Welcome to the second panel in today’s hearing on economic security. We are going to look now at threats to the UK’s critical supply chains. Kevin Craven, I will start with you. From your point of view, how should Parliament think about critical supply chains? Is there a definition that we should have in mind? What ideas would you specify?

Good afternoon, Chair. The first point to make is that in my sectors particularly, these are global, highly complex, interconnected supply chains, by design. Recently, we have had tariff challenges. We have had tariff-free access to aircraft parts since 1979, which means that over the last 40 years, the supply chains have grown ever more dependent, interdependent and interconnected. The supply chains are deeply complex, and also quite opaque because of the commercial sensitivity of the transactions. Most of the larger suppliers in our sectors look for dual sourcing or multi-sourcing of components and parts, so sourcing and obtaining components and parts and raw materials is sensitive. There is a lack of knowledge of those supply chains, which makes it very difficult.

But what is the difference between a supply chain and a critical supply chain?

That is a good question. The critical supply chains are those that would prevent the majority of your business being carried out. For example, in aerospace, it might be the supply of titanium, and in shipbuilding, steel. Most of the greatest complexity lies in those component parts where there are sub-assemblies made into assemblies, interchanges across oceans multiple times, and then into final assembly.

I do not know if you think about the number of supply chains that are at stake in your industry, but it would be good to get a sense of what fraction of the supply chains that you work with you would define as critical supply chains. Is it all of them? Is it a fraction of them? How do you think about that?

That is a very difficult question to answer. Broadly, if you are a prime in the UK in defence, for example, there are around 6,000 or 7,000 smaller contractors in the supply chain, many of whom source from abroad. In terms of defining the percentage, you would probably have to go to the raw material elements of that, which is again is slightly complicated by the fact that most of our industries take semi-finished materials like alloys that are required for assembly, rather than the pure critical minerals. By tonnage of parts, I suggest that probably—it is a guess, but perhaps an educated one—over a third of those supply chains are critical.

Trevor Hutchings, how do you think about this question? What is a supply chain and what is a critical supply chain?

I head up the Renewable Energy Association. We look across the whole of the clean energy sector, which of course has a number of extended supply chains. One of the characteristics, as the Committee will know, is that, as we move from a fuel-intensive energy system to an essentially minerals-intensive one—towards solar panels, wind turbines and other technologies—we become reliant on extended supply chains. I was listening in to the previous hearing and, of course, China is a dominant player in a number of these technologies—whether in battery technology, solar panels or other component parts. There is certainly a concentration of those technologies in China and in other international supply chains.

Can I bring you back to the question? When you are thinking about supply chains in renewable energy, how do you determine which supply chains are critical and which are not?

I would say that is a critical supply chain, because without it there would undoubtedly be higher costs and potentially input constraints to the big hike we are having in solar, wind and other technologies. So I would say that one is critical, because it is concentrated in a few countries. The UK has benefited from China’s vast manufacturing capability in terms of lower prices and availability. The fact that we have 50% clean electricity today is partly because we have exploited those supply chains, but I do not think anyone feels particularly comfortable being over-reliant on a single critical supply chain, as you talked about. That is why we would very much like to see more diversity in the supply chains, as well as the home-grown ones that were mentioned in the previous panel. One area that has not been touched on enough is the circular economy. A lot of those supply chains bring critical materials into the country; once that material is here, we need to extract greater value from it, by retaining, recycling and reusing it. Over time, that will of course reduce our dependence on the sorts of critical supply chains we talked about. But it is different for other technologies too. The renewable energy space includes a number of technologies beyond wind and solar, and many of those are less reliant on some of those international supply chains.

Antony Walker, what is your view on the difference between a supply chain and a critical supply chain?

