Oral evidence - Work of the National Security Adviser

Mr Mark Sedwill.

Q1 The Chair: Thank you very much for coming. As you probably know, we were a little dismayed that it took a while to set up the Committee, but we are grateful to you for coming so early in the period since we have been set up. We have all taken note of the fact that the Prime Minister has tasked you with reforms to the National Security Council process. What exactly are you considering?

Mr Mark Sedwill: Thank you, Madam Chair, and thank you very much for your welcome to this session. Essentially, there is a continuous process of trying to improve the operation of the National Security Council. You will be aware that we have been seeking to embed the Chilcot reforms into the process. With my coming in and there being a new Parliament, the Prime Minister asked me to look at the process and ensure that it was functioning effectively. That is aside from the policy work and the capability review.

I suppose the headlines of that are that we are trying to prepare meetings more thoroughly. The NSC(O), which is the officials’ group that meets beforehand, now considers the main strategic issues a few weeks ahead, so that we can have a proper steering discussion and try to ensure that we are bringing issues to the council itself in a more strategic format. We have also made some adjustments to the agenda, so that again there is a work plan that is several months ahead and Ministers have the chance to consider issues more strategically.

Perhaps the third thing—I can talk more about this; it is probably the most important point—is that the Prime Minister was particularly concerned that we had a rigorous implementation process in place so that the council’s decisions were then driven through government.

Q2 The Chair: That is helpful and very interesting, because, as you may know, in the past this Committee has expressed some anxiety about the degree to which the NSC was being strategic, and worried that it was being too operational and driven by day-to-day events. So the notion that you want to look at this more thoroughly and to a consistent plan that has a strategic approach is welcome news.

You said that you are looking carefully at how to make the discussions more strategic, have more notice and prepare in greater depth. You also referred to rigorous implementation. Which of those do you think requires most attention?

Mr Mark Sedwill: Probably the latter, to be candid.

The Chair: That is what I thought.

Mr Mark Sedwill: There are many colleagues here who have worked in government, and as you will know, particularly when one is dealing with cross-cutting issues for which there is no natural single home in a department—it is fairly straightforward if a department just brings a proposal that is agreed or not, and then it moves ahead. Here, of course, we are dealing with proposals that involve half a dozen departments or more, and it is in those areas that implementation has constantly proved challenging. When you were in government, Madam Chair, we talked about joined-up government. Essentially, we need to bring that concept alive in the national security area and ensure that each department and individual area is clear about what is expected of it and what the ministerial direction and guidance means.

The Chair: Yes, because we rather understood that that was part of the point of having a National Security Council.

Mr Mark Sedwill: Indeed.

The Chair: Am I right in thinking that you used to attend previously in your official capacity?

Mr Mark Sedwill: I attended when I was ambassador in Afghanistan, and when I returned from Afghanistan and was the Foreign Office political director I would attend from time to time on those issues. I attended very rarely when I was Permanent Secretary at the Home Office. I attended if the Home Secretary could not go and no junior Minister was available. But I did attend the NSC(O), so I was a member of the officials’ committee.

The Chair: Is that a strength? Does that help to inform the steps that you are taking?

Mr Mark Sedwill: I guess I am the wrong person to ask. You should perhaps ask some of my colleagues. Of course, my predecessors were very experienced ambassadors but had not run a domestic department. Having worked overseas and having that blend of the two has helped me. It probably means that I understand better some of the pressures, particularly of implementation, and of course have a good appreciation of the domestic security agenda in particular.

The Chair: I do not invite you to comment on this in case you do not want to, but I recall it being said, although not in public by her, that the Prime Minister, when Home Secretary, had some concerns about the degree to which the NSC did not consider the domestic agenda.

Mr Mark Sedwill: Without commenting on the specific point, I think your general point is well made, and we do try to ensure that a good blend of issues is brought. We now look at some overseas issues in geographic clusters, rather than country by country, which helps in a strategic discussion.

