Britons face a growing online threat from criminals, terrorists and hostile states, according to the UK’s first cyber security strategy.
Businesses, government and ordinary people are all at risk, it says.
The strategy has been published alongside an updated, wider National Security Strategy.
Its publication is a sign of the growing recognition within government of the need to bolster defences against a growing threat.
In line with a wider focus within the National Security Strategy on not just protecting the state but also citizens, the cyber-strategy encompasses protecting individuals from forms of fraud, identity theft and e-crime committed using technology as well as defending government secrets and businesses.
‘Attack capability’
Launching the strategy, security minister Lord West said: “We know that various state actors are very interested in cyber warfare. The terrorist aspect of this is the least (concern), but it is developing.”
He warned that future targets could include key businesses, the national power grid, financial markets and Whitehall departments.
He said: “We know terrorists use the internet for radicalisation and things like that at the moment, but there is a fear they will move down that path (of cyber attacks).
“As their ability to use the web and the net grows, there will be more opportunity for these attacks.”
He confirmed that the UK government has already faced cyber attacks from foreign states such as Russia and China.
But he denied that hackers had successfully broken into government systems and stolen secret information.
He also said he could not deny that the government had its own online attack capability, but he refused to say whether it had ever been used.
“It would be silly to say that we don’t have any capability to do offensive work from Cheltenham, and I don’t think I should say any more than that.”
‘Naughty boys’
Among those the government has turned to for help on cyber crime are former illegal hackers, Lord West added.
He said the government listening post GCHQ at Cheltenham had not employed any “ultra, ultra criminals” but needed the expertise of former “naughty boys” he said.
“You need youngsters who are deep into this stuff… If they have been slightly naughty boys, very often they really enjoy stopping other naughty boys,” he said.
Officials said e-crime crime is estimated to costs the UK several billion pounds a year.
Two new bodies will be established in the coming months as part of the strategy.
A dedicated Office of Cyber Security in the Cabinet Office will co-ordinate policy across government and look at legal and ethical issues as well as relations with other countries.
The second body will be a new Cyber Security Operations Centre (CSOC) based at GCHQ.
This will bring people together from across government and from outside to get a better handle on cyber security issues and work out how to better protect the country, providing advice and information about the risks.
“CSOC’s aim will be to identify in real time what type of cyber attacks are taking place, where they come from and what can be done to stop them”, according to a Whitehall security official.
Experts say the “forensics” of detecting who is behind a cyber attack and attributing responsibility remains extremely difficult.
Officials said it would require input from those who had their own expertise in hackers. “We need youngsters,” an official said.
The range of potentially hostile cyber activity – from other states seeking to carry out espionage through criminal gangs to terrorists – is daunting.
Critical information
At one end of the spectrum, military operations – such as Russia’s conflict with Georgia last year – are now accompanied by attacks on computer systems.
The UK’s critical national infrastructure is also more reliant on technology than it was even five years ago and terrorists who have used the internet for fundraising and propaganda are also believed to have the intent – if not yet the capability- to carry out their own cyber-attacks.
Officials declined to give a figure of how many attacks on government computer networks take place each day.
In a speech in 2007, the head of MI5, Jonathan Evans, explicitly mentioned Russia and China in the context of a warning that that “a number of countries continue to devote considerable time and energy trying to steal our sensitive technology on civilian and military projects, and trying to obtain political and economic intelligence at our expense. They do not only use traditional methods to collect intelligence but increasingly deploy sophisticated technical attacks, using the internet to penetrate computer networks.”
Officials said they were not aware of any “key pieces of information” that had gone missing yet but said that British companies had lost critical information.
The new Cyber Security Operations Centre will work closely with the designated parts of the critical national infrastructure and wider industry and officials say that business are keen for the government to take a lead but also share as much information as possible.
US President Barack Obama has been carrying out a similar re-organisation for defending US computer networks and British officials said the two countries were co-ordinating closely not least because of the intimate relationship between GCHQ and its US equivalent.
British officials believe that their government systems may also have fewer vulnerabilities than their US counterparts partly because they moved online later and have fewer connections between the internal government system and the rest of cyberspace to monitor.
Officials in the US and UK are also thought to be working on forms of offensive cyber-warfare capability but officials are unwilling to go into any details of what this might involve.
Some Comments: