Intelligence and Security

Committee of Parliament

Russia

HC 632
 Intelligence and Security
Committee of Parliament

Russia

Presented to Parliament pursuant to section 3

of the Justice and Security Act 2013
Ordered by the House of Commons to be printed on
21 July 2020

HC 632
© Intelligence and Security Committee of Parliament copyright 2020

The material must be acknowledged as Intelligence and Security Committee of

Parliament copyright and the document title specified. Where third party material has
been identified, permission from the respective copyright holder must be sought.

This publication is licensed under the terms of the Open Government Licence v3.0 except
where otherwise stated. To view this licence, visit
nationalarchives.gov.uk/doc/open-government-licence/version/3

Any enquiries regarding this publication should be sent to us via our webform at
isc.independent.gov.uk/contact

This publication is also available on our website at: isc.independent.gov.uk

ISBN 978-1-5286-1686-7

CCS1019402408 07/20

Printed on paper containing 75% recycled fibre content minimum

Printed in the UK by the APS Group on behalf of the Controller of Her Majesty9s
Stationery Office
 THE INTELLIGENCE AND SECURITY
COMMITTEE OF PARLIAMENT

The Rt Hon. Dr Julian Lewis MP (Chair)

The Rt Hon. Chris Grayling MP The Rt Hon. Kevan Jones MP
The Rt Hon. Sir John Hayes CBE MP Mark Pritchard MP
Stewart Hosie MP The Rt Hon. Theresa Villiers MP
Dame Diana Johnson DBE MP The Rt Hon. Admiral Lord West of Spithead
GCB DSC

This Report is the result of an Inquiry conducted by the previous Committee, which sat from
November 2017 to November 2019:

The Rt Hon. Dominic Grieve QC MP (Chair)

The Rt Hon. Richard Benyon MP The Rt Hon. the Lord Janvrin GCB GCVO
QSO
The Rt Hon. Caroline Flint MP The Rt Hon. Kevan Jones MP
The Rt Hon. David Hanson MP The Most Hon. the Marquess of Lothian PC
QC
Stewart Hosie MP The Rt Hon. Keith Simpson MP

The Intelligence and Security Committee of Parliament (ISC) is a statutory committee of Parliament
that has responsibility for oversight of the UK Intelligence Community. The Committee was
originally established by the Intelligence Services Act 1994 and was reformed, and its powers
reinforced, by the Justice and Security Act 2013.

The Committee oversees the intelligence and security activities of the UK Intelligence Community,
including the policies, expenditure, administration and operations of MI5 (the Security Service),
MI6 (the Secret Intelligence Service or SIS) and GCHQ (the Government Communications
Headquarters)* and the work of the Joint Intelligence Organisation (JIO) and the National Security
Secretariat (NSS) in the Cabinet Office; Defence Intelligence (DI) in the Ministry of Defence; and
the Office for Security and Counter-Terrorism (OSCT) in the Home Office.

The Committee consists of nine Members drawn from both Houses of Parliament. Members are
appointed by the Houses of Parliament, having been nominated by the Prime Minister in consultation
with the Leader of the Opposition. The Chair of the Committee is elected by its Members.

The Members of the Committee are subject to section 1(1)(b) of the Official Secrets Act 1989 and
are routinely given access to highly classified material in carrying out their duties. The Committee
sets its own agenda and work programme, taking evidence from Government Ministers, the Heads
of the intelligence and security Agencies, senior officials, experts and academics as required. Its
Inquiries tend to concentrate on current events and issues of concern, and therefore focus on
operational and policy matters, while its annual reports address administration and finance.

The reports can contain highly classified material, which would damage the operational capabilities
of the intelligence Agencies if it were published. There is therefore a well-established and lengthy

iii
process to prepare the Committee9s reports ready for publication. The Report is checked to ensure
that it is factually correct (i.e. that the facts and figures are up to date in what can be a fast-changing
environment). The Intelligence Community may then, on behalf of the Prime Minister, request
redaction of material in the report if they consider that its publication would damage their work, for
example by revealing their targets, methods, sources or operational capabilities. The Committee
requires the Intelligence Community to demonstrate clearly how publication of the material in
question would be damaging since the Committee aims to ensure that only the minimum of text is
redacted from a report. Where the Committee rejects a request for material to be redacted, if the
organisation considers that the material would cause serious damage to national security if
published, then the Head of that organisation must appear before the Committee to argue the case.
Once these stages have been completed the report is sent to the Prime Minister to consider. Under
the Justice and Security Act 2013 the Committee can only lay its reports before Parliament once the
Prime Minister has confirmed that there is no material in them which would prejudice the discharge
of the functions of the Agencies or 3 where the Prime Minister considers that there is such material
in the report 3 once the Prime Minister has consulted the Committee and they have then excluded
the relevant material from the report.

The Committee believes that it is important that Parliament and the public should be able to see
where information had to be redacted: redactions are clearly indicated in the report by ***. This
means that the published report is the same as the classified version sent to the Prime Minister (albeit
with redactions).

33333333333333333333333333333333333
*
The Committee oversees operations subject to the criteria set out in section 2 of the Justice and Security
Act 2013.

iv
CONTENTS

INTRODUCTION .............................................................................................................. 1
What does Russia want? .....................................................................................................1
Why the UK? ......................................................................................................................1
The Report...........................................................................................................................2

The Threat

CYBER ................................................................................................................................ 5
A sophisticated player .........................................................................................................5
Leading the response ...........................................................................................................6
Attribution: a new approach ................................................................................................6
HMG as a player: Offensive Cyber.....................................................................................7
International actions ............................................................................................................7

DISINFORMATION AND INFLUENCE ....................................................................... 9

A 8hot potato9 ....................................................................................................................10
The Defending Democracy programme.............................................................................12
Political advertising on social media................................................................................ 12
Case study: the EU referendum ........................................................................................12

RUSSIAN EXPATRIATES ............................................................................................. 15

Welcoming oligarchs with open arms ...............................................................................15
Trying to shut the stable door ...........................................................................................16
Russians at risk..................................................................................................................17

The Response

ALLOCATION OF EFFORT ......................................................................................... 19

Coverage ...........................................................................................................................19
Did HMG take its eye off the ball? ...................................................................................21
Future resourcing ..............................................................................................................23

STRATEGY, CO-ORDINATION AND TASKING ..................................................... 25

The cross-Whitehall Russia Strategy ................................................................................25
Ministerial responsibility ..................................................................................................25
The Fusion Doctrine and joint working ............................................................................26
The intelligence contributions to the Russia Strategy .......................................................26
Less talk, more action?......................................................................................................27
Measuring performance ....................................................................................................27

A HARD TARGET .......................................................................................................... 29

A unique challenge............................................................................................................29
Rising to the challenge ......................................................................................................30

LEGISLATION ................................................................................................................ 33
Counter-espionage ............................................................................................................33
Tackling crime ..................................................................................................................34
Protecting democracy ........................................................................................................36
v
INTERNATIONAL PARTNERSHIPS .......................................................................... 37
Working with others..........................................................................................................37
Helping others to help us ..................................................................................................38
The international response to Salisbury ............................................................................38
Maintaining momentum ....................................................................................................39
Is Russia seeking alliances? ..............................................................................................39

ENGAGEMENT WITH RUSSIA ................................................................................... 41

Russian disengagement .....................................................................................................41
The purpose of communication.........................................................................................41
Sending the right message.................................................................................................41

WITNESSES ..................................................................................................................... 43

ANNEX .............................................................................................................................. 45

CLASSIFIED ORAL AND WRITTEN EVIDENCE ................................................... 47

vi
INTRODUCTION

1. The dissolution of the USSR was a time of hope in the West. In the 1990s and early
2000s, Western thinking was, if not to integrate Russia fully, at least to ensure that it became
a partner. By the mid-2000s, it was clear that this had not been successful. The murder of
Alexander Litvinenko in 2006 demonstrated that Russia under President Putin had moved
from potential partner to established threat. Since then, there have been a number of attempts
to repair relations between Western countries and Russia (for example, the US 8Russian
reset9 in 2009, and the Prime Minister9s visit to Moscow in 2011 in which he expressed a
desire to rebuild the relationship), but the events of recent years show that none has had any
impact on Russian intent, and therefore on the security threat that Russia poses.

