House of Commons - Ministerial statement - Crowdstrike Caused Outage - 22/07/2024

right we now come to the next statement I call Ellie Reeves Minister thank you Mr Speaker on Friday the 19th of July we saw a crowd strike software update on Microsoft systems result in a major Global it outage it caused significant impacts around the world impacts were seen in the transport sector with flights grounding in Europe the US and delays and cancellations here in the UK on rail live departure boards were impacted during the morning rush hour and some media Outlets lost the ability to provide live coverage this caused substantial inconvenience for passengers hoping to travel for the summer holiday Getaway on the busiest travel weekend of the Year airports and Airlines across the UK had measures in place to maintain safe operations support passenger welfare extend operating hours and deploy additional staff to support late running operations to keep people moving where possible as with all incidents the sector will review their response and Implement any learnings more concerningly large parts of the local UK Health Care System lost access to test results and appointment information affecting mostly GP surge Services tried and tested NHS contingency plans were enacted and services are expected to be operating at full capacity in in the next few days small businesses without dedicated it support uh systems were heavily impacted due to disruption to Cardon payment systems and ATMs with many resorting to operate with cash only while firms worked to fix their systems many firms were able to get back online quickly and the remaining are expected to restore operations this week officials from the national cyber security Center quickly established the outages were not as the result of either a security incident or malicious cyber activity the cause was instead identified to be a flawed crowd strike software update which caused Windows machines to crash on Friday morning crowd strike issued guidance on how to solve the problem giving unit users a manual fix for each affected device or system I now believe cry strike is in the process of implementing an automated update which can be applied remotely and should therefore speed up recovery however there are still residual impacts from the failed update and it's important that we continue to monitor the situation and the longer term impacts to UK sectors and secondary impacts from International disruption ever since the incident occurred the government has worked closely with both Microsoft and crowd strike my cabinet office officials have been leading coordination of the government response across all impacted sectors of the economy this included close monitoring of affected public services to ensure business continuity plans were enacted and services were supported as they came back online two Cobra senior officials meetings were also convened on Friday to coordinate the response and officials from across Her Majesty's government met over the weekend to continuously monitor the impacts and the co recovery process I'm pleased to say that government services and the online services that government provides were remain largely unaffected my colleagues including the chancellor of the duy of Lancaster the health secretary and transport secretary attended briefings with officials throughout and the Prime Minister was kept informed the majority of the sectors that were impacted have now mostly recovered the UK transport system Aviation railroad Maritime is running normally NS staff worked hard over the course of Friday and the weekend to quickly apply the fixes required and my colleagues in the department for Health and Social care have confirmed that systems are now back online including for GPS their advice is that patients should continue to attend their appointments unless told not to there may still be some delays and GPS will need to rebook appointments that could not be made during the it outage the public should continue to contact their GPS in the normal way however as it systems are complex we can expect that minor disruption will continue in some areas while systems continue to recover but my officials expect these to be resolved in the next couple of days I'd like to extend my thanks to everyone who has worked so hard to get systems up and running again and all staff who have worked tirelessly to support individuals impacted by the outage following this incident the cabinet office will work with the national cyber security Center and other partners across government to review the lessons learned the central digital and data office will work with the ncsc to implement any improvements to the existing response plans to cover both technical resilience features as well as cyber the Cobra unit will work with departments to support their processes for establishing how the organizations and sectors they represent manage the impact of the outage and what lessons have been learned as soon as this government was elected we took immediate steps to begin legislating to protect public services and the third party service they use our cyber security and resilience Bill including in the King speech will strengthen our defenses and ensure that more essential Digital Services than ever before are protected for example it will look at expanding the remit of the existing regulation putting Regulators on a stronger footing and increasing reporting requirements to build a better picture in government of cyber threats technology failures can be as disruptive as cyber attacks and the move to create the center for digital government within D is aimed at creating a more resilient digital