In March 2018, Sergei Skripal, a former GRU officer and double agent working for the UK, and his daughter Yulia, were poisoned in Salisbury in the Novichok nerve agent attack. Perpetrated by two Russian nationals, the attack was almost certainly approved at senior levels of the Russian state, former prime minister Theresa May later confirmed.
Following the poisonings, May and others called for greater powers to punish Russia and prevent its operatives from performing espionage operations in the West. The plans were built on those first made in 2017, when the Law Commission proposed a new Espionage Act to replace the outdated Official Secrets Act – first drafted in 1911 – covering the disclosure or theft of information, whether by foreign adversaries or UK officials.
Last updated in 1989, the current Official Secrets Act was not designed for modern issues of large-scale cyber espionage and election interference. After all, the world was very different in 1989. The outdated Act also makes it difficult to track and prosecute foreign intelligence agents entering the UK.
But the proposed Espionage Act has stalled. It was met with opposition and as Brexit negotiations took over political discussions, appetite for the new powers waned. Then in December last year, prime minister Boris Johnson again outlined plans to tackle foreign spying as part of the Queen’s Speech cementing the new government.
This week the desire to rewrite rules around spying has been re-ignited. The Intelligence and Security Committee’s long-awaited Russia Report includes more calls for greater powers to handle Russian espionage in the UK, as part of a damning criticism of the Official Secrets Act. (Russia has consistently denied being involved in the Skripal poisoning, called the publication of the UK’s report “Russophobia” and said the country doesn’t meddle with the elections of other states).
The UK has allowed Russian adversaries to enter this country without challenge, the report says, and the Official Secrets Act makes it harder to prosecute when they are found to be in breach of it. “It is very clear that the Official Secrets Act regime is not fit for purpose and the longer this goes un-rectified, the longer the intelligence community’s hands are tied,” the report concludes.
Since the end of the Cold War in 1991, Russia has continued to conduct wide scale espionage operations in the West. Distracted by anti-terrorism efforts and the fallout post 9/11, the Russia Report questions whether the UK government “took its eye off the ball”, badly underestimating the threat posed by the hostile state.
Last updated 31 years ago, the current Official Secrets Act isn’t designed to deal with newer tactics of influence, big data manipulation and cyber-espionage – whether these come from Russia or any other countries considered a threat. “A lot of things have changed since 1989, especially the counter-espionage mindset,” says Ian Thornton-Trump, former Canadian forces intelligence operator and CISO for threat intelligence firm Cyjax.
The current Official Secrets Act includes powers to prosecute anyone who shares classified information, including someone who intercepts it. “The Official Secrets Act was drafted before the end of the Cold War,” Thornton-Trump says. “The mindset of those tasked with keeping official secrets out of the Soviet Union’s hands was radically different than it is today. The biggest threat was the Soviets turning UK insiders with access to classified information into agents.”
He points out that under the current legislation “a person who is not a British citizen or Crown servant does not commit an offence if they disclose the information outside the United Kingdom”. Andrew Parker, the recent head of MI5, told the MPs producing the Russia Report that the Official Secrets Act had become “dusty and largely ineffective”.
Russia blazed a trail for Chinese oligarchs to nab London property
This is a major issue, since the majority of technically enabled cyber-espionage activity is perpetrated by non-British people located outside the UK in countries such as China, Russia, Iran and North Korea. Crucially, says Philip Ingram, MBE, a former colonel in British military intelligence, the Official Secrets Act “has no powers” to stop intelligence agents from another nation coming into the UK.
“Our intelligence services have a continually updated database of foreign spies but lack the resources to track all of them if they come into the country. New legislation would make it easier to remove them if they don’t declare themselves on entry. It would also deal with other activities not necessarily carried out by intelligence agents.”
Technological advancement doesn’t mean there aren’t ways to currently handle foreign interference. Ian Cobain, author of The History Thieves, a study of official secrecy in the UK, says there are powers that can be exercised against overseas intelligence officers, but they “haven’t been used over the years”.
