Tag: Tom Tugendhat

It’s an enormous pleasure to be with you and I’m very grateful to be back at RUSI.

I gave my first foreign policy speech when I took over the Chairmanship of the Foreign Affairs Committee here.

I know RUSI’s vision has always been to inform, influence and enhance public debate to help build a safer and more stable world.

The mission has endured for 200 or so years now. The mission has not changed but the medium has.

Today the range of challenges we face has never been greater.

So it’s right that here, at the home of strategic thinking, we’re gathering to build on the foundations of those who shaped our security in the generations before us to make sure that endures for the generations to come.

So a profound thanks to our hosts, and also to you all, for being here on the eve of the first major global summit on AI security.

As with the summit itself, we have representatives here from government, from industry, from civil society, academia, and law enforcement.

Whatever your profession, whatever sector you represent, you are here because we need you.

Because we need each other.

Like so many areas of my responsibility, the government cannot do this alone.

Our role in government is to understand the threats that we face and target resources, helping others to come together and meet our challenges in the most effective way possible.

You can tell a lot about a government from the operating system they build for society.

Some countries build a system that are designed to control.

Other build a system designed to exploit.

Here in the UK we build systems that are designed to liberate.

To free individual aspiration and creativity for the benefit of all.

And that’s what security means to me.

It’s not a means of closing things down.

It’s about creating the conditions required to open up a society.

A safe environment in which ideas can take root, and opportunity is available to all.

That’s why we need to get this right.

Because technology as transformative as AI will touch every part of our society.

If we succeed, hardworking families up and down the country will reap the benefits.

If we don’t we will all pay the price.

The stakes are very high, but coming together today, in this way today sends the right message.

There are two core themes for the programme today. They come from different eras.

The first is fraud, which in its various guises, is as old as crime itself.

When Jacob stole Esau’s inheritance by passing himself off as his brother, that was perhaps the first description of fraud in the Bible.

The first record of fraud actually is possibly older, it dates from a fraud case related to copper ingots and is recorded 4000 years in Babylon.

The last time I spoke about Babylon in RUSI I was in uniform describing how I was one of many armies to have camped under its walls.

The challenges posed by Artificial Intelligence are comparatively new.

Its democratisation will bring about astonishing opportunities for us all.

Sadly that includes criminals.

We know that bad actors are quick to adopt new technologies.

Unchecked, AI has the power to bring about a new age of crime.

Already we’re seeing large language models being marketed for nefarious purposes.

One chatbot being sold on the darkweb – FraudGPT – claims to be able to draft realistic phishing emails:

mimicking the format used by your bank, and even suggesting the best place to insert malicious links.

That doesn’t just have implications for the realism of scams.

It has huge implications for their scale as well.

I don’t want to be in a situation where individuals can leverage similar technologies to pull off sophisticated scams at the scale of organised criminal gangs.

We don’t want to find the Artful Dodger has coded up into Al Capone.

At a fundamental level, fraudsters try to erase the boundary between what’s real and what’s fake.

Until relatively recently, that was a theoretical risk.

It wasn’t so long ago that I believed I was immune to being fooled online.

That is, until I saw a viral picture of the Pope in a coat.

Not just any coat.

A fashionable puffer jacket that wouldn’t look out of place on the runway in Paris.

One that my wife assured me was ‘on trend’.

I quickly forgot about it.

That is, until I learned that that image wasn’t actually of the Pope at all.

It was created on Midjourney. Using AI.

On the one hand it was a harmless gag, Pope Francis had never looked better.

On the other hand, it left me deeply uneasy.

If someone so instantly recognisable as the Holy Father could be wholly faked, what about the rest of us?

The recent Slovakian elections showed us how this could work in practice.

Deepfake audio was released in the run up to polling day.

It purported to show a prominent politician discussing how to rig the vote.

The clip was heard by hundreds of thousands of individuals.

Who knows how many votes it changed – or how many were convinced not to vote at all.

This is of course an example of a very specific type of fraud.

But all fraudsters blur the boundary between fact and fiction.

They warp the nature of reality.

It does not take a massive leap of imagination to see the implications of that in the fraud space.

Thankfully, relatively few AI-powered scams have come to light so far.

However, the ones that have highlight the potential of AI to be used by criminals to defraud people of their hard-earned cash.

The risks to citizens, businesses and our collective security are clear.

A few lines of code can act like Miracle Gro on crime, and the global cost of fraud is already estimated to be in the trillions.

In the United Kingdom, fraud accounts for around 40% of all estimated crime.

