Lord Fuller (Con)

My Lords, I will speak against Amendment 367. I have the gravest concerns about it. I am not going to echo everything my noble friend Lady Coffey said, but it amounts to a hackers’ charter. I take security and IT security very seriously. I am responsible for IT security in my business. We are in a sensitive industry—we are involved in global trade—never more so than today, when ammonia and natural gas are under global pressure as part of a war. You have to take these things seriously. When I joined your Lordships’ House two years ago, there was a briefing and I was pleased that I was one of a handful of Peers and MPs who had a password manager. Every password I have is at least 16 characters—they are random and not one is repeated. You have to take this stuff seriously—no pet names, not using your wife’s name or possibly a wedding anniversary. Using a VPN is important as well. No matter what precautions you take, however, someone is always going to have a go. What this amendment does is give the malevolent hacker a free pass to get through: a ready defence. It is not just that. We need to recognise that technology is changing all the time. All the things I may do with passwords are not enough. Even using face, voice, biometrics and two-factor authentication, cloned SIM cards or using public wifi to intercept signals are important ways in which even the most diligent and careful person can have their data compromised. There are people who want to abuse your privacy or insult your business. We can simply create a crime, but we must take a huge number of steps to avoid jeopardy or giving them a “get out of jail free” card. In my view, this amendment would mean that, if somebody finds something, they get off, but if they do not find anything then they are guilty. All those years ago when I was at school, we were taught about trial by ordeal. If you gripped a red hot iron bar and you got blisters, you were guilty; if a lady was put on the ducking stool and she drowned, she was probably innocent. This is the sort of perverse outcome that this amendment would provide. Further, it denies how technology is changing in so far as AI is concerned. In our minds, we have a spotty teenager hacking away at their computer, perhaps late into the night while playing Fortnite on the other screen. What this amendment does is give an opportunity for AI, mechanisation, and the industrialisation and automation of structured hacks on a phishing expedition—a mass insult or mass trolling to try to scrape as much as they possibly can. The public interest is in the eye of the beholder, and because there is no pure definition that is challengeable, and so one would have to go to the law or ask international lawyers what amounts to a statement of the law, we are going to get in a muddle. I cannot support Amendment 367, not just because I think it is naïve, in so far as it is thinking about the individual at home, but because it fails to understand the way that technology is changing so rapidly—the industrialisation, AI and so forth, and the volume attacks. We cannot give a perverse incentive that allows those people with malevolent intent to get off while individuals, business and the economy, at home and abroad, are under attack.