public sector what this incident shows is how dependent the modern world is on complex and interconnected it systems and how essential preparedness for such events is including business continuity planning not withstanding the immense frustration and inconvenience the outage has caused I'm pleased to see that effective contingency plans mitigated the potentially very very ser serious impacts this outage could have had I'm pleased also that there is to be a comprehensive process to identify the lessons from this episode I hope these will lead to improvements which both help prevent similar incidents and further improve our resilience to system outages and the impacts they can have and in this Spirit Mr Madame Deputy speaker I commend this statement to the house Oliver dton yeah yeah yeah well may I begin by welcoming The Honorable lady to her role and thank her for her advanced S of the statement in that role I know she will be supported by a dedicated team of civil servants who represent the very best of public service and I have no doubt that they will serve her as well as they did me but she will also be aware of the enormous challenges facing this government and governments around the world in relation to cyber security as I warned when I was the responsible Minister threats to public services and critical National infrastructure come from a range of challenges from hostile State actors to human error and design flaws last week we saw these challenges vividly brought to life following the corrupted antivirus update by crowd strike on Friday 8.5 million Microsoft devices globally were rendered unusable this left airports disrupted patient records temporarily lost and GPS unable to access important patient data creating significant backlogs this is more than an inconvenience Madame Deputy speaker I want to pay tribute to all those working in our public services for the efforts they undertook over the weekend to restore these services and to the work of dedicated cyber Specialists across government including in the National cyber security Center in government we undertook a wide range of measures to enhance the nation cyber security creating the national cyber security Center introducing secure by Design setting cyber resilience targets launching G Shaw and transforming the oversight of governmental cyber security and now I note uh as The Honorable lady said that the government intends to build on this progress by bringing forward a cyber security and resilience Bill uh will the minister therefore outline the timetable for this bill and will the government consider mandatory cyber security targets for the UK public sector and is the government considering obligations to ensure that infrastructure is designed to be resilient against common cause problems such as this one what steps are being taken to enhance cyber security in the devolved Administration and in parts of the public sector such as the NHS which are operationally independent and specifically in relation to this incident what assessment has been made of the prevalence of crowd strike within critical National infrastructure and what further reassurances can the government give in relation to the timetable for full recovery of Key Systems and data in particular can the minister ensure employee assure employees that this month's payroll will not be adversely affected Britain's cyber industry is World leading cyber security Now employs over 60,000 people and brings in nearly 12 billion worth of Revenue annually this transformation was in part due to our 5.3 billion pound investment which launched the country's First National cyber security strategy I therefore urge the government and I see the chancellor uh in her place to continue such investment incidents such as crowd Strike should not deter us from the path of progress we must must Embrace digitalization and the huge improvements in public services that it offers indeed the adoption of artificial intelligence across government is the closest thing we have to a silver bullet for public sector productivity however if we are to command public confidence people must be assured that technology is safe secure and reliable and incidents such as this demonstrate how reli the government and public services are on large technology companies and how much responsibility they have for the services that have become critical to people's lives and livelihoods that's why in government I called for us to work more closely with leading technology firms to address these shared challenges the best solution is partnership So to that end what further engagement will the minister undertake with Microsoft and crowd strike and The Wider sector to ensure there is no such recurrence the task for us all is to build on existing progress that has transformed Britain's cyber defenses and to enhance protections for British families businesses and indeed the very heart of government and in that mission the government can rely on the support of these benches uh I thank the shadow Minister for his uh contribution and his questions and uh particularly I would Echo uh the thanks to all of those involved across the uh civil service in departments uh in dealing with the outage last Friday uh and mitigating the effect of uh it I set out in my opening uh comments uh that our cyber security and resilience uh bill which was uh included uh in the uh King's uh Speech uh will strengthen our defenses uh and ensure that more Digital Services our are protected and that is a priority for this uh government the bill will look at expanding the remit of existing regulation putting Regulators on a stronger footing and uh increasing reporting