24
Examination of witnesses
Dame Angela Eagle and Roger Hargreaves.
Q179 The Chair: Good morning, Minister. Good morning, Mr Hargreaves. Thank you very much for joining us today to help us with this important inquiry.
I should remind you that this is a public session that it is being broadcast live. In a couple of days, you will each receive a transcript of the session. If you spot any inaccuracies, that is your opportunity to make corrections. If you think at that time that there is something missing that you should have said, we will always welcome additional supplementary evidence in writing. We have a lot of questions for each of you. Before you give your first answer, it would be helpful, for the record, if you could introduce yourself briefly.
I will kick off. First of all, I would like to say congratulations, Minister, on your latest appointment. It is very good to have you here. Mr Hargreaves, thank you for your letter yesterday and for engaging with the committee at a much earlier stage. It is good to have you here now in public session so we can get your thoughts and advice on the record and take account of that in our report.
We have all seen yesterday’s Statement. I would like to kick off with a bit of background and context. It seems to be generally more and more acknowledged now that the threats and emergencies that we might face are very unlikely to remain in one sector or silo but will cascade pretty quickly into a multisector scenario, and I think that is implicit in yesterday’s Statement as well. Alongside that, we have heard from a number of witnesses, both in person and in writing, the view that the resilience systems in place at the moment seem to be response and recovery-heavy but planning and preparedness-light.
In that context, I wanted to ask you—perhaps I can turn to the Minister first—whether there is a case for refining or changing the current model in which the lead government department oversees the response. Alongside that, is there a case for any adjustments that could helpfully be made to ministerial responsibilities, such as having a Minister responsible exclusively for resilience and nothing else?
Dame Angela Eagle: First, it is a great pleasure to be here. I am the Member of Parliament for Wallasey but obviously, for the purposes of this hearing, I am the Security Minister. My brief ranges across the Home Office and the Cabinet Office.
In some ways, the paradox of your question, wanting to have a Minister only for resilience, was disproved by the earlier bits of your question when you were saying that the risks are changing, morphing and becoming interconnected. It strikes me that having a Minister who is responsible at the Home Office end for the National Crime Agency and terrorist response ties in very neatly with resilience, which is run out of the Cabinet Office, as you know.
Cross-departmental working makes it more effective, from a ministerial point of view, for me as I can look across the piece and see what the risks are. The key thing for these kinds of interconnected risks is about how government works cross-departmentally and co-operatively up and down the system, from local resilience level all the way up to national level and, of course, with the devolved Administrations because some of these risks are dealt with in a devolved fashion.
It is important that we have cross-departmental working, but the Cabinet Office particularly leads on the catastrophic interconnected risks that you referenced in your opening question. Quite clearly, if there is a wildfire in a particular place, it is absolutely right that the local resilience forums, many of which are chaired by fire chiefs, get on and deal with that.
We have a system that is long-standing and effective. It is a logical model that fits in with the structures of working in this country politically, both nationally and locally, but I would not want you to go away from the answer that I am giving thinking that we are complacent, because we are not complacent at all. If you look at the Covid response—the first part of the Covid inquiry response had some comments about more catastrophic risks in it that we have taken account of—or the Grenfell fire inquiry, there are always lessons to be learned, if things have gone wrong or if things can be improved.
The structure is reasonably sound, but we have an open mind about how we can evolve it in order to keep meeting the changing threats that we face. Nationally, at the Cabinet Office, we have some state-of-the-art issues with the National Situation Centre. We use a lot of data and analysis. We can make information available very quickly where it needs to be. We are particularly involved in what we can do about multicascading risks. Some of that we have changed and tweaked because of the experience of Covid.
Roger Hargreaves: The only thing that I would add to that would be to amplify the point that the Minister made about reviewing the system. The change to give the Cabinet Office additional responsibilities was a post-Covid decision. We knew that the lead government department model worked really well but we recognised that it needed to be adjusted, so we were happy to make that adjustment to have Cabinet Office co-ownership.
That is clear evidence that we are willing to adjust the system, but, as someone who operates it day to day, I wholeheartedly agree with the Minister’s point that you need something that works with the grain of how you run the country generally when it comes to resilience. You cannot invent a wholly distinct model otherwise people will regard this as a separate and distinct task rather than something that should be part of all their work.
Dame Angela Eagle: There is a really important thing here because many people look at other countries’ ways of doing things, such as having a national emergency structure. Our view is definitely that we should be integrating potential risks at department and local level with the people who know the most about the sector that they are involved in organising and managing, and have the most wide-ranging stakeholder contacts. Those people are the best people to be thinking about emergencies and risk, rather than having it on the side somewhere. You would have to have some organisation that was somehow prepared to deal with absolutely everything without having any of the specialist knowledge. It may need tweaks, but we feel this is the right structure.
Q180 Lord Oates: We had evidence from Alex Woodman, the national lead for resilience at the National Fire Chiefs Council. He suggested that it would be useful, in addition to the existing structures, to have a lead agency for convening and delivering on national resilience. He was bidding for the fire and rescue service on that.
Dame Angela Eagle: Did that surprise you?
Lord Oates: No, it did not, but it might be a sensible solution to have a national resilience agency lead. He also suggested a national resilience forum. I wondered whether you could set out your thoughts about that.
Dame Angela Eagle: We have national resilience expertise in the Cabinet Office. We can call on absolutely anyone, depending on what the threat or issue is, to give us their expertise. In fact, that is done via the COBRA mechanism. A lot of the local resilience forums are run by local fire chiefs. We also have the National Security Council, which reports directly to the Prime Minister. There is a sub-committee of that called National Security Council (Resilience), where we can gather who we need to gather in a particular room to deal with whatever the crisis is.
There may be all sorts of different ways that you want to organise or skin this particular cat, but I am convinced that we are in a good situation with some of the changes we have made in the Cabinet Office, the way that COBRA works, the National Security Council itself and its lead into the Prime Minister, and the fact that the Chief Secretary to the Prime Minister convenes all the resilience meetings that we need to do. Those can be practices, like we did with Operation Pegasus last year, which was a big pandemic exercise. We will do an exercise to practise for an attack on the homeland next year, as the Chief Secretary to the Prime Minister announced in Parliament yesterday.
