The Committee consisted of the following Members:
Chairs: Caroline Nokes, † Graham Stringer
† Baynes, Simon (Clwyd South) (Con)
Bhatti, Saqib (Meriden) (Con)
† Brennan, Kevin (Cardiff West) (Lab)
† Double, Steve (St Austell and Newquay) (Con)
† Edwards, Ruth (Rushcliffe) (Con)
† Elmore, Chris (Ogmore) (Lab)
† Grundy, James (Leigh) (Con)
† Hart, Sally-Ann (Hastings and Rye) (Con)
Hollern, Kate (Blackburn) (Lab)
† Long Bailey, Rebecca (Salford and Eccles) (Lab)
† Lopez, Julia (Minister for Media, Data and Digital Infrastructure)
† Mishra, Navendu (Stockport) (Lab)
† Osborne, Kate (Jarrow) (Lab)
† Randall, Tom (Gedling) (Con)
† Vara, Shailesh (North West Cambridgeshire) (Con)
Warburton, David (Somerton and Frome) (Con)
Whitley, Mick (Birkenhead) (Lab)
Huw Yardley, Bethan Harding, Committee Clerks
† attended the Committee
Anna Turley, Chair, Protect and Connect
Dr Charles Trotman, Chief Economist, Country Land and Business Association
Eleanor Griggs, NFU Land Management Adviser, NFU
John Moor, Managing Director, IoT Security Foundation
Dave Kleidermacher, VP for Engineering, Android Security and Privacy, Google; Director, Internet of Secure Things Alliance
Dan Patefield, Head of Programme, Cyber and National Security, techUK
Public Bill Committee
Tuesday 15 March 2022
[Graham Stringer in the Chair]
Product Security and Telecommunications Infrastructure Bill
We are now sitting in public and the proceedings are being broadcast. I have a few preliminary announcements. If hon. Members with speaking notes could email them to email@example.com, that would be very helpful to Hansard. Similarly, officials in the Gallery should communicate with Ministers electronically. All electronic devices should be switched to silent mode. Unlike in Select Committees—although these proceedings are similar—tea and coffee are not allowed during sittings.
We will first consider the programme motion on the amendment paper, and then a motion to enable the reporting of written evidence for publication, and a motion to allow us to deliberate in private about our questions before the oral evidence session. In view of the time available, I hope that we can deal with these matters formally. We discussed the programme motion last week at the Programming Sub-Committee.
1. the Committee shall (in addition to its first meeting at 9.25 am on Tuesday 15 March) meet—
(a) at 2.00 pm on Tuesday 15 March;
(b) at 11.30 am and 2.00 pm on Thursday 17 March;
(c) at 9.25 am and 2.00 pm on Tuesday 22 March;
(d) at 11.30 am and 2.00 pm on Thursday 24 March;
(e) at 9.25 am and 2.00 pm on Tuesday 29 March;
2. the Committee shall hear oral evidence in accordance with the following Table;
Date Time Witness Tuesday 15 March Until no later than 10.25 am Protect & Connect; The Country, Land and Business Association; The National Farmers’ Union Tuesday 15 March Until no later than 11.25 am The IoT Security Foundation; The Internet of Secure Things Alliance; techUK Tuesday 15 March Until no later than 2.40 pm Professor Madeline Carr, University College London; Copper Horse Limited Tuesday 15 March Until no later than 3.40 pm Openreach; CityFibre; Speed Up Britain Tuesday 15 March Until no later than 4.20 pm BUUK Infrastructure; The Internet Service Providers’ Association Tuesday 15 March Until no later than 5.00 pm Which?; Refuge
Tuesday 15 March
Until no later than 10.25 am
Protect & Connect; The Country, Land and Business Association; The National Farmers’ Union
Tuesday 15 March
Until no later than 11.25 am
The IoT Security Foundation; The Internet of Secure Things Alliance; techUK
Tuesday 15 March
Until no later than 2.40 pm
Professor Madeline Carr, University College London; Copper Horse Limited
Tuesday 15 March
Until no later than 3.40 pm
Openreach; CityFibre; Speed Up Britain
Tuesday 15 March
Until no later than 4.20 pm
BUUK Infrastructure; The Internet Service Providers’ Association
Tuesday 15 March
Until no later than 5.00 pm
3. proceedings on consideration of the Bill in Committee shall be taken in the following order: Clauses 1 to 66, the Schedule, Clauses 67 to 78, new Clauses, new Schedules, remaining proceedings on the Bill;
4. the proceedings shall (so far as not previously concluded) be brought to a conclusion at 5.00 pm on Tuesday 29 March.—(Julia Lopez.)
That, subject to the discretion of the Chair, any written evidence received by the Committee shall be reported to the House for publication.—(Julia Lopez.)
Copies of written evidence that the Committee receives will be made available in the Committee Room and circulated to members by email. I would usually call on the Minister at this stage to move the motion for the Committee to sit in private, but I do not think that the Front Benchers on either side want to move into a private session, so we will continue sitting in public and the proceedings are still being broadcast. Before we start hearing from the witnesses, do any hon. Members wish to make declarations of interest in connection with the Bill?
I am a former worker in the cyber-security industry, and have worked for a couple of the witnesses giving evidence today. One is techUK; I have also worked for BT, which of course owns Openreach. I also draw the Committee’s attention to my entry in the Register of Members’ Financial Interests: I undertook some work in cyber-security for MHR between May and December last year.
Thank you. The Clerks will note that declaration from Ruth Edwards; and Ruth, if you wish to refer to it later in the proceedings, do so.
Thank you. The same applies.
Examination of Witnesses
Anna Turley, Dr Charles Trotman and Eleanor Griggs gave evidence.
I welcome the witnesses to the meeting, and thank you for your time. Before calling the first Member to ask a question, I remind all Members that questions should be limited to matters within the scope of the Bill and that we must stick to the timings in the programme motion to which the Committee has agreed, so this session will end at 10.25 am sharp, or earlier if we run out of questions. I ask the witnesses to introduce themselves briefly.
Anna Turley: My name is Anna Turley and I am chair of the Protect and Connect Campaign.
