UK bill would let ministers order a supplier out in secret, and gag the firm that complied

The instrument is called a vendor-related direction ^[2], and the name that enters the public record is the buyer's. The government's own worked example is a water company, hospital provider or data centre operator publicly identified as having received a direction while the vendor that prompted it stays anonymous ^[10]. The reputational charge lands on the party that did as it was told, and every other supplier in that estate inherits a share of the suspicion, because nobody outside knows which one went.

The channels that would normally fill that gap close at the same time. Anyone consulted before a direction is issued can be barred from revealing that the consultation took place ^[9], which silences the industry peers most likely to know what happened and why.

Absent ministerial discretion, the number of vendors this regime will publicly identify is zero ^[1]. What goes to Parliament is a standing aggregate: how many directions were issued, which sectors were affected, and how many were later varied or revoked ^[14]. Ministers keep the option of making a direction public where they judge that to be in the national interest ^[11], which is discretion rather than duty. For anyone assessing a supplier, the resulting public data has the wrong shape. A base rate tells you directions are happening in water. It does not tell you which product to take out of your own estate.

This argument has already run elsewhere in Whitehall. Security officials have pushed for greater transparency in comparable cases, including Apple's attempt to introduce end-to-end encryption for iCloud, where secret powers of this shape have been described as unsustainable and unjustifiable ^[12]. The stated purpose here is narrower: intervening when an essential service provider plans to buy equipment from a supplier that could pose a critical national security risk, particularly one with ties to hostile states that may seek to spy, sabotage systems or cause disruption ^[19].

Liz Lloyd, the recently reappointed cybersecurity minister, says the powers mean the government "can act before a threat materialises, not just after the damage is done" ^[13]. Pre-emption on that basis cannot be evidenced publicly without disclosing why, so the secrecy is not a drafting oversight; it is what makes the power usable at the moment ministers want to use it. The question at committee stage ^[17] is who carries the cost of that design. On the current text it is the buyer, which is named, and the vendor, which may never be told.