2. Russia is simultaneously both very strong and very weak. The strengths which
Russia retains are largely its inheritances from the USSR and its status as a victor of the
Second World War: nuclear weapons, a space presence and a permanent seat on the UN
Security Council. By contrast, it has a small population compared with the West; a lack of
both reliable partners and cultural influence outside the countries of the former USSR; a
lack of strong public and democratic institutions, including the rule of law; and, of course,
a weak economy.

3. Despite its economic weakness, it nonetheless heavily resources its intelligence

services and armed forces, which are disproportionately large and powerful. Moreover,
Russia is adept at using its apparent weaknesses to its advantage: for example, its poor
national brand and lack of long-term global friends appear to feed its enormous risk appetite
3 perhaps on the basis that it thinks it has nothing to lose; its lack of democracy and rule of
law allows its intelligence agencies to act quickly, without constraint or consideration; and
its lack of strong independent public bodies and the fusion of government and business
allow it to leverage all its intelligence, military and economic power at the same time to
pose an all-encompassing security threat.

What does Russia want?

4. The security threat posed by Russia is difficult for the West to manage as, in our
view and that of many others, it appears fundamentally nihilistic. Russia seems to see
foreign policy as a zero-sum game: any actions it can take which damage the West are
fundamentally good for Russia. It is also seemingly fed by paranoia, believing that Western
institutions such as NATO and the EU have a far more aggressive posture towards it than
they do in reality. There is also a sense that Russia believes that an undemocratic 8might is
right9 world order plays to its strengths, which leads it to seek to undermine the Rules Based
International Order 3 whilst nonetheless benefitting from its membership of international
political and economic institutions.

5. Russia9s substantive aims, however, are relatively limited: it wishes to be seen as a

resurgent 8great power9 3 in particular, dominating the countries of the former USSR 3 and
to ensure that the privileged position of its leadership clique is not damaged.

Why the UK?

6. It appears that Russia considers the UK one of its top Western intelligence targets:
while we may not experience the level and type of threat that countries on Russia9s borders
suffer, witnesses have suggested that we would sit just behind the US and NATO in any
1
priority list. This is likely to be related to the UK9s close relationship with the US, and the
fact that the UK is seen as central to the Western anti-Russian lobby. 1

7. This perception will have been reinforced by the UK9s firm stance recently in
response to Russian aggression: following the UK-led international response to the
Salisbury attack 3 which saw an unprecedented 153 Russian intelligence officers and
diplomats expelled from 29 countries and NATO 3 it appears to the Committee that Putin
considers the UK to be a key diplomatic adversary. The threat to the UK 3 and any changes
to this following the actions taken in response to the Salisbury attack 3 is described in this
Report, together with the action that the UK Intelligence Community is taking to counter
those threats. 2

The Report
8. This has been a major Inquiry, spanning a number of evidence sessions with a broad
range of witnesses over the course of eight months, in addition to a substantial volume of
written evidence. We are grateful to those outside the Intelligence Community 3 in
particular Anne Applebaum, William Browder, Christopher Donnelly, Edward Lucas and
Christopher Steele 3 for volunteering their very substantial expertise on Russia, which
provided us with an invaluable foundation for the classified evidence sessions.

9. We also express our particular gratitude to the late Sir Charles Farr, who was Chair
of the Joint Intelligence Committee for much of the duration of our Inquiry. The evidence
he provided directly and his wider assistance in the progression of our Inquiry were both
very helpful. We wish to take this opportunity to pay tribute more broadly to his lifetime of
exceptional service to the Intelligence Community.

10. The matters covered by our Inquiry are highly sensitive. We have been told,
repeatedly, that the Russian Intelligence Services will analyse whatever we put in the public
domain and therefore, on this subject more than any other, the potential to damage the
capabilities of the intelligence and security Agencies and Defence Intelligence was both real
and significant. It was clear, therefore, that any Report would have to be subjected to
extensive redaction, and risked becoming unreadable. In order to be able to publish a Report
at all, we have accordingly decided to produce a shorter Report than usual, which takes the
form of a summary of the most important points we have noted during the Inquiry, at a high
level, without revealing underlying detail. We have supplemented this with a substantial
Annex, which provides both greater detail on the points we have raised and further rationale
for the judgements we have reached. This Annex is not published at this time, in view of
the current Russian threat.

11. The Report covers aspects of the Russian threat to the UK (Cyber; Disinformation
and Influence; and Russian Expatriates) followed by an examination of how the UK
Government 3 in particular the Agencies and Defence Intelligence 3 has responded
(Allocation of Effort; Strategy, Co-ordination and Tasking; A Hard Target; Legislation;
International Partnerships; and Engagement with Russia).

1
There is, of course, also a long history of hostile engagement between the Russian 3 and previously Soviet 3
intelligence services and their UK counterparts.
2
Throughout this report the term 8Intelligence Community9 is used to refer to the seven organisations that the
Committee oversees: the intelligence and security Agencies (MI5, SIS and GCHQ); Defence Intelligence in
the Ministry of Defence; the Office for Security and Counter-Terrorism (OSCT) in the Home Office; and the
National Security Secretariat (NSS) and Joint Intelligence Organisation (JIO) in the Cabinet Office.
2
12. As a result of our scrutiny, we have reached conclusions as to what is working well,
where there is a need for more, or different, effort, or where a strategy may need updating,
and we have commissioned a number of actions. These are embedded throughout the
Report. We note here, however, that there have been a number of cross-cutting themes
which have emerged during the course of our work:

" Most surprising, perhaps, was the extent to which much of the work of the
Intelligence Community is focused on ***. We had, at the outset of our Inquiry,
believed they would be taking a rather broader view, given that it is clearly
acknowledged that the Russians use a whole-of-state approach.
" This focus has led us to question who is responsible for broader work against the
Russian threat and whether those organisations are sufficiently empowered to tackle
a hostile state threat such as Russia. In some instances, we have therefore
recommended a shift in responsibilities. In other cases, we have recommended a
simplification: there are a number of unnecessarily complicated wiring diagrams that
do not provide the clear lines of accountability that are needed.
" The clearest requirement for immediate action is for new legislation: the Intelligence
Community must be given the tools it needs and be put in the best possible position
if it is to tackle this very capable adversary, and this means a new statutory
framework to tackle espionage, the illicit financial dealings of the Russian elite and
the 8enablers9 who support this activity.
" More broadly, the way forward lies with taking action with our allies; a continuing
international consensus is needed against Russian aggressive action. The West is
strongest when it acts collectively and that is the way in which we can best attach a
cost to Putin9s actions. The UK has shown it can shape the international response,
as it did in response to the Salisbury attacks. It must now seek to build on this effort
to ensure that momentum is not lost.

