---

Internet: Personal Security (S&T Report)

My Lords, when I was allotted the privilege of responding on behalf of the Government to the distinguished report written by a distinguished group, I admit that I felt some trepidation. After reading the report, the trepidation increased. After hearing the contributions to the debate, the trepidation has continued to increase, but for a variety of reasons. One of them is due to the speed at which the internet develops, as has rightly been said. A number of issues raised in this debate developed after the report—indeed, after government action. That development will continue. Therefore, the ability of the human process—whether it is the legal process or the commercial process—to keep up to speed with changes is a challenge to us all. The Government welcome the report and this debate. The report comes at a time of growing interest in the safety of individuals and their information on the internet, and is a very valuable contribution to this broad, continuing and, perhaps, endless debate. The Government beg forgiveness—at least I do—if their first response to the report was seen to be, or was thought to have been, insulting in any way. It was never meant to be. I would view this report as being a spur to the Government and a challenge for us to recognise, as a Government and an Administration, the need to protect the public. It is clear from the take-up of broadband access across the UK, and from the growth in online commerce, that the public to a large degree is comfortable in using the technology and increasingly enjoys the services available. However, the Government are not, and cannot be, complacent about the risks to the public, and have taken legislative and organisational steps to ensure that the public can have confidence in the internet and is protected from harm. Many of the comments in this debate and in the report are requirements that we give force to that statement in terms of legislative and other measures. The Government’s response to the threat to the safety of the public and business has grown, and will continue to grow, as the use of the internet has risen and continues to rise. The noble Lord, Lord Mitchell, vividly reminded us of that in terms of the speed of developments. It affects all areas of society. We should seek to increase protection of our population through the development of legislation, the provision of specialist law enforcement bodies and co-operative working within the UK and internationally. The Government welcome the recognition in the report that the problems of making the internet safe cannot be addressed by government, or by any other group, alone. It is vital that all relevant sectors of society work together to ensure that the internet is as safe as possible and that information is available to the public to empower it to protect itself. The Government and the agencies for which they are responsible work with a number of different groups to support work on internet security. We are working with the internet crime and disorder partnerships, established through EURIM, which brings together government, Parliament and civil society. Some noble Lords will be familiar with many of the acronyms in this area. In this debate, I have heard many other acronyms used by the internet and the computer industry. When information technology meets the Civil Service, perhaps the slogan might be, ““Acronyms rule OK””. Therefore, one should not seek to use acronyms, where possible; but I am afraid that on this occasion there are so many acronyms that it is impossible to do otherwise. The importance of the partnership through EURIM and the collaboration of industry, government, Parliament and civil society is that they will develop a co-ordinated approach to online crime and establish a co-operative regulatory framework for the internet, capable of adapting with the necessary speed and flexibility required in this rapidly changing area. The challenge set by many noble Lords is to see whether the Government are capable of keeping up the speed and degree of flexibility that we require. In the eyes of the Government, it is one of a number of vital and complementary initiatives that we need to tackle general electronic crime, alongside the law enforcement response provided by SOCA e-crime, the Police Central e-crime Unit and the National Fraud Strategic Authority—three very important bodies. The Government recently sponsored the Byron review, which considered how children can be protected on the internet and made a number of recommendations, all of which the Government accepted. The key recommendation was that the UK should establish a forum that brings together government, law enforcement, industry and the third sector to look at how the internet can be made as safe as possible for children. On 29 September, the Prime Minister launched the UK Council for Child Internet Safety. I am very pleased to report that there has been a positive response from all sectors and that well over 100 organisations have applied to join the council, showing that there is a broad commitment across society to support safety for children. The Government strongly support the work of Get Safe Online, which brings together industry and law enforcement to provide safety information to the public and industry. We believe it is right for government to work alongside industry: by working together they will help to ensure that people are kept safe and are empowered to stay safe online. Additionally, officials from the Department for Business, Enterprise and Regulatory Reform are committed to working with representatives from the Internet Services Providers’ Association to achieve this. We hope that over the coming months we will see a serious elevation of the debate on the clear and consistent role that industry can take to demonstrate the protection it is offering, with advice on how people can protect themselves online. In that context, there is nothing like a personal interest to bring about concentration on a piece of legislation. This morning, I received a letter from my bank telling me that in the course of an hour someone had attempted to use my details to purchase about £1,200-worth of goods in Venezuela. The impressive thing about that is that fortunately the bank refused to accept any of the transactions and has now written to me saying that it suspects fraud. Nothing like this has happened to me before, and that incident demonstrates the risk but also the comfort that can be gained from efficient and effective protection—in this case, from my bank. Earlier this month, the Government brought into force changes to the Computer Misuse Act 1990 that increase the maximum penalty for the Section 1 offence of unauthorised access to computer material to two years to better reflect the seriousness of such offences. The changes also ensure that the offence is extraditable, which, in the international context, is very important. Similarly, we have increased the maximum penalty for the Section 3 offence of unauthorised modification of computer material to 10 years. We have broadened the definition of the Section 3 offence to clarify that all means of interference with a computer system are