Peers have questioned why the UK’s Cyber Security and Resilience Bill does not allow regulators to penalize senior executives when an organization’s failure to comply involves their consent, connivance, or deliberate or careless neglect.

Echoing arguments heard across the industry for years, Baronesses Kidron and Ludford backed probing amendments that would introduce personal civil liability for senior execs and make cybersecurity a board-level responsibility.

“The intention behind the amendment is to change the culture of an organization, to ensure preventative action is taken, to avoid penalties,” said Baroness Kidron. “As I said at the outset, culture change starts at the top.”

The Register has previously reported on calls for NHS organizations, some of which would be covered by the bill’s reforms, to treat cybersecurity as a board-level priority.

More recently, 60 organizations committed to the aims of the UK government’s Cyber Resilience Pledge, promising to ensure their boards take responsibility for their organization’s cybersecurity.

Peers supporting the amendments pointed to financial sector rules introduced over the past decade that can impose regulatory or criminal liability on the C-suite for serious failings.

They argued that the amendments would bring the bill closer to the EU’s NIS2 directive, which includes senior management accountability measures. Personal liability is not mandatory under NIS2, however, and member states have implemented it differently.

Supporting the personal liability proposal, Lord Clement-Jones said: “If an individual is fit to draw a multimillion-pound executive salary running a critical national provider, they must be prepared to carry personal responsibility for securing it.”

Despite support from several peers, the government defended its existing plan to impose substantial maximum fines and introduce security, resilience, and governance requirements through secondary legislation.

“It is absolutely right that organizations, especially those delivering our essential services, are held properly accountable for their activities,” said cybersecurity minister Baroness Lloyd of Effra, who did not support the personal liability amendment.

She cited the maximum fines of £17 million or 4 percent of the offending organization’s annual turnover, whichever is higher, calling it “a meaningful enforcement regime.”

Baroness Lloyd said the forthcoming security and resilience requirements would mandate board-level governance in line with the NCSC’s Cyber Assessment Framework. The government has yet to consult on the details.

“That will cover issues such as organisational capability, senior responsibility, and accountability for security and resilience and effective risk escalation, and it is in that way that we will connect the clarity on what is expected of boards with the accountability through the enforcement regime.”

Reporting requirements and other matters

Separately, peers quizzed the government on the structure of the bill’s strict reporting requirements, warning that the current wording threatens to overwhelm regulators with an administrative burden.

One of the CSR bill’s primary objectives is to collect more data about the threats facing UK organizations by imposing stricter reporting requirements on in-scope entities. 

The bill requires regulated organizations to issue an initial notification within 24 hours and a fuller report within 72 hours. It defines an incident as an event that has, or is capable of having, an adverse effect on an operation.

Former security minister Baroness Neville-Jones suggested changing the wording from “capable of” to “likely to have,” to reduce the reporting burden on regulated organizations.

Lord Clement-Jones agreed, warning that the current wording would “unleash an administrative tsunami of defensive reporting.”

He also argued that the government’s definition of a data compromise was overly broad and “dramatically expanding the notification net to include technical data anomalies that cause zero disruption or loss to actual customers.”

He said the reporting rules and broad definition of compromise could leave responsible operators of essential services spending more time on paperwork than improving their defenses.

The government was unmoved, and Baroness Lloyd said that the more stringent reports were crucial in achieving the aims of the bill, which seeks to update the existing NIS Regulations 2018.

While some peers were looking to ease the burden of reporting, others sought to increase it in other areas.

Baroness Harding, who is uniquely placed to weigh in on cyberattack response, proposed a 14-day intermediate report and a final report due one month after the attack first occurred.

Drawing on her experience as the former TalkTalk CEO, she said that after 72 hours, attacked organizations start to get “real data,” but “it’s really only after a couple of weeks that you’ve got a proper sense of what has happened.”

The final report comes at the one-month mark, when “the fog is starting to clear and you have a proper sense of the real scale of the problem,” she said.

Harding said that senior executives are typically told from all sides not to say anything about a cyberattack, but this only serves the criminals, who meanwhile may be attacking other victims.

“If you share this information in the fog with regulators and with law enforcement agencies, that’s how the law can prevail,” she said.

“It’s how regulators can work out what’s happening, it’s how they can warn others who might be affected, and it’s how the law enforcement agencies can do their work to actually try and find the bad guys.”

Baroness Lloyd defended the bill’s existing two-stage process, arguing that it already provides information at the points when regulators need it.

She reaffirmed that the initial 24-hour report alerts the NCSC and allows it to determine whether other organizations are affected, while the 72-hour report will contain the necessary details to enable a more actionable response.

“We believe that the stages we set out meet that. They have been carefully developed to provide the right notification at the appropriate time,” she told peers.