From a broader technology and digital sector perspective, supply chains become critical when you suddenly get scarcity. In recent years, we have seen that that can be difficult to predict, and there may be multiple causes. We saw issues emerge through the pandemic. There was discussion earlier about critical minerals and rare earth minerals, and it is interesting that rare earth minerals have become a bit more difficult to access from China recently, as a result of China’s response to US tariffs. The nature of the digital technology sector is that most of the sector’s value in the UK is at the services layer, but all of it is dependent upon a product layer. Those products have huge amounts of minerals incorporated into them, and most of the minerals are sourced in Asia, so you can see how a specific scarcity may emerge at any moment. The obvious area that has been a huge focus for Government is chips. I think a lot of lessons have been learned from the pandemic period, but it is difficult to see a solution where the UK ends up having its own supply of chips. We are going to be reliant on global markets, so we really have to take a strategic view on how the markets operate and on your strategic relationships with key countries that can meet your demand for those kinds of products. I think that is where we are seeing Government focus.

Henrik Pedersen, how do you think about this question?

I will go at it from a ports point of view. So far, critical supply chains have really been ranked in terms of products. Unfortunately, we had some experience of that through covid: so much of it was about ranking the products coming in and out of the ports—mainly in—where you had food and energy all the way over to non-essentials like hair gel. It is very much about prioritising what is important for the country at any given time in a crisis. That is how we see it from the point of view of ports. We are not the best placed to say whether it is rare earths or similar materials that are most critical for the supply chain. For us, it will always be about hand-in-glove co-ordination with Government asking: what is critical for the country at any given point in time?

There are four headline threats: risks to energy as critical national infrastructure; the cyber risk, which the Committee will be familiar with; reliance on concentrated supply chains in particular areas, per the previous question; and exposure of our energy infrastructure to the impacts of our changing climate and more severe and intense weather events, whether flooding, high winds or storm damage. We see the disruption that that already causes, and it will become even more prevalent. Finally, there is now the interdependence of the energy system and other parts of the economy, for example, telecommunications, where more of our energy system is reliant on telecommunications; smart metering is an obvious example. There are a number of threats. I believe an energy system that is moving towards renewable energy is fundamentally more secure than the system we had previously, because it will isolate us from international energy markets and the price volatility that we have seen through the energy crisis. It is a decentralised system with fewer points of failure, and it relies on uninterruptible sources—certainly uninterruptible by state actors—such as the sun and wind. It is inherently a more intricate energy system, but it is also inherently more secure overall. But we have to manage those risks that I talked about.

We certainly have a more complex system to manage going forward. The UK system, headed up by the National Energy System Operator, is a very robust system which has historically been hugely reliant. I do not think that the move to renewables is any way weakening that. In fact, it is actually strengthening our security because it is less reliant on any single point of failure. We have not fully got to the bottom of what happened in the Iberian peninsula. It is very easy to jump on the bandwagon too quickly and say that it is all because it is a heavily renewable-dominated system. We need to wait and see what the full inquiry says. I am confident that the way we manage the UK system means that the risk of that happening here is very low.

I am not so sure that the rapid progress towards renewable energy will make it that much more secure. If you go too fast, you inject other risks into the system. I am not sure the grid transformation and so on can actually keep up. If you go too fast too soon, you inject some other risks that we do not like to discuss. In any business scenario, there is a lot to be said for having resilience from a variety of sources. That is also true for our energy system today. Of course we should progress with the energy transition, but it should be an energy transition and not an energy cut-off, because if you do it too soon, the backbone is not there. That still means that you can buy energy from many places around the world. As a Government, you want to be sure of the countries you can rely on, and you do not want to put all your eggs in one basket. Maybe with other components you need to go to a single big country, but you actually do not need to do that with energy. This requires us to take a step back, I think. It is easy to talk about the energy transition and not think about the cost. We heard from the previous panel that one of the biggest issues with economic security in the nation today is the cost of energy, even compared with Europe. That will not go away. I heard the previous panel talk about how it will help if we give bigger subsidies, but that is a cop-out. It is just taking money from elsewhere in the system or from taxation. It is not the real solution. It is important to step back and look at energy from a much broader perspective. DESNZ’s own prediction is that we will never not use oil and gas. We have to remember that. It is called net zero—it is not a zero; it is a net zero. We still have resources out in the North sea today, which is our own, as much as the sun and the wind are. That is a different part of putting in resilience. I am from Denmark, and I have heard a lot of discussion about the Baltics, where they basically dig up the cables—both IT cables and power cables. Once you do that, you are cut off from the offshore wind farms. But if you take oil product, gas or green ammonia in by vessel, yes, you can blow one vessel out of the water, but the next vessel will come. That is a very different resilience. I think it needs to be looked at much more holistically.

