First Report - A hostage to fortune: ransomware and UK national security

A major ransomware attack could have a devastating impact on UK citizens and the economy, and undoubtedly represents a major threat to UK national security. A sophisticated ransomware ecosystem has evolved, with criminals able to purchase advanced forms of malware and access points in order to conduct profitable and damaging attacks. This has made it much more widely available to those who wish to inflict harm for profit, and increased the scale of the threat.

Past attacks demonstrate that ransomware can cause severe disruption to the delivery of core Government services, including healthcare and child protection, as well as causing ongoing economic losses. Mass data loss from an attack can be irreversible, even when the ransom is paid. Given the damage wrought by these uncoordinated ransomware attacks, a coordinated and targeted attack has the potential to take down large parts of the UK’s critical national infrastructure and public services and—in the words of the National Crime Agency—to bring the country to a standstill. It would also shine a spotlight on the inadequacy of the Government’s efforts to secure the UK against ransomware, and to prepare for the aftermath of a major cyber-attack.

Russian-speaking actors are the source of most attributable ransomware attacks against UK targets. The Russian Government’s tacit (or even explicit) approval of these attacks is consistent with the Kremlin’s disruptive, zero-sum-game approach to the West. It also provides revenue to the Putin regime’s well-oiled network of corruption and criminality. This is not a straightforward state threat, however. For many Russian hackers, ransomware is simply an easy way to make large sums of money, with next-to-no chance of being caught or prosecuted. Regardless of the extent of state involvement, or whether they are ideologically driven rather than financially, the sheer scale of the threat demonstrates how vital it is that the UK is adequately resourced to upscale its defences, and to prepare for a major attack. (Paragraph 32) Strengthening our defences — UK preparedness and resilience

The Government and the National Cyber Security Centre (NCSC)—the public- facing arm of GCHQ—have focused significant efforts on enhancing the UK’s cyber resilience, with particular attention paid to major operators of critical national infrastructure (CNI). Nevertheless, UK CNI remains vulnerable to a catastrophic ransomware attack, particularly in sectors in which investment in upgrading legacy infrastructure has been inadequate. Supply chains are also particularly vulnerable, and have been described by the NCA as the ‘soft underbelly’ of CNI. With different CNI operators sharing the same supplier, a single attack could also affect multiple sectors at once, with damaging and widespread consequences.

Unlike many areas of national resilience, the Government has imposed cyber resilience requirements on most CNI operators through the 2018 Network and Information System (NIS) regulations, and has also committed to imposing new 62 A hostage to fortune: ransomware and UK national security cyber resilience standards on CNI by 2025. There are significant issues with the implementation and oversight of the existing regulations, however, linked to a lack of regulator capability and cyber skills. Plans to extend the NIS regulations to CNI supply chains need to be accompanied by further work to ensure that they can be implemented effectively. The Government must scope the feasibility of establishing a cross-sector regulator on CNI cyber resilience to oversee the implementation of the NIS regulations, and to make recommendations for investment and legislative reform. The Government should report back to us on the outcome of this scoping work by March 2024.

We welcome the Government’s efforts to reinvigorate the National Exercise Programme. The majority of UK CNI is run by private operators, however, so it is vital that these companies are invited to participate in the Programme. The exercises should also consider broader impacts, beyond a single infrastructure sector. As part of the National Exercise Programme, the Government should hold regular national exercises to prepare for the impact of a major national ransomware attack affecting multiple CNI sectors, engaging CNI operators to stress-test their response and ensure a swift recovery. It should also ensure that the insights from these exercises are fed back to Lead Government Departments and regulators, so that they enhance preparations for future potential attacks.

Although we recognise the value of peer support, it should not have fallen to Redcar and Cleveland Council’s Leader to train other councils how to prevent and respond to cyber-attacks, following their own devastating attack in 2020. Local authorities are on the frontline of support for the most vulnerable in society. The Government needs to provide much more active support. This should include how to prevent and respond to major cyber-attacks, recognising the extremely challenging financial circumstances in which they operate. The Government’s understanding and expectations regarding local aut.hority preparedness has developed since 2021. However the problem persists, the NCSC Annual Review for 2023 reported that 73% of reports to the NCSC Vulnerability Reporting Service have come from Local Government and local services. We recognise and welcome the work undertaken by the NCSC so far, but urge the Government to pursue a more focused effort which proactively seeks to support local government with preventative support and strengthened resilience measures. The NCSC should be funded to establish an enhanced and dedicated local authority cyber resilience programme, including intensive support for local exercising and on securing council supply chains. (Paragraph 58) Responding to attacks — victim support and recovery