Eleanor Griggs: I am Eleanor Griggs, land management adviser for the National Farmers Union, representing about 47,000 farming members.
Dr Trotman: I am Charles Trotman, chief economist at the Country Land and Business Association. We represent 28,000 members across England and Wales. I am also chair of the rural connectivity forum, which represents rural organisations to industry and Government.
Thank you. Let us move first to the Minister to ask any questions that she may have.
Anna Turley: Thank you for meeting us to discuss our campaign. I should have mentioned at the outset that we represent all the site owners around the country who host telecoms communication infrastructure on their land.
I am afraid that we are not seeing the same tailing off of difficult cases; a number of cases are continuing to come to us where leases are up for renewal, yet telecoms companies are behaving in quite an appalling way. We have cases of rent reductions, often starting at 90% to 95%, and that is par for the course—it is not a small handful of extreme cases. In a large number of cases across the country telecoms companies are coming in often with very aggressive legal notices, which are quite intimidating and making people feel that they are being steamrollered by those large companies. People feel that they have no ability to participate in the legal process, and are obliged to take those cuts of 90% to 95%. If you are small community group, a church or a sports club, the difference between £4,000 and a couple of hundred is huge and has a great impact, especially when you believed that you had that income for the next 10 years. The impact on people has been huge and it has been pretty devastating since 2017.
Our frustration with the Bill is that it fails to address the root causes of that problem. The valuation issue is affecting people deeply, and the Bill will not deal with that. Those cases will continue to arise, and in fact the Bill will expand the number of people who will be affected by the 2017 code through the Landlord and Tenant Act 1954 and the Business Tenancies (Northern Ireland) Order 1996. Between another 3,000 and 4,000 people in Ireland will be affected by the 2017 code changes, as well as thousands of others across the UK. Those cases will not diminish, nor will the huge drops in rent, and that is having a devastating effect on a lot of small landowners and property owners around the country.
Anna Turley: I would say that we are dealing with in the region of a few thousand. I have a number of case studies from Members’ constituencies around the country. I am afraid that I do not have a total overall figure, but there are 33,000 site owners around the country who are affected by this. Thousands of affected people have come forward to us via social media and lobbied their MPs. I would be happy to write to the Committee with a full number, but as I said, it is in the thousands. This is not a small number of unique people; this is par for the course. Colleagues here will represent their members in such cases, too. They are not a small minority that we have cherry-picked; this is happening across the board.
The campaign was set up because there was no way for, say, a church in Scotland, a rugby club in Wales and a farmer in Surrey to come together to stand up for their rights as landlords, to talk about how this was affecting them, and to have their voice heard by Government. Legislation was continuing to be developed, through pressure from mobile operators, which have long-standing and strong connections with Government through their large lobbying organisations. The views of ordinary people about the impact of the legislation on them were not being heard.
Anna Turley: Absolutely. Someone in Cambridgeshire wrote to us who has two masts on their farm:
“I have recently gained Planning Approval for 5 Houses on my land Immediately next to the mast positions. Not only do I appear unable to refuse to renew the Lease…their current offer is derisory at £750 per annum which is less than 10% of the current rent.”
Another, in Peterborough, said:
“It’s been two and a half years out of lease, they had agreed all the new terms of the lease, just about to sign off. Then all change and they pulled out, and offered £500 per year and not heard anything since. These tower operators make dodgy used car salesman seem like Saints.”
We have hundreds and hundreds of those. Churches, for example, are saying that they can no longer keep to their plans for the upkeep of their buildings. Sports clubs say that they will have to ask parents for more, so that their kids can play on the team. The impact of a rent cut from £4,000 to just £350 is devastating for small community groups and small businesses. They feel that nobody is standing up for them or listening. The impact of the new legislation will make that even worse.
Anna Turley: The first recommendation would be to go back to the Law Commission proposals of 2013. The Law Commission suggested a market-based valuation approach that was closer to the previous approach but still delivered savings to the operators. That was widely accepted as a very positive way forward. If that were taken as the approach to valuation, it would deal with the root causes of the issues and the imbalance brought by the 2017 changes, which essentially gave all the power to the operators.
As for the Bill, a number of further changes will damage and affect smaller landlords. For example, the Bill brings in backdated payments. Again, that could have a devastating impact on a small community group that is being asked not only to accept huge cuts in their rent, but to backdate their bills. There are issues on the definition of “occupier”, which others will talk about. That could give operators the opportunity to change or modify agreements that were entered into in good faith and still have time to run. We would like more protections for landlords, to protect them against poor behaviour by operators. For example, alternative dispute resolution should be mandatory. There should be the power to impose fines on operators for bad behaviour. We would like a statutory code of practice for them as well.
We are also very concerned about changes to the Landlord and Tenant Act 1985. We do not believe the reforms to valuation should be extended to the new legislation. That could set a huge precedent for all kinds of things such as wind turbines, and could bring the 2017 changes into effect for thousands of people who previously were not covered.
We would also like to see an evidence base; that is one of the most important things. Five years after the changes were brought in, there has been no full impact assessment of the 2017 changes. There is no evidence base, but it was promised, during the passage of the Bill in 2017, that there would be a full assessment by 2022. We have not got a clear enough sense of the impact of those changes. Here we are again, bringing forward new legislation without having a proper evidence base for those 2017 changes.
Finally, we would also like more reporting requirements on the operators. We have no evidence that the money they have saved since 2017 has gone back into building new infrastructure. Everybody wants connectivity. All our members want better connectivity and wi-fi, but the reality is that money is not being invested back into the infrastructure. It is disappearing into the profits, and there is no onus on operators to show where that money is being saved and how it is being used. We would like there to be more reporting requirements on them.
Before Chris Elmore asks another question, let me say to the other two witnesses, who are appearing virtually, that if at any stage they wish to add anything to what has been said, please indicate that to me, and I will call you.
