---

Proposed Directive (Information Systems)

With permission, Mr Speaker, I would like to make a statement on the proposed European directive on attacks against information systems, which we have decided to opt in to. Hon. Members will not need me to tell them how much we benefit from the services that are now available online. In 15 years, the number of global web users has jumped from 16 million in 1995 to more than 1.7 billion today. About three quarters of all British households now have an internet connection, and last year nearly two thirds of all adults in Britain bought goods or services online. We want to build on our cultural and economic success in the online world, but with the growth of the internet has come the growth of a new type of crime and a new risk to our national security. We now face a real, ongoing and persistent threat from other states, terrorists and criminals operating online. They are stealing commercial secrets, they are trying to take sensitive Government information and they are defrauding ordinary people. Cybercrime, often carried out by organised criminals, is now a major and growing threat to all sectors of our economy, and we should be in no doubt: online attacks can have a significant real-world impact, from people's bank accounts being emptied to industrial plants and critical infrastructure being disrupted. The risks from cyberspace are now so great that the national security strategy placed the threat as one of the top tier of risks to our national security. Recognising the seriousness of the threat, the Government are already investing heavily in cyber-security. Following the strategic defence and security review, we committed £650 million of new investment over the next four years to transform our protective capabilities in cyberspace. Our response is led by Government, but uses the resources and knowledge of the private sector, including those parts of the private sector that own and operate large elements of our digital infrastructure. The programme explicitly depends on building strong relationships with like-minded countries around the globe, because the problem is an international one and online criminals do not respect international borders. Here in Britain we have long-standing laws against computer misuse, but we need to be able to take action also against cyber-criminals operating overseas; it is therefore clear that we need to work across national boundaries. That means our law enforcement agencies working with their partners overseas to identify suspects, gather evidence and bring criminals to justice. The European Union directive on attacks against information systems supports those aims. The directive builds on an existing 2005 EU framework decision with which Britain was already compliant. It is also consistent with the Council of Europe convention on cybercrime, which Britain is in the final stages of ratifying. Opting in further demonstrates our commitment to internationally co-ordinated action against online threats. The directive will ensure that there is a basic set of agreed minimum rules in relation to online crimes and penalties across the EU that member states must build into their legislation. It will also ensure that member states respond quickly to requests from other member states for assistance in cybercrime cases. Those measures will benefit Britain and other countries that have active online economies, because it will mean that cyber-criminals will not be able to hide in European countries that do not have as well developed laws against cybercrime as we do. The directive also seeks to address the threat from large-scale attacks on information systems by ensuring that member states have adequate legislation to allow the prosecution and punishment of those organising, committing or supporting large-scale attacks. That is not a hypothetical threat: it is a real, existing problem for the British Government and British business. Finally, the directive sensibly takes into account changes in the threat picture since the framework decision was agreed, such as tackling the creation of malicious software and other innovative tools that criminals have invented to commit offences. It is for all of these reasons that we have decided to opt in to the directive. It fits with our approach of making Britain a tougher place for online criminals to operate in, and it will mean that the reach of our law enforcement agencies extends outside our borders. By opting in now, we do not accept that the draft directive is perfect. We will work to ensure the final text is in Britain's interests and we will seek to negotiate out any proposals we believe are unnecessary. I pay tribute to the work done by the European Scrutiny Committees of both Houses. They do much to ensure that European legislation is right for this country. On this specific directive, both Committees agree that there is a case for further EU action in this area. Cybercrime is a major threat to Britain. The aims of the directive are consistent with the aims of the Government in protecting our country, our economy, our businesses and our citizens from those who seek to misuse the online environment. I commend this statement to the House.