On Tuesday, the chancellor, Philip Hammond, announced that the government was “investing” £1.9bn in boosting the nation’s cybersecurity. “If we want Britain to be the best place in the world to be a tech business,” he said, “then it is also crucial that Britain is a safe place to do digital business… Just as technology presents huge opportunities for our economy – so to it poses a risk. Trust in the internet and the infrastructure on which it relies is fundamental to our economic future. Because without that trust, faith in the whole digital edifice will fall away.”
Quite so; cybersecurity is clearly important. After all, in its 2015 strategic defence and security review, the government classified “cyber” as a “tier 1” threat. That’s the same level as international military conflict and terrorism. So let’s look at the numbers. The UK’s defence budget currently runs at £35.1bn, while the country’s expenditure on counterterrorism is now running at about £3bn a year. That puts Hammond’s £1.9bn (a commitment he inherited from George Osborne, by the way) into perspective. And the money is to be spent over five years, so an uncharitable reading of the chancellor’s announcement is that the government is actually investing just under £400m annually in combating this tier 1 threat.
All of which suggests that there’s a yawning chasm between Hammond’s stirring rhetoric about the cyber threat and his ability to muster the resources needed to combat it. As if to highlight that gap, his announcement came a day after a cyber-attack forced Northern Lincolnshire and Goole NHS foundation trust to cancel thousands of operations and appointments at three hospitals for three days. Just to put that into context: imagine the national controversy there would be if an attack by a terrorist group – or a stoppage by hospital and nursing staff – had resulted in the same closures. Imagine the headlines in the Daily Mail. But because it’s “just” a cyber-attack, public and politicians shrug their shoulders and carry on.
This can’t go on. A 2016 survey by PwC, the auditing and consultancy firm, illustrates the scale of the problem: 32% of companies surveyed reported that they had been affected by cybercrime. (More alarmingly, another 18% said that they didn’t know whether they had or not!) About 50 organisations said that they had incurred losses of more than $5m; of these, nearly a third reported cybercrime-related losses in excess of $100m. And only 37% had a cyber-incident response plan in place.
It’s not clear how Hammond’s £1.9bn will be spent, but if past form is anything to go by it will mostly go on recruiting expert staff to work in the new National Cyber Security Centre. Which is fine as far as these things go. But in terms of addressing the scale of the problem, it’s par for the course: to go for dramatic initiatives while ignoring humdrum but feasible options that, overall, would have much greater impact. It’s a bit like focusing on exotic renewable power-generation technologies rather than developing ways of ensuring that every house in the country is properly insulated.
What kind of options would help in the cybersecurity area? Simple legislative changes would be a good start. The big story of the last few months, for example, is the way in which chronically insecure “internet of things” (IoT) devices such as webcams have been marshalled into colossal botnets that are then used to launch distributed denial-of-service attacks on important websites. It ought to be a criminal offence to sell or import IoT devices that don’t meet specific security criteria.
Similarly, just as it’s illegal to drive a motor vehicle that does not have a current MOT certificate, we could make it an offence to run a networked computer system that does not have all current security patches installed. We could make software companies liable for shipping apps that have known security vulnerabilities. Makers of Android phones that don’t rigorously implement security updates on their devices could likewise be made liable for fines or prosecution. Secondary schools should run classes on computer security for teenagers. And so on.
None of this is rocket science. It’s just common sense. Which I guess is why it won’t happen.