Many ransomware victims feel there is insufficient support from law enforcement or Government agencies, with limited state resources focused on the most critical organisations. For smaller organisations and those falling outside the boundaries of critical national infrastructure, the NCSC’s post-incident support appears limited to a list of approved cyber incident response companies, which may be beyond the financial reach of many victims. These gaps in support apply to important elements of the public sector too, including schools and colleges, and stand in stark contrast to victim support for comparable thefts or ransom demands in the offline world. The NCSC and NCA should be funded to provide negotiation, recovery and remediation A hostage to fortune: ransomware and UK national security 63 capabilities to all public sector victims of ransomware, to the point of full recovery. The NCSC should also explore, with the cyber incident response industry, the possibility of establishing a ‘pro bono’, industry-led scheme for charities and small businesses, akin to those provided by many major law firms.

The emphasis on supporting high-risk individuals and protecting electoral integrity is undoubtedly welcomed. We would, however, welcome a more direct approach from the NCSC in their offer of support to political parties and high-risk individuals. It is unclear if the support for ‘high risk individuals’ will be offered to all parties before, during, and after an election and what work the NCSC is doing to preserve the integrity of free and fair elections in the UK overall. This work is vital to defending democracy and providing impartial support. Our committee therefore requests a private briefing on the preparation that is being put together for an upcoming election and how this support will be provided and delivered.

Cyber insurance can provide a vital lifeline for ransomware victims, offering the sort of support and technical advice not offered by state agencies, as well as driving up cyber security standards through conditions of coverage. Unfortunately, there remains a woeful lack of UK coverage: premiums are unaffordable for many organisations, and have increased drastically in recent years. There are precedents for more extensive Government interventions, where market failures in insurance have wider societal implications. Given the losses endured by ransomware victims and the costs to businesses and public finances, there is a strong economic case for the Government to do more. The Government should work with the insurance sector to establish a re-insurance scheme for major cyber-attacks, akin to Flood Re, to ensure the sustainability and accessibility of the market.

Victims are currently disincentivised to report ransomware attacks, making it difficult to understand fully the nature and scale of the threat, and how best to tackle it. The Director General of the NCA has suggested that it would be unusual for the Government to require any victim of crime to report an attack—but there are usually greater incentives for reporting of serious crime to take place. The US has also recognised this unique challenge, legislating to mandate reporting by CNI operators. The Government acknowledges that this lack of data creates challenges for the policy response, and experts have told us that it reduces their understanding of how best to protect other organisations against future attacks. The Government should urgently establish a central reporting mechanism for ransomware attacks, and consider whether to require all UK organisations to report an attack within three months. As part of reporting arrangements, the Government should specify that companies disclose: • Which systems or data have been compromised; • The identity and tactics of the attackers, if known; • Technical details, such as the performance of security and operational systems whilst under attack; • Key details on how the organisation has responded, including communication with secondary victims; and 64 A hostage to fortune: ransomware and UK national security • Which regulators have been notified. The data should be kept securely and used for threat intelligence, disruption and prevention work. It could also contribute towards a quarterly, anonymised public report on key ransomware trends.

While the Government maintains that UK victims should not pay ransoms, it is the only viable option for many of those directly affected, enabling them to keep their businesses afloat and prevent damaging leaks of personal data. Too many organisational leaders are left to face this moral dilemma alone, without any state intervention. The NCSC must produce more detailed guidance—accessible to a non- technical audience—on how best to avoid the payment of ransoms after an attack, including negotiating techniques and sources of support for smaller organisations. (Paragraph 80) The strategic response — the Government’s structures and approach

The Government has acknowledged that ransomware is the number one cyber security threat to the UK. It is therefore welcome that it has published an ambitious National Cyber Strategy (NCS), with some strong commitments on resilience and the cyber security of core Government functions, both of which are vital to defending the UK against ransomware. It is also positive that the Cabinet Office has identified the Deputy Prime Minister as holding ministerial responsibility for the National Cyber Strategy, and that there is a cross-government steering group of senior officials to drive delivery work on ransomware. This is a better state of affairs than we have uncovered for some other cross-Government security risks. Nevertheless, there is still a lack of emphasis on prevention and a clear understanding of preventative measures. We remain concerned by the lack of cross-government ministerial fora for overseeing NCS implementation, given the National Security Council’s very wide remit and limited schedule of meetings. The Government should establish an NSC sub-committee on the National Cyber Strategy, which should consider progress against each of the five ‘pillars’ at least twice per year.