I would not get too hung up on structures. There are always going to be people in the structure who want more prominence for their bits, but it is the Cabinet Office’s job to co-ordinate all this, and I am confident that we can do it.
Q181 Lord Peach: Welcome, Minister. Congratulations on your appointment.
Dame Angela Eagle: Thank you.
Lord Peach: Defence is part of many elements of national resilience, and home defence is now back in the language. My question is simple. When will we see the home defence programme? It is due to be published. Declaring my interest as president of the Council of Reserve Forces and Cadets Associations, is it time that we talked more about civil defence as a concept and an issue, and what might that look like?
Dame Angela Eagle: We are pivoting into a different era than the one we have been in. The strategic defence review and the national security strategy pointed this out, as does the resilience action plan, which was published last year.
Some of this is about moving out, unfortunately, of the era where we had a defence dividend because of the end of the Cold War and into an era where we have a much more hybrid hostile situation. All members of this committee will understand what is going on and where some of the threats come from.
We are thinking much more about how we could look at the arrangements that came with the peace dividend, which came out of the end of the Cold War, such as the Civil Contingencies Act, rather than thinking about the connection with the military or outside foreign hostility. We now have to pivot back not to the same place as we were in the Cold War but to somewhere very different because of the increase in technological ability, the hybrid war that is going on at the moment, the cyberattacks and the attempts at foreign national interference. You are doing the SIs for the state threats Bill today to designate three proxy bodies as controlled by foreign powers so we can get more of a handle on their activities on our streets.
We are in a different place. That means we do, first of all, need to have a national conversation about that. The Chief Secretary to the Prime Minister talked about that in his Statement to the House on Tuesday. We are planning that—we are in the planning stages. It will be available for us to use in the autumn. Some of this is about the agreements that we have made at NATO meetings to be much more resilient in the homeland as well as in a military sense. We are preparing to do a lot more.
The national conversation is part of that, but we have to get the balance right. We do not want to frighten people; we want to give them practical things they can do to make sure that they are more aware of how to respond to threats. This is at business level, community level, the local tier and in voluntary organisations. How can we be more resilient as households? How can we be more resilient in particular places? You go through the system that way. We are at the beginning of changing our approach so that we can make our country much more resilient than it has been at all those levels.
Finally, we need to recognise that, sadly, we are in a darker time. We have to get to the stage, as a lot of our European colleagues already are, where this conversation is happening and the local citizenry are well aware of what they need to do, and when and why.
Roger Hargreaves: Just on the specific point about civil defence, we would understand civil defence to be the protection of the civilian population in wartime scenarios. That is a subset element of the home defence programme as a whole, which is looking both at our plans to fulfil our NATO commitments and what will be required in the UK, and at the impacts of a European conflict on the UK directly and how we might mitigate those. That includes the home defence work.
It is also worth observing that we moved on from the planning frameworks we had post the Second World War, which saw civil defence and preparedness for attack as the defining challenge in this area. With the end of the Cold War or in fact before the end of the Cold War, we moved more towards an all-hazards approach. We are still saying that home defence and that work is one risk among many, but the prominence that we are giving to it has increased. The home defence programme, which effectively involves rebuilding the war books, the operational plans for conflict, major exercises and the acquisition of new capabilities, is a really important feature of the landscape but it is not the only one.
Dame Angela Eagle: By the way, that does not mean we think there is going to be a conflict any minute. We need a war book so that, in case there is one, we are not making up as we go along. That is what resilience is about.
The Chair: As Security Minister, do you liaise with the MoD on our compliance with NATO’s seven baseline commitments on resilience? Some of those are where military and civilian operations overlap.
Dame Angela Eagle: Yes. There is a liaison anyway because of military assistance to civilians in particular crises. There are well-established ways of liaising with the MoD, the Cabinet Office, the Home Office and the security services. That is the web of support that we need.
Q182 Baroness Paul of Shepherd's Bush: You have already touched on the fact that we need a whole-of-society response to resilience. I wanted to turn our thoughts more to local communities and local resilience forums. In the context of local communities, we have heard from a lot of organisations that they are not really sure how they can support our resilience efforts, how to mobilise volunteers, particularly to help our most vulnerable people, and how to know who those are in times of crisis. Could you give us your thoughts on that?
The local resilience forums are clearly a very key component of how we think we might respond. Do they need to be better equipped to tackle large-scale incidents? Should they have some statutory status, standards, operating guidance, expanded membership or more funding? We are very alive to the fact that an incident may be an ongoing incident or there may even be multiple incidents that happen at the same time. Is there resilience in the local resilience forums to combat that, if that were to happen?
Dame Angela Eagle: I can speak as someone who watched what happened with my local resilience forum during Covid. A lot of us could do that. We saw some fantastic work. We also saw a Government at the centre who were not really aware of quite what was going on locally and in some ways tried to get around it.
We need much better ways. I will give you an example. In the Wirral, we were told by central government that about 8,000 or 9,000 people would have to shield. That was what the NHS stats and data showed. It was triple or quadruple that, in reality. What happened was that the resilience forum and the people who were meeting locally on the Wirral did other stuff because they knew more about where people were. The communities knew more about where people were. There were sudden and spontaneous appearances of food kitchens. We managed to get the supermarkets to give us food so we could cook and take stuff around to people. Our local areas are full of people who will do that in crisis. Those people filled the gap themselves.
We need to enable and empower that to happen. We do not need to try to control it all from the top or the centre. If we can get better at data and at contacts, and if we can empower the local resilience forums so that they can take more of the kind of initiatives that happened spontaneously during Covid, that is all to the good.
There is a trailblazer programme. It has five local resilience forums in it. We have given them £2.5 million between them so that they can see how they might strengthen their approach and how we can empower them so they can start being proactive locally about building resilience at that level. We will take the lessons that are learned back to our look at the Civil Contingencies Act, which is due for its five-yearly review.
The Chair: We will be coming on to that later.
