Cyber-attack: Microsoft

(Urgent Question): To ask the Secretary of State for Foreign, Commonwealth and Development Affairs if he will make a statement on the reported Chinese state-sponsored cyber-attack on Microsoft exchange servers.

I thank my right hon. Friend for asking this important and timely question. Yesterday, on 19 July, the UK Government joined like-minded partners to confirm that Chinese state-backed actors were responsible for gaining access to computer networks around the world via Microsoft exchange servers. As the Foreign Secretary made clear in a statement yesterday, this cyber-attack by Chinese state-backed groups was reckless, but sadly a familiar pattern of behaviour. The Chinese Government must end this systematic cyber-sabotage and can expect to be held to account if they do not.

The attack was highly likely intended to enable large-scale espionage, including acquiring personally identifiable information and intellectual property. At the time of the attack, the UK quickly provided advice and recommended actions to those affected. Microsoft has reported that, at the end of March, 92% of customers had installed the updates that protected against the vulnerability.

As part of that announcement, the UK also attributed the Chinese Ministry of State Security as being behind activity known by cyber-security experts as APT40 and APT31. Widespread, credible evidence demonstrates that sustained irresponsible cyber-activity emanating from China continues. The Chinese Government have ignored repeated calls to end their reckless campaign, instead allowing their state-backed actors to increase the scale of their attacks and act recklessly when caught.

Statements formally attributing Chinese responsibility for the Microsoft exchange attack and actions of APT40 and APT31 were issued by the EU, NATO, the UK, Canada, the US, Australia, New Zealand, Norway and Japan. That co-ordinated action by 39 countries sees the international community once again calling on the Chinese Government to take responsibility for their actions and respect the democratic institutions and personal commercial interests of those they seek to partner with. The UK is calling on China to reaffirm the commitment made to the UK in 2015 as part of the G20 not to conduct or support cyber-enabled theft of intellectual property or trade secrets.

I simply make the point that it is a surprise that it has taken you, Mr Speaker, to bring the Government to the Dispatch Box when they could have made a statement yesterday.

This is the latest form of Chinese attack—it is not a one-off—on the west, which has included espionage, economic sanctions against Australia, wolf warrior diplomacy and naval aggression in the South China sea to name but a few.

I have some questions for my right hon. Friend. Will he explain why the Government did not come to the House yesterday to make a statement? Given that this is an aggressive attack, why are the Government allowing the UK’s largest silicon chip manufacturer, Newport Wafer Fab, to be bought by a Chinese firm when they know very well what they are up to? Why is it that the US Justice Department, also with this, brought federal criminal charges against four named MSS officers over their role in the hacking of the American targets, yet no such charges have been brought against operatives here?

The integrated review said clearly that Russia was a threat to the UK, but China was merely a competitor. I wonder why, if China goes on attacking us and trashing us, we continue with this deceit when it is quite clear that China is a clear and present threat. Beyond tearing up the treaty, conducting a genocide and upsetting the international order, China has now been found to be conducting systematic attacks on targets in the UK. Will the Government now finally agree to a diplomatic boycott of the Beijing winter Olympics to make their statement clear?

On a personal note, you will know, Mr Speaker, that I set up, with others, the Inter-Parliamentary Alliance on China—politicians left and right in 20 countries who are concerned about China’s activities. There are over 200 members. I understand now that there is intelligence from Five Eyes sources that shows that a very active and direct threat from the Chinese Government is aimed directly at the co-chairs of the Inter-Parliamentary Alliance on China. Some of the co-chairs, of which I am one, have now been warned by their intelligence services in receipt of this that they should be very careful and that they will be supported. Can I ask my right hon. Friend to confirm whether his Government are in receipt of this same intelligence and, if so, why have they not informed the co-chairs and others here in the UK, as other allies have done?

I thank my right hon. Friend for the points that he has made. The unanimity of voice among the international partners—the 39 countries that I listed—is incredibly important to us, and we will continue to seek to work collaboratively with our international partners in our response to this. My right hon. Friend makes the point about Chinese investment, or Chinese purchasing—specifically Newport Wafer Fab—and that is a decision that the Government are looking to review. He asks about the differential language between China and Russia. Our response is based on the actions, and we will continue to react robustly to any and all cyber-attacks that occur. He will understand, I am sure, that I am not necessarily going to go into details here and now about what further measures we might take, because to do so might undermine their effectiveness, but we will continue to work with international partners; and, as I said in my answer to his question, the Chinese Government should expect to be held to account if they do not come back into compliance with norms of behaviour.

