Skip to main contentSkip to navigationSkip to navigation
National Cyber Security Centre.
The National Cyber Security Centre, in central London, is not being adequately funded, says committee. Photograph: Andy Rain/EPA
The National Cyber Security Centre, in central London, is not being adequately funded, says committee. Photograph: Andy Rain/EPA

UK 'wholly' unprepared to stop devastating cyber-attack, MPs warn

This article is more than 5 years old

Ministers not taking growing threat to national infrastructure seriously, says committee

Ministers are failing to act with “a meaningful sense of purpose or urgency” in the face of a growing cyber threat to the UK’s critical national infrastructure (CNI), a parliamentary committee has warned.

The joint committee on national security strategy said at a time when states such as Russia were expanding their capability to mount disruptive cyber-attacks, the UK’s level of ministerial oversight was “wholly inadequate”.

It urged Theresa May to appoint a cybersecurity minister in cabinet to take charge of the efforts to build national resilience.

The committee, made up of senior MPs and peers, also called on the government to prioritise continued information-sharing and collaboration on cyber-attacks with the EU during the Brexit talks.

It noted the government had assessed a major cyber-attack on the UK critical national infrastructure represented a “top-tier” threat to national security, with potentially “devastating” consequences.

While ministers had explicitly acknowledged the need to improve resilience, MPs said their efforts had failed to match the level of risk.

“While we applaud the aspiration, it appears the government is not delivering on it with a meaningful sense of purpose or urgency,” it said.

“Identifiable political leadership is lacking. There is little evidence to suggest a ‘controlling mind’ at the centre of government, driving change consistently across the many departments and CNI sectors involved.

“We are concerned that the current complex arrangements for ministerial responsibility mean that day-to-day oversight of cross-government efforts is, in reality, led by officials, with ministers only occasionally ‘checking in’.

“This is wholly inadequate to the scale of the task facing the government, and inappropriate in view of the government’s own assessment that major cyber-attacks are a top-tier national security threat.”

The committee welcomed the establishment of the National Cyber Security Centre as the national technical authority, but expressed concerns that expectations of what it could achieve were “outstripping the resources put at its disposal”.

It noted that a recent tightening of the regulatory regime “was not the government’s own initiative but instead flows from our acceptance of EU-wide regulations”.

Margaret Beckett, the chair of the joint committee on national security strategy, says there is a ‘grave’ threat to the UK’s critical national infrastructure. Photograph: Christopher Thomond/The Guardian

Ministers needed to do more, it said, to change the culture of CNI operators in the private sector to ensure the cyber threat was addressed at board level with an understanding that it must be “proactively managed”.

“It appears that the government is reluctant to move more forcefully and, by default, continues to rely on market forces to improve operators’ cyber resilience, despite recognising the previous failure of this approach,” it said.

The committee’s chair, the former foreign secretary Margaret Beckett, said: “We are struck by the absence of political leadership at the centre of government in responding to this top-tier national security threat.

“Too often in our past the UK has been ill-prepared to deal with emerging risks. The government should be open about our vulnerability and rally support for measures which match the gravity of the threat to our critical national infrastructure.”

Most viewed

Most viewed