth and allied forces were still involved in bitter fighting in Japan and the Pacific. Although part of the same war, the conflict in Asia presented different and in many cases uniquely harrowing challenges. Troops fought in jungles drenched by monsoons, on snow-covered hills and in the scorching tropical heat of remote islands. Prisoners of war faced the harshest conditions of brutality, disease and malnutrition. Sadly, while 8 May is taught and commemorated across the country, too many remain unaware of the sacrifice and conflict in Asia, or even when VJ Day is. The Fourteenth Army, which fought in the campaign in the Pacific, is called the forgotten Army. In the face of regional and growing conflict today, as we once again face threats from powers increasingly hostile to our values and way of life, it is more important than ever that we remember them. In the Spencer family, the Army in Burma is hardly forgotten. My grandfather was a Chindit and fought in Burma. While he resisted talking much about his experiences, it is clear from what he did say what incredible sacrifices he and his fellow Chindits made for our country. The experiences of the war lived on with him not just in memory, but in his health. He was medically evacuated back to the UK, suffering from tropical sprue and malaria and, like many others, malnourished and incredibly underweight. Back in the UK he was treated with cigarettes, which we now know is not helpful, and with tonic, which—although it was helpful—he consumed so much of that he damaged his hearing. He continued to have relapses of malaria throughout his life. He died before I was elected MP, but I am proud to stand in this House to pay tribute to him and to all who fought in Asia for our freedoms. It is clear that, while the forgotten Army may have been forgotten, it is certainly not forgotten in this place this evening. I am grateful each and every day for the freedoms we enjoy in this country—freedoms secured because of the bravery and sacrifices made by those young men who fought and died in defence of our country and our way of life, and those who played the vital roles at home to make the war effort possible. Their sacrifice—their legacy—is our ability to have this debate this evening. We will remember them.