Director GCHQ speaks at CyberUK 2022

Bore da pawb a croeso.

I’m crossing my fingers that came out as I intended!  But in any language I want to say a massive welcome to CYBER UK 2022 and add my hopes to Lindy’s that the next few days will be important and meaningful for us all. 

I am genuinely excited to be here in beautiful Wales.  And given the context, I know that the things we are discussing will help shape not only the cyber environment, but the future success of our nations.

Now before, we get to the programme it’s my pleasure to set the scene and spend a few minutes looking at that context.  If you like, the bigger picture…

Since we last got together in Glasgow in 2019, we have been through some particularly challenging times.

The pandemic has shaken the world, caused millions of deaths and shifted more of all of our lives online.

The toll on our economy, especially on supply chains, has become obvious as we prioritise and tighten our belts.

Of course, we can count ourselves lucky compared to those caught up in wars, but we are also seeing a heightened cyber risk. Cyber criminals are consistently evolving their tactics; the lines are blurring with hostile state activity and ransomware remains a real threat.

The shift in technology towards the East, regulatory competition, and the commoditisation of data has increasingly obvious implications for our future security and our prosperity.

Any one of these factors could be viewed as historic. Taken together, their impact is even more so.

It adds up to a context that emphasises the importance of digital connectivity to the very fabric of our lives. 

The fact is that this trend that will keep on accelerating.

And that means we must be able to trust the systems that connect us; that enrich our lives economically and socially. And it means that Cyber clearly matters to everyone.

It’s against this period of generational upheaval and through the lens of an intelligence, security and cyber agency that I want to explore this in more detail - what we’re learning now and how we must change our approach to cyber security in the future.

At the global level, the UK has developed as a cyber power. Alongside the more traditional forms of diplomacy and statecraft, cyber now plays a vital role in our national security and prosperity.

I’m sure you’ll have heard me talk about this before. But, I consider a country to be a cyber power if it can direct or influence the behaviour of others in cyber space.

And I believe that our ability to protect the digital homeland is where we must start.    

I’m incredibly proud of the NCSC’s role in UK’s defensive strength.  We are working with partners across the country – private and public – to respond to incidents, warn of threats and offer tailored advice and guidance to stay safe online. And we are supporting the adoption of measurable, data-driven standards, in government, the public sector and the wider critical national infrastructure.

It’s increasingly clear that not only are these the right things to do, but they have the potential to make a long-term, systemic impact.

However, we cannot take our current defensive strength for granted. As threats shift, as technology advances, we must constantly re-evaluate and reinvent cyber security. 

And we know that to be a true cyber power, cyber security alone is not enough. 

That’s why with our partners in intelligence and MOD, we formed the National Cyber Force.  It builds out from our world class cyber defence and resilience. And, it’s brought another level to the spectrum of national security work.

The NCF is already making a big impact. From countering disinformation, to supporting the activities of our military overseas, and to helping law enforcement to go after criminal gangs, it is improving the UK’s defences and it’s imposing a cost on our adversaries. 

Of course, ultimately, what sets us apart from these adversaries is not what capabilities we have but how we use them in a legally, proportionate and ethical way. The UK has led the way on this thinking and later this month, the Attorney General will set out the Government’s latest legal views on the responsible use of cyber capabilities.

Each part of the system – intelligence, security and cyber - is different and to a degree, independent. But it’s how they operate together – how we make them greater than the sum of our parts - that provides true national advantage and cyber power.

That’s not rhetoric, that synergy is advancing the UK’s vital interests in these challenging times.

Now, if I dig into some of the factors a bit more, I mentioned at the start, you can start to see this in action.

We’re seeing China go further and faster, imbuing standards and technologies with their authoritarian, government-led values. Much of this is in the public domain.  Some isn’t.  It has to be combined with insights from intelligence to help shape the UK’s cyber security approach to future tech and the standards that govern it.

And it has to come together with action now to enhance cyber resilience and to secure the next generation of technologies upon which the UK will rely.

That requires long-term investment and strategic patience.  But we’re also focused on immediate and closer threats. 

And at the moment, that means the war in Ukraine.  It’s at the front of all of our minds.  The suffering and broader humanitarian effects are terrible and we see the implications of indiscriminate warfare and Putin’s miscalculations play out on the battlefield.

But we’re also seeing this conflict in near real time in information, cyber and technology spaces.   

It is already a remarkable feature of this war just how much information about the behaviours and tactics of the Russian forces are out in the public domain. And how much intelligence has been released by Western Allies to challenge and get ahead of Putin’s actions. 

This is modern warfare influenced and shaped by the democratisation of information.  And thankfully, the Ukrainians are excelling at it - we’re proud to be playing our part in supporting their efforts.

We’re seeing it in cyber too.  Perhaps, the concept of a ‘cyber war’ was over-hyped.  But, there’s plenty of cyber about, including a range of activity we and partners have attributed to Russia.  We’ve seen what looks like some spill over of activity affecting other countries. And we’ve seen indications that Russia’s cyber operatives continue to look for targets in countries that are opposing their actions.

That’s why we have increased our efforts to ensure UK businesses and Government urgently improve levels of cyber resilience. And why, with our allies, we will continue to support Ukraine in shoring up their cyber defences.

Back here in the UK, we’ve continued to adapt.  For the first time we have a National Strategy that covers the ‘whole of cyber’.  From defence to cyber operations; from cyber rules to skills.

It’s a National Cyber Strategy with a ‘whole of society’ approach. It recognises the role of citizens, businesses large and small, academia, NGOs and local and devolved governments. And that recognises that we must work together to raise cyber resilience.

