Cyber-security and UK Democracy

With permission, I will make a statement about malicious cyber-activity targeting the United Kingdom by actors that we assess are affiliated to the Chinese state. I want to update the House on our assessment of this activity and to reassure it on the steps that the Government have taken to shore up our resilience and hold those actors to account.

I know that right hon. and hon. Members on both sides of the Chamber will recognise the seriousness of this issue, particularly in a year when so many democratic elections will be taking place around the world. Members will want to be reassured that the Government are taking steps to address the associated threat.

I can confirm today that Chinese state-affiliated actors were responsible for two malicious cyber-campaigns targeting both our democratic institutions and parliamentarians by, first, compromising the United Kingdom’s Electoral Commission between 2021 and 2022, as was announced last summer, and secondly, by attempting reconnaissance activity against UK parliamentary accounts in a separate campaign in 2021.

Later today, a number of our international partners, including the United States, will issue similar statements to expose this activity and to hold China to account for the ongoing patterns of hostile activity targeting our collective democracies. Mr Speaker, you and parliamentary security have already been briefed on this activity. We want now to be as open as possible with the House and with the British public, because part of our defence is in calling out this behaviour.

This is the latest in a clear pattern of hostile activity originating in China, including the targeting of democratic institutions and parliamentarians in the United Kingdom and beyond. We have seen this in China’s continued disregard for universal human rights and international commitments in Xinjiang, in China’s erasure of dissenting voices and stifling of the opposition under the new national security law in Hong Kong, and in the disturbing reports of Chinese intimidation and aggressive behaviour in the South China sea. That is why this Government have investigated and called out so-called Chinese overseas police service stations and instructed the Chinese embassy to close them.

However, China’s cumulative attempts to interfere with the UK’s democracy have not succeeded. Last summer, the Electoral Commission stated that it had been a victim of a complex cyber-attack between 2021 and 2022. That was the work of Chinese state-affiliated actors who gained access to the Electoral Commission’s email and file-sharing systems, which contain copies of the electoral register. As the Electoral Commission stated in 2023, when that attack was first made public, the compromise has “not affected” the security of elections. It will not impact how people register, vote or otherwise participate in democratic processes. I want to reassure people that the compromise of that information, although obviously concerning, typically does not create a risk to those affected. I want to further reassure the House that the commission has worked with security specialists to investigate the incident and remove the threat from its systems, and has since taken further steps to increase the resilience of its systems.

In addition, the National Cyber Security Centre assesses that it is almost certain that the Chinese state-affiliated cyber-actor known as APT31 attempted to conduct reconnaissance activity against UK parliamentary accounts during a separate campaign in 2021. Hon. Members may recall that APT31 was one of several cyber-actors attributed to the Chinese Ministry of State Security by the UK and its allies in July 2021. That email campaign by APT31 was blocked by Parliament’s cyber-security measures; in this case, it was entirely unsuccessful. However, any targeting of Members of this House by foreign state actors is completely unacceptable.

Taken together, the UK judges that those actions demonstrate a clear and persistent pattern of behaviour that signals hostile intent from China. That is why the UK has today sanctioned two individuals and one entity associated with the Chinese state-affiliated APT31 group for involvement in malicious cyber-activity targeting officials, Government entities and parliamentarians around the world. We are today acting to warn of the breadth of targeting emanating from Chinese state-affiliated actors such as APT31, to sanction those actors who attempt to threaten our democratic institutions, and to deter both China and all those who seek to do the same.

Last week, at the summit for democracy in Seoul, I said that we would call out malicious attempts to undermine our democracy wherever we find them. This is an important tool in our armoury and today we are doing just that. The UK does not accept that China’s relationship with the UK is set on a predetermined course, but that depends on the choices China makes. That is why the Foreign Office will be summoning the Chinese ambassador to account for China’s conduct in these incidents. The UK’s policy towards China is anchored in our core national interests. We will engage with the Chinese Government where it is consistent with those interests, but we will not hesitate to take swift and robust actions wherever the Chinese Government threaten the UK’s interests—we have done so today and previously. This Government will continue to hold China and other state actors accountable for their actions.

