Welcome to today’s session of the Business and Trade Sub-Committee. We are incredibly grateful to you, Chancellor of the Duchy of Lancaster, and to you, Douglas Alexander, together with Philippa and Jonathan, for joining us for our wrap-up hearing on the inquiry into the nation’s economic security. Chancellor of the Duchy of Lancaster, perhaps you might open the batting. The President of France yesterday came to Parliament and warned against the perils of an excessive dependency on America and China, and he counselled us to be wary of this double dependency. Was the President right or wrong?

He did say, though, that we need to de-risk our economies and societies from this dual dependency.

So you would not advise us that the Government’s economic security strategy is, in essence, an argument for a Gallic-like strategic autonomy.

It is kind of an agile interdependence that you are describing as a guide to policy.

Let me move on to the threats in a moment, but Douglas Alexander, are you being agile and interdependent?

I am trying my best, Chair. I should start with a declaration. Pat graciously acknowledged that he is not new to this House. I am even older in terms of my membership of the House, so I attended the last Anglo-French summit with Nicolas Sarkozy and Gordon Brown in 2009.

In Highbury—it was a great day, I seem to remember.

It was at the Emirates stadium with the Arsenal manager at the time. I want to build on a couple of points made by the Chancellor of the Duchy of Lancaster. First, in a very prescient speech yesterday, the President of the Fifth Republic made clear that we had left the European Union but not Europe. If you consider how we think about the objectives of economic security—promoting strength and resilience, protecting from risk and threat and partnering with other like-minded countries—there is a striking commonality with the EU Commission thinking in relation to economic security. It is right to recognise that the French state was rather quicker to embrace industrial policy than the recently published industrial strategy of the UK Government, and that is a point of differentiation. It is also important to recognise, even if we are determined to build strength at home and influence abroad, that the Prime Minister set out in the Mansion House speech in November a very clear compass by which we were seeking to navigate this challenging and changing trading environment. Exactly as Pat observed, the Prime Minister made clear in the Mansion House speech that we would categorically not choose between our friends, partners and neighbours in Europe and our long-standing friends and allies in the United States. There was a degree of scepticism among some commentators as to whether we could deliver on that promise. But as Pat graciously recognised, whether it is stage 1 of the EPD that we put in place with the United States, as the first Government to reach a trade agreement with the United States, or the EU reset, with the first UK-EU summit on 19 May, we have been working very hard in the intervening period since last November to give practical expression to the Prime Minister’s direction to us. You asked us about the compass by which we are navigating and whether it is a Gallic view. At every stage, a clear-eyed sense of the UK national interest has been the north star by which we have sought to navigate these waters.

Chancellor of the Duchy of Lancaster, you have been in office over a year now. You have just refreshed the national security strategy, and you delivered to Parliament a resilience strategy yesterday. When you look at the next five to 10 years, what are the principal threats confronting our country’s economic security that worry you most?

Douglas, do you have anything to add to that?

It is more than 30 years since Edward Luttwak talked about geoeconomics and the weaponisation of economics in the service of strategic ends. But exactly as Pat says, what we have seen in recent years is the interruption of geoeconomics by geopolitics. In that sense, the early 20th century was marked by war and then pandemic. We have seen pandemic and then war. It has been an object lesson to Governments, including the United Kingdom Government, about the need for economic security as an essential precondition of national security. Again, if one takes a longer view, one can look back to the Athenian empire and its imposition of sanctions at the outset of the Peloponnesian war. Economic statecraft is not new, but whether in relation to the vulnerability of supply chains—for masks and medicines during the pandemic, for example—the weaponisation of energy in relation to Ukraine, or the invasion of Ukraine by Russia, which is the biggest single challenge to the Euro-Atlantic security area and the international order in 80 years, we have learned some harsh lessons in recent years as to the capacity for politics to interrupt economics. That is certainly reflected in our engagement with business. Frankly, an understanding of geopolitics used to be a nice to have, but it is increasingly at the forefront of C-suite conversations, not just here in the UK but across many of our partner countries.

Chancellor of the Duchy of Lancaster, given the picture that you have both just sketched out, the national security strategy rightly puts a real premium on the development of some sovereign capabilities. That has been echoed in the strategic defence review, and I hope will be echoed soon in the defence industrial strategy, whenever that is published. What are the kinds of sovereign capabilities that you think we will need to grow onshore, and what are the kinds of capabilities that you would be asking Douglas to ensure that we can procure through our trade agreements with allies?

A list is fine.

Do you think the business community knows what sovereign capabilities the Government want to curate?

The answer may be that we do not yet know what the full sovereign capabilities are that we might like.

Let me try to help. The industrial strategy has been devised through discussion and by listening very carefully to business. So, in answer to your direct question as to whether businesses would be aware, the industrial strategy has very much been an act of co-creation. There are two real categories—although we do not use the term “sovereign capability” in the industrial strategy—that I will highlight. One is the IS-8, which is the eight growth sectors. That, if you like, contributes to economic security in the broader sense, because if we can build our growth capability as a country, that inherently not only allows you to fund public services and everything else, but also strengthens your capacity for the choices you need to make in terms of resilience. As well as those IS-8 fast-growth sectors, we also categorise—and I will share the list with you—the foundational underpinnings of that IS-8. Those foundational areas are electricity networks, ports, construction, steel, critical minerals, composites, materials and chemicals, all of which we regard as essential to support the IS-8 sectors.