Dame Angela Eagle: I am sure you will, so I will not ruin people’s questions about that. That is how the local resilience forum thing ties into the bigger structure. Of course, the people who can best build active resilience like that are the volunteers on the ground, the local authorities that know their areas and the local health people. All the people who sit on the local resilience forum can have a fantastic input into it. We also have to reach out and empower local voluntary organisations—not that they always need it. The more that we can do that now, the better shape we will be in if we do have a crisis.
Roger Hargreaves: The stronger the plans we have in the centre, the more effective use we will make of people at the local level. With Covid, which was slightly before my time, you could see a centre that was quite self-absorbed in trying to work out what to do and therefore not thinking about how to empower others.
If you have really strong plans and capabilities at the centre, as I suggest we have now, you are better able to make sure that you then draw in other people. We have a really clear principle that the local level is a building block of resilience. Every emergency is local; only some are national. They all need to be equipped to deliver effectively.
We have looked at the question of whether they should be separate statutory bodies. We looked at that when the contingencies Bill was going through, which set all this up. There are really clear statutory responsibilities on each of the partners. There is no doubt about what they should be doing. The LRF is the vehicle through which they come together and work together. On most occasions, it works really effectively. If you were to create a separate new structure locally, people would simply pass on their responsibilities to that new structure. There are real questions about incentives.
My other practical reflection is on the point about communities and how we mobilise them. We would certainly operationally distinguish between different kinds of community and public engagement. In the UK, a huge amount of what we get from the public when it comes to emergencies comes through auxiliary organisations, such as reservists, special constables, volunteer coastguard and retained firefighters. That is the vehicle through which volunteers here do most of their volunteering in a meaningful way.
We are then also able to draw on local voluntary or community organisations that are structured and exist outwith the emergency itself, but that is more variable. Sometimes they operate really effectively in a local area; sometimes they operate much less effectively. Every local resilience group needs to decide how best to use the voluntary sector in its area, depending on the configuration in its area.
The third group of volunteers or community engagement that we think is important is the public generally. We tend to want to help and to work together during emergencies. We want to volunteer and take part. We saw it on a huge scale during Covid. We see it a lot with big emergencies locally. People want to do something. That last group is really important, but it is quite hard to organise and build into plans.
We try to encourage, both nationally and locally, through guidance and the planning work, models for dealing with each of those different contributions. It will not just be a blanket, “Let’s do more with the voluntary sector”, because we do a huge amount. If we are not doing more, that is because it is quite bespoke or quite tricky.
Baroness Paul of Shepherd’s Bush: My only observation would be that during Covid everybody was at home, which made it much easier to mobilise people. In some of the scenarios that we have been discussing, there could be multiple things going on. I am very mindful that my colleague Lord Peach has also drawn to our attention that some of the people who would be your reservists may also be doing other things in the event of an incident.
Dame Angela Eagle: Every crisis is different.
Baroness Paul of Shepherd’s Bush: Yes, exactly.
Dame Angela Eagle: You cannot overiterate the plan. You have to have structures that are able to adapt quickly to whatever the incident is.
Q183 Baroness Mobarik: The committee has received evidence that the private sector is not always clear about what the Government want it to do concerning national resilience. Apart from guidance, what steps should the Government take to ensure that any guidance given is embedded in every organisation, whether it is key supply chains, operating critical national infrastructure or SMEs more generally? What practical tools are we giving to organisations? You mentioned practical tools earlier, Minister, but can you just be a little more specific, please?
Dame Angela Eagle: First of all, the private sector, just referring to it like that, covers a multitude of very different things. We tend to divide it into three. The first bit is SMEs, and there are a lot of those around. We tend to give advice for protection. Take cybersecurity, for example. We would give lots of advice to SMEs as to how to target-harden yourself from the point of view of cyberattacks, but we would not expect to incorporate them in any great detail as a mass. It is advice for protection there.
The UK-wide businesses and multinationals tend to want risk information. We have to share risk information, alerts, issues, best practice, training and all that with them. They have the capacity to take that on board and deal with it themselves, if we give them the information.
Then there are the critical national infrastructure parts. Those are regulated, and we deal with them in a very different way than we would with small and medium-sized enterprises. You have to cut up the “private sector” label into something a bit more manageable and provide information and advice at the range at which it can be used sensibly. That is probably the first thing that I would say.
Particularly in the aftermath of the war in the Middle East and the problems that it has created, we have had meetings in COBRA of the Middle East Response Committee or MERC, as it is known, at official and ministerial levels. That has looked in great detail, using local government department leads, at the supply chain issues in different sectors and where there might be critical shortages or effects.
To take one off the top of my head from my previous job at Defra, fertiliser is a huge issue. It is not a particular issue for us, but global prices are going up because a lot of it goes through the Strait of Hormuz. We had particular issues with the supply of CO2, which is very important in the food sector, in both the food manufacturing sector and the primary sector because they use it to kill livestock. There are a range of things that we have discovered because we have been doing this work on where our critical bottlenecks and weak points are.
There is now a Supply Chain Centre in DBT, which is looking at how to make sure that we never run short of these very critical things that you might not think about, whether that is CO2, carbon, phosphorus or whatever. These are basic chemicals that everybody has forgotten that we need, but you suddenly realise that they are at the centre of these supply chains.
As we work through these things, we get more and more information about these scenarios and what we can do to increase our resilience. Dealing with the private sector is a key part of that. Businesses have a lot of information about what they need in their supply chains. We need to understand their supply chains so that we can see what is critical. Co-operation and collaboration with the private sector is crucial to getting this right.
Baroness Mobarik: We learned at one of the evidence sessions that we no longer produce antibiotics, for example. I know that securing supply chains and all that is really important, but should we be manufacturing or producing certain things at home? We have the expertise; we have pharmaceutical companies. I would have thought that is a very—
Dame Angela Eagle: Antimicrobial resistance, for example, is a critical threat that we keep a very close eye on. We have just published some information about how we might deal with that.
I agree with you that we need to think about home production. In fact, the Chief Secretary to the Prime Minister has just announced that we have an mRNA vaccine production factory that we could rely on, if there were another pandemic.
