cherezoff -

How Samlesbury, Lancashire became the home of the National Cyber Force

The National Cyber Force, a new branch of the military, is gearing up to fight battles in cyber space from the fields of Lancashire. Its presence is expected to bring a high-tech renaissance to the region

This article can also be found in the Premium Editorial Download: Computer Weekly: Managing cyber risk by integrating supply chains

The battle to win the headquarters of the UK’s National Cyber Force (NCF) has been quietly fought out of the public eye for the past 12 months.

Samlesbury, in Lancashire’s Ribble Valley, saw off stiff competition from Manchester, the home of GCHQ’s northern office, to become the site of the UK’s headquarters for military operations in cyber space against nation states, terrorists and criminals.

The arrival of the NCF brings with it an investment of £5bn to the Lancashire economy, the largest seen in the area for 50 years.

In its wake is the promise of high-tech jobs to an area that has been struggling with lower-than-average wages and a shortage of highly skilled jobs.

By 2023, more than 3,000 people will be working at the NCF headquarters, which will be built on land on the former Samlesbury Aerodrome, alongside BAE Systems’ aircraft components site.

The UK has been conducting cyber operations since at least 2010, but the NCF marks a step-change in the UK’s response to hostile state hacking, terrorism and high-tech criminals.

Cyber is viewed, along with space, as the next military domain, and the NCF will go beyond defending against cyber attacks to using hacking techniques to undermine adversaries.

Under the control of the Ministry of Defence’s (MoD’s) Strategic Command, the NCF will draw its staff from the MoD, GCHQ, the Secret Intelligence Service (MI6) and the Defence Science and Technology Laboratory (DSTL) at Porton Down.

As many as 2,000 jobs are likely to be created in the region, said Sarah Kemp, CEO of Lancashire Local Enterprise Partnership.

She has no doubt that the NCF will encourage high-tech businesses to move to the area, creating a corridor of expertise that could run from Manchester to Lancaster.

“It will be a centre of gravity, attracting business in digital technology, cyber defence and security,” she said.

Ministers believe the NCF could transform Samlesbury in the same way that GCHQ transformed the small town of Cheltenham in 1951.

Internally, the cyber force headquarters is known as “GCHQ2”, reflecting the ambition and scale of the operation.

Building work on the NCF campus is due to start next year. Its exact location is being kept under wraps, but the Salmesbury Aerospace Enterprise Zone, which has a capacity of one million square feet, is the likely candidate.

It is already home to BAE Systems, which manufactures parts for military aircraft, including the Eurofighter Typhoon; the BAE Academy for Skills & Knowledge (ASK), which trains 200 apprenticeships a year; and a solar power plant.

An Advanced Manufacturing Research Centre, which will offer businesses access to a research and development team, is also being developed on the site, with the backing of Sheffield University and a £20m grant from Lancashire Local Enterprise partnership.

People were told on a need-to-know basis

Since January, a small coterie of local councillors and academics have been lobbying intensively to persuade the Ministry of Defence to choose Samlesbury as the base for the National Cyber Force.

A tight-knit group from Lancashire Enterprise Council, BAE Systems, the University of Lancaster, the University of Central Lancashire and Lancashire Country Council collaborated on the bid.

The participants signed non-disclosure agreements limiting knowledge of the plans to build the NCF in Lancashire to a select few.

“We worked with a very tight core of partners,” said Kemp. “National security issues prevented wider discussion and engagement. It was done on a need-to-know basis.”

Stephen Young, an executive director at Lancashire County Council, has dealt with large projects before, including investments by Amazon, but said this project was unusual because of the secrecy involved.

“There were a very small number of people who knew about this within the council,” he said. “We had to be very careful how we managed it.”

One of the other bidders was Manchester, home of GCHQ’s northern office and to companies specialising in data analytics, cyber security and artificial intelligence.

“The competition was really quite close,” said Kemp, who was keen to point out that even the areas that lost out will become “strategic partners” in the development of the region.

The bid had political support from local MPs, including the Speaker of the House of Commons, Lindsay Hoyle, and his deputy, Nigel Evans, Conservative MP for the Ribble Valley.

One of the attractions for the NCF is the expertise of the area’s universities, including Lancaster University, which has won recognition for its work on cyber security

Ben Wallace, secretary of state for defence, who announced the win for Samlesbury, represents Lancashire’s Wyre and Preston North constituency.