I think it genuinely breaks new ground and whilst it inevitably talks to the threat, it makes it very clear that as a country, we must seize the opportunities from technology, confident that cyber remains a force for good. 

As technology never stands still, we won’t stand still either. The NCSC continues to evolve in response. Take our Active Cyber Defence programme that took down more than 2.7 million online scams in 2021 alone. It’s delivering real results, especially when combined with new Early Warning services.

And of course, this isn’t just relevant to those of us in the cyber community.

As a country, we face a serious global economic situation.  The need to make the UK the safest place to live and do business online is ever more relevant. We must continue to focus on cyber criminals and other malign actors who are adapting their tactics to make money, by diversifying our approach too.

For example, through the Cyber Aware campaign, the NCSC is arming individuals and organisations with the knowledge they need to stay safe online, including against ransomware attacks. 

And, through the National Cyber Force, we are actively undermining the cybercriminals’ assumption that they can act with impunity on the internet. We have disrupted criminals, making it clear that they are being observed, and going after their ability to profit from their illegal work.

Cyber crime always has a local and personal impact on its victims, but cybercriminal networks go beyond international borders. NCF has worked with the NCSC and law enforcement partners in the UK and overseas to disrupt these gangs. 

Alongside our partners, we have mounted operations to undermine their networks, and prevent them from profiting from their crimes as well as denying them access to their cyber tools and malware.

In real life this means: tens of millions of pounds in potential fraud against the UK economy avoided.  Hundreds of thousands of stolen credit cards made worthless to the criminals, and countless potential victims of crime around the world with their data and accounts safeguarded.  That’s cyber power on an immense scale.

Just as we need a whole of society approach, the whole of society must benefit from the opportunities cyber can bring. Across our regions, we can already see that happening.

We chose to locate our newest GCHQ hub in Manchester, a city that is part of a thriving community in Europe’s fastest growing major tech cluster. It already has a growing NCSC footprint which we plan to significantly expand.

And the National Cyber Force’s site nearby in Samlesbury will help grow technology, digital and defence sectors across the whole region.

Here in Wales, cyber is bringing new opportunities too, enabled, encouraged, and supported by the Welsh Government.

It always starts with education.  Wales now boasts academic centres of cyber excellence, producing world-class research, and talented graduates with the specialist skills needed throughout our economy.

The budding cyber security sector here has attracted world leading tech giants alongside homegrown start-ups. 

And in its International Strategy, the Welsh Government is putting cyber security at its heart. This is about encouraging investments and exports.  But it’s also about people and employment here in Wales. 

So I hope, in the last few minutes, I’ve given a flavour of what we’re seeing in terms of global trends and emerging events.  I’ve outlined the way the UK Government intends to address this situation in terms of a whole of society, whole of cyber approach.  And where I see GCHQ, including through the NCSC and NCF, playing its part.

I want to finish on the things we can all do that will make a difference, for now and for the longer-term.

Firstly partnerships.

It’s clear that the UK must work beyond its borders with countries who believe the digital world should remain open, democratic, and free.

We have a collective responsibility to stand together to oppose those who do not share our core values and interests and to provide a persuasive offer, for those countries who may be deciding which side of the argument they want to take.

To do this we need to shape the international debate about the way in which technology and cyberspace should be governed in the future.   

Here in the UK, we could not do that without the partnership between government and industry. And that’s in no small part thanks to many of you in this room. I’d note that wherever I travel, I am asked how others could learn from this way of working.

I always say that the partnership between government and industry has to continuously evolve. That means building trust, being open to challenge, sharing data as effectively as possible whilst recognising the equities at stake, and having a shared sense of purpose.  

It’s working well, but we all know there’s more to do as we tackle new issues such as cross-sector cyber resilience and supply chain challenges. 

Secondly, raising resilience and doubling down on our collective approach is key to long term success.

Investing time, energy and resources in getting the basics right. Ensuring you understand the technology you use, following best practice to make it is as resilient as possible, and being alive to the shifting threat and how to defend against it.

The third area, perhaps the most important area we can make a difference is on skills. The talent in the community today is huge. But if the UK wants to continue to be successful, we need to widen the appeal of careers in cyber

Together, we must work to attract the next generation of talent from as diverse a pool as possible, from right across the country. The range of lived experiences this will bring into the workforce will make us collectively better.

We’re doing some of this through the massively successful CyberFirst programme. It’s been helping to develop the nation’s cyber skills for years; delivering programmes to attract diverse talent from 11 year olds through to post-grad and bursary students.  And many of you are developing the career streams which will sustain and develop these skills for the longer term too.

Of course, there are many other areas for us to progress together.  But it seems to me that a focus on partnerships, on resilience and on skills will go a long way in making the vision for a whole of cyber and whole of society approach real.

I will close today by reflecting that the global shifts we are seeing will take decades to resolve. And while I can’t predict how things will turn out, I can confidently say that cyber and cyber security will continue to be pivotal.

This community – everyone of you – has a critical role in what happens next.  We all need to ask the right questions. Demand the latest knowledge and make sure we apply all of our ingenuity to ensure the UK thrives.

Keep reminding yourself of that over the course of the conference. Learn from the experts we’ve brought together for you. And afterwards, share what you take away, and help us turn vision into action.

If we do that, I know that we will make the UK and our partners both more prosperous and more secure. 

I look forward to seeing the difference we can make and to seeing you all again in Northern Ireland next year.

Thank you.