“They have been developed in consultation with industry, as many noble Lords exhorted in the previous group.

“Crucially, under the information-gathering powers in Clause 15, regulators can also request further information about an incident that has been reported to them if they consider this necessary to understanding the incident and how it is being managed.

“Obviously, that may be appropriate in some incidents and not in others. That kind of practical balance is enabled by the bill.”

Separately, the Grand Committee spent the second day scrutinizing the bill, fleshing out datacenters’ responsibilities, as well as examining requirements to notify affected downstream customers within 24 hours of a breach instead of 72 hours.

The government also rejected concerns that cybersecurity data collected under the reporting rules could contribute to unfair overseas proceedings. Baroness Lloyd said ministers had considered the issue and assessed the risk as very low. ®

If your vehicle is older, you might want to check this out.

What to look for when buying a portable CarPlay screen

Evgenia Parajanian/Getty Images

Extra features they can offer you

Bowonpat Sakaew/Shutterstock

• 2027 UBS recruits told they must have AI proficiency and a willingness to learn
• The bank’s AI Fluency Pathway will continue to support junior workers’ development
• While thousands of jobs could be at risk, we’re starting to see shifts rather than outright displacement

Swiss investment giant UBS is now requiring all junior bankers to demonstrate AI proficiency as the skill moves from being a nice-to-have to an absolute requirement within recruiting.

The change currently applies to graduates and interns applying to the company’s 2027 intake, per the Financial Times, and it’s unclear whether UBS will broaden the requirement to all workers in the future.

This story originally appeared on Grist and is part of the Climate Desk collaboration.

This fall, 54 million K-12 students are headed back to the classroom for another year of lessons in all the classic subjects: math, English, history, biology. But there’s another subject that’s been sneaking into school curricula: plastics.

A new report from the nonprofit Plastic Pollution Coalition documents the many ways the plastics industry has been inserting its agenda into classrooms across the US—including through lesson plans and worksheets, hands-on science experiments, and a program called “PlastiVan” that travels from city to city teaching students about “the contribution plastics make to modern life.”

Industry interests offer these resources to teachers for free or for cheap, according to the report. The materials tend to highlight the necessity of plastics while downplaying their significant downsides to human health and the environment.

“When that information is provided to kids, it obfuscates the true impacts of plastic pollution,” said Madison Dennis, senior policy and advocacy manager for Plastic Pollution Coalition and one of the report’s main authors. Besides harming marine life, plastics can expose people to hazardous chemicals, clog storm drains and contribute to flooding, and release planet-warming greenhouse gases. The Plastic Pollution Coalition is calling for stricter school policies against the use of industry-sponsored learning materials.

The report lays out four case studies of plastics industry “propaganda” for schoolkids. One involves the Society of Plastics Engineers, or SPE, a trade group that recently became a division of the Plastics Industry Association. SPE’s lesson plans include activities like a “plastic scavenger hunt,” which aims for students to “understand that plastics are ubiquitous and their importance to society and their personal life.” A video titled “Your Bottle Means Jobs” explains how plastics recycling supports local employment.

Another case study highlights the American Association of Chemistry Teachers, an initiative of the Dow Chemical Company. One of the association’s lesson plans teaches elementary and middle school students how to compare the strength of various types of plastic bags that can be found in a grocery store. After a brief experiment, the lesson invites them to “pretend [they] are an employee for Dow Chemical Company” and are designing a plastic bag for a customer.

While many of the materials claim to support STEM learning objectives, they do so while promoting familiar industry talking points, emphasizing the affordability and safety of plastics. Some acknowledge plastic pollution as a serious problem, but they blame irresponsible consumer behaviors and, instead of recommending less plastic be produced, propose more recycling as the primary way to address it.

In reality, only 9 percent of all plastics are recycled worldwide, and scientists have repeatedly warned that recycling will be unable to keep up with projected growth in plastic production. Investigative reporting has shown that industry groups knew this decades ago, but promoted recycling anyway in order to defuse growing concern over plastic pollution.

Wendy Johnson, a science education specialist at the National Center for Science Education, said the industry’s lesson plans and worksheets don’t reflect good pedagogy. Materials claiming to be aligned with state-level STEM standards don’t say which standards they support, or how they’re aligned. Lesson plans instruct students to read teachers’ notes, or list industry-specific vocab terms like “stretch blow molding” or “thermosetting.”

“By using all of these technical terms, it’s tricking people into thinking … that they’re doing science,” Johnson told Grist. What the materials really teach, she said, is “ideological perspectives about the economy,” like the desirability of cheap consumer goods.

For the last two years, the advice to brands has been more or less standardized: get cited and recommended in AI, and the rest will follow.

Whether that is called GEO or AEO, the objective is the same: make sure AI can understand your brand, retrieve the right information and recommend it when a customer asks.