Conservative-led Lancashire County Council worked with the Labour Council in South Ribble to make the case for Samlesbury. “We have all done our damnedest to make sure it came to South Ribble,” said council leader Paul Foster.

For Westminster, the decision represents a concrete outcome for the government’s “levelling up” policy and a boost for the growth of a “northern powerhouse”.

In the end, one of the deciding factors in choosing Samlesbury may have been the greenfield space that it offered to build and grow a large campus.

That could be a harder proposition in an urban area such as Manchester, where any major building work would be harder to protect from prying eyes.

BAE Systems has agreed to host staff from the NCF in buildings secured behind perimeter fencing, while the new headquarters is under construction.

Once construction work is complete, it will only be a short hop to the new HQ – an important logistical consideration for the NCF.

“Trying to do that in a major urban environment where space is confined and everyone can see what you are doing is not anywhere near as easy as doing it a Samlesbury,” said one of the people involved in the work.

From cyber defence to cyber attack

GCHQ and the Ministry of Defence have been developing cyber capabilities that enable the UK to strike back against hostile states, terrorists and cyber criminals since at least 2014, though GCHQ’s work in this area goes back much earlier.

The NCF has its origins in the National Offensive Cyber Programme, a joint operation between the military and Cheltenham that aimed to prepare the armed forces for “hybrid conflicts played out in cyber space as well as on the battlefield”.

The unit will also disrupt serious crime on the internet, including abuse of children and fraud.

The Secret Intelligence Service, MI6 – one of the partners in the NCF – is expected to use its network of agents overseas to gain access to human sources and target computer systems.

Part of the NCF’s role will be to collaborate with allies, including NATO members and the US.

The UK, for example, worked with the US Cyber Command in a major operations against the Islamic State (IS) during the war in Afghanistan, with the approval of the then prime minister, David Cameron.

The operation was described by GCHQ’s director as the first time the UK had “systematically and persistently” degraded a adversary’s online operations as part of a military campaign.

Operation Global Symphony gained access to IS networks, planted malware and backdoors on servers run by members of the organisation in multiple countries.

GCHQ worked with special forces to jam the ability of IS commanders to communicate and fed them false instructions over the internet.

Details of the UK’s involvement were later disclosed by security officials in off-the-record briefings to Sky News.

Cyber specialists took down servers and websites hosting IS propaganda, locked IS administrators out of their accounts, and shut down the production of the online IS magazine.

Universities have links with GCHQ

One of the attractions for the NCF is the expertise of the area’s universities, including Lancaster University, which has won recognition for its work on cyber security.

The university’s cyber masters programme, its academic centre for excellence for cyber education and academic centre for excellence for cyber research, have each been accredited by GHCQ’s National Cyber Security Centre.

Dion Williams, associate dean for enterprise engagement at Lancaster, said there are huge opportunities for research collaborations between the NCF and universities in the region.

Lancaster, for example, is working with Manchester and Salford universities on a research partnership sponsored by GCHQ.

It is also the lead academic partner in a Digital Innovation and Security Hub (DISH). Housed in the same building as GCHQ’s Manchester headquarters, DISH aims to enable academics, entrepreneurs and business to collaborate on innovate digital and cyber security projects.

The university is supporting small businesses to develop innovative digital technology and improve their cyber security through its Cyber Foundry project in Manchester and Lancashire.

It hosts 50 businesses on its campus, many focusing on digital technology, and expects more to join as the NCF opens for business.

Diverse workforce

One of the NCF’s stated aims is to hire employees with a diverse range of backgrounds.

The University of Central Lancashire (UCLAN), which offers a range of courses in digital technology and computer networks, believes it can play a key role in developing the skills of young people.

It runs a programme that brings young people into medicine through an apprenticeship scheme that combines work and study that people can follow at their own pace.

That brings in young people from communities in Preston, Blackburn, Burnley and further north.

StJohn Crean, pro-vice chancellor of UCLAN, believes a similar programme could bring more young people into high-tech careers at the NCF. “We, as a university, are well positioned,” he said.

Welcome to the Cyber Corridor

The NCF will employ military personnel, but the majority of jobs will go to civilians from Lancashire and elsewhere in the country.

There are not enough skilled jobs for the area, forcing more than 8,000 people to commute out of Lancashire for work.

