The UK government has taken significant steps to address evolving threats in the realm of cybersecurity by adding new scenarios to its National Risk Register, a critical document that outlines potential risks the country faces. This document is not merely a compilation of theoretical threats; it is based on the government’s internal, classified National Security Risk Assessment, which evaluates a wide range of malicious risks, such as terrorism and cyberattacks, alongside non-malicious events like severe weather.
Published on July 14, the latest edition of the National Risk Register identifies various cyber-related scenarios that could theoretically lead to mass casualties. Among the newly added scenarios are potential impacts from cyber-attacks on digital and water infrastructure, police systems, and a large-scale IT outage reminiscent of the issues faced by CrowdStrike—a cybersecurity firm that has been a target of cyber incidents in the past.
Notably, a distinct section has been dedicated to the risks of interference with democratic processes. This includes potential attacks on election infrastructure, deterioration of the online information space, and the harassment or intimidation of candidates and voters. Furthermore, it highlights the grave consequences of hacking and leaking sensitive information related to political parties or prominent individuals, along with the implications of foreign interference in these processes.
Considered one of the more serious threats, a cyber-attack targeting data infrastructure could prove catastrophic. Described as “disruptive and sophisticated,” this type of attack might target UK colocation datacenters, resulting in the exfiltration of sensitive data, including customer information and intellectual property. The government has estimated that disaster recovery could extend from several days to weeks, while complete restoration of information might take years. While the likelihood of such an event is categorized as “highly unlikely,” with a probability score of between 5-25%, the potential fatalities could reach up to 200, with casualties potentially doubling and financial losses amounting to hundreds of millions of pounds.
Another alarming scenario involves a cyber-attack on water infrastructure. In such an event, a malicious actor could infiltrate the operational technology (OT) systems of a water company, deploying destructive malware. This could lead to a significant disruption in water supply and wastewater services, potentially affecting a large population for months. The implications of such an attack could extend beyond mere inconvenience; it might result in physical and mental health consequences, including fatalities.
Similarly, a cyber-attack on policing infrastructure poses severe risks. Compromised investigations could jeopardize staff safety and lead to reputational damage for law enforcement agencies. Such disruptions could diminish police access to critical intelligence, ultimately affecting the effectiveness of frontline policing efforts. The register indicates that the most severe impacts of such attacks might last for days, while ongoing disruptions could extend for months, with equally concerning likelihood and impact scores as previously mentioned.
Lastly, the government’s assessment also includes the scenario of a digital outage, which could have cascading effects on communications, emergency services, transport, border control, financial systems, and broadcasting networks. Smart devices and smartphones would also likely face widespread failure. The likelihood of such an event is estimated to range between 1% and 25%+, with impacts being rated from moderate to catastrophic.
To equip the public against these emerging threats, Chief Secretary to the Prime Minister Darren Jones remarked in Parliament on June 14 that the updates to the National Risk Register were imperative, especially due to the proliferation of artificial intelligence and the increasing dependence of critical infrastructure on IT and OT systems. He reflected on the historical resilience of the nation, stating, “It is right that we consistently evaluate the risks we could face and plan for what may come.”
Moreover, an initiative is underway to launch a “landmark national resilience campaign” aimed at empowering households to adopt simple yet effective measures to improve their resilience against risks like cyber-attacks. This endeavor not only underscores the government’s commitment to safeguarding national security but also reflects an acknowledgment of the evolving landscape of modern threats, particularly in the digital age.