GCHQ could sell ‘spook’ expertise to private sector

GCHQ could sell its skills and technology to the private sector as part of efforts to protect the country from online attacks.

The Government Communications Headquarters, near Cheltenham, is to look at commercial applications for encryption techniques and other expertise that is not considered top secret.

The move is part of the government’s cyber security strategy, designed to tackle the “real and growing” threat from criminals, terrorists and hostile states.

A new national police Cyber Crime Unit will also be created by 2013, and forces are being urged to recruit more special constables with relevant skills – nicknamed “iPlods”.

The strategy document says GCHQ’s “world-class expertise in cyber security” should be used to “benefit economic growth”.

It will explore working “with private sector partners to explore the potential commercial applications”.

A venture capital model sponsored by the government could also be set up to help fund innovation in cyber security in small and medium-sized enterprises.

The strategy stresses none of the activities will “compromise the agency’s core security and intelligence mission”. Officials are understood to have in mind instances where GCHQ has devised technology, such as encryption systems, decades before it has emerged commercially. The organisation has been barred from exploiting its innovations even when they no longer need to be secret.

The government’s National Security Strategy last year classed cyber-security as one of the UK’s top defence priorities, alongside terrorism, international military crises and natural disasters.

Concerns have been raised about sophisticated attacks seemingly mounted by states such as China and Russia against key infrastructure.

The fears over national security reflect cases like that of Glasgow-born Gary McKinnon, who is waiting to hear if he will be extradited to the US to face charges of hacking into Pentagon and Nasa computers, where he said he was looking for evidence of UFOs.

A new Defence Cyber Operations Group is being set up in the Ministry of Defence to develop “military cyber capabilities” for countering threats. It is understood it will also consider “pro-active” responses, which could include retaliation in kind.

The strategy plans to set up cyber security “hubs” around industry to allow government experts and the private sector to exchange information. A pilot is due to begin in December for five sectors – defence, telecoms, finance, pharmaceuticals and energy. The government also wants to encourage British businesses to achieve a competitive edge by promoting themselves as “certifiably cyber secure”.

The new cyber crime unit within the National Crime Agency will combine the operations of the Metropolitan Police and Serious and Organised Crime Agency. It will deal with all high-level criminality online, as well as taking part in the response to national incidents, such as terrorist attacks.

Unveiling the cyber strategy – which has a four-year £650 million budget – yesterday, Cabinet Office minister Francis Maude said: “The growth of the internet has transformed our everyday lives. But with greater openness, interconnection and dependency comes greater vulnerability.

“The threat to our national security from cyber attacks is real and growing. Organised criminals, terrorists, hostile states, and ‘hacktivists’ are all seeking to exploit cyberspace to their own ends.”