3
4
CYBER

A sophisticated player
13. GCHQ assesses that Russia is a highly capable cyber actor with a proven capability
to carry out operations which can deliver a range of impacts across any sector:

" Since 2014, Russia has carried out malicious cyber activity in order to assert itself
aggressively in a number of spheres, including attempting to influence the
democratic elections of other countries 3 for example, it has been widely reported
that the Russians were behind the cyber-enabled 8hack and leak9 operation to
compromise the accounts of members of the French political party En Marche! in
the run-up to the 2017 French elections. 3
" Russia has also undertaken cyber pre-positioning 4 activity on other nations9 Critical
National Infrastructure (CNI). 5 The National Cyber Security Centre (NCSC) has
advised that there is *** Russian cyber intrusion into the UK9s CNI 3 particularly
marked in the *** sectors.
" GCHQ has also advised that Russian GRU 6 actors have orchestrated phishing7
attempts against Government departments 3 to take one example, there were
attempts against ***, 8 the Foreign and Commonwealth Office (FCO) and the
Defence Science and Technology Laboratory (DSTL) during the early stages of the
investigation into the Salisbury attacks. 9
14. Russia has sought to employ organised crime groups to supplement its cyber skills:
SIS has observed that <this comes to the very muddy nexus between business and corruption
and state power in Russia=. 10 GCHQ told the Committee that there is <a quite considerable
balance of intelligence now which shows the links between serious and organised crime
groups and Russian state activity= and that <we9ve seen more evidence of *** serious and
organised crime *** being connected at high levels of Russian state and Russian
intelligence=, in what it described as a <symbiotic relationship=. 11

15. Russia9s cyber capability, when combined with its willingness to deploy it in a
malicious capacity, is a matter of grave concern, and poses an immediate and urgent threat
to our national security.

3
8Hack and leak9 refers to the obtaining of private information by hacking, and making it public.
4
Pre-positioning in the context of cyber activity is the process of exploring and securing an entry point in a
network that now, or in the future, could be used to disruptive effect. It is not always immediately apparent
whether the intrusion is for espionage purposes or pre-positioning.
5
Critical National Infrastructure (CNI) comprises the facilities, systems, sites, information, people, networks
and processes necessary for a country to function and upon which daily life depends. In the UK, there are 13
CNI sectors: Chemicals, Civil Nuclear, Communications, Defence, Emergency Services, Energy, Finance,
Food, Government, Health, Space, Transport and Water.
6
The GRU is the Main Intelligence Directorate of the General Staff of the Russian Armed Forces.
7
Phishing 3 the fraudulent practice of sending emails purporting to be from reputable organisations in order
to reveal personal information, such as passwords and credit card numbers.
8
***
9
GCHQ, Quarterly Report to the ISC, July3September 2018.
10
Oral evidence 3 SIS, *** February 2019.
11
Oral evidence 3 GCHQ, *** February 2019.

5
Leading the response
16. The NCSC 3 part of GCHQ 3 leads on protecting the UK from cyber attack and, as
the authority on the UK9s cyber security environment, sharing knowledge and addressing
systemic vulnerabilities. It is the Government9s interface with industry on cyber security
and leads on incident response (for example, in the event of a cyber attack on the UK9s
CNI).

17. However, it is clear that cyber is a crowded domain 3 or a <complex landscape=. 12

There are a number of agencies and organisations across the Intelligence Community which
have a role in countering the Russian cyber threat, and it was not immediately apparent how
these various agencies and organisations are co-ordinated and indeed complement each
other. The next iteration of the National Cyber Security Strategy must address this need for
greater cohesion.

18. Accountability is an issue in particular 3 whilst the Foreign Secretary has

responsibility for the NCSC, which is responsible for incident response, the Home Secretary
leads on the response to major cyber incidents. Indeed, there are a number of other Ministers
with some form of responsibility for cyber 3 the Defence Secretary has overall responsibility
for Offensive Cyber as a 8warfighting tool9 and for the National Offensive Cyber
Programme, while the Secretary of State for the Department for Digital, Culture, Media and
Sport (DCMS) leads on digital matters, with the Chancellor of the Duchy of Lancaster being
responsible for the National Cyber Security Strategy and the National Cyber Security
Programme. It makes for an unnecessarily complicated wiring diagram of responsibilities;
this should be kept under review by the National Security Council (NSC).

Attribution: a new approach

19. What is clear about the Government9s response is that it has now begun to take a
more assertive approach. Cyber attribution is the process of identifying and then laying
blame on the perpetrator of a cyber attack. The UK has historically been reticent in
attributing cyber attacks 3 as recently as 2010, this Committee was asked to redact mention
of Russia as a perpetrator of cyber attacks, on diplomatic grounds. 13

20. This new approach was indicated first by the response to the November 2017
WannaCry attack (with a statement by Foreign Office Minister Lord Ahmad condemning
the attack) and the subsequent response to the February 2018 NotPetya attack, then more
recently when the Foreign Secretary took the step, on 3 October 2018, of announcing
publicly that the UK and its allies had identified a campaign by the GRU of indiscriminate
and reckless cyber attacks targeting public institutions, businesses, media and sport 14 3
including attribution of the attempted hacking of the Organisation for the Prohibition of
Chemical Weapons (OPCW) in the Hague. 15 This must be the right approach; there has to
now be a cost attached to such activity. When attacks can be traced back 3 and we accept

12
Oral evidence 3 NSS, *** February 2019.
13
The Committee did not accept this request, and published the information.
14
NCSC, Reckless campaign of cyber attacks by Russian military intelligence service exposed, 3 October
2018, (www.ncsc.gov.uk/news/reckless-campaign-cyber-attacks-russian-military-intelligence-service-
exposed).
15
A joint statement was made by the Prime Minister, the Rt Hon. Theresa May MP, and the Prime Minister
of the Netherlands, Mr Mark Rutte, on 4 October 2018.

6
that this is in itself resource-intensive 3 the Government must always consider 8naming and
shaming9.

HMG as a player: Offensive Cyber

21. Nonetheless, this is an era of hybrid warfare and an Offensive Cyber capability is
now essential. The Government announced its intention to develop an Offensive Cyber
capability in September 2013, and in 2014 the National Offensive Cyber Programme
(NOCP) 3 a partnership between the Ministry of Defence and GCHQ 3 was established. 16

22. The UK continues to develop its Offensive Cyber capability. The Ministry of
Defence and GCHQ have described it as a <genuinely joint endeavour=. 17 This has led us to
question whether there are clear lines of accountability. The Committee was assured by the
Chief of Defence Intelligence that:

By executing a joint mission, we [the Ministry of Defence and GCHQ] can move
seamlessly between one set of authorisations and another, making sure we9re acting
appropriately, but those that are managing the capability are able to make that switch
and run those operations effectively. 18
We expect to be kept updated on how the dual authorisation process is working as the
capability itself continues to develop.

23. GCHQ and the Ministry of Defence have in recent years adopted a more open posture
on Offensive Cyber, 19 for example with public references to the successful prosecution of a
major Offensive Cyber campaign against Daesh. The issue of Offensive Cyber is addressed
in more detail in the classified Annex to this Report.

24. *** 3 GCHQ acknowledged that *** it would have to broaden its recruitment base,
with a shift towards recruiting on aptitude rather than on pre-existing skills. It was also
interesting to hear that Defence Intelligence is taking steps to develop and retain these skills
through revision of the military resourcing model, which will mean military personnel
remaining in cyber roles for longer than the current one to two years. The Committee
supports the lengthening of posts as a general principle across the board, not just in Defence
Intelligence and not just in cyber. Corporate knowledge and experience are continually lost
across Government with such short rotations, and there is a question as to how long an
individual needs in a post in order to start contributing or whether they move on just as they
are up to speed. We commend Defence Intelligence for being the first to recognise this
problem and take action.

International actions
25. Whilst the UK must have its own defensive and offensive capabilities, it must also
be prepared to lead international action. In terms of attribution, it is apparent that not
everyone is keen to adopt this new approach and to 8call out9 Russia on malicious cyber
activity. The Government must now leverage its diplomatic relationships to develop a

16
The announcement by then Defence Secretary Philip Hammond also included the launch of a Cyber Reserve
Unit.
17
Oral evidence 3 GCHQ, *** February 2019.
18
Oral evidence 3 Defence Intelligence, *** February 2019.
19
The Director of GCHQ referenced the cyber campaign against Daesh in a speech at CyberUK on 21 April
2018.
7
common international approach when it comes to the attribution of malicious cyber activity
by Russia and others.

