My hon. Friend the Member for Lichfield (Dave Robertson MP) has been appointed as a full member of the United Kingdom delegation to the Parliamentary Assembly of the Council of Europe in place of my hon. Friend the Member for Rugby (John Slinger MP).

[HCWS364]

Today the Government are launching a public consultation on proposed legislative measures to combat the threat of ransomware. We want to protect UK businesses from the most harmful cyber-crime facing the UK and to facilitate growth.

These measures will hit ransomware criminals in their wallets, cutting off their funding; and improve reporting of these cyber incidents, to shine a light on this criminal world and provide law enforcement with the information they need to pursue criminals.

The National Crime Agency assesses ransomware as the greatest serious and organised cyber-crime threat, the largest cyber-security threat, and a risk to the UK’s national security. Ransomware incidents are continuing an upward trend.

In 2023, incidents of ransomware attacks reported to the Information Commissioner’s Office reached their highest level since 2019, and private sector reporting to the National Crime Agency indicates that the number of UK victims appearing on ransomware data leak sites has doubled since 2022. This is reflected globally, with 2023 resulting in the highest financial yield for ransomware criminals so far, with an industry estimate of over $1 billion.

Ransomware criminals ruin lives, wreck businesses and damage the UK economy. The impacts of ransomware —financial, reputational, psychological and social—can be wide-ranging, as seen in recent incidents, such as those affecting Synnovis, the supplier of services to the NHS across London; the British Library; Capita; and Royal Mail.

It is this significant risk of harm that warrants focused and specific intervention to reduce the impact of ransomware across the UK.

We are seeking to build on existing resilience and disruption strategies, including sanctions, where the UK has already sanctioned 36 ransomware criminals, and our work with the international Counter Ransomware Initiative, where the UK led a commitment from 48 countries and two international organisations that their Governments would not pay ransoms.

The Home Office has developed three world-leading tailored legislative proposals for consultation—they reflect the seriousness of the threat and the need for transformative action. The measures will be consistent and align with the proposals in the forthcoming cyber-security and resilience Bill.

The three measures are:

A targeted ban on ransomware payments for the public sector and critical national infrastructure—making the essential services the country relies on the most unattractive targets for ransomware criminals;

A ransomware payment prevention regime—to increase transparency of criminal demands, and provide victims not covered by the ban with advice and guidance before they decide how to respond; and

A mandatory reporting regime for all ransomware incidents—bringing ransomware out of the shadows and maximising information for law enforcement on criminal activity.

The targeted ban will protect the systems that the UK relies on every day for our most critical and essential services. We are making a strong statement to these criminals that there is no financial gain in disrupting the core of our economy.

The consultation explores whether the payment prevention regime should be economy wide or operate via a threshold, with the potential exclusion of individuals and/or small businesses. Such a regime would provide the Government with the ability to block payments and allow law enforcement greater oversight of ransomware, supporting disruptive operations such as the recent success of Operation CRONOS, the NCA-led global collaboration to disrupt Lockbit, one of the most prolific ransomware groups in the world.

For those ransomware incidents that do not result in a payment, we are proposing to introduce a mandatory ransomware incident reporting regime. This could include a threshold-based mandatory reporting requirement for suspected victims of ransomware, with the potential exclusion of individuals and/or small businesses. Our aim is to build the Government and law enforcement’s understanding of the threat landscape and allow us to provide greater levels of support and guidance to victims.

The consultation seeks public input on key issues, including: the extent to which supply chains should be captured in the targeted ban; what support the Government can provide to victims, such as improved guidance; the appropriateness of paying ransoms in any circumstances; and the extent to which information should be shared with authorities. These world-leading measures reflect the new Government’s commitment to tackling ransomware and making the UK a less attractive target for such attacks globally.

The consultation will run for 12 weeks, and the Government will publish their response in due course. Copies of the consultation document and the related options assessment will be placed in the Libraries of both Houses and made available on www.gov.uk.

[HCWS365]

I am making this statement to record updates to maritime legislation as a result of changes to international law. This fulfils a commitment made to Parliament to make such a statement. The legislative changes came into force on 1 January 2025.

Some domestic maritime secondary legislation includes ambulatory reference provision to give direct effect in UK law to certain amendments to international obligations. This means that where the legislation refers to a requirement of an international instrument, this reference will be ambulatory; in other words, it is a reference to the most up to date version of that requirement. This approach ensures so far as possible that the UK keeps up to date with its international maritime obligations.

