UK government seeks powers to secretly block risky tech suppliers

The British government is seeking new powers that would allow it to ban technology vendors on national security grounds from supplying companies working in the country’s critical sectors — and to potentially do so in secret without publicly identifying the supplier concerned and barring the company from discussing the instruction.

The proposals, published Monday in amendments to the Cyber Security and Resilience Bill, adapt powers previously used to restrict Huawei equipment in Britain’s 5G networks, while removing some of the transparency safeguards built into that regime. 

Unlike the telecoms law, ministers would not have to publicly designate a vendor as a security risk before taking action against it, and there would be no duty to send the vendor a copy of the order. The powers would also reach beyond telecoms into managed service providers, data centers and digital infrastructure, as well as the energy, water, transport and health sectors.

A senior minister would be able to order companies in those sectors to stop buying from a particular supplier, restrict the use of that vendor’s products or services, or modify, disable or remove equipment already installed.

Liz Lloyd, the recently reappointed cybersecurity minister, said the new powers “mean we can act before a threat materialises, not just after the damage is done,” adding that by “working together with industry, we're putting national security at the heart of how essential services choose their suppliers.”

Ministers would have to publish a notice that a direction had been issued but only the company receiving it would have to be named, not the vendor concerned. Details could be withheld on national security or commercial grounds, and the recipient could be barred from discussing the order publicly. Anyone consulted before a direction was issued could also be barred from revealing that the consultation had taken place.

The draft bill leaves room for the government to make a direction public where it judges that doing so is in the national interest. Security officials have pushed for greater transparency in other contentious cases — including Apple’s attempts to introduce end-to-end encryption for iCloud — where similar secret powers have been described as unsustainable and unjustifiable.

Spying and sabotage

The British government said the new powers would let it intervene when essential service providers planned to purchase equipment “from suppliers that could pose a critical national security risk, particularly where they have ties to hostile states who may seek to use products to spy, sabotage systems or cause disruption."

Called a “vendor-related direction” under the amendments, the new power closely follows a similar legal mechanism used to force Huawei equipment out of British 5G networks under the Telecommunications (Security) Act 2021.

Both laws allow ministers to intervene on national security grounds, but while ministers would normally have to give both the company affected and the supplier a chance to respond before issuing an order, that process can be sidestepped under the new proposals on national security grounds.

The amendments add a publication duty the telecoms act lacks. The government would be required to announce publicly that an order had been issued and who it was issued to, although that notice would not necessarily identify the vendor and ministers could withhold details on national security or commercial grounds.

A water company, hospital provider or data center operator could therefore be publicly identified as having received a government direction without the public necessarily knowing which vendor it had been ordered to stop using.

The government would report annually to Parliament on the number of directions issued, the sectors affected and how many had later been varied or revoked.

The powers would not be confined to companies in the critical sectors being regulated. Ministers could specify, through regulations, any person they consider is engaged in essential activity in the U.K. or provides essential goods or services — drawing in companies not otherwise covered by the legislation.

A company given a direction would need written government approval before appointing an outside specialist to help it comply with the order. In deciding whether to approve, ministers could rely on a list of specialists published by GCHQ.

The amendments will be considered at committee stage in the House of Lords in September.