26. There is also a need for a common international approach in relation to Offensive
Cyber. It is clear there is now a pressing requirement for the introduction of a doctrine, or
set of protocols, to ensure that there is a common approach to Offensive Cyber. While the
UN has agreed that international law, and in particular the UN Charter, applies in
cyberspace, there is still a need for a greater global understanding of how this should work
in practice. The Committee made this recommendation over two years ago in its Annual
Report 201632017. 20 It is imperative that there are now tangible developments in this area
in light of the increasing threat from Russia (and others, including China, Iran and the
Democratic People9s Republic of Korea). Achieving a consensus on this common approach
will be a challenging process, but as a leading proponent of the Rules Based International
Order it is essential that the UK helps to promote and shape Rules of Engagement, working
with our allies. 21

20
Intelligence and Security Committee of Parliament Annual Report 201632017, HC 655.
21
The UK9s position on applying international law to cyberspace was set out in a speech, Cyber and
International Law in the 21st century, delivered by the Attorney General, the Rt Hon. Jeremy Wright QC MP,
at Chatham House on 23 May 2018.
8
DISINFORMATION AND INFLUENCE

27. The spreading of disinformation (by which we mean the promotion of intentionally
false, distorting or distracting narratives) and the running of 8influence campaigns9 are
separate but interlinked subjects. An influence campaign in relation to an election, for
example, may use the spreading of disinformation, but may also encompass other tactics
such as illicit funding, disruption of electoral mechanics or direct attacks on one of the
campaigns (such as 8hack and leak9). Equally, the spreading of disinformation is not
necessarily aimed at influencing any individual outcome; it can simply have broad
objectives around creating an atmosphere of distrust or otherwise fracturing society. 22

28. Russia9s promotion of disinformation and its attempts at broader political influence
overseas have been widely reported. 23 Examples include:

" use of state-owned traditional media: open source studies have shown serious
distortions in the coverage provided by Russian state-owned international
broadcasters such as RT and Sputnik; 24
" 8bots9 and 8trolls9: open source studies have identified significant activity on social
media;
" 8hack and leak9: the US has publicly avowed that Russia conducted 8hack and leak9
operations in relation to its presidential election in 2016, and it has been widely
alleged that Russia was responsible for a similar attack on the French presidential
election in 2017; and
" 8real life9 political interference: it has been widely reported that Kremlin-linked
entities have made 8soft loans9 to the (then) Front National in France, seemingly
at least in part as a reward for the party having supported Russia9s annexation of
Crimea, 25 and the GRU sponsored a failed coup in Montenegro in October 2016 26
3 an astonishingly bold move in a country just a few months from its accession to
NATO.
29. Russia may spread disinformation or seek to influence political events for a wide
range of purposes, but all in support of its underlying foreign policy objectives:

" direct support of a pro-Russian narrative in relation to particular events (whilst

some of the outright falsehoods which are put forward may not be widely believed,

22
Promoting disinformation does not usually lead to any criminal or civil liability under UK law, but an
influence campaign which interferes in a democratic process could (this is considered further in the Legislation
section of this Report).
23
We note that Russia9s disinformation efforts against the West are dwarfed by those which the Russian state
conducts against its own population.
24
A survey of some such studies can be found in the Digital, Culture, Media and Sport Select Committee9s
report Disinformation and 8Fake News9, HC 1791, 18 February 2019. In the case of RT, Edward Lucas
informed the Committee that the direct <impact of RT & is tiny & Any one time & there is an average of
1,300 people in this country watching RT & the real point of RT is it is a way of gaining legitimacy in elite
circles and not least saying to MPs and Peers 8Here is [say] £2,000 in cash if you appear on our programme9=
and Christopher Donnelly explained that <in the UK its main impact & is through social media output. It gets
out its message on any serious activity that happens [on social media] within 20 minutes ...= (oral evidence 3
12 July 2018).
25
***
26
Written evidence 3 HMG, 29 June 2018.

9
 they may still succeed in casting doubt on the true account of events: <When people
start to say 8You don9t know what to believe9 or 8They9re all as bad as each other9,
the disinformers are winning= 27);
" direct support of Russia9s preferred outcome in relation to an overseas election or
political issue; and
" general poisoning of the political narrative in the West by fomenting political
extremism and 8wedge issues9, 28 and by the 8astroturfing9 29 of Western public
opinion; and general discrediting of the West. 30
30. In terms of the direct threat to elections, we have been informed that the mechanics
of the UK9s voting system are deemed largely sound: the use of a highly dispersed paper-
based voting and counting system makes any significant interference difficult, and we
understand that GCHQ has undertaken a great deal of work to help ensure that the online
voter registration system is safe. 31 Nonetheless, GCHQ informed us that <***=, 32 and the
Deputy National Security Adviser noted that <there is a lot of work going on [in relation to
electoral mechanics] to map the end-to-end processes & *** and to make sure where we
can we are mitigating the risks there=. 33 This was reflected in the Joint Intelligence
Committee (JIC) judgement in May 2017 that <the UK paper-based voting process is
protected from cyber operations but ***=. 34 ***. The Committee will expect an update on
this in six months.

A 8hot potato9
31. The UK is clearly a target for Russia9s disinformation campaigns and political
influence operations 35 and must therefore equip itself to counter such efforts. The Agencies
have emphasised that they see their role in this as providing secret intelligence 36 as context
for other organisations, as part of a wider HMG response: 37 they do not view themselves as

27
The Integrity Initiative Guide to Countering Russian Disinformation, 2018 (the Integrity Initiative is a
project run by the Institute for Statecraft, a UK-based think-tank and charity, aimed at countering Russian
disinformation campaigns).
28
8Wedge issues9 are highly divisive subjects which bifurcate a country9s population, often (but not always)
into socially liberal and socially conservative camps, and which often to at least some degree transcend
traditional political party boundaries. Examples of wedge issues include abortion and gun control in the US
and Brexit in the UK.
29
8Astroturfing9 is a propaganda technique whereby a viewpoint is falsely presented as belonging to a certain
group. In this instance, employees of the Russian state and Russian-controlled bots may masquerade as
ordinary British citizens on social media and give the UK9s politicians, journalists and other people who may
have power and influence the impression 3 simply via the sheer quantity of posts 3 that the views espoused
are genuinely those of a majority of their country9s public.
30
Whilst the purpose of this sort of campaign is sometimes to directly damage Western positions, some of this
effort is aimed at ensuring that the nature of Russia9s ruling elite is not exposed. In the words of Edward Lucas
in his evidence to the Committee: <If you believe that the West is run by hypocritical, incompetent, greedy
politicians, then it becomes much harder to take any kind of moral high ground about Russia which really is
run by very, very bad people.=
31
Oral evidence 3 GCHQ, *** December 2018; oral evidence 3 NSS, *** February 2019.
32
Oral evidence 3 GCHQ, *** February 2019.
33
Oral evidence 3 NSS, *** February 2019.
34
JIC(17)053.
35
We note that the formal HMG assessment categorises the UK as a <***= target for political influence
operations.
36
In addition to providing secret intelligence, the Agencies may ***.
37
We note that the Centre for the Protection of National Infrastructure (CPNI) and the National Cyber Security
Centre (NCSC) also support the Government security architecture and play a role in protecting the mechanics
of elections, including informing improvements to electoral management software and through protective
security advice to political parties.
10
holding primary responsibility for the active defence of the UK9s democratic processes from
hostile foreign interference, and indeed during the course of our Inquiry appeared
determined to distance themselves from any suggestion that they might have a prominent
role in relation to the democratic process itself, noting the caution which had to be applied
in relation to intrusive powers in the context of a democratic process. They informed us that
the Department for Digital, Culture, Media and Sport (DCMS) holds primary responsibility
for disinformation campaigns, and that the Electoral Commission has responsibility for the
overall security of democratic processes.

