• Cyber Resilience

For a year, I have argued that Britain should think harder about who controls the technology it runs on. At times, that has felt like shouting into the void. Licensing terms, hosting contracts, and supplier dependency maps have rarely been top of mind for senior leaders.

Since then, advanced AI models have been temporarily suspended for other countries under US export controls. Ukraine’s military access to Starlink was restricted at a critical moment. Ministers have suggested households keep several days of food and water in reserve following recent digital disruption. Japan has even declared a national cyber emergency.

Closer to home, issues buried deep in our digital plumbing are now reaching ordinary people, who don’t need to know what PHP is in order to be affected by it.

I take no pleasure in being proven right. But it is encouraging that the subject is finally being taken seriously.

What worries me is the response that is already emerging. Make minor tweaks to a product, host it in a data centre with a Union Flag on the brochure, assuage lock-in fears by declaring “you can leave any time”, call it “sovereign”, and move on. It makes for a good press release. It does very little for resilience.

Sovereignty is not about the nationality of the supplier. It is about who holds the power to decide.

Can you leave if the price triples? Can you inspect what you are running? Can you keep operating if a foreign government, a hostile actor, or a distant board of directors changes the terms?

A British firm can lock you in just as thoroughly as an American one, and a foreign supplier building on open standards can leave you more free than a domestic one you can never replace. Where a company was founded is a piece of the puzzle. It is not the full jigsaw.

We must acknowledge that much of the state has already accumulated vast dependencies without noticing. Departments face rising bills for virtualisation software they cannot easily escape, even if they have the budget for a multi-year migration. Sensitive information is being sent to overseas data centres so public bodies can use the latest AI tools. Full stack cloud service consumption continues to narrow our skills base and remove optionality. Each decision may have made sense in isolation, but together they leave government with fewer choices than it believes it has.

There is no single correct path ahead, but I can point to three reliable ways to go wrong.

The first is moving slowly while threats move fast. Attackers can now discover and exploit weaknesses at machine speed. Public institutions that take weeks to apply a security fix are badly exposed. We need to invest in the ability to patch across government as quickly as problems emerge, and secure reliable patches for the unsupported open-source software we depend on.

The second is deferring the question of lock-in. Checking dependencies and designing exit routes before signing a contract is cheap and unglamorous. Doing it afterwards, under pressure, is neither. Mitigation after the fact is simply damage control.

The third is mistaking symbolism for substance. If “sovereign” comes to mean “supplied by someone with the right passport”, we will repeat old mistakes in new packaging and congratulate ourselves in the process. Especially when a British founder incorporates their business in Delaware, or an overseas company buys the start-up we locked into.

Recent headlines have handed us political capital. But news stories fade, budgets remain challenging, and the familiar option continues to be the default. Public interest in resilience tends to peak just after a crisis and drain away just before the next one.

So I would suggest a simple test for every digital purchase the public sector makes from here on. Ask who has the power to decide about price, about access, about how a system changes. If the honest answer is “we do”, then we can proceed. But if the answer boils down to a flag on the box, then we should expect costly lessons before long.

---

Read More Cyber Security

Comments are closed.