Dr Trotman: No, it does not. The Minister hit the nail on the head: you need balance in the market. What the 2017 changes did and what the part 2 changes will do in this Bill is further skew the marketplace. As Anna said, if the Government had taken forward the Law Commission’s recommendations back in 2013, we would not be in this situation. We would be moving far faster towards universal coverage, which we all want, and which, as the covid-19 pandemic proved beyond all reasonable doubt, we all need. The problem we have is that this element of distrust between site providers and operators has shifted clearly in favour of the operators. The market is not working as it needs to.
As far as the CLA and I am concerned, it is incumbent on the industry, rural organisations, telecom companies and trade associations to come together and work out the differences. It is the role of the Government to assist in that process. If we cannot get the balance right, effective deployments will be delayed. That delay will severely limit the ability of rural communities to increase social inclusion, and reduce the ability of rural businesses to pick up and recover from the pandemic, and from the cost of living crisis that we are likely to face in the next six to 12 months. We need to get the balance right, and we still have not got it right.
Dr Trotman: No, it makes it worse. That is our concern. We have an opportunity here to bring the industry together. Unfortunately, what part 2 of the Bill does is pull the industry further apart. The sector and the market was beginning to settle down after the 2017 changes. The Government then decided that the changes were necessary. We do not know why—as Anna said, there has been no real assessment of the impact of the changes on the market place.
On the case numbers that the Minister was talking about, you have to bear in mind that a lot of these agreements are placed under non-disclosure agreements, so we do not have the information we need to assess how wide the problem is. Given all the cases we have, it is clearly a very serious problem. The key is for the industry to get the balance right and for the Government to assist.
Dr Trotman: If the Government could give us the assurances and safeguards that we need that a voluntary system would work, I think that would be satisfactory. However, we have not seen that so far in our discussions with Government officials. If it is going to work as effectively as we want it to, it will have to be a mandatory mechanism.
If the ADR system works, it will reduce tensions in the market, because it means that site providers, for example, who are in dispute with the operators, would not be threatened with going before the courts. There would be an opportunity to negotiate under the premise of an arbitration process. However, we must ensure that that is available. That is where we need the safeguards. If we have those safeguards, and they are clear and consistent, then a voluntary system may be appropriate. However, from what we have seen so far, that will not be the case. We are not certain that the Government’s guarantees will work—that is the key point—so it has to be a mandatory system.
Eleanor Griggs: My opinion is very similar to Charles’s, really. As it stands, I cannot see any option other than to make it mandatory to protect our members, who do not necessarily have that negotiating power, given the statutory powers that operators have, which could potentially be increased should the Bill, as introduced, go through.
Eleanor Griggs: Yes, a lot of members have contacted us over the past few years, including quite a few recent cases. Obviously, those are under the 2017 changes. Many do focus on the rent, because that seems to be the trigger point, but then, when you look at the 90% decrease in rent, and then at the further terms that operators are trying to claim on renewals, those too are very unfavourable. They are not included within the code—they are not code powers—and have the impact of limiting what members can do across not just a small area contained within the deeds, but sometimes much larger areas, and sometimes an entire farm.
On the valuation itself—the reduction in rents—at a time when agriculture is seeing the loss of its EU subsidy payments under the common agricultural policy, it needs to be looking at alternative income streams. That, in itself, means that they will not be looking at mobile phone masts, as they did pre-2017, to get those income streams, but—this is leading on to the second part of the question—farmers will be looking to try to get income streams from every little piece of their land now. That will mean that there will not be any scope for something that does not pay very much money, but also does, or potentially could, include quite a lot of hassle through behaviours of operators and contractors when they are on land. It is not a very attractive prospect to have an operator on land now.
Thank you. Will any Members wishing to ask questions please indicate that? Ruth Edwards.
Anna Turley: That is in total.
Anna Turley: Well, we know that a third of them have had reductions of around 90% or 95%; that is from our own survey approaches. Going back to the Minister’s first question, I could write to the Committee afterwards with the exact number. Thousands of people have written to us through social media and email, and have responded to our website. I do not have a total number for all those who have contacted us, but there are thousands of case studies across the country.
You must have a rough idea. Is it something like 10% or 50%?
Anna Turley: I would say that probably about 4,000 people have reached out to us, but again, people have to be aware of our campaign. They have to have found us—come across us on social media. They have to have been engaged with us. It does not mean that there are not an awful lot of people sitting and suffering in silence. Part of the reason for setting up this campaign was that there were people who were just in despair and really struggling. Our campaign was set up to give them a voice and to give them access. I think this is really important. When the legislation was made previously, you were hearing only from mobile operators—those on the other side. There is no roll-out and no connectivity without people hosting a site on their lands. These people are fundamental to us hitting our targets, and we need to make sure their voices are heard in this campaign.
Anna Turley: I am not sure about that, but I know that internationally we compare very well. Our rents pre-2017 were not significantly higher than those in other countries, like Germany, Spain, Italy and others that are substantially ahead of us in the roll-out. I do not believe, and evidence does not suggest, that cutting these rents has actually increased our roll-out and our connectivity.
If you want to make the comparison with other utilities companies, the issue for all of those is that they are very tightly regulated industries, whereas there is very little regulation, and very little accountability and transparency, on the telecoms industries. If they are to become an essential utility—that may be the way we go, down the line—it is fundamental that the same kind of transparency, accountability and regulation is placed on them as is placed on utilities at the moment. That is not the case. We have no idea whether the savings that have been made through this have been reinvested in new infrastructure. There is no onus on these companies to do that. The Government are continuing to subsidise them with things like the shared rural network. It seems to be money after money towards these companies, without any indication of whether that money is actually being invested in helping us to achieve our connectivity outcomes.
Anna Turley: We are funded by an organisation called APW, which is a company that is a telecoms—sorry, a company that owns a land infrastructure itself. But as I say, we are supported by colleagues like the NFU, the CLA and others who back our campaign, and we represent all the site owners that have contacted us over this time to get their voices heard.
There are huge organisations, like Speed Up Britain and Mobile UK, that have very good connections with Government and are able to lobby and present their side of the argument. Until Protect and Connect was set up, there was no collective voice—no unified way in which site owners could speak to Government and tell their story. I think it is really important that we hear about this. I have examples here of constituents of your own who are saying, “We have telecoms masts. In view of the impact on our rent, I would certainly not have allowed the siting of masts on my property.” A number of people and organisations around the country would not have had this voice if we were not providing this campaign.