In response to your letter to the Prime Minister, by the way, Madam Chair, I will write to you this week with the agenda details of the NSC over the past couple of years, so you can see the issues that we have been discussing. We tend to look now at overseas issues essentially in clusters—we will look at east Asia, for example, and not just China—and at thematic issues that cut across the domestic and the overseas, such as counterterrorism or serious and organised crime.

Q3 The Chair: That is extraordinarily helpful, not least because that was about to be my next question.

Turning to another brief business-type question, in the past your predecessors have given the Committee information about the size and function of the secretariat, which is of course germane to implementation. Can we write to you after this session with questions? I do not invite you to dwell on that in detail now.

Mr Mark Sedwill: Of course, Madam Chair. The secretariat is still pretty much the same size as it was under my predecessor, but obviously I am making some changes there to reflect the changes to the NSC process itself. I am, of course, happy to take any detailed questions after this session.

Q4 James Gray MP: Whose idea was the capability review, and when was it commissioned?

Mr Mark Sedwill: We conducted a piece of work during the election campaign—my arrival coincided with the declaration of the election, coincidentally. I had already talked to the Prime Minister about doing a quick refresh of the 2015 strategy and SDSR, partly to deal with the evolving threat picture but partly also to deal with the question of whether it was still right in all respects, given that it was written before the decision to leave the European Union. Essentially, that morphed into preparatory work during the election campaign for incoming Governments, because, of course, we need to be able to present the incoming Government with a range of options on how they might proceed. So we presented that to the council after the election, and as a result of that discussion the council commissioned the capability review, which in effect is a refresh of the 2015 SDSR.

James Gray MP: Is it not unusual for an outgoing Prime Minister to instruct a review of this kind during a general election campaign? Is that normal?

Mr Mark Sedwill: The initial discussion with the Prime Minister was before the election campaign was declared, so I was not aware of it. But just as departments have to prepare for an incoming Government of whatever party or mixture of parties in any event, we would have had to do some work through the election campaign to prepare for the incoming Government on the basis of the overall review. So we have brought the two pieces of work together. We would have done that whether the Prime Minister had sought it or not as part of the proper work of the Civil Service during an election campaign to prepare for an incoming Government.

James Gray MP: Is it a proper review of the national security strategy as well? Is that part of the work?

Mr Mark Sedwill: The initial piece of work looked at the 2015 strategy and essentially ran a lens across it to ask whether it still looked as though it was broadly speaking correct in the new context of 2017. We concluded that the main structure and approach of the strategy and the broad view of national security et cetera were right. It was as a result of that that the council then commissioned the capability review.

James Gray MP: Given that the 2015 national security strategy review and the SDSR were one document, unusually and for the first time—this Committee was rather critical of that—and given that in this review you have cast your eye over the NSS part of that document, what led you to the conclusion that something needed to be changed in the other parts? If the NSS was of itself sufficient, despite the fact that it did not know anything about Brexit and all sorts of things had not happened in 2015, what led you to the conclusion that there had to be some other review at all?

Mr Mark Sedwill: Both are essentially a refresh of the NSS and the SDSR in 2015. You are right: the two remain together and there will be some changes to the first part—the strategy part—of the document when the process is concluded. The operational consequences of that, the council concluded, were for us to look in particular at a range of capabilities, some of them because of an evolving threat picture—the terrorist threat picture in particular has altered—and some of them, including “global Britain”, because of the decision to leave the European Union. We are looking at a mixture—it is not purely capability—across strategy, policy and capability.

James Gray MP: Forgive me, but I am puzzled now. It is easy to confuse me. The national security strategy in 2015 was merged with the SDSR. The conclusions of the SDSR were based on the national security strategy. The national security strategy in 2015 did not know much about the emerging Russian threat, did not know about Brexit and did not know about a whole variety of things, but none the less you concluded that it was not necessary to have a new NSS review.

