Britain should prepare for an attack on its critical national infrastructure using artificial intelligence within the next two years, the National Cyber Security Centre warned on Tuesday, November 3. The agency identified China as the country best equipped to carry out such operations and urged organizations to address weaknesses in their technology.
In its annual report, the NCSC assessed that a ransomware attack involving AI-powered malware against the country's critical infrastructure was highly likely by 2028. It also warned that hostile actors' use of AI would increase the scale and efficiency of their operations over the same period.
Richard Horne, chief executive of the NCSC, which forms part of the GCHQ intelligence agency, said British organizations and supply chains had left themselves exposed through decades of inadequate technology investment. Too many, he said, had been “doing tech on the cheap,” allowing vulnerabilities to persist.
In a speech scheduled for later on Tuesday, Horne was expected to warn that the coming months could bring an unprecedented increase in cyber incidents. His explanation focused on the ability of AI to find and exploit existing weaknesses on a previously unimaginable scale, rather than on the technology creating new methods of attack.
Horne was also due to identify China as highly likely to have both the intention and the strongest position to deploy AI against Britain's critical infrastructure and other strategic targets. He described Chinese cyber activity as the most sophisticated and sustained challenge facing the UK in this area.
The planned speech also highlighted threats attributed to Russia and Iran. Horne was expected to say Russia was persistently trying to penetrate British military networks, while Iran was conducting malicious cyber operations internationally, including against Britain and people regarded as threats. Moscow, Beijing and Tehran have repeatedly denied similar allegations in the past.
The report and speech follow hacking attacks on supermarkets across Europe that revealed vulnerabilities in IT systems. That backdrop accompanies the agency's warning that weaknesses tolerated for years could become increasingly exploitable as hostile actors make greater use of AI.
Horne called for urgent action by organizations, warning of consequences including empty food shelves, power interruptions and business failures. He said those that failed to act would have to explain why they had recognized the warning signs and understood the risks but still made inadequate choices.
