Show Hide image

Chi Onwurah: “We are only as strong as our weakest link”

Shadow digital minister Chi Onwurah says the cyber security needs of Britain’s 5.4m small businesses are being dangerously overlooked

The link between a parliamentarian and their appointed subject can be tenuous – Andrea Leadsom, then climate change minister, famously asked in 2015 if climate change was real – and this disparity becomes more apparent the more technical the portfolio. The current digital minister, Matt Hancock, does have some tech experience – he worked briefly for his father’s computer company – but his opposite number, Chi Onwurah, is that rare thing: a politician who is also a highly qualified engineer.

“Engineers are definitely underrepresented in government,” agrees Onwurah. “And they’re underrepresented in the Civil Service, because the Civil Service has had an emphasis on generalism. That basically meant not being an engineer. It meant having a first in classics or medieval history, and there haven’t been career paths for engineers and technical specialists. The Civil Service says it’s addressing that, and I hope it is.”

She adds: “We are under-represented in political parties, too, because the routes by which most MPs become MPs do not include engineering. We’ve got lawyers, spads [special advisers], PR people, journalists, but we don’t have engineers.

“I joined the Labour Party when I was 16. I wanted to become an engineer or scientist from the age of about nine. I looked to politics and technology as the two ways of changing the world for the better, and first of all I thought I wanted to be an engineer, as that was also what interested me – making things work, building things, so I went into engineering. It was a fantastic career and I’d recommend it to anyone and everyone.

"Particularly during my time working in Africa as an engineer, and later at Ofcom, it really highlighted to me the importance of public and government policy in making technology accessible."

“I could design the best broadband network in the world – I still think I could,” she says, with the confidence of someone who has clearly not quite given up being a telecoms engineer, “but only if people had the right income, the right skills, the necessary rights to lay cables, to actually get to use that fantastic technology. And so when it was announced that the MP for the bit of Newcastle where I grew up was standing down, I thought, ‘Let’s see if we can.’ ”

It was in Onwurah’s pre-political career that she first encountered cyber security. “Quite early in my career, as an engineer for Northern Telecom, or Nortel, we were looking at how access to telecoms switches were password-protected or not. We didn’t call it cyber security then; it was just security. The first time I encountered it as a citizen issue was ten years ago at Ofcom, when I was asked to write a report on malware.

“I went back to Ofcom’s senior board with all these tales of black hats, honeypots and viruses, and they thought I’d been playing Dungeons & Dragons. A lot of the terms I used then have changed but the actual threats and challenges, whether they’re to mobile telephony or fixed lines or desktop PCs, are still there. I remember learning about honeypots and bot networks long before these terms had any common understanding.”

Onwurah also has plenty of experience of battling to make the case for cyber security. In 2005, she says, even the Ofcom board was slow to appreciate the risk. “They were sceptical, I think, about whether we needed to invest real resource then. Ten years on, those threats are very, very real – they’re part of the daily, lived experience of everyone who’s online.”

Reluctance to address this risk, she says, persists today: “I’m still very surprised at the level of complacency. Ed Vaizey [digital minister in the Cameron government] used to talk with great pride about putting over £600m into cyber security, but that had almost all gone into the security services – MI5 and MI6 – and critical national infrastructure. It hadn’t gone to the police force, to deal with the day-to-day rising tide. And they’re totally under-resourced, so I think there’s still huge complacency.

“We’ve just seen today, and I’ve asked for an urgent question on it, that GCHQ has raised security questions about Universal Credit, and that’s one of the reasons it’s been delayed. I’ve been raising security questions about Universal Credit since about 2012, because they didn’t design security into it from the start, and you’ve got millions of vulnerable people with low digital skills, which creates a huge potential for fraud.

“I don’t want to put people off technology. I’m a tech evangelist – I think it can do amazing things for us and make our world better – but obviously it can also be used for scams, IP theft and more, and it’s a real dilemma about how we raise the profile of the threat without scaring everybody silly. But I’m coming to the conclusion that we need to scare people, because it’s not being taken seriously.”

