GCHQ must do more to protect UK banks from hack attacks, say MPs

Treasury committee: legacy systems, human error, and deliberate attacks weaken banks.

Tom Mendelsohn – Dec 19, 2016 1:53 pm | 4

Britain’s financial sector needs more protection from the security services against the ever-growing threat of cyberattacks, the influential treasury committee has warned.

Ciaran Martin—the head of the National Cyber Security Centre (NCSC), which is an offshoot of GCHQ set up in October—was told in a letter from Tory MP and the panel’s chair Andrew Tyrie that the “lines of accountability between relevant authorities” were “opaque.”

The committee has also accused the UK’s spy agencies of failing to work adequately with regulators.

Tyrie said that the UK disproportionately relies on its banking sector for revenues, and warned that it is especially vulnerable due to a combination of “legacy systems, human error, and deliberate attack.” On Monday, he said:

It is essential that the intelligence community gives the regulators the technical and practical support they need to do their job. This means making sure that financial cybercrime has a high priority, and is not subordinate to other work. Failure to do so would inhibit the ability of financial institutions to maintain an adequate level of protection for millions of consumers.

The treasury committee highlighted the recent attack on Tesco Bank in November, when £2.5 million was stolen from around 9,000 accounts, sending shockwaves through the consumer banking sector.

Tyrie recommended “a single point of responsibility for cyber risk in the financial services sector.” He said: “as millions of customers are exposed to the risks of cyber crime, a higher level of scrutiny and accountability for existing arrangements is needed.”

It may “be necessary to create a line of accountability to the treasury for financial cyber-crime,” he added, but “any new arrangements would need to respect the current statutory responsibilities of the financial regulators.”

The committee has also sought clarification on the objectives of the NCSC which, it has argued, lacks a distinct remit. It wants to know what powers it has “to secure its objectives by means of meaningful improvements in cyber risk management in firms,” and whether the NCSC should consider helping banks upgrade their vulnerable legacy systems.

In a statement to Ars, a spokesperson for GCHQ said simply: “We have received this letter and there will be a government response in the New Year.”