---

National Security Strategy

At 10 o'clock this morning, my right hon. Friend the Prime Minister made a written ministerial statement, in which he laid before the House this year's update to the national security strategy. Accompanying the strategy was the first national cybersecurity strategy for the United Kingdom. Last week, the Government presented to the House the "Digital Britain" strategy. This country is well placed to take advantage of the opportunities of the digital age, but we can seize those opportunities only if people are confident that they can operate safely in cyberspace. Every day, millions of people across the UK—our constituents—rely on the services and information that make up cyberspace. Indeed, 65 per cent. of UK households have access to the internet, and the figure is growing by about 8 per cent. a year. The national security strategy, published for the first time by the Government last March and updated this year, sets out an honest and transparent appraisal of the risks that we face, including the threat that organised crime poses to our country. Organised crime costs us around £20 billion a year, and we have a duty to the British public and to British industry to take measures dramatically to reduce that cost. The Government also need to assess the threats from terrorist organisations and prepare our response to them; the public would expect no less. All those threats can arise in cyberspace. As the director general of the Security Service has said, a number of nations and organisations are""trying to obtain political and economic intelligence at our expense"" and""increasingly deploy sophisticated technical attacks, using the internet to penetrate computer networks."" We know the importance that terrorist groups, notably al-Qaeda and its affiliates, place on the internet and cyberspace, which are particularly important for propaganda reasons. We know that terrorists would like to be able to operate more effectively in cyberspace. I am not scaremongering, but we need to look at the issues. Our assessment at present is not that terrorists have the capability to mount attacks imminently, but that we must honourably prepare as terrorists become more sophisticated. Such threats from states or terrorists could affect critical national systems, but there is also a real threat to millions of ordinary citizens—our constituents—as well as their transactions and the businesses for which they work. Online fraud generated some £52 billion worldwide in 2007. The average cost to companies of information security incidents is in the range of £10,000 to £20,000. For a large company, the cost can be as high as £1 million to £2 million. As the dependence on cyberspace grows, we need to ensure security, which is critical to the health of the nation. As I mentioned, today the Government published, in a written ministerial statement made by my right hon. Friend the Prime Minister, the first cybersecurity strategy. As a result, we will establish an office of cybersecurity in the Cabinet Office to lead on cybersecurity policy issues, and a cybersecurity operations centre, a multi-agency body, based alongside GCHQ in Cheltenham. That organisation will lead on operations and technical capabilities, which we will examine. As a result of the new strategy, we will develop a cyber industrial strategy for the UK's critical security needs, in the same way as we have a defence industrial strategy; we will develop cybersecurity skills for the UK, plugging existing gaps and creating more high-tech employment opportunities; we will make critical systems in the public and private sectors more resilient and enhance our ability to detect attack; we will develop international law and doctrines of national defence in cyberspace, working with other countries; we will consider better advice to business and citizens about the security-risk picture and the steps that they need to take to address it; and we will develop new strategies for tackling terrorist and criminal use of cyberspace with our colleagues in the Association of Chief Police Officers and its strategy on cybercrime, which is due out shortly. We plan emergency responses, and the new centre will test the UK's ability to respond to major attacks, which we obviously believe that we can prevent, but which we need to consider. As with our national security, it will be important that the Government's powers are used proportionately and in a way that is consistent with civil liberty issues, as I know the hon. Member for Reigate (Mr. Blunt) would wish. So, from today, we will establish an ethics advisory group to advise on that issue, and I shall update the House on its membership when it is formed. The centres will be operational in September, and new funding will be announced before then to meet their obligations, building on existing resources that were allocated largely to intelligence agencies. Again, I shall report back to the House on those matters. The wider national security debate is important, and the Government have taken forward the good start that was made last year. We look ahead to the broad range of national security threats, and we look at how we can prevent them. Today, we have set out in the documents an updated analysis of the threats that we face, made commitments on what drives insecurity in the world—on conflict, energy, poverty and the impact of climate change—and published the cybersecurity strategy, which I hope will be the subject of some debate and interest. Britain depends very strongly on the dedicated work of the armed forces, the intelligence services, the police and other services in the support of those strategies. I pay tribute to them all for the courage that they display every day of the week in often very difficult circumstances. I commend the document to the House and hope that the written ministerial statement from my right hon. Friend the Prime Minister will be read with interest by right hon. and hon. Members from all parts of the House.