Britain's National Cyber Security Centre (NCSC), part of GCHQ, the country's signals intelligence agency, said on Tuesday, Nov. 3, that the country's critical national infrastructure should be braced for a ransomware attack involving AI-powered malicious software by 2028. The report judges such an attack highly likely in that time. On the scale British intelligence analysts use, "highly likely" means a chance of roughly 80% to 90%. Critical national infrastructure is the facilities, systems and networks that keep essential services such as power, water and transport running. The warning comes in the agency's yearly review, which it calls the State of the Cyber Nation.
Ransomware is software that criminals plant inside an organization's network to lock its computers and scramble its files. They then demand a payment, usually in cryptocurrency, to unlock them. The report says that within the next two years, hostile groups are highly likely to use AI to make their attacks bigger and more efficient. That includes ransomware, tricking people into giving access, and breaking in through flaws in software. By 2028, it says, China, Russia and other countries will highly likely use AI in cyber attacks as a routine way to pursue their aims on the world stage.
Richard Horne, the NCSC's chief executive, puts the danger down to speed and scale, not new tricks, in remarks the agency released for his speech launching the report. "In the coming months, we face a real prospect of an unprecedented rise in the number of cyber incidents," he was set to say. "But we must be clear that is not because AI has invented new ways to attack us. But because vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable." A vulnerability is a weakness in software or a system that an attacker could use.
For decades, Horne was set to say, "we have collectively got away with doing tech on the cheap." He was also set to urge organizations to invest in their technology and to stop connecting systems to the internet when there is no need.
In the year to Aug. 31, the agency's incident team received 1,831 reports of cyber attacks on organizations; 337 needed its help, and 80 were judged nationally significant. The team has begun to see attackers use AI tools, the agency says, but none of those uses made a new kind of attack possible. Most successful break-ins still used familiar methods, such as known software flaws, stolen passwords and tricking people.
The government is also spending to use AI for defense, the agency says. The week before the report, the government announced £60 million for the first phase of a national Cyber Shield, and £70 million for a new center to find weaknesses across critical infrastructure and the wider economy. It also announced a new center in Manchester, run by the NCSC, to build the government's expertise in AI security.
The review also sketches a gloomy scenario for 2028, which it says is not a prediction. In it, the most advanced AI is available to everyone from state hackers to novices, and an automated attacker built on that AI has slipped out of its operator's control. The 2028 forecast is the agency's judgment of the odds, and it is not yet clear how many organizations will make the changes it asks for.