Mr Mark Sedwill: I am sorry; I have not made it clear. We concluded that we did not need a full new national security strategy and SDSR. That was one of the options that the council could have commissioned, but it concluded that we did not need it, because, broadly speaking, the structure and conclusions of the 2015 reviews were correct: a broad view of national security that incorporates security, economic and influence objectives and the commitment that was already made in that strategy to deliver certain capabilities, most of which were only just starting. But there were clearly areas where we might need a course correction. Essentially, that was why a capability review was commissioned rather than a full SDSR. The other point is that the Government did not commission a spending review immediately after the election. That is the third component of the 2015 document, which was run alongside a full spending review. That range of factors caused the council to conclude that it should be a capability review rather than a full NSS document.

James Gray MP: I was about to come on to that. What is the point of having the NSS review or indeed the SDSR linked if you are not having a spending review? If the budgets are precisely as they were before, how can any outcome of the review have any effect, as there is no more money—or less money, come to that?

Mr Mark Sedwill: A constant challenge in government, which perhaps goes back to the point that the Chair made at the beginning, is whether we are spending all the money that we already have to best effect and in the right places, given the—

James Gray MP: That is a different point.

Mr Mark Sedwill: Depending on how you define it, we spend something like £56 billion a year on national security. I think it is reasonable of a Government to want to know that the balance of that expenditure is correct before they consider whether that £56 billion a year is the right number.

James Gray MP: Hang on. I am afraid to say that you have not answered the question at all. The question was: what is the point of having a national security review and a defence review linked to it if the premise is that there is no more money? Let us imagine that the NSS review or the SDSR concluded that there were vast new threats, which is presumably perfectly possible, but none the less there was no more money attached to it. Therefore, what is the purpose in doing it?

Mr Mark Sedwill: The purpose in doing it is to see whether the money that is already allocated is allocated in the right way.

James Gray MP: But you do not have to have an NSS review or an SDSR in order to do that. Presumably all departments do that all the time; presumably one of their primary functions is to do that. Do you not think that you are emasculating the SDSR or the NSS review by saying, “No matter what you conclude, the budget will remain the same”?

Mr Mark Sedwill: I would not put it quite that starkly. This exercise was commissioned by the council as fiscally neutral. It was commissioned against the background that we spend around £56 billion a year on national security as broadly defined, as I said, and to ensure that the balance of that expenditure across departments is allocated correctly. There are some constraints within that—obviously, the 2% commitment on defence and the 0.7% commitment on ODA were fixed—but there is a great deal that one can do to allocate resources within a pool that size to ensure that they are being allocated correctly and that the prioritisation is correct. It is essentially that that we are considering.

James Gray MP: What about timings? When will it be announced?

Mr Mark Sedwill: We will bring it to the National Security Council sometime in the new year and it will be made public by Ministers in due course. That decision has not yet been taken.

James Gray MP: Rumours circulating last night were that it was going to be delayed, so that it would in fact happen at the same time as the spending review. In other words, it will be delayed until next autumn’s Budget.

Mr Mark Sedwill: There is no spending review for next autumn’s Budget. There will be a Budget in 2018 and no decisions have been taken yet about a full spending review. But, no, it is not being delayed. I saw a tweet about a particular meeting moving. I will not get into a running commentary about what is on the NSC agenda, and you would not expect me to do so, but this will be brought to the council in the new year and Ministers will take decisions on the way forward then.

James Gray MP: So by Easter.

Mr Mark Sedwill: It is scheduled to be taken in the new year. Obviously, the schedule is for the Prime Minister.

Q5 Rachel Reeves MP: You mentioned in your answers to Mr Gray that Russia and Brexit were reasons for the updates since 2015. I wonder whether those are the principal reasons. The former Defence Secretary said that one reason for the capability review was the intensification of the four principal threats identified in the 2015 national security strategy. Is it the intensification of the risks, is it Brexit and Russia or is it a combination of those that meant that this update was needed?

Mr Mark Sedwill: The former Defence Secretary of course included Russia in the threats that he was talking about. The 2015 review identified four threats, Russia and terrorism among them—

Rachel Reeves MP: What about Brexit?

Mr Mark Sedwill: That was entirely separate. But it did identify those threats and was largely based on tackling the security component of those threats. As the former Defence Secretary said, the threats of terrorism and the Russian threat have both intensified. That is a factor influencing the shape of the review and whether we have the right strategy. But the original review took place before Brexit and we have to make sure that the current review is correct in the new circumstances as we leave the European Union.

