---

Internet: Personal Security (S&T Report)

My Lords, I, too, thank the noble Lord, Lord Broers, for introducing this debate and also for the seminal part that he played in the work of the committee in this area. We were very fortunate to have him and others in our team. Sometimes the House of Lords is represented as being at some distance from real life. That is the perception that many have of us—they see pictures of ermine and all sorts of things. I dispute that view and cite as evidence this report and the follow-up report. We hit the target. We were right on track for the central issues in our society and have raised some fundamental questions, and I want to go through one or two of them. Of course, another criticism of the House of Lords is that it ignores the elephant in the room and concentrates on details. The elephant in this Chamber, in the Chamber down the way and in many other rooms at the moment is the position of the banks in our society. Paragraph 20 of our follow-up report reads: "““Professor Ross Anderson … and Nicholas Bohm … in their follow-up submissions are critical of the Government’s reliance on the banking industry””." Of course, we see the wider context for that but there is also a very specific context in relation to the focus of this report. Why is that so? Internet trading and purchase, which now form a significant part of our economy, depend on confidence and trust in a variety of ways but specifically, as we informed ourselves very clearly, they depend on confidence and trust in the processes employed by the banks and in the priority that they give to personal internet security. Every purchase online, every purchase of a ticket for the theatre or a train, or every purchase on eBay depends on one’s credit card functioning well and securely. A central question which we raise here is the role that the banks must play in future in guaranteeing the security of the information that flows so regularly and freely down those channels. I quote again from paragraph 25 of our follow-up report: "““A system which depends on a decision by a bank on whether or not a customer has been defrauded is flawed by the fact that the bank has a direct financial interest in denying the customer’s claim””." We have learnt to be more careful about the reassurances given by banks. That is fundamental. My noble friend Lord Broers made the point so well that I need not elaborate on it. That is the elephant in the room today and relates to our report and to our concerns. Do we have confidence in the systems of the banks? Would that confidence be greatly increased if the banks were to be more transparent in reporting computer and internet fraud and in reassuring customers that they had this as a high priority in the processes which they put in place? I want to comment on the government response to the original Select Committee report. We reported in July 2007 and the Government responded in October 2007 in a written reply which I regard as something of an own goal—what Harold Macmillan taught us to call ““Events, dear boy, events””. The government response was effectively a brush-off and it was complacent. Since then we have had the loss of personal data from Her Majesty’s Revenue and Customs which resulted in 25 million individuals being exposed; further revelations from the MoD today concerning 100,000 personnel, plus 600,000 potential recruits and the loss of security information; the Driver and Vehicle Licensing Centre; and so on. The record of the Government on this is not good and, in the eyes of the committee, those failings became failings in capital letters, following as they did the Government effectively saying they had no concerns or worries about the issues raised by the report. Of course, it is a mistake to refer to these as just, ““Events, dear boy, events””, out of the blue and not their fault or responsibility, because they represent massive failings by public bodies on which we, the citizens, rely with regard to the security of personal information. They are not events over which we have no control, but the point of much in our report is that the Government must take charge of this, ensure that the controls are in place and that the information that we either reluctantly, in some cases, or freely give to these government sources is protected and that our personal information does not become a matter of the public market place. We passed through the stage of thinking of them as events some way back. The government systems, as I have suggested, seem to be badly flawed. However, we are proceeding down the line. Consider ID cards and the databases required to service that policy. I am not discussing the policy of having ID cards, as that is a matter for another day and another debate, but I am simply alerting the House to something of which I am sure it is already well aware: that the protection of the information to be held in connection with that policy must have a very high priority indeed and, in view of what has happened, reassurances and words will not do. These examples—and one could add NHS information to them—indicate why the committee decided that the follow-up analysis and report was justified. The general picture is the initial report, a brush-off reply by the Government, the events—as I call them—and a follow-up hearing by the committee. To be positive, because so far I have been critical of the Government, we had a good and, on both sides, helpful discussion with two Ministers, Vernon Coaker and the noble Baroness, Lady Vadera, on 20 May 2008. There were at least two outcomes of that discussion which I regard as positive. The first was a commitment by Vernon Coaker to write update reports every two months. We have received the first two, and they were helpful. I look for more, but they are good start and a positive response that matches the contributions that the Ministers made to our discussion. The principle of such reports is important and is much appreciated by the committee and more widely. More updates are anticipated. The Council of Europe Convention on Cybercrime was signed in 2001, but it has yet to be ratified by this Government. In the discussion, we were promised that ratification will take place before the end of 2008. We had our two-monthly update in September and the next is due in November. I hope that there is some indication that before the end of this year action will be taken. That is just one example. There are many examples of where updates and expansions of what we have already been told will be useful. A second outcome is that the full Science and Technology Committee has underlined its determination to be a scrutinising committee that will hold the Government to account in those areas where science and technology affect government policy and practice. It will do that and will follow up. It will not simply send reports into the ether to be left there. This is simply a marker to the Government that, as regards this and other reports, the committee will expect responses of the desired quality.