The UK is a leading international “cyber power” but must beware of threats from China’s technology and be prepared to undertake offensive operations against organisations such as Isis, the director of GCHQ has said.
In a speech in Singapore, Jeremy Fleming said the government’s monitoring agency would “need to pioneer a new form of security for the cyber age” to ensure that Britain develops more resilient telecommunications networks.
His comments come as international concern grows about the reliance on the Chinese technology giant Huawei for the future rollout of superfast 5G phone networks in western economies.
UK security chiefs have reportedly advised ministers that the risk could be contained despite US warnings about opening the telecoms network up to Chinese cyber-espionage.
Huawei has insisted it is owned by its employees, not the Chinese government, and that its technology has already been used for parts of the 4G mobile network.
Delivering the Fullerton lecture at a conference hosted by the International Institute for Strategic Studies (IISS), Fleming, who has been GCHQ’s director since 2017, said: “We have to understand the opportunities and threats from China’s technological offer, understand the global nature of supply chains and service provision irrespective of the flag of the supplier [and] take a clear view on the implications of China’s technological acquisition strategy in the west.”
We must “help our governments decide which parts of this expansion can be embraced, which need risk management, and which will always need a sovereign, or allied, solution. It’s a hugely complex strategic challenge which will span the next few decades … probably our whole professional lives. How we deal with it will be crucial for prosperity and security way beyond 5G contracts.”
On online attacks, Fleming said GCHQ needs “in extremis, to be able to use cyber tools to disrupt, deny or degrade” threats from overseas though such actions must be “governed by appropriate international and domestic laws” and be legal, necessary and proportionate. “Offensive cyber is an essential part of a nation’s cyber toolkit,” he said.
Disruptive online operations were conducted against Isis, he confirmed. He said: “This was remarkable work carried out by a talented and committed group of men and women from several nations and it helped lead to the end of the physical caliphate.”
There are three components of being a cyber power, he explained: being world class in safeguarding “the digital homeland”; having legal, ethical and regulatory regimes to foster public trust; and being able to project cyber power to disrupt, deny or degrade opponents in accordance with international law.
As director of GCHQ, Fleming said it was his role to ensure the National Cyber Security Centre’s (NCSC) active defence programme is implemented to deal with “those who are intent on causing disruption and harm”. About a half of the 1,100 incidents handled by the NCSC in the last two years “have a state actor behind them,” he said.