That is extremely helpful. The final question from me is about the economic security regime that you inherited. Given the fast-moving landscape that you have described and your picture of the threats that we now confront, is it your view that the economic security strategy and system that we have are fit for purpose, or do they now need either a revolution, an evolution or—dare I say it—a third way?

That is very helpful. Douglas, you are at the cutting edge of negotiating some trade agreements. If I look at the list of critical supply chains, critical national infrastructure and critical minerals, presumably there is an opportunity to begin building into some of those agreements with allies around the world what some have characterised in shorthand as an economic NATO, which I think basically means a coalition of allies that are interdependent and want to de-risk things that we all rely on.

I think it was maybe you who characterised it as an economic NATO.

I think I may have stolen the term from others.

Let me build on what Pat offered. While it is absolutely true in terms of investment security, on the broader waterfront of economic security, the first responsibility of Government is defence of the realm, and therefore it is right to evolve in the light of changing circumstances rather than make change for change’s sake. If I was to identify some of the changes that we have seen in the course of the last 12 months, first, as I say, we have published an industrial strategy. Our capacity to effectively provide the defence, the public services and the standard of living that we are looking for is contingent on strength at home, and in that sense, both in terms of resilience and in terms of growth, we stand by the industrial strategy. As part of that, we announced a supply chain centre that is specifically designed to look at exactly the questions that you are asking. I have a great personal friend who worked for the Biden Administration and oversaw their evolution and development of supply chain centres. That was not far from my mind when we were talking through the trade strategy and saying, “How do we make sure that we have best-in-class capability in terms of supply chain centres?” That will be directly engaged with industry, it will be data-led and it will allow us to dock effectively with G7 partners on the critical issue of supply chains. As well as the supply chain centre, we have also innovated in terms of the establishment of the economic security advisory service. The question, which has been reflected in a number the Committee’s questions in previous evidence sessions, is: “Even if you are getting the systemic approach to economic security correct, are you confident that there is a clear enough understanding within the British business community of both how they can access support and services, and what is available to them?” We have given a lot of thought to the framework and structures to ensure that we are systemic and reflect the character of how accountability works in the British system, rather than a more narrowly siloed approach, but we did listen to many people who told us that we could do a better job of making sure that the business community understands how to access the deep pools of domain knowledge and expertise that are inherent within the capabilities across Whitehall. I see the economic security advisory service as a better user interface between Government and the private sector to make sure both that we have an effective online offering and that we are able to provide an effective brokering service, in the first instance for the IS-8 sectors that we identified, so that if you are a company that is concerned with export controls, investment security or the range of other areas covered by economic security, not only are we effective in the advice that we offer, but you know how to access that advice. More broadly, on the trade questions that you asked, Pat mentioned meeting his opposite number in Japan. I recently met the economic security Minister in Japan. I travelled to Canada for the CPTPP meeting in Vancouver in December. The Canadians were at pains to emphasise that they saw themselves as a reliable, trusted partner in relation to critical raw materials. As I think a witness to one of the Committee’s previous sessions evidenced, rare earths are often not that rare; what is rare is the refining capability. It seems to me that if interdependence and extended supply chains are our vulnerability, then co-ordination is the remedy. That is why the work that Philippa and others are doing in terms of the G7—we were the first to put economic security on the G7 agenda—is so central. Frankly, the Chinese in particular have been working on their refining capability for more than 20 years. They have a very high element of concentration in terms of refining capability, and one of the challenges that is faced is how independent countries, other than China, can develop refining capability, not just sourcing and supply capability. That is where the G7 continues to have a critical role to play.

One of the many reasons for us to develop the Cornish mining sector. Let us get into some of the detail, starting with Sarah Edwards.

Thank you, Chair. Slightly rolling back on that really interesting overview, we have heard a lot of evidence about what the definition of economic security might be. There are various schools of thought and a number of potential wordings. Some people think that you need a solid definition; others think that you need a set of principles. We know that there are three principles in Japan and three principles in the EU—quite similar. The previous Government also had three principles. Have this Government decided to continue with the previous Government’s principles, to rewrite them, or to set themselves apart in a completely different way?

So no actual definition—that is fair enough, and we can understand why. What about a set of principles that sit across the top that enable both yourselves and Departments to make judgments about where the eye should fall? Again, your principles can be flexible—you can flex and change those much more easily than a definition, which, as you say, may get you into the legal weeds—but what about a set of principles that help keep that slightly more focused attention in the right areas?

Running with Sarah’s point about principles, under the last Government, Labour pushed very hard that any trade agreement should have a human rights chapter in it. India’s does not; the GCC’s, as currently being discussed, does not. It feels a little bit like, “When we’re out of power, we want this, but when we’re in power, we don’t.” Could you please give some thoughts on that?

I said at the time of the trade strategy that we had a pragmatic patriotism. That is the approach we have taken to our trade negotiations, with a clear-eyed sense as to the UK’s national interest. I can assure the Committee that we do not leave our values at the door when negotiating with other countries, but it is inherent in negotiating with other countries that one is not always able to secure everything that one seeks from the outset of the negotiations. If you were to say to me, “Is there an inconsistency between Labour in opposition pushing hard on the issue of human rights, labour standards or responsible business practices?” I can assure you that we continue to do so. That does not prescribe the approach taken by other countries or blocs with whom we are working to deal. If you take the example of the GCC, those are still live negotiations—if you were to read The Guardian that might not always be apparent, but the reality is that we have negotiations under way—and we continue to push for legally binding text. Whether we are able to secure legally binding text is a matter of negotiation.