With regard the Olympics, my right hon. Friend the Foreign Secretary has said that we have not as yet made a decision on formal attendance at the Olympics. The attendance of athletes is ultimately a decision for the British Olympic authorities. On intelligence matters, my right hon. Friend the Member for Chingford and Woodford Green (Sir Iain Duncan Smith) will understand that we do not discuss intelligence-related issues on the Floor of the Chamber, but I take his point about making sure that people who are potentially the target of overseas intelligence actions are given the opportunity to defend themselves against them.

This is an unacceptable attack, costing businesses millions and raising the alarm for people across the country, who will be concerned that their personal information could be compromised. The Government confirmed yesterday that a quarter of a million servers were affected worldwide, but how many British businesses and organisations were victims of the attack and how many may still be vulnerable? What is the cost to British businesses of compromised data and were public bodies among those targeted? Can the Minister guarantee that hospitals, local authorities, universities and this Parliament have not and will not be compromised?

The Government have been repeatedly warned about this. A year after the Russian report was published, still no meaningful action has been taken. The Computer Misuse Act 1990 is now three decades old. It was written before smartphones, before Google—before the public could even use the web. When will the Government finally update it? The Minister says that this is a pattern of behaviour, and he is right, but Ministers have tried naming and shaming before. It did not work then, so why would it work now? Only weeks ago, President Xi said that those who expressed dissent about China’s actions would

“have their heads bashed bloody against the Great Wall Of Steel forged by over 1.4 billion Chinese people.”

Last year the Government were willing to act. They announced targeted sanctions against individuals involved in the Russian state-backed cyber-attack on the German Parliament. So why are there no sanctions in response to the Chinese state-backed cyber-attack on, among others, the Finnish Parliament?

The truth is that the Government are unable to send a clear, coherent message to Beijing because they are still arguing among themselves. Just two weeks ago, the Chancellor was telling Mansion House that it was time to realise the potential of our relationship with China. While the Foreign Secretary imposes sanctions, the Chancellor is cashing cheques. It is extraordinary that the Minister can stand at the Dispatch Box today and refuse to tell us how he will safeguard critical infrastructure, or whether he and his colleagues will board a plane to Beijing early next year to participate in a public relations exercise. The seriousness of this attack must concentrate minds. We need a coherent strategy. When are we likely to get one?

In response to the specific questions that the hon. Lady raised, we estimate—we can only estimate—that 3,000 UK-based organisations were put at risk by this attack. It was an untargeted action. It was not targeted at specific sectors. We do not believe that Government organisations were a victim of it, and because it was an untargeted action it is not possible for me to give a credible assessment of the economic damage of this particular attack. The National Cyber Security Centre and Microsoft gave advice at the time and, as I say, by the end of March it was estimated that 92% of organisations had installed the patch to protect themselves. Advice is available to any organisation that still thinks it may be at risk in some way, both from the National Cyber Security Centre and from Microsoft.

With regard to our attendance at the winter Olympics, my right hon. Friend the Foreign Secretary answered that point in departmental questions. There is nothing more that I can add to that.

The hon. Lady asked about naming and shaming. The fact that 39 countries collectively put their name to the statement is unprecedented, and it sends a significant signal that countries are working together to steer China’s actions. China is a significant economic and political player. We cannot pretend that China does not exist. We want China to change its behaviour, and we will work with international partners to urge it to do so. As I say, we reserve the right to take further actions if necessary.

I call the Chair of the Intelligence and Security Committee, Dr Julian Lewis.

As the ISC’s inquiry into China is still current, I shall limit myself to asking why the Government generally describe the communist Chinese system as authoritarian rather than totalitarian, what the Minister’s understanding is of the difference between the two, and whether the Chinese regime took any steps to close down the hacking group APT10, which was denounced in a similarly forceful statement by the then Foreign Secretary, my right hon. Friend the Member for South West Surrey (Jeremy Hunt), and our allies in December 2018.

I understand the point that my right hon. Friend makes about the use of language. I am not in a position to have a debate on that specific point, but I make the broader point that the UK Government’s actions, and indeed the actions of our friends and allies around the world, are based on actions whether they be from Russia, China or wherever else, rather than on the narrow definition that may be found in international documents.

The reason that we put out this joint statement and attributed responsibility to state-backed Chinese actors is to let the Chinese Government know, to an extent, that we can tell what they are up to and we will not accept it. That is why taking actions in concert with our international partners is so important and will always be the foundation stone of whatever else we choose to do in response to the behaviour, if it does not change.