Rachel Reeves MP: In the work that you have been doing, in what way is Brexit important for our national security?

Mr Mark Sedwill: It clearly affects our relationship and our co-operation with the European Union. As you know, we seek to have a deep and special partnership with the EU, but we have yet to negotiate that. It also affects our relations with the rest of the world. The Government are seeking to exploit the freedoms to deepen relationships with other countries—in south Asia, in the Gulf, in the Far East et cetera—across the economic and the security agendas. Brexit sets a different context within which we are operating, but the threats, of course, are independent of that.

Rachel Reeves MP: In 2015, when you conducted the NSS and the SDSR, you knew that there was going to be a referendum in 2016. Had the risk or opportunity of Brexit, however you might see it, been included in the NSS and SDSR, or did you have to look at this totally from scratch?

Mr Mark Sedwill: The 2015 exercise was conducted before I took the job. The government position at the time was that there would be a referendum, but at the time of the review I do not think that the timing of that was set and the Government’s intention was to campaign for remain. It was mentioned, I think, in the 2015 review, but it was not taken as a strategic driver of the 2015 review. Inevitably, of course, we have a different context now and we need to make sure that we are in the right shape for the position in 2017 and beyond.

Rachel Reeves MP: It is obviously a hugely different context. I am surprised that in 2015, when the work was done, it was not looked at more systematically. Have you undertaken a new national security risk assessment as part of the national security capability review process?

Mr Mark Sedwill: That process is under way. Within government you will be aware that there are three documents in this area. There is a national risk assessment, a national security risk assessment, both of which are confidential for practitioners within Government, and there is a published national risk register, which is an unclassified document. These documents are constantly under review, but we conducted a full refresh of the national risk assessment this year and we will conduct a full refresh of the national security risk assessment in 2018.

Q6 Lord Powell of Bayswater: Leading on from that, my question is this. From the work you have done so far, are you already seeing a significant variation between the four identified principal threats in their impact on the UK and the need to deal with them?

Mr Mark Sedwill: The two I would focus on are Russia and the terrorist threat. If we look back at the 2015 review, we expected both those positions to become more troublesome, and they have. They have probably become troublesome more quickly and broadly than was anticipated at the time, but they were shaping factors for the 2015 review. Clearly the Russian attitude towards the West has worsened more generally and that seems set to continue, while the terrorist threat has diversified and dispersed. That is partly because of the success of the military campaign against Daesh in Syria and in Iraq itself, but it is also because of the way that terrorist threat has developed and innovated.

Lord Powell of Bayswater: Linked to that, do you see a significant variation in spending diverging from the present base?

Mr Mark Sedwill: Not necessarily. It is more about the balance. Of course, some more money is coming in, and perhaps I should have made this point in response to Mr Gray’s earlier question. The Home Secretary and the Chancellor announced at the weekend that there would be an additional £50 million next year to support the police in dealing with the terrorist threat. The Home Secretary will set out more detail about that later this week in the House of Commons.

We had already agreed in the 2015 SDSR to expand significantly the resources going into the counterterrorism ring-fence and the security and intelligence agencies. You will note from the Anderson review, which has just been published, of the operational lessons learned from the terrorist attacks earlier this year that the main recommendations are not about additional resources or resources additional to those already planned to come in but about changes to the way information is shared and how the different organisations operate with each other. It is not always just about resources. Perhaps to go back to the earlier line of questioning, a lot of it is about the way we operate across the national security community.

Q7 Lord Powell of Bayswater: I have one last question that is not directly related to the previous two. When you are looking at the possible variations in the allocation of funds to particular departments, are you also looking at the question of how our nuclear capability is funded and whether it should be moved back to central funding as we did it in the 1980s, rather than lumping it all into the MoD budget?

Mr Mark Sedwill: There is a separate discussion about that. You will understand that I do not want to be drawn on the detail of the deterrent, but that issue has not really been central to the capability review, although of course I am having a discussion about it in a separate forum with the Ministry of Defence and the Treasury.