We have to make decisions. We cannot produce absolutely everything on our own land. We also have a duty to make sure that things such as antibiotics are available in other areas of the globe. We have to make strategic decisions about whether we try to bring back to our country the actual production of those or whether we do deals with the pharmaceutical industry, which produces all over the world, to ensure that we have supplies when we need them. Clearly, the battle that there was for a Covid vaccine during that time had some lessons to teach us.
We have to get the balance right and have plans, if things happen, to make sure that we are resilient to shortages.
The Chair: I am very glad to hear you say that about antibiotics.
Dame Angela Eagle: I am a big believer in dealing with antimicrobial resistance.
The Chair: We had evidence that 90% of our penicillin is imported from China and a large proportion of all other antibiotics as well. To hear you say that you are seriously considering restoring domestic production of antibiotics is very positive.
Dame Angela Eagle: Well, I did not say that.
The Chair: Did you not?
Dame Angela Eagle: No; I said that we are aware of these risks. We have made sure that we have production facilities in the UK for vaccines. Clearly, we keep a very careful eye on what other things we might need. We have all seen what has happened post Brexit with the supply of important medicines. We have to learn a lot about these supply chains.
The other side of the coin is that, if you centralise the manufacture of all these things to the richer nations, it makes it very difficult to have a global supply. There is a balance.
Roger Hargreaves: In practical operational terms, our understanding of these things compared to where it was five years ago is night and day. In many respects, dealing with the policy problems that you are describing requires us first to have that understanding of where the vulnerabilities lie. We now understand that much more clearly.
The Middle East experience is really interesting because we were able on day one to put in front of people immediately the effects of what we were seeing and what it meant. When you compare that even to Russia-Ukraine, it took time for some of the problems to emerge and become apparent, even for businesses themselves.
The work that the DBT is doing is really helpful on that front. We have something called CNI Knowledge Base, which is effectively a map of the UK’s critical infrastructure, not just physical assets but ownership and other dependencies. The clarity in our sense of what is going on is profoundly different and better.
That still leaves the policy challenges. We are ultimately on the receiving end of other decisions, but those decisions are made for other good policy reasons. There are lots of reasons why it might make sense to have more internationally diverse supply chains. It might make them more resilient in other circumstances or it might reduce the cost, which means day to day you get better results even if things are more difficult in emergencies.
It is quite difficult to interfere with all those choices purely from a resilience perspective because that is one narrow look at things. We are trying to make sure that, when people make choices about government intervention or businesses make choices about their international supply chains, they have the best possible information about what the risks are and what might go wrong. It is altering the balance slightly between just in time and just in case.
Dame Angela Eagle: By the way, just to give you an insight, when I was at Defra and the MERC was set up, COBRA was gathering this information and I was having round tables with all the stakeholders in the agricultural supply industry, who told me exactly what was happening with fertiliser prices, where they got them from, what they were worried about and what they might be short of. They talked about phosphorus and various other things.
I was able to have really detailed conversations in a round table with the people who do the actual work in the private sector and then feed that back. It was a very good and thorough approach that I thought worked really well.
Q184 Baroness Northover: Following on from what you have just said in terms of understanding something that is fast-moving and extremely risky, I want to ask about the challenges of cyber-risk enhanced by AI. How are the Government enhancing their approach to these serious risks that the country faces? Some of this is to do with disinformation and undermining the very trust that we need to build in order to implement some of the things that you are talking about. The other part of it is about the catastrophic and interconnected risks that can result from cyberattacks.
We are dealing at the moment with the cybersecurity Bill in the Lords. We have received evidence to this committee that the legislation is too limited. The EU regulations take a whole-of-economy approach, including manufacturing, public administration and food production. For example, the attacks on JLR and Marks & Spencer would not be in scope of the regulations under the Bill that we are looking at at the moment. We have also received evidence saying that voluntary codes of practice sitting alongside those regulations are insufficient.
You have talked about risks being multicascading, so therefore I would like to ask how you hope to take this forward. It sounds as if the legislation that we are looking at is already out of date. What can we do to address that? What can we do in terms of insurance? How do we make sure that all the relevant areas are seriously addressing this? It is not just about advice, which at the moment they are clearly not fully taking up. As we have been told in our evidence, it is not whether attacks will occur but when, including on SMEs.
Dame Angela Eagle: I would like to separate out your comments about misinformation and disinformation, which is a social media issue. It is a serious issue—do not get me wrong—but it is slightly different from the cyberattack issue. We need to look at those threats in slightly different ways.
To give you an idea of the scale, the number of nationally significant cyber incidents more than doubled in the last year. The National Cyber Security Centre handled 200 nationally significant incidents. The cost per business of that is about £195,000. That is £15 billion a year. We know that the attack on Jaguar Land Rover affected our GDP because it shut down production completely.
Our view to begin with is that one of the best ways to deal with this is what we call doing the basics and housekeeping. Get the basics right first and keep it up to date. We are doing a lot of work in terms of trying to get information out there about how companies of all sizes can do the basics and the housekeeping. We are also doing work to make the internet automatically safer and building basic protections to benefit all UK businesses into those networks. We are trying to make that as automatic as possible.
However, we need businesses to lead the way in their own areas. First, that is by taking this seriously and making sure that someone high up in the company takes responsibility for making sure that it is right. We then have a whole range of best practice that we are getting out there in terms of cybersecurity.
We are dealing with the Anthropic AI threat with the AI Security Institute there, which is world-leading. There is a lot of very good work going on there. The national cyber action plan is due to be published very soon, probably now after summer. That will enable best practice to happen.
I do not know whether you want to deal in detail with some of the work we are doing with the cyber certificate.
Roger Hargreaves: Yes, it is quite striking the extent to which perspectives are changing rapidly on this. Even from my personal perspective, I used to get invited to far fewer business-type events than more resilience-focused events. Since JLR and Marks & Spencer, I get a steady stream of invites. It is sometimes the case that, when you have an emergency, the emergency itself is the signal to people. You can tell them as much as you want in the planning phase or in abstract, but it is only when they see it in front of them that they change their perspectives. That is not to say that lots of businesses were not doing something. It is just that that supercharges interest.
