National Cyber Force carrying out daily hacking operations to disrupt hostile threats

The UK’s newly created offensive cyber unit, the National Cyber Force (NCF), has carried out daily hacking operations to counter sophisticated cyber threats and disrupt state disinformation campaigns and terrorist groups, it has been revealed.

The government yesterday disclosed rare details about the work of the NCF, which was formed three years ago to respond to hostile state hacking, terrorism and high-tech criminals.

The director of signals intelligence agency GCHQ, Jeremy Fleming, said the NCF had “countered state threats, made key contributions to military operations, and disrupted terrorist cells and serious criminals, including child sex offenders”.

The government also named the head of NCF as James Babbage, a GCHQ intelligence officer for nearly 30 years.

Babbage, who took a degree in history and went on to complete a master’s in computing, has spent most of his career at the signals intelligence agency, with interludes at the Ministry of Defence and as a liaison officer in the US.

The NCF disclosed that it had carried out hacking operations to counter terrorist radicalisation, reduce the threat of interference in elections and disrupt attempts to evade UK government sanctions, in addition to supporting military objectives.

One of the NCF’s most important strategies is to use techniques that have the potential to sow distrust, decrease morale and weaken the ability of adversaries to plan and conduct their activities effectively, a report published yesterday revealed.

Known as the “doctrine of cognitive effect”, objectives can include preventing terrorist groups from publishing pieces of extremist media online or making it harder for states to spread disinformation.

The aim is to undermine an adversary’s confidence in the data they are using, undermine the ability of information systems to function effectively or disrupt communications through hacking or equipment interference.

Operations could include covertly gathering data on hostile actors to demonstrate that their activities are “known and understood”, or covertly contacting individuals who pose a threat to the UK and influencing their actions. Other operations covertly expose information to highlight, for example, that a state actor is responsible for a disinformation campaign.

The NCF’s work is focused on “priority targets with high tailored and calibrated actions designed to achieve specific outcomes”.

Operations can be carried out by the NCF acting alone, or as part of wider campaigns with other intelligence agencies and partner countries.

The report, Responsible cyber power in practice, did not give details of specific operations, but noted that countries – including Russia – routinely carry out cyber operations to spread disinformation, undermine democratic processes and disrupt critical infrastructure.

The NCF also identified ransomware, the distribution of terrorist propaganda on the internet, and the rise of cyber criminals carrying out politically motivated cyber attacks following the conflict between Russia as Ukraine, as threats.

Set up as a joint operation between staff of the Ministry of Defence, GCHQ, the Secret Intelligence Service (MI6), and the Defence Science and Technology Laboratory (DSTL) at Porton Down, the NCF operates under a single command.