Director General Ken McCallum gives annual threat update

Published date: 16 Nov 2022

MI5 Director General Ken McCallum gave his annual threat update at our headquarters in Thames House, London today.

In a wide-ranging update to an invited audience, he explained the nature of the terrorist threat to the UK and highlighted the challenges posed by states - in particular Russia, China and Iran.

Read his full speech below:

Introduction

Good morning. Thank you for joining me here in Thames House.

Today, I’ll give our annual public update on the threats the UK is facing, and what MI5, with partners, is doing about them.

No-one should be under any illusion about the breadth and variety of the threats we face in 2022:

•    We’ve seen Putin’s illegal invasion of Ukraine bringing war to Europe – raising national security questions many thought consigned to the history books.  
•    We’re seeing an increasingly assertive Chinese Communist Party using overt and covert pressure to bend other countries to its will.
•    Instability in Iran is bringing real-world consequences here.   
•    We’re still contending with transnational terrorist groups that are down but definitely not out.
•    As well as the wicked problem of self-initiated lone actor terrorists, fiendishly hard to detect and disrupt.  

Not all these challenges are bolts from the blue.  You’ve heard me and my predecessors talk about most of them before.  But their confluence and trajectory pose profound questions for the UK and our allies, on how we bolster our resilience and defend our way of life in a changing world.

All of this makes MI5's task compelling, and deeply motivating. The classic prioritisation choice for us is deciding what to pursue within hundreds of fragmentary leads to potential terrorist activity. Lifting up a level, how do we balance effort between, say, detecting teenage would-be terrorists radicalised in extreme right-wing spaces online, and protecting the UK’s military secrets from Russian cyber hackers? How to prioritise combatting repression of the Chinese diaspora or of Iranian dissidents here against the need to keep degrading Al Qaeda overseas? The complexity we face is huge.   

We also have a balance to strike in how much we say about our work.  I have made it a feature of my tenure to be as open as I can with you about what we do and why it matters.  

But I must be clear that secrecy and covert activity are essential for our effectiveness. We will always keep our methods and techniques confidential.  To maintain the UK’s edge in dealing with covert threats, we must protect our agents, our people and our operations.  

And maintaining the UK’s edge also means working with a wider range of partners than ever before; explaining the necessity of our work; and dispelling myths about the ‘type of person’ that works here keeping the UK safe.

Part of our mission is about keeping secrets, secret.  Another part is informing the public we serve about the threats facing the UK. That’s what I’m going to do today.

State threats

I’ll start on threats posed to us by States, where MI5 is making the biggest shifts in a generation. We are facing adversaries who have massive scale and are not squeamish about the tactics they deploy. The West is in a contest in which our security, values and democratic institutions are at stake.  To be clear: at stake because of the actions of authoritarian regimes, not because of the people living under those regimes.  

We are prepared for the long haul.  These threats will not evaporate overnight. When you’re in a contest, it’s almost always better to recognise that you’re in one. And we need both to disrupt specific individual threats, and make the UK a harder target. 

First Russia.  When I gave my last annual update, the invasion of Ukraine was a dark cloud on the horizon.  Now it’s a grim reality.  

The human cost is sickening.  But Putin is not winning.

Not winning in Ukraine, where the counter-offensive has made important advances. And not winning strategically, where rather than weaken NATO, Putin’s actions have doubled Russia’s land border with a strengthened alliance.  Much remains uncertain.  But I am proud of the part the UK, including our intelligence community, has been playing – in providing accurate warning of the invasion, in calling out disinformation attempts, and most crucially in supporting the monumentally brave Ukrainian effort.

I’d highlight one aspect of the international response that will have a profound, lasting impact. This year, a concerted campaign has seen a massive number of Russian officials expelled from countries around the world, including more than 600 from Europe – over 400 of whom we judge are spies. This has struck the most significant strategic blow against the Russian Intelligence Services in recent European history.  And together with co-ordinated waves of sanctions, the scale has taken Putin by surprise.