32. However, DCMS told us that its function is largely confined to the broad HMG
policy regarding the use of disinformation rather than an assessment of, or operations
against, hostile state campaigns. It has been surprisingly difficult to establish who has
responsibility for what. Overall, the issue of defending the UK9s democratic processes and
discourse has appeared to be something of a 8hot potato9, with no one organisation
recognising itself as having an overall lead.

33. Whilst we understand the nervousness around any suggestion that the intelligence
and security Agencies might be involved in democratic processes 3 certainly a fear that is
writ large in other countries 3 that cannot apply when it comes to the protection of those
processes. And without seeking in any way to imply that DCMS is not capable, or that the
Electoral Commission is not a staunch defender of democracy, it is a question of scale and
access. DCMS is a small Whitehall policy department and the Electoral Commission is an
arm9s length body; neither is in the central position required to tackle a major hostile state
threat to our democracy. Protecting our democratic discourse and processes from hostile
foreign interference is a central responsibility of Government, and should be a ministerial
priority.

34. In our opinion, the operational role must sit primarily with MI5, in line with its
statutory responsibility for <the protection of national security and, in particular, its
protection against threats from espionage, terrorism and sabotage, from the activities of
agents of foreign powers and from actions intended to overthrow or undermine
parliamentary democracy & =. 38 The policy role should sit with the Office for Security and
Counter-Terrorism (OSCT) 3 primarily due to its ten years of experience in countering the
terrorist threat and its position working closely with MI5 within the central Government
machinery. This would also have the advantage that the relationship built with social media
companies to encourage them to co-operate in dealing with terrorist use of social media
could be brought to bear against the hostile state threat; indeed, it is not clear to us why the
Government is not already doing this.

35. With that said, we note that 3 as with so many other issues currently 3 it is the social
media companies which hold the key and yet are failing to play their part; DCMS informed
us that ***. 39 The Government must now seek to establish a protocol with the social media
companies to ensure that they take covert hostile state use of their platforms seriously, and
have clear timescales within which they commit to removing such material. Government
should 8name and shame9 those which fail to act. Such a protocol could, usefully, be
expanded to encompass the other areas in which action is required from the social media
companies, since this issue is not unique to Hostile State Activity. This matter is, in our

38
Section 1(2), Security Service Act 1989; MI5 has informed us that it currently has a role to (i) <investigate
leads to any of this sort of clandestine activity by foreign states=; (ii) <translate [the] intelligence picture into
protective advice to defend our systems=; and (iii) <provide assessed intelligence reporting into the policy
system to assist in policy formulation= (oral evidence 3 MI5, *** December 2018).
39
Written evidence 3 DCMS, 13 February 2019.
11
view, urgent and we expect the Government to report on progress in this area as soon as
possible.

The Defending Democracy programme

36. The problems identified above regarding roles and responsibilities may be addressed
by the Government9s Defending Democracy programme, which was publicly announced in
July 2019. We have been told that this will co-ordinate the Government9s work on protecting
democratic discourse and processes from interference under the leadership of the Cabinet
Office, with the Chancellor of the Duchy of Lancaster 40 and the Deputy National Security
Adviser holding overall responsibility at ministerial and official level respectively.

37. The aim is sound, but the response proposed is still rather fragmented (with at least
ten separate teams within Government involved, as well as the Electoral Commission and
Information Commissioner9s Office). In addition, it seems to have been afforded a rather
low priority: it was signed off by the National Security Council only in February 2019,
almost three years after the EU referendum campaign and the US presidential election which
brought these issues to the fore. In the Committee9s view, a foreign power seeking to
interfere in our democratic processes 3 whether it is successful or not 3 cannot be taken
lightly; our democracy is intrinsic to our country9s success and well-being and any threat to
it must be treated as a serious national security issue by those tasked with defending us.

Political advertising on social media

38. The regulation of political advertising falls outside this Committee9s remit. We
agree, however, with the DCMS Select Committee9s conclusion that the regulatory
framework needs urgent review if it is to be fit for purpose in the age of widespread social
media. In particular, we note and affirm the Select Committee9s recommendation that all
online political adverts should include an imprint stating who is paying for it. 41 We would
add to that a requirement for social media companies to co-operate with MI5 where it is
suspected that a hostile foreign state may be covertly running a campaign.

Case study: the EU referendum

39. There have been widespread public allegations that Russia sought to influence the
2016 referendum on the UK9s membership of the EU. The impact of any such attempts
would be difficult 3 if not impossible 3 to assess, and we have not sought to do so. However,
it is important to establish whether a hostile state took deliberate action with the aim of
influencing a UK democratic process, irrespective of whether it was successful or not.

40. Open source studies have pointed to the preponderance of pro-Brexit or anti-EU
stories on RT and Sputnik, and the use of 8bots9 and 8trolls9, as evidence of Russian attempts
to influence the process. 42 We have sought to establish whether there is secret intelligence
which supported or built on these studies. In response to our request for written evidence at
the outset of the Inquiry, MI5 initially provided just six lines of text. It stated that ***, before
referring to academic studies. 43 This was noteworthy in terms of the way it was couched
(***) and the reference to open source studies ***. The brevity was also, to us, again,

40
The Chancellor of the Duchy of Lancaster delegates to the Minister for the Constitution as appropriate.
41
DCMS Select Committee, Disinformation and 8Fake News9, HC 1791, 18 February 2019.
42
The DCMS Select Committee9s report Disinformation and 8Fake News9 (HC 1791, 18 February 2019)
surveys and comments on some of these studies.
43
Written evidence 3 HMG, 3 April 2018.
12
indicative of the extreme caution amongst the intelligence and security Agencies at the
thought that they might have any role in relation to the UK9s democratic processes, and
particularly one as contentious as the EU referendum. We repeat that this attitude is illogical;
this is about the protection of the process and mechanism from hostile state interference,
which should fall to our intelligence and security Agencies.

(i) Failure to prepare

41. There has been credible open source commentary suggesting that Russia undertook
influence campaigns in relation to the Scottish independence referendum in 2014. 44
However, at the time ***. It appears that *** what some commentators have described as
potentially the first post-Soviet Russian interference in a Western democratic process. We
note that 3 almost five years on 3 ***. 45

42. It was only when Russia completed a 8hack and leak9 operation against the
Democratic National Committee in the US 3 with the stolen emails being made public a
month after the EU referendum 3 that it appears that the Government belatedly realised the
level of threat which Russia could pose in this area, given that the risk thresholds in the
Kremlin had clearly shifted, describing the US 8hack and leak9 as a <game changer=, 46 and
admitting that <prior to what we saw in the States, [Russian interference] wasn9t generally
understood as a big threat to [electoral] processes=. 47

43. It appears that the Intelligence Community did learn lessons from the US experience,
and HMG recognised the Russian threat to the UK9s democratic processes and political
discourse. In May 2017, the Joint Intelligence Committee (JIC) concluded that <***= and
that <***=. 48 Had the relevant parts of the Intelligence Community conducted a similar
threat assessment prior to the referendum, it is inconceivable that they would not have
reached the same conclusion as to Russian intent, which might then have led them to take
action to protect the process.