The National Audit Office (NAO) criticised previous delivery failures in cyber security in 2019, finding that the Government risked making the same mistakes with its subsequent National Cyber Strategy. The Government’s Performance Framework for the 2022 NCS appears to be a reasonably rigorous approach to monitoring delivery, but its latest Progress Report sheds little light on whether it will achieve the NCS’s ambitious objectives, particularly on disrupting and deterring offenders. Given the criticality of the NCS to the UK’s national security and prosperity, it is vital that the Government’s progress in implementing the NCS is exposed to external scrutiny. We recommend that the NAO reviews the Government’s progress in implementing the National Cyber Strategy through the National Cyber Programme and associated departmental activities, and the effectiveness of the NCS Performance Framework at monitoring and driving delivery.

It is potentially concerning that the Conflict, Stability and Security Fund (CSSF) has now been merged with the National Cyber Programme—which delivers aspects of the National Cyber Strategy—as part of the new Integrated Security Fund (ISF). We recognise that this could encourage a more integrated approach to the UK’s A hostage to fortune: ransomware and UK national security 65 domestic and international cyber work, enhancing our allies’ resilience against ransomware actors and addressing threats to the UK’s critical supply chains. Given the wide remit of the ISF, however, there is also a risk that cyber work could be deprioritised against other security objectives, at a vital time for the UK’s active engagement on cyber security with our international partners. Funding for overseas work also risks being diverted towards domestic priorities, in the face of political pressures closer to home—a risk that we also highlighted in our recent report on the CSSF.

To ensure ongoing transparency and accountability, the Government’s Annual Progress Report on the National Cyber Strategy should remain distinct from any Annual Report on the Integrated Security Fund, and should specify how the Government is using ISF funding to deliver NCS objectives. Through its Annual Report and statements to Parliament on the ISF, the Government should continue to make clear the regional, programmatic and thematic allocations for the Fund, as it has done for the CSSF. Finally, as recommended in our recent report on the CSSF, the Government should similarly maintain the CSSF’s current levels of transparency in the publication of information on programme activity, spend and performance.

The Home Office claims the lead on ransomware as a national security risk and policy issue, but the then Home Secretary, Suella Braverman MP, showed no interest in it. According to some observers, clear political priority is given instead to other issues, such as illegal migration and small boats. We recognise the significance of illegal migration as a policy challenge, but there is a risk that ransomware is relentlessly deprioritised. The Department’s ransomware ‘sprint’ in 2022 resulted in no discernible policy outcomes. The Minister for Security’s acknowledgement of how out of date the Computer Misuse Act is does not excuse the lack of progress which has been made to legislate in this space. It has been two-and-a-half years after its main consultation and 33 years since that dated legislation received Royal Assent. It is hard to see how the Criminal Justice Bill brought forward by the King’s Speech 2023 will sufficiently cover the gap left by the outdated CMA.

In line with many other aspects of cyber security, and to ensure that it is treated as a cross-government national security priority, responsibility for tackling ransomware should be transferred from the Home Office to the Cabinet Office, in partnership with the NCSC and NCA. It should also be overseen directly by the Deputy Prime Minister, as part of a holistic approach to cyber security and resilience. (Paragraph 102) Raising the costs for attackers — who pays?

The National Crime Agency is locked in an uphill struggle against the ransomware threat, which is now so sophisticated that even the most highly-protected organisations expect to experience a ransomware attack. There is clear value in the Government’s resilience work, but it is vital that this is paired with further work to raise the costs for attackers, to make the UK a less attractive target. Based on the evidence we have seen, the NCA has insufficient resources and capabilities to match the scale of this challenge.

It is possible to infiltrate and disrupt ransomware groups’ infrastructure without arresting the criminals involved, sometimes even preventing attacks after the initial 66 A hostage to fortune: ransomware and UK national security infiltration has taken place. The NCA has some offensive capabilities, but it is vital that the UK is able to operate on a level footing with its international partners. The Government should invest significantly more resources in the NCA’s response to ransomware, enabling it to pursue a more aggressive approach to infiltrating and disrupting ransomware operators.