We have a model that is built largely on advice rather than mandation, but there are some really strong incentives there. My colleagues in the National Cyber Security Centre do lots of excellent work putting advice out there, but, if you talk to them, they do not expect people to do something incredibly fancy. They are saying, “Just do the cyber essentials—firewalls, secure configuration, user access controls, malware protection and software updates”. Those are things that people see ordinarily at work and so forth.
These are not huge and complicated things, but many businesses choose not to do them. Those that do are massively less likely to claim on insurance for cyber incidents. They may get other benefits in terms of their day-to-day operations. They may get reduced insurance premiums. This is a choice for organisations. In the same way that we do not prescribe people’s physical security, we do not prescribe cyber security in most instances.
That begs the question of whether we should do more on that front. There is a political choice there about the extent to which government takes responsibility for the conduct of business or whether the incentives are strong and clear enough for business to take its own action, and that is where the debate is.
Dame Angela Eagle: We are investing £90 million to provide a range of free guidance tools and training to help businesses and organisations improve their cyber resilience. There is a cyber action toolkit that helps small businesses take the first steps to protect themselves. There is what is almost a cyber essentials certificate, which can, if you put the basics in place and protect yourself, lead to lower insurance premiums, as was just said, and massively decrease your likelihood of suffering from an attack. There is a cyber governance code of practice to help boards and directors manage their digital risks more effectively.
This is an issue that, because of recent very high-profile events, there is a lot more interest in. It is a pity that it had to be a high-profile event that caused it, but it is a good thing that there is more interest in this, and we are trying to facilitate it as much as possible.
The Chair: Thank you. We have very quick supplementaries from Lady Paul and Lord Oates, so I suggest that we hear from both of them first, and then you can answer both together. I need to remind colleagues that we are only half way through the questions but way more than half way through the time that we have our witnesses for.
Dame Angela Eagle: We have talked too much. That is the problem.
The Chair: Could we have quick supplementaries on the cyber issue first?
Q185 Baroness Paul of Shepherd's Bush: You mentioned incentivisation and the idea that it is up to businesses themselves to find their own way through some of this. The guidance is there. However, when the cost is then borne by the taxpayer—because we have to step in and make loans or, in more catastrophic events, we may have to come up with other things—that is a problem for us. “Who pays?” is a really important question, and we need to think more about the incentivisation of people to take up insurance.
On Cyber Essentials, I understand that, if everybody takes up the basic certification and does it to a really high level, that would be helpful; we will all come up across the board. But take-up is so low. What are we going to do to change behaviour, because what we are doing right now is not having the desired effects that we want to have in order to increase the cyber resilience that we have?
Lord Oates: Mine is a related question. In the financial services arena, you will be aware that, in order to avoid systemic risk, firms are required to run internal stress tests against the material risks unique to their businesses. That is then evaluated by the Prudential Regulation Authority. Do you think that there is the potential to learn some lessons from that, particularly given the comments that you made, Minister, about the impact of JLR on GDP, for instance, and the comments that Lady Paul has made on having a more robust system and drawing on those lessons from the financial services industry?
Dame Angela Eagle: We are literally on the cusp of much more understanding of the risks that this presents, because of the high-profile hacks that we have seen in the last year. The Chancellor and the Secretary of State for Business and Trade, and the heads of the National Cyber Security Centre and the National Crime Agency, have written to all CEOs and FTSE 350 companies, imploring those businesses to recognise the threat that is facing them and to do something about it. We can tell them what to do if they want to ask us, or they can hire their own people.
I think that we are at the beginning of there being a much more robust response in business to this. There are always lessons that can be learned. The financial services sector is one of the most obviously targeted areas, and so it will have expertise. At the moment, we want to do it voluntarily. It is a very different thing to shift to total regulation across the entire sector. There are regulations in the critical infrastructure, but there is an issue there about precisely what is going to work the best.
Roger Hargreaves: It goes back to the Minister’s answer about the different parts of the private sector. Financial services is very heavily regulated. For critical infrastructure and those regulated bits of the economy, there are much clearer demands and expectations around cyber protection, and we have more active debates because there are more levers available to government. It is very difficult for government to fix the individual cyber security inadequacies of a million small businesses, but advice is the main vehicle there.
What is interesting is what we do with the largest businesses, and there is a policy question about whether it is government’s job to run—Jaguar Land Rover is the wrong example, because it has been through it—a big company and get it to ensure that it has the right cyber security, or whether the company fixes it itself. We come back to the question of who bears the cost if it goes wrong for the company. It is a policy question rather than an operational one from our perspective, in terms of how far government interfere in the running, effective or otherwise, of private companies.
The Chair: We had better move on now. We have a few more questions and we may run over by a few minutes, if that is okay.
Q186 Baroness Hunter of Auchenreoch: First, can I say how very pleased I am to see Dame Angela in her new role? She and I worked together many years ago during the foot and mouth crisis and the fuel crisis. This is somebody with considerable expertise and a long interest in this area. I am delighted that you are here, and I hope that the new Prime Minister takes note of that as well.
We are interested in the media and communications landscape, and the changing nature of that landscape. Only 50% of people now get their news from national broadcasters. There is a massive decline in trust in politicians and in mainstream media. I know that the Chief Secretary made an announcement about starting a national conversation. First, how are we going to have that national conversation in this new media landscape? Secondly, how would we communicate with people if there were power outages and an inability to communicate?
Dame Angela Eagle: Thank you for the reminding me of how long we have both been in this place. It is absolutely true that resilience is about the way that trust in society and in institutions works, as well as what we plan to do. The less trust and the more fragmented our society, the harder it is to get resilience.
I, for one, thinking back to pre-foot and mouth times all those years ago, would never have anticipated that we would have the vaccine scepticism that we have, or that we would have disinformation and misinformation being believed so much. It does come across on the doorstep, when I go out canvassing in various places, that people believe a lot of this stuff. They do not trust the BBC or our national broadcasters, so they get their information from other places with no bona fides at all.
We recognise that there is a fragmentation problem, and we are going to try to take account of that in the way that we get our messages out. We are not going to put a pamphlet out to everybody’s household telling them what they ought to do. There is stuff already on GOV.UK/prepare, if you want to have a look at that.
Baroness Hunter of Auchenreoch: People do not know about this.
