---

Internet: Personal Security (S&T Report)

rose to move, That this House takes note of the reports of the Science and Technology Committee on Personal Internet Security (5th Report, Session 2006-07, HL Paper 165-1) and Personal Internet Security: Follow-up (4th Report, HL Paper 131). The noble Lord said: My Lords, those of us who are regular computer users—I think that we are now a majority, even in this House—have for some years been watching with alarm the increase in the criminal use of the internet, and have been especially worried about the impact that this has had on non-expert users. In 2006 that concern led the Science and Technology Select Committee to decide to conduct an inquiry into personal internet security. The report from the inquiry was published in August 2007. In October 2007, we received the Government’s response to our report, which we were disappointed to find was extraordinarily complacent. Few of our recommendations were accepted and, indeed, the Government did not even agree with us that abuse of the internet was a significant problem. As the committee was not satisfied with this response, a follow-up inquiry was launched in February 2008. It was chaired by my noble friend Lord Sutherland. As part of this follow-up, the committee asked those who had given evidence in the original inquiry to comment on the Government’s response. After receiving these comments it took evidence from two Ministers involved in policy on internet security. Mr Vernon Coaker, then Parliamentary Under-Secretary of State for Crime Reduction in the Home Office—I would like to congratulate him on his recent promotion—and the noble Baroness, Lady Vadera, Parliamentary Under-Secretary of State for Business and Competitiveness at BERR. We were gratified to learn from the Ministers that the Government’s view had changed and that they were now taking a more positive view on our recommendations. Mr Coaker acknowledged that the follow-up report had prompted them to rethink their response. He said that the report had helped to drive the agenda forward and that reconsideration of the evidence had reinforced progress. However, it was clear from the input we received from the witnesses that there was still much to be done. In this connection we were pleased that Mr Coaker offered to keep the committee informed every two months. We were grateful that he held to this commitment and the committee was pleased to receive his reports in July and September. On behalf of the committee I would like to thank Mr Coaker and the noble Baroness, Lady Vadera, for working so constructively with the committee. Before moving to the substance of my remarks, I would like to thank those who supported our inquiry. First, I acknowledge and thank Dr Richard Clayton, our specialist adviser, who is one of the world’s leading authorities in this field and who has the added talent that he can explain the complexities of the internet in terms that non-experts can understand. His advice and his contacts were invaluable to us. I also thank Christopher Johnson, who was clerk to the original inquiry, and Christine Salmon, who was clerk to the follow-up inquiry, and the staff of the committee who expertly co-ordinated the taking of evidence and organised our visits, especially the very valuable visit we made to the USA, and who wrote the clear and concise drafts from which the final report has emerged. I also acknowledge the contribution of committee members who participated in these inquiries and who brought a broad range of expertise to bear on the issues, some of which were of a highly technical nature. I do not intend to go through all our observations and recommendations—they are laid out clearly in the report—other than to say that we still support all of them. I will instead concentrate on those I consider most important and that remain outstanding. Last week the committee was pleased to learn that the Government were going ahead with our recommendation to establish a specialist e-crime police unit, although it is not clear how the £7 million that is to support this unit is to be spent. We would appreciate the Minister telling us more about that. I seek reassurance that the important expertise that this unit will provide will be available to police throughout the UK, and that something along the lines of the regional centres of expertise set up by the FBI in the USA will be replicated here. Important issues remain unresolved, such as the responsibilities of the banks. It is anomalous that the banks in the UK are not obliged by law to refund those who have been defrauded by electronic means. The banks set up schemes to avoid fraud, but when these fail they determine whether you have been defrauded. It is true that in the majority of cases they refund the money of people who have been defrauded, but they do this only under the voluntary Banking Code. Why are they not obliged to do this by law? In effect, we are being asked to put the banks in the special category of trusted institutions. In today’s environment this is scarcely appropriate. I suggest that we should watch them closely and regulate their responsibility to pay up when their anti-fraud schemes fail. We should introduce legislation equivalent to the Bills of Exchange Act 1882, which specified that if a bank honoured a forged cheque, the bank, not the customer upon whose account the cheque had been drawn, was liable. The Government tell us that when we are defrauded we should report not to the police but to the banks. This is