PARLIAMENTARY DEBATE
Telecommunications (Security) Bill - 25 May 2021 (Commons/Commons Chamber)

Consideration of Bill, as amended in the Public Bill Committee
Brought up, and read the First time.

I also ask the Minister to consider another very real possibility. As our networks evolve, key functionality moves from chips into software that will be running in the cloud. Our cloud infrastructure is dominated by one vendor, Amazon Web Services, whose cloud services cross-subsidise the retail services we are more familiar with and with which so many of our high street names are unable to compete. So in the near future it might be that although we think we have three, or four, or five separate mobile 5G networks, they would all, in effect, be running over one vendor, AWS. That would be a single point of failure were AWS to be bought by a hostile country or, as in the case of SolarWinds, even were it just to be hacked by a hostile operator, yet without this new clause I fail to see how the Bill would ensure we had warning of that. There is no requirement on Ofcom to assess how each network provider, and their supply chains, is evolving in its network architectures and the threat to our network security that follows. As is becoming a recurring theme with this Government’s approach to telecoms security and elsewhere, including to online harms, they appear capable of recognising a threat once it is here but incapable of putting in place the infrastructure to anticipate threats and protect our citizens accordingly. New clause 1 is designed to address that.
New clause 2 is designed to improve the Bill by ensuring greater scrutiny, focus and transparency, and addressing the deepening hole in accountability presented by the Government. As I have said, Labour have consistently supported the need for this Bill. Our approach has been to push for the change necessary to address security threats and, specifically, to allow the broad powers of intervention that this Bill gives the Secretary of State, while ensuring that those powers are overseen by Parliament.
This Bill provides substantial powers on national security to the Department for Digital, Culture, Media and Sport, a Department that lacks expertise, experience and understanding in matters of national security. New clause 2 would ensure that the Intelligence and Security Committee was provided with information relating to a designated vendor direction, notification of contravention, urgent enforcement action or modifications to an existing enforcement direction made on grounds of national security by the Secretary of State as soon as is reasonably possible. During proceedings in this House and in the other place on the Bill that became the National Security and Investment Act 2021, we tried time and again to ensure ISC oversight of national security issues, with support from across the House and in the other place. The Government seem to have a blind spot here, and I hope the Minister will not put ideology before national security today.
In Committee, on 26 January, the Minister said that the ISC is the appropriate place to discuss matters of national security and talked about the unique role it plays in assessing security implications, so I hope he is not going to pretend that the occasional letter from himself to the ISC will provide the appropriate level of debate. The Under-Secretary of State for Business, Energy and Industrial Strategy did try that during the National Security and Investment Bill debate, but the Chair of the ISC, the right hon. Member for New Forest East (Dr Lewis), who I note is down to speak in this debate as well, made short work of him. and I hope the telecommunications Minister will not follow in his footsteps.
Most of the testimonies during the passage of both the National Security and Investment Act and this Bill have emphasised how national security threats are evolving, how the bad guys do not stand still, and how technology is becoming more and more important in every sphere of activity. Yet instead of responding, the Government stick to the same old ways. I urge the Minister to accept new clause 2.
On our new clause 3, on diversification, we believe that it is right to remove high-risk vendors from the UK’s networks and enable Government to designate vendors and require telecoms operators to comply with security requirements. However, our networks will not be secure if the supply chain is not diversified, as dependency is simply shifted to another point of failure. New clause 3 would require that network diversification be reported on annually. The Government claimed to recognise this point, and indeed set up the telecoms diversification taskforce over nine months ago. I have voiced concerns that this taskforce does not represent our whole country, or even the telecoms sector, but I welcome the report it published in April that identified the lack of joined-up thinking across Government as a potential barrier to diversification, with 20 different initiatives across different Departments that could contribute to diversifying the sector but had no effective overall responsibility or accountability. I hope the Minister will address that in his comments.