Dame Angela Eagle: No. We are going to be pushing people to that, but we are also going to try to get messages across about what people can do in situations to ensure that, for example, they have a 72-hour supply of water, batteries, and wind-up or battery radios. We will be able to broadcast in certain ways if there were a problem. We have the national alert scheme that goes to people’s phones. We want people to make certain that they have food, a first aid kit and, if they are on particular drugs, enough of a supply for three days or a week.
There are practical things such as that, but I absolutely accept that we are in a period when trust in institutions is low and people are not likely to listen. In many ways, they are the ones who complain a lot. There are an awful lot of silent people out there who will take this information and do things with it that will make us more resilient. If I could wave a magic wand and make our society less fragmented and trust in institutions return, then I would do it, but we have to communicate with people where they are and in a way that they can take seriously.
Roger Hargreaves: On the specific point about communication in emergencies, the Minister mentioned emergency alerts. That is a very effective system but a good example of something about which there was a lot of debate in relation to its utility and whether we would ever use it. One in six of the population has received an emergency alert in a life-saving situation now, so we do make use of those systems. We have the arrangements with broadcasters to put out emergency broadcasts when power is absent, so there is a lot that we have in place that you do not necessarily see because we do not use it day to day.
Dame Angela Eagle: We do not want you to see it. It would be better if we never used it.
The Chair: This all connects very nicely with the next question from Lord Spellar.
Q187 Lord Spellar: It does. I want to focus more on the message than the mechanics—although I accept that the mechanics are important—and how the Cabinet Office, for example, is working across government to make resilience education, training and exercising more formal and robust, including with schools, senior leaders and organisations responsible for critical services. Behind that, we have to decide what the message is, and who is deciding what the message is, maybe at different levels.
Where is the centre of gravity in working out the extent to which we make people aware of the threat that we are facing, of what they can do, and of what the state is doing to help them? How are we phrasing that? How are we using those who use social media but also those who can think in tabloid? We are not asking people to write a Times article; we want people who can write the front page of the Sun and the Mirror in order to get that message across. Where is the centre or the focus of all of that? That is really a political message.
Roger Hargreaves: The campaign that we put out in the autumn is being finalised now, as the Minister said. A really important part of that has been a period where we have carried out a lot of research with the public—a lot of focus groups and other targeted activity—to understand what the public appreciate and what messages will connect with them effectively.
Dame Angela Eagle: And who the message carriers are.
Roger Hargreaves: Yes. This tells us lots of interesting things. For example, on message carrying, we started off thinking that it would be really helpful if the message did not come from the Government, because people do not always trust them as much as I might like. We have 30 or 40 civil society organisations that will take part in our campaign and are already signed up to it. When we talked to the public, they were much clearer that this was a topic on which they did want to hear from the Government, so we will elevate the government role.
We have tested different ways of framing the messages to the public. Does a message that is about being ready, which focuses on the incident itself, make more sense? Should we have something that is more about people playing their part, which can include both emergency response and a wider contribution, going back to the earlier points on the role of the voluntary sector? Or do we want something that is very mechanical, covering 72 hours? Should that be the focus of it, as it is, say, in Finland?
We tested all those points. We will provide advice to Ministers shortly, as the final outcomes of that work are concluded, on precisely how stuff will be framed, but it will be a result of that testing and we will make sure that we do it correctly. The decision-making around that advice will sit with me on the professional resilience side, but also with David Dinsmore, a former tabloid editor who understands how to write a Sun headline. He is the Permanent Secretary responsible for government communications, so we have that communications input as well as the professional resilience input, which will allow Ministers to make the decision.
Dame Angela Eagle: I would also want to make sure that we got to places where government communications do not always get to, if I can put it that way, particularly with the younger generations. I do not know what we are going to do with the under-16s now. The thing is that, because we want there to be a drumbeat of this advice, and this is the first time that it has been like this for a very long time, this will be cumulative over time.
It is not that we are going to do one big push on homeland security and then it is going to disappear. It is, in essence, the batsmen getting on to the front foot so that they can deal with the stuff that is coming at them. It is a change of posture. We will learn from the first iteration of it and carry on with this message over time, because we have to be in a situation where this stuff becomes ingrained.
The work that has been done shows that people want to be ready but do not know what it is that we want them to do. After this first campaign, I certainly hope that they will know what it is that we want them to do, and then we can start having conversations with them about readiness in other ways too.
Lord Spellar: This sounds almost as though the Minister is signing off the prepared outcomes from these studies.
Dame Angela Eagle: I have not seen them yet, so I am not signing them off before I have seen them.
Lord Spellar: That worries me even more. We have seen this so often in the political world as well. It is government or campaign by focus groups. They have a role, primarily, to road-test what you have thought out as the strategy in all of this. That is where you need the political involvement. That is where you need the wordsmiths’ involvement. In a way, the focus groups then become part of the mechanics.
If there is feedback and things do not work, that is part of the feedback loop, but there has to be that engagement. Otherwise, it is still going to be a very mechanical exercise and not one that cuts through to the public. By the way, those at the political centre are the people who drive this process. We are making it more bureaucratic. Politics is at the heart of what our opponents do.
Dame Angela Eagle: All I can say is that this is not a one-off thing. It will be iterated. It is not a top-down thing. It will not work if that is what it is. We have to get awareness up, but we also have to empower. We have to keep those messages going. You would not be surprised to know that I completely agree with you, Lord Spellar, about how communication works, and we do not have only one shot at it.
Q188 Baroness Winterton of Doncaster: First of all, Minister, many congratulations on your appointment, and thank you, both, for giving such detailed answers; I would expect nothing less. If we are going to make the claim to having known the Minister for the longest, I am up there with you, Angie.
Dame Angela Eagle: Since before we were both elected.
Baroness Winterton of Doncaster: Yes, exactly.
Lord Spellar: When we were trade union officials.
Dame Angela Eagle: That is true.
Baroness Winterton of Doncaster: I want to widen out a little bit more into the international field. Following on from the previous answers, we have had evidence from, for example, the Finnish ambassador, who spoke about what they do there. I think that they had a leaflet with cartoons that went to every household.
Baroness Hunter of Auchenreoch: It was Sweden.
