To ask His Majesty’s Government what further steps they will take to ensure that ministers do not use private (1) mobile telephones, and (2) email accounts, for conducting government business.
The Government have robust systems in place to protect against cyber threats and we are vigilant in ensuring that these are up to date and meet the challenges of the modern world. Just yesterday, the Security Minister announced that he was establishing a new task force from across departments, the security and intelligence agencies, the private sector and civil society to meet these big challenges. All new Ministers receive a general security briefing in their first weeks in government. The National Cyber Security Centre and government security officials then regularly provide Ministers with specific advice on protecting personal data and managing online profiles, as well as on best-practice guidance.
But the system is not robust, as the Minister claims. The previous Prime Minister had her phone hacked. The Home Secretary leaked classified information and, during the early days of Covid, Johnson, the Prime Minister, used a phone that then was lost with all messages unobtainable. At this rate, we are going to have to ask the Russian secret services for all the details about where and when ministerial decisions were made. [Laughter.]
Good. The Government take matters of security very seriously. Of course, I am not going to comment on individual cases—that would not be appropriate—but I draw attention to the fact that the Home Secretary has provided a very detailed account, step by step, in a very full letter to the Home Affairs Select Committee and, of course, she apologised for her error and resigned. The Prime Minister has now appointed her to do a very important job.
My Lords, the noble Baroness will be aware that the former Prime Minister, Boris Johnson, and his entire Cabinet at that time, many of whom are now back in the Cabinet, were warned in 2019 not to use their personal phones for business but it appears that some continued to do so. Can the Minister confirm what guidance was given to Cabinet Ministers at that time? Is it still being given to Cabinet Ministers? How is that guidance being enforced and is not obeying those rules a breach of the Ministerial Code?
I will not, of course, comment on the particular; however, it is the case that government systems should be used, as far as practicable, for government business. The guidance issued and kept under review does not rule out the use of different forms of electronic communications in some circumstances. There has to be a place for a variety of digital channels. Ministers have informal conversations from time to time and they have to use a variety of digital communications for personal, political and parliamentary matters.
My Lords, Ministers have said that they are conducting government business on Signal, a messaging app that deletes messages after five seconds and can block screen grabs. How is this compatible with official rules on the use of private devices for such business, particularly when having to send copies of messages to civil servants?
As I said, government systems should be used as far as practicable. In some cases it is not possible to do that, and in some cases it is not appropriate—for example, changing the time of a meeting can be done perfectly well in this digital world. Having said that, the Cabinet Office has previously published guidance on how information is held; it is always being looked at and updated to reflect modern forms of working and technology—and, of course, the changing threat. Cyber and technology are changing all the time, which is why this work is so important and why I mentioned the task force set up under Minister Tugendhat.
The Lord Bishop of Leeds
My Lords, I sympathise over the complexity of this matter, particularly given the technological developments, but there is the question of principle, which does not particularly relate to the recent cases cited. Several decades ago, when I was at GCHQ, the slightest security misdemeanour meant that you lost your job. Does that principle—that making a serious security error has consequences and a simple apology will not do—still apply? I cannot think of another circumstance in which an apology would have sufficed.
I am glad that we have the advice of somebody who used to work at GCHQ; it shows the breadth of this House and what we are able to do on security. I have explained that the Home Secretary apologised and that she resigned. We have discussed before that she has come back—you can have redemption in this life. You need to have respect for security and make sure that you are ahead of the game but, occasionally, you also need to be able to say, “I did the wrong thing”, and you need to be forgiven.
My Lords, some of us think that government was rather more efficient before the advent of social media. Would not it be a good idea to make twittering an offence?