A security guard outside the new National Cyber Security Centre in London. Photograph: Andy Rain/EPA
GCHQ

British political parties ask GCHQ for advice on preventing cyber-attacks

Ciaran Martin, head of UK National Cyber Security Centre, says he expects formal requests for help with digital security

Tue 14 Feb 2017 13.57 EST

British political parties have approached the surveillance agency GCHQ for advice on beefing up their internet security after a cyber-attack during the 2015 UK general election and the hacking in the US last year of the Democratic party.

Ciaran Martin, head of the UK’s National Cyber Security Centre, which is part of GCHQ and was officially opened on Tuesday, confirmed informal contact had been made by the parties and that he expected to be asked formally to provide advice on how to increase their digital security.

He did not specify which parties had made approaches.

The idea of political parties engaging with the intelligence services is a sensitive issue. But such concern is being pushed aside by fears of the impact of a major hack along the lines of that in the US last year, which caused huge damage and embarrassment to the Democrats. Russian state hackers have been blamed by US intelligence.

Asked if any UK parties had asked for help, Martin said: “There is talk about it and we are ready to work [with them]. We have had some approaches and we would expect to be offering seminars and that sort of thing for political parties in the future. Have not done it yet. But we would expect to. But only if they asked.”

When asked if they had made such a request, he replied: “not formally”.

Martin was speaking to journalists after the official opening by the Queen of the new centre, which has been set up as the public face of GCHQ and that is intended to give advice to businesses, members of the public and others worried about cybersecurity.

He said there had been a step-up in cyber-attacks on the west over the past two years and, with elections this year in the Netherlands, France and Germany, there was concern about protecting the democratic process. “Across the west we are on the alert and looking at defences in that sort of area of the electoral process.”

Asked about concerns over interference in the British political system by potential hacking of political parties, Martin said: “So what I would say is that protecting the integrity of the electoral democratic systems is up there with the top priorities. Of course it is. But it is not just a question of something happens to the Democratic National Committee, therefore we look at the corporate networks of British political parties.

The Queen views a display during the official opening of the National Cyber Security Centre in London. Photograph: POOL/Reuters

“You have to look at the totality of this,” he said, adding that it was not just about the security of the parties but the political system as a whole. “Of course, we will try to look at political parties. But we support the parliamentary authorities at their request because we are constitutionally different from parliament.

“We look at what is going on in government networks. We did a huge amount of work in the last parliament when there was the move to online and individual electoral registration to protect that system. And also, frankly, we give advice, a brochure, to every parliamentarian after [their] election and we advise generically people with high public profiles on what they need to do in their personal electronic lives.”

The chief technical director of the new cybersecurity centre, Ian Levy, said that political parties were set up like medium-sized enterprises and constituency parties like small enterprises. The kind of advice given to medium-size and small enterprises could be given to political parties, he added.

Levy said one of the first initiatives of the new centre would be publication of guidance on selecting a good password manager to make access easier.

“Across everybody’s private and work life, all the different services they have, all the different passwords, the average complexity and the average change interval, broadly speaking, it’s the same as asking somebody to remember a different 600-digit number every month.

“When I say it’s dumb, that’s why I say it’s dumb.”

Earlier, Levy showed the Queen and the Duke of Edinburgh around, including a room of household appliances that could be vulnerable to security breaches, including a vacuum cleaner, a doll and a coffee maker. The vacuum cleaner had a camera inside that could be accessed by the manufacturer.

“It is a horrendous device,” Levy said. The Queen seemed amused.

The Conservative party has tended to be closer to the intelligence community down the decades than Labour, where there is a residue of suspicion. During the cold war, leftwingers were often targets of surveillance by the intelligence services.

Advice from the cybersecurity service would not be foolproof, although such advice might have helped the Democratic party to avoid being hacked. More problematic would have been personal emails such as those of the chairman of Hillary Clinton’s presidential campaign, John Podesta, which would have required him to take personal security precautions.

Ciaran Martin: Unlike previous intelligence mandarins with their coveted offices, he has no office or desk. Photograph: Ulrich Baumgarten/Getty Images

Ciaran Martin: cybersecurity chief brings GCHQ out of the shadows

One of the most senior members of GCHQ, Ciaran Martin, was showing a visitor around its ultra-secret headquarters in Cheltenham. He remarked on the irony that as a Northern Ireland catholic he himself might not have been allowed inside the building a generation or so back.

Against the background of the Troubles, Martin would probably have been viewed with suspicion as a potential security threat. With relative peace in Northern Ireland since the 1998 Good Friday agreement, not only was he allowed inside but since joining in February 2014 he has occupied a series of key roles.

That is not the only sign of the changing nature of GCHQ. Until recently, his name would have been treated as a secret. Only the director’s name was made public.

As the first head of the UK’s National Cyber Security Centre, Martin’s role is to leave the shadows and to be out and about in public, giving media interviews, making speeches, engaging with companies and anyone else concerned about digital security. Representatives from about 100 companies will be invited to join the centre on secondment to learn about digital security.

Opinion within GCHQ is divided about this new direction, with some staff uncomfortable, after years of ingrained secrecy, with such a public posture. Others accept that in the post-Snowden world such engagement with the public is probably essential.

Martin, who is in his early 40s and graduated with a first in history from Hertford College, Oxford, has enjoyed a stellar career in government. He has worked for three years at the National Audit Office, six at the Treasury and eight years at the Cabinet Office, where his roles included director of security and intelligence and constitution director, helping to prepare for the 2014 Scottish independence referendum.

He quickly made an impact as head of cybersecurity with a speech in Washington in September arguing the case for creating a “Great British Firewall” as a defence against hackers.

Although officially opened on Tuesday, the cyber centre, which is opposite Victoria station in London, is still far from finished, with the ranks of computer screens that will occupy one floor yet to be installed. The office may not be fully equipped and be up and running until the end of the year.

Staff describe Martin as easygoing. Unlike previous intelligence mandarins with their coveted offices, he has no office and no desk – at least not yet. When he gets in to work in the morning he just sits at the first empty desk.

Show more
Show more
Show more
Show more