The Russia Report is not revelatory and largely summarises threats familiar to readers from information already in the public domain. It mentions the Russian cyber threat to critical infrastructure, implying in one section (punctuated with redactions) that Russian cyber pre-positioning operations had been observed in unspecified parts of UK infrastructure. This is not a new revelation. Nor is it confined to the UK, given reporting about similar threats to US critical infrastructure, or the destructive cyber attacks on Ukrainian infrastructure.
Moreover, given reported US cyber pre-positioning on Russian infrastructure and the assertive turn in US offensive cyber operations under the Trump administration, involving both Cyber Command and the Central Intelligence Agency, it is possible to conclude that these activities have simply become, for the foreseeable future, an integral feature of adversarial relationships between states with the cyber capabilities to exploit vulnerabilities in critical infrastructure. As the UK moves (slowly) towards its goal of a national cyber force with 2000 personnel, it is to be hoped that the ISC and other committees return to this issue in greater depth.
In another echo of US experience, the committee explored the potential vulnerability of UK democracy to disinformation and operations to disrupt or pervert the course of election campaigns. Arguably the report’s most damaging claim is that the government appears not to have tried hard enough to determine whether UK elections had been adversely affected by Russian interference. The report rightly draws an explicit comparison between this omission and the public assessment of Russian interference in the 2016 US presidential election published by the US intelligence community.
Whilst the government’s response to the ISC report highlights routine lines of intelligence collection and analysis that would raise the alarm, this is not the same thing as a dedicated review and commitment to publish its results. The ISC report also highlights the vulnerability of London as a location and instrument of Russian influence. As a former two-term Mayor of London during this period, prime minister Boris Johnson might reasonably be expected to have a principled desire to shine a brighter light on this issue as part of such an inquiry.
The brief section on ‘Russian Expatriates’ in the UK is another politically-sensitive part of the report, focusing as it does on the extent to which wealthy individuals with connections to the Russian government have been able to invest and build influence within the UK over the last 25 years.
The overall conclusion of this section is that the UK government was slow to recognise and respond to this threat, but that recent efforts have indicated that it is improving its approach, particularly to the investigation of serious organised crime. The committee recommends that more should be done in this area, as well as in mitigating the potentially adverse impact of Russian influence on UK politics, eg in the transparency of Russian business connections to UK parliamentarians, several of whom hold positions on the boards of Russian companies. Perhaps there are highly damaging revelations about such connections that might appear in future, but they are not the subject of this report.
The committee’s report describes Russian state decision-making as a centralised, secretive and swift process, presenting a challenge for the slower and more cumbersome decision-making processes of liberal democracies like the UK. The report also notes briefly that covert action against Russia would be fraught with risk, particularly in light of paranoia in Moscow about Western intentions and the relative lack of bilateral engagement at a senior political level, creating opportunities for misunderstanding and overreaction.
Redactions obscure the details here, but the committee appears to have been surprised by the relatively small proportion of operational effort dedicated by the UK intelligence community to covert action and effects, rather than to intelligence collection. This prioritisation was reportedly partly motivated by the agencies’ focus on what will most reliably contribute to achieving the objectives of the government’s Russia strategy, and partly by concern about ‘the need to tread carefully so as not to provoke unexpected escalation.’
This is a revealing observation about a British strategy for countering the Russian threat that appears to be as cautious and careful about controlling the risk of escalation as its adversary appears to be aggressive and reckless. The ISC is complimentary about the UK’s diplomatic response to the 2018 Skripal attack, after which the UK and its allies coordinated the expulsion of 153 Russian spies and diplomats – albeit with President Trump reportedly angry with aides when he realised that the US had expelled more than any other state.
The ISC is similarly approving of the UK and allied turn towards publicly attributing Russian responsibility for cyber attacks, a development that has continued in the 10 months since the ISC concluded its report, with public attributions this year of Russian cyber operations against the former Soviet state of Georgia (in late 2019) and more recently against targets associated with coronavirus vaccine development.
What is missing, however, is an attempt to assess the overall effectiveness of this strategy. This is not a criticism of the ISC: such an assessment falls outside its remit. But the various strands of activity incorporated within the UK’s Russia strategy should ultimately be assessed according to their ability to deter Russia from hostile activity in the UK. Like most other areas of British foreign policy, this cannot easily be disaggregated from analysis of the US strategy for countering Russia has been in recent years. As the only legislative oversight committee with a remit to explore the work of UK intelligence and security agencies, the ISC has an important role to play in contributing to this strand of such a wider assessment.
Unaddressed by the Russia report is the question whether the UK is still regarded as a soft target, whether for political manipulation or assassinations. The ISC report refers to the UK’s concern to reduce the risk of escalation. This indicates a significant asymmetry in risk appetite between UK and Russian decision-makers. It is at least arguable that the UK should consider increasing its risk appetite and identifying areas to impose higher costs if it is to effectively deter hostile activity in future.
Expulsion of intelligence officers, public attribution of cyber operations, and the imposition of targeted sanctions might each have their place in a wider strategy. But the reported absence or surprisingly small contribution of more punitive, covert responses as part of that strategy, suggests that too little may have changed since the Skripal attack in 2018.
And if the UK is to adopt a more robust response to the Russian threat, it will be all the more important for legislative oversight of these activities to be strengthened, for the intelligence community to provide more extensive cooperation with the ISC than the committee felt it had received in its Russia inquiries, and for the Johnson government to demonstrate a greater respect for the integrity of the ISC’s independence than it has in its handling of the committee’s post-election reconstitution and the election of its chair. As it stands, there are currently few grounds for optimism on any of these counts.
Dr Joe Devanny is a Lecturer in the Department of War Studies, and deputy director of the Centre for Defence Studies, King’s College London. He writes here in a personal capacity.