Two Amendments Tabled To the Cyber Security Bill – one, to prevent Data Sharing With Hostile States, accepted by the Government. The other, to create a Register of Hostile States, opposed by the Government but passed on a Vote in the House of Lords.
Posts on Hong Kong Watch Report; BNO Citizenship; Breaches of the British-Sino Declaration; the persecution of religious believers in China; Launch of the IPAC China Audit; Joshua Wong’s 30th birthday in a Hong Kong Jail; Meeting of the All Party Parliamentary Group on Tibet.
Cyber Security Bill – Amendment 45 To prevent Data Sharing With Hostile States – Tabled by the Government in response to the all-party amendment tabled at Committee Stage.
My Lords, as I indicated earlier in our proceedings, I want to speak to government Amendment 45. In doing so, I reiterate my thanks to the noble Baroness, Lady Lloyd of Effra, for the diligent way in which she has engaged with those who were concerned about data sharing with hostile states.
This amendment had its origins in another place, where Sir Iain Duncan Smith moved an amendment concerned that data might be shared with countries that do not have a judicial system that would ensure that, for instance, extradition requests would stand up to scrutiny. Particular examples were given of things like the national security law in Hong Kong and how data might be shared that would allow young people who have been involved in pro-democracy protests there to then be removed from the United Kingdom and have to stand trial in a place such as Hong Kong.
During our proceedings in the Joint Committee on Human Rights, which I referred to earlier, we had a remarkable young woman who waived her anonymity to come and give evidence to us. Chloe Cheung was just a young teenager when she took part in pro-democracy demonstrations in Hong Kong. She, like many others under our BNO scheme, came to live and claim sanctuary in the UK. At the age of 19, she was told that a bounty of 1 million Hong Kong dollars would be placed on her head. She was not alone; there were several others, including Carmen Lau, who was a legislator in the Hong Kong legislature. One of their great fears in giving evidence to our committee was that they would be subjected to all sorts of intimidation in the UK, including potential removal in due course. They had seen the incident that had occurred outside the PRC consulate in Manchester and were fearful about the new super-embassy being created in London, and all of us on that committee unanimously signed a report saying that we had to go a lot further in dealing with transnational repression.
Having had its origins in the House of Commons, the amendment was supported by a number of organisations across the non-governmental organisation sector. In particular, I pay tribute to the work of the
Inter-Parliamentary Alliance on China and, notably, Luke de Pulford and Jaya Pathak, who participated in the constructive and helpful meetings that we held with the Minister.
Here in the House of Lords, the amendment was recast and retabled by me with the noble Lords, Lord Hunt of Kings Heath and Lord Markham, and the noble Baroness, Lady Ludford. In my unavoidable absence at that moment in the Committee, I was extremely grateful to each of them for their important remarks and support. That unity of purpose has resulted in a shared, unyielding conviction that, in an era of unprecedented systematic competition, our sensitive regulatory and enforcement data must never, in any circumstances, be exposed or gifted to hostile authoritarian regimes.
In the best traditions of your Lordships’ House, the noble Baroness carefully listened to the grave concerns which were raised and recognised the fatal vulnerability in the Bill as originally drafted. She has acted decisively. By closing the loophole that would have permitted disclosure to authorities in any foreign country with a strict, closed list of trusted democratic partners—our Five Eyes allies and our friends across the EEA and Switzerland—the Government have closed a dangerous statutory void. For that constructive engagement and for bringing forward these amendments, I am profoundly grateful.
I refer again to the brave dissidents and diaspora striving to live in peace on our shores, despite intimidation from regimes such as the CCP, and what the noble Lord, Lord Robertson, memorably described as the “deadly quartet” of China, Russia, North Korea and Iran. It is outrageous that people resident in the UK have been subjected to intimidation, harassment and coercion as political targets, some of it utilising data and cyber availability, in CCP-orchestrated extensive and sophisticated campaigns of transnational repression.
Hostile states routinely camouflage political persecution as legitimate, with the systemic abuse, as we heard in the Joint Committee on Human Rights, of Interpol red notices, for instance. Network and information systems data, such as IP addresses, server logs and digital fingerprints, are not neutral administrative information. In the hands of hostile states and their security services, that can become actionable intelligence used to unmask, to geolocate and to surveil individuals on British soil.