So it is strictly best efforts. The message to anybody else is, “We would like to have human rights in there, but we’ll go forward without it.”

Be assured that human rights are not optional. We stand firm on human rights. I returned recently from China, as part of our engagement with China. I took the opportunity when there to raise Jimmy Lai, the case of the Uyghurs and human rights issues more broadly. In that sense, trade policy is but one of the instruments available for the exercising of influence on the international stage. The UK continues to stand firm on human rights, as evidenced by the approach that the Foreign Secretary and the whole Government have taken.

Monica Harding, you look poised to come in.

I am—excuse me. Coming back to the human rights chapter, can I draw your attention to the war in Sudan? That is the biggest humanitarian crisis since aid began, with 30 million people in food insecurity. I understand that the gold trade and weapons are both out of scope of the GCC trade agreement. About 90% of the illicit trade in gold is going through the UAE, which is sustaining Sudan’s civil war, as shown in Chatham House reports. There was also an article last week in The New York Times. Much tougher concerted action is needed, which I hope the UK would lead. On weapons, the UAE is playing a central role in arming the RSF, which the USA has said is involved in a genocide in Sudan. A report in The New York Times says—

Do you want to come to a question? I am sure the Minister knows the background.

My question is: how does that stack up with what you are saying about the human rights chapter and how it is implicit in everything you do, if it is not within the GCC deal?

First, the UAE is but one of the sovereign entities within the GCC, and we are negotiating via the GCC secretariat, which leads on trade policy. Of course, it is talking to the UAE along with Bahrain, Qatar and the other members of the GCC. In relation to Sudan, again, I probably have to declare an interest as an old man, but I travelled when I was Development Secretary to Darfur and know how profound are the challenges that country continues to face. I visited South Sudan and Juba as well. I know that resolving the Sudanese conflict is a personal priority of the Foreign Secretary, who has convened a conference on Sudan. The UN Security Council, in language penned by the United Kingdom, said: “Council members urged all Member States to refrain from external interference which seeks to foment conflict and instability and instead to support efforts for durable peace and reminded all parties to the conflict and Member States to adhere to their obligations to comply with the arms embargo measures as stipulated in paragraphs 7 and 8 of resolution 1556…and reaffirmed and renewed in resolution 2750”. So there is an arms embargo on Sudan, which the UK is absolute in standing behind and supporting. Any military exports to the UAE are governed by the strategic arms export licence criteria, which means that they are judged on a case-by-case basis. We seek assurances in relation to the end user from any country to which arms are being exported. In that sense, the UK is very clear in our deep bilateral relationship with the UAE about its responsibilities, as well as our responsibilities, in relation to the conflict. We are unaware of instances of weapons being passported through the UAE to Sudan as you describe. If you are aware of any evidence to that effect, of course we would be grateful to receive it.

We are going to go into some detail on that on 9 September, so we will return to that.

It is worth putting on the record that the jury is still out on whether the Athenian Megarian decree, which imposed sanctions, was effective.

I thought you were about to say that they were built in your constituency.

I was at the opening. It is probably fair to say that economic security sits in lots of ministerial portfolios but is nobody’s specific priority. Douglas, you seem to be coming down on the side of Sir Simon Fraser of Flint, who argued for a one-stop shop for business to come to, so that they can come to Government, have one stop, and feed into the deeper pool of talent that you talked about. Am I right in saying that? Is that roughly your position?

it really depends on how big the shop is. There was a very good article in the Financial Times back in 2024 that argued that the Australian approach was more about being on the same page than being in the same building. If the shop front is the route to Whitehall in its totality, I am on all fours with the former PUS at the Foreign Office, Simon Fraser. If the suggestion is—the Chair has written eloquently on these matters—an office of economic statecraft, which would brigade all the capabilities of Whitehall into a single shop, respectfully, that is not the Government’s position. As Pat set out, first, we need to recognise the deeply embedded domain expertise that rests within individual Whitehall Departments. Secondly, we do not want to compromise the clear ministerial accountability, not just to Committees like this but to Parliament more generally, that rightly rests with Secretaries of State in the British system. It is critical that, along with the vertical domain capability that naturally and appropriately rests in different Departments, there is a co-ordinating capability carried out by the Cabinet Office and an interface with business, which DBT leads. In that sense, I hope the Economic Security Advisory Service addresses Simon’s observation that we need a clearer portal and point of contact with Whitehall, but we are not convinced of the case for trying to take the deep domain expertise that, exactly as Pat said, is always going to rest in individual Whitehall Departments, and to brigade that together in a single centre or building.

Thank you. Pat, you mentioned the need to balance economic and security policy, and said that they are sometimes competing areas. How do you manage situations where there may be competition? I am thinking of, for instance, PV panels for solar. We now have a policy that we will drive towards that, but the cheapest source of what we need to make that happen is China, with all that goes with that. How does this balancing act work out?

Mr Alexander, how satisfied are you with the UK’s overall approach to enforcing its economic security regime?