So they would stand to gain substantially financially if we increased rent valuations.
Anna Turley: They have been losing substantially since 2017, so, yes, of course there is a financial interest. The point of the campaign is that they, by themselves, do not have a voice, and without their funding this campaign neither would all the other affected organisations—charities, community groups and others. If a representative of Speed Up Britain were here, you would recognise that there is a financial interest for mobile operators as well.
We have been very clear about the issue. Of course, the valuation is important and the money is important. I am a member of the campaign because bad policy has been developed over the past few years that has basically put all the power in the hands of a large number of mobile operators. Ordinary people around the country have been absolutely hammered by that and have not had the opportunity to express the impact on their lives and livelihoods. The campaign is a really important one to address that balance.
Just to be clear, I do not think that there is anything wrong with APWireless lobbying for their interest; like you say, big telcos would as well. For clarity and transparency, however, I think it is important for people to note that Protect and Connect does not just represent small landowners and community groups; it also represents APWireless, which describes itself as one of the world’s leading mast lease investment firms, with thousands of leases in 21 countries across the world. I think it important that we have that on the record.
Anna Turley: Absolutely; no problem with that.
I remind Members that we should confine ourselves to questions, not to straightforward dialogue.
Anna Turley: Yes, I think that is the case. The fact that we are back here again shows that roll-out has not improved, nor has connectivity. We have had further subsidies through the shared rural network. More than 300 cases going through court have been bogged down, whereas prior to the 2017 legislation barely a handful of cases went to court. That has resulted in a huge amount of litigation and conflict between site owners and operators, which simply did not arise before. That is holding back our roll-out and affecting GDP. We are falling behind our international competitors. The changes in the 2017 code mean that there is now so little incentive for people to host sites on their land that we are at risk of further jeopardising our connectivity goals and achieving the outcomes that we all want.
Anna Turley: Going back to your point about the Bill, that was not what was envisaged at the time. The impact assessment predicted a reduction of around 40%. Even Speed Up Britain has said that the average reduction is around 67%. We would dispute that, but without the evidence it has been incredibly difficult to show that. We have a huge number of cases where the operators have come in at a 90% to 95% reduction. That is par for the course.
There is an incentive for the operators to take cases to court to try to push for the biggest cuts that they can, because they can apply that across the board. The frustration is that we see them come in with large rent reductions, often bullying small landowners, families, small charities and community groups. Those people are having to accept cuts of between 90% and 95% because they simply do not have the wherewithal to go through lengthy legal processes to combat the huge strong legal arms of those organisations. They are simply having to submit to that.
To go back to your point about outliers, we have also tried to get information about the impact on local authorities, because a huge number of local authorities host these sites, as well as a number of hospitals and other public buildings. Again, we are seeing 80% to 85% cuts to local authorities. Leeds City Council, for example, has taken a reduction of 85%. That is thousands of pounds lost to local authorities. At the same time as we have heard that dairy and other farmers are being encouraged to expand and diversify their income, or local community and charity groups are being told to be entrepreneurial and to diversify their income, local authorities have had huge cuts over the past decade, as we know, and they are trying to get their income wherever they can. It seems crazy for them, essentially, to be subsidising private companies that might be making £10 billion in profit last year. That is money taken away from our local authorities, small charities and community groups, and it is not a small handful of them; this is happening across the board.
Dr Trotman: First, we have to understand what the Government’s levelling-up agenda is to begin with. If we look at the levelling-up White Paper, out of 332 pages, there are only 39 references to “rural”, so maybe the Government’s objectives do not relate to rural areas. There needs to be a levelling up not just of north and south, but of rural areas compared with urban.
We have always said—I said this earlier—that, as far as we are concerned, our overall objective is universal coverage, because we can see the benefits. The very fact that I am Zooming into this meeting at the moment illustrates the benefits of effective and affordable broadband connections. We understand what the benefits are and we want to see faster deployment, but we also want to see both parties playing fair. This is where I said that the ADR mechanism is a workable solution, if we can get it right.
We have to look at the positives of this as well. There is one big positive in terms of rural wayleaves on fixed-line infrastructure. With the NFU, we secured from Openreach and Gigaclear—the two big infrastructure providers for fixed-line connectivity—a wayleave agreement. We have had that since 1 October 2018, and it works. If we can get it right for fixed-line rural wayleaves, what I do not quite understand is why we cannot get it right for fixed-line urban wayleaves—Anna’s point about local authorities is a good one—and in the mobile sector.
The major criticism that we have of the 2017 changes and of this Bill is the fact that we are talking about mobile infrastructure. We are also talking about the tactics being employed by mobile operators, which at the beginning of 2018 were not that conducive to effective negotiation. Basically, it was, “We’ll offer you a little carrot, but if you don’t agree, we will hit you over the head with a big stick.” Hopefully, we are getting away from that, but again, it underlines the point that we have a major market imbalance, which we have to get right if we want to get to the point of universal coverage.
Before I bring in Rebecca Long Bailey, Eleanor Griggs, did you wish to say something?
Eleanor Griggs: I have just a couple of points. If statutory powers are given, there needs to be some sort of accountability on the part of operators, with, essentially, sanctions if those powers are abused or not used responsibly. That sort of thing needs to be considered, because at the moment there does not seem to be any comeuppance for the poor behaviour that my members have had to endure. Are we looking at consensual agreements that are reached by negotiation, or are we looking at consensual agreements that are reached because somebody cannot afford to defend their position or get slightly more favourable terms at tribunal? It is quite cost-prohibitive, certainly for the smaller individual landowners. I do not know about the monopoly landlords that the Bill’s impact assessment talks about quite a lot, but it is quite prohibitive for our smaller members.
