Select committee inquiry
Cyber security in the UK inquiry
Closed
What the inquiry looked at
“The UK has one of the world’s leading digital economies, making it more vulnerable to cyber-attacks from hostile countries, criminal gangs and individuals, which continue to increase and evolve as it becomes easier and cheaper to launch attacks. While all public and private organisations are responsible for safeguarding their own information, since 2010 government has taken a central lead to ensure the UK effectively manages its exposure to cyber risks. The Cabinet Office leads this work, through successive National Cyber Security Strategies published in 2011 and 2016; and separate National Cyber Security Programmes designed to help deliver each Strategy between 2011-2016 and currently between 2016-21. In March 2019, the National Audit Office (NAO) published a report which found that the first national cyber security programme for 2011-2016 did not achieve sufficient change to stay ahead of the cyber threat. The report further notes that the Department did not undertake a comprehensive lessons-learnt evaluation of the first programme, so there was no robust baseline to inform the current Programme. Finally, the report underlines that the Department did not produce a business case for the Programme, meaning there was no way to assess how much funding was required for it. The Committee’s report on Protecting information across government in 2017 concluded that it had taken too long to consolidate and coordinate the ‘alphabet soup’ of agencies involved in protecting Britain in cyberspace. The Committee also considered cyber security risks in 2018 in its reports on Online Fraud and Wannacry, the cyber-attack on the NHS . On 1 April, the Committee will question Sir Mark Sedwill, Cabinet Secretary and National Security Adviser, along with other senior officials from the Cabinet Office and National Cyber Security Centre about the failure to establish its current strategy in line with good practice. Members will also ask how and by when the Department will improve the performance of the current Programme, as well as challenge officials to provide a commitment on how it plans to build on its current cyber security beyond 2021. The Committee may also want to use this session to question Sir Mark Sedwill, the former Permanent Secretary at the Home Office, on Windrush, the Disclosure and Barring Service (DBS) and the emergency services network (ESN).”
The committee's words, from the inquiry page on parliament.uk ↗.
What it found
In the committee's words, from the summary of 99th Report - Cyber security in the UK ↗
The UK has one of the world’s leading digital economies, designed to exploit the benefits of the internet, but this also makes it vulnerable to attack from hostile countries, criminal gangs and individuals. To counter this threat, and continue to support the UK’s digital government and economy, since 2011 the Cabinet Office (the Department) has managed two, five-year national cyber security strategies. The Department is beginning to make progress in meeting the strategic outcomes of the current, 2016–2021 National Cyber Security Strategy after a poor start. However, a weak evidence base and the lack of a business case for the National Cyber Security Programme that helps to deliver the Strategy make it difficult for the Department to assess whether it will meet all its objectives by 2021. A lack of a business case also means it is unclear whether the money allocated at the start of the Programme was the right amount, making it more difficult to judge value for money. Digital technology and online services are fast-moving areas and constantly evolving, and we are concerned that consumers do not know how safe the websites or internet-enabled products they use are. There is clearly more that the government needs to do to make progress in this area.
What the government said
How the inquiry ran
Each dot is a dated item listed on this page, from the inquiry's opening on 15 March 2019 to 5 November 2019.
- Oral evidence 1 Apr 2019
- Report 5 Jun 2019
- Correspondence 3 letters
What it recommended 0 recommendations · 18 conclusions
1The UK is particularly vulnerable to the risk of cyber-attacks.
Concluded (the committee's words)
The UK is particularly vulnerable to the risk of cyber-attacks. As one of the world’s leading digital economies and global leader in putting government systems online, the UK is especially vulnerable to cyber-attacks. The National Cyber Security Centre (NCSC) has dealt with over 1,100 cyber security incidents since it was established in October 2016. The cyber-attack threat is evolving fast and becoming technically more complex, with the boundaries between state-orchestrated attacks and those of cyber criminals increasingly blurred. The government introduced a coordinated approach to cyber security in 2010 and has since published two, five-year strategies (National Cyber Security Strategy 2011–2016, and National Cyber Security Strategy 2016–2021). It has yet to set out its plans for its approach to cyber security after
2The Department cannot justify how its approach to cyber security is delivering value for money.