aimed, apparently, at reducing police bureaucracy. However, it is not in the banks’ interests to draw attention to the fact that their anti-fraud systems have failed, so they hope that the volume of fraud will not be too high and that they can absorb the losses. They remain silent and the crime is seldom, if ever, reported to the police. I tabled a Question for Written Answer on this topic that was originally aimed at discovering the fraction of cases of electronic fraud reported by customers to banks that the banks had passed on to the police for investigation. I was told that this Question could not be answered because the Government grouped together online credit card and cheque fraud and did not separate out fraud reported by banks from that reported by individuals and merchants. Therefore, the noble Lord, Lord West, gave me the total number of cases of fraud from all sources reported to the police, thereby revealing that the Government have no comprehensive data on online or credit card fraud. If you are defrauded via your credit card in the USA, your bank will not consider your case until you have reported it to the police and have sent it a copy of the police report. This enables the police to record and collate the information. If it is established that you have been the victim of fraud, under law the bank must refund you all but the first $50. In practice, they refund everything. The bank sends the information to the Federal Trade Commission, thereby ensuring that the Government have a record of all such electronic crimes and can monitor their growth or decline. The Government rejected our recommendation that a cross-departmental group, bringing in experts from industry and academia, should be established to help gather and classify all forms of e-crime. In practice, data exchange over the internet and the storage of data are highly technical matters; they are so technical that very few people understand all the complexities of routing, encryption and decoding, and are therefore in a position to predict where the criminal experts are likely to practise their art. Why are the Government resisting our recommendation? Do they think that they can do it themselves? The number of cases in which there have been losses of data from government and military organisations has been so large—there has been yet another today—that surely, had it occurred in the 1880s, it would have been the plot for a Gilbert and Sullivan opera. Do they really think that they can cope without advice? Why have they not accepted our recommendation to set up the expert group? I reinforce our recommendation that a data security breach notification law be introduced. The Government, fortunately, seem eager to admit their losses, but this is not the case with the banks and with industry. They, too, should be required under law to inform people when their personal data have been lost and they are therefore put at risk. Finally, I will talk about the responsibilities of the network providers and the internet service providers. We recommended that the Government and Ofcom engage with the network operators and the ISPs to develop higher and more uniform standards of security in the industry. In particular, we recommended the development of a BSI-approved kitemark for secure internet services. Their response was that kitemarks were for products, not services, an out-of-date distinction in my mind, and went on to say that in any case this was up to industry, not government, and besides it was clear that the review of the EU regulatory framework for communications providers would address security and consumer issues and it would be unwise to do anything before the requirements of the European legislation had been clarified. Has there been any progress in Europe? How long are we prepared to wait before we do something ourselves? Another aspect of the responsibilities of ISPs is whether they should be held responsible for the consequences of passing on false and damaging information. Sir Timothy Berners-Lee recently expressed concern over such misuse of the web. He was troubled by its use to spread fears that flicking the ““on”” switch of the Large Hadron Collider could create a black hole that would swallow up the earth. He had also been troubled by the misinformation that had been spread over the web that the MMR vaccine was harmful. He told BBC News that there needed to be new systems that would give websites a label of trustworthiness once they had been proved to be reliable sources. The label sounds rather like a kitemark to me. He went on to discuss the difficulties that this would present, but none the less he felt that it was important to find a solution to this problem. Sir Tim’s World Wide Web Consortium, which has been strongly opposed to any controls being placed on the web, has changed its position on this. This is another example of how the headlong pace at which the web is growing challenges existing norms and requires new mechanisms for control. Can the Minister reassure us that the Government are putting in place the capability to react in time to threats that the relentless increase in the use of the internet presents, both with regard to the spreading of misinformation and ensuring that personal data are held securely? I beg to move. Moved, That this House takes note of the reports of the Science and Technology Committee on Personal Internet Security (5th Report, Session 2006-07, HL Paper 165-1) and Personal Internet Security: Follow-up (4th Report, HL Paper 131).—(Lord Broers.)