We will also take serious action to prevent this behaviour from affecting our security. The steps we have taken in recent years have made the UK a harder operating environment for foreign state actors seeking to target our values and our institutions. Through the National Security Act 2023, we now have, for the first time, a specific offence of foreign interference. That new offence will allow law enforcement to disrupt state-linked efforts to undermine our institutions, rights or political system.

Our National Security and Investment Act 2021 has overhauled our scrutiny of investment into the United Kingdom by giving the Government powers to block, unwind or put conditions on investments that could create national security risks. We have significantly reduced China’s involvement in the UK’s civil nuclear sector, taking ownership of the CGN stake in the Sizewell C nuclear power project and ensuring Chinese state-owned nuclear energy corporations will have no further role in the project.

We have put in place measures to prevent hostile infiltration of our universities, including protecting campuses from interference through the Higher Education (Freedom of Speech) Act 2023. The Procurement Act 2023 includes national security devolvement provisions that allow us to act where we see malicious influence in our public procurement. I have taken steps to reduce the Government’s exposure to Chinese operators, banning Hikvision and TikTok from Government buildings and devices. Through the national cyber-security strategy, we are investing £2.6 billion to increase the cyber-resilience of our critical national infrastructure by 2025, making the most important parts of our digital environment a harder target for state and non-state actors.

The Government are continuing to build the tools, expertise and knowledge to respond to the systemic challenge that China poses to the United Kingdom’s security and its values. The integrated review refresh in 2023 took steps toward this, doubling funding for a Government-wide programme, including investment in Mandarin language training and deepening diplomatic expertise.

We must be clear that this is not a problem for the Government to solve alone. That is why we created the National Protective Security Authority within MI5 to help businesses and institutions play their part in protecting our security and prosperity. The NPSA will help organisations in the UK’s most sensitive fields, including critical national infrastructure operators and world-leading science and tech sectors, to protect themselves against state threats. I set up the economic security public-private forum to ensure businesses and business leaders in crucial sectors understand the threat to the UK and what they can do to defeat it.

In Parliament, the National Cyber Security Centre has launched an opt-in service for Members of both Houses. This allows the NCSC to alert high-risk individuals if they identify evidence of malicious activity on their personal devices or account, and swiftly advise them on steps to take to protect their information. Today, the NCSC has published new guidance for political organisations, including political parties and think-tanks, which will help these organisations take effective action to protect their systems and their data. The NCSC is also working with all political parties to increase the uptake of their active cyber-defence services in the lead up to a general election. A key component of increasing our resilience is supporting the NCSC and parliamentary authorities by taking up that cyber-security offer. I urge all Members of this House to do so. I will be writing to colleagues later today, setting out again the steps that they can take.

At the summit for democracy, I was struck by the powerful strength of our collective voices when we work together to defend our democratic freedoms. The summit provided the United Kingdom Government with a platform to build international agreements on a new global Government compact on countering deceptive use of AI by foreign states in elections. It is important and welcome that our partners across the Five Eyes, as well as those in Europe and the Indo-Pacific, are standing in solidarity with our efforts to call out malicious cyber-activity. I pay tribute to the dedicated public servants, whose painstaking work has continued to expose the reality of the threat we face.

Our political processes and institutions have not been harmed by these attacks. The Government will continue to call out and condemn this kind of activity in the strongest terms. We will continue to work with our allies to ensure that Chinese state-affiliated actors suffer the consequences of their behaviour. We will take preventive action to ensure these attempts do not succeed. The cyber-threat posed by China-affiliated actors is real and serious, but it is more than equalled by our determination and resolve to resist it. That is how we defend ourselves and our precious democracy, and I commend this statement to the House.

Order. This was an important statement, which is why it has run on quite a lot longer than the normal 10 minutes. I am sure everybody will agree that if the two Front-Bench speakers need a little extra time, we will be flexible in exactly the same way. I call the shadow Secretary of State, Pat McFadden.

I thank the Deputy Prime Minister for his statement, and for advance sight of it. It is a statement about which there has been significant briefing in the press over the past couple of days. On questions of national security, Labour will support the Government in efforts to counter attempts by China, or any other state, to interfere with or undermine the democratic process, or attempts to stop elected representatives going about their business, voicing their opinions, or casting their votes without fear or favour. With that in mind, I pay tribute to the efforts made every day by the intelligence and security services to protect the public, and to protect our democracy and way of life. The economic relationship between the United Kingdom and China can never mean compromising on national security or our democratic integrity.

