Cyber hit on a defence prime would cost capacity, warns MP

A cyber attack on the scale of the one that stopped Jaguar Land Rover would, if it struck a defence prime or a munitions supplier, take British industrial capacity out of the fight as well as money out of the economy, the Labour MP Graeme Downie has told the UK Defence Journal.

Downie, the member for Dunfermline and Dollar, was asked what an attack of that size against a defence manufacturer would mean for the country.

“I think the implications are the same, but with the added that you’ve probably taken down or reduced direct UK industrial capacity,” he said. “That obviously has a short-term impact, but also then huge knock-on effects to supply chain, availability of skills, raw materials, and lots of other things. So it would be a more direct attack, but it would nonetheless still have a huge economic impact, and then possibly knock on down to our industrial capacity.”

The comparison he was working from is the attack on Jaguar Land Rover, which his report identifies as the costliest cyber attack in British history. Downie said its effects travelled a long way past the company’s own balance sheet.

“What was striking is not only did that meaningfully affect UK GDP, reducing it by I think it was 0.1 per cent, in an economy that’s only growing by you know 1 per cent a year, that’s a significant number,” he said. “It’s noteworthy that it also affected Bank of England interest rate decisions and could have delayed an interest rate cut because of the performance of the economy. So not only was it costly to a large British company and all of the knock-on to supply chain and everything else, but that actually hit British mortgage payers potentially and cost them money.”

Asked what defence firms themselves could do about the risk while government works out how to measure it, Downie said the burden does not sit with them.

“I don’t think there’s anything defence firms can do in the meantime. I think at the moment this is something that really is on government to start publishing the cost of attacks,” he said. “I think there’s probably things government can do with businesses to not compel them to publish the cost of a cyber attack, for example, because that is difficult. But I think you can probably compel them much faster to have in place the right protections against cyber attack, and I think government just needs to be much quicker and more proactive.”

His prescription for the National Cyber Security Centre is that it should arrive without being asked, and leave with a number. “NCSC and other parts of government need to be much stronger at not only being there to assist when asked, but actually going in and assisting, not only to fix the problem as they did with JLR, for example, but also, while we’re here, we are going to find out how much this has cost your business, and then find a way to publish that.”

Downie’s report puts the cost of Russian hostile activity to the British economy at between £2 billion and £2.5 billion, a figure that excludes the additional defence spending the Russian threat has driven. He said the exclusions were deliberate and the real number is a good deal larger.

“What we did with all the figures was we took very conservative estimates because I wanted to make sure these figures were credible and were only what we could absolutely find,” he said. “I’m hoping that we will have more information out in the coming weeks and months as other information becomes available to us. I think it will be significantly bigger. But as I say, what’s important is that we don’t start spreading misinformation and unattributed sources. I think we’ve got to be really careful as we’re introducing this concept to the British public about how much Russian activity costs us.”

The Jaguar Land Rover attack halted production for weeks from the end of August last year and has been estimated by the Cyber Monitoring Centre at around £1.9 billion, the largest figure it has put on a single cyber event in the United Kingdom. Britain’s defence manufacturers sit on the same kind of integrated production systems, with the added exposure of long single-source supply chains for forgings, energetics and specialist components, where the loss of one plant for a few weeks cannot be made up elsewhere.

One of the four recommendations in The Putin Tax, published this month, asks the Ministry of Defence to begin costing physical attacks on British interests.