Question proposed, That the clause stand part of the Bill.

With this it will be convenient to debate schedule 3.

I will do my best to conclude prior to 11.25, when the Committee might consider adjourning.

Clause 20 and schedule 3 create a new power for UK law enforcement and other investigative agencies to suspend IP addresses and domain names that are being used in serious crime. Under the power, law enforcement will be able to apply for a court order requiring the organisation responsible for providing the IP address or domain name to prevent access. Sadly, we have all too often seen that criminal actors use domain names and/or IP addresses to carry out crime including fraud and malware dissemination, targeting the vulnerable. When IP addresses and domain names are being used to conduct criminal activities, law enforcement agencies need to be able to block access, preventing the crime occurring.

In the UK, the police and other law enforcement agencies currently use public and private partnerships, and industry will, in the majority of cases, voluntarily suspend domain and IP addresses used for criminal purposes. This has led to the UK being generally one of the safest jurisdictions in the world. However, voluntary suspension is not an option in all cases. In particular, the majority of cyber-crime emanates from outside the UK, where the same voluntary arrangements are not available. Quite often, internet infrastructure providers based overseas will only take action when a court order is handed down. This measure will provide for such a court order to be obtained. Overseas infrastructure providers are much more likely to comply with a court order than a simple request made by the police without a court order.

We reviewed the Computer Misuse Act 1990 in 2021. As part of that, we invited views from stakeholders. Responses indicated that although much of the 1990 Act remains effective, more could be done in cases where the UK wants to take action against offences committed from overseas. The main function of these provisions is to ensure that UK law enforcement and certain investigative agencies can act to suspend IP addresses and domain names where they are being used for criminal activity with a link to the UK. Schedule 3 enables UK law enforcement agencies listed in paragraph 12 of the schedule to apply for a court order, which they can serve on entities based outside the UK.

Will this apply to illegal gambling sites and crypto casinos? Will the Gambling Commission have the authority to have these addresses pulled down?

If illegal activity were taking place, which would include illegal gambling, then the provisions of the clause would apply. As to whether the Gambling Commission can make the application or whether it would have to be the police, to answer that question we will have to refer to schedule 3 on page 91 and look at the list of entities. The hon. Member will see that paragraph 12(2)(e) does include

“a member of staff of the Gambling Commission of at least the grade of executive director.”

Indeed, paragraph 12(1)(a)(v) also expressly references the Gambling Commission, so I hope that answers the question about the Gambling Commission’s powers. I obviously prepared that in advance, anticipating her question—as Members of the Committee could surely see!

That is very helpful and will strengthen our hand with overseas entities that might not respond to a polite request but are willing to act when there is a court order. I hope that is something that we can all get behind. It will help protect our constituents from online crime, particularly fraud, but other forms of illegal activity, including illegal gambling. I pay tribute to the hon. Member for Swansea East for her work combating gambling harm, which I saw at first hand during my time as Minister for technology and gambling a couple of years ago.

Given the time left in this sitting, I thought there was a degree of optimism when the Minister stood up on a matter related to some degree to illegal gambling and thought it would be quick; I will try to bring my remarks in under the wire, but I may fail, when I assume I will be cut off in my prime.

Much of our discussions so far have had a digital and online dimension: the sale of knives and bladed articles, the posting of intimate images, the sale of stolen goods, and the digital online element of fraud. This is a very live, shape-shifting part of the debate. It was feature of the Online Safety Act 2023 discussions and is an important part of this Bill. Our basic principle is that we must give our police and broader enforcement agencies the best tools possible for them to stand half a chance of keeping up. This clause and schedule 3 fit with that approach and, as such, we support them.

For all the creative and direct uses that criminals can exploit modern technology with, there remains a basic staple: a website, a domain name and an IP address. That can be used in a variety of ways: selling illicit goods, selling stolen goods, pirating live events, pirating software or content, scamming or illegal gambling. It is right that enforcement agencies can close such sites down. Although this is a modern venture, I suspect it is today’s version of the 1975 classic Whac-A-Mole, as we chase scammers, fraudsters and thieves around the internet. I dare say that is frustrating but it is important for enforcement agencies to do.

The provisions in the schedule allow for the suspension of IP addresses and domain names for up to 12 months, following an application to a judge. In doing so, four criteria must be met. Three are relatively simple: condition 1 is that the address or domain name is being used for serious crime; condition 3 is that it is necessary and proportionate to shut the site down to prevent crime; and condition 4 is that the address or domain name would not be shut down by another route. The industry picture can be good, as the Minister says, but I do not think it is always good. That is the nature of the type of crime. We talked previously about pirating a premier league game—that would go pretty quickly. If the site is hosting an intimate image that was unlawfully obtained, that tends to take an awful lot longer, or indeed does not happen at all; that point has been debated.

Conditions 1, 3 and 4 seem clear to me, but I want to press the Minister on condition 2. That is met under four scenarios, although I believe the use of the word “or” means any one of the four scenarios, including,

“(a) that a UK person is using the IP address for purposes of serious crime”,

which is very similar, if not the same, as condition 1. The other scenarios are: (b)—that a UK person is a victim of the serious crime that the site or domain name is used for; (c)—that the IP address is being used for unlicensed gambling, which goes to the point made by my hon. Friend the Member for Swansea East; or (d) —the IP address is allocated to a device located in the UK. I think only one of those four tests needs to be met in order for condition 2 to be met. Given that (a) is essentially the same as condition 1, but with the proviso that the person is UK based, how does that operate in practice? Is that not a degree of duplication? The Minister can mull that one over while having his lunch.

I will move on to the heading

“Inclusion of non-disclosure requirements in suspension orders”.

As in the Bill, as part of a suspension order, a judge can require that the individual deprived of their domain name or IP address does not tell anyone that that has happened to them.

The Chair adjourned the Committee without Question put (Standing Order No. 88).

Adjourned till this day at Two o’clock.