I call the SNP spokesperson, Alyn Smith.

I warmly congratulate the right hon. Member for Chingford and Woodford Green (Sir Iain Duncan Smith) on raising this vital issue, and echo his concern about the fact that this was an urgent question rather than a statement made proactively by a representative of the Government.

I was glad to hear a Minister say that China can expect to be held to account for this truly breathtaking attack, which facilitated a range of attacks on private and public organisations on a broad scale by other actors. I applaud the statement that there will be sanctions—there will be measures—but I would like to hear what they are, because a somewhat homeopathic approach to date does not seem to have had much of an impact on stopping anything.

May I suggest that it is the UK Government’s breathtaking lack of policy coherence that is giving mixed signals to Beijing? I can give a fairly concrete example. China General Nuclear Power Group remains a significant stakeholder in the Hinkley Point C nuclear power plant, but the UK is pushing for another deal at Sizewell which will involve an even bigger Chinese state holding. May I also suggest that ending policy incoherence starts at home, and we should really see about that?

Countries around the world trade with and receive investments from China, and, as I have said, pretending that that does not exist or that it is not a significant economic player in the world is completely unrealistic. What we are seeking to do is change China’s behaviour, and we are doing it collaboratively with our international partners.

The hon. Gentleman asked what specific actions we would take. I will not answer in detail at the Dispatch Box—[Interruption.] For the same reason that we do not discuss intelligence matters, we do not speculate on future sanctions, because to do so would undermine the effectiveness of those measures. However, as I have said, we and our international partners have made it clear that these actions will not go unresponded to.

If you will allow me, Mr Speaker, I should like to wish you, and especially the people on the estate who are celebrating it, a very happy Eid Mubarak.

I am not going to ask the Minister to explain China’s actions, but I want him to try to explain why we do not align ourselves with our allies—particularly the United States—who have moved much further on this issue, notably in protecting individuals who have been sanctioned or targeted by China. As has already been mentioned, IPAC’s website has been hacked twice; colleagues on IPAC are also being hacked, as it were—I cannot think of a more appropriate term—and there are four sanctioned MPs on the call list today. We need far more support than is being provided at present.

May I ask the Minister whether the Foreign Office has reached out to Alan Estevez, who was appointed by the Biden Administration to take over security with a special focus on China tech concerns? We seem to be moving at a snail’s pace while America is moving far faster, and, of course, China is light years ahead. It is here, Mr Speaker: it could be hacking the estate, it could be hacking sanctioned MPs’ websites or email addresses and it could be hacking Ministers’ servers, but we are none the wiser, and we do not feel any more protected after the Minister’s response to the urgent question.

I completely understand my hon. Friend’s concerns, but I assure her that we work incredibly closely with international partners, including the United States of America. The unprecedented number of countries and multilateral organisations that co-authored yesterday’s statement is testimony to how closely we are working on this issue as an international community. However, I will certainly take back the points that my hon. Friend has raised about ensuring that individuals who may be the target of cyber-attacks are given all the support that they need both to defend themselves and to respond to those attacks.

It is absolutely right that we are working in lockstep with our international allies to combat these attacks on our cyber-security. However, the Minister will be aware of hugely concerning reports that activists, civil society leaders, Government officials and politicians around the world have been targeted by NSO Group’s Pegasus software. Is he aware of any individuals in the Government, or indeed any UK citizens, who have been targeted by that software, and is there any indication that it may have been used by the Chinese Government?

The House will understand that I will not discuss security and intelligence operations at the Dispatch Box, and that I therefore will not be responding to that part of the hon. Lady’s question. We do of course know about the capabilities of the Pegasus software; its licensing is ultimately a decision for the Israeli Government, but we are working closely with our friends and allies around the world in response to any emerging technical threat at this time.

Cyber-capabilities are the new arms race, but skills are in short supply. How can we best work with our allies to build the skilled workforce we need to defend ourselves in cyber-space?

My hon. Friend is absolutely right that skills are an important part of our arsenal to defend ourselves. The Government are working with industry, academics and many other partners to ensure that we develop the essential cyber-skills we need to be a credible force in the modern world. In April, we launched the UK Cyber Security Council as a new professional body for cyber to raise standards and guide people through their career. In addition, the UK has committed to promoting an international stability framework for cyber-space, based on the application of existing international laws, voluntary norms of responsible behaviour and confidence-building measures.