But the taskforce has yet to actually do anything, fund anything or get anything going. Nine months may not be long in ministerial terms, although not all Ministers last that long, but it is an age in technological terms. If the taskforce is going to move at this glacial speed, then we will have a single supplier telecoms supply chain embedded in our telecoms infrastructure within the next five years. Answers to parliamentary questions I have submitted show that none of the £250 million allocated to the taskforce has been spent, or earmarked, but we know there are small start-up suppliers in this sphere desperate for funding. We have innovative small businesses crying out for investment in Wales and the north-east, to name just two centres of excellence, so where is the investment to secure the future of these small businesses? Without it, the Government will not be able to achieve a diverse and resilient network.
That is why, as new clause 3 sets out, we need a reporting mechanism on network diversification, which is not mentioned in the Bill at all. Government inaction is putting our national security at risk. As I said, the 2019 telecoms supply chain review stated that there is
The Bill does not address that fully. During the evidence sessions, Emily Taylor stated that the Bill was very much
Dr David Cleevely was clear that
Yet so far we have seen no investment to support a diversified supply chain. The Opposition have argued throughout the Bill’s passage that the sweeping powers that it affords to the Secretary of State and Ofcom must be put under proportionate scrutiny. In addition to the scrutiny of the ISC, the new clause would enable that, because it would bring about a debate in the House updating it on the progress to and barriers faced in network diversification. The new clause would therefore provide accountability for the diversification strategy’s progress and lead to real action, not just talk.
We cannot have a secure network with only two service providers, and the removal of Huawei leaves the UK with, effectively, only two service providers. Reliance on two providers creates “an intolerable resilience risk”. Those are not my words but the words of the Secretary of State. The chief technology officer of BT Group, the director of emerging technology at Ofcom and the former head of cyber-security at GCHQ all think that reliance on only two providers presents a risk, yet the lack of a link between the diversification strategy implementation and the security of our telecoms networks is an ongoing cause for concern. Now we have the opportunity to put that right. We need a diversified supply chain, and that means diversity of supply at a different point in the supply chain and that different networks will not all share the same vulnerabilities of a particular supplier. That is incredibly important for network resilience.
The new clause provides a reporting requirement that is simply not there in the Bill, although the entire success of the Bill depends on diversification. I hope that the Minister will take this opportunity to correct that.
Finally, I want to say a few words about the Scottish National party’s amendment 1. It requires the Secretary of State to consult leaders of the devolved nations when carrying out reviews or drafting reports required in the Bill. Given that telecoms is not a devolved issue, I would hope that consultation with the relevant Ministers of the devolved nations was a regular occurrence. Following the success of the Welsh Labour Government’s superfast Cymru project and the above-average level of fibre connections to Welsh homes, I hope that the Government would listen closely to any advice offered them on telecoms roll-out.
The Labour party recognises that our telecoms networks will never be safe and secure unless every region and nation of the United Kingdom has a say in how we build out our networks. Under this Government, nine of the 10 worst connected constituencies in the United Kingdom are all in Scotland; if the Government ever wish to reach their broadband and 4G rural broadband connectivity targets, they must address connectivity blackspots in every nation.
A fundamental characteristic of being part of our United Kingdom is that there is a pooling and sharing of resource. Therefore, roll-out targets in the UK must apply to the whole of the UK—not just new Conservative constituencies or those that have the Minister’s WhatsApp details. The devolved nations should be consulted when key infrastructural decisions are being made, so Labour is pleased to support the amendment.
I will finish now by celebrating the potential of the UK telecoms sector and the benefits that digital innovation and effective government can provide to all our lives. If the first industrial revolution was powered by engines, the fourth is driven digitally. The Bill is an opportunity to set in motion a bright future for British telecoms, creating an environment in which telecoms providers, including a sovereign UK capability, with the right subsequent Government support, can grow and thrive.
Unlocking the potential of 5G will not only vastly improve our connectivity and web experience but support new enabling technologies—from the internet of things to artificial intelligence. But that will not happen by accident; it requires political will. We must get this right, and without oversight, diversification and an appropriately resourced regulator we cannot get it right.