Our emergency response plans, whether it is a bad state actor or not, look at how we operate the port without IT and power. Whether that is induced by an accident or unfriendly fire, we still need to do it. That is how we plan on a port level. Because we are an island nation, we will need the ports, but they are also important from a resilience point of view. It is the same point that I made on energy: we have many different ports around the country, so you can take out one port, but you will not be able to take out all of them. In the Netherlands, you have two ports. One of them is by far the biggest. Belgium has Bruges and Antwerp, but here, we have many big ports around all our coast. That actually gives some resilience, which is important for the UK.

The hostile state actor threats are threefold; it is not just cyber, it is physical intrusion, and then there is espionage and destruction as well. The defence sector in particular has a very complex and lengthy supply chain as we have discussed, and that provides a very large target area, so protection is difficult. One of the things that we do is work very closely with the agencies and authorities. I suspect that there could be better intelligence sharing between them, and greater collaboration with industry around those threats, to help to mitigate and prevent those sorts of attacks. There are other shocks to those supply chains and that critical infrastructure. We have talked about critical minerals. Disruptions such as the war in Ukraine and covid introduced huge shocks in the supply chain, which generally take somewhere in the region of 18 months to two years to work through and source alternative supply chains or restore existing ones. Again, there is also some thought to be given to how to build stockpiles or alternate sources of supply.

It is pretty good at the large company end. I would suggest that the SMEs struggle day to day with doing business at the moment, and therefore some of these threats are perhaps less of a priority for them.

I want to build on the challenges around supply chains. I will ask the whole panel to comment on this. We know that supply chains are vulnerable. How do you monitor the situation across that? Does that sit with your board, or with some person within the company who has that responsibility? How do you manage the monitoring process around the risk to supply chains?

Risk management generally covers the typical threats that we would see in this business. They would generally report in to the board, and the board would monitor those on a monthly basis. You would normally see the top 10 risks published on an annual basis. In my experience, those risk-mitigation plans are studied pretty closely. As you go down the chain from the listed to the very small and medium-sized enterprises, that requirement probably devolves to an individual within an organisation who is probably doing risk management on the side of a day job. The efficacy of that is challenging. There is help—there are tools and support from the MOD and people like ourselves—but more could probably be done around that.

Potentially, defence is naturally slightly more alive to that type of risk. Trevor, what do you think about the monitoring success?

As a number of operators in the energy space are operators of critical national infrastructure, they are obliged, through a number of regulations and the forthcoming strengthening of regulations—particularly in terms of cyber-security—to have a pretty comprehensive regime in place to understand the risks and are taking regular contact and guidance from Government and the National Cyber Security Centre. There is training, reporting and threat intelligence sharing. There is quite a comprehensive regime in place at the moment. Again, that is largely the bigger players within the energy system. With the heightened awareness and potentially heightened risk with the geopolitical situation, more needs to be done in that area around sharing, reporting and making sure that the Government are secure, and the National Energy System Operator is reassured that the companies in the supply chain are following the rules, and there is compliance with that. I do not think it is an area that we can in any way become complacent on.

Similarly, I think larger players have a very sophisticated view of what their supply chains look like, but then as you get down to smaller companies, they probably have less of a forward view. Particularly in terms of the CNI designated operators, I think that risk-assessment basis is pretty strong.

In terms of the supply chain and support, part of this goes back to the emergency response that I mentioned; from a risk and compliance officer to the executive board up to our board of directors and audit committee. Because we operate three critical national infrastructures within the company, we are also audited every year by the Department for Transport, which I actually think works quite well. I will also say that you do sense that every year they step up their requirements, just as we as a company have to step up our requirements every year, because it does become more difficult.