As Pat said, it is like painting the Forth bridge: it is not one and done; it is a matter that we keep under constant review. But I was very struck by the evidence that was given to this Committee about the operation of the NSIA in recent months and how effective that has proved to be. There was serious and important probing by this Committee into whether there were significant delays or uncertainty in the business community, and I was very struck by the candour of the answers. More broadly, we have the arms export regime, of which I have spoken, including the ECJU and the work that we lead in the Department for Business and Trade on those areas. Whether it is about investment security or export controls, we are always open to the thinking and learning of this Committee as to what we could or should do better, but broadly I think we are seen as pretty effective. For example, if I look at the dialogue that we have with the United States, as Pat was describing, I am very struck by how warm, cordial and constructive it has been on areas where we have been able to establish, if you like, equivalence of regimes.

I was taken by what you said about geopolitics interrupting economics. The value of UK exports to markets such as Kyrgyzstan, which is believed to be an entry point for sanctioned goods into Russia, has increased by around 300%. Are UK sanctions really a threat to our adversaries, or are they just a mild annoyance?

There are particular challenges that the Government are looking at—for example, there has been a lot of coverage on Sky News about where luxury car exports are ending up—but leading on strengthening our sanctions regime in relation to Russia has been a personal priority of the Foreign Secretary and Stephen Doughty in the Foreign Office, and a huge amount of work has gone into that. I am conscious that this Committee has a strong interest in the new Office of Trade Sanctions Implementation, as well as the originator, which sits with HMRC and the Treasury. That is only nine months young, so we have a lot of work under way in the Department to build up the capability of OTSI. I am conscious that the Committee is interested in getting a review. We are aiming to publish an annual report, which will be the means by which we provide information about how OTSI is doing. Following Russia’s illegal invasion of Ukraine, we were in lockstep with our friends and partners in Europe. To again reference President Macron yesterday, I thought that he was both generous and accurate in paying tribute to the UK’s leadership in relation to that conflict.

So it would concern you if, say, diggers made in Britain suddenly turned up in Russia, bought through interlocutors in Turkey.

We have a very rigorous sanctions regime, and we are constantly seeking to learn whether there is a diversion of trade in an effort to circumvent those sanctions. Since we came into government, we have already acted to strengthen that regime. Where evidence emerges, there is no public policy objection to strengthening the sanctions. We are at one, whether in the Foreign Office, the Department for Business and trade or, indeed, the Cabinet Office, in wanting to make sure that those sanctions are effective. The indications in terms of quite a lot of the capability of the Russian state, notwithstanding that it is moving to a war economy, are that those international sanctions have had some effect. As I say, it is like painting the Forth bridge, and if more can be done, we should return to it.

So firms facilitating that kind of trade would face the full weight of the law.

Yes, absolutely.

Running with that, one part of economic security is a register of foreign-owned assets in the UK, which the last Government talked about a lot. I was hoping that—maybe not on the spot now, but perhaps in writing—you could say when this Government will commit to putting in the public domain a full register of properties and businesses that are owned by foreign parties. That would be very helpful. Going back to the UAE-Sudan situation, what would be really helpful is knowing whether or not gold and weapons will be included and properly addressed in the FTA discussions, and whether the UK for its part—this is in the public news; The New York Times has reported it globally, so there is a lot of information out there—will confirm within 30 days that none of the weapons that we are exporting to the UAE are then being transferred down into Sudan. I have two more points, if I may. One is: will the UK will re-examine its arm exports to the UAE, taking into consideration the new information—à la The New York Times and others—regarding the alleged transfer of arms, and not just the ones we are selling, into Sudan? That is because, exactly as Douglas mentioned, what are our rules? Arms export regulations require that we consider whether exports can be used for human rights violations, which are going on in Sudan, or to destabilise a region, which is certainly going on in Sudan, or to breach international law, which is also certainly going on in Sudan. Finally, will the UK work with the UAE to sanction the key individuals and companies involved in the smuggling and laundering of conflict gold through the Gulf, including the UAE?

Answer what you can now and feel free to follow up in writing, or indeed on 9 September.

While I undertake to write to the Committee, I cannot give you the guarantee as to exactly when the UK Government will do what you are asking; but I can guarantee that we will write and set out our thinking in relation to that. The UK has already frozen assets of nine commercial entities linked to both SAF and RSF, the two principal organisations, and as I said, there is a huge diplomatic effort being led by the Foreign Secretary personally to resolve the Sudan conflict. As for how the system operates, let me share with you what I can at this stage and then I am very happy to write. As for all countries, for the UAE we keep our export licences for military equipment under review, on a case-by-case basis, against the requirements of our export licensing criteria. This includes specifically an assessment of the risk of diversion to a proscribed destination, and Sudan would meet that threshold in terms of being a proscribed destination. As a Government, we are not aware that UK military equipment being licensed to the UAE is being diverted to Sudan, but we will not grant a licence unless the end-user provides a signed undertaking stating that, and I quote directly, “The goods will not be re-exported or otherwise resold or transferred to a destination subject to UN, EU, UK, OSCE embargo, where that act would be in breach of the terms of that embargo.” We expect end-users to honour that commitment and if they do not we can suspend or revoke licences, and we will factor that into decisions on any future licences. That is the regime that we are operating. We do not have within our knowledge evidence that UK weapons exported to the UAE have found their way to Sudan, but in that sense I am very happy to write to the Committee.

Many thanks for that, Douglas, but if I may, it is not just about our weapons; it is about other weapons. If the UAE is transferring weapons into Sudan, which is a bloodbath, we should be thinking very hard, because we would be breaching our own export regulations because of what their actions are doing with other people’s weapons. I am looking for your help on that as well.