I would also like to make the point that the NFU has an annual digital technology survey. The most recent figures—we have not quite had the 2021 figures in yet—are the 2020 figures. Going back to 2015, 29% of our members reported that their outdoor mobile signal was reliable. By 2017, that had risen to 42%. Obviously, that is a really big increase from 29% in 2015 to 42% in 2017. By 2020, it was still at 42%, so no advances have been made from the introduction of the code, essentially; that is quite important. Various other figures mirror that—smartphones with access to 4G and things like that. It just shows a stagnation from 2017 onwards. We just need to be careful that that does not continue or, in the worst case scenario, get any worse.
Anna Turley: That imbalance of power is absolutely something that we see throughout our case studies. If I may, Ms Long Bailey, there is someone in your constituency who has had a mast and a hub on their property for 25 years, and EE is now trying to force a rent reduction of around 86%. They said:
“On this basis we will not renew any lease”
and that they will do everything in their power
“to have the site removed, all land owners near us are aware of the situation and will not entertain the idea of situating on their property.”
That goes exactly to the heart of it; people just feel powerless. Many often cannot have the site removed even when they want to, because of the legislation. It is having the knock-on effect that people do not feel incentivised, or do not want to have the site on their land, not only because of the lack of income, but because of the disparity in power and the threatening legal pressure from those companies. It is a David and Goliath issue. People are having to take on huge companies with huge legal arms, and they just do not feel that they can compete with them. That is a real issue.
We have suggested a few ways in which the Bill could at least make the negotiations fairer by making the ADR mandatory so that operators are obliged to undertake that. There ought to be fines for poor behaviour. There ought to be more scrutiny and a code of practice to put an onus on better behaviour from the operators in the way they deal with site owners. We think that would go a long way to addressing that balance, as well as putting some reporting requirements on them.
Eleanor Griggs: Yes, I would say pretty much what Anna has said. For us, it is about looking at the Landlord and Tenant Act and how it will affect a lot of our members who are currently on landlord and tenant leases that are due to expire or perhaps already have. According to the figures from Mobile UK that were used in the impact assessment, there are just over 7,000 expired leases, with another 2,000 due to expire within one year. Bringing the Landlord and Tenant Act valuation for renewals in line with the code removes the transitional provisions that were intended to ease landlords into the new 2017 code. It means that the holders of the leases that are going to expire will have no time to prepare financially for the sudden income loss that they will face. We would look at removing that proposed amendment to the Landlord and Tenant Act.
We would also look at the interim rents side of things. As Anna has alluded to, there are potential issues that could mean that a small landowner would end up having to pay back rent to a large operator. We have a member in Mr Double’s constituency who had a lease that was due to expire that was achieving a rent of £3,500 a year. The renewal figure that he received was £17.50 a year. If the operator were to apply for an interim order and that order took a long time to come through, or the court took a long time to make that order, our member would still receive the £3,500 in the meantime. Then, if that took a year, he would have to pay back almost £3,500. Operators could use the proposed interim arrangements for indefinite periods of time, rather than looking to eventually get to either a court or tribunal-imposed agreement, or a consensual agreement. There are implications for landlords.
Thank you. Dr Trotman?
Dr Trotman: There are two things here. First, we understand that there is a lack of awareness as to what the code is, what it is meant to do, how it actually operates and the various tactics that are used, whether they be operators or site providers. Secondly, leading on from the lack of awareness, there is a lack of education. We are not just talking about on a wider scale—the general public, or site providers who may be in your constituency or anywhere across the UK; there is a lack of understanding and a lack of awareness within the industry itself. That is an important point.
One of the key fundamentals in resolving that issue is to have a code of practice that actually works, which we have from the 2017 revision of the code. At the moment, the code is doing absolutely nothing. Eleanor and I were part of a working group that drafted the initial form of the code of practice. What we have now—how it actually works in practice—is not worth the paper it is written on.
If we are going to have a code of practice and that is going to be a requirement of the revised code, let us make sure that that code of practice has some legal teeth. The only way it can have legal teeth, at the moment, is if it is appended as an annex to a code agreement. Very few site providers would understand that, and from what we have seen it is likely that very few agents and solicitors who deal with the code agreements understand that either.
Again, it is a case of getting the information out there, getting people educated as to what the code is and how it works and increasing the level of awareness. By doing that—again, going back to the point I made right at the beginning—you are creating a balance in the marketplace; you are having a more equitable system as we move forward. That then leads to faster deployment, and our ultimate objective of universal coverage. With what we are doing, if we have a deadline of 2025 or 2030, it is highly unlikely that those will be met, because there are too many problems and complexities within the system as it operates at the moment.
If you are finished, are there any other questions?
Anna Turley: That is a really interesting question. We have not seen particular companies standing out any more than others. I think that they all have strong legal arms and come in with a very strong approach. However, what we have seen change, even since the 2017 code changes, is the development of tower companies, which I think is an interesting thing that has not really been taken into account when looking at the new changes.
These middlemen have been created, where tower companies will now rent the site from the landlord and use the code to cut the rent that they are paying, but will continue to charge high amounts of money to the telecoms companies—Vodafone, EE, Three, and others. The savings are not actually going back to those original companies, but somebody is making money in the middle. I think that is an important change in the market, partly, I think, because of the 2017 changes, which has not been properly explored.
Again, I think that we should be looking at that before we change this legislation, because the development of tower companies has distorted the market even further. It has not resulted in reinvestment in infrastructure, and is essentially creating middlemen who are profiting off the changes brought in to essentially accelerate 5G roll-out, and that money is not going back into the development of infrastructure.
Anna Turley: I think that they are certainly playing a role in it. We have seen examples where, as I said, they have continued to charge, say Vodafone, £17,000 a year for a site, but then slashed the rent to the actual site owner to a few hundred pounds. That is absolutely a huge driving force, coming from profiteering, from those guys in the middle.
If there are no more questions, I thank our three witnesses for a very informative session, and for giving us their time. Thank you very much.
Examination of Witnesses
John Moor, Dave Kleidermacher and Dan Patefield gave evidence.
Dan Patefield: Good morning, everyone. I am Dan Patefield. I lead the cyber-security programme at techUK, which is the national trade association for the digital and technology sectors.