This year’s expulsions follow the template set by the UK-led international response to Salisbury in 2018. Alongside the wave of expulsions, the other part of that template is staying the course and preventing Russian intelligence restocking. In the UK’s case, since our removal of 23 Russian spies posing as diplomats, we have refused on national security grounds over 100 Russian diplomatic visa applications.

We’ve continued to work intensively to make the UK the hardest possible operating environment for Russian covert action. And we’ll need to keep at it: alongside assassination attempts, the Russian covert toolkit includes cyber attacks, disinformation, espionage, democratic interference, and the use of Putin-aligned oligarchs and others as tools for influence.

The distinctive importance of the UK’s support to Ukraine’s self-defence is reflected in recent Russian public statements pointed at the UK. While these include silly claims, such as alleging UK involvement in attacking the Nord Stream pipelines, the serious point is that the UK must be ready for Russian aggression for years to come. Some of that will be covert aggression, for MI5 to detect and tackle. But much of it, as currently with energy levers, will be overt. Our national resilience, brought into sharp focus by COVID, is a vital asset in which we must invest.

Which brings me to China.

In the summer, speaking alongside Director Wray of the FBI, I said that the activities of the Chinese Communist Party pose the most game-changing strategic challenge to the UK.

We set out the coordinated campaign we are seeing to re-design the international system.  We outlined the scale and breadth of their information acquisition, using not only intelligence officers and cyber hackers but businesspeople and researchers to steal government and commercial information alike. We talked about how organisations can actively protect themselves - while still engaging with the world, including with China.

And we described the threat to our national and economic security, and to the UK’s political system.  We see the Chinese authorities playing the long game in cultivating contacts to manipulate opinion in China’s favour - seeking to co-opt and influence not just prominent Parliamentarians from across the political landscape, but people much earlier in their careers in public life, gradually building a debt of obligation.

Since then, we’ve seen yet more concerning activity.  The Chinese authorities use all the means at their disposal to monitor - and  where they deem necessary intimidate - the Chinese diaspora. This takes place all over the world, from coercing and forcibly repatriating Chinese nationals to harassment and assault.

This was brought home recently when a pro-democracy protester appeared to be the subject of violence outside the Chinese Consulate in Manchester.  We’re seeing further indications of that repression.  Recent media coverage has focused on so-called overseas Chinese police stations.  But this activity extends to using the United Front Work Department and other front organisations to apply pressure to those challenging the regime’s perceived ‘core interests’ – whether that’s on democracy in Hong Kong or human rights abuses in Xinjiang.  We can expect it to increase further as President Xi consolidates power on an indefinite basis.  

To intimidate or harass UK nationals or those who have made the UK their home cannot be tolerated.

MI5 has an important part to play in countering these threats.  But tackling the whole problem needs a system-wide response. So it’s welcome that government recently announced a taskforce, reaching out cross-party, to focus on protecting our democratic institutions and freedoms.  We look forward to working with the Security Minister and partners on it.

I also want to mention the threat from Iran – the state actor which most frequently crosses into terrorism.

The current wave of protests in Iran is asking fundamental questions of the totalitarian regime.  This could signal profound change, but the trajectory is uncertain.  For now, we see the regime resorting to violence to silence critics.  An Iran that, with its proxies, remains a profoundly destabilising actor in its region and beyond. An Iran providing support to Russia, including by supplying the drones inflicting misery in Ukraine.

Iran projects threat to the UK directly, through its aggressive intelligence services.  At its sharpest this includes ambitions to kidnap or even kill British or UK-based individuals perceived as enemies of the regime. We have seen at least ten such potential threats since January alone. We work at pace with domestic and international partners to disrupt this completely unacceptable activity.  The Foreign Secretary made clear to the Iranian regime just last week that the UK will not tolerate intimidation or threats to life towards journalists, or any individual, living in the UK.