Dame Angela Eagle: Do you remember the one that went out about a nuclear attack in the 1970s? It was just widely ridiculed. It depends on what you say when you send it out.
Baroness Winterton of Doncaster: Yes, indeed, but, having received this evidence, we are asking whether the Government are drawing from the approach in places such as Finland to resilience training, where there is quite structured training for leaders and whole‑of‑society preparedness? That is just one part.
There is one other thing that I want to press you on a little. I am on the OSCE Parliamentary Assembly, so I am very aware of international work that is going on in terms of interference in elections, cyber attacks and so on. Do you do much on the international front? Are there meetings, for example, between security Ministers from different countries on where joint action might be taken in some of these areas?
Dame Angela Eagle: First things first. We do keep in close contact via NATO with our NATO allies about preparedness and readiness. We have had meetings with our Finnish colleagues and, I am sure, other NATO colleagues about what they do. Every approach fits the geography and situation that the country is in. Finland has a particular closeness to the Russian border and a very long border with Russia. Therefore, historically, it has always had a very integrated military-civilian approach to what it does, and a huge infrastructure of bunkers and protected areas, in a way that we do not. We want to get best practice from as many of our NATO allies as we can, and so we do that work.
Whole-society training is probably a bit extreme for where our particular approach is, but the UK Resilience Academy has been set up, where Ministers and 3,000‑odd civil servants have been trained in best practice. That also includes people from other sectors and the business community, so we are trying to professionalise and standardise the approach to some of this. Our international approach is really done via NATO for resilience to hostile state action.
Baroness Winterton of Doncaster: Mr Hargreaves, would the NATO stuff cover things such as democratic resilience? It does, yes.
Dame Angela Eagle: I was going to get on to that as the Security Minister here. I have chaired my first meeting of the Defending Democracy Taskforce. That is a cross-departmental task force, but it does look at hostile state actions, disinformation and misinformation, attempts to interfere in elections, and what we can do about the security of candidates, which is, very sadly, a huge issue at the moment. I have not had a chance to talk to a lot of people about this, having been in the job for only a month, but I see that very much as the centre of a hub of protections. At the end of the hub, there are things such as foreign state interference, corruption, money laundering and how bad money gets into UK systems to try to affect our democratic rights.
There is a range of resilience there, and it also includes education, so that we can make a positive case for democracy, because, let us face it, we all know that the alternatives are much worse, even if one has frustrations with democratic systems. I do not think that the positive case has been made for a very long time. Everyone has assumed that everybody in succeeding generations will somehow think the same about democracy as we do, but they will not, unless we demonstrate that it is true, and so we have to do a lot more to shore up what we thought was a won argument.
The Chair: Before Mr Hargreaves comes in, Lord Farmer has a follow-on question that is relevant here, and then you will be able to answer both.
Q189 Lord Farmer: Thank you, Minister and Mr Hargreaves, for making yourselves available today and giving us useful information. On the subject of disinformation and misinformation, which seems to be quite a big subject today in terms of individual and local democratic resilience, should there be training for Ministers on how to argue against this misinformation, particularly among young people? You passed the Hillsborough law this week, which has demanded a duty of candour. When it comes down to a lack of trust in government, it seems to me that what is almost at the heart of it is that we are not hearing the honesty behind it. Is this duty of candour to be pushed through all government communications?
The Chair: We have just one more question after this to come to, just to let you know.
Dame Angela Eagle: What we can do about some duty of candour in political campaigning is a very philosophical question, in some ways. The best way of dealing with a lot of this is to equip young people with the capacity to judge what is true and what is false. I worry about the battle for truth. If you are in a democracy and there is no agreement about what the truth is—I do not mean opinions; I mean the truth—you are in a very difficult situation. The rise of social media and what we have seen with misinformation, disinformation and that kind of propaganda has bled over into people’s real behaviour.
I talked to the terribly tragic parents of people who have killed themselves using sodium nitrate because they went on suicide websites. We have seen some of the incel manosphere effects dripping over into the behaviour of real life. When we look at the number of people planning mass casualty attacks, and we see that 15% of them are under 17 now, we know that something really difficult is happening that we have to get a grip on.
We are right in the Wild West bit of social media and how the internet is working at the moment. We all, in our democratic societies, have to think of ways to get a grip on the truth and ensure that people can distinguish the truth from fiction. That is really important if we are going to defend our democracy. Do not ask me how to do it at the moment—I am still thinking about it—but all democratic societies have to think about how to reassert those values and those facts in our national lives.
The Chair: Mr Hargreaves, does the Resilience Academy have a role in relation to this kind of training for young people?
Roger Hargreaves: No, not directly. The Resilience Academy is largely focused on the provision of technical training in relation to resilience for people who work in the area, particularly in local response organisations and businesses. It is a big training organisation based in North Yorkshire and has a very significant throughput of courses physically and online.
Separately, we do training inside government through the Crisis Management Excellence Programme, which is focused on a wide range of civil servants at different levels, as well as Ministers and special advisers. Again, that is largely about the management of crisis. An important element of that training is on communications with the public, which does touch on misinformation and disinformation, but it is probably a more technical approach to how you get government messages across in a trusted way, and there have been some quite big changes in how we approach it.
Particularly during a crisis, we see a point of vulnerability around misinformation and disinformation, first, because people want to share information, and secondly because foreign states or others who wish us harm will sometimes try to amplify problems. We have changed the way in which we communicate in a crisis and moved away from a model that you would have observed in the early stages of Covid, which involved very simple messages, assuming a public who would not be compliant and needed simplicity, and so things cut through there—the “hands, face, space” sort of message.
Following the end of Covid, something that has now been baked into our doctrine more generally is that you give the public more information. They are far more intelligent consumers of that information than they have been given credit for in the past. They will do what they are advised to do, if that advice is sensible, clear and evidenced. Therefore, the provision of more information from government is not only one of the best antidotes to the misinformation and disinformation, but also a vehicle to getting the public to play their part in a crisis, which touches on some of the earlier points as well. That is all now set out in the guidance and the training.
