UK National Cyber Force operations to become ‘more embedded’ with policing

Gen. Sir Jim Hockenhull, the four-star chief of the United Kingdom’s Strategic Command, said that the longer-term future of the National Cyber Force (NCF) would see the elite hacking unit integrated into police operations, alongside military and intelligence ones.

The former chief of Defence Intelligence — Britain’s military intelligence agency, part of the Ministry of Defence — spoke onstage Tuesday at Recorded Future’s Predict 2023 conference in London, to Sir Alex Younger, the former head of MI6 who now sits on Recorded Future’s board. The Record is an editorially independent unit of Recorded Future.

Unlike other nations with a military cyber command, the U.K.’s approach is “trying to generate a capability which is able to range from serious organized crime, child online sexual exploitation crime, verging into counterterrorism all the way through to military operations — from crisis all the way through to a war fighting capability,” said the general.

In the longer term, he said Strategic Command saw NCF operations being integrated “into wider police operations, wider intelligence operations, wider military operations. I think we’ll find that it becomes much more embedded and becomes a much more common thing.”

The Crown Jewels

Strategic Command, as Hockenhull described it, covers “the military capabilities that you don’t usually see, or we intend that you don’t see. I would see them as the Crown Jewels of defense. The heads of the Army, Navy, and Air Force have got other views — other views are available even if they’re not correct.

“So I look after defensive capacity to mount operations, so the Permanent Joint Headquarters, which runs our global operations. I look after the Special Forces, Defence Intelligence, the National Cyber Force in partnership with GCHQ —”

“— and MI6,” interjected Younger.

“And MI6,” acknowledged Hockenhull, “and DSTL [the Defence Science and Technology Laboratory], and some other people as well.”

Hockenhull said the NCF was founded “to bring together the best of our national security community. So the organizational planning capability of the military, the technical know-how of GCHQ, the cunning of MI6, and also others across the national security community, and trying to pull that alchemy together.”

Sir Alex Younger — who left the Secret Intelligence Service, also known as MI6, after six years of service in 2020 — previously spoke to The Record about his career.

“We all predicted that the war would happen. You guys were completely on the money,” he told Hockenhull, who was the chief of Defence Intelligence at the beginning of the Russian full-scale invasion of Ukraine in February 2022, when the agency made the unprecedented decision to begin publicly sharing intelligence about expected Russian activities.

Hockenhull said: “There was a disinformation operation about 10 days before the conflict, that Russian forces were withdrawing from the border. That caused me to want to take Defence Intelligence’s output … [and start] tweeting out intelligence reports.

“Luckily, there was one person that agreed with me that it was a good idea. And so we did it, took a little bit of a risk, in fact on the 17th of February we tweeted out their invasion plan, saying that, you know, this is how it’s going to happen. And we got a bit of ridicule, with people saying it looks like a sort of Dad’s Army map of arrows going round. But I was then reassured a week later to see on Sky News, the BBC, they were all doing exactly the same thing.”

The purpose “was to get the truth out early,” said Hockenhull, “using our intelligence to understand what the Russians were planning to do, and getting out and spiking those stories by trying to get the truth out early.”

He described the effort as “kind of pre-bunking rather than debunking, a lie. A kind of prebuttle, I suppose.”

The idea was that once the Russians had begun to spread a false narrative, it was “out there, it’s almost impossible to kill. And the more outrageous the lie is, the more difficult it is to kill. So you’ve got to get in early and show that, no, this is coming and this is the truth. And if you can do that, I think there’s a way of combating the disinformation campaign.

“But it’s a tool that Russia relies upon, has got the capability to do, both as a state but also deniably, and it’s something we need to watch very, very carefully,” he added.

Asymmetrical warfare

These prebunking activities align with the ideas of “cognitive effects” that were focused on in an NCF paper published earlier this year, which stressed how Britain’s offensive cyber operations were designed to be “accountable,” “precise,” and “calibrated.”

Hockenhull said the paper’s focus on cognitive effects was “right, up to a point. Of course there are a range of other ways in which you can use your offensive cyber capability,” he acknowledged.