(ii) Narrow coverage

44. The written evidence provided to us appeared to suggest that HMG had not seen or
sought evidence of successful interference in UK democratic processes or any activity that
has had a material impact on an election, for example influencing results. 49,50 ***. ***. 51

44
For example, it was widely reported shortly after the referendum that Russian election observers had
suggested that there were irregularities in the conduct of the vote, and this position was widely pushed by
Russian state media. We understand that HMG viewed this as being primarily aimed at discrediting the UK in
the eyes of a domestic Russian audience. More recently, we note the study by Ben Nimmo 3 #ElectionWatch:
Scottish Vote, Pro-Kremlin Trolls, 12 December 2017.
45
Oral evidence 3 GCHQ, *** December 2018 ***.
46
***
47
***
48
JIC Key Judgement, ***, 26 May 2017.
49
*** (written evidence 3 HMG, 29 June 2018).
50
We note that Arron Banks became the biggest donor in British political history when he gave £8m to the
Leave.EU campaign. In October 2018, the Electoral Commission 3 which had been investigating the source
of this donation 3 referred the case to the National Crime Agency, which investigated it ***. In September
2019, the National Crime Agency announced that it had concluded the investigation, having found no evidence
that any criminal offences had been committed under the Political Parties, Elections and Referendums Act
2000 or company law by any of the individuals or organisations referred to it by the Electoral Commission.
51
***

13
45. This focus on *** indicates that open source material (for example, the studies of
attempts to influence the referendum using RT and Sputnik, or social media campaigns
referred to earlier) was not fully taken into account. Given that the Committee has
previously been informed that open source material is now fully represented in the
Government9s understanding of the threat picture, it was surprising to us that in this instance
it was not.

46. Whilst it may be true that some issues highlighted in open source did not require the
secret investigative capabilities of the intelligence and security Agencies or were at the
periphery of their remits, the Agencies nonetheless have capabilities which allow them to
8stand on the shoulders9 of open source coverage: for example, GCHQ might attempt to
look behind the suspicious social media accounts which open source analysis has identified
to uncover their true operators (and even disrupt their use), or SIS might specifically task
an agent to provide information on the extent and nature of any Russian influence
campaigns. 52 However, we have found *** which suggests that ***. ***.

(iii) Lack of retrospective assessment

47. We have not been provided with any post-referendum assessment of Russian
attempts at interference, ***. 53 This situation is in stark contrast to the US handling of
allegations of Russian interference in the 2016 presidential election, where an intelligence
community assessment 54 was produced within two months of the vote, with an unclassified
summary being made public. Whilst the issues at stake in the EU referendum campaign are
less clear-cut, it is nonetheless the Committee9s view that the UK Intelligence Community
should produce an analogous assessment of potential Russian interference in the EU
referendum and that an unclassified summary of it be published. 55

48. ***. Even if the conclusion of any such assessment were that there was minimal
interference, this would nonetheless represent a helpful reassurance to the public that the
UK9s democratic processes had remained relatively safe.

52
***
53
***
54
Office of the Director of National Intelligence, Assessing Russian Activities and Intentions in Recent US
Elections, 6 January 2017.
55
We note that the DCMS Select Committee has called on the Government to launch an independent
investigation into foreign influence, disinformation, funding, voter manipulation and the sharing of data in
relation to the Scottish independence referendum, the EU referendum and the 2017 General Election. If the
Government were to take up this recommendation for a wider investigation, the assessment we recommend
should take place could feed into it (DCMS Select Committee, Disinformation and 8Fake News9, HC 1791,
18 February 2019, recommendation 39).
14
RUSSIAN EXPATRIATES

Welcoming oligarchs with open arms

49. Whilst the Russian elite have developed ties with a number of countries in recent
years, it would appear that the UK has been viewed as a particularly favourable destination
for Russian oligarchs and their money. It is widely recognised that the key to London9s
appeal was the exploitation of the UK9s investor visa scheme, introduced in 1994, followed
by the promotion of a light and limited touch to regulation, with London9s strong capital
and housing markets offering sound investment opportunities. The UK9s rule of law and
judicial system were also seen as a draw. The UK welcomed Russian money, and few
questions 3 if any 3 were asked about the provenance of this considerable wealth. It appears
that the UK Government at the time held the belief (more perhaps in hope than expectation)
that developing links with major Russian companies would promote good governance by
encouraging ethical and transparent practices, and the adoption of a law-based commercial
environment.

50. What is now clear is that it was in fact counter-productive, in that it offered ideal
mechanisms by which illicit finance could be recycled through what has been referred to as
the London 8laundromat9. The money was also invested in extending patronage and building
influence across a wide sphere of the British establishment 3 PR firms, charities, political
interests, academia and cultural institutions were all willing beneficiaries of Russian money,
contributing to a 8reputation laundering9 process. In brief, Russian influence in the UK is
8the new normal9, and there are a lot of Russians with very close links to Putin who are well
integrated into the UK business and social scene, and accepted because of their wealth. This
level of integration 3 in 8Londongrad9 in particular 3 means that any measures now being
taken by the Government are not preventative but rather constitute damage limitation.

51. It is not just the oligarchs either: the arrival of Russian money resulted in a growth
industry of enablers 3 individuals and organisations who manage and lobby for the Russian
elite in the UK. Lawyers, accountants, estate agents and PR professionals have played a
role, wittingly or unwittingly, in the extension of Russian influence which is often linked to
promoting the nefarious interests of the Russian state. A large private security industry has
developed in the UK to service the needs of the Russian elite, in which British companies
protect the oligarchs and their families, seek kompromat 56 on competitors, and on occasion
help launder money through offshore shell companies and fabricate 8due diligence9 reports,
while lawyers provide litigation support. William Browder told the Committee that:

Russian state interests, working in conjunction with and through criminal private
interests, set up a 8buffer9 of Westerners who become de facto Russian state agents,
many unwittingly, but others with a reason to know exactly what they are doing and
for whom. As a result, UK actors have to deal with Russian criminal interests masked
as state interests, and Russian state interests masked by their Western agents. 57

Trying to shut the stable door

52. The links of the Russian elite to the UK 3 especially where this involves business
and investment 3 provide access to UK companies and political figures, and thereby a means

56
Kompromat 3 compromising information collected for use in blackmailing, discrediting or manipulating
someone, typically for political purposes.
57
Written evidence 3 William Browder, 14 September 2018.
15
for broad Russian influence in the UK. To a certain extent, this cannot be untangled and the
priority now must be to mitigate the risk and ensure that, where hostile activity is uncovered,
the tools exist to tackle it at source.

53. The extent to which Russian expatriates are using their access to UK businesses and
politicians to exert influence in the UK is ***: it is widely recognised that Russian
intelligence and business are completely intertwined. The Government must ***, take the
necessary measures to counter the threat and challenge the impunity of Putin-linked elites.
Legislation is a key step, and is addressed later in this Report.

54. Several members of the Russian elite who are closely linked to Putin are identified
as being involved with charitable and/or political organisations in the UK, having donated
to political parties, with a public profile which positions them to assist Russian influence
operations. It is notable that a number of Members of the House of Lords have business
interests linked to Russia, or work directly for major Russian companies linked to the
Russian state 3 these relationships should be carefully scrutinised, given the potential for
the Russian state to exploit them. It is important that the Code of Conduct for Members of
the House of Lords, and the Register of Lords9 interests, including financial interests,
provide the necessary transparency and are enforced. In this respect, we note that the Code
of Conduct for Members of Parliament requires that MPs register individual payments of
more than £100 which they receive for any employment outside the House 3 this does not
apply to the House of Lords, and consideration should be given to introducing such a
requirement. A 8Foreign Agents Registration Act9 (an issue which is addressed in the section
on Legislation) would also be helpful in this respect.
55. The Government effort on the disruption of Russian illicit financial activity in the
UK is led and co-ordinated by the National Crime Agency (NCA). 58 Its work also
encompasses the investigation of UK-based professional enablers in the financial and
property sectors, with the aim of hardening the UK financial and property markets from the
proceeds of crime, and challenging any perception that the UK is a safe haven for illicit
funds. The extent to which this money has now been invested, and reinvested, calls into
question the efficacy of the recently introduced Unexplained Wealth Orders when applied
to the investigation of individuals with such long-established 3 and to all intents and
purposes now apparently legitimate 3 financial interests in the UK. Whilst the Orders appear
to provide the NCA with more clout and greater powers, the reality is that it is highly
probable that the oligarchy will have the financial means to ensure their lawyers 3 a key
group of professional enablers 3 find ways to circumvent this legislation (we return to this
issue later in the Report). By contrast, the NCA lacks the resources required in terms of
financial investigators, technical experts and legal expertise 3 this must be rectified. 59

56. The inherent tension between the Government9s prosperity agenda and the need to
protect national security that has led to the current situation has been played out across
Whitehall departments. However, the formation of the new Serious and Organised Crime
(SOC) Group within the Home Office at the end of 2018 was a tangible acknowledgement
of economic crime as a national security issue. The SOC Group has a wide-ranging remit 3
it is hoped that it will be provided with the necessary resources and will give sufficient

58
The Committee is grateful to the NCA for providing evidence for this Inquiry. The Committee does not
oversee the NCA; its work and operations usually fall outside the remit of the ISC.
59
The Serious and Organised Crime Strategy, published on 1 November 2018, announced the establishment
of a multi-agency National Assessment Centre (NAC) and the National Economic Crime Centre within the
NCA.

