The National Security Act 2023: what is changing and what do you need to know

The National Security Act 2023 (the Act) received Royal Assent on 11 July 2023. We take a look at what new measures the Act has introduced and what you need to know about the changes.

What is the rationale for the Act?

The Act addresses the evolving threat of hostile state activity against the UK’s democracy, economy, and values. The Act equips law enforcement and intelligence agencies with updated tools to deter, detect, and disrupt threats, including espionage, foreign interference, sabotage, disinformation, and cyber operations. The Act aims to keep the UK one step ahead, making it a harder target for hostile acts and responding to ever evolving technologies and methods. 

What do you need to know about the changes if you’re a:

• Security Controller within the UK Defence Industry: the Ministry of Defence (MOD) issued an Industry Security Notice (ISN) which recommends that you get familiar with the provisions of the Act and directs you to the UK Government factsheets here. Where MOD issues updated standard contractual security conditions or Security Aspects Letters then these should be flowed down to sub-contractors, where relevant. This may require an amendment or variation to existing contracts and you should review your contracts to identify any that might be impacted (for example an existing contract which refers to the MOD standard contractual security conditions). If your premises are a "prohibited place" under the Act (see below) then new signage is required to make this clear to the public.

• Business supplying goods and services to MOD and MOD contracting authorities: you are likely to have contracts in place which refer to legislation which has now been repealed (the Official Secrets Act 1911, 1920 and 1939). You may have a contract which refers to DEFCON 659A, which has been updated to include the Act. You can anticipate that MOD will require an amendment to your contracts to reflect the changes brought about by the Act. You should inform your staff that both the Official Secrets Act 1989 and National Security Act 2023 apply to them, and this is a requirement of the updated DEFCON 659A.

• Crown servant or a UK Government contractor: you continue to be bound by the Official Secrets Act 1989 and your duties around the unauthorised disclosure of official documents (for example, documents relating to defence) remain in force. Offences in the Official Secrets Act 1989 only apply to Crown servants and UK Government contractors in the HMG supply chain.

• British National or a person living in the UK: the Act applies to you.

What new measures has the Act introduced?

The Act came into force on 20 December 2023 and has introduced a number of new measures including the following:

• New espionage offences – Espionage offences were contained in the Official Secrets Acts 1911, 1920 and 1939. The Act repeals these Acts and introduces three offences: obtaining or disclosing protected information, obtaining or disclosing trade secrets, and assisting a foreign intelligence service. The Home Office says that these reformed offences enhance the UK’s capacity to counter espionage and help to keep the UK safe.

• New offence of sabotage – This new offence applies to activity carried out for a foreign power which results in damage to property, sites and data affecting the UK's interests, and national security. As you would expect in 2024, this includes both damage to property and damage caused by cyber actions.

• New offences relating to foreign interference – These new offences primarily aim to deter foreign states from undermining the UK by making interference activities costly and accountable. There are now much higher penalties for foreign interference in elections. The Home Office describes these measures as necessary for the UK to tackle state-sponsored disinformation. 

• Prohibited places – The Act designates certain sensitive sites as prohibited places. This includes defence-related sites and also a number of civil nuclear sites. The Act introduces new offences and police powers to deter, capture and prosecute harmful activity in and around prohibited places. Taking into account technological advancements, the Act now includes the use of unmanned devices/vehicles (such as drones) and also the use of cyber methods to access sites electronically.

• A new Foreign Influence Registration Scheme (FIRS) – This is a two-tier scheme which will require individuals or entities who have formed certain arrangements with foreign powers, or who carry out specified activities for foreign powers, to register on an online portal. There are different requirements in the scheme, the political influence tier, relating to political influence activities in the UK, and the enhanced tier, for activities which pose a potential risk to UK safety or interests. Failure to register will be a criminal offence. It will also be an offence to carry out the relevant activities/arrangements without a registration in place. This part of the Act is not yet in force. The Government is consulting on draft guidance on the scheme and it is expected to come into force later in 2024.

• Financial and property investigation powers – There are three new powers to support investigations into foreign power threat activity with a focus on powers to obtain information about finances and property.

• Powers of arrest and detention – New powers and measures to give the police the tools they need to be able to investigate and respond to state threat activity. This includes enhanced search and seizure powers for state threats investigations.

When did MOD issue its industry security notice about the Act?

MOD issued its ISN about the Act on 31 January 2024. The new DEFCON 659A (02/24) was then issued. The ISN relating to the Act gives a helpful overview of the rationale for the Act, the changes it introduces and what it means for MOD standard contractual security conditions and templates, including Security Aspects Letters and DEFCON 659A. You can access the ISN here.

[Note: MOD uses ISNs to inform defence personnel about security changes or information.] 

What impact has the Act had on existing legislation?

The Act has repealed the Official Secrets Acts 1911, 1920 and 1939, which dealt with espionage offences. The Official Secrets Act 1989, which deals with the unauthorised disclosure of official documents, remains in force.

Do you want to know more about the Act or how it might impact on your contracts? 

Simply reach out to Stephen Anderson.