National Cyber Force

National Cyber Force
Unit name	National Cyber Force
Dates	2020–present
Country	United Kingdom
Allegiance	United Kingdom
Branch	Ministry of Defence, Government Communications Headquarters
Type	Cyber operations
Role	Offensive cyber operations, defensive cyber operations, intelligence support
Garrison	London
Notable commanders	Ben Wallace, Andrew Parker

National Cyber Force

The National Cyber Force is a United Kingdom capability created to conduct offensive cyberwarfare and support defensive signals intelligence activities. It was established to integrate resources from the Ministry of Defence, Government Communications Headquarters, and other elements of the United Kingdom intelligence community such as MI5 and MI6. The unit operates within the context of national security frameworks including the National Security Council (United Kingdom) and coordinates with international partners such as United States Cyber Command and NATO.

History

The concept behind the force traces to post-2010 discussions following incidents like the Sony Pictures hack and the NotPetya cyberattack, and institutional reviews such as the 2016 Comprehensive Review of Defence and Security. Early predecessors included Jersey Cyber Crime Unit initiatives and the Joint Forces Command (United Kingdom), later reorganized under the Strategic Defence and Security Review 2015. Formal announcement occurred during the tenure of Prime Minister Boris Johnson and Defence Secretary Ben Wallace, building on capabilities from Government Communications Headquarters and operational lessons from Operation Shader and Operation Ellamy. The unit’s formation paralleled developments at United States Cyber Command, Australian Cyber Security Centre, and policy frameworks like the Budapest Convention on Cybercrime and the NATO Cooperative Cyber Defence Centre of Excellence.

Mission and Roles

The force’s stated mission aligns with national objectives articulated by the National Security Strategy (United Kingdom) and the Integrated Review. Roles include conducting offensive operations to deter actors such as Russian Federation-linked groups implicated in the 2016 United States elections interference and disruptive campaigns like the WannaCry ransomware attack. It provides support to campaigns against non-state actors exemplified by Islamic State of Iraq and the Levant and state actors linked to incidents such as the 2017 NotPetya campaign and alleged influence operations tied to the Internet Research Agency. The unit supports Joint Expeditionary Force missions and assists Civil Contingencies Secretariat responses to major cyber incidents affecting critical infrastructure like the National Health Service (England).

Organization and Structure

Reporting lines place the force within a matrix of authorities including the Ministry of Defence (United Kingdom), Cabinet Office (United Kingdom), and Government Communications Headquarters. Leadership has included figures with backgrounds at GCHQ and Defence Intelligence, and coordination partners include Director of Public Prosecutions offices and the National Crime Agency. The force is organized into directorates reflecting capabilities familiar from Signals Directorate models and integrates analysts from institutions such as University of Oxford, University of Cambridge, and professional training pipelines like Royal Military Academy Sandhurst. Recruiting draws from private-sector firms including BAE Systems, Booz Allen Hamilton, and Raytheon Technologies contractors, and collaborates with civil bodies such as National Cyber Security Centre (United Kingdom).

Operations and Capabilities

Operational activities encompass persistent engagement, tailored cyber effects, and integration with kinetic options employed in scenarios like Operation Shader and coalition actions aligned with Article 5 of the North Atlantic Treaty. Capabilities include exploit development, intrusion operations, denial-of-service measures, and information operations similar in scope to methods used by Office of Personnel Management breach responders. Technical assets derive from research communities exemplified by University College London and private research labs at ARM Holdings spin-offs. The force conducts classified operations that have reportedly targeted adversary command-and-control infrastructures involved in campaigns resembling activities attributed to Fancy Bear and Cozy Bear. It also supports protective missions for national elections and major events like UEFA European Championship and COP26.

Legal and Ethical Framework

Activities are governed by statutory and policy instruments including principles from the Intelligence Services Act 1994 insofar as applicable, guidance from the Investigatory Powers Act 2016, and oversight by bodies such as the Intelligence and Security Committee of Parliament. Legal advice is coordinated with the Attorney General for England and Wales and integrates human rights considerations reflecting obligations under the European Convention on Human Rights. Ethical frameworks draw on debates sparked by incidents like the Edward Snowden disclosures and reports from civil society groups including Amnesty International and Human Rights Watch. Parliamentary scrutiny involves committees such as the Defence Select Committee (House of Commons).

International Cooperation and Partnerships

The force cooperates closely with United States Cyber Command, Five Eyes, NATO Cooperative Cyber Defence Centre of Excellence, and bilateral partners like France and Germany. Multinational exercises include participation in events such as Cyber Coalition and Locked Shields organized by the NATO CCDCOE. Liaison arrangements exist with EU bodies such as the European Union Agency for Cybersecurity and with regional partners including Australia and New Zealand. Intelligence-sharing mechanisms echo frameworks used by the Five Eyes alliance and coordinate sanctions policy with entities like the United Nations Security Council and national measures under the Sanctions and Anti‑Money Laundering Act 2018.

Controversies and Incidents

The unit’s secretive posture has raised concerns similar to debates over US Cyber Command operations and historical controversies like Operation Gladio. Civil liberties advocates citing Liberty (UK civil liberties group) and legal challenges referencing the Investigatory Powers Tribunal have questioned transparency and authorisation processes. Reports and leaks have provoked parliamentary inquiries reminiscent of scrutiny following the Iraq Inquiry and disclosures by whistleblowers analogous to Chelsea Manning and Edward Snowden. Specific operations have prompted diplomatic tensions with states such as the Russian Federation and incidents paralleling public controversies around Stuxnet and attribution disputes in the Skripal poisoning aftermath.

Category:United Kingdom intelligence agencies Category:Cybersecurity organizations Category:Military units and formations established in 2020