State Threats can sometimes feel a bit abstract, or of interest only to specialists. But they’re very real. To convey some of how it feels to us, allow me to use a metaphor which I get is imperfect:

MI5 plays a crucial role in a highly effective UK team.  But we need to be clear about the opponents we’re facing.

Russia thinks nothing of throwing an elbow in the face, and routinely cheats to get its way.  We’ve had success in getting some of their players sent off, and for now they’re a bit distracted by the blame game in their own dressing-room, but they will keep attacking us.

The Chinese authorities present a different order of challenge.  They’re trying to re-write the rulebook, to buy the league, to recruit our coaching staff to work for them.  

And Iran will only let people support one team and is prepared to use violence against those who don’t toe the line.

We’re alive to the risk of these teams loaning players to each other, amplifying their strengths.

But of course this isn’t a game. Which is why it’s so crucial that the UK grows its resilience. Alongside MI5’s work with the police, SIS and GCHQ amongst others to detect and disrupt threats we need a concerted societal response. That includes:

•    The National Security Bill, which will introduce new measures to protect the public, give MI5 and our policing partners a greater range of tools, and make the UK a harder operating environment.
•    It includes the whole-of-system approach I mentioned earlier - a concerted counter-state threat strategy bringing together expertise and tools from across government.
•    And it includes bolstering our nation’s resilience by investing in the foundations that will harden UK defences – our energy security; our supply chains; our protective and cyber security across government, industry and our research and innovation base.

The Centre for the Protection of National Infrastructure (CPNI), which reports to me, is doing vital work to help the UK reduce its vulnerabilities.  And it must go further, building on its respected role in protecting critical infrastructure, to reach a wider range of audiences in need of protection from a wider range of risks.  The way they do this, and the name under which they do it, will need to change. I expect that to happen in the first half of next year – at which point we’ll have more to say about the important roles businesses, universities and others can play.

In an era of renewed contest between democracies and autocracies, what we do in MI5 is one piece of a bigger jigsaw. I expect resilience to feature centrally in the Government’s refresh of its Integrated Review of security.  We are playing our full part.

Terrorism

I want to turn now to the threat from terrorism. Rising State threats are a huge challenge; but getting ahead of terrorist plots is still the first thing the British public expects of us. MI5 and CPNI’s quietly effective work with the police to safeguard the national mourning events following the death of Her Majesty Queen Elizabeth II was testament to the maturity of the system we’ve put in place over many years.

And we need that system, because the threat is still there. Since the start of 2017, MI5 and the police have together disrupted 37 late-stage attack plots. That’s another 8 potentially-deadly plots disrupted since I gave my update last year. And as before it’s a mix of Islamist and extreme right-wing terrorism.

Islamist Terrorism remains the larger problem – about three quarters of our terrorist caseload. As previously, much of the volume is self-radicalised terrorists seeking to conduct low-sophistication attacks. Low sophistication does not mean low impact: think of the appalling murder of Sir David Amess MP just over a year ago.

In a free country, detecting self-initiated terrorists – who often don’t reveal their plans to anyone, and can move quickly and sometimes spontaneously from intent to violence – is an inherently hard challenge. A challenge which is compounded by the complex mix, often, of extremist ideology with personal grievance and individual vulnerability such as mental ill-health. This poses pressing questions about how different elements of the State should best join up to manage risk to the public, effectively and proportionately.

This same phenomenon is strongly present also in the other quarter of our counter-terrorist caseload: Extreme Right Wing Terrorism. We most recently saw the horrible petrol bomb attack in Dover.

Just as with Islamist extremist activity, it is not always straightforward to draw lines demarcating what is and is not terrorism. In cases of previously-unknown attackers, who make no claim of responsibility, it takes time to assemble the facts – and even once they are assembled, they are often a confused mix of factors. 

