Summary

Russia and China are staging “relentless” cyberattacks against the UK using AI, according to one of the nation’s top spy chiefs. But AI is also being used to help defend against such attacks. Paul Chichester, director of operations at the National Cyber Security Centre (NCSC) – the government department tasked with securing the nation’s IT infrastructure – says the UK’s four main cyber adversaries – Russia, China, North Korea and Iran – are all using AI to boost their ability to attack the country. “They don’t need sleep, coffee, food or anything like that,” says Chichester. “AI is certainly being used by all our adversaries.” Advertisement NCSC was formed 10 years ago this month by amalgamating a disparate group of departments that all had overlapping aims to protect against cyberattacks. Chichester says that, over that decade, cyberattacks have become a standard part of the intelligence activity of nation states. “It feels more relentless now than it did 10 years ago,” says Chichester. “This is now an absolutely critical part of covert statecraft, and we obviously live in a world that is more uncertain and geopolitically there is more tension. So that will manifest in the cyber domain and that will manifest in our workload. All of a sudden [with AI], the productivity of their operations is certainly increasing.” In recent months, a string of stories about AI models inadvertantly escaping test environments and hacking computers in the real world have emerged from large AI companies. And the use of AI models by security companies paid to break into clients’ machines to test defences has become commonplace. These models can not only design new types of attack, but they can carry them out at astonishing pace and operate without rest. Chichester says that AI is being used in all stages of the “cyber kill chain”, from reconnaissance to developing a vulnerability to actually carrying out attacks on a target. He also warns that when humans staged attacks, there was a de facto limit to how much intelligence or data they could steal, but in a world where AI can carry out attacks that limiting factor is gone. “What you’re seeing is always something new. Because if they don’t get it, they’re gonna try something else,” says Chichester. “No two days are the same; you’re always seeing different kinds of attack. You’re always trying to defend against things.” Their aims vary, from espionage to economic advantage to disruption and, in the case of North Korea, simple financial crime and fraud. Chichester would not be drawn on the extent that the UK takes part in similar attacks, but says that “there are capabilities that are avowed and the UK uses”. The secretive National Cyber Force is a joint operation between the UK Ministry of Defence and GCHQ (the UK’s cybersecurity agency), which has offensive cyber capabilities. However, Chichester says that NCSC is open about using commercial frontier models in its work, and in developing its own AI tools. “Building an LLM [large language model] in a way that you might look at some of the frontier models obviously takes a ridiculous amount of computing and machinery, but building smaller models that do particular specific things is a very different proposition,” says Chichester. “For instance, in the way that we do malware research or malware engineering investigations, there are elements of artificial intelligence in the tooling and the systems we build, and that’s been in there for a long time – but it’s very bespoke, it’s very specific to that task.”