Concluded (the committee's words)
The Department cannot justify how its approach to cyber security is delivering value for money. The £1.9 billion funding for the Strategy, including £1.3 billion for the Programme, was allocated via the 2015 Spending Review. The Department did not develop a business case for the Strategy or the Programme, although teams that manage each of the 12 objectives that make up the Programme do produce their own annual business cases. This means that the Department did not assess at the start whether £1.3 billion was the right amount needed to deliver the Programme and makes it more challenging to assess value for money. The Department acknowledges that it was not absolutely confident that the funding was at the right level, and that the estimated funding relied on a judgement about the resources required, the level of risk involved and the impact intended. It asserts that as its approach was cutting edge there was no existing approach or model for building a national cyber security strategy or programme on which the Department could base its assessment. The Department is nonetheless unable to explain what proportion of the overall Strategy the Programme itself is expected to deliver. In addition, a third (£169 million) of the Programme’s planned funding for the first two years was either transferred or loaned to support other government national security priorities, such as counter- terrorism activities. Some £69 million of this funding will not be returned to the Programme, which seems at odds with the government’s claim that cyber security is a priority. Recommendation: The Department should ensure that, to support any follow- on, long-term and coordinated approach to cyber security, it produces a properly costed business case.
3The Department lacks the robust evidence base it needs to make informed decisions about cyber...
Concluded (the committee's words)
The Department lacks the robust evidence base it needs to make informed decisions about cyber security. The evidence base used to measure progress of the Strategy is weak. The Department has admitted that it has ‘low confidence’ 6 Cyber security in the UK in the evidence used to assess progress against half of the Strategy’s 12 strategic outcomes, and only has ‘high confidence’ in the evidence related to one strategic outcome—incident management. The Department did not conduct a robust ‘lessons learnt’ exercise to capture the evidence from the 2011–2016 National Cyber Security Strategy to help develop a baseline for the 2016–2021 National Cyber Security Strategy. Although the Department has been involved in aspects of cyber security for many years it often lacks evidence around the impact of its work; for example, on the demand for cyber skills. However, the Department has developed sufficient understanding in some areas to stop work where it is clear the desired impact has not been achieved. Its active cyber defence work is making good progress in generating evidence for future investments. Looking ahead, the Department is beginning work to ensure that it captures the relevant lessons from the current Strategy and hopes to develop a continuous process of learning rather than waiting until the Strategy ends in 2021. Recommendation: The Department should write to the Committee by November 2019 setting out what progress it is making in using evidence-based decisions in prioritising cyber security work. This should include plans for undertaking a robust ‘lessons learnt’ exercise to capture all relevant evidence from the current Strategy and Programme to support any future approach to cyber security.
4The Department has not been clear what the Strategy will actually deliver by 2021.
Concluded (the committee's words)
The Department has not been clear what the Strategy will actually deliver by 2021. The Department asserts that it didn’t intend to deliver all 12 strategic outcomes by the end of the Strategy in 2021, although it is unable to say how many it did intend to achieve. The evidence we heard suggests the Strategy committed to delivering 2 outcomes by 2021, although currently it is only on track to deliver a single strategic outcome, ‘incident management’. The Department’s ‘low confidence’ in the quality of the evidence underpinning the assessment of progress against many of the remaining 11 strategic outcomes gives us little confidence in the Department’s progress up to 2021. Regarding the performance indicators for the Programme that support the Strategy, the Department is currently achieving only three of its 12 objectives. Unlike during the 2011–2016 National Cyber Security Strategy, the Department has not published any updates on progress since the current Strategy began, despite agreeing in the Strategy to report progress on an annual basis. It has committed to doing so in future and expects to produce its first report in May 2019. Recommendation: When the Department publishes its costed plan in autumn 2019 for its future approach to cyber security it should also set out what the existing Strategy and Programme should deliver by March 2021, and the risks around those areas where it will not meet its strategic outcomes and objectives.