Do you think that the Government could be playing any more of a role in this area? Obviously, I am sure they could be providing certain amounts of support within the supply chains, as you mentioned, but is there anything in particular that you could cite that the Government could do more of in the light of that?

For me, it is probably a conversation to have with the National Cyber Security Centre—should they give advice, or should they mandate and thereby follow up? They give advice and send out advice, and we are quite alert to that. We follow their advice, and we actually try to do more than what is recommended, but I do not know if there are other companies that are less alert to this and hope that they can avoid the cost and inconvenience of doing it. That is something that will be pretty important in terms of what the country wants. Is it guidance, or this now so critical—from everything you see behind closed doors—that you want to mandate it more to companies? As the panel has alluded to, the bigger companies will probably already be a little further ahead, but they will probably also still have more financial capacity to do it. For small and medium-sized companies, if you mandate more, we need to make sure that we do not take them out of out of business and out of a competitive situation.

Did anybody else want to add anything to that before I move on?

Yes, in a couple of areas. On this point about encouraging the circular economy to reduce our reliance on extended supply chains and the home-grown industrial strategy, in energy we have a sustainable industry bonus at the moment, which is part of the CfD support mechanism for technologies such as offshore wind. There is an additional payment if you can have more of your supply chain in the UK. That payment could be a mechanism that could be expanded to other technologies within the energy sector, so that is a really concrete example. The one area I would say that we are falling behind on—where the Government need to do more—is the climate adaptation planning on the energy system, reducing our exposure to severe weather events. The Climate Change Committee was recently quite critical on the lack of progress in that area.

I was just going to add that this question touches on a number of Government Departments, and cross-departmental collaboration is always challenging. I would recommend, certainly at an economic security level, that a co-ordinating body located either in DBT or the Cabinet Office would be sensible. It could also then, perhaps, provide better interface with industry.

I would agree with that. To broaden out a little from the supply chain risks to the wider economic security piece, we have the sense that we are operating in a far more complex and interdependent, but also more fragmented world. Not everybody has a complete view about what is happening across an ecosystem. That is true on the industry side, and it is also true across Governments. Ensuring that joined-up nature of co-ordination across Government, bringing together DBT, MOD, DSIT, the Treasury, the Foreign Office and so on to make sure you have that comprehensive view about what economic security really means from the level of supply chains to wider geopolitical risks, will be really important, as will ensuring we are able to be fleet of foot in a much more dynamic geopolitical environment.

Let me put another question that picks up on the point that you just made: we have heard very useful information from Boston Consulting Group, which has looked at the estimates for how much capital investment will be needed in various sectors—between £363 billion and £583 billion in additional capital to meet the growth needs. Obviously, we need to ask questions about where that capital is coming from. Their estimates are: £179 billion is the minimum that they expect for renewables, for example; in commercial industrial, it is £155 billion, which is their minimum level; and digital, £65 billion. If that investment is coming from foreign companies, where do you think that we need to be concerned, and why?

When we look at these economic security issues, we come from the position that the UK needs to be—has always been, and must remain—one of the most open economies in the world. That was our starting point and our real strength. But we also need to be one of the most secure. If we are going to be open, we need to be really thoughtful about how to make sure that we have that economic security approach. To be open, we have to be open to foreign investments. That will be absolutely critical, for all the reasons that you have just set out. That is therefore where it comes back to having a strategic view of which countries you want to partner with, recognising that you might seek to attract investment from parts of the world where values could be different. You might have to take a view on where in some parts of the world you are willing to accept investment from, and where not. The key thing is having that joined-up view, and I think that comes back to—

Is there a joined-up view across Government?

I think it is evolving.

That sounds like, “No, not yet.”

I think there has been a lot more progress towards building it over the past couple of years, so I would not say that nothing is happening, but we are still coming to the point of building that view. Developments over recent weeks, with the trade agreements with the US, the European Union and India, and so on, are all good examples of the Government thinking, “Okay, who can we co-operate with around the world on a really dependable basis?” That is also why industrial strategy is so important. We heard about the example of China, where it is very clear that its industrial strategy is also an economic security and national security strategy all in one. We have to make sure that these aspects of economic security are really built into our international trade strategy and our industrial strategy, so that they are all joined up and linked.

