2011/06/07 - Cyber: The War of the Invisible Enemy
Speech delivered by Secretary of State for Defence at the London Chamber of Commerce and Industry Annual Defence Dinner, on Tuesday 7 June 2011.
INTRODUCTION
Ladies and gentlemen, while we dine, Britain’s interests are under attack.
There is a continuous battle being waged against us, day in, day out.
Between 2009 and 2010, security incidents more than doubled.
Was this in Afghanistan? No - this was in cyber space and the target was the MOD.
I and my senior colleagues are routinely alerted to incidents that could have had severe consequences if they’d not been stopped.
Our systems are targeted by criminals, foreign intelligence services and other malicious actors seeking to exploit our people, corrupt our systems and steal information.
To give you an idea of the challenge, last year we in the MOD blocked and investigated over 1,000 potentially serious attacks.
The risks to Defence are real, and I take them very seriously.
These risks are not restricted by the geographic constraints of conventional conflict - we are not protected by distance or by natural barriers - in cyberspace our adversaries are on our doorstep.
This is the war of the invisible enemy.
Success cannot be achieved by government alone because, in cyber space, there are few boundaries between government, business and every individual internet user.
We now see weekly reports of cyber attacks against businesses, institutions and networks used by people going about their daily lives.
The cost to the UK economy of cyber crime is estimated to be in the region of £27bn a year and rising.
These are attacks against the whole fabric of our society.
When it comes to cyber security - we must fight this battle together.
Part of our response must be to act internationally.
The Foreign Secretary has set out 7 broad principles which the UK sees as important including the need for governments to act proportionally in accordance with international law, the need to provide proper protect for intellectual property and the need to act collectively to tackle the threat of cyber criminality.
To take international dialogue forward the UK will host in London in November an International Cyber Conference that aims to provide some focus to the currently fragmented international response to the challenges of cyber space.
But we must also continue to act here at home.
That is why, last autumn as part of the Strategic Defence and Security Review (SDSR), we allocated an extra £650m to create a National Cyber Security Programme funding work across government, including the MOD, to strengthen our understanding, our resilience and our defences.
I want to talk today about how we can work together to meet this threat, but first I want to talk about other challenges facing Defence over the next few years and how those relate to industry in particular.
ECONOMIC WEAKNESS IS A NATIONAL SECURITY LIABILITY
The Coalition Government inherited a level of debt and economic mismanagement that represents a national economic emergency.
Even with the aggressive action we are taking to eliminate the structural deficit, the Office for Budget Responsibility forecasts public sector net debt to peak at over 70% of GDP in 2014/15 - well over 1.3 trillion pounds - equivalent to almost 40 years spending on Defence at the level of this years budget.
Put aside for a moment the economic arguments about how Britain’s deficit reduction programme brings confidence to the financial markets, just consider the opportunity costs of running a national debt of this size.
The interest, just the interest, paid out last year was £43bn - around the same as the annual budgets of the MoD, FCO and DfID combined.
But it is not just opportunity costs - this is an issue of national security too.
The lessons of history are clear.
Relative economic power is the wellspring of strategic strength.
Structural economic weakness, if not dealt with, brings an unavoidable reduction in any country’s ability to shape the world.
As the National Security Strategy clearly sets out, Britain’s national interest requires our continued full and active engagement in world affairs.
Our trade and economic relationships are world-wide - we are connected to, and reliant on, the global economic system as never before.
A threat that appears in one part of the world, such as in Afghanistan, can swiftly be felt on our streets and those of our allies.
In order to protect our interests at home, we must project our influence abroad.
Britain can ill-afford another ‘East of Suez’ moment.
But without a strong, sustainable economy we will not be able to afford the Armed Forces and other levers of influence required to keep us safe in a volatile and unpredictable age.
Deficit reduction has to be the Government’s number one priority in the short-term, and it is something I am fully signed up to, both as a Cabinet Member and as Defence Secretary.
As the Prime Minister said yesterday, “In the end, this isn’t just about economics - it is also about the morality of it all.”
THE DEFENCE DEFICIT
The Defence budget was perhaps the worst inheritance of all.
Before the SDSR the forward defence programme was overcommitted to the tune of £38bn over the next decade.
This is one of the reasons why, in relation to the vast majority of government departments, the MOD is contributing less to deficit reduction.
Given the mess we inherited, putting Defence on a sure footing with a predictable budget is going to take time and cannot be pain-free.
But it is the only way in the long-term that we can we can sustain the Armed Forces we require.
The Strategic Defence and Security Review has set the right direction, ensuring that we will remain in the premier league of military powers - supported by the fourth largest defence budget in the world.
The adaptable posture we have embraced gives us the best capability to respond with agility to changing threats in an uncertain world.
But staying the course will require sustaining the strict cost-control regime I have put in place at the MOD.
One of the consequences of the mismanagement of Defence over the last decade - including what Chief of Defence Materiel, Bernard Gray described as ‘the conspiracy of optimism’ in the department’s planning - is that we have to prove that Defence can be managed sustainably.
It is as if we have taken over a troubled business, with the Treasury as our main investor.
We have to show that we can live within our means and have a business plan for recovery to ensure the further investment we need to grow.
The SDSR is part of that plan, but so too is tackling the drivers of systemic financial instability and the institutional lack of accountability.
That is why the work of Lord Levene and his Defence Reform Unit to reform the operating model of Defence is so important.
As is the work of Bernard Gray on ‘The Materiel Strategy’ to achieve best value in procurement and set the forward equipment programme on a sustainable basis.
Inevitably - the relationship between Defence and the industries that support our Armed Forces will have to change too.
