UK to splash billions on a new 'cyber army'

The 21st-century battlefield isn't filled with tanks, aircrafts and submarines - but code, AI networks, and the quiet hum of a global cyber war. With this in mind, the UK is reportedly investing billions into a new kind of force - dubbed a ‘cyber army’ - to "project power in the information age." Danny Dresner - a professor cyber security at the University of Manchester - and, up first, Tim Stevens, an associate professor of cyber conflict and the geopolitics of digital warfare at King's College, London, have been telling me about the plans…

Tim - The UK already has some capability in this space. In other words, it has military personnel and units that are already dedicated to, if you like, fighting in the digital battle space. But what's going on at the moment is, as we've heard from various governments and military officials, that we are at a uniquely dangerous point in the UK and indeed the world's modern history. And the digital battle space, cyberspace, the internet, is the origin of and the medium through which various strategic actors are threatening UK national security and UK PLC. That ranges from state actors like military and intelligence agencies who may wish to do the UK and its allies harm, through cyber espionage actors and through the cyber criminals that affect you and I in our daily lives. And clearly what the UK is thinking in this space is that they somehow need to harmonise its existing capabilities and maybe supercharge it a bit to enable the British military to operate and fight in that space.

Chris - Danny, we often hear cyber described as the new front line, but it is both everywhere and nowhere all at the same time. What does this shift towards cyber conflict mean for our security day to day?

Danny - Cyber abhors a vacuum. It has to be connected to something. There's no cyber security by itself. It's the security of whatever infrastructure, whatever devices, whatever processes and activities are actually going on. So I'm really pleased that there is actually some consolidation. This is something that has been needed for a while. As Ecclesiastes said, there's nothing new under the sun. And if you think about it, the signals intelligence people have been taking actions and have been actually out in action for well, as long as my short memory of history goes.

Chris - Have we seen much action on home territory in this respect? Have we been attacked much, Tim, in the past? And we just don't know about it.

Tim - Yes, I think that's undoubtedly the case. The intelligence agencies have traditionally taken the lead in this space when we think about strategic threats to the United Kingdom. And our signals intelligence capability, by which we mean government communications, headquarters, GCHQ, has been at the forefront of that. And they have very good what we call threat intelligence, intelligence about what is out there and who's operating against the United Kingdom. But there will always be gaps. So if we're going to put numbers on this, we think about the military piece, the Ministry of Defence has said something like several 10s of 1000s attacks against the defence estate over the last couple of years, which is far from insignificant.

Chris - So Danny, what sort of tech are we expecting to be deployed as part of this new initiative? They're saying they're going to spend a billion. It's big money. What are they going to spend it on?

Danny - Some of it will be on the kind of things that we've heard doing mischief to ourselves, I suppose the real development needs to come to make sure that these things don't go full circle, to a certain extent, anything that you can imagine all kinds of different levels of sophistication of software. But we'll want to look at our adversaries' systems, we'll want to be able to detect what they're doing, we'll want to deny them access when they do get there, we'll want to disrupt. But it doesn't always have to be as clever as a piece of software or a physical device. I remember Ian Levy, the former head of the National Cyber Security Centre's technical operations, once pointed out that sometimes when they find a server, even if it's abroad, doing bad things to us in the UK, even a phone call to the people who are running that server in the internet service providers to say, please switch it off can be enough. It doesn't have to be a full attack like they did with Stuxnet, which is the famous case of cyber weaponry.

Chris - Tim, presumably, everybody's at the same game. So if we were to be having this conversation in Russia, in China, in other states like that, they would be saying, well, they're tooling up in the same way. So this is just sort of an arms race, but it's a cyber arms race.

Tim - In China, fairly recently, they reorganised their military under something called the Information Support Force, which contains cyber and electromagnetic warfare. The US, of course, has US Cyber Command. And inevitably, this will be compared to that, although that's a much larger, much better resource. Russia's a little bit different. The operators of cyber and electronic warfare in that are spread across the military and intelligence. But of course, Russia has a slightly different way of looking at this environment. It thinks of it in a much more holistic way anyway. We tend to separate out cyber from electromagnetic warfare and from information warfare and from other forms of land, sea and air power. The Russians tend to bring it all together and think of it more as cognitive warfare, if you like. So creating effects in the cognitive space through whatever means necessary. So the UK's approach is similar in some respects, but different in others. The one major difference, of course, between the US, Russia and China, is that we don't have the money to set up these major kind of institutional units within a relatively small military of a middle power.

Chris - Do we also have the manpower, Danny? Because in the last 10-15 years, we've been reminded by successive governments that there is a digital skills gap emerging in countries like the UK, and we really need more people who are savvy in this space. Can we lay our hands on the expertise we need in sufficient numbers to build this kind of cyber army that we're envisaging?

Danny - I think we can. I think we already are. I'm not actually worried from that point of view. And what we've seen already with the National Cyber Force, which is already in existence, and will work alongside this new construct, is that that is already making use of existing agencies and bringing skills together, which is what you need to do with cyber.