5Government has not yet done enough to enhance cyber security throughout the economy and better...
Concluded (the committee's words)
Government has not yet done enough to enhance cyber security throughout the economy and better protect consumers. It is difficult for consumers to know whether the internet-enabled devices they buy or the companies they give their details to online are holding their information securely. For example, a trusted brand like British Airways was hacked in 2018, and the personal data of 380,000 customers was stolen. There is currently no ‘traffic light’ or ‘kitemark’ system to inform consumer choice on how cyber secure the products they buy are, unlike recognised standards in other areas—such as food safety. This is a difficult area for government to influence and regulate, although it has made some progress. For Cyber security in the UK 7 example, the NCSC has promoted two-factor identification to make thefts of basic personal information less valuable to criminals on the open market. The NCSC has also worked with the Bank of England to build better cyber security standards. Rather than trying to impose a list of requirements on the banking sector, which may become rapidly outdated, the NCSC has provided technical advice to allow the Bank to best judge how to incorporate cyber security into its statutory mandate to promote financial stability. A similar approach could be developed to support other sectors of the economy, such as retail. Government also needs to involve larger organisations to make sure they realise the responsibility they have to encourage the smaller and more vulnerable companies that sit within their long supply chains to get their basic cyber security right. To help this process in 2018 NCSC published a guide specifically aimed at small and medium enterprises in an effort to get these organisations to improve their “basic hygiene” in terms of cyber security. Recommendation: The Department should write to the Committee by November 2019, outlining how it intends to influence the different sectors in the economy—for example, retail—to provide consumers with information on their cyber resilience. As part of this it should outline how they intend to measure success in protecting consumers. This should also form part of its approach to cyber security after 2021. 8 Cyber security in the UK 1 Delivering the National Cyber Security Strategy
6The Department explained that the government divides cyber threats into two types: strategic state actor...
Concluded (the committee's words)
The Department explained that the government divides cyber threats into two types: strategic state actor threats and the more common and high-volume cyber-crime attacks. Part of the aim of the NCSC is to enable the country to be better equipped to deal with the low level, high volume cyber-crime attacks and can defend against them, so that cyber experts can concentrate on the high level, complex attacks which are more individual in nature.10 The Department told us that it has built a free service that most NHS bodies and some local authorities use that allows them to scan for vulnerabilities on their networks, which tells them what is wrong and shows how to take basic precautions. Within local government around 4,000 vulnerabilities to cyber-attacks have been identified and fixed in the two years since the tool was introduced.11
7The Department told us that the Spending Review of 2015 allocated £1.9 billion over five...
Concluded (the committee's words)
The Department told us that the Spending Review of 2015 allocated £1.9 billion over five years for the Strategy and £1.3 billion of this for the Programme.12 As the Department did not produce a business case for either of these allocations, it does not know if £1.3 billion is the right amount to deliver the Programme. The Department explained that the amount of money required for the Strategy and Programme was based on a judgement about the level of resources, the level of risk and the impact that a particular programme or strategy was trying to achieve that would lead it to an allocation. The Department also told us that as the UK was at the cutting edge of developing a cyber security strategy there was no model elsewhere in the world that showed what did and didn’t work, therefore a judgement had to be made as to what should be included in the Programme. The Department could not explain in further detail how it how it arrived at the amount of money allocated and whether this was the right amount to deliver the Programme.13
8Although cyber security is one of government’s top priorities, the Department reprofiled Programme funding in...