“Lancashire really needed a different type of investment,” said Kemp. “It is not just different in terms of the kind of job it creates, wages and career progression, but it is different in scale – £5bn is a huge investment.”

The arrival of the NCF is expected to attract more high-tech businesses to the region. The Lancashire Enterprise Partnership received its first enquiries from interested organisations on the day the NCF plan was announced.

Businesses’ employees will benefit from lower house prices compared to the South East, access to countryside that locals describe as stunning, and good transport links.

The £5bn investment for the NCF comes alongside other development projects in the region, including investment in transport infrastructure and a government sponsored project to build 9,000 homes.

Next steps

The Lancashire team will meet with the NCF over the coming weeks to map what resources, skills, and research and development it will need.

That could lead to new undergraduate and postgraduate courses and closer liaison with further education colleges in the region.

There are some practical things to put in place, including a construction contract for the NCF headquarters and finding houses for military staff who will need to relocate.

The council is responsible for supplying infrastructure to the Samlesbury Enterprise Zone, which is likely to house the NCF and other high-tech businesses.

That has included working with Electricity North West on a £7.5m project to build a 33,000V electricity substation on the Samlesbury Aerospace Enterprise Zone, which kicked off  in January. The substation, connected by 22km of cables, will supply electricity to businesses as the site develops. Other infrastructure will also be necessary.

The NCF, which already has close links with BAE, is also keen to broaden its base of industry partners, so planning for an outreach programme to local companies is under way.

“It is our job to make those introductions and foster those collaborations,” said Lancashire Local Enterprise Partnership’s Kemp.

She said she has worked with some extraordinary high-tech businesses that don’t want to leave the area, but they needed a significant investment such as the NCF to prosper and grow.

Local hopes are that Samlesbury will become a “centre of gravity” for digital, cyber, defence and security businesses that will bring in new private sector investment.

Lancashire County Council’s Young agreed that the NCF will encourage more companies specialising in fields such as artificial intelligence and advanced manufacturing to Samlesbury.

“Technology companies will want to relocate right next door because, if nothing else, the NCF will create a huge supply chain for companies that are leaders in their field,” he said.

Young sees a cyber corridor, or perhaps a cyber triangle, developing in the area that would encompass BAE Submarine Systems in Barrow-in-Furness, Samlesbury, Liverpool and Manchester.

“We see this as a massive opportunity for people in Lancashire, particularly for young people, to have a really clear path from education into highly paid, highly skilled jobs,” he said.

How UK cyber operations came out of the shadows

4 October 2021: Defence secretary Ben Wallace, accompanied by Patrick Sanders, head of Strategic Command, Jim Hockenhull, chief of defence intelligence, and senior GCHQ staff announce plans to build headquarters for the National Cyber Force in Samlesbury, Lancashire, in a press conference at BAE Systems.

May 2021: Sanders tells a press conference that “cyber warriors will be as vital to our defences as an F-35 pilot, a special forces operator, or a submariner and in contact with the enemy, more frequently and persistently than any of them”.

March 2021: Prime minister Boris Johnson announces that the National Cyber Force will be relocated to a cyber corridor in the north-west of England.

March 2021: The UK is likely to remain a priority target for threats, including cyber attacks and disinformation which blur the line between peace and war, the government warns in its integrated review of security, defence, development and foreign policy.

March 2021: There is an absolute requirement to develop national Offensive Cyber capabilities, the MoD’s Defence and Security Strategy reports. “Offensive Cyber offers the UK a range of national flexible, scalable and de-escalatory measures that will help us to maintain strategic advantage,” it says. The NCF is to provide “capabilities that can be used to deceive, degrade, deny, disrupt or destroy targets in and through cyber space, in the pursuit of our national interests, security and foreign policy goals”.

November 2020: Johnson publicly discloses the existence of the National Cyber Force in a speech on the integrated review of security, defence, development and foreign policy. He announces £16.5b in cash for defence over four years, focused on aerospace and cyber technology.

April 2020: National Cyber Force begins operation.

February 2020: Sanders describes cyber space as a new domain for conflict. He tells a conference: “We are now treating cyber space as a war-fighting domain and organising, structuring, equipping around that domain.”

December 2019: The joint forces command, which manages capabilities for the three armed forces, is renamed Strategic Command to reflect new responsibilities including cyber defence. 

October 2019: Wallace uses a Nato Parliamentary Assembly to announce the UK’s intention to “solidify plans” for the NCF. “To date our response has not been good enough. We are neither nimble enough nor deterring enough,” he said.