The Extreme Right Wing landscape has continued to evolve away from structured, real-world groups such as National Action, to a diffuse online threat. From the comfort of their bedrooms, individuals are easily able to access right-wing extremist spaces, network with each other and move towards a radical mindset. 

There has been further growth in attempts to acquire weapons - firearms in particular, whether illegally obtained, homemade or 3D-printed. Often weapons are sought for their own sake, well in advance of any specific targeting intent developing – making for difficult risk management judgements, and forcing early intervention.

We are seeing growing numbers of right-wing extremist influencers, operating globally, fuel grievances and amplify conspiracy theories. This problem feels like it will endure.

Another problem which endures is the risk of sophisticated plots directed against the UK from Islamist terrorist groups based overseas.

Years of pressure by the military and organisations like mine against Al Qaeda and Islamic State means neither wields a centralised operational structure comparable to their respective heydays.

But MI5, SIS, GCHQ and other partners are still operating globally, every day, to penetrate and disrupt transnational terrorist groups, who absolutely still aspire to attack us. 

Pressure has forced both Al Qaeda and Islamic State to adapt, as each has done before. They are expanding into unstable regions and failing states through affiliated groups. This provides them with strength in depth, as decentralised movements more than hierarchical organisations.

Intent and capability varies, but the enduring risk is that in these strengthened global networks, affiliates work together to direct activity in the UK and in other western countries. A risk not to be underestimated. Though certainly preferable to what we faced from overseas just a few years ago. 

Which brings me to Northern Ireland.

Clearly, the political situation is challenging at present. But progress in countering terrorism continues: this year, the threat level in Northern Ireland was reduced. Working with partners we continue to achieve significant disruptions to Dissident Republican activity.    Despite many attempts, there have been no completed national security attacks since 2019. We continue to monitor all potential threats in Northern Ireland, and will investigate any that reach the national security threshold.   Those still attempting to engage in terrorism will continue to face the consequences of their actions.

Learning and improving

As terrorism in its various forms continues to evolve, MI5 continually looks to adapt the counter-terrorist system. The Operational Improvement Review we conducted with the police following the awful attacks of 2017 made 104 recommendations – we have implemented 102. We are on the other two and we’ve gone yet further:

A massive milestone is the creation of the Counter-Terrorism Operations Centre, in which MI5 staff are now working alongside the police.  CTOC, as we know it, is a purpose-designed operational hub that enables minute-by-minute connection between the many teams working on counter-terrorism. Progressively co-locating  policing, the intelligence agencies and other parts of government will significantly improve the effectiveness, efficiency and responsiveness of the counter terrorism mission.

Taking that same approach further, just as on state threats we’re working to build a wider response, going beyond traditional security agencies to connect with expertise in healthcare, education, social services and the criminal justice system, to respond to the complexity we are seeing.

Our other big push is constantly to improve the way data is obtained and analysed. That means MI5 forming cutting-edge partnerships such as with The Alan Turing Institute, and valuing data scientists and engineers just as we do agent runners and investigators.

The nature of terrorism, especially self-initiated terrorism, is such that we know it won’t be possible to find and stop every single developing plot. But we owe it to the public we serve to get as close as we possibly can, continually striving to tilt the odds in our favour. Every act of terrorism is shattering for its victims.  

Conclusion

Today I have sought to give a straight, balanced account of the increasingly complex range of threats we face.  I do so in service of our commitment to openness with a purpose - to keep our country safe.

Amongst other benefits, openness helps us bring the best talent to our organisation wherever it may be found, to maximise our effectiveness. This year marks the 25th anniversary of MI5 moving to fully open recruitment.

It is a great honour to lead an organisation of such brilliant people, who work with incredible dedication, integrity and drive to keep our country safe.

They do not expect recognition, but I want to take this opportunity to acknowledge publicly the invaluable contribution they make.

You don’t know who they are – but they do.

I’m incredibly proud of them.

Thank you.