Concluded (the committee's words)
Although cyber security is one of government’s top priorities, the Department reprofiled Programme funding in its first two years. The Department explained that the Verify and Foxhound projects were given £69 million, and £100 million was loaned to counter-terrorism activities. It told us that around 50% of the £100 million was returned to the Programme by March 2019, with the remaining 50% expected to be returned in 2020–21. The Department told us that the reprofiling helped it to develop more innovative cyber security work, as it gave it the opportunity to test what would and wouldn’t work. It similarly told us that this has meant, for example, that the active cyber defence element 8 C&AGs Report, paras 1.19, 3.6 9 Qq 65, 119 10 Qq 65, 120 11 Q67 12 C&AG’s Report, para 1.19, Q82 13 Qq 82–86 10 Cyber security in the UK of the Programme was given more money in the remaining years of the Programme— as during the financial reprofiling in the first two years it undertook pilot projects that showed which interventions worked.14 The lack of an evidence base
9The Department acknowledged that it could have done more to understand the evidence base of...
Concluded (the committee's words)
The Department acknowledged that it could have done more to understand the evidence base of the first National Cyber Security Programme which covered 2011–2016. The Department told us it conducted a ‘lessons learnt’ exercise, but admitted that with hindsight it could have been more robust than it was.15 We asked how the Department could be confident that it was making the right decisions about levels of funding and priorities within the Programme without the evidence of what works that a robust lessons learned exercise would have provided.16 The Department asserted that it had nonetheless learned some valuable lessons from the first programme, the main lesson being that government needed to be more interventionist, and as a result it changed its policy.17 The Department told us that it had introduced a number of new and innovative projects at the beginning of the 2016–2021 Programme, and that there was continual testing by government of these projects of what worked and what didn’t. It similarly told us that it had stopped projects that were not working and took the decision to invest more money into projects, such as active cyber defence, which were working.18 However, as the National Audit Office observed, while some of the things that are being funded as part of the second cyber security programme are genuinely new and innovative, others are continuations of activities funded as part of the previous cyber security programme. The National Audit Office told us that it would therefore have expected the Department to have had a stronger evidence base for these areas in place to support the second Programme.19
10We similarly asked the Department why it had taken it until 2018, halfway through the...
Concluded (the committee's words)
We similarly asked the Department why it had taken it until 2018, halfway through the current Programme, to introduce a new performance framework. Prior to this, the individual departments that led each of the 12 strategic outcomes included within the Programme reported on progress. The Department told us that the evaluation of each outcome was originally carried out by individual departments to reflect the devolved funding arrangements for the Programme. However, the 2017 National Security Capability Review found that the centre of government needed to have a better overview of the Programme, so performance measurement was centralised in the Department. The Department acknowledged that there are still gaps in its evidence base and told us that it was working to fill these gaps.20 It told us that there were some areas where there was no evidence for a certain approach to be taken and where a judgement call will need to be made. The Department provided the example of the establishment of the NCSC, for which there was no evidence that the unprecedented step of bringing the secret work of a body like the Government Communications Headquarters (GCHQ) into the open would work.21 It nonetheless committed to collecting evidence of performance and lessons learned throughout the Programme, and confirmed that it would not wait until 2021 to 14 Qq 86–89 15 Qq 68–69, 77–78 16 Q 105 17 Qq 68–69 18 Q86 19 Q 105 20 Qq 79–80, 106 21 Qq 104–107 Cyber security in the UK 11 capture lessons from the current Programme and was already working to capture those lessons on an ongoing basis.22 Although the Department set out in the Strategy that it would provide annual updates on the progress of the Strategy, is has so far not published any. The Department told us that it intends to start publishing progress reports, the first of which is due to be published in May 2019.23 22 Qq 79–80, 106 23 Qq 80–81, C&AG’s Report para 2.16 12 Cyber security in the UK 2 Planning for the future Delivery of the Programme to March 2021
11The Department currently expects to meet just one of the 12 strategic outcomes in the...