The NCA’s resourcing challenges are exacerbated by the Government’s failure to allow them to offer salaries that might attract those with specialist skills. It will always be difficult for the NCA to compete with the private sector, particularly for roles requiring high-level cyber skills, but it is unacceptable that NCA officers are paid less than their policing counterparts. As the elite national squad for serious and organised crime, the public would rightly expect the NCA to offer a competitive pay package, in recognition of the more specialist skills required for defending the UK against serious organised crime. The Home Office and Treasury should urgently revisit the funding available for NCA pay and progression, which has been an obstacle to achieving pay parity between police forces and NCA officers.

The Government and NCSC’s approach to ransomware is often framed through the language of state threats. While we recognise that operators are often facilitated by the Russian harbour state, ransomware is primarily a problem of criminality for profit, rather than espionage or geopolitical sabotage. Through the 2021 Integrated Review and its 2023 Refresh, the Government has acknowledged that the blurred lines between state threats and serious and organised crime require more threat- agnostic capabilities—and yet ransomware is currently at risk of falling into a ‘no man’s land’ between state threats and criminality.

Given the links between ransomware crime and certain state actors, it is striking how little attention has been paid to the potential for international law to target the collusion of states. In Chapter 2, our report highlights the possibility that Russia’s approach could constitute a violation of international law. Recognising that Russia shows little, if any, respect for international law, the FCDO should nevertheless investigate the possibilities for legal sanctions and international cooperation to deter state-linked ransomware crime.

The Government’s response to ransomware is conducted partly through the National Cyber Force and the intelligence agencies, on which we can only access limited information. RUSI has argued that the UK intelligence community may not be sufficiently motivated or resourced to tackle ransomware, but it is vital that the NCA’s work is properly supplemented by the other agencies. In light of these concerns, and to ensure full scrutiny of state capabilities on ransomware, we recommend that the Intelligence and Security Committee scrutinises the extent and nature of the resources and capabilities devoted to disrupting ransomware operatives by the intelligence agencies, as opposed to combating broader state-sponsored cyber threats. We also recommend that the Committee examines how the intelligence agencies work in partnership with the NCA to deploy a full-spectrum response to the ransomware threat, as envisaged by the Integrated Review and IR Refresh, and how this compares with the US agencies’ ‘full statecraft’ approach to ransomware.

Crypto-assets are the lifeblood of the ransomware ecosystem, and have been a major driver of the increased threat. The Government is making welcome reforms to the A hostage to fortune: ransomware and UK national security 67 UK’s legislative regime underpinning crypto-asset seizure, but we have heard that the NCA has insufficient capacity and skills to make full use of its existing powers, which might be why its total crypto seizures decreased by over a third between 2021/22 and 2022/23. It is essential that the UK bears down on the vast profits of these criminal groups. The Government and NCA must prioritise further resources towards the training and recruitment of officers with skills in crypto-asset trace and seizure, to reduce the incentives for criminals and to claw back some of the financial losses experienced by ransomware victims.

The UK’s main legislative framework on cybercrime is over 30 years old. In that time, the country’s relationship with the online world has changed beyond recognition, along with the scale and nature of cybercrime. Rather than introducing a Bill, however, the Home Office has run a second consultation on its proposed reforms to the Computer Misuse Act 1990 (CMA), and only published an analysis on 14 November 2023. We are disappointed that the King’s Speech 2023 did not include the CMA and we are still unclear as to how the Criminal Justice Bill is a suitable replacement. The Government should urgently bring forward legislation to reform the Computer Misuse Act, including to: • Criminalise the theft and copying of data, to bring it in line with property theft offences; • Introduce appropriate extra-territorial provisions for cybercrime; • Give authorities the power to preserve data, pending a decision on formal seizure; • Enable law enforcement agencies to seize domain name and IP addresses; and • Increase the maximum sentences for more serious CMA offences.

There is a high risk that the Government will face a catastrophic ransomware attack at any moment, and that its planning will be found lacking. In 2020, this Committee examined the Government’s preparations for the Covid-19 pandemic, considering what it could teach us about how to prepare for a known risk with a high potential impact. We found that the Government had not prepared adequately for a pandemic, despite knowing that there was an increasing chance of such a scenario occurring. The Government is at risk of making the same mistake again: it knows that the possibility of a major ransomware attack is high, yet it is failing to invest sufficiently to prevent catastrophic costs later on. There will be no excuse for this approach when a major crisis occurs, and it will rightly be seen as a strategic failure. If the UK is to avoid being held hostage to fortune and avoid electoral interference it is vital that ransomware becomes a more pressing political priority, and that further substantial resource be devoted to tackling this pernicious threat to the UK’s national security. (Paragraph 130) 68 A hostage to fortune: ransomware and UK national security