As we all agree, our national security is priceless, but until we see a detailed plan, a proper impact assessment and an industrial strategy, we in the Labour party will remain deeply concerned that the Government are not prepared to make the interventions necessary to ensure that our national security is safeguarded. I encourage everyone to support our new clause and take the necessary steps towards unlocking the UK’s digital potential.

The Committee therefore welcomes this Bill, and the additional safeguards it provides. In presenting it on Second Reading, the Secretary of State assured the House:
That was a considerable advance on the coalition’s complacent response to our CNI report, which committed the then Government to do no more than “balance” economic prosperity with national security considerations. This change of approach and the Bill itself are thoroughly good news from the perspective of the ISC. Both the Secretary of State and the Minister, my hon. Friend the Member for Boston and Skegness (Matt Warman), have been exemplary in reaching out to the ISC, and what I am about to say in no way reflects on them.
The problem with this legislation lies not in what has been included in the Bill, but in what has been left out of it in terms of scrutiny. The Bill grants significant new powers to the Secretary of State to designate certain vendors as high risk, and to direct telecoms providers to abide by certain requirements about the use of equipment from such designated vendors. When the Secretary of State issues, varies or revokes a designation notice or a designated vendor direction, he will lay it before Parliament, except when this would be contrary to national security. That is entirely reasonable. None of us would want the Government to publish information that would damage national security; that would not be in the national interest. However, as in the case of the recent National Security and Investment Act 2021, it does mean that there is a significant gap in Parliament’s oversight of these new powers. That should concern Members on both sides of the House.
The logical solution would be for any designation notices or designated vendor directions that cannot be laid before Parliament for security reasons to be provided to the ISC, the body that was expressly created by Parliament to scrutinise national security issues that cannot be laid before Parliament. As Members will know, the ISC is the only Committee of Parliament that has regular access to protectively marked information that is highly classified for national security reasons. Amendments to provide for such scrutiny were tabled in Committee, but sadly, the Government did not support the principle behind them for reasons that are—I am sorry to say—entirely unpersuasive.
It is both puzzling and exasperating that the Government are yet again refusing to use the Intelligence and Security Committee for the purpose for which it was created. As I reminded the House on 26 April during consideration of Lords amendments to the National Security and Investment Bill, paragraph 8 of the memorandum of understanding between the Government and the ISC categorically asserts:
such as the Department for Digital, Culture, Media and Sport,
New clause 2, tabled by the Opposition, would fix the problem in this instance, but there is no sign of the Government’s being willing to accept it. I regret that: we should not be knowingly passing legislation that has holes in it. The Government should not be creating new powers, or new units within Departments—as in the case of the National Security and Investment Act—without providing for effective parliamentary oversight of them. As previously explained in considerable detail on 26 April, it is a physical impossibility for departmental Select Committees to fulfil that role, lacking as they do STRAP-indoctrinated and cleared staff and secure facilities, even if individual members may—very occasionally—be shown something classified.
Neither do assurances by the Government that the ISC is welcome to ask for information related to its remit from non-traditional national security Departments, such as BEIS, or in this case DCMS, offer any comfort. During the passage of the National Security and Investment Bill, Ministers repeatedly emphasised that
in that case the BEIS investment and security unit,
However, when we recently did precisely that and asked BEIS for information related directly to our remit, we received a response that was so dismissive as to border on the contemptuous.
The ISC was created by Parliament to oversee national security matters on its behalf. It should not be for the Government to deny Parliament’s intent. Paragraph 8 of our memorandum of understanding with the Prime Minister explicitly confirmed that that oversight extends to
If information relating to the use of the powers in the Bill cannot be laid before Parliament for reasons of national security, that information must surely be given to the ISC to scrutinise. Nevertheless, because the Bill is good legislation for which we have consistently called, the Committee will certainly not seek to impede its progress.