The Deputy Prime Minister’s statement touches on a number of issues, and I have some questions about them. Will he say more about the Government’s assessment of Chinese motives? Does he believe, for example, that Beijing wants to disrupt our democratic process, or instead to gather data about our citizens for some other reason? On the specific issue of the Electoral Commission and the electoral register, why does he think that the Chinese Government hacked what is a publicly available database? Does he believe they were after the details of those who may not be on a public register for good reasons, for example because they might be employed in security-sensitive areas? Does he believe they were after details and the personal data of political donors, or was there some other motive?

The Deputy Prime Minister referred to the democratic electoral process, and with an election coming it is vital that people have confidence in their ability to register and to vote. Will he confirm that our electronic register to vote system is sufficiently well protected? He said that the attacks on parliamentary accounts were unsuccessful. Does he believe that China now wants to engage in the kind of hack and leak activity that we have in recent years associated with Russia, in order to compromise either individual politicians or the wider democratic process? On sanctions, only last week the Minister of State was reluctant to respond to the claim that the Foreign Office “indefinitely paused” targeted sanctions against Chinese officials late last year. Will the Deputy Prime Minister explain what has changed in the past week?

I thank the right hon. Gentleman for his questions. I shall seek to address as many of them as I can.

When it comes to Chinese motivations, ultimately, it is a matter for the Chinese to be able justify their motivations, but the points that the right hon. Gentleman made were apposite. First, the Chinese look at successful democratic countries, such as the United Kingdom, Japan or the Republic of Korea where I was last week, and they want to seek to undermine them. It is no surprise therefore that they should seek to interfere in electoral processes, in the way that we have seen conduct from Russia that aligns with that. Indeed, the successful democratic elections around the world right now stand in contrast to the sham elections that we saw in Russia last weekend.

On the right hon. Gentleman’s point about the public record of the Electoral Commission, I think that that is the essence of what has happened here. These attacks and these attempts were ultimately pretty unsuccessful. I reassure the right hon. Gentleman and Members of this House that there was no infiltration of the closed register of the Electoral Commission, so the concerns that he raised have not arisen. On the further strengthening of the electoral register, that is precisely the work that the National Cyber Security Centre does in co-ordination with GCHQ, working with Government agencies, including the Electoral Commission.

The right hon. Gentleman was right to raise the risk of hack and leak. It is certainly something that we saw in previous elections, and I remain concerned. I also remain very concerned about artificial intelligence, deep fakes in particular, being used to disrupt elections, hence the work that I undertook at the conference last week and the progress that we are making with the accord on artificial intelligence use by malign states.

In relation to targeted sanctions, it is not the case that the Foreign, Commonwealth and Development Office paused targeted sanctions. On the conduct of the former Foreign Secretary—[Interruption.] I am not sacking the Foreign Secretary from the Dispatch Box. On the conduct of the current Foreign Secretary, who sits in the other place, all appointments to Government are subject to the usual propriety and ethic processes. Lord Cameron is addressing the 1922 Committee in his capacity as Foreign Secretary in the usual way, addressing a wide range of issues. It is not a specific briefing on this issue, but if leaders of the principal Opposition parties wish to have a further briefing on this issue I am of course very happy to facilitate that, in the way that they know I have done in relation to other national security issues.

Tomorrow, it will be three years since parliamentarians here were sanctioned; your defence of us, Mr Speaker, has been remarkable. Although I welcome the two sanctions from the Government, it is a little bit like an elephant giving birth to a mouse. The reality is that in those three years the Chinese have trashed the Sino-British agreement and been committing murder, slave labour and genocide in Xinjiang. We have had broken churches, and, in Hong Kong, false court cases against Jimmy Lai. My question is: why two? America has sanctioned more than 40 people in Hong Kong; we have sanctioned none, and only three lowly officials in Xinjiang. Surely the integrated review should be changed. China is not an epoch-defining challenge, strange as that may be, but it is surely a threat. Can the Government now correct that, so that we all know where we are with China?