John Moor: Just before I introduce myself, let me say that it is an honour to be here. This represents a milestone moment for me, seven years in the making. Seven years ago, I set out on this journey to understand what IoT cyber-security was about and its challenges, so I am honoured to represent our membership and the executive steering board. I am John Moor, managing director of the IoT Security Foundation.
Dave Kleidermacher: Hi, everyone. My name is Dave Kleidermacher; hopefully you can hear me okay. I am the Google vice-president of engineering responsible for the security and privacy of the Android operating system, the Google Play app store, and “Made by Google” products including Pixel phones, Nest smart home products and Fitbit wearables. I am responsible for security and privacy, including the certification strategy for the company—how we assess and demonstrate compliance with security standards and privacy standards.
Thank you. I will move straight to the Minister for questions.
John, you rather touched on the challenge: this is an area that is very dynamic. All of us are learning what the security risks are, and in Government—which often moves very slowly—it is a particular challenge to manage such a dynamic, changing picture. That is why in this legislation, we have set out some broad principles and basic requirements, but a lot of this has to be secondary legislation so we can keep up to speed with all the changes that are going to be happening to connected devices, and some of the risks that will come with that. I think it would be very helpful if you could set out for the benefit of the Committee how this picture has changed over the past few years, where you think things will be moving, the extent to which connected devices will be in our homes in future, and some of the security risks that will present.
John Moor: When I started out seven years ago, I was invited to take a look by the chairman of the organisation I was working for at the time, the National Microelectronics Institute. He was the CEO of an IoT company. I confess, I had not seen what the challenge was, so when he invited me—“John, go and take a look at IoT cyber-security”—I thought, “Why me? What’s the challenge? Isn’t this thing just a tiny part of a well-established body of knowledge about cyber-security, and why me?” My background is in electronic engineering—semiconductors.
As it turned out, when I went and had a look, it did not take me very long to realise, “My goodness, there is a real problem here.” I remember that at the time, a word I was using often was “egregious”. As effectively a student coming into it, trying to understand the space, I looked at the evolution of computing, broadly speaking. In one era, we had computers—desktops, laptops—and we connected them up, and the security around those was pretty dire at one point, but we started to get on top of that. It is not perfect now, but it is a lot better than it used to be, and we are all very familiar now with doing security updates. The next phase was mobile. Mobile was not quite as bad as the era of PCs. It was better—still a few problems, but much, much better. Then we got to this thing called IoT, and it took a complete reset. It was totally egregious.
I come from the world of embedded systems engineering, and one of the first events we did was a summit we ran at Bletchley Park in 2015, just to do a landscape piece—just to try to understand it from chips to systems, bringing in the regulator. We had a representative of what was then the Communications-Electronic Security Group, but is now the National Cyber Security Centre, to try to understand where the issues are. Part of the problem, I think, is what I learned there as an embedded systems guy. We had a pen tester there, and he said, “If a researcher comes knocking on your door, don’t turn him away.” I thought, “That is a really interesting thing. What is he talking about?” We were talking about vulnerability disclosure. For someone who comes from embedding air gap systems, security was not a thing. It does not take you long to realise that when you start connecting things up, suddenly you expand this thing called an attack surface. Attackers can come from many sources, not in proximity to the thing that you are working on. Suddenly, you have this massive attack surface.
The whole idea about IoT—internet of things—is about connecting things up, so by its very nature, you are vulnerable. These things can come at you from many angles. What does that mean? It means different things to different people. I tried to understand what this thing called security was about. I immersed myself in the security community and straight away I realised there were different groups. If people start talking to me about data, they are usually coming from a data security or information assurance-type background. If they talk to me about availability of systems—keeping systems up—they usually come from an operational technology. What I mean by that is the sort of things we find in industry—process and manufacturing.
Then we have this thing called IoT. One of our board members expressed it very well. He called it the “invasion of IoT”. What I took from that is that this technology is coming at us, ready or not. We established in those early days that we needed to have a response. The need is now. We could not wait for new standards and regulation, which is why we set up the IoT Security Foundation. Our centre of gravity is in best practice. It is saying, “Can we help manufacturers who do not yet see that the very fact that they are starting to connect things up poses a risk?” They did not, but now we are in a much better state. The body is developing.
I am delighted to be here to talk about this regulation. More needs to be done, without a doubt. A seminal moment for me was at the very first summit that I talked about. We had the chief technology officer of ARM, a chap called Mike Muller, give a talk in which he said, “The ugly truth is this: you will get hacked.” That was quite an epiphany for me, because coming from an engineering background, we engineer our systems to be virtually perfect, but what we are witnessing now is that security is a movable feast that evolves. Out in the wild, things change. New vulnerabilities are discovered. Yes, you can do all you can to engineer it up front, but guess what? Once it is in the wild, this thing called resilience is so important. What that means, especially in terms of this regulation, is the software updating part and especially the vulnerability disclosure. They are absolutely essential parts. That is part of what I have learned on the way.
I come to refer to IoT security as a “wicked challenge”. By that I mean that I do not think we will ever perfectly fix it, because it is always moving, but we can address it. We can mitigate the risks to a level that we are comfortable with and can accept. Again, another phrase I learned is, “Don’t let perfect be the enemy of the good.” This is all good. This is progressive. This is what the world needs. Being part of the regulatory process to get here today, it became apparent that getting regulation right is so difficult. It is so easy to get it wrong, but going through the process, this is a regulation that we can wholeheartedly back. We think it is absolutely the right thing. It takes a step; it gets us on that security journey. We often talk about an on-ramp of security. It is about maturity. In terms of regulation, this is a fantastic first step, but more will come. The way it has been set up is exemplary. We can evolve it over time as we have to ratchet up the security for the benefit of consumers and society. I hope that little ramble gives you some idea about my journey and where I think we are at.
Dave Kleidermacher: Let me start by saying I am so appreciative of the leadership role that the UK Government have taken to help us get to a better place for IoT security. I have been working closely with the Department for Digital, Culture, Media & Sport and NCSC for the past couple of years leading up to this. I have worked on how to measure security in digital technology for almost 20 years, and I believe that the lack of transparency in what the security ingredients are for digital technology has been one of the headwinds facing the entire digital world, even before the IoT was called the IoT. Of course, the IoT has made it much more urgent that we address this.