First of all, if there was evidence that that was happening, that would be a material consideration in terms of the risks of diversion in relation to our own licences. Secondly, at the United Nations and at the Security Council we have made clear our absolute commitment to the arms embargo more broadly in relation to Sudan. Thirdly, we have a deep and enduring bilateral relationship with the UAE, and it is open to us to have those dialogues not just with the UAE but with any other country about which we have concerns. I would be very happy to write to you on those terms.

Thank you. Let’s pursue that further, including on 9 September, if that is good.

Pat, I imagine that working across Government is very difficult, given the kind of silo mentality that may exist in different Departments. There are many Departments involved with national security. What is your approach to make it work?

Obviously, it is about bringing together those who need to be brought together to ensure that everyone is working with common purpose. I was struck by the work of the Export Control Joint Unit, and how that is set out in a flow-chart, process-driven approach. Is that something that is being replicated in a very formalised way across other areas of work?

Do you think there are areas where it could be quite useful to introduce a more process-driven approach?

Could I add a personal observation? As well as working with the Secretary of State in the Department for Business and Trade, I work with, and for, Pat in the Cabinet Office. My observation is that relationships in Government really matter as well. There is a degree of jeopardy in assuming that, if there is a flow chart, there is a functioning system. I have experienced plenty of examples where there may have been a clear flow chart but there was a very far from clear set of working relationships. The fact that I sit with Pat and his directors general, and the fact that I work very closely with Jonathan and Philippa, makes a very material difference to the functioning of not just our relationships but our effectiveness across Government. My observation, again having served previously, is that one of the vanishingly few benefits of Opposition is that the Cabinet really know each other very well. Over time, Whitehall creates the opportunity for more siloed ministerial thinking. One of the strengths of the last 11 to 12 months, as an incoming Government, has been the fact that, as well as the organogram and the flow charts, there is a deep sense of affinity among Ministers, which has not always been the hallmark of the British Government in recent years.

Finally, Pat, one of first things the new Government did was abolish the National Security Council’s economic security sub-committee. To what extent do you think the National Security Council is adequately considering these issues, given all the other matters that it has to deal with?

Could I add one thing to explain to the Committee how, underneath the political structures, we organise our co-ordination from the centre? We split it a bit between a response to an acute issue, which is what Cobra is set up to do, and more of a standing structure for approaching more chronic and more strategic challenges, which I and the other deputy National Security Adviser chair, reporting into the CDL. That brings together all the Departments, the agencies and the heads of professions, like the chief scientist or whoever is appropriate to each issue. Underneath that, we are doing quite a lot of work on what we call integrated assessment and analysis, to try to bring together national security assessment with the more classic cost-benefit analysis that you would see in the economic sphere. That is working with the joint intelligence office and the economists. That touches on something that has come through in your questions, which is about how we manage our economic and security interests. Traditionally, they were sometimes more separate, but today they are much more intertwined. This work is about trying, in a practical way, to bring that together.

On the recent cyber-attacks on Marks & Spencer and the Co-op, I am interested to know—given that there was clearly a coherent, integrated attack—what that would have looked like for you. Would that have been chronic? Would there have been an emergency Cobra? What would have happened over that weekend?

Would there have been an assessment by DBT or someone about the potential for food shortages as a result of the attack, or did you feel, as a Government, that it was pretty secure and not a concern?

They did not sound wholly convinced that they got the assistance from the state that they had perhaps wanted. I think they suggested that they would have to go to the FBI for some of the help that they wanted.

“Muscled up” was the phrase, I think.

That was a perfect introduction to the question that I want to ask about cyber-security for SMEs. RUSI has highlighted its concern about the lack of availability of security tooling for SMEs, which have an outsized exposure to attack, both from direct impacts on their organisations and as a result of their exposure to much larger organisations through supply chains. Perhaps this question is more for Douglas Alexander, to start with: when you talk to businesses, do they tell you that they are confident in understanding their role in UK economic security?

I should probably declare an interest: I was a trustee of RUSI for several years preceding my election to this House in July, so I have huge regard for the quality of its research and for its work on economic security broadly and cyber in particular. The easiest way to answer your question is probably to give you a practical example of what we did in relation to that.

What are we talking about, specifically?

Specifically the M&S and Co-op attacks, and the learnings for SMEs in particular. At the last meeting of the Retail Sector Council, which is an industry-led body chaired by my colleague Gareth Thomas, the agenda reflected the exact concern that RUSI identified and that you have reflected to me. Revealingly, the council recognised in its deliberation the depth of domain knowledge that Pat spoke of, whether that was the National Cyber Security Centre, the National Crime Agency or indeed trade associations, but exactly as you have described, concern was expressed about the capability of SMEs to access that learning. One practical change that is happening is that the retail sector and the SMEs therein are forming a resilience group to work with a range of businesses—principally small businesses—and with trade associations and other Government Departments to consider how their resilience can be enhanced and collaboration strengthened. Secondly, I return to a point that I made earlier in this session. By establishing the economic security advisory service, we want to have a better online offering, so that if you are an SME that frankly does not know its NCSC from its NCA, there is a portal that lets you navigate the Whitehall system. In that sense, we are working directly with the Retail Sector Council, but we are also actively working to improve the online offering so that an SME without even the capabilities of a Co-op or a Marks & Spencer will know who to turn to in those circumstances.

May I add something about the economic security advisory service? Having spoken to businesses, we are looking at the information at the point of need of the business.

What do you mean by that?