My right hon. Friend’s views are well known to me, I genuinely welcome the constructive, at most times, debate that I have with him, but nobody should be in any doubt about the gravity of this matter. These are not the actions of a friendly state, and they require our serious attention. As he has described, this is an escalating situation. The measures that we have announced today are the first step, but the Government will respond proportionately at all times to the facts in front of us. No one should be in any doubt about the Government’s determination to face down and deal with threats to our national security, from wherever they come.

I call the SNP spokesperson.

I thank the Deputy Prime Minister for his statement, and for advanced sight of it. In the statement, he said:

“I have taken steps to reduce the Government’s exposure to Chinese operators, banning Hikvision and TikTok from Government buildings and devices”,

but the reality is that the Hikvision ban extends only to sensitive sites, despite the fact that we have pushed him to ensure that it extends to all public buildings. Surely the majority of things that happen in government involve some sort of confidential information. Will he confirm whether he is extending the ban beyond sensitive sites to all Government sites, as we have been calling for for a number of years? The attacks on the Electoral Commission and parliamentarian accounts happened nearly three years ago. Will we be sitting here in 2027 hearing about an attack that is happening right now? The EU is currently delivering €240 million for cyber-security to improve its collective resilience. Will the Government deliver an equivalent fund for these islands? Finally, without more action, can he give us real assurances that this year’s general election will take place without international interference?

As the hon. Lady is aware, we currently ban Hikvision, and indeed any other Chinese technology relating to CCTV. We continue to keep that under review. I do not rule out a further progression in the policy, but that is not the case right now.

On the time taken, it is essential that, before Ministers stand at the Dispatch Box and make assertions attributing such activity to a hostile state, we are absolutely sure of the basis on which we do so. That requires extensive work by our intelligence agencies, it requires fine judgments to be made, and it requires work to be done with our allies around the world—there will be comments from the United States shortly after my statement. I would rather we did this in the proper way.

We have invested £2.6 billion on cyber-security during this spending review. I can never be totally confident in relation to cyber-security—no Government Minister anywhere in the world can be; it is an environment in which the risks are escalating all the time and are turbocharged by artificial intelligence—but I can assure the hon. Lady and other Members that we are constantly increasing our activity and vigilance in the face of it.

Like my right hon. Friend the Member for Chingford and Woodford Green (Sir Iain Duncan Smith), I am rather underwhelmed by this statement. In the three years since seven parliamentarians were sanctioned, we have been subject to intimidation, impersonation and hacking, as have the families of exiles from China with whom we have associated. Today, the Deputy Prime Minister has described hostile actors’ malign acts towards the integrity of our electoral system and parliamentary democracy—foreign interference—and sanctioned two individuals and one company employing 50 people with a turnover of £208,000. Does he think that that is proportionate, and can he confirm that the Government will put the whole of the Chinese Communist Government in the enhanced tier of the foreign influence registration scheme?

My hon. Friend may be aware that we are currently in the process of collective Government agreement in relation to the enhanced tier of the foreign interference registration scheme. Clearly, the conduct that I have described today will have a very strong bearing on the decision that we make in respect of it.

In relation to the sanctions, it is worth noting that this is the first time that the Government have imposed sanctions in respect of cyber-activity. I believe that they are proportionate and targeted, but they also sit in the context of actions that we have been taking with our international allies. They are a first step, and we remain totally open to taking further steps as the situation evolves. The path we are going on with this is clear.

My first reaction is: “Is that it?” The spin was clearly not matched by this statement. The Deputy Prime Minister says that there is an issue around nuclear and higher education. That is because the Government encouraged China to invest in nuclear, and cut the budgets of our universities so they are reliant on Chinese students. The Deputy Prime Minister also ducked the question asked by my right hon. Friend the Member for Wolverhampton South East (Mr McFadden) about Lord Cameron. Will Lord Cameron publish all the money and interactions that he had with Chinese entities when he was out of government? The Deputy Prime Minister says that he is committed to the security services. Why, then, in the Budget on 6 March, was the security budget cut by £600 million next year? That is not a sign of a Government who are taking this issue seriously.

The Foreign Secretary has provided a full declaration of all his interests—

No he hasn’t!

I will take lectures from Labour Members on action in relation to security threats with a pinch of salt. It was this Government who introduced the National Security and Investment Act 2021; it was this Government who passed the Higher Education (Freedom of Speech) Act 2023; it was this Government who passed the National Security Act 2023—none of which we saw from the Labour party during its years in office.