UK unveils National Cyber Force of hackers to target foes digitally

New unit aims to disrupt online activities of hostile states, terror groups and paedophiles

Britain has unveiled its new National Cyber Force, a unit of offensive hackers that can target hostile states such as China and Russia, terror groups and even paedophiles by disrupting their online communications.

The NCF, controlled by the spy agency GCHQ and the Ministry of Defence (MoD), has been secretly up and running since April with several hundred hackers based in Cheltenham and other military sites around the country.

Little is known about the agency’s activities, but it is understood the bulk of its early operational work has been to disrupt the communications of those deemed to pose a threat to the UK, for example terrorists engaged in an attack plot.

Boris Johnson told the Commons on Thursday that the NCF combines “our intelligence agencies and service personnel” and is “already operating in cyberspace against terrorism, organised crime and hostile state activity”.

The idea is to bring together the scattered offensive hacking capabilities that the UK claims to have had for a decade – and rapidly increase the size of the operation. The NCF plans to increase its staffing around tenfold to 3,000 over the next decade.

An estimated 60 countries have developed offensive hacking capabilities, with Iran and North Korea among the most advanced nations with a track record of targeting the UK, as well as state-sponsored hackers linked to intelligence agencies from Moscow and Beijing.

Britain has rarely talked about its offensive hacking capability, and remains reluctant to do so despite the existence of the new unit. But in 2018, GCHQ said it had conducted “a major offensive cyber campaign” against Islamic State.

At the time its director, Jeremy Fleming, said the operations had made “a significant contribution to coalition efforts to suppress Daesh [Isis] propaganda, hindered their ability to coordinate attacks, and protected coalition forces on the battlefield”.

Other techniques used by the NCF include trying to change behaviour to make it impossible for threats to proceed or dissuading the person behind the threat from carrying their plan out – or simply degrading physical communications systems.

Insiders prefer to focus on their work in countering Isis and other terror groups, but it is understood the NCF can work if necessary against Russia or China. It has also been busy disrupting online paedophile and other sexual abuse networks, regarded as being some of the most sophisticated cyber actors around.

Cyber operations will have to be approved by a minister, typically either the foreign or defence secretary, depending on the nature of the target and the exact assets required. Insiders said it would operate within existing legal controls, and would be subject to oversight from parliament’s intelligence and security committee.

But the intention is that it will operate largely in secret. Its first director, a man, has not been publicly named but it is understood he has been with GCHQ for more than 20 years, often working closely with the MoD.

The NCF had been in the planning stage for a couple of years, struggling to get off the ground amid bureaucratic turf wars. Some Whitehall insiders have questioned whether GCHQ’s intelligence culture and the MoD’s more hierarchical military culture will work effectively together.


Dan Sabbagh Defence and security editor

The GuardianTramp

Related Content

Article image
Ex-hackers could be recruited to UK cyberdefence force
GCHQ to train hundreds of enlisted computer experts including possible convicted hackers for UK cyberdefence force

Haroon Siddique

22, Oct, 2013 @8:46 AM

Article image
US and UK blame Russia for 'malicious' cyber-offensive
Security officials issue alert directly blaming Kremlin for attack as US warns Moscow it is ‘pushing back hard’

Ewen MacAskill Defence correspondent

16, Apr, 2018 @6:23 PM

Article image
Hackers HQ and Space Command: how UK defence budget could be spent
Creation of specialist cyber force and artificial intelligence unit in pipeline

Dan Sabbagh Defence and security editor

18, Nov, 2020 @10:30 PM

Article image
Britain has offensive cyberwar capability, top general admits
Gen Sir Patrick Sanders says Boris Johnson has told him to ensure UK is major cyber power

Dan Sabbagh Defence and security editor

25, Sep, 2020 @5:00 PM

Article image
The Guardian view on cyberwar: an urgent problem | Editorial
Editorial: The internet is now used as a low-level weapon of war. How should Britain best defend itself?


22, Jan, 2018 @5:42 PM

Article image
GCHQ chief: west faces ‘moment of reckoning’ over cybersecurity
Jeremy Fleming to say UK must ‘develop sovereign technologies’ and work with allies to ‘build better cyber-defences’

Dan Sabbagh Defence and security editor

22, Apr, 2021 @11:01 PM

Article image
‘Trident is old technology’: the brave new world of cyber warfare
Forget debates about Britain’s nuclear deterrent. New technology means a country can be brought to its knees with the click of a mouse

Julian Borger

16, Jan, 2016 @8:00 AM

Article image
Priti Patel pressed to explain award of spy agencies contract to Amazon
US firm Amazon Web Services to host classified material for GCHQ, MI5 and MI6, raising sovereignty concerns

Rajeev Syal Home affairs editor

27, Oct, 2021 @7:23 AM

Article image
Hostile states pose 'fundamental threat' to Europe, says MI6 chief
Although Alex Younger does not name specific country, he makes clear that Russia is target of his remarks

Ewen MacAskill Defence and intelligence correspondent

08, Dec, 2016 @1:31 PM

Article image
Inside the British military base where young hackers learn to stop cybercrime
As part of the Cyber Security Challenge UK, law enforcement agencies are putting ‘cyberdefenders’ through their paces

Mark Townsend

19, Aug, 2018 @6:00 AM