Onwurah even has the dubious honour – increasingly common among public figures – of having been hacked. She found the experience informative: “It was a very good demonstration of the risks small businesses face. Our office is about the size of a small business. From the investigation that was done, we know that one of my staff had gone on to a perfectly legitimate website in the course of their work, where there had been an ad that had downloaded malware on to their computer. That had spread over the course of about three days on to our servers, and then the ransomware locked up our files and demanded a ransom.”

For Onwurah’s well-supported team, this wasn’t a huge problem. “We have a big department supporting us. We also had all our casework on a separate server, which meant there was no compromise of constituents’ data. Our digital services identified the virus, cleaned up our systems and restored us to the day before the virus was downloaded – we lost a couple of days’ work. But if we had been a small business, we wouldn’t have had access to that kind of support, and it could have put us out of action for a lot longer.”

What many small businesses may not realise is that their cyber security constitutes a responsibility not only to themselves, but to others. The law takes a dim view of businesses that do not protect their customers’ data.

“We have a duty of care, which is why it was so important that our constituent data wasn’t compromised, but a small business could find themselves liable in that respect. Also, small businesses are in the supply chains of large businesses. I’m really keen to emphasise to large businesses and government that protecting the big boys is all very well, but actually small businesses are part of everyone’s supply chain, as well as having access to important data. We’re only as secure as the weakest link.”

Is an institution such as the new National Cyber Security Centre (NCSC) solely for the big boys, then? “To be honest, small businesses generally don’t have the resources themselves to seek out the right sort of support,” Onwurah says.

“The NCSC is focused on the financial sector, and the financial sector is hugely important, but it clearly doesn’t see it as its role to raise the overall standard of cyber security.” So who is there to help the little people? “That’s the key question. The government put in place the Cyber Essentials programme of accreditation for small businesses but it’s had very low take-up – just over 2,100 when I last asked.” From the UK’s more than 5.4 million SMEs, that represents a take-up rate of 0.0004 per cent.

“One of the things I want to look at,” she adds, “and one I know the Institute of Chartered Accountants in England and Wales, for example, are looking at, is linking insurance to cyber skills. So you get a discount on your insurance if you’ve trained in cyber skills.”

Should small businesses have to display their cyber credentials, as restaurants display their hygiene certificates? “There is a level of cyber hygiene that we need to be promoting and enforcing,” Onwurah says, “but part of the challenge is having the skills for enforcement. That is one of the things Cyber Essentials was supposed  to address, but I don’t think it has.”

She believes that cyber security is too important to be left unenforced: “Government should recognise that it has a real role to play here, that it’s not enough to say, as they have, that the market will deal with it, and that people have recourse to the small claims court if they feel that their data have been mishandled. Government should be much more proactive. It should be working with insurance companies, to look at driving the incentives by linking premiums to cyber security knowledge, and looking at kitemarks and standards.

“There isn’t cyber-security support in a box. We need to look at stimulating the small-business cyber-security market, so that there are more products and better services out there. And yes, there should be ways of making that more visible to consumers. Look at the role that the fire brigade plays in helping small businesses with their fire alarms – there are many examples where the state intervenes to ensure a level of security, because it’s in the interests of everyone, but this government hasn’t recognised that cyber security is just like that.”

Like many others, Onwurah is dissatisfied with the low level of reporting of cyber-security incidents. “One of the issues with reporting is that people often feel stupid – they don’t want to report it; it’s not good for business – so the level of reporting may not yet match the level of the issue. But now that cyber statistics have been added to the police crime statistics, we’ve seen a huge rise in reporting, and I think we’re going to see that in small businesses as well.” We should, she says, see this as a chance for Britain to become a leader in cyber security: “There’s a huge opportunity here.”

Will Dunn is the New Statesman's Special Projects Editor. 

Show Hide image

Investing in a secure future

Increased training and investment in cyber security infrastructure are essential in the digital age.

It is easy to underestimate how crucial the internet is to our everyday lives. It has become an essential tool in the way we communicate with others and conduct business both at home and abroad. More than 1.6m people work in the digital sector or in digital tech roles in the United Kingdom and the internet continues to provide individuals and businesses with huge opportunities.