criminalised, and in particular to ensure that adequate provision is made to criminalise all forms of denial of service attacks—a matter raised by several noble Lords—so that they can be better dealt with. We have also created a new offence of making, adapting or supplying articles for use in computer misuse offences to discourage the market in the production and distribution of hacking tools. We believe that these changes have ensured that the legal framework to tackle offences on the internet is robust and relevant. In 2006, the Government set up the Child Exploitation and Online Protection Centre, or CEOP, to protect children from those who would seek to harm them online. CEOP has grown into a world leader and has had remarkable success in rescuing children, arresting offenders and building relationships with law enforcement in the UK and overseas. CEOP has also developed a widespread educational programme for children and parents, which allows children to understand the risks on the internet and to protect themselves from harm. The noble Viscount, Lord Bridgeman, raised the question of the police e-crime unit, which has now had funding approved. It will be hosted by the Metropolitan Police and will co-ordinate activity across the police service to tackle cybercrime. A theme from today’s debate is the need for interaction and co-ordination between agencies, police forces and others, so that they work together, without overlap, in dealing with this problem. The unit will provide support and advice to the National Fraud Reporting Centre on electronic fraud reported to the centre and will respond to intelligence packages produced by it. While the unit will not investigate every electronic fraud, it will work to tackle major frauds and bundles of smaller frauds that are assessed as being the work of one person or group. The unit will also work across the police service, in co-operation with the National Policing Improvement Agency, to develop the overall response to electronic crime and to ensure that police officers have adequate knowledge and training to tackle such crimes—another important point made by noble Lords. The Government also support the SOCA e-crime unit, which is dedicated to tackling organised crime groups that operate online. We will ensure that the work of all the law enforcement groups does not overlap—a point made by the noble Earl—and I understand that the senior officers in each of those agencies communicate regularly to ensure that the work that they do is co-ordinated and not duplicated. Much has understandably been made of data losses. I was not aware of the one reported today. We appreciate and understand the serious concerns set out in the reports regarding the loss of data by government departments. As part of the response to the losses of data, we commissioned a report to look at how data should be handled in the future. The report was delivered in June this year and contains far-reaching mandatory recommendations, which departments are already investing time and energy in to ensure that personal information is managed properly and used securely for the public’s benefit. As part of our drive for greater openness and transparency, departments have already published details of data security incidents in their 2007-08 resource accounts. Clearly, the call for higher security transparency means that we also see headlines on these unfortunate incidents. The report recognises that the problem of cybercrime cannot be addressed by the UK alone and that international co-operation is essential to ensure that law enforcement within the UK can obtain assistance, when required, from countries where cybercriminals might be operating. With the changes to the Computer Misuse Act now enacted, we believe that the UK meets all the requirements necessary for us to ratify the Council of Europe Convention on Cybercrime and to give effect to the EU framework decision on attacks on information systems, a point raised by the noble Viscount, Lord Bridgeman. I am pleased to say that we expect the Convention on Cybercrime to be ratified by the end of the year, or certainly in the early part of 2009. Many points and comments were made in the debate. If I try to deal with them now, I will fail, because I have not yet learnt the paper-juggling skills required of a Minister at the Dispatch Box and, more important, some of the questions require detailed answers which I would not be able to give orally. As this is the first time that I have responded to a debate, I probably would not do justice to the questions. Given that my knowledge of the retail industry exceeds my knowledge of the IT industry, I make a once-in-a-lifetime offer to any Member who feels that the response that I have given does not cover points raised by undertaking to write to them, even if they have not asked a question. I have identified a number of issues that were raised, which require us to make responses in any event; for example, there was a question about the resources to the Metropolitan Police and whether they are additional or taken from somewhere else. I will reply to that in writing. I can respond on some issues. The noble Viscount, Lord Bridgeman, asked about CPS prosecutors in relation to e-crime. I confirm that prosecutors in the CPS are already trained to deal with electronic crime, but I do not think that they are identified as a separate group within that institution. There was concern about cross-departmental groups. We accept the need to co-ordinate interests across departments, and the Cabinet Office has established a forum for that purpose. We hope that it will enhance our position. However, I do not think that I can do justice to individual questions without writing. The internet and the technology that underpins it are changing rapidly—““changing rapidly”” does not do justice to the speed, which has been very much on noble Lords’ minds—and the challenge that the Government must meet is to ensure that there is a safe environment for all. For many people these are exciting changes, which bring tremendous benefit and enjoyment. However, they also bring new challenges, of which keeping up with the speed of technological change is but one. I assure noble Lords that the Government are prepared to meet those challenges as they arise. The Government will actively consider updating legislation to ensure that the UK has sufficient legal powers to tackle crime committed on the internet. We will work with and through international partners, both bilaterally and through institutions such as the EU and the G8, to build a common approach to preventing such crimes and ensuring that there is an adequate response. The Government will work with all sectors of the UK economy to develop a safer internet and to ensure that the public can have confidence that they are free to trade, communicate and enjoy the services available to them. The Government will continue to support the law enforcement agencies that provide protection and support to the public and tackle the criminals operating in cyberspace. Above all, with groups across the public, private and third sectors, we will seek to ensure that all of us play our part in ensuring the security and safety of the internet.