requirements so that we can build a better picture in government of cyber threats and we'll also consider the implications of Friday's incident as we develop that uh legislation but rest assure that we are working across uh government uh in uh relation uh to this uh to ensure uh resilience uh as the chancellor of the duy of Lancaster said in his statement on the covid inquiry module one report uh he will lead a review to assess our national resilience against the full range of risks that the UK faces and that includes cyber risks CH on wara um thank you madam Deputy speaker and it is a great pleasure to see uh the minister in her place um as she said uh the crowd strike outage is a reminder of the way in which technology is so integrated into our lives making all our lives better but also our dependence on standards of development uh deployment and integration of new technology which are largely not visible to us I was reassured to hear of the steps that government and businesses have been taken to U mitigate the impact but I fear that small businesses and consumers do not have the same resources so could the uh Minister tell us or does she agree that you shouldn't have to be able to reboot from a blue screen in order to enjoy the benefits of technology and will her government uh move to ensure that consumers are better protected go ahead I thank uh my friend for that in uh contribution and uh also want to acknowledge all of the work that she has done in this uh area uh it has been hugely uh valuable she makes some really uh important points uh about making sure that uh consumers and small businesses uh are protected as well as uh government uh departments and uh bigger uh business uh and uh I'm sure that will be uh form part of the lessons learned from this incident uh but also feed into the bill that we'll be introducing Daisy Cooper thank you m Deputy speaker it's my first opportunity to welcome ministers uh to their places and thank you for advanced site of the statement um I want to focus on the impact on the NHS in particular and I'm sure my thanks and that the entire house goes to all NHS staff who've been scrambling to deal with urgent inquiries from distressed patients I wonder if I might press ministers for assurances on two particular patient groups who suffer from time the need for time critical care first of all there are some patients who always require blood test results before they commence urgent treatment or operations and I wonder if there are any assurances on what attention they've been given by the NHS both now and in any future scenarios and secondly those patients who are at extreme risk of getting an extremely uh ill version getting extremely ill from getting covid since the last government scrapped the covid medicines delivery unit many vulnerable patients have been struggling to get the covid um antivirals they need from their GPS in time that situation has made much worse when this kind of disruption happens I wonder if she can provide any assurances about any attention that NHS England has given to these two patient cohorts and if not whether she might be willing to meet with me to discuss what we might do in future uh I Thank The Honorable uh member for her question and highlighting the issues facing vulnerable patients um I'm pleased to report that there were no uh reported impacts to uh 111 or 999 uh Services uh and that patients were able to acknowledge emergency care if required uh the majority of the impact to GP Ser Services were accessing patient records GP appointments and prescriptions uh patients who couldn't access GP appointments were able to uh attend uh Urgent Care um uh Services uh and GPS were able to issue paper uh prescriptions but I will pass on her concerns to my colleagues in the department of health because they are incredibly uh important issues and we need to make sure uh that uh vulnerable patients are protected uh going forward Pamela Nash thank you Madame Deputy speaker and I'd like to take this opportunity to welcome both you to your your very temporary position and also to my honorable friend on the the front bench welcome welcome her to her role I'd like to ask if there's any uh further detail that the minister could share with the house on the particular impact of this outage in Scotland and ask her which what conversations her Department have had with the Scottish government in recent days [Applause] thank you and I uh welcome my horable friend back to the house it's fantastic uh to see uh her in her place uh and rightly uh so uh thank you for the points uh that uh you uh have raised they are uh very uh important uh and will be taken into account with the Lessons Learned David Mandel thank you Madame Deputy speaker and I commend uh the minister on her appointment does she agree with me that uh these events demonstrated that we are very far from being in a position to move into a cashless society and given that the chancellor is in her place will she confirm that her government will do everything that it can to support the continued use of cash which is so important to some of the most vulnerable people in our society I Thank The Honorable member for that uh Point cash Remains the second most commonly used form of payment in the UK and we remain committed to ensuring access to cash for individuals and businesses uh that's why we have got a commitment to uh 350 uh banking hubs so that uh cash uh remains uh available uh to uh people thank you Mark Ferguson thank you madam Deputy speaker and it's a pleasure to welcome the minister Hood to place particularly sat alongside the chancellor of the check um I welcome the points that being made with regard