The National Security and Investment Act would have been lost entirely at the end of the last Session if the upper House had insisted once again on our amendments providing for proper ISC scrutiny. We were not then, and we are not now, in the business of seeking to scupper legislation that helps to safeguard our national security, but that does not mean that this serious scrutiny gap can be left unresolved. In our forthcoming annual report, we shall therefore ask the Prime Minister to agree an update to the ISC’s memorandum of understanding, in order for it explicitly to include oversight of these matters. I trust that by the time we lay our report before the House, we shall finally be able to announce a positive outcome.

I agree with the reference that my right hon. Friend the Member for New Forest East (Dr Lewis)—it is always a pleasure to be in the same debate as him—made to the ISC’s ability to scrutinise. I have a huge amount of time for him, as he knows, and we have debated some of this ad nauseam, but I do say to him that I think the Government will have to come back to this process. There is no question but that the parliamentary scrutiny process through his Committee—the ISC—will add value and strengthen Government legislation going forward. Even if the Government do not want to accept new clause 2, I hope they will come back to this issue in principle and use the Committee. That can only strengthen the provisions and counterbalance pressures that may exist from companies outside.
I agree that the Bill requires our support. Its main aims include strengthening the security and resilience of the UK’s telecommunications infrastructure—that goes without saying, and all these struggles over Huawei were just part of that process; giving stronger powers to the Secretary of State and Ofcom to enforce the new duties on telecoms providers to increase the security and resilience of their networks, which is also critical; and giving new national security powers to the Secretary of State to impose restrictions on telecoms providers, which I want to come back to. Those restrictions relate to the equipment from high-risk vendors.
I and some of my right hon. and hon. Friends tabled amendment 3, which I had hoped to be coming here to debate, but clearly it was not selected. However, I will speak to the principles of that particular amendment, if you do not mind, Madam Deputy Speaker—even though it was not selected, it is here in spirit. Amendment 3 would essentially have required the Secretary of State to make a designated vendor direction for any firm that was required to hand over its data to the Government or intelligence services of a foreign country. I wanted to be specific about that—using what was already in the Bill to force the Government to go a little bit further—because I think it is necessary.
That specificity is necessary because right now we are facing a number of particular threats. There are a lot of hidden threats behind the idea that companies, particularly from China, are independent of their Government. That is simply not the case. I cannot think of a single company registered in China—not Hong Kong, but China—that is not somehow linked directly to, or indirectly to but none the less under the control of, the Chinese Government.
It is worth repeating article 14 of China’s 2017 national intelligence law, which obliges all firms to give the Government assistance in areas of intelligence and national security if requested. This quote is a translation, so it may be slightly modified, but it may be useful. Article 14 states:
That is critical, because it requires those organisations to do whatever is required of them with regards to data transfer. It is peculiar in a way, and it would be peculiar even if it was dealing with Russia, but the fact is that it relates to China, which has a very much larger commercial base in all of these areas.
It is interesting to look back. Had other Governments, going back, further recognised the nature of what was going on, they would have seen that there is a strategic plan from the Chinese Communist party to dominate key commercial areas. For example, they own 85% of rare earth materials. Rare earth materials, as was said the other day, are the oil of the 21st century, without which we simply will not be able to operate. However, China does not stop there; it also owns the lion’s share of the world’s processing capability.
China strategically looks ahead. In telecommunications, we had 10 to 15 companies globally engaged in this area about 12 years ago, one of which was Marconi here in the UK. Today there are only three non-Chinese companies in existence that can build a 5G system. Not one of them, by the way, is in the United States; that tells us exactly how that market has been infiltrated and destroyed. People talked about market failure when we discussed the Huawei Bill. It was not market failure; it was the fact that a Government, with their institutions, had set out strategically to destroy a market and dominate it. That was one of the excuses used by my Government—that is, that we had no other option and had to go for what was there in the marketplace. Well, that has now changed, and I am pleased about that.
