UK Warns of Likely AI-Powered Cyberattack on Critical Infrastructure Within Two Years, Names China as Best Equipped

London: Britain must prepare for an artificial intelligence-driven cyberattack on its critical national infrastructure within the next two years, the UK’s National Cyber Security Centre (NCSC) said on Tuesday, identifying China as the state most likely to possess the capability to carry out such operations.

Richard Horne, Chief Executive of the NCSC, which forms part of the GCHQ intelligence agency, said that for decades far too many organisations and supply chains in Britain had been allowed to get away with “doing tech on the cheap,” leaving them exposed to attack.

“In the coming months, we face a real prospect of an unprecedented rise in the number of cyber incidents,” Horne is expected to say in a speech later on Tuesday. “But we must be clear that is not because AI has invented new ways to attack us, but because vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable.”

Annual Threat Assessment

In its annual report, the NCSC assessed that a ransomware attack using AI-powered malware against the country’s critical infrastructure was highly likely to occur by 2028. The agency further warned that, over the same period, the use of AI by hostile actors would increase both the scale and the efficiency of their operations.

State Actors Identified

In his speech, Horne is expected to say that Russia has been making persistent attempts to infiltrate UK military networks, while Iran has been conducting malicious cyber operations around the world, including against the United Kingdom and against individuals it regards as threats.

“We know that China highly likely has the intent and is best positioned to use AI for operations against our critical national infrastructure and other strategic targets with their activity representing the most sophisticated and sustained cyber challenge the UK faces,” he will say.

Moscow, Beijing and Tehran have consistently rejected similar allegations of hostile cyber activity in the past.

Call for Urgent Action

The NCSC report and Horne’s address follow a series of cyberattacks on supermarkets across Europe that exposed weaknesses in IT systems.

Horne urged organisations to act without delay, warning that otherwise they would have to explain why, “when food isn’t on shelves, lights aren’t on, businesses have gone under … that we saw the warning signs, understood the risks and still didn’t make the right choices.”