Contribution
I refer Members to my registered interest as parliamentary chair of the Campaign for Secure Technology, which I thank for its work in preparing my two amendments as well as my speech.
I echo the comments of my hon. Friends the Members for Leeds Central and Headingley (Alex Sobel) and for Newcastle upon Tyne Central and West (Dame Chi Onwurah) about the scale of the threat that we face from cyber-attack. We must ensure that we are having that national conversation about the nature of the threats we face, and who those threats come from. In many ways, this country is already in conflict with Russia, and in more than what we could call competition with China—something that the public are not fully aware of. We must do more to ensure that they are fully aware of that threat, and that they hold our feet, and those of the Government, to the fire, and ensure that we are taking the kinds of measures in this Bill, and beyond, that we need to protect our economy, our military and our democracy more widely.
I will limit my remarks to amendments 4 and 5, which I tabled. It is always difficult to speak at this point in a debate, because people with far more experience and knowledge than me have said a lot of the things that I was planning to say, and have done so with far more eloquence and knowledge than I have. Amendments 4 and 5 seek to deal with part of our digital infrastructure that is almost entirely invisible to the public and rarely discussed in Parliament—other than this afternoon—yet is essential to our national security: cellular internet-of-things modules. As my hon. Friend the Member for Warwick and Leamington (Matt Western) described, cellular IOT modules are small electronic components, about the size of a credit card, and they allow a device to connect to the internet over a mobile network. They sit inside everything from smart meters, CCTV cameras and traffic lights to industrial sensors, medical devices and parts of our energy grid. They are the connective tissue of our modern digital economy, and we all rely on them every day. Despite their importance, however, very little is known publicly about what they do and the potential harm that they could cause.
Today, more than 70% of all cellular IOT modules used globally are manufactured in China, and that dominance creates strategic vulnerabilities that the Bill must address. Amendments 4 and 5 would ensure that the Bill covers the risks created by embedded communications components manufactured outside the UK. Amendment 4 would ensure that the Secretary of State can treat the provenance of those components as a cyber-security risk, and amendment 5 would allow Ministers to require operators of critical systems to identify and mitigate those risks. In short, the amendments would give the Government clear authority to act where foreign-made modules create known vulnerabilities.
Why is that necessary? Because the modules present three major security threats. The first is dependency. When one country controls the overwhelming supply of a critical technology, that is by its nature a structural risk. If supply is disrupted, whether for geopolitical leverage or commercial pressure, our energy systems, transport networks and emergency services could be left without essential replacement parts. We have already seen that threat with Huawei and our 5G network—a mistake we must not repeat.
The second reason is disruption—as colleagues have said, that is increasingly referred to as the “kill switch”. Internet-of-things cellular modules contain firmware that can be updated remotely. If a manufacturer is subject to state influence—and in China we know that they are—it could insert a kill switch or back door that allows it to disable devices at scale and at will. It could push out malicious updates, insert malware or remotely disable devices. That could mean vehicles being turned off, cranes and industrial machinery being halted mid-operation, or financial terminals suddenly going offline. We could even see disruption to areas such as NHS refrigeration, affecting drugs and blood supply.
The concern with that type of module is that it might not happen overnight or be something we immediately see. It could be hidden for a number of weeks or months in different technologies and across different parts of our economy, and it would be incredibly difficult—nigh on impossible—to prove exactly what had happened and who had done it, and to tie it to any one state actor with certainty. It is certainly not something that could be done quickly, allowing for a full response. As my hon. Friend the Member for Warwick and Leamington said earlier, there are a number of examples of that from around the world. Perhaps the best known was when Russia invaded Ukraine in 2022 and tried to steal more than two dozen John Deere tractors and ship them to Chechnya. The US company intervened to switch them off. It remotely locked the thieves out of the equipment, rendering the tractors useless. That is the kind of action we could see China take in the event of a future crisis.
Closer to home, my hon. Friend the Member for Warwick and Leamington mentioned that Norway tested two of its Chinese-designed electric buses, one manufactured in the Netherlands and one built in China, to discover exactly the same kill switch technology.