Iranian State-sponsored Cyber Attacks: Mitigation and Preparation

Question

Asked by

To ask His Majesty’s Government what advice they are giving to (1) the general public, and (2) businesses, about what steps they should take to mitigate and prepare for the consequences of Iranian state-sponsored cyberattacks, sabotage or disruption arising from recent events in the Middle East.

My Lords, I refer to my interest, as recorded in the register, as chair of the National Preparedness Commission and beg leave to ask the Question standing in my name on the Order Paper.

My Lords, the National Cyber Security Centre is closely monitoring the situation in the Middle East and directly engaging with critical sectors, providing immediate and specific information and advice. It has issued an alert, urging all organisations, especially those with assets or supply chains in the region, to remain vigilant. While it is likely that the direct cyber threat from Iran to the UK has not changed, NCSC advises organisations to strengthen their cyber security posture due to the fast-evolving nature of the conflict. The National Protective Security Authority also issued updated guidance last year on countering the threat of sabotage, helping organisations to protect their sites from physical threats.

My Lords, I am grateful to my noble friend for that reply. I am also grateful for what the National Cyber Security Centre has been doing in terms of targeted advice. However, last week four people were arrested by the Metropolitan Police under the National Security Act for what has been reported as spying against Jewish organisations— so there is an issue about that in terms of the risk of Iranian sabotage. There has also been a series of incidents across Europe and in this country of Russian-inspired or Russian paid-for attacks on various businesses. What is the general advice given to the public, to small businesses and to larger businesses in terms of the precautions they ought increasingly to take under the current international situation?

My noble friend raises an important point; all of this comes down to our national resilience and making sure that we are prepared for such threats. Before I highlight what we are doing on the specifics of cyber, and on cyber more generally, let me highlight that ministerial colleagues, the Faith Minister and the security services, which have done so much in recent days to keep us safe, have met and spoken to a large range of Jewish and Muslim organisations to provide reassurance. They have also met with my noble friend Lord Mann and 20 councils to provide reassurance to those who are so worried about the current conflict.

In terms of specific guidance, the reality is that in this space we need a whole-society approach. Businesses have to take the lead—they know where their threats are and where their vulnerabilities may lie—but at this point we need to make sure that we are collectively working together. The Government will bring forward the cyber action plan by spring, and the cyber security and resilience Bill is currently in the other place.

My Lords, as the defence production need for entirely new kinds of warfare steps up, as it is now doing, are the Government satisfied that the needs of our strategy, which are rapidly growing, are closely enough aligned with the plans of British industry?

The noble Lord is right that we need to make sure that we are protecting British industry and working with key allies. Last year, cyber attacks cost the economy £15 billion, and it is a growing threat. We need to work with business, but also to be led by it because it knows what infrastructure is there. As some noble Lords will be aware, some of this is low tech as much as high technology, and people are seeking every vulnerability. We all need to be cognisant of that and make sure there is a genuinely whole-society approach.

My Lords, if we are going to have a whole-society response, we had better make sure that the whole society is informed about the nature of the threat. Nearly a year ago, the strategic defence review talked about the need for

“a national conversation led by the Government”—

political leadership by the Government—to inform and educate the wider public about the nature of these new cyber and other hybrid threats from a number of different countries: Iran, Russia, China and others. When are the Government going to provide that political leadership through the national conversation which was proposed?

My Lords, I am disappointed that not everybody looks at the NCSC’s website in the same way that I do to ensure that they are updated. The noble Lord is right that we need to make sure that people are aware. It was one of the reasons why it was so important in the run-up to the national alerts we had on all our phones last year that materials were made available about what else could be done in terms of resilience and what other things needed to be done. I urge all noble Lords to make sure they are also protected. I hate to do this, but there is a cyber offer available to every Member of your Lordships’ House, and I believe only 10 of us have accessed it. It would be very good if all Members of your Lordships’ House took up the security offering provided to protect us while we talk about others too.

My Lords, sticking with the theme, Iran is a sophisticated actor and works closely with Russia. We know the threats that Russia can generate, which are more than cyber. It is not just time for a national conversation; it is time to strengthen our national security narrative for the whole country.

I think it is fair to say that of course I agree with the noble and gallant Lord. It is also about making sure the foundations we have in place are right too. We go from national security to national defence within this space, as well as our wider resilience programme. It is one of the reasons why the Rycroft review into funding of political parties is so important and why the Representation of the People Bill, which is in the other place, is key. It is also why we are investing £170 million in Sovereign encrypted technology so that we can protect ourselves. The noble Lord is absolutely right that the challenges from Iran are not one-dimensional; they are multi-dimensional and we all need to be prepared.

My Lords, when Russia invaded Ukraine, we were very quick to sanction individuals and freeze assets. Can the noble Baroness tell me what assets we have frozen of the late ayatollah? His office, I believe, is still open in Kilburn. Apparently, there are flats and so on near Israel’s embassy in Kensington. What are we doing to sanction the assets?

My Lords, the Government have taken significant action so far. We have sanctioned the IRGC in its entirety, as well as 550 Iranian individuals and entities. We have also placed the whole of the Iranian state, including Iran’s intelligence services, on the enhanced tier of the new foreign influence registration scheme, to better reveal any Iranian influence on the UK. We are also training front-line police officers on what state threats are and are not. In terms of the specifics, I will have to write to the noble Lord.

My Lords, we have talked a lot about cyber defence, and of course that is extremely important, but you do not win a war purely through defence and, be in no doubt, we are at war in cyber space. I do not expect the Minister to give us any details, but could she reassure the House that we are taking all the action necessary to go on the offensive in this area as well as defend?

The noble and gallant Lord knows much more than I do about how to fight a war. He is absolutely right that we need to be prepared on all fronts, and I want to reassure him that we are making sure that we are.