How Samlesbury, Lancashire became the home of the National Cyber Force

From cyber defence to cyber attack

GCHQ and the Ministry of Defence have been developing cyber capabilities that enable the UK to strike back against hostile states, terrorists and cyber criminals since at least 2014, though GCHQ’s work in this area goes back much earlier.

The NCF has its origins in the National Offensive Cyber Programme, a joint operation between the military and Cheltenham that aimed to prepare the armed forces for “hybrid conflicts played out in cyber space as well as on the battlefield”.

The unit will also disrupt serious crime on the internet, including abuse of children and fraud.

The Secret Intelligence Service, MI6 – one of the partners in the NCF – is expected to use its network of agents overseas to gain access to human sources and target computer systems.

Part of the NCF’s role will be to collaborate with allies, including NATO members and the US.

The UK, for example, worked with the US Cyber Command in a major operations against the Islamic State (IS) during the war in Afghanistan, with the approval of the then prime minister, David Cameron.

The operation was described by GCHQ’s director as the first time the UK had “systematically and persistently” degraded a adversary’s online operations as part of a military campaign.

Operation Global Symphony gained access to IS networks, planted malware and backdoors on servers run by members of the organisation in multiple countries.

GCHQ worked with special forces to jam the ability of IS commanders to communicate and fed them false instructions over the internet.

Details of the UK’s involvement were later disclosed by security officials in off-the-record briefings to Sky News.

Cyber specialists took down servers and websites hosting IS propaganda, locked IS administrators out of their accounts, and shut down the production of the online IS magazine.

How UK cyber operations came out of the shadows

4 October 2021: Defence secretary Ben Wallace, accompanied by Patrick Sanders, head of Strategic Command, Jim Hockenhull, chief of defence intelligence, and senior GCHQ staff announce plans to build headquarters for the National Cyber Force in Samlesbury, Lancashire, in a press conference at BAE Systems.

May 2021: Sanders tells a press conference that “cyber warriors will be as vital to our defences as an F-35 pilot, a special forces operator, or a submariner and in contact with the enemy, more frequently and persistently than any of them”.

March 2021: Prime minister Boris Johnson announces that the National Cyber Force will be relocated to a cyber corridor in the north-west of England.

March 2021: The UK is likely to remain a priority target for threats, including cyber attacks and disinformation which blur the line between peace and war, the government warns in its integrated review of security, defence, development and foreign policy.

March 2021: There is an absolute requirement to develop national Offensive Cyber capabilities, the MoD’s Defence and Security Strategy reports. “Offensive Cyber offers the UK a range of national flexible, scalable and de-escalatory measures that will help us to maintain strategic advantage,” it says. The NCF is to provide “capabilities that can be used to deceive, degrade, deny, disrupt or destroy targets in and through cyber space, in the pursuit of our national interests, security and foreign policy goals”.

November 2020: Johnson publicly discloses the existence of the National Cyber Force in a speech on the integrated review of security, defence, development and foreign policy. He announces £16.5b in cash for defence over four years, focused on aerospace and cyber technology.

April 2020: National Cyber Force begins operation.

February 2020: Sanders describes cyber space as a new domain for conflict. He tells a conference: “We are now treating cyber space as a war-fighting domain and organising, structuring, equipping around that domain.”

December 2019: The joint forces command, which manages capabilities for the three armed forces, is renamed Strategic Command to reflect new responsibilities including cyber defence. 

October 2019: Wallace uses a Nato Parliamentary Assembly to announce the UK’s intention to “solidify plans” for the NCF. “To date our response has not been good enough. We are neither nimble enough nor deterring enough,” he said.

2019: GCHQ opens a hub in Manchester, at Heron House, setting up collaborations with local high-tech startup companies, research projects with academics and outreach work to schools.