INDUSTRY
We have published our Green paper on Equipment, Support and Technology with the White paper expected later this year and obviously I can’t pre-empt its conclusions tonight.
But the principles are clear.
We are determined to create a climate in which Defence and Security companies are resilient, and can flourish, without using the Defence Budget to subsidise them - maximising the benefits of international collaboration and exportability.
Let me be crystal clear, the primary purpose of defence procurement is to provide our Armed Forces with the equipment and support they require to do the job we ask of them and at a cost acceptable to the taxpayer.
This need not be inconsistent with a decent rate of return for business.
The Defence Budget is there to be used for Defence purposes and where there’s a real need to protect national security.
But our approach is not laissez-faire.
We have an interest in our wider security relationships, British influence, and the economic benefits of a flourishing industrial base.
These and other factors will be weighed when spending the £20bn we do each year on Defence with UK-based industry.
But I am clear that our default position is open competition and buying off-the-shelf where we can, albeit that many of the goods on the shelf are wholly or partly British.
Science and Technology is a key element of our overall capability.
R&D is extremely important in delivering a technological edge to the Forces of the future and continuing to support them on operations today.
The Government has allocated £200 million for the establishment of a network of elite Technology and Innovation Centres which will help the UK to take advantage of new and emerging technologies in areas where there are large global market opportunities.
Ideas and technology can come from across the S&T community - big and small industry and the UK’s excellent universities and research organisations.
This is particularly true in the work required to maintain and develop our defences in cyber space.
CYBER
The National Security Strategy recognises the threat of attacks from cyber space as being in the top tier of our national security concerns.
This threat is growing in scale and sophistication - my Department is a prime target.
Across the core Defence networks there were an average of over a million security alerts every day.
Not all of this can be attributed to deliberate activity by adversaries - many are the result of the back ground noise of the Internet and the unintended consequences of the interconnected environment in which we have to work.
But as I said earlier many are potentially serious.
Of course, the cynic might say that we have coped for hundreds of years with the threat of espionage from our competitors.
We have always adapted and designed strategies to thwart our adversaries.
But in this modern cyber age, where we have increased our own ability to work efficiently, exploit paperless environments and share information - we have made the task for our adversaries easier - and they have not been shy in taking advantage of our open and free society.
With the opening of the new Global Operations and Security Control Centre, we have already made significant strides in ensuring that we can defend our departmental systems, but there is more to do.
Working with our ICT suppliers, we will continue to develop the defensive capability of our systems and we will continually re-evaluate our budgetary plans as the threat evolves.
As I try to come to terms with the challenges that my Department faces in cyber space, I am constantly reminded that the issue is not just one for our departmental systems.
There is no Maginot Line in cyber space as recent high profile attacks on defence contractors have shown.
Our national intellectual property in defence and security industries is at risk from a systematic marauding.
Not only could it severely affect the future success of British industry, our economic advantage, and the country’s financial recovery - but also directly impacts upon our national security today.
We pride ourselves in maintaining a technological edge over our adversaries and collectively, Aerospace and Defence companies in this room spend over £1.7 Billion on R&D every year.
But that technological edge is at risk of being eroded as your hard won nuggets of intellectual property are targeted on a daily basis.
Without proper protection, what took years of diligent work and millions of pounds of funding to develop could fall victim to an expert adversary with the right know-how working on a simple networked laptop.
The Government is taking this seriously.
The Prime Minister led a senior level meeting with key Industry CEOs in February to look at the problem and how we might tackle it.
As Minister for the Cabinet Office, Francis Maude now has responsibility for co-ordinating efforts on cyber security across government and with business and academia.
A new type of partnership will be required if we are to survive this new battle in cyber space.
Partnerships often fail when there is no shared interest in the outcome - I believe the protection of our intellectual property and the national advantage it affords offers just such a shared interest.
Lest we forget, much of the infrastructure we are worried about is not government property, but it is no less critical to our society and its security.
Fundamentally, we must recognise that cyber space is now where most business is done.
The recent Sony incident and the phishing attacks on the Google accounts of US officials have proven that a passive approach to cyber security is not enough.
Detica’s recent study of the costs of cyber crime suggest that the Aerospace and defence sector is particularly exposed - losing £1.6bn per year as a result of espionage and the theft of intellectual property.
As I look across the defence and security industries, I see a complex supply chain with many companies, all of whom use the internet to do business, and all of whom are vulnerable to cyber intrusions.
The reality is that increasingly we will worry about how seriously our suppliers take account of the cyber security threat when we are placing our business, so I am encouraged by the recent joint initiative by ADS and Intellect.
So we will establish a new partnership with you - I will make sure that my department plays its part by being more open about the scale and nature of the threat and by tackling barriers to international co-operation on cyber security matters with our key Allies.
But I look to you to recognise the seriousness of this issue - and to work with me to improve our national security and our competitive advantage.
CONCLUSION
Ladies and Gentlemen, we face a challenging few years.
We must tackle the deficit, grow our economy, and put defence on a sustainable footing while ensuring that we are successful in the wars of today - in Afghanistan, in Libya and in cyber space.
To do this a new partnership between government and business is required.
It has to provide our Armed Forces with the equipment and support they require at a cost that the taxpayer is willing to bear.
And it has to provide industry with a competitive edge in the global market, but it has to be based on reality not wishful thinking.
It has to deal with the world as it is, not as we hope it would be, and that includes the opportunities and challenges of cyber space.
The bottom line is that a strong economy is a national security requirement.
An affordable Defence programme is the only responsible way to support our Armed Forces in the long term.