The amendment was necessary because, lying behind all this, is the real key, which is that these companies are not free and do not protect data in the way in which we would expect. Huawei is not alone, by the way. It is just one company, but there are lots of others—for example, ByteDance, which owns TikTok. I really question the degree to which that company owns that data now and is able to use it, and that is data on many people, particularly of our younger generation.
The requirements of the national intelligence law apply not just to Huawei and company, because those companies dominate the process that they are engaged in through dominating the data and through their use of that data, which is critical. I am pleased that, through this Bill, the Government are now demonstrating that they have absolutely got the point. I give credit to my hon. Friend the Minister, who has been honest and straight from the beginning of this process about his recognition of this particular problem.
Although that it now the case, we are but stepping tentatively in the direction of understanding these issues. I think the Trade Minister in the other place said that this Government were still determined to pursue deeper bilateral trade with China, while sanctions against many of our parliamentarians—myself included, but there are others here now—are in place. We kind of put that to one side and think that we can go ahead with trying to make these deeper relations with China, notwithstanding the fact that we also recognise that it is a remarkable threat. I simply do not understand how we square those two things and get on with it. [Interruption.] Does my hon. Friend the Member for Wealden (Ms Ghani) wish to intervene?

Perhaps I can make the point this way: as we come out of covid—thank God that is where we are going—we will see a tourism boost in the United Kingdom, but if the tourism providers in my constituency and remote parts of Scotland are to compete on a level playing field, surely they have to have the connectivity that is enjoyed by other businesses in other parts of the United Kingdom. That is one argument. Secondly, and sadly, there will be another pandemic one day. One of the means by which we can beat off the pandemic is by being very clever indeed, and when it comes to the provision of NHS services and so on, connectivity has a part to play in that as well in my constituency. I will rest my case there, but I believe that whatever the United Kingdom Government can do to work with the devolved Government in Scotland to get proper connectivity in my constituency and other parts—we have very few Gs at all in some parts—and to get up to 5G would be so welcome and so important to my constituents.
I will end with a point that the shadow Minister made. I very much agree with the notion that Ofcom will face considerable strain. This is about confronting the known hostile nations, but this is a changing world—it is changing ever more rapidly—and new threats and new challenges will emerge. Ofcom will have to be very nimble on its feet to deal with that, and that will require the necessary resources, so we look forward to seeing what the Government’s reply will be on that front. Essentially, this debate has been an example of Parliament changing the mind of a Government. The point that has been made about the Intelligence and Security Committee is absolutely correct. Parliament does have a role to play and I very much hope that the right hon. Member for New Forest East (Dr Lewis) and his Committee will have a role to play in future.

Every day, every week, there are attempts to break or breach the information and communications systems on which so much depends. The fragility of the modern world, as the resilience provided by the eclecticism of local and national means of gathering, storing and exchanging information has been eroded by global interdependence and, in particular, by technological interoperability, has left us more vulnerable to attack from hostile state actors or, indeed, other groups—serious and organised criminals. So, the need for safeguards that guarantee our security could not be more pressing or clear.
In that spirit and to that end, this legislation is very welcome. The Bill strengthens the security framework used for 5G and full-fibre networks. It will protect the UK from hostile state cyber-activity and other activity of that kind, and we need protection, because we know from the evidence that attacks from Russia, China, North Korea and Iran have been recorded in recent times. The Bill will also provide new national security powers to issue directions to telecoms providers to manage the risks of high-risk vendors. Incidentally, that extends beyond the existing restrictions—which in essence relate to the most significant parts of systems and the most sensitive areas—to all goods, services and facilities.