Henrik, do you want to comment?

I will build on what Antony said about attracting foreign direct investment. We do not have the fiscal firepower that they have in the US and the EU, and I do not think that we need it. What we need is to start to execute on the fundamentals. What I mean is: we need to get the regulation and planning regime much more fit for purpose. We need to see that as a competitive tool to attract inward investment to the country. We cannot give grants to everyone who wants to come in and set up shop, so we need to make it much easier, much more predictable and much more timely to invest. I hear a lot about regulation and planning, but that does not filter into hard actions on the ground. You might have a policy statement, but that does not mean that planning is moving faster on the ground. Of all the countries that I have done infrastructure projects in, those are really difficult here, and I think that we need to put some focus on it. The good thing about regulation, including planning, is that it does not cost a lot. It is capital-light to change; it is just hard, hard work, and you will need to disappoint some groups in society, but that is what leadership is about. You then need to have certainty of projects for the inward investors. You cannot tell them to come to build a factory here that will last for a further 20 or 30 years if you only promise them work, or a commercial outlook, for three or four years. That will not work. You need to have that long-term certainty for projects. The last one is the trade agreements with the EU and the US. What we need to do now is implement the new EU trade agreement that came up, but also, already, we need to be asking ourselves, “What comes after this?” because from a pure trading point of view, it is far from what it was like being inside. There is more work to be done, but that needs to be started in parallel. It is the same with the US trade agreement. It is very, very good compared with 2 April. It is really not good compared with 1 April. We need to get it implemented, but there need to be other teams working on what comes next. If we fix those fundamentals, we have ample potential to attract billions in foreign investment from the right companies and the right states into the country, but if you do not fix the fundamentals, you will not be able to change it.

To build on much of what has been said, we are not going to get this clean energy transition done without huge amounts of capital investment, much of which will be foreign. There is an obligation on the Government to be really clear what the strategic priorities are, and what the risk is, and to make this a really attractive place to invest, so that we are diversifying and spreading that risk across different investor types, different countries and different nations, while having a regime and framework in place, as there is today, to be able to halt or call in particular projects where the threshold has been exceeded. It has to be the Government who set that threshold.

Can I just check, though: is it clear enough whether we should be taking significant investment from China into the renewable energy infrastructure?

I think my members are satisfied with the current regime, but I do not think that it is clear enough what an acceptable level of investment is in a particular subsector, particular technology, or any particular industry. That is an area where I would prefer to see more clarity from the Government on assessing the risk, and then setting out what the acceptable thresholds are.

Do your members have a view about the wisdom of taking significant Chinese investment into the renewable infrastructure?

I think there are mixed views on that. I do not think that there is a single view; it is about what does it look like strategically, and whether we are taking on the potential for foreign interference. It comes down to how much in what particular subsector, what leverage is there, and what risk is there. As I say, I think the Government have a role in establishing what threshold is acceptable.

At the moment, that strategic take from the Government perhaps is not there.

It is not clear enough.

Briefly, access to capital for the small and medium-sized enterprises in our sectors is very difficult anyway, and given the current challenges of operating businesses, that is hard. From a national economic resilience point of view, particularly in defence, the MOD is already thinking about how the open nature of our marketplace needs to be translated into a requirement that onshore British factories, British jobs and British IP are used in supplying to the MOD, which is a good thing.

The challenge is that we have a situation in our country today where you have substantial private management of public risk. Everybody agrees that the risk levels are going up. We do not have a clear definition of threat from the Government. We do not have a clear definition of economic security. We do not have the Secretary of State for Business and Trade on the National Security Council. It feels as if we need to take a total defence approach to economic security, which means that the public sector and the private sector probably have to work much more closely together in the future. I am not sure we have a forum for that, but we do have an industrial strategy council coming soon. Do you think that we need a space where the public sector and the private sector are thinking about risk scenarios—wargaming together—and is the creation of the industrial strategy council an opportunity to build that forum?

