UK National Cyber Force reveals strategies to thwart hostile states, criminals

The secretive unit is using its cyber capabilities to counter disinformation campaigns by state actors and impede terrorist groups

clock • 3 min read
National Cyber Force reveals its approach for thwarting adversarial states and criminals
Image:

National Cyber Force reveals its approach for thwarting adversarial states and criminals

Britain's secretive National Cyber Force (NCF) has, for the first time, disclosed its approach to safeguarding the country through offensive cyber operations.

According to GCHQ, the NCF has utilised its cyber capabilities over the past three years to protect foreign military deployments, impede terrorist groups, and counter disinformation campaigns by state actors. Additionally, NCF hackers have endeavoured to minimise the risk of external intervention in democratic elections.

Established in 2020, the NCF is a collaboration between the Ministry of Defence (MOD) and GCHQ, comprising intelligence officers and defence personnel from both organisations.

NCF's mission is to address risks to the UK, assist military activities, and deter significant crimes like terrorism and child sexual exploitation.

NCF's actions have been veiled in secrecy until now; however, it is starting to divulge some of its covert strategies that it employs to thwart hostile nations, criminals, and terrorists.

The government has released these details alongside a 28-page report titled Responsible Cyber Power in Practice, which aims to highlight aspects of "how the UK is being a responsible cyber power".

As per the official paper, the NCF employs tactics to subvert the techniques used by state-sponsored hackers from Russia, China and other countries, and uses "technical disruption" methods to hinder terrorist organisations.

The NCF also penetrates the digital communications of adversarial nations, infiltrating their systems to "sow distrust" and create uncertainty in their data and decision-making.

The NCF's list of operations also encompasses disabling hostile technology to impede essential communication between key individuals during critical moments. They may also manipulate the functionality of IT networks, rendering it more difficult for states to employ the internet to disseminate disinformation.

The NCF acknowledges its willingness to disable an adversary's cyber capability, but contends that it is often more effective to undermine their capacity to gather, analyse and utilise crucial information.

It describes the approach as the "doctrine of cognitive effect," which aims to manipulate an opponent's perception of the operational landscape and weaken their capability to plan and execute activities proficiently.

"The NCF's work is covert and we therefore do not reveal details of individual operations. Indeed the intent is sometimes that adversaries do not realise that the effects they are experiencing are the result of a cyber operation," GCHQ said.

"This ambiguity can help to amplify the cognitive effect".

Jeremy Fleming, director of GCHQ, warned that in a world that is becoming more volatile and interconnected, nations must be capable of competing with their adversaries in cyberspace to be considered a genuinely responsible cyber power.

"With the threat growing and the stakes higher than ever before, we hope this document provides a benchmark for the UK's approach and a basis for like-minded governments to come together internationally to establish a shared vision and values for the responsible use of cyber operations," Fleming said.

General Sir Jim Hockenhull, commander of Strategic Command, noted: "The National Cyber Force is a crucial tool in our integrated approach to national security and our defence of the UK.

"Working across government and with our international allies is vital. There is a power in partnerships, and we must go further to out-cooperate and out-compete states that are driving instability."

For the first time, the government has also revealed the identity of the NCF's commander. James Babbage, a GCHQ intelligence officer with nearly 30 years of experience, has been spearheading the NCF since its inception. Babbage has overseen the expansion of the NCF's operations and played a crucial role in integrating it efficiently with various other agencies and partners.

More on Threats and Risks

3CX supply chain attack: the unanswered questions

3CX supply chain attack: the unanswered questions

Days after the attack was made public the impact on its 6,000 enterprise customers remains uncertain

clock 03 April 2023 • 5 min read
Russian threat group stealing government emails via Zimbra flaw

Russian threat group stealing government emails via Zimbra flaw

Winter Vivern seen targeting entities in European governments that support Ukraine in the war

John Leonard
clock 31 March 2023 • 2 min read
3CX admits supply chain attack

3CX admits supply chain attack

Trojanised version of the 3CX desktop VoIP app observed communicating with C2 servers

clock 31 March 2023 • 2 min read