Concluded (the committee's words)
The Department currently expects to meet just one of the 12 strategic outcomes in the current Strategy by 2021. We asked it to explain why this was the case if it considered that its current approach was working.24 The Department explained that the Strategy recognised that not all the strategic outcomes would be achieved within its five year timescale, although it hoped it might achieve them all.25 However, the National Audit Office found that two of the 12 strategic outcomes—‘secure by design’ and ‘science and technology’—have specific objectives that should be met by 2021. The rest are open-ended. The Department explained that its performance measures for each of the outcomes in the Strategy related to the confidence it had in the evidence that the strategic outcome will be achieved, not the actual deliverability of the strategic outcomes.26 The Department told us it currently has ‘low confidence’ in the evidence used to assess progress against half the Strategy’s 12 strategic outcomes and it only has ‘high confidence’ in the evidence related to one strategic outcome—which is incident management. The Department acknowledged the weakness of this evidence base, but asserted that some areas of its work, particularly those there were more innovative, were very difficult to measure.27 For example, it told us that it had a good evidence base for incident response as this is relatively easy to measure. It told us that there were other areas, such as improving the pipeline of cyber skills in the UK, where it will take a number of years for the Department to know whether its interventions in schools, for example, have been successfully delivered.28
12Of the 12 objectives within the Programme, the Department told us that three were on...
Concluded (the committee's words)
Of the 12 objectives within the Programme, the Department told us that three were on track, and a further eight objectives had 80% or more of their projects on schedule. It told us that while one project had 73% of its projects on track, it was moving in the right direction.29 We asked the Department how much of the Strategy the Programme was meant to be delivering. The Department explained that the Programme was meant to have a catalytic and transformative impact on both the public and private sector. However, it also told us that there were other projects outside the Programme that will also help deliver the Strategy, including money spent by government departments as part of their business-as-usual work to improve their IT and private sector initiatives and investment in their networks and systems.30
13The Department is still considering its approach to cyber security after 2021, but expected to...
Concluded (the committee's words)
The Department is still considering its approach to cyber security after 2021, but expected to have a single, portfolio-based business case, rather than its current approach where each of the 12 strategic outcomes of the Strategy has its own, separate business case. The Department expects that it will focus on three elements: improving cyber resilience; continuing to build capability to deal with threats; and making sure that the UK is the safest place in the world to do business online.31 24 Qq 97–101 25 HM Government, National Cyber Security Strategy 2016–2021, p.69, Qq99–100 26 Qq 101–102, C&AG Report, para 3.14 27 Q76–77, 101 28 Q103 29 Q98 30 Qq 98–99, 86 31 Qq 109, 113–119 Cyber security in the UK 13 Protecting consumers
14Consumers have no way of telling if the online sites they are using or the...
Concluded (the committee's words)
Consumers have no way of telling if the online sites they are using or the internet- enabled products they are buying are safe to operate or if companies are following best practice in building in cyber security.32 For example, a trusted company like British Airways was hacked in 2018, and the personal data of 380,000 of customers was stolen.33 The Department told us that government had made a range of guidance publicly available on its website covering common cyber security issues, such as the promotion of two-factor identification, where a user requires a second source to verify their identity in addition to a password; and the Cyber Essentials scheme run by the Department for Digital, Culture, Media and Sport that businesses can use. The Department explained that over the past 20 years the web economy has been based on consumers providing their personal data to organisations in return for a service.34 The NCSC told us that cyber security was not thought of when internet-enabled products were being designed, and Western countries did not really understand the security requirement of evolving technology and is now paying for those mistakes.35
15We asked the Department if there should be a mandatory certification scheme for organisations operating...
Concluded (the committee's words)
We asked the Department if there should be a mandatory certification scheme for organisations operating online with regards to cyber security standards. The Department told us that although there is a role for regulation, particularly within the critical national infrastructure sector, it is hard to draw up a list of organisations and specify what they must do as this becomes outdated quickly.36 It suggested that a different model could be used, similar to the approach the Bank of England has adopted for banks, where it has worked with the NCSC to draw up technical standards that should be built into cyber security regulation by the Bank.37 The Department also told us that there are some areas where private sector organisations will not invest, or where only government can intervene; for example, the NCSC intercepting spoof emails. In one year the NCSC collected half a billion spoof emails pretending to be HMRC, and these stopped appearing in peoples’ inboxes. The NCSC told us that this method has been tested with commercial providers, such as retailers.38
16The NCSC published a guide for SMEs in the 2018 budget, which set out the...