There’s an overlap with organised crime, terrorism and hostile activity from foreign states.

It is in a very real sense a threat to our national security.

But while there is undoubtedly a need to be proactive and vigilant, we need not despair.

And the wealth of talent, insight and expertise I see in front of me here gives me hope.

For the Government’s part, we are stepping up our counter-fraud efforts through the comprehensive strategy we published this summer and the work of Anthony Browne, my friend, who is the Anti-Fraud Champion.

Fraud is a growing, transnational threat, and has become a key component of organised criminality and harm in our communities. So international co-operation is essential.

That’s why the UK will host a summit in London next March to agree a co-ordinated action plan to reform the global system and respond to this growing threat.

We expect Ministers, law enforcement and intelligence agencies to attend from around the world.

The Online Safety Act which has completed its passage through Parliament and will require social media and search engine companies to take robust, proactive action to ensure users are not exposed to user-generated fraud or fraudulent advertising on their platforms.

And we are working on an Online Fraud Charter with industry that includes innovative ways for the public and private sector to work together to protect the public, reduce fraud and support victims.

This will build on the charters that are already agreed with the accountancy, banking, and telecommunications sectors to combat fraud, which have already contributed to a significant reduction in scam texts and a 13% fall in reported fraud in the last year.

New technologies don’t just bring about risk.

They create huge opportunities too.

AI is no different.

We know that the possibilities are vast, endless even.

What’s more it’s essential.

As the world grows more complex, only advanced intelligence systems can meet the task before us.

We need the AI revolution to deliver services and supply chains in an ever more globalised world.

I’m particularly interested in the question of how we can harness this new power in the public safety arena.

As we will hear shortly, AI is already driving complex approaches to manage risk, protect from harm and fight criminality.

There is a real-world benefit in combating fraud and scams, such as payment processing software that is stopping millions of scam texts from reaching potential victims.

No doubt I’ve barely scratched the surface, and there’s lots more excellent work going on.

What we absolutely have to do is break down any barriers that might exist between the different groups represented here this evening.

The only people who benefit from a misaligned, inconsistent approach are criminals, so it’s critical that we work hand in glove, across sectors and borders.

I want to come back to the point I started on.

For me AI and the security it enables is an essential part of the State’s responsibility to keep us all safe.

It’s not to increase our control.

Not to keep people in a box.

But to set people free.

We cannot eliminate risk, but we can understand it.

Using AI to map and measure today’s environment will ensure we do that.

The pursuit of progress is essential to human experience.

And the reality is that even if we wanted to, we cannot put the genie back in the bottle.

That does not mean, though, that we simply sit back and what and see what happens.

We can’t be passive in the face of this threat.

So what I want us to be thinking about is how we move forward.

Well, the way I see it there are three key questions that align to the aims of the AI Safety Summit:

• The first, how do we build safe AI models that are resilient to criminal intent?
• Second, as the vast majority of fraud starts online, how do we harness AI to ensure that harmful content is quickly identified and removed?
• And lastly, what do governments need to be doing globally to balance progress and growth with safety and security?

That’s far from an exhaustive list.

But I think by addressing these core questions we can put ourselves on the right path.

So, thank you once again for being here; thank you RUSI for hosting us, I hope you will find it a valuable exercise.

And most of all I hope we can look back and say that today was a day when we took important steps forward in our shared mission to reduce the risks and seize the opportunities associated with AI. I remain hugely optimistic, but that optimism depends on the work we do today together.

Thank you. It’s an enormous pleasure to be here with you today in Belfast.

It is also an incredible honour to be here in Belfast on this auspicious occasion. Not just to be here at this conference, but 25 years ago there was the extraordinary moment of the signing of the Good Friday agreement. That wonderful moment that gave hope to a new generation and demonstrated this country, the whole of the UK and the whole of these islands can move on from a difficult past to a much better future.

It’s a reminder that peace can never be taken for granted, and that service, debate and compromise define what is at the heart of our peaceful and democratic system, and together they must never be neglected.

It also makes me particularly mindful of my role today. I stand before you as Security Minister of the UK.

In one respect, that is quite a simple job: keep Britain safe. Of course, that clarity marks a complexity of the challenges we face from terrorism and state threats to organised crime and distributed attacks.

Those attacks are more your field and its there in the cyber world that the UK faces some of its sternest tests.

A quick look at the basic figures is enough to bring home the scale and severity of the issue we face.

New findings released just yesterday from the Cyber Security Breaches Survey show that 32% of businesses experienced at least one cyber breach in the last 12 months.

