UK report pegs Russian hybrid activity at £2-2.5B yearly floor with no official cost tracking
Downie's analysis exposes the gap between classified threat reporting and public budget debates by assigning a concrete cost to untracked Russian activity. The 10% cybercrime assumption and lack of NCSC cost data in attributions reveal systemic classification barriers that prevent accountability. Recommendations for annual assessments mirror earlier calls from defence intelligence leadership to surface evidence for resource allocation.
The report documents zero responses from multiple departments to parliamentary questions on economic losses from Kremlin-linked incidents, including the Advanced NHS supplier breach and Royal Mail ransomware. Methodology relies on modeled assumptions rather than incident data, with the Jaguar Land Rover attack cited despite lacking formal attribution. This absence of metrics blocks direct comparison against defensive spending ahead of the November budget.
NCSC: First public cost estimate attached to an attribution notice will appear within 9 months of 2025 budget passage.
Sources (3)
- [1]Primary Source(https://therecord.media/russia-cyberattacks-on-britain-putin-tax-graeme-downie)
- [2]Supporting Source(https://www.ncsc.gov.uk/files/annual-review-2024.pdf)
- [3]Supporting Source(https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1171103/UK_Cyber_Security_Breaches_Survey_2023.pdf)