I mean that there is absolutely no point in just putting lots and lots of different websites up that specifically say “economic security”, because businesses are not looking for that, as the Minister said. What we are doing is embedding that within the business growth service, so that any time a business is looking to export or invest, as well as seeing a host of information that will help it to grow, it will also have the links needed for economic security issues. At the point at which it is looking to make those changes, that information will be there.

Is there an acceptance that historically, because that service has not been there, engagement has been pretty thin on the ground, and that this is the first attempt to really take a step forward?

As well as publishing the trade strategy, in which we have announced the economic security advisory service, my friend and colleague Gareth Thomas is due to publish a small businesses strategy, which will look at the need for growth among the small business sector in the UK. If you like, we are aligning and brigading together the offering for the SMEs with the insight that, frankly, if you have a secret garden marked “economic security”, the chances of an SME finding it are very low. It is not a “build it and they will come” scenario. We are saying, “Where in an online offering would an SME be likely to seek support, guidance and advice from Government? How do we embed a capability there to support them in relation to cyber?” My sense is that that has not been the approach. Chair, you mentioned the FBI. We have just published the trade strategy. One of my lead officials was in the private sector, in EY, before coming to the Department for Business and Trade to write that trade strategy. She repeatedly told me and other officials that when she was in the private sector, she strongly advised clients to use the Australian Government website, because it was so much better at navigating post-Brexit trade than the British Government website. We are constantly open to how we can improve the online offering, not just for export support more generally, but, exactly as you describe, to make sure that we are where businesses are looking for advice on cyber-capability.

I would argue that that journey is never going to end. The NCSC has some fantastic capability on its website, but it knows that people are not accessing it. Small businesses are not accessing it and, with the best will in the world, many will not necessarily be exporting or even going on the growth website. Robust engagement is needed.

That is very fair.

Yes. This is what we are really driving at: at the top of the session, you described a terrifying evolution of the threat that we now confront, but you have told us that there is not really a substantial case for reorganising the way Whitehall works. When it comes to mobilising a whole-of-society approach, we have a website and a bit of a business growth service. We are just trying to understand how this mobilisation of the whole of society is going to unfold over the next year or two, given the terrifying analysis that you started with.

Sorry to interrupt, but is that a crisis moment or a chronic risk?

That is not my phrase; it is your phrase. It is in the national security strategy. It is written right the way through the national security strategy.

Presumably it will be a similar approach when it comes to de-risking critical supply chains and critical minerals—or will that require a different kind of approach?

I want to go back to the point about small businesses. Most of those businesses do not know what they do not know, and they are too busy trying to stay on a plateau, let alone grow in the current environment. I want to hear a much more proactive strategy for getting through to all those businesses, whether that is through trade bodies or active engagement in conferences. Just expecting, because you have put the messaging out there, that they will have time and headspace to pick it up is not realistic.

I might have a go at answering your question, because I can relate to exactly what you describe, having founded my own business in 2015 and run it until July last year. The challenges for founders and for people running businesses are legion. Quite often, cyber-security can be one of the areas that falls by the wayside. First, it is worth recognising that this is as much a human as a technological challenge. Many of the vulnerabilities that SMEs encounter are actually, dare I say it, about human error such as failure to remember passwords. Human error is a key component, so it is about culture as well as systems. It is not coincidental that we launched the trade strategy, in which we talk about the economic security advisory service, at the British Chambers of Commerce’s annual conference. One thing that we did at great length was to listen and talk to businesses about who they most trusted to give them the advice that they need, whether that is in relation to straight exporting or whether it is in relation to the resilience capability of their own business. Ideologically I do not agree, but Ronald Reagan famously said that the most terrifying words in the English language were “I’m from the Government, and I’m here to help.” We heard a version of that from many businesses: they said, “The people we most trust are other businesses that have made the equivalent journey.” We are working very closely with the British Chambers of Commerce, local chambers and others to figure out how we can better share the learning within Government about the trade strategy more broadly, of which economic security is a central part. As I say, we literally launched it at the BCC conference. Shevaun, the director general, was generous and gracious in her comments: she said that there has been a genuine recognition that Government cannot solve every problem but it can be indispensable, for example, as the central repository of information in relation to cyber-security. It is a transmission challenge about where people can show up who are credible, can be listened to and can affect cultural and behavioural change within organisations in which people are just running to stand still every day.

Yes. With the challenge of private ownership of what is ultimately public risk, we have to make sure we have the mechanisms for joint working absolutely right.

In the words of the Defence Committee in 2021, “China is well known to engage in large scale intellectual property theft.” The National Cyber Security Centre has also issued specific warnings about China’s state-sponsored cyber-activity targeting CNI networks. Given the lack of information about the China audit—it has not been published—how should we get UK businesses to assess potential risks linked to China? How can that information be disseminated down?

How can we speak to businesses so that they can assess potential risks that might be coming through? There may be a supply chain that has gone from China to the UK, but it might be feeding into our UK procurement.

You will know that the Committee has been very interested in hearing from businesses about how they access capital and how they are going to finance their ability to grow, and some of the challenges. We have also heard some really interesting evidence from the Boston Consulting Group about which sectors are potentially going to need how much capital to meet the scale of growth that the Government require. For example, in renewables, we might need £255 billion of capital to help us get to where we want to; in the commercial-industrial area, it might be £207 billion; and in water, it could be £83 billion. The money has to come from somewhere. We know that is a challenge, and we are talking a lot about pensions being one potential solution, but one of the worries is when this potentially comes from abroad. Thinking about the National Security and Investment Act, how do we scrutinise where that money is coming from in those critical sectors like digital, where we do not necessarily want to end up with another Huawei situation? Have the Government taken a position on how you are going to manage the decisions on what capital we accept and what we do not?