“They do have powers to deal with Russian interference; they tend to deal with it not by prosecution, but by expulsion and probably recruitment. There’s a very good reason for that because if we are sending intelligence officers to jail in the UK, the British intelligence officers in Moscow will face the same fate.”
But Ingram points out that the law is complex and easy to defend – and the intelligence services will never bring classified data out in public court. Following the Skripal poisonings, the UK and its allies expelled around 100 Russian diplomats, and Russia responded by doing the same.
The most publicised element of the UK government’s response to the Russia Report is legislation designed to clamp down on spying by requiring foreign agents to register when entering the UK. Essentially a mirror of the US’ Foreign Agents Registration Act (FARA), the aim is to make it easier to catch and prosecute some of those who operate on the behalf of foreign governments.
There are several types of spy, says Ingram. “Formally declared intelligence officers working officially in an embassy; and undeclared ones, who will come into the embassy as a ‘regional trade rep’ but are actually intelligence officers. Then there’s the third class: these are nothing to do with the embassy and are part of black ops, such as the GRU agents responsible for Skripal.”
The proposed new legislation would in theory make it much more difficult for those under the first two categories to conduct espionage operations and get away with it. “But it doesn’t stop black ops or off the books agents,” Zak Doffman, CEO at security firm Digital Barriers says. “The question is how much Russian espionage is conducted by avowed embassy staff that would register vs disavowed embassy staff who would not register – or activities outside the embassy with embedded people or those coming in. Clearly if they’re caught, they’ve broken the law and can be prosecuted. But let’s be blunt: It does not stop high end espionage of the kind Russia or China conducts against the UK.”
The FARA plans were mentioned in the government’s legislative agenda in December 2019 as part of wider plans to modernise the Official Secrets Act. The proposed Espionage Act also aims to make the UK a harder environment for adversaries to operate in by “ensuring the security services and law enforcement agencies continue to have the necessary powers” to address modern threats from hostile nations, “both domestically and overseas”. In addition, the government wants to modernise existing offenses and create new ones to “deal more effectively with the espionage threat”.
This week, Home Office Minister James Brokenshire said the UK would consider strengthening the Official Secrets Act and tightening rules on investment visas.
There is some sense to the FARA proposal, but Eliot Higgins, founder of open source and social media investigations platform Bellingcat is sceptical about what the UK government’s Espionage Act could achieve in practice. He thinks Russia is still getting away with too much and points out that the response to Salisbury – expelling Russian diplomats – appears to have achieved very little. “I think we need to have a much stronger response,” Higgins says. He suggests a centralised biometric passports system could cause problems for the Russian intelligence services. “They would have to recreate all of their fake identities.”
Another issue is the Official Secrets Act’s provisions are split into counter-espionage measures and counter-transparency measures. Any update to these could potentially prevent the press from receiving or publishing information handed to them by whistleblowers. “The Official Secrets Act has always combined counter-espionage measures and counter-transparency measures. Once the new version is on the table you can bet your life more draconian transparency measures will be attempted,” says Cobain.
But until it is stopped, Russia and other countries will keep pushing the boundaries of what they can do. “Russia knows if they keep attacks below a certain threshold, no one will do anything about it,” says Higgins. “The problem is, the threshold for Russia is so high at the moment because nothing happens; diplomats just get expelled. Until the price becomes something they are not willing to pay, like losing access to the SWIFT [banking] system, or a requirement for biometric visas or passports, they are going to keep doing it.”
More great stories from WIRED
🚚 The French town that created its own Amazon
🦆 Google got rich from your data. DuckDuckGo is fighting back
😷 Which face mask should you buy? The WIRED guide
🔊 Listen to The WIRED Podcast, the week in science, technology and culture, delivered every Friday
👉 Follow WIRED on Twitter, Instagram, Facebook and LinkedIn
Get The Email from WIRED, your no-nonsense briefing on all the biggest stories in technology, business and science. In your inbox every weekday at 12pm sharp.
Thank You. You have successfully subscribed to our newsletter. You will hear from us shortly.
Sorry, you have entered an invalid email. Please refresh and try again.