to resilience in public services but can the minister assure me that similar efforts are being made to ensure resilience when it comes to it with regard to defense uh I thank my aable friend uh for that uh contribution and uh as I said uh in answer to previous question uh as soon as this government was elected we took immediate steps to start legislating to better protect all our public services and the third party services that they uh use uh through the cyber security and resilience uh bill um which will uh be uh coming to Parliament Jim Shannon speaker can I first of all welcome the the minister to place and I think some and congratulations are due to the honorable lady for I understand H lady was in charge of the elections for the labor party so much of says that there was over there The Honorable lady can take some credit for that it's good to see a reward for the Endeavors for hard work well done and when it comes to Airlines 171 flights canceled of which some of my constituents were stuck in London couldn't get home to Belfast when it came to Banks customer some my conss were out in the shops they were buying their their goods and they found their credit cards didn't work because the system was down uh when it come to the health system and just to give you some some uh effect of and the Department of Health in North AR said that hospital service and around 2/3 of GP surgeries faced problems that there was problems with patients and operating theaters accessing staff uh rosters and and the whole system was an absolute chaos so can I ask the The Honorable lady this question yeah I can those Min not agree that the issue is underlined the necessity of ensuring that we are prepared for cyber breakdown whether that has intentionally done as an attack or unintentionally done and would the minister outline perhaps our preparedness for situations such as this as well as our resilience and moving forward for news Tech problems for all parts of the United Kingdom of Great Britain and Northern Ireland thank you uh I Thank The Honorable member for his kind comments uh and can I just say that I'm sorry to learn of his constituents who were unable to get flights home or were unable to get GP uh appointments uh I've talked uh in the uh statement uh about uh resilience um going forward uh and making sure that we uh expand our cyber uh resilience putting Regulators on a stronger footing uh and getting uh a clear picture of cyber threats and how they can be uh dealt with and he raises some very important points about that K Walt house thank you madam deuty speaker this was an extremely uh serious incident which I suspect May well be detectable in the next GDP figures uh that we see coming out of the s but I had two questions in her statement uh The Honorable lady said she was pleased to say that government services and the online services that government provides were and remain largely unaffected could you just tell us which were in fact affected or was largely just a youthism for not affected at all and secondly it's quite difficult for members to get a handle on the full impact and spread of this particular contagion will she commit to laying the house some kind of report the details the sectors that were affected how seriously they were affected including government systems and whether and how there will be any resolution in the future because obviously we need to report to our constituents that in future these things are less likely to occur uh I uh set out the impact that the uh incident had on for example GP uh Sur uh Services uh but um uh things like the Emergency Services remained uh unaffected as far as we are aware we are uh undergoing the Lessons Learned uh from the incident uh and I'm sure uh will report back uh on that once that's been completed Joshua Reynolds thank you madam Deputy speaker GPS in my constituency of ma head were affected on Friday like so many others and I'd like to thank them for the work they did when even though patients weren't able to get test results and appointments were missed they managed to make sure that people received the best care possible what assurances can the minister give me about the lessons learned from Friday so that patients can continue to receive the care they need when they need it uh I welcome The Honorable gentleman uh to the uh house and place on record my thanks to the GP surgeries in Maiden head uh who have uh done what they can to make sure that disruption for patients were at uh a minimum uh we will be undertaking the Lessons Learned exercise uh from uh this which I hope will offer some reassurances to his constituents as along with with the bill that will be going through Parliament custy Blackman thank you very much chair um I'm aware that the minister is new to her role so I'm going to ask her to consider things rather than to commit to doing things um will she please consider continuing with the annual statement to Parliament on civil contingencies and risks that was committed to by the previous government um will she also consider looking when she's looking at the cyber security and resilience Bill assessing whether there is widespread use of certain software or hardare that could cause Mass outages in the event that is affected such as uh In Crowd strike I'm not aware that we've seen a kind of analysis of that in uh previous uh outputs by the cabinet office and I think it would be incredibly helpful for us to be aware of where those risks are uh I thank uh The Honorable member for those uh suggestions and very happy to consider the points that she has raised um I cannot be the only member who thinks how proud Mr and Mrs Reeves must be today