China poses genuine and increasing cyber security risk to UK, says GCHQ director

Vulnerabilities stockpiled

The Chinese government is stockpiling security vulnerabilities to use in future hacking attacks, according to cyber security officials.

Under Chinese law, Chinese companies and cyber security organisations are required to report newly discovered security vulnerabilities to the Chinese government.

A Chinese hacking competition due to take place in June 2024, for example, is offering $2.5m in prize money for exploits and vulnerabilities in software, operating systems, and network and security equipment.

Western intelligence agencies are concerned that Chinese state-sponsored hacking groups are gaining access to the computer networks of energy, electricity and other critical services providers to use as potential political leverage.

They warn that the groups are installing hacking capabilities that could be used at a later date to threaten to disrupt critical infrastructure of western countries.

Harry Coker, national security director at the White House, said in a speech today that the Chinese People’s Liberation Army has invested “tremendous” resources in a cyber programme “to hold critical civilian infrastructure at risk”.

“In a crisis or conflict scenario, China could use their pre-positioned cyber capabilities to wreak havoc in civilian infrastructure and deter US military action,” he said. “Make no mistake, this is a global challenge. China’s ambitions to use its cyber power coercively extends far beyond the United States.”

Greatest risk

Felicity Oswald, CEO of the National Cyber Security Centre (NCSC), the UK’s technical authority on cyber security, added that alongside China, Russia and North Korea continue to pose the greatest risk to the UK and its allies.

“China poses a systemic challenge to our values and interests, a challenge that grows more acute as the country moves towards even greater authoritarianism,” she said, speaking at the NCSC’s Cyber UK conference.

She singled out the Chinese Volt Typhoon hacking group, which she said could be laying the groundwork for disruptive or destructive cyber attacks.

Volt Typhoon has targeted multiple CNI operators in the US Pacific island territory of Guam, close to Taiwan, and also across the US.

They include communications services providers, manufacturers, utilities, transport operators, construction firms, IT companies, educational institutions and government bodies. 

There has been no indication that Volt Typhoon has targeted organisations in the UK, but Oswald said the group served as a clear warning about China’s intent to hold essential networks at risk. “And it is a warning that providers of essential services in the UK cannot afford to ignore,” she added.