Dame Angela Eagle: There are also things that the DfE is doing about education in the area of disinformation and misinformation, and some of the preparations that it is doing for the proposals to lower the voting age. There is a range of work going on across government dealing with some of that. We also have to think about how we can get a handle on how some of this stuff gets dispersed through the internet. We certainly do that for child sexual abuse. We do it for terrorism. We have to think about how to get a less damaging series of things available, often to be consumed by very young, impressionable minds.
Roger Hargreaves: I have a very brief point on the international comparisons. We do an awful lot of work with our international comparators. We do a lot of that through NATO, as the Minister said, but we also have a lot of important bilateral relationships. You do not go to another country and say that you are doing a bad job of stuff. You present your best possible story, and so you will hear good stories about what other people do.
We have got to a point with a number of key countries where we have a much more honest dialogue, and we are sharing our best practice with them, and they share theirs back with us in return. We are doing a lot of work with the Scandinavians, who are very interested in the work that we do on risk and on data. We learn a lot from them on public information.
Baroness Winterton of Doncaster: It is the joint international action that is required. It is not just best practice, but the joint element.
Roger Hargreaves: A really good example of that is Ireland. We used not to do much with Ireland at all. If you are looking at our international co-operation on civil protection through an EU lens, Ireland is not a big player in the context of the EU, but, in the context of our geography and our relationships, Ireland is critical and, arguably, our most important international partner on civil protection work. We have an MoU with the Irish. We meet with them regularly. We talk to them a lot about cross-border issues, co‑operation and operational co-ordination.
We do that also with the French, the Dutch and the Scandinavians, with whom we share operational priorities as well. We have found that we have a really good basket of international co-operation, but it is definitely not a one-way street with other people telling us how it is done. There is as much in the other direction, where we are sharing our best practice, and people are really keen to talk to us, because they can often see the quality of what we do.
The Chair: Thank you. You will be relieved to hear that Baroness Helic has the last question, but it is a substantial one.
Q190 Baroness Helic: It is. Thank you so much for your contributions so far. I think that you have covered a lot. What has not been covered yet are legislative changes that may need to be introduced. With that in mind, what specific gaps and overlaps in the current resilience framework do the Government believe require legislative change? How would those gaps and overlaps be addressed through the upcoming review of the Civil Contingencies Act and other related reforms?
Dame Angela Eagle: You are right to point out that there is a review. We have just issued a public call for views on that. We think that Part 1 of the Act, which sets up all the local resilience forums, is solid and works well, but we are anxious to learn if there is anything else that we can do to make it better. We have added certain bodies, for example, to the local responders, which have obligations under Part 1.
In category 2, we have added the Met Office. We have added the Coal Authority because of legacy industrial issues. If a sinkhole opens up, you probably need the Coal Authority to tell you what is going on underground. There is a range of things that we have done to try to make it up to date.
The other thing that I have clocked is that the local resilience forums are based on police authority areas, and we are in the middle of looking at police reform to reduce the number of them, so there may be a boundary issue. There are also issues around English devolution changes since the Civil Contingencies Act came into being in 2004.
We will be looking at those things, but we are approaching it with an open mind in terms of the public call for views that we have asked for. We will deal with our views on all of this as part of the review that is due to be published next year.
The Chair: Do you have a role in the legislative review, Mr Hargreaves?
Roger Hargreaves: I am responsible for making sure that it is delivered, so in that sense, yes. As the Minister said, we could invest an awful lot of time continually rehashing the legislative frameworks, but they are quite general, and that allows us to do a lot within them. This process is as much about the regulations and guidance that underpin the legislation and oversee delivery, rather than ripping up the primary legislation and starting again.
There are changes that we have had to make over the years. We review the Act every five years, so it is not as though it is 20-plus years old and we have not looked at it before. We adjust it carefully each time to reflect changing institutional arrangements.
There are a couple of other areas where we are doing some exploratory work on the coverage of the Act. These relate largely to what we were discussing earlier on the role of the private sector. There are two things in particular. The first is whether we have the right arrangements for critical national infrastructure. A lot of CNI is regulated, but not all of it, so are there gaps we need to fill in, in terms of the extent to which we have regulatory powers across all CNI?
Secondly, there is a particular issue around the behaviour of individual businesses. They might make perfectly rational business decisions individually, but those business decisions can have wider external effects that lead to emergencies. On the same principle that we would have environmental legislation that applies to businesses because their behaviour, while perfectly rational as a business, has environmental externalities that flow from it, there is a question about whether we need to be able to take steps if a business is doing something that might lead to an emergency.
It is not always straightforward to tackle that, and the powers that we have are very general, so we are looking at that question in particular. We are not idle on the legislative regime. We understand it really clearly. We are adjusting it where we need to, and we are going through quite a process at the moment.
Lord Spellar: You mentioned the powers being general, but possibly not broad enough. Is there a case, with the developing international crisis, for putting in something like the United States Defense Production Act or our previous Defence of the Realm Act that fundamentally enables legislation to face a crisis?
Roger Hargreaves: There is a commitment to have a defence readiness Bill, which is being generated at the moment. The defence readiness Bill would be partly analogous to the relevant defence production legislation in the US, which is about making sure that the economy and society are configured for the pre-war phase and allows you to build capacity, supplies and infrastructure.
In the UK system, what has happened traditionally is that you have that kind of enabling legislation early on, and then, at the point when you go into conflict, you have a Defence of the Realm Act or similar, which gives you wartime powers. If we found ourselves in a scenario where we were facing conflict, we would probably follow the same model: do the defence readiness Bill now and come to the defence regulation-making powers later on. That is the model that works well in the UK.
It is worth also observing, though, that the emergency powers provisions in the Civil Contingencies Act are, themselves, the child of the Emergency Powers Act that was passed in 1920, which, in turn, permanently put on to the statute book the defence regs from World War I. The mechanics have been in place for 100 years, and this is about an overlay, particularly for wartime powers, rather than something that is an area of absence.
Dame Angela Eagle: I do not think that the emergency powers have ever been used in this form.
Roger Hargreaves: No, not in this form.
Dame Angela Eagle: I hope that that will remain the case, but they are there.
The Chair: You have been extremely generous with your time. We are very grateful. Your answers have been of huge help to us. Thank you.