Just as there should no longer be any doubt about the damage done by lazy liberal assumptions about globalisation, there must be no complacency about the virtues of the suppliers of telecoms, hardware, software and services, or those who manage them. That they can themselves provide a threat to the way we communicate, to our infrastructure and to all that we now do in our country is without doubt. Indeed, I would go so far as to say that the unaccountable power of corporate monopolies is one of the most sinister features of the way we now live. That is not just my view; it is the view of the chief of MI5, who recently said that Facebook had given terrorists a “free pass” by allowing stronger encryption on its network. Mr McCallum said that social media giants’ plan to install end-to-end encryption would block hundreds of counter-terrorism investigations by the security service. He said:
The effects of what Facebook are doing—I suspect they will do still more of it—will inhibit the powers of those that we mission to keep us safe. It is as simple as that, so let us have no naivety or complacency about what those organisations are about or their willingness to act responsibly. Neil Basu, the National Police Chiefs’ Council lead on counter-terrorism, echoed those sentiments. He said that if Facebook pressed ahead with its plans, it would “put privacy before security”. While Mr Basu might be confused about the institutionalised racism of the Metropolitan police, he is not confused about this—he is absolutely right.
The reality of hostile state cyber-activity is beyond doubt. For example, in 2018, the Chinese APT10 group attack on global networks, also known as Cloud Hopper, targeted a range of companies, including in the aerospace, defence, telecommunications, professional services and utilities sectors and many others. It was one of the most significant and widespread cyber-intrusions against the UK and allies uncovered to date, targeting trade secrets and economies around the whole world. I could cite many similar examples, but I think the case has already been made by other contributors to the debate, particularly my right hon. Friend the Member for Chingford and Woodford Green (Sir Iain Duncan Smith).
The pressing need for the Government, as well as ensuring that safeguards are in place, is—as their own supply chain review acknowledges—to diversify the suppliers in the market. The Government have concluded that the only way to address the risk is to introduce national security powers to allow them to
It is also important to acknowledge that without an effective diversification strategy in place, we will not have a secure network. As the ISC highlighted in July 2019, the diversification strategy is therefore the most critical action to ensure our security now and for the future. The issue of national dependence goes beyond high-risk vendors. I hope that when the Minister winds up he will say more about diversification, because our most pressing requirement is not to allow ourselves to become dependent on single vendors; the case has already been made about the existing vulnerability that Britain endures in that regard.

The Bill says that when a Secretary of State issues, varies or revokes a designation notice or a designator vendor direction, he or she will lay that before Parliament—good, so far—except in cases when that would be
or when there were details prejudicial to commercial interests. Those might be excluded from documents laid before Parliament. What? That could mean that we parliamentarians had no oversight whatever of such activities. Are we really going to be debarred from such knowledge?
I wish now to highlight a few of the problems that I foresee—not just because I am a member of the ISC but because I have handled highly classified information in the past. As we have heard, the Committee of Parliament that has regular access to top secret—and above—information is the Intelligence and Security Committee. Its members are subject to section 1(1)(b) of the Official Secrets Act 1989. Have I got that right?

New clause 3 requires the Secretary of State to report on the impact of the Government’s diversification strategy on the security telecommunications network and services, which of course they will do, so I agree that the Government do not need to be dragged back to the Dispatch Box on this. Again, I am with the Government on new clause 3. I can see the merits of amendment 1 on consulting with the devolved nations, which, of course, again, the Government will do. National security, as we know, is a reserved matter under the devolution settlements in force, so, again, I am happy that the Government have got this right.
On amendments 2 and 3, the Government have every intention of seeking the advice of the UK security and intelligence services, in particular the National Cyber Security Centre, so again, while the amendments have merit, I am completely with the Government on this.
In conclusion, my sense is that the new clauses and amendments that we have discussed today do have merit, and I note that the Minister has noted them. Again, we discussed these issues at length in Committee. It is a good Bill and I will be voting it through this evening.

The list of Members currently certified as eligible for a proxy vote, and of the Members nominated as their proxy, is published at the end of today’s debates.
Brought up, and read the First time.
Question put, That the clause be read a Second time.
The list of Members currently certified as eligible for a proxy vote, and of the Members nominated as their proxy, is published at the end of today’s debates.
Brought up, and read the First time.
Question put, That the clause be read a Second time.
The list of Members currently certified as eligible for a proxy vote, and of the Members nominated as their proxy, is published at the end of today’s debates.
Third Reading