How Britain’s Secret Cyber Unit Targets Russia and China Online

Details surrounding how the National Cyber Force uses online warfare against hostile states released in Ministry of Defence report

A man types on a computer keyboard on Feb. 28, 2013. Kacper Pempel/Reuters

Details of how Britain’s most secretive disinformation unit has been targeting “hostile states” such as China and Russia online have been revealed in a new report.

The National Cyber Force (NCF), staffed by the intelligence services and the Ministry of Defence (MoD), has been carrying out “cyber operations on a daily basis” to not only stop threats to the UK, but also to “further the UK’s foreign policy.”

According to the latest Defence Command Paper (pdf), the NCF has been using covert internet and technology techniques to “sow distrust, decrease morale, and weaken” the abilities of overseas “adversaries.”

That includes disrupting online platforms or messaging services, preventing the publication of extremist material and “countering” foreign state disinformation campaigns.

The MoD report also revealed how the NCF has been working closely with super secret global surveillance group the Five Eyes, and NATO.

It said: “Our ability to both learn from events and hunt forward to find threats will generate strategic advantage for our personnel and partners in conflict.

“This involves close collaboration with our cross-government partners, including the National Cyber Security Centre, and our international partners, in particular through Five Eyes and NATO.”

While the NCF’s work is “covert” and details of individual operations are not disclosed, the paper stated that over the past three years, the NCF has delivered operations to protect military deployments overseas, disrupt terrorist groups and counter “sophisticated, stealthy and continuous cyber threats.”

Propaganda Distribution

The unit, set up in 2020, is also set to expand its operations, with plans to hire more MoD and intelligence staff over the next number of years.

The report said: “Over the coming years we will expand the capacity and reach of the NCF to keep pace with adversaries. We will operate more dynamically within the international information environment and improve the coordination of defence strategic communications activities.”

“We will make more sophisticated use of information to explain our approach, to build coalitions, to change the behaviours of our adversaries, and to influence a wide range of audiences.”

In April, the highly secretive group published its one and only report (pdf) detailing some of the defence operations its carried out in the digital sphere since 2020.

“This has included disrupting terrorist command and control and propaganda distribution, supporting military objectives on the battlefield, and disrupting the activities of hostile actors seeking to do us harm,” the report said.

It said it recruits and runs agents, alongside delivering clandestine operational technology, with the help of the MoD’s “operational and planning expertise” and GCHQ’s “global intelligence.”

The intelligence services—which includes MI5 and M6—also have an input into the cyber unit, along with the Defence Science & Technology Laboratory (Dstl).

The NCF says its objective is “to change adversary behaviour by exploiting their reliance on digital technology.” It also carries out operations targeting paedophiles using the internet to download child abuse images and videos.

Photo-illustration of web flash pages for GCHQ, the British government's communications and electronic surveillance headquarters, and The Security Service (MI5), the government's internal security service, on a computer and smartphone in London, on Nov. 25, 2016. AP Photo/Alastair Grant

Counter Disinformation Unit

It is the second secret group that has been used by the government over the past two years to combat disinformation.

The Counter Disinformation Unit (CDU) was part of the Department for Digital, Culture, Media, and Sport, which leads the UK government’s operational response to “domestic disinformation threats online.”

In February it moved to the Department of Science, Innovation, and Technology after it was revealed the CDU had been monitoring lockdown critics on social media.

The government confirmed in January the CDU had monitored COVID-19 pandemic critics, including Conservative MPs and journalists, on social media platforms via the CDU and other misinformation units.

Documents obtained by the civil liberties group Big Brother Watch revealed that well-known figures including Tory MP David Davis, Lockdown Sceptics founder Toby Young, talkRADIO’s Julia Hartley-Brewer, and Mail on Sunday columnist Peter Hitchens were all monitored by the groups.

Last month The Telegraph reported that one of the CDU’s main functions was “passing information over” to companies such as Facebook and Twitter to “encourage … the swift takedown” of posts.

Earlier this week, Britain’s intellectual property minister faced calls to shut down the “secret institution”. Viscount Camrose defended the CDU in the Lords, claiming most of its work focused on hostile state threats to the UK.

Tory peer Lord Lilley told the minister, “Surely it is the job of politicians to put forward the truth and dispute what they consider to be unreasonable or disinformation with facts, reason, logic, and ridicule, not to have a secret institution, which should be closed down.”