Amendments have been made to two maritime codes which are made mandatory by the international convention for the safety of life at sea, 1974 (SOLAS), which is the main international instrument governing maritime safety: the International Maritime Solid Bulk Cargoes (IMSBC) Code and the International Maritime Dangerous Goods (IMDG) Code. Two sea areas identified in the international convention for the prevention of pollution from ships, 1973 (MARPOL), which are subject to enhanced pollution protection requirements, have been established under the agreed procedure in MARPOL.

The IMSBC code is made mandatory by chapter VI of SOLAS and is implemented in the UK by the Merchant Shipping (Carriage of Cargoes) Regulations 2024 (SI No. 2024/637) (the “Carriage of Cargoes Regulations”). The IMSBC code provides the international regulatory framework for the safe loading, stowage and shipment of solid bulk cargoes other than grain, and includes mandatory carriage requirements specific to each type of solid bulk cargo covered by the code.

To remain up to date and fit for purpose, the IMSBC code is amended in the International Maritime Organization and a new edition adopted every two years. Changes to the IMSBC code text are proposed to, and considered by, the IMO’s Sub-Committee on the Carriage of Cargoes and Containers with participants including member states and industry bodies. The latest edition of the code was adopted by IMO resolution MSC.539(107) and became mandatory internationally on 1 January 2025 when, by way of the ambulatory reference provision in the Carriage of Cargoes Regulations, it also became mandatory in the UK. It includes carriage requirements for a number of new solid bulk cargoes in order to permit and facilitate their safe transport by sea, and amendments to some existing cargo schedules.

The IMDG code is made mandatory at the international level by chapter VII of SOLAS, and also by annex III of MARPOL. The IMDG code is implemented in the UK by the Merchant Shipping (Carriage of Dangerous Goods and Harmful Substances) (Amendment) Regulations 2024 (SI No. 2024/636) (the “Dangerous Goods Regulations”). The IMDG code provides the international regulatory framework for the carriage of dangerous goods and marine pollutants by sea. It makes mandatory provision for the classification, notification, packaging, labelling, stowage and segregation of dangerous goods to enable their safe transport by sea.

In order to keep it up to date and harmonised with the requirements for the carriage of dangerous goods in other modes of transport, the IMDG code is updated in the IMO every two years. The latest edition of the code was adopted by IMO resolution MSC.556(108). It applies on a voluntary basis from 1 January 2025 and will become mandatory internationally on 1 January 2026 when, by way of the ambulatory reference provision in the Dangerous Goods Regulations, it will also become mandatory in the UK. It includes clarifications on the requirements for marine pollutants, new provisions for electric vehicles and provisions for cargo tracking devices.

Further amendments to MARPOL will come into force in the UK by way of the ambulatory reference provisions in the Merchant Shipping (Prevention of Oil Pollution) Regulations 2019 (SI 2019/42) (“the Oil Pollution Regulations”) and the Merchant Shipping (Prevention of Pollution by Garbage from Ships) Regulations 2020 (SI 2020/621) (“the Garbage Regulations”). MARPOL contains mandatory requirements for the prevention and control of pollution from ships and identifies geographical areas, known as special areas, where sea traffic and the sensitive nature of the marine environment mean that additional control measures are required for the protection of that environment. Annex I of MARPOL, which makes provision for the prevention of pollution by oil from ships, and annex V of MARPOL, which makes provision for the prevention of pollution by garbage from ships, both include provisions defining the Red Sea as a special area. Annex I further defines the Gulf of Aden as a special area. Until now, these special areas were identified in MARPOL but had not been established as such. MARPOL contains provision to allow the IMO to establish the special areas identified in MARPOL. By resolutions MEPC.381(80) and MEPC.382(80), the IMO has determined that both special areas were established internationally on 1 January 2025. By way of the ambulatory reference provision in the Garbage Regulations, and also by way of specific provision in the Oil Pollution Regulations which replicates the MARPOL procedure, these special areas were also established for the purposes of UK legislation on that date.

Further information and guidance on all amendments referred to in this statement has been published by the Maritime and Coastguard Agency and is available on www.gov.uk.

[HCWS363]