16
priority to disrupting the threat posed by illicit Russian financial activity. One key measure
would be an overhaul of the Tier 1 (Investor) visa programme 60 3 there needs to be a more
robust approach to the approval process for these visas.

Russians at risk
57. Whilst the oligarchs and their money have been the most obviously visible part of
the Russian diaspora, recent events have highlighted the number of Russians in the UK who
are on the opposing side. Since Putin came to power in 1999, a number of critics of Putin
and the Russian government have sought sanctuary in the UK, fearing politically motivated
criminal charges and harassment. 61 They are of interest to the Russian Intelligence Services
(RIS), which may seek to target them in a number of ways:

" it is possible the RIS will seek to monitor some of these individuals using human
sources (i.e. agents) and by technical means, for example by intercepting phone
calls and hacking into their personal electronic devices;
" RIS collection of intelligence could also be used in support of 8influence
operations9, with the objective of degrading an individual9s ability to encourage
international or domestic Russian political opposition to Putin and his government;
or
" the RIS may seek to identify or engineer opportunities to arrange an individual9s
arrest and transfer to Russia to stand trial, or indeed meet a worse fate.
58. On 15 June 2017, BuzzFeed News published the results of its investigation into 14
deaths in the UK of Russian business figures and British individuals linked to them. 62 The
attempted assassination of Sergei and Yulia Skripal in March 2018 prompted calls for the
Government to investigate the allegations that had been made in the BuzzFeed report and,
on 6 March 2018, the Chair of the Home Affairs Select Committee wrote to the Home
Secretary calling for a review of the 14 deaths, given the <considerable concerning
evidence= from BuzzFeed which raised <questions over the robustness of the police
investigations=. 63

59. The Committee has taken evidence on these matters. We have been told that ***.
64
***.

60. We questioned whether the need to protect those at risk in the UK has been given
sufficient priority. We were assured that all figures at risk 3 Russian or otherwise 3 receive
protection according to the level of risk, through a police-led process ***. 65

61. We welcomed this process, but questioned whether the Intelligence Community has
a clear picture of how many Russians there are in the UK who are at risk 3 for example,
would MI5 or any other relevant agency ***? This would appear to be an immediate and
obvious way in to the issue, and the ***, so it would appear manageable. In response we
were told that ***.

60
A Tier 1 (Investor) visa allows the recipient to stay in the UK for three years and four months in exchange
for a £2m investment in the UK.
61
These include such high-profile figures as ***.
62
8From Russia with Blood9, BuzzFeed News, 15 June 2017.
63
Letter from the Chair of the Home Affairs Select Committee to the Home Secretary, 6 March 2018.
64
***
65
Oral evidence 3 *** February 2019.
17
62. The events of 4 March 2018 showed that it is not only individuals who are openly
critical of Putin who are at risk here in the UK. The Salisbury attack has highlighted the
vulnerability of former Russian intelligence officers who have settled in the UK. This issue
was investigated by the Committee as part of its Inquiry, and is addressed in the classified
Annex to this Report.

18
ALLOCATION OF EFFORT

63. It is clear that Russia currently poses a significant threat to the UK on a number of
fronts 3 from espionage to interference in democratic processes, and to serious crime. The
question is how that has happened 3 and what the Intelligence Community is now doing to
tackle it.

Coverage
64. In its Annual Report 200132002, the Committee raised a concern that, as resources
were being transferred to counter-terrorism, coverage of other areas had become
increasingly thin:

These reductions are causing intelligence gaps to develop, which may mean that over
time unacceptable risks will arise in terms of safeguarding national security and in
the prevention and detection of serious organised crime. The Agencies must be given
sufficient resources to enable them not only to fill the staff vacancies that have been
created but also to expand sufficiently to ensure that they can meet the new demands
now being placed on them. 66
The Government responded:

The Government recognises that the increase in demand for intelligence to support
the campaign against terrorism has meant that the Agencies, amongst others, have
been obliged to review their priorities within their own budgets. This process has been
carried out professionally and carefully, and the Government will continue to keep
the situation under review. It is inevitable that if some areas of activity become
relatively more important to the national interest, others become relatively less so and
may have less resources devoted to them. All decisions about matching resources to
tasks involve a degree of risk. Identifying, quantifying, managing, and where possible
mitigating those risks is one of the basic responsibilities of the management of the
Agencies. The Government is confident that the judgements taken so far have been the
right ones, and that no unacceptable risks with or to national security have been, or
will be taken. 67
65. In its Annual Report 200232003, the Committee reported that it believed that the
problem of intelligence collection gaps had worsened, concluding that:

The Committee believes that, with the focus on current crises, the Agencies9 long-term
capacity to provide warnings is being eroded. This situation needs to be addressed
and managed by Ministers and the JIC [Joint Intelligence Committee]. 68
In 200332004, the Committee again expressed concern:

We remain concerned that, because of the necessary additional effort allocated to

counter-terrorism by the Security Service, significant risks are inevitably being taken
in the area of counter-espionage. 69

66
Intelligence and Security Committee of Parliament Annual Report 200132002, Cm 5542.
67
As quoted in the Intelligence and Security Committee of Parliament Annual Report 200232003, Cm 5837.
68
Intelligence and Security Committee of Parliament Annual Report 200232003, Cm 5837.
69
Intelligence and Security Committee of Parliament Annual Report 200332004, Cm 6240.
19
MI5
66. MI59s remit 3 as set out in the Security Service Act 1989 3 is the <protection of
national security and, in particular, its protection against threats from espionage, terrorism
and sabotage, from the activities of agents of foreign powers and from actions intended to
overthrow or undermine parliamentary democracy by political, industrial or violent
means=. 70 MI5 states its objectives in this area as being to <seek to find those trying to pass
sensitive UK information and equipment to other countries and ensure they don9t succeed=
and to <investigate and disrupt the actions of foreign intelligence officers where these are
damaging to our country9s interests=. 71

67. Twenty years ago, MI5 devoted around 20% of its effort to Hostile State Activity,
which includes Russian activity alongside the hostile activity of other states, such as China
and Iran. 72 This allocation of effort declined, as the terrorist threat grew. By 2001/02, it had
reduced to 16% and by 2003/04 to 10.7%. This fall continued until, by 2008/09, only 3% of
effort was allocated by MI5 to all its work against Hostile State Activity (noting that
reductions in proportion of overall effort do not translate directly into changes in
resource). 73 It was not until 2013/14 that effort began to increase significantly, rising to
14.5% 74 3 a level that MI5 says meant that slightly more staff were working on Russia than
had been during the Cold War. 75 The past two years have seen ***: currently, ***% is
allocated to Hostile State Activity, approximately *** which is dedicated to countering
Russian Hostile State Activity. 76