We desperately need a comprehensive cross-departmental strategy to prohibit such actions, and government Amendment 45 is a step in that direction. For that, I am extremely grateful to the noble Baroness and felt no need therefore to bring back an amendment in any hostile way today.
Cyber Security Bill Amendment To Create a register of foreign powers that pose an acute risk to our critical network and information systems – opposed by the Government but passed on a vote in the House of Lords
Amendment 164 to Create a Register of Hostile States
My Lords, I would like to join with the noble Viscount, Lord Camrose, and the noble Lord, Lord Markham. I have, as has
been indicated, signed their amendment, but I echo also what the noble Lord, Lord Clement-Jones, has said about the way in which the Minister has gone about dealing with the Bill.
Noble Lords will be glad to know that I will not be speaking on other groups of amendments, other than one. That gave me a very good insight into the way that the noble Baroness, Lady Lloyd, goes about things. We had three separate meetings in the Recess; she has been exemplary in the way that she has tried to deal with the arguments and with Members of your Lordships’ House and I want to put on record my gratitude to her for that.
So why have I signed Amendment 164? Part 4 of the Bill rightly equips the Secretary of State with formidable powers to issue directions in the interests of national security. Yet, as the Bill stands, those powers risk operating in a strategic vacuum. If we are to empower Ministers to intervene decisively to protect our essential services and our critical supply chains, that intervention must be anchored to an objective, statutory assessment of who threatens us. We cannot defend what we value against an adversary whom we refuse to formally identify. Amendment 164 provides that essential statutory spine by establishing a clear, maintained register of foreign powers that pose an acute risk to our critical network and information systems—something that came home to us last week when so many of our systems nationally were attacked. We do not necessarily know by whom, but we can no doubt guess.
We certainly know that, in the past, everything from the National Health Service onwards has been subjected to attacks: in that case the NHS was attacked by the regime in North Korea. Critically, this is not a political blacklist, though. It is not subject to diplomatic whim; it is an intelligence-led mechanism rooted in the hard, objective assessments of GCHQ. Where our intelligence agencies have confirmed that a foreign state or its proxies have perpetrated attacks against our essential services within the last seven years, or where they issue clear warnings of imminent peril, that state must be listed.
The definition must be clear-eyed about modern authoritarian governance. In the People’s Republic of China, for instance, the state, the military and the Chinese Communist Party are inextricably fused. To assess state-backed cyber threats while ignoring the governing political party that directs them would be wilful blindness. This amendment closes that semantic loophole once and for all.
Furthermore, Amendment 164 demands that we confront our own domestic vulnerabilities. It requires the Secretary of State to review not merely attacks launched from across oceans but the profound risks inherent in foreign-owned or foreign-controlled infrastructure situated on our own soil. For far too long, across successive Administrations, our critical national infrastructure has been treated with commercial naivety rather than strategic discipline. By requiring the Government to conduct this review and lay a coherent action plan before Parliament within six months, this amendment ends the era of bureaucratic drift.
Let me end by referring to the inquiry that I chaired on behalf of the Joint Committee on Human Rights. It was an inquiry into transnational repression. Our domestic policy’s failure is illustrated by the reluctance of the Government to act on the recommendation that the committee made unanimously to place the People’s Republic of China, which we found to be the state that was the most responsible for transnational repression in the United Kingdom, even more than Russia or Iran, in the foreign influence registration scheme’s top tier. Unlike with those two other countries, we have failed to do so.
I would be grateful when the Minister comes to reply if she is able to give us any information about whether Mr Dan Jarvis, who is responsible for security issues and who promised to continue to keep this issue under review, has done anything further to act on our committee’s recommendations and also the concerns raised by the Intelligence and Security Committee, which the noble Lord, Lord Beamish, has often spoken about in your Lordships’ House.
Strategic ambiguity, which is what I think has been the order of the day, does not deter authoritarian regimes; it merely invites opportunistic aggression. If we are serious about building genuine national cyber resilience, we must replace vague administrative discretion with an empirical, transparent and accountable framework, and I urge the Government to embrace this vital measure and to accept Amendment 164 in the names of the noble Viscount, Lord Camrose, and the noble Lord, Lord Markham