This year, for the first time, the survey also tells us how many of these breaches resulted in a cybercrime being committed.

We can now estimate that 11% of businesses were victim to at least one cybercrime. That cost each of them around £15,000 in the past year.

We must never lose sight of the fact that behind each of these online statistics is a real-world victim.

Each is a grandparent defrauded, and stripped of their savings.

Each is a small business held to ransom, and jobs lost.

Each is public money stolen, and the taxpayer short-changed.

The cyber-threat doesn’t just come from criminals. The ongoing war in Ukraine is a constant reminder of the threat we face from hostile actors. Russia has been trying to invade Ukraine’s cyberspace as much as its physical space, threatening critical information, critical services, and critical infrastructure.

The threat of further cyber fallout from conflict is very real to the United Kingdom and to all our allies.

At home we are seeing the overlap of state threats, terrorism and organised crime brought together online and off.

Against this troubling background our mission is clear. We must crack down on cybercrime, we must protect the United Kingdom from the most capable cyber adversaries – states, criminals and terrorists – all are trying to hurt us and all have made the online world work for them, delivering offline political gain and criminal profit.

That is no small brief, and it is not one any department, certainly not one Minister, can achieve alone.

That’s why this event is so important to me. This is why I’m so grateful to Lindy for inviting me and so grateful for the opportunity to speak to you. Because what we can achieve together is an all round ecosystem of cyber security built on the UK’s world class foundations of education, expertise, technology and capability.

The task of cyber security falls to government of course, but also to individuals, law enforcement, and to you, business.

Now today, I’d like to reflect on how far we’ve come, and where we need to go. Above all, I want to stress the core message, exemplified by those extraordinary events of 25 years ago – that only by working together can we collectively be safe.

I’d like to briefly outline my priorities in cyber policy, before affirming areas in which government and industry partnerships must go further if we are all going to succeed.

The government has already made phenomenal progress in building resilience and countering the threat from our adversaries.

The latest iteration of the National Cyber Strategy set out the UK’s role as a responsible and democratic cyber power, and laid down the framework on which the UK’s security and prosperity can depend.

It’s the bedrock of everything we do to keep the UK cyber safe.

It also important that our laws, the software of our society, are updated.

That’s why we recently published a consultation on improving the Computer Misuse Act, which is an important part of deterring those who would commit crime, and equipping law enforcement to carry out their duties.

That consultation is for you to contribute to and I look forward to hearing your thoughts.

We are proposing to include powers to take control of domains and IP addresses used by criminals and enable action against individuals in possession of or using data obtained through the criminal actions of others.

But I say again, your thoughts matter and I’m looking forward to your input.

We’re building the National Cyber Crime Unit to take on serious cyber criminals.

Its operational resources must deliver arrests and disruption, and build on the NCA’s enhanced intelligence picture to target criminals where they are most vulnerable.

We recently helped to dismantle Genesis Market – one of the biggest online marketplaces selling stolen logins and passwords to criminals across the world.

We’ve built a network of Regional Cyber Crime Units, ensuring that police units have access to specialists and capabilities.

I must also mention Ransomware attacks, where the National Cyber Security Centre assesses to be in the top tier of online threats to the UK.

Ransomware criminals cause harm and hurt. They cost more than cash. Hospitals and their patients in a pandemic were targeted, putting people and lives at risk.

Now this is a global problem, we are working with global partners.

With the US and others, the UK is a leading member of the international Counter Ransomware Initiative, and together we are going after these criminals.

Recently we sanctioned seven Russian cyber criminals who were behind some of the most damaging ransomware attacks in the UK in recent years.

With those priorities in mind, let me now turn to your role in the cyber community. Against this array of challenges, collaboration between government, law enforcement and industry is key.

I’d like to propose three areas where we must go further and faster, together.

First, prevention is always better than a cure.

Sometimes cyberattacks are sophisticated – but the vast majority are in fact simple, and can be easily prevented by a few simple steps.

Our aim is to make the UK the safest place to be online, and that starts with all of us working to ensure that everyone understands how to protect themselves.

The NCSC’s Cyber Aware campaign and the work of City of London Police leading this work, is I hope, of use to you all in providing advice that is simple, consistent and based on our collective latest understanding of the threat picture.

This room is filled with experts so please be active in shaping the guidance so that your staff and customers can avoid becoming victims in the first place.

Second, our most capable adversaries will only get better.

Malign states and crime gangs will look for chances in an open internet. We’ve got to do the same to protect ourselves.