Do we think that the regime is going to catch things at the right stage? Obviously, this was something that went through and then got withdrawn, at great expense and interruption to infrastructure development. Do we think that we have got that right now?

It is not just that, though. Article 7 of the Chinese national security law that was passed in 2017 requires any Chinese company to co-operate with the security services of China, as you know. We are now in the position of having to welcome up to a quarter of a trillion pounds-worth of investment in, say, the renewables system. It is not very clear to Parliament how judgments are made on companies such as Mingyang and their participation in offshore wind farms. I do not want you to comment on Mingyang, and you would not in public, but right now there is no clear way for Parliament to assure itself that we are not making another Huawei-like error that may entail us having to rip this infrastructure out in the future.

Let me try to answer directly. First, on the point Pat made, we recognise that we need to be attractive to globally mobile capital if we are going to see the level of investment that we need. At the international investment summit in the autumn, I chaired a panel with Q, now C designate, at MI6. That is evidence of the fact that, even in the international investor community, there is a growing recognition that economic security is the foundation of not only national security, but national prosperity. All businesses and investors at that scale are as literate and aware of these issues as Government now are. In that sense, there is nothing to hide in terms of the NSIA regime. I have to say, as I know that this is a matter of real concern for the Committee, that I was struck by the frequency with which the witnesses you have questioned in the course of this inquiry said that the NSIA regime is relatively quick, albeit relatively young, and that it has not had a chilling effect on international investment. However, we are constantly looking at it. As part of the industrial strategy, there will be a 12-week public consultation on updating the definition of the 17 sensitive areas defined across the economy. That is an opportunity for not just this Committee, but businesses themselves and others to comment on whether we are striking the right balance in the NSIA regime between ensuring that we continue to attract the level of investment that we want—which is on a huge scale, as you say, Chair—and having the appropriate protections in place. We are mindful of the examples of the difficulties when economic coercion has been exercised in other places, and indeed of the historical Huawei example, which is why we are we are having a public consultation on the 17 sensitive areas.

When does that start?

Almost immediately.

On the process involved in that, over the last 10 months we have experienced things like point No. 17 in our weekly pack being, “Company B is blocked from buying company C”, or whatever it might be. That may be interesting, but our job here is to scrutinise DBT. We have absolutely no way of doing that with the information we are provided, because we are not provided with any information apart from company A and company B’s names. It would be helpful if DBT in the next 30 days proposed to us a process that meant that we can actually do our job. At the moment we feel—I think I can speak for all or most of us, and we have certainly discussed it, but who knows—that we are unable to scrutinise anything because we are not provided with any information.

This is the unhappy information sharing protocol that we discussed.

The Japanese have come pretty close. They said in their national security strategy that they want a degree of independence from China, for example.

This is why our question about sovereign capability is so important. If, for example, there is a militarised situation with China—not a war—whereby we are suddenly vulnerable to economic coercion and we have a lot of Chinese kit in our renewable energy infrastructure, all of a sudden we may need to diversify our suppliers. If we do not have that sovereign capability onshore, that could leave us vulnerable in a way that we do not wish for. That is why we will be all ears as you evolve your thinking on sovereign capabilities.

No, I think you are right. We would love to see the patterns too, but the information sharing protocol that we have does not allow us to see that.

I take your logic that there has to be a system, and the security makes it harder to do that. Certainly from my point of view, it does not necessarily have to be this Committee that is doing it, but I am advocating a check and a balance on the Ministry making the decision. Whether it is Matt and his colleagues at the Joint Committee on the National Security Strategy or somebody else—I do not really have a strong view of who it should be—there should be a check and a balance.

Do you at least accept the point that there should be a check and a balance on the decision made by Government, and that we should work towards putting an effective check and balance in place?

Fine. That is a question we shall return to, I think, in subsequent hearings.

Pat McFadden—a slight shift of tack—how does the Government prepare for possible combined attacks, such as a physical attack and a cyber-attack, against critical infrastructure or critical sectors of the economy?

We were very interested, in particular, to read about the national exercises that have been proposed in the national security strategy.

It was done a couple of years ago, wasn’t it?

Going back to the original question, has the Government already prepared for possible combined attacks? You have given me several tests, none of which cover, for example, an attack on the pipeline in the North sea—which we may or may not have already seen—or a large cyber-attack. I did not hear in your answer anything that tells me that we have preparation for that.

Are you confident that the national risk register covers our economic security sufficiently?

No, I do not want a list. I am asking you about your confidence in the ability of the Government.

That was not strictly the question, to be clear. It was about preparation.

Similarly, I have attended those exercises, so it is not unique to CDL. We have tabletop exercises in Cobra, as well as elsewhere, to make sure that different parts of Government are prepared. In that case, I was speaking on behalf of DBT.

Building on this landscape of a potential cyber-attack, or whatever we might want to deem it, we have heard some quite interesting information about Pool Re. Obviously, that originally started to cover terrorism from the IRA in the ‘90s, but it still exists. There is about £13 billion sat in a pot of money to cover an eventuality that many are now saying is probably far less likely and therefore we may need to turn our view to the likelihood of cyber-attacks and their devastating impacts. Also, a lot of insurers will not insure businesses for state terror or infrastructure failure. Have there been any thoughts or discussions about repurposing that money or having a similar pool that would cover business for that eventuality? We have seen cyber-attacks on M&S and the Co-op. If that had been happened to all the food providers, would we potentially have declared that to be an infrastructure failure? What would the Government then do, and how would the insurance market behave? Has any thought been given to the likelihood of where we might be heading with these types of attacks, and how the Government might be preparing?