Concluded (the committee's words)
The NCSC published a guide for SMEs in the 2018 budget, which set out the government’s expectation about cyber security measures within these organisations. The Department explained that government does not expect SMEs should have the same defences as larger organisations, but that they should have in placed defences against cyber- attacks that are proportionate to the size of their organisation. However, the Department also pointed out that that many SMEs are in the supply chains of larger organisations and can be a point of entry for cyber hackers. The Department told us that it considered it the responsibility of larger organisations to encourage their supply chains to get basic cyber security right.39
17The Department recognised that, as the internet is a global network, it needs to work...
Concluded (the committee's words)
The Department recognised that, as the internet is a global network, it needs to work closely with international partners when addressing cyber security. We asked the 32 Qq 74–75 33 Forbes, ‘This Is How 380,000 British Airways Passengers Got Hacked’ 34 Qq 74–75 35 Q 112 36 Qq 121–122 37 Q 122 38 Q 91 39 Q 123 14 Cyber security in the UK Department if there were other countries we could learn from in terms of cyber security. It told us that there were not many reliable international indexes, although Canada has a good record in protecting its government networks. The NCSC told us that some countries, including Canada and Australia, are following the UK model. In addition, the NCSC told us that the UK also aims to encourage international organisations to adopt best practice in protecting their networks.40 We asked the NCSC how it worked in the international arena as the internet is a global network. The NCSC told us that there are three ways of looking at this issue. The first is areas in which the UK can do something either by encouraging— or mandating, where possible—transnational companies to adopt segmented networks rather than flat ones. A flat network allows an attack on a network on one country to expand to other countries—as there is no segmentation of the network. The second is to make UK infrastructure a less attractive target for cyber-attacks by reducing the ability of hackers to operate from within the UK. The third way to work in the international arena to help combat cyber-attacks is to publish evidence of the interventions that the NCSC has made that work and hope that other countries will use them as well.41
18While many of the cyber risks faced by the UK are from outside of Europe,...
Concluded (the committee's words)
While many of the cyber risks faced by the UK are from outside of Europe, we also heard of an increase in the number of cyber-attacks from within the European Union. We therefore asked the Department about the UK’s relationship, and agreements in place, with organisations across Europe that currently help protect the UK from cyber-attacks. The Department told us that its response to the UK leaving the European Union in terms of cyber security will depend on whether the UK leaves with or without a withdrawal agreement in place.42 It told us that if the UK left without a withdrawal agreement, the existing cyber security measures “will be severed”, creating risks that it would have to mitigate against. If the UK leaves with an agreement, then these measures would form part of the agreement that had been reached, although the Department accepted that some areas, such as the UK’s access to the second-generation Schengen Information System (SIS II), would require further negotiation as the EU does not yet have the legal instruments to extend capabilities to third countries.43 The Department told us that the government would like to ensure that access to SIS II is available to the UK and that it would form part of the negotiation with the EU in the implementation period.44 It told us, however, that it would expect to be able to agree this during the implementation period as “there is strong intent on both sides” to maintain existing access arrangements. 40 Qq 124–127 41 Q 127 42 Q 128 43 Q 132 44 Qq 133–134 Cyber security in the UK 15
Evidence
Oral evidence sessions 1
- 1 Apr 2019No witnesses recordedparliament.uk ↗
Correspondence 3 letters
- 5 Nov 2019Letter from the Cabinet Office to Chair regarding cyber security in the UK - dated 4 November 2019To committee
- 8 Oct 2019Letter from Madeleine Alessandri to Chair, in response to the Committee's report on Cyber security in the UK - dated 26 September 2019To committee
- 11 Jun 2019Letter from the Cabinet Office to Chair, regarding National Cyber Security Strategy update - dated 31 May 2019To committee