Defence Secretary Wes Streeting said he wanted people to be “alert but not alarmed” as he defended against accusations that a call for the public to stockpile days’ worth of food and water for crisis situations was scaremongering.
He also said that cyber incidents such as the critical security flaw in the PHP programming language used by the majority of websites that has left organisations around the world scrambling for a fix will happen “more and more”.
Under a new Government “be ready” campaign, households are being urged to be prepared if everyday services are temporarily disrupted with three days of key supplies.
The checklist released advises stocking up with three days’ worth of bottled water and non-perishable food, a battery or wind-up FM radio to receive updates during outages and cash in case electronic payments or cash machines are disrupted.
Mr Streeting, speaking at the opening of a new gun hall in Telford on Thursday, warned of the need to be ready in case businesses were hit by cyber attacks that could knock out supply chains of essentials.
He said households and businesses need to ask if they know how they would respond to possible “everyday challenges” that might manifest themselves.
“But we’ll also need to take the country a step further and ask them are they prepared for increasingly sophisticated cyber attacks on our businesses, are they prepared for the eventuality that there may be disruption to essential supply chains caused by hostile state actors or terrorists?” he said.
“How would we cope if the payment systems at the local supermarket went down?”
He later told BBC One’s Question Time that there was not a “specific thing” in mind when it comes to potential emergency incidents, but said the advice might help during power cuts or if a local shop is subject to a cyber attack and was a matter of “everyday national resilience”.
Put to him by an audience member that it could be “scaremongering” and push people towards panic buying like during the Covid-19 pandemic, he said: “We did have this debate though, just to reassure… because we want people to be alert but not alarmed, and the truth is we looked around the rest of Europe, ‘what are our friends doing across the continent?’.
“They are way ahead of us on some of this stuff.”
Shadow foreign secretary Tom Tugendhat said it was “a perfectly reasonable thing to ask people” to have provisions in place for several days.
But his Conservative colleague shadow national security minister Alicia Kearns criticised the move as “lecturing the public”.
She said: “Preparing for emergencies is important. But the Government should get its own house in order before lecturing the public. It isn’t families that are failing to fund our defence or secure reliable energy – it’s Labour.
“With rising threats to our national security, we must all be ready to face all eventualities. We each have a role to play, but the Government must lead by example.”
The campaign launched amid a global scramble to fix a critical security flaw in the programming language PHP used by the majority of websites.
Mr Streeting said: “We’re going to find these sorts of things happening more and more.
“And it’s not just from foreign states engaged in espionage or sabotage; it’s also organised criminals.
“In this world of AI that we live in, with all of the opportunities it brings, and I’m a massive, you know, glass-half-full optimist about the technology and what it brings, it does also present threats if people are innovating and pushing against conventional defences, conventional cyber defences.”
Thirty-two Government services went offline and four were partially unavailable while work was carried out to address potential cybersecurity issues, a minister said on Thursday.
Officials said it was not “standard practice” to provide a list of Government services that were affected and that the picture was quickly evolving, with services being reviewed, updated and coming back online.
It came after cybersecurity chiefs warned UK organisations on Wednesday that a “critical security issue” had been discovered in PHP, which is used by almost 70% of websites according cybersecurity firm Cloudflare.
Organisations have been urged by the National Cyber Security Centre (NCSC) to update to a new, fixed version of the PHP software – or consider taking their websites offline if they cannot be upgraded immediately.
The PHP security issue identified could allow attackers to remotely control any web servers running PHP, which underpins popular platforms such as WordPress and Magento.
Many attempts at exploiting the vulnerability were spotted within hours of it being announced, according to Amazon and Cloudfare.
A Government spokesperson said: “Work is already under way across Government to actively identify and patch any potential exposure.
“We encourage all organisations – private and public, large and small – to follow guidance issued by the NCSC to understand their exposure and take the necessary actions to safeguard their systems.”