Amy: 0:00

Hello and welcome again to The Bench Report, where we discuss recent debates and briefings from the benches of the UK Parliament. A new topic every episode. You're listening to Amy and Ivan.

Ivan: 0:15

Today, we're looking at something that caused quite a stir, an urgent question in Parliament, focusing on that cyber attack against Jaguar Land Rover.

Amy: 0:24

Yes, a really significant event. And the impact was, well, pretty much immediate and quite severe.

Ivan: 0:31

It sounds like it. Production lines halted, sales completely stopped.

Amy: 0:35

That's what the reports indicate. And you have to think about the knock-on effects. We're talking, what, some 34,000 UK employees?

Ivan: 0:41

Huge numbers. And then there's the whole supply chain, especially across the West Midlands and the Northwest.

Amy: 0:45

Exactly. It ripples out. And the reported figure for lost sales, 72 million pounds per day.

Ivan: 0:52

72 million. That really brings home how quickly a digital attack hits the physical economy. Must create a lot of anxiety for workers, for businesses.

Amy: 1:01

Absolutely. Understandable anxiety. The government's response seems to have been quite rapid, though.

Ivan: 1:05

What are we seeing there? Well, daily engagement with JLR, apparently. Direct support from the National Cyber Security Center, the NCSC, since last Wednesday.

Amy: 1:14

Okay, so hands-on help.

Ivan: 1:15

Yes. And the minister responsible has apparently had personal meetings with JLR's CEO.

Amy: 1:21

Of course, they can't reveal everything, can they? Not while investigations are live.

Ivan: 1:25

No. Operational details are understandably limited. But the message is clear. They're committed to helping resolve it. It's being treated as a serious economic issue, not just a tech problem.

Amy: 1:38

Which it is. So that's the immediate response. But what about preventing this sort of thing? What wider measures are in place or coming?

Ivan: 1:45

Good question. There's existing legislation, the Product Security and Telecommunications Infrastructure Act from 2022, for instance.

Amy: 1:52

What does that do, essentially?

Ivan: 1:53

It mandates security by design for internet-connected products. So building security in from the ground up rather than adding it later. Think secure foundations, not just alarms on the doors.

Amy: 2:04

Makes sense. And the NCSC, they do more than just react, presumably.

Ivan: 2:07

Oh, definitely. They offer a whole range of tools and advice. Their cyber essentials scheme, for example, is meant to be high Reducing

Amy: 2:17

the likelihood quite drastically, I heard.

Ivan: 2:20

That's the aim. Plus, they offer training for boards, for staff, early warning systems to flag potential threats on networks.

Amy: 2:27

And there's new legislation on the horizon, too.

Ivan: 2:29

Yes, the upcoming Cybersecurity and Resilience Bill. That's intended to raise standards, especially in critical services. Energy, water, the NHS, places you really don't want falling victim.

Amy: 2:41

And updating older laws, like the Computer Misuse Act. That's from 1990. It is.

Ivan: 2:47

Trying to apply laws from the dial-up era to modern cyber threats is challenging, to say the least. The landscape has changed entirely.

Amy: 2:55

Especially with things like ransomware, which keeps cropping up.

Ivan: 2:58

A major issue. And the government's stance there is quite firm. They advise against paying ransoms.

Amy: 3:03

Why is that, specifically?

Ivan: 3:05

Because paying essentially validates the criminal's business model. It encourages more attacks. The focus has to be on prevention, resilience, and catching the perpetrators.

Amy: 3:14

It's a tough line to hold though, isn't it? If you're a company hemorrhaging millions, like that 72 million pound a day figure for JLR, the pressure must be immense.

Ivan: 3:24

It's incredibly difficult. There's definitely a tension between that long-term policy goal and the immediate commercial survival instinct.

Amy: 3:31

And this JLR incident, it's not happening in a vacuum, is it?

Ivan: 3:34

Not at all. It's part of a much bigger picture. We've seen other major British names hit recently. Marks & Spencer, even the British Library, had significant issues.

Amy: 3:41

That statistic was quite eye-opening. Something like 40% of UK companies reported some kind of cyber attack last year.

Ivan: 3:48

Around that figure, yes, 40%. It shows this isn't just about the huge corporations, small, medium businesses. Everyone is potentially a target.

Amy: 3:57

And the threat itself, is it getting worse and more sophisticated?

Ivan: 4:00

The evidence points that way. Increasingly hostile activity comes from sophisticated criminal groups, but also potentially from malicious state actors. And it's a global issue. Qantas, Adidas, big international names facing similar problems.

Amy: 4:15

Is there a sense that maybe companies sometimes focus security efforts in the wrong place?

Ivan: 4:19

Well, there's an interesting point raised sometimes that companies might understandably prioritize protecting customer data, credit cards, personal info, maybe sometimes at the expense of securing their core operational systems, the systems that actually run the factory or the logistics.

Amy: 4:36

Leaving the core business vulnerable, even if customer details are safe. That's a critical distinction.

Ivan: 4:42

It is. It underlines that this is fundamentally a national security issue and an economic one. It affects every single sector.

Amy: 4:48

And looking forward, there's this idea of computers on wheels, future cars.

Ivan: 4:53

Exactly. As vehicles become more connected, more autonomous, they potentially become targets, too. It adds a whole new dimension. Not just data theft, but potential physical disruption, even safety risks.

Amy: 5:04

A sobering thought. It really demands constant vigilance, constant adaptation from businesses, from government, from all of us, really.

Ivan: 5:11

Precisely. Proactive defense, built-in security, awareness As always, find us on social

Amy: 5:21

media at BenchReportUK. Get in touch with any topic important to you. Remember, politics is everyone's business. Take care.