UK unveils National Cyber Force of hackers to target foes digitally

Britain has unveiled its new National Cyber Force, a unit of offensive hackers that can target hostile states such as China and Russia, terror groups and even paedophiles by disrupting their online communications.

The NCF, controlled by the spy agency GCHQ and the Ministry of Defence (MoD), has been secretly up and running since April with several hundred hackers based in Cheltenham and other military sites around the country.

Little is known about the agency’s activities, but it is understood the bulk of its early operational work has been to disrupt the communications of those deemed to pose a threat to the UK, for example terrorists engaged in an attack plot.

Boris Johnson told the Commons on Thursday that the NCF combines “our intelligence agencies and service personnel” and is “already operating in cyberspace against terrorism, organised crime and hostile state activity”.

UK defence now has £16.5bn coming. But where is it going?

Read more

The idea is to bring together the scattered offensive hacking capabilities that the UK claims to have had for a decade – and rapidly increase the size of the operation. The NCF plans to increase its staffing around tenfold to 3,000 over the next decade.

An estimated 60 countries have developed offensive hacking capabilities, with Iran and North Korea among the most advanced nations with a track record of targeting the UK, as well as state-sponsored hackers linked to intelligence agencies from Moscow and Beijing.

Britain has rarely talked about its offensive hacking capability, and remains reluctant to do so despite the existence of the new unit. But in 2018, GCHQ said it had conducted “a major offensive cyber campaign” against Islamic State.

At the time its director, Jeremy Fleming, said the operations had made “a significant contribution to coalition efforts to suppress Daesh [Isis] propaganda, hindered their ability to coordinate attacks, and protected coalition forces on the battlefield”.

Other techniques used by the NCF include trying to change behaviour to make it impossible for threats to proceed or dissuading the person behind the threat from carrying their plan out – or simply degrading physical communications systems.

Insiders prefer to focus on their work in countering Isis and other terror groups, but it is understood the NCF can work if necessary against Russia or China. It has also been busy disrupting online paedophile and other sexual abuse networks, regarded as being some of the most sophisticated cyber actors around.

Cyber operations will have to be approved by a minister, typically either the foreign or defence secretary, depending on the nature of the target and the exact assets required. Insiders said it would operate within existing legal controls, and would be subject to oversight from parliament’s intelligence and security committee.

But the intention is that it will operate largely in secret. Its first director, a man, has not been publicly named but it is understood he has been with GCHQ for more than 20 years, often working closely with the MoD.

The NCF had been in the planning stage for a couple of years, struggling to get off the ground amid bureaucratic turf wars. Some Whitehall insiders have questioned whether GCHQ’s intelligence culture and the MoD’s more hierarchical military culture will work effectively together.