I absolutely agree with you that we need such a forum. My understanding of the industrial strategy council is that it is very much focused on horizontal themes across the growth sectors that have been identified in places like skills. Threats to our economic security could be one of those themes; that would probably require some sort of official department or resource as a co-ordinating body to enact that thinking and work. But certainly, greater collaboration with industry in which a large number of experts were in this space would be a very good thing.

Mr Hutchings?

We already enjoy a really close public-private partnership in the energy sector, with regulated industries providing much of our infrastructure today, so there is a basis on which to build. But I agree with the sentiment: there is more to be done in ensuring joined-up government and joined-up thinking on the threats that we face.

Mr Walker?

I am not sure that the Industrial Strategy Advisory Council is the right mechanism, partly because it has lots of other things to do that are also really important. You might have to have a sectoral level as well. One of the things that we have suggested is that there should be an international technology taskforce that would keep bits of Government together with security agencies to co-ordinate around industrial strategy, trade policy and economic security issues, to triangulate at that level. There is a commonality but there are also specific differences between everybody on this panel today; my sense is that to get to a meaningful level, you will probably have to have something at a sectoral level as well for core sectors.

Is that new space needed or not needed?

It is absolutely needed. You have to start to bring these elements together and recognise that the risks we face are so multifaceted that the only we way we can try to be responsive is if we are really joined up across the public and private sectors, and if we have the international as well as the domestic dimension.

Henrik Pedersen, what is your view? You have already talked about an existing close relationship with the DFT.

I am a member of the Industrial Strategy Advisory Council and I do not think it is the right forum for what you are suggesting here. We have seen some green shoots in terms of co-operation: right now we are operating for the armed forces—the MOD, the Army—down in Marchwood military port. That was the first port where we operated for the Army, but only a couple of months ago we and the Army announced a framework agreement, so now the Army has access to 21 ports in the north, south, east and west of the country. That, of course, will lower their logistics costs so that they can spend the money on other things. That also means more resilience should one port be taken out. There is plenty of room for public-private partnerships that actually work. The Army are very supportive of how we service them and we are very supportive and proud of serving them. There is another thing, which I have brought up on the Industrial Strategy Advisory Council, that goes a little bit hand in hand with this and I will mention it here. We need to be much more assertive as a country about what business we want to bring into the country, not only on the renewable energy path, but across that. What home-grown companies do we want to support? If you look at the WTO rules, you see that the US, China, Germany and France are members, but they seem to interpret the rules very differently from us. We are playing according to the same rules, but they always favour their companies and home-grown industries. I have lived here for only seven years, but I do not understand why we do not do that in this country—it is a huge opportunity to be more resilient and to create economic growth here. Again, as with regulation and planning, it is not that sexy for the lawyers to go through the WTO rules. But as a layman standing on the side, I do not see us playing according to the same rules as those other countries and I think we are losing out.

That is very helpful. I have to say that, after 21 years in the House of Commons, I do not understand the answer to that question either. We are about to conclude this panel, but you have a question, Mr Maynard.

Mr Pedersen, five port operators control those 120 ports, give or take. Is there any bigger risk of a co-ordinated IT attack on all five at once?

No. To the best of my knowledge, I do not see all five port groups being taken out at the same time. I do not think we are on the same network, and we are not on the same software. I actually think that this is where the UK is more resilient than some other countries with bigger ports and bigger proportions of cargo. That, of course, helps with unit costs, but, from a resilience point of view, from what I know, I would imagine that this country would be quite resilient in the scenario you mentioned.

Is there anything worse than that on your radar screen? Apart from an IT attack on all five at once, what is at the top of your risk list?

The top—except for staff safety—is loss of power and loss of IT. That is what we always try to go through. I think those are worse than some of the climate change risks, which we are also addressing, of course, but are a little bit more long term than that.

Thank you so much for being candid and clear with us. That has been incredibly helpful. That concludes this panel.