2019: GCHQ opens a hub in Manchester, at Heron House, setting up collaborations with local high-tech startup companies, research projects with academics and outreach work to schools.

October 2018: Nato sets up a Cyberspace Operations Centre capable of mounting cyber attacks. Nato secretary general Jens Stoltenberg later tells London conference that Nato allies have agreed to “integrate national cyber capabilities or offensive cyber into alliance operations and missions”. The unit in Mons, Belgium, will be fully equipped with 70 people by 2023, Reuters reports.

October 2018: The Sunday Times reports that the UK has carried out a simulated cyber attack against Moscow in response to a Russian attack. A former cabinet minister later reveals that the UK has conducted cyber operations against president Putin and his allies.

September 2018: Details emerge of UK plans to create a new cyber force focused on offensive cyber operations with funding of more than £250m in briefings to Sky News. Under the plan, cyber operations, run from GCHQ’s headquarters in Cheltenham, and the permanent joint headquarters in Northwood, London, would transfer to a new location. It was undecided whether the operation would be run by the MoD or GCHQ, or both. The unit would expand from 500 to 2,000 staff.   

April 2018: Director Jeremy Fleming reveals that GCHQ has conducted a “major offensive cyber campaign” against IS. The operation suppressed IS propaganda, hindered its ability to coordinate attacks, and protected coalition forces on the battlefield. “This is the first time the UK has systematically and persistently degraded an adversary’s online efforts as part of a wider military campaign,” he says. GCHQ has pioneered the use of offensive cyber techniques for over a decade, starting with the conflict in Afghanistan, he says.

June 2017: Defence secretary Michael Fallon uses a speech at Chatham House to confirm that the UK is conducting cyber operations routinely against IS in the war in Iraq and Syria, and has plans to make its cyber capabilities available to Nato.

October 2017: Fallon says in a speech that the UK has begun to integrate offensive cyber operations into military planning. “It is important that our adversaries know there is a price to pay if they use cyber weapons against us, and that we have the capability to project power in cyber space as in other domains,” he says.

November 2016: The UK’s national cyber security strategy recommends the development of offensive cyber capabilities. The National Offensive Cyber Programme (NOCP), a partnership between the MoD and GCHQ, has dedicated capability to act in cyber space. “We have the means to take offensive action in cyber space, should we choose to do so,” says the report. It promises to develop the ability of the armed forces “to deploy offensive cyber capabilities as an integrated part of operations”.

September 2016: The US and UK sign a memorandum of understanding to collaborate on defensive and offensive cyber capabilities.

2016: GCHQ establishes the National Cyber Security Centre which, among other functions, provides advice to businesses on cyber security.

2016: Prime minister Cameron orders action against IS online propaganda, beheading videos and the online magazine Dabiq, Sky News reports.

November 2015: Chancellor of the exchequer George Osborne commits to funding the National Offensive Cyber Programme for the next five years. He says the armed services should be “prepared for hybrid conflicts, played out in cyber space as well as on the battlefield”.

November 2015: GCHQ and MoD are collaborating on a National Offensive Cyber Programme partly funded by the £1.9bn National Cyber Security Programme. Plans are in place to provide the armed forces with “advanced offensive cyber capabilities”.

2014: GCHQ and MoD create a join investment programme.

September 2013: Defence secretary Philip Hammond announces plans to recruit hundreds of cyber specialists as reservists into a joint cyber reserve. He confirms the UK is developing a cyber strike capability.

2013: GCHQ’s cyber offensive and hacking operations, known as Computer Network Exploitation,  are first disclosed in documents leaked by Edward Snowden.

2012: An enterprise zone is established on Samlesbury Aerodrome, a 74-hectare disused airfield in Ribble, Lancashire, previously owned by British Aerospace. BAE Systems Warton Aerodrome forms a second site for the Enterprise Zone.

2010: The government identifies cyber threats as a top national security priority. The Strategic Defence and Security Review notes: “Asymmetric tactics such as economic, cyber and proxy actions, instead of direct military confrontation, will play an increasing part…in conventional military capability.” The government is working on a cyber operations memorandum of understanding that will allow the UK to  work with allies to “enable joint planning and the conduct of operations in the cyber domain”.

2008: GCHQ appoints its first director of cyber.

Read more on IT risk management

Data Center
Data Management