October 2018: Nato sets up a Cyberspace Operations Centre capable of mounting cyber attacks. Nato secretary general Jens Stoltenberg later tells London conference that Nato allies have agreed to “integrate national cyber capabilities or offensive cyber into alliance operations and missions”. The unit in Mons, Belgium, will be fully equipped with 70 people by 2023, Reuters reports.

October 2018: The Sunday Times reports that the UK has carried out a simulated cyber attack against Moscow in response to a Russian attack. A former cabinet minister later reveals that the UK has conducted cyber operations against president Putin and his allies.

September 2018: Details emerge of UK plans to create a new cyber force focused on offensive cyber operations with funding of more than £250m in briefings to Sky News. Under the plan, cyber operations, run from GCHQ’s headquarters in Cheltenham, and the permanent joint headquarters in Northwood, London, would transfer to a new location. It was undecided whether the operation would be run by the MoD or GCHQ, or both. The unit would expand from 500 to 2,000 staff.   

April 2018: Director Jeremy Fleming reveals that GCHQ has conducted a “major offensive cyber campaign” against IS. The operation suppressed IS propaganda, hindered its ability to coordinate attacks, and protected coalition forces on the battlefield. “This is the first time the UK has systematically and persistently degraded an adversary’s online efforts as part of a wider military campaign,” he says. GCHQ has pioneered the use of offensive cyber techniques for over a decade, starting with the conflict in Afghanistan, he says.

June 2017: Defence secretary Michael Fallon uses a speech at Chatham House to confirm that the UK is conducting cyber operations routinely against IS in the war in Iraq and Syria, and has plans to make its cyber capabilities available to Nato.

October 2017: Fallon says in a speech that the UK has begun to integrate offensive cyber operations into military planning. “It is important that our adversaries know there is a price to pay if they use cyber weapons against us, and that we have the capability to project power in cyber space as in other domains,” he says.

November 2016: The UK’s national cyber security strategy recommends the development of offensive cyber capabilities. The National Offensive Cyber Programme (NOCP), a partnership between the MoD and GCHQ, has dedicated capability to act in cyber space. “We have the means to take offensive action in cyber space, should we choose to do so,” says the report. It promises to develop the ability of the armed forces “to deploy offensive cyber capabilities as an integrated part of operations”.

September 2016: The US and UK sign a memorandum of understanding to collaborate on defensive and offensive cyber capabilities.

2016: GCHQ establishes the National Cyber Security Centre which, among other functions, provides advice to businesses on cyber security.

2016: Prime minister Cameron orders action against IS online propaganda, beheading videos and the online magazine Dabiq, Sky News reports.

November 2015: Chancellor of the exchequer George Osborne commits to funding the National Offensive Cyber Programme for the next five years. He says the armed services should be “prepared for hybrid conflicts, played out in cyber space as well as on the battlefield”.

November 2015: GCHQ and MoD are collaborating on a National Offensive Cyber Programme partly funded by the £1.9bn National Cyber Security Programme. Plans are in place to provide the armed forces with “advanced offensive cyber capabilities”.

2014: GCHQ and MoD create a join investment programme.

September 2013: Defence secretary Philip Hammond announces plans to recruit hundreds of cyber specialists as reservists into a joint cyber reserve. He confirms the UK is developing a cyber strike capability.

2013: GCHQ’s cyber offensive and hacking operations, known as Computer Network Exploitation,  are first disclosed in documents leaked by Edward Snowden.

2012: An enterprise zone is established on Samlesbury Aerodrome, a 74-hectare disused airfield in Ribble, Lancashire, previously owned by British Aerospace. BAE Systems Warton Aerodrome forms a second site for the Enterprise Zone.

2010: The government identifies cyber threats as a top national security priority. The Strategic Defence and Security Review notes: “Asymmetric tactics such as economic, cyber and proxy actions, instead of direct military confrontation, will play an increasing part…in conventional military capability.” The government is working on a cyber operations memorandum of understanding that will allow the UK to  work with allies to “enable joint planning and the conduct of operations in the cyber domain”.

2008: GCHQ appoints its first director of cyber.