---

National Security Strategy

My Lords, I add my thanks to my noble friend Lord King for giving us the opportunity to debate this important subject. In my few minutes, I will focus on the single issue of cybersecurity. I am a member of Sub-Committee F of the European Union Committee of this House. We are looking at cybersecurity on an EU-wide basis. I will not run before the committee's conclusions, which will undoubtedly be debated on the Floor of your Lordships’ House in due course, but we have picked up some lessons that are relevant to our debate this afternoon. We had interesting evidence sessions, one of which involved the Minister himself. He was extremely frank and helpful, and I place on record my thanks for his contribution. I will make two broad points. The first concerns the level of public awareness of the prevalence of, and threat from, cybersecurity breaches. I hold up my hand: when we began this inquiry in September, I saw the problem as being primarily one of lonely anoraks in their bedrooms getting their intellectual kicks from breaking and entering the citadels of computing power—places like the Pentagon, the Ministry of Defence and major banks. I saw it as an intellectual rather than a criminal challenge, although clearly some criminal intent was involved. I have had a rude awakening. My cosy assumption probably was accurate five years ago, but now everything has changed. Criminals and others are hard at work in cyberspace. However, I suspect that I am typical of the general public in assuming that cyberattacks remain a minority problem, and I believe that we have to do more to raise awareness about them. Secondly, there is a rising prevalence and frequency of attacks. I may be suffering from what advertising men call selective perception: when you want to buy a car, you always see advertisements relating to cars. Perhaps it is because I am on the cybersecurity inquiry that I keep seeing news about it. I see allegations about Indian and Chinese-inspired hacking. I see that the Davos World Economic Forum devoted a session to it a week or so ago. Does the Minister agree that public awareness is on the low side, and that the frequency of attacks is increasing? If he does so agree, I think that we need to look at the punch in the government document, Cyber Security Strategy of the United Kingdom. It is a perfectly worthy document, but it is dull. It is not going to encourage or raise intellectual curiosity or awareness of the problem, and I think that there is a great deal more to be done in that regard. The scale of attacks and their sophistication are quite staggering. If you go on to Wikipedia—that essential support for a Back-Bench Member of your Lordships’ House so far as research is concerned—you will find listed what are called botnets, which are collections of autonomous and automatic software robots. The largest of them is called Srizbi. With 450,000 bots, it is capable of delivering 60 billion spam messages a day and is clearly able to overwhelm any individual computer system. You will see quite frequently cropping up in the list on Wikipedia botnets with a capability of delivering 1 billion to 10 billion spam messages a day. We also have Trojan malware, whereby software is inserted into a person’s computer without them knowing about it, and messages which appear to originate from them in fact originate from someone completely different. There are also cyberprivateering and cybermercenaries. Most worrying of all was what one of our experts at Sub-Committee F said. You may think that you have an anti-virus system but, whereas four years ago it would have stopped 80 per cent of the viruses that are around, it now stops less than a third—probably only about 20 per cent. Ways have been found to get round the systems. Certainly John Donne’s famous phrase, "No man is an island", applies in the field of cybersecurity. In the last minute or two available to me, I should like to ask the Minister a couple of specific points. In doing so, I accept that there is no silver bullet—there is no single answer to the problem that we face. The first is the question of our structural response. A good structural response by the United Kingdom requires interface between our Civil Service, cyber experts and regulators. The Civil Service tends to be arts-led and have a very hierarchical structure. Cyber experts are engineering-led and, because it is a fast-moving, predominantly young person’s industry, it has very flat organisational structures, if indeed any organisational structures at all. Regulators tend to be law-led with a heavy reliance on process. Is the Minister convinced that we have so far managed to find a way to tie these very different disciplines together in a way that will give us an effective response to the many challenges that lie ahead? Secondly, I should like to ask him about international standards and international collaboration. Here, I follow the point made by the noble Lord, Lord Soley, and I shall not use up any more time making it again now. Thirdly, I have two practical suggestions. Would it not be a good idea if it became a requirement for internet service providers to report the number of infected machines? So far, there is no requirement to do so, except on a voluntary basis. I understand that about 2 to 5 per cent of such cases are reported, but that is almost certainly an understatement. Finally, in order to reduce the level of petty crime at an individual level which collectively can become very large, should there not be some effort to make sure that credit card companies give better and fuller details of the entries on credit card slips? Noble Lords who might challenge a £100 entry might not challenge one for £2.50, but if it happened to be the result of cybercrime and was repeated, collectively it could add up to a very substantial sum. I fear that this subject will be an increasing part of our future world. I look forward to hearing from the noble Lord how he proposes we meet the challenges.