“I think we should recognise that the threats we face, our adversaries have a range of asymmetric advantages — not having to play by the rule of law, not having to have any kind of respect for norms and standards — and that often contains our ability to respond.

“I think we need to find our own asymmetry against our adversaries, and I think the National Cyber Force provides one of those methods of asymmetry. So there’s something around seeing how we can, if we’re limited and constrained in some ways, how can we leverage that to our advantage

“And that really takes us into the technology partnership that we want to refer to the technology partnership that we want to rub between the National Cyber Force and the technology industry, but that’s going to also apply to wider Defence as well.”

Younger revealed that during his last day in government he was given the floor for half an hour in the National Security Council — a relatively modern forum chaired by the prime minister in the model of the U.S. National Security Council — to speak his mind.

“I said, what I really thought, was that ultimately we’ve been kept safe by a superior rate of technology innovation over our opponents, that in a hybrid world there’s a risk that we lose a war before it’s even begun, and that we had to look at warfare in this new dimension,” said Younger.

“And then I was made to look rather stupid by a very 1914-style war, starting up in Eastern Europe, which appears to be determined by the quantity of artillery shells available. And so in a sense, [the Russia-Ukraine war] confronts, I think, where we all thought this was going. What’s your explanation of all of this? What are the future-facing lessons that you’re drawing from what is happening?”

Hockenhull acknowledged that there was one sense in which the conflict could appear tone attritional, and cited the social media coverage of “people being attacked in trenches and armored vehicles moving around the countryside.”

He also cautioned that there was “an industry in lessons in Ukraine — both inside defense and more broadly — and if you squint hard enough you can learn any lesson you want from the conflict in Ukraine, and many people are.”

But, he said, his sense was “that the thing which has particularly sustained the Ukrainians, in addition to their own heroism and bravery, and the supply of Western support, has been their ability to adapt and innovate. And they’ve been really quite remarkable at the way in which they’ve adapted.

“They secured their national data very early on, they were helped by some Western companies in terms of being able to secure their ability to govern, but then in terms of the fight they’ve been remarkable. The ability to take commercially available platforms and use those in really innovative and clever ways to provide advantage has been really significant.”

Putin’s ‘blood-curdling threats’

Younger noted that despite “the blood-curdling threats that Putin issues, he hasn’t used his offensive cyber capabilities at all outside of Ukraine. Was that unexpected?”

Hockenhull said that the Russians had a doctrine of local, regional, and global conflict. “And it’s been clear since the start of this conflict that Russia has wanted to treat this as a local conflict, indeed they call it a special military operation. And I think they recognise the risks of expanding the conflict.”

The four-star added that while the campaign “looks traditional” there are “an awful lot of other things going on. So the Russians are using very widespread and high-quality electronic warfare capabilities which have the ability to disrupt quite a lot of conventional capability.”

One of the lessons the conflict in Ukraine revealed was a need to recognise the importance of hardening those capabilities so they could work in a denied environment. “Sometimes that takes quite a lot of innovation about how you are able to either get around, get through, and fight through those disruptions,” he added.

Hockenhull said he had also been impressed by “the way in which the Ukrainians — together with some Western support — have been able to be really smart in their use of information operations, the way in which they’ve struck deep against Russian targets.

“You know, the fact that the Ukrainians are able to effectively sink a submarine whilst they don’t really have a Navy is really quite remarkable, and doing that through quite a complex attack. But blowing a hole in a Kilo-class submarine which will out it out of access for quite a long time, noting of course that because of the restrictions on the Bosphorus and being able to being other vessels, particularly military vessels, into the Black Sea, means its gone out of the conflict for a significant period.

“Those sorts of things, I think, are really quite remarkable. So on the surface it’s an attritional struggle, and it’s about who’s got how much artillery, and you can kind of measure with a tape measure sometimes how much terrain has been taken,” he said.

Hockhenhull argued that the way in which the conflict “gets unlocked” was going to be through “adaptive technology, the use of information, and a really smart application of being able to target.”

“The fact that the Ukrainians have set up a network where they can crowdsource missile data, from individuals taking photographs with their iPhones and then sending that photograph in to assess the trajectory of the missile from a photo, which then provides warning in depth as you can work out where that missile is likely coming towards. It’s remarkable.”