Five years ago, WannaCry wreaked havoc in the NHS, leading to cancelled appointments and postponed operations on a huge scale.

North Korea’s cyber weapon was heralded in a new business model for criminals around the world.

Today, Ransomware is a chronic threat and is sold as a service to groups without cyber skills. The barriers to entry have come down. This is a democratisation of crime, just as much as any other.

The question that we should all be asking is: what next?

Breaking the future cyber-criminal business model – and understanding tomorrow’s state action in cyber space is key to pushing for more responsible, democratic behaviour.

The enemy will evolve and so must we.

Third, new technology will change the world we think we know.

Dawn has broken on the age of Artificial Intelligence. We’ve only just begun to wake up to the opportunities that will be unlocked in the coming years, and can only guess at the ways in which they’ll transform our world.

This speech wasn’t written by ChatGPT as you can probably tell. You’re not supposed to laugh at that. Very soon we are going to see Large Language Models such as Open AI’s ChatGPT which are already able to ace the bar exam and indeed write better speeches than this, and suggest new avenues for drug discovery. They’re not thinking yet, it is more pattern recognition and repetition than real thought, but the game is changing already.

The goal that many are working towards – an Artificial General Intelligence, or AGI – is looking more open and more possible.

It’s difficult to overstate what this would mean to all of us. Super intelligent computers that learn and develop autonomously would transform our society and our world, and more than almost any other advancement in human history.

Even in these early stages, AI can enhance our security but it can also threaten it. Our AI capabilities will be at the heart of our mission to protect the UK.

In Ukraine, AI is already being used to identify malicious Russian behaviour by analysing patterns of activity at huge scale, they are not just finding needles in the haystack but finding out what the haystack itself is saying.

At home and across our homes in the UK, AI could protect children from predators, unlocking advanced tools and techniques to identify potential grooming behaviour at scale and uncover rings of offenders right across the net.

However, in our line of work opportunity often comes hand in hand with risk, and AI is no different.

We already know because we’ve seen it, the cost of the advancement of technology and the challenge it has brought in biological space and we know because we’ve seen it the risks that a pathogen can cause to our world. We need to make sure that we do not see the same risk from AI.

It’s not hard to see future AGI coding weapons, even now there are threats we must guard against.

Cyberattacks work when they find vulnerabilities. AI will cut the cost and complication of cyber attacks by automating the hunt for the chinks in our armour.

Already AI can confuse and copy, spreading lies and committing fraud. Natural language models can mimic credible news sources, pushing disingenuous narratives at huge scale. And AI image and video generation will get better – so called ‘deepfakes’ – which make the danger to our democracy even greater.

Given the stakes, we can all understand the calls to stop AI development altogether. But the genie won’t go back in the bottle anymore than we can write laws against maths.

As Robert Oppenheimer once said, ‘technology happens because it is possible’.

Putin has a longstanding strategic interest in AI, and has commented that ‘whoever becomes leader in this sphere will rule the world’. And China, with its vast data sets and fierce determination is a strong rival.

But AI also threatens authoritarian control.

Other than the United States, the UK is one of the only a handful liberal democratic countries that can credibly help lead the world in AI development.

We can stay ahead but it will demand investment and cooperation and not just by government. Only by working together can we keep Britain in the front rank of AI powers and protect ourselves and our businesses.

As for the safety of the technology itself, it’s essential that by the time we reach the development of AGI we are confident that it can be safely controlled, and aligned to our values and interests.

Solving this issue of alignment is where our efforts must lie – not in some King Canute like attempt to stop the inevitable, but in a national mission to ensure that when super intelligent computers do arrive, they make the world safer and more secure.

Before I finish let me say again what a huge pleasure it is to join you for this outstanding event.

Last night at dinner I wasn’t with you in the Titanic Hall but instead at Hillsborough castle hearing those that had negotiated the complexity of the Good Friday agreement. I heard about the uncertainty and recriminations and the fear but I also heard about hope and the individual efforts by millions across Northern Ireland, and indeed across the islands of Ireland and Great Britain that changed our lives for the better.

This morning I’ve heard from others who are taking on a different challenge with its own complexity and uncertainty and indeed its own risk. But I’ve also heard the hope for a better future for us all. As we can cooperate to contain and confront the challenges, I am grateful to you all for everything you have done and continue to do in the name of keeping people safe online.

This is a ferociously difficult task. But I am constantly inspired and reassured by your talent, expertise and dedication.

I am very grateful for everything you do and I look forward to us working together to make sure that this revolution, the next revolution, serves us all and keeps us all safe.