However, we know that criminals seek to exploit the many benefits of the internet for their own personal gain, often at great expense to others. The WannaCry ransomware attack, which hit the NHS as well as other organisations, highlights the seriousness of the threat and reinforces the need to properly protect ourselves online.

In the recent Cyber Security Breaches Survey 2017, just under half (46 per cent) of all businesses identified at least one breach or attack in the last year. Although it is difficult to put an exact figure on how much this cost the UK economy, it is likely to be in the billions.

We are also all too aware of attacks by hostile state actors who look to exploit the UK through intellectual property theft, in order to further their own interests and prosperity. We take these attempts to disrupt our national security very seriously.

That is why this the government set up the National Cyber Security Centre (NCSC), which provides cyber security at a national level. In its first year of being operational, the NCSC responded to 590 significant cyber incidents, more than 30 of which were sufficiently serious to require a cross-government response.

It is not just large organisations and our national infrastructure that are targeted by online criminals; individuals also face the daily threat of being scammed in their own homes. It is now the case that British citizens are 20 times more likely to be defrauded at their computer than mugged in the street.

It is a threat we all face. I strongly believe that we – individuals, businesses and the government – must play our own part to mitigate the risk and ensure that the internet is a safe and secure space for everyone. The government has legislated within the Serious Crime Act 2015 to create a new offence that applies where an unauthorised act in relation to a computer results in serious damage to the economy, the environment, national security or human welfare, or a risk of such damage occurring.

Legislating against online criminality goes some way to tackling the problem; however, close collaboration between the government, business and international partners is essential in combating the increasingly sophisticated attacks that the UK faces.

We work closely with the NCSC, which acts as a bridge between industry and government, providing a unified source of advice and the management of cyber-related incidents. It is at the heart of the government’s 2016 National Cyber Security Strategy, which is supported by £1.9bn of transformational investment to 2021.

Our law enforcement agencies across England and Wales also play a vital role in disrupting the activities of cyber criminals and bringing them to justice. They now operate as a single networked resource with the National Crime Agency (NCA) and Regional Cyber Crime Units using shared intelligence and capabilities. The NCA also has a dedicated Dark Web Intelligence Unit which targets those criminals who exploit hidden areas of the internet.

But we also want people to take their own preventative measures, so that they don’t become a target by criminals operating in the cyber space. We are running a series of campaigns and programmes which aim to encourage individuals and businesses to adopt more secure online behaviours.

Cyber Aware works with over 320 public and private sector partner organisations to encourage us all to take simple steps to protect ourselves online including using a strong, separate password for our email accounts and installing the latest software and app updates on our electronic devices.

The NCSC has also recently launched expert guidance on how small businesses can easily avoid common online breaches and attacks. Should organisations seek to improve their cyber security further, they can get certification through the Cyber Essentials Scheme.

To further support the efforts of SMEs in improving their cyber security, regional cyber crime prevention coordinators engage with businesses and members of the public to provide customised cyber security advice based on the latest technical guidance from the NCSC.

We must also look to the future – we now have a whole generation that have grown up immersed in tech. It is hugely important that we harness their talents and put them to good use rather than letting them wander down a path towards criminal online activities.

We must train and engage with the next generation of cyber security experts and is why the NCSC is taking a leading role in promoting a culture where science and technology subjects can flourish within the education system. Their CyberFirst programme identifies and nurtures young talent through a series of summer workshops and competitions. In addition, their CyberUK 2018 programme focuses on encouraging more women to enter into the technology industry, a sector that is largely seen as male-dominated.

There is a great effort across government and law enforcement to pursue online criminals, prevent
those that are headed on a path towards criminal activity, protect the public and prepare for the many threats we face online. We will continue to invest in law enforcement capabilities at a national, regional and local level to ensure agencies have the capacity to deal with the increasing threat from cyber crime.

However, this is not a threat that we can tackle alone. It is everybody’s responsibility, from top to bottom, to follow the guidance provided and increase their awareness of cyber security in order to create a safe space to communicate and conduct business online.