The national security strategy talks about us collaborating with a number of our allies, including NATO. What lessons do you think we have learned from other attacks that have happened in other countries, and what sort of co-ordination are we doing with our allies?

I would add trade defence thinking as well as defence thinking. If one looks back to the trade restrictions implemented against Australian exports back in 2020, in the light of the request for a covid inquiry, we worked very closely with the Australians, whether through established Five Eyes processes, or through the CPTPP subgroup on economic coercion, and a lot of our thinking is shaped by and informed by the experiences of other friends and allies in similar circumstances. From the hard end of security, where the move on the battlefield from a small number of very large platforms to a very large number of small platforms has been one of the biggest learnings of Ukraine, to the more trade-defined aspects of economic coercion, we are in constant dialogue with our partners, whether through the G7, as Jonathan has experienced himself, through CPTPP, or through other forums, including Five Eyes.

Just to add to that, the Minister mentioned the G7, which has been our primary forum for co-ordinating with like-minded countries, but I would add Australia on to that as a country that would go into that group.

Some of those allies are not quite as like-minded as they used to be.

Back to what we were saying at the beginning, this is a thing that has moved really fast. When the UK chaired the G7 in 2021, we proposed putting economic security as a dedicated thing on the agenda, and that was seen as a novel thing. Three or four years later, when the Japanese chaired the G7, it was the centrepiece of their agenda. I think that just gives you a sense of how quickly the agenda there has moved. We have used that partly just to think hard about how we manage that interface between economics and security. We have used it to try and develop—or at least compare notes as we have developed—our toolkit. For example, most other countries have done something similar to the legislation that we have done on investment, procurement, and changes to export controls over the last few years as well. We have ended up with slightly different regimes, because we are all different countries and have our own circumstances, but we have done a lot of learning on all of that. The other thing that has happened in parallel is that we have had a series of more bilateral economic security dialogues—Philippa mentioned one of them—with Australia, Canada, Japan and Korea, and now reflected in the agreements with the EU and the US as well. We use those bilateral ones too. I would just emphasise what the CDL said on the war in Ukraine in that respect: a lot of what we have talked about here is basically chronic, which goes back to my point earlier, but the war in Ukraine was obviously an acute crisis where we took very significant steps on the sanctions side—the economic statecraft side. The co-ordination that we did in the G7 there has set the tone for what we have done subsequently in a more steady state sense. I hope that is helpful to give you a sense of how we have done that.

That is very helpful. We are almost out of time, but I think one of my reflections on today’s session is that you have given us a pretty arresting picture of the new dangers in the world. There is a really clear and developed strategy around the way that we work in lockstep with allies, and there was a pretty confident portrait of the way that Whitehall pulls together. On page 5 of the national security strategy, however, it says that the “animating idea” of the strategy is to “mobilise every element of society towards a collective national effort.” It just feels as though the partnership between public and private might need to work at a slightly different level and a slightly different tempo if we are to actually deliver on the ambition of that. Would you acknowledge that? Do you think, “Yes, indeed; the public private partnership is going to look pretty different in five years’ time,” given this animating idea that you are trying to deliver?

Douglas, I think you are saying that we have at least the bones of the institutions that we need to broker and convene that kind of conversation in our country.

Yes, I will just build on what Pat said. When I served in the Cabinet Office under a previous Government, I was responsible for the Civil Contingencies Act passing through Parliament. That reflected the need for resilience in the light of the threat at the time: essentially, post 9/11, a realisation that our level of resilience and physical protection across and around Whitehall was deficient, and about the need to build resilience capability far beyond Whitehall. In that sense, there is a dynamic between the external threat and the agency and impetus of both Government and the private sector. As surely as now, more than 20 years ago we acted in relation to the challenge of resilience post 9/11. For all the reasons you have described, in terms of the national security strategy and the national risk register, and the growing sense of us living in a more protectionist, isolationist and geopolitically contested world than many of us anticipated even a few years ago, there is now a wind at our back in making that case. I recognise that we have further work to do. Without being overly partisan, I also observe that the last 10 years have not been a shining example of the effectiveness of the British state in every domain given the degree of churn and change in our politics. At some level, one of the strategic assets that this Government bring to that responsibility of building a relationship with the private sector is stability and continuity of leadership. We have got out of the habit of having Ministers broadly pointing in the same direction and developing industrial or trade strategies—we did not have a trade strategy in the last eight or nine years. In that sense, it is much easier to have that engagement with the private sector and with the public when the defining challenge of the Government stays stable during those years. In that sense, the fact that the Government have a growth mission, and the public has set our homework for us over the next four years, is a support and assistance to us in rising to exactly the challenge that you identify. That does not guarantee that we will be successful, but it certainly helps compared with the cavalcade of chaos that we have seen in British politics in recent years.

We shall conclude on that note because our time is up. Thank you very much indeed, Pat and Douglas, and Philippa and Jonathan, for an extremely illuminating—if alarming—evidence session. We shall supply our recommendations to you as a Sub-Committee in September. That concludes this session.