I agree that the minimum requirements we are talking about here are a really good starting point, but as we move forward and look at the secondary legislation, the really big challenge is how we scale this. The question about smaller developers is something that I am quite concerned about. At Google, we build our own first-party products but we also develop global-scale platforms. On Android, we have many manufacturers of devices across all different price points. We have millions of app developers across the world with whom we connect and work in all sorts of different environments.
One of the biggest challenges is how to monitor and measure these requirements, and how to make that work for small businesses in particular. That is the area I have personally been putting a lot of time into over the past couple of years. How do we build and establish an actual practical mechanism or scheme for measuring security at scale? There are a lot of details that go into that, but at the end of the day, we need a hub and spoke model. I can give you an example of a failure mode. The UK is, again, taking a leadership role, but many countries are looking at similar kinds of ideas and legislative concepts. The problem is that if every single country decides to create its own testing scheme for how to measure this, imagine how difficult it would be to have, say, a webcam or smart display, and then go to each country and provide documentation, provide the test results, explain how it works and go through a testing mechanism for every country.
As an example, for our Nest Wifi products, Google has had public commitments and transparency about our desire to have third-party independent security labs to test the products and assess compliance to these common-sense requirements. We have been doing that for a while now. We certify all of our products that way, but then a couple of countries at the leading edge of this started to ask us to certify again their schemes, and we did. That was a lot of work, to test to one scheme and certify and then do the same for another country with a different set of rules. The product did not change at all; it did not get any better because we were already certifying it. However, the work and the cost of doing that were significant. If we scale that to the full IoT, to all the countries which are interested in this—they all should be—then you can imagine how quickly it breaks down.
The hub and spoke model is looking at how we can work together to build a public-private partnership where there are non-government organisations, typically well-regarded international standards bodies, which take the great standards that we are developing, such as the ETSI EN 303 645 international specification on security requirements, which the UK has led in developing, and translate that into a practical conformance regime. An NGO can take that specification and the test specification—a sister specification, ETSI TS 103 701—and test a product once to have it certified for use in all of the different nations which adopt the same standard. That is the trick to this—the hard part that has to be solved as we move forward.
Dan Patefield: I think John and Dave have already mapped out the ever-growing risk landscape, so I will not reiterate that. From an industry perspective, there is clearly strong support for the ambitions of the Bill we have been discussing today, in implementing a minimum baseline that everyone should work to. Certainly, large swathes of industry are going beyond that, as Dave has outlined. I think I would join the other panellists in commending DCMS on the leadership that it has shown in developing the framework, not just with this legislation, but with the code of practice in 2018. I also commend it for playing a key role in developing the globally recognised standard in this space, EN 303 645—I always get that number wrong. The challenge that we have, and I am sure that we will come on to this, is that the code of practice—we supported its development and engaged industry in it—created an outline for best practice. However, it was never prescriptive; it was broadly focused. The practical challenge now is translating that into regulation that is workable for industry and consumers. I am sure we will move on to that, so I will leave it there.
Dan Patefield: Going back to the code of practice, I am confident that across all 13 of those areas many companies have made good progress, and will continue to develop best practice that goes far beyond those requirements. I think it is a good approach to start with the three requirements that are included in the Bill; it is not the case that industry will be surprised by what comes out in secondary legislation. The practical challenge is translating the non-prescriptive code of practice into something that will be more prescriptive by definition.
There are a number of areas where I think there is more work to be done to smooth the path to compliance, if you like. We have got various elements. We have got the standard—that is not going to be a surprise. We know the security requirements—they are not a surprise. What we have not got is the boring bit—the technical specification that people in compliance teams within manufacturers are worried about. Quite often they have to then communicate that to their HQs—which are often in different parts of the world—and say, “We have got legal certainty that this is how it is going to work and this is how we achieve compliance”. That is the bit that we have not yet got.
Dave Kleidermacher: It is a really important distinction, as we look at the so-called security ingredients in digital products. The analogy to food is a good one—but it also has its limits. What is good about it is that consumers deserve to have information at their disposal to be able to make better decisions about their health; in the case of food, that is their physical health, but in the case of digital technology it is their digital health. The concept that a consumer should easily be able to get a sense of the security status of a product is a very good idea. However, the main challenge is that food contents do not typically change—there can be a printed label that works okay. However, in the digital world, it could happen that you ship a product today and then there is a severe critical vulnerability, perhaps a hardware problem, that cannot effectively be mitigated or even patched. If that happens in the future, even a day after you have shipped it—this is a worst-case scenario—then if you try to put an attestation on the static label that the product is “secure” or meets these requirements, that attestation could be immediately incorrect. In fact, it could be dangerously misleading, and give consumers a false sense of security, so I believe that, while the ingredients label is essential, the user needs to have transparency. The consumer needs to have visibility here.
That label needs to be a live label. A simple example would be a QR code on packaging, although I am not sure how much consumers really go back to their packaging. We should also stress in-product experience wherever that is practical. It will not be practical in the case of every electronic product, but there is typically an app to manage many of our consumer IoT products. The app can provide an experience where the consumer can get the real-time, current status. That status can be as simple as a link that takes you to the certification page. As I mentioned earlier, we can have NGOs that establish the conformance programmes that we need to help to measure the security. It could just take you to the certification page to see the real-time status. If a product is deemed unsafe for use, it will become decertified, and the user will then know it.
We now move on to the shadow Minister, Chris Elmore.