SIS and GCHQ

68. SIS is the UK9s foreign human intelligence (HUMINT) agency, with a <global covert
capability= 77 focusing on intelligence gathering. Areas of intelligence coverage work that
SIS undertakes in relation to Russia include cultivating agents who are in a position to pass
on secret information, particularly in relation to the capabilities and intent of the Russian
government, and its intelligence effects work includes ***. In 2001, SIS9s operational effort
against Russia was ***%. This declined to ***% in 2007. It only began to increase
significantly in *** and currently stands at approximately ***%. 78

69. GCHQ is the UK9s signals intelligence (SIGINT) agency 3 also focusing on
intelligence gathering. 79 GCHQ9s intelligence effects work primarily comprises Offensive
Cyber. Areas of intelligence coverage work that GCHQ undertakes include: applying
selectors to emails obtained by bulk interception; targeted interception of the phone calls of

70
Section 1(2) of the Security Service Act 1989.
71
www.mi5.gov.uk/espionage
72
Written evidence 3 MI5, 31 October 2018.
73
Intelligence and Security Committee of Parliament Annual Reports: 200132002, Cm 5542; 200332004, Cm
6240; 200832009, Cm 7807.
74
Written evidence 3 MI5, 31 October 2018.
75
Intelligence and Security Committee of Parliament Annual Report 201632017, HC 655.
76
Written evidence 3 MI5, 12 March 2019; MI59s overall resource has increased significantly over this period.
*** allocation of effort on Hostile State Activity has ***, spending on Hostile State Activity has ***. This
operational effort also benefits from the support of corporate and 8enabling9 services across MI5 (which is not
reflected in these figures).
77
www.sis.gov.uk
78
Written evidence 3 SIS, 17 December 2018.
79
SIGINT is intelligence gathering through the interception of communications between people, and through
the interception of other electronic signals.

20
people of interest; intercepting material transmitted over military communications systems;
and hacking into computer systems in order to obtain the information they contain.

70. At the height of the Cold War, 70% of GCHQ9s effort was focused on the Soviet
bloc. 80 By 2000, this had fallen to 16% and by 2006 effort was at a low point of just 4%. In
2012, this had recovered to 10%, which stayed fairly constant until 2016 when a significant
further increase began. 81 Approximately ***% of GCHQ9s current operational effort is on
Russia. 82

Defence Intelligence
71. Defence Intelligence has wide-ranging responsibilities for intelligence collection and
analysis, and a key role within Government in the preparation of All Source intelligence on
Russia. It leads the UK9s work on geospatial intelligence (GEOINT) and measurement and
signature intelligence (MASINT). 83 It also holds a SIGINT role ***, and has a HUMINT
unit which is primarily used to support military operations. Alongside GCHQ, it also has a
major role in the UK9s Offensive Cyber capability. Defence Intelligence effort on Russia
also underwent significant reduction in the early 2000s. Although Defence Intelligence has
been unable to provide figures for its allocation of effort over the past 20 years, we have
been told that in 2013 there were relatively few All Source analysts in the Russia/Eurasia
team (in addition to Russia-focused analysts in other teams). Defence Intelligence has
advised that currently *** of its All Source analysts spend more than 50% of their time on
Russia and a further *** spend less than 50% of their time on Russia. 84

Did HMG take its eye off the ball?

72. Following the end of the Cold War, the West aspired to partner with Russia. The
threat posed by Russia was considered to be diminished and the proportion of effort
allocated to countering the threat decreased accordingly. As can be seen from the figures
above, there was a marked drop in allocation of effort. The murder of Alexander Litvinenko
in 2006 was perhaps the clearest indication that not only had reconciliation failed, but Russia
was once again just as hostile towards the West, and towards the UK. However, by 2006,
operational effort was being directed to the fight against international terrorism: in 2006/07,
MI5 devoted 92% of its effort to counter-terrorism work, 85 with SIS and GCHQ at 33%. 86
The remaining resource was thinly spread across a number of areas 3 Hostile State Activity
being just one, and Russia being just one of the hostile states. This is understandable: the

80
Oral evidence 3 GCHQ, *** December 2018.
81
Written evidence 3 GCHQ, 8 March 2019.
82
Written evidence 3 GCHQ, 14 December 2018.
83
Geospatial intelligence (GEOINT) consists of collecting and analysing intelligence on geographical features
and the human activities that occur in a geographical context. Measurement and signature intelligence
(MASINT) uses technical means to detect and analyse the 8signatures9 of targets, in order to locate, analyse
and track them.
84
This represents ***% of Defence Intelligence9s current analytical resource being focused on Russia (written
evidence 3 Defence Intelligence, 6 March 2019).
85
Written evidence 3 MI5, 31 October 2018.
86
Written evidence 3 SIS, 17 December 2018; Intelligence and Security Committee of Parliament Annual
Report 200732008 Cm 7542. Defence Intelligence told us that it seconded its analytical effort on counter-
terrorism to the Joint Terrorism Analysis Centre (JTAC) when it was established in 2003. This was estimated
to be 20 posts by 2006/07 3 just 1% of its then workforce (written evidence 3 Defence Intelligence, 21 March
2019).

21
threat from international terrorism at that time 3 just a year after the 2005 terror attacks
which claimed the lives of 52 people 3 had to be the primary focus.

73. If we consider the Russian threat to have been clearly indicated in 2006 with the
murder of Alexander Litvinenko, and then take events such as the annexation of Crimea in
2014 as firmly underlining Russian intent on the global stage, the question is whether the
Intelligence Community should 3 and could 3 have reacted more quickly and increased
operational effort on Russia. On figures alone, it could be said that they took their eye off
the ball; nevertheless, the Heads of MI5, SIS, GCHQ and Defence Intelligence all sought to
defend against this suggestion. MI5 was clear that there was an inevitable reprioritisation
due to the terrorist threat:
& back then it9s how can we possibly do enough to get ahead of this appalling
terrorism problem which & back then was larger than we could see the edges of and
one of the things we used to say about it, at exactly the time you9re talking about, was
we haven9t yet found the edges of this problem. 87
Defence Intelligence viewed it similarly:

So in terms of relative prioritisation, rather than losing focus & our coverage of
Russia undoubtedly suffered as a consequence of that prioritisation, which was
necessary for the conduct of military operations. 88
By comparison, SIS and GCHQ saw it as due to the longer lead time required for work on
Russia. SIS said:

I don9t think we did take our eye off the ball. I think the appetite for work against the
Russian threat has sort of waxed and waned. ***. 89
And GCHQ agreed:
A bit like [SIS9s] point, some of the kind of hardcore capabilities that were necessary
to keep in the business we maintained and then, really, as the reviews and the
discussion around what happened in Crimea really brought minds more to the fore
again on Russia, that then led us to move in ramping up again. 90
74. We fully recognise the very considerable pressures on the Agencies since 9/11, and
that they have a finite amount of resource, which they must focus on operational priorities.
Nevertheless, reacting to the here and now is inherently inefficient and 3 in our opinion 3
until recently, the Government had badly underestimated the Russian threat and the
response it required. 91
75. Accepting the counter-terrorism pressures on the operational organisations, there is
nevertheless a question over the approach taken by the policy departments. We have
previously discussed the extent to which economic policy dictated the opening up of the UK
to Russian investment. This indicates a failure of the security policy departments to engage
with this issue 3 to the extent that the UK now faces a threat from Russia within its own
borders. What appears to have been a somewhat laissez-faire policy approach is less easy
to forgive than the response of the busy Agencies. We welcome the fact that this has now
been recognised and appears to be changing.

87
Oral evidence 3 MI5, *** December 2018.
88
Oral evidence 3 Defence Intelligence, *** December 2018.
89
Oral evidence 3 SIS, *** December 2018.
90
Oral evidence 3 GCHQ, *** December 2018.
91
We note that the Agencies 8horizon scan9 and that this is a matter of prioritisation of resources.
22