Dan Patefield: There are two points on the timescales. There is the point at which the grace period will begin. For industry, we strongly think that that should be when the regulatory framework is confirmed and we know who the regulator is. That is the point at which that countdown should start. There are different views in industry on how long an appropriate grace period would be. Obviously, DCMS has confirmed that it will be no less than 12 months. Once we see that technical specification, a lot of parts of industry will have interpreted the code of practice in such a way that complies, so that will not be a problem for them, but some might have an interpretation that the compliance framework rules out—for example, around passwords. They might have to go back, certainly for security requirement 1, and make a hardware change. For a lot of these products, the supply chains are enormously long. Take a projector coming over from Malaysia. That will be 15 weeks in transit, and eight weeks getting through the broader supply chain in the UK through distributors and re-sellers. That already reduces the 12 months to seven months for manufacture and design. That is the difficulty that some manufacturers might face.
To the obsolescence point, there are two points again. In terms of when this comes in, we have to communicate it to consumers in such a way that it does not cause them to think that any devices that they currently have are obsolete in any way. That is a communication piece. It is about DCMS and the Government broadening that out, and helping consumers to understand what the legislation is for. More broadly, I am sure that we will come to the timescales for security updates but we do not want that to turn into some kind of perceived sell-by date. That is the minimum we will give you security requirements for, but the device is not useless after two or three years. Both those elements might lead to an increase in electronic waste and the kind of things that we want to avoid in a practical framework.
Do either of the other two witnesses wish to comment?
Dave Kleidermacher: I would like to make a quick comment. Especially as we look forward in time, beyond the minimum requirements to the larger set that are codified into the ETSI EN 303 645, and extended requirements even beyond that, in different vertical markets there will be a desire to have additional requirements. For example, on the Android side, a Google-certified Android device already meets baseline requirements, so we are working with NGOs on how to define higher levels. For example, the strength of a biometric is really important on a smartphone, and that is not currently covered by the baseline requirements.
As we go forward, there will be an increasing set of requirements, and there is a way to balance that challenge. You will always hear of some manufacturers, including smaller ones, that have more difficulty meeting a certain requirement in a certain timeframe, and one way to help balance that is by focusing more on transparency about whether the requirement is met, versus requiring that all those requirements be met. I like to say that transparency is the tide that raises all boats. That is the key.
To go back to our analogy with food, it is not that on a label it says that you cannot have more than 50 grams of something; it is that you can compare the number of grams of carbohydrates and other ingredients between products. If you look at EN 303 645 and all its provisions—there are many—you could ask manufacturers simply to attest as to whether those are met. Yes, I still believe that there are minimum requirements that are critical, but in as much as we run into some difficulties on timeframes, you could just ask them to state whether they meet those requirements. That transparency will still be really valuable for consumers. Again, the NGOs that are setting up those conformance schemes can take the attestations of yes or no across the requirements and translate that into a health score, if you will, to help consumers make better decisions.
Thank you. John, did you wish to add anything?
John Moor: Yes, I have a few points to make. First and foremost, most of my comments are about the here and now: what we are looking at, what is in front of us and the three requirements that are coming. Our assumption and that of our members is that, as we add to that, there will be an equally robust and rigorous process to determine what might follow. That is essential.
The labelling question is really interesting, along with certifications and attestations. All we can say about certification is, under these conditions, on this day, in these tests, those conditions were satisfied. I have heard the discussion about food labelling schemes come up time and time again as a “We ought to do something like that”, but in our view that is not really practical.
One of the things that I had to get my head round when I came into this space was some people talking to me, saying, “Safety and security are the same, aren’t they, John?” I had never had to get my head around that in the past, but I thought about it for about an hour, and I concluded, “Actually, they are not the same.” They are not the same because safety is much more determinable. You can define the situation, the operating environment, the characteristics, the materials, etc., and you can figure out, “This is safe under these conditions.” The difference in security is that it is dynamic—there is a changing environment, there is a human adversary at the other end. We might consider something to be safe today, as David said, but that changes over time.
Where do we place our trust? Do we place it in the product? I do not know that we do. Do we want to be looking up thousands of products to see what the certificates are? Where we really place our trust is in the companies that provide those products. It is interesting that, of the three provisions that we are talking about, only one is really related specifically to the product, and that is passwords. The other two are really about the processes that are involved in the providers of the technology—vulnerability disclosure and keeping the software updated.
I do think that certification is useful, but it is not a panacea; it only goes so far. What we are really looking for is something that we would term “continuous assurance”. How do you do continuous assurance? That is the question for the industry to answer going forward, but some of the mechanisms that we have done in the past do not map well into a future world that is changing rapidly.
That is on the labelling front. It should be as simple as possible for consumers and for the producers of the technology. There is a discussion about whether we need another label. Certainly, many of our members favour integrating this into something that is already known. For example, could it become part of a CE labelling scheme, so that we add the security elements too? Those processes are well known.
Some of the discussions among our members about keeping software updated come down to considering what is a reasonable time to keep software updated. If you make it too short, that process is almost meaningless, and means that consumers probably will not buy a product if the update is, let’s say, after only six months. If that update is too long, the company is carrying a financial legacy burden. What is the right point? I think we will find that out. Is it three years, five years, one year? We do not quite know yet. My own view is that it should be a length of time that is beyond the life cycle of the product. In that regard, it is variable and I do not know how that would quite be implemented, but that is what we have in front of us. For the here and now, this is what we are talking about; as for the future, we are assuming the rigorous.
In my view, security is an awful lot like quality. As we go into the digital world, we will see profound changes not only in the way that we use products, but how they are produced. We already know that: among our membership whole engineering teams have been reconstructed. The selling of physical products must be reviewed too, because are we buying a physical product? Often we are not, often we are buying a service. Do we actually own it? No, we don’t.
Those are things that we will be working out as we go forward. We must understand those limitations as we do that, because we do not want to be taking the past into the future when the future looks quite a lot different from the past.
Dan Patefield: I will lead on that question. techUK would be happy to give more thoughts on that in a written submission, but it is not an area I focus on. Internally, we split the Bill; I lead on the cyber-security element and another colleague leads on telecoms infrastructure. I am happy to get that question answered in a written submission.
If there are no other questions from Committee members, I thank our witnesses for their time and contributions. I am sure that when Committee members come to consider the Bill in detail they will find those comments very helpful. Thank you.
Ordered, That further consideration be now adjourned. —(Steve Double.)
Adjourned till this day at Two o’clock.