Q8 Dan Jarvis MP: Can I ask you about defence-specific resource and capability? You will know perhaps better than anyone about the huge range of very varied threats that we face as a country. Given that, is 2% of GDP sufficient to invest in our defence?

Mr Mark Sedwill: That is a political question above my pay grade, Mr Jarvis. We invest more than 2% now, of course. We have the biggest defence budget in Europe and we are the biggest defence contributor in Europe. From my perspective, I tend to think of this in the round. We are the only western country that exceeds the 2% target for defence and also hits the 0.7% target for development. We have world-class security and intelligence agencies and so on. When I think about our national security capabilities, I am thinking about the whole portfolio. No other country has quite the same mix as we do and can bring all those capabilities to bear. Going back to the Chair’s first line of questioning, part of my job is to ensure that we synthesise and fuse all that and deliver it effectively.

Of course, anyone in my job would be delighted to have more capability, but we have one of the largest defence budgets in the world and it is growing. The Joint Force 2025 programme will, when delivered, give us world-class and modern capabilities across the piece. I think that my counterparts overseas envy the sort of capabilities that I am able to recommend that Ministers deploy.

Dan Jarvis MP: In terms of the capabilities that we can bring to bear, obviously when we are looking to develop those for the future, it is incredibly important to think about what our allies are doing to develop their own capabilities. What conversations are you having or what work is taking place alongside our US and European partners about the contribution that each of them proposes to make to collective security in the future?

Mr Mark Sedwill: That is a really powerful point. One of our capabilities, which of course is one that the Russians do not have, is our allies. If you add up only, say, the British, French and German defence budgets, even though France and Germany do not hit the 2% target, the result is double the Russian defence budget, or at least the declared Russian defence budget. A lot of this is not about absolute levels of expenditure but about the effectiveness that we can get through interoperability and so on.

Part of the NATO modernisation programme is to ensure that forces are genuinely more interoperable and that we are able to deploy alongside each other. As we deploy the carriers, you will be aware that we will have some allied capability both in the carrier groups and indeed on the carriers themselves. When I was in the United States last week, I saw the Defense Secretary, General Jim Mattis. He talked about examples of British defence and military capabilities that are almost unique and that make a real contribution to the American view of the allied effort both within the European theatre and outside it. So you are absolutely right. If one of our strengths is our alliances, we need to ensure that we integrate and interoperate our capabilities as best we can.

Q9 Tom Tugendhat MP: You say this as the Government’s chief security adviser. The question raised by Lord Powell and Mr Jarvis on spending is surely key to your responsibility, as indeed is the flexibility of finances from one area of spending to another. Therefore the reality of the 2% is that it is not, after all, a target. What is a target is the strategy capability of the United Kingdom. That is a floor of 2%, not a target. Could you say a little about how you therefore see the strategic threats to the United Kingdom being balanced against that floor?

Mr Mark Sedwill: Perhaps I could take the European theatre as an example, otherwise I would probably deliver a 20-minute answer, which I suspect would try your patience. We know that the Russian threat is definitely intensifying and diversifying. The Russians are improving the sophistication of their conventional capability. We saw that out in Norway quite recently where I was shown me some of the conventional capabilities that the Russians are developing in the northern theatre. That work is clearly designed to be able to disrupt, if needed, NATO capabilities in the north Atlantic.

At the same time, we saw the huge Operation Zapad, which was as much a propaganda operation as a military exercise designed to unsettle our allies in eastern Europe. Then, as we are all well aware because the Prime Minister spoke of this in Mansion House, there is also the cyber threat that they mount. So we are seeing a diversification of the Russian threat, which they call the continuum doctrine, and we as an alliance need to be able to deter, disrupt and defend ourselves against all those threats. However, we have to do it as an alliance.

From my perspective, it is not just the 2% floor, as you say; I think it is 2.14% at the moment in defence, with a growing budget—0.5% in real terms per year—unlike in most other areas of government. It is about the full mix of national security capabilities that we can bring to bear, and my job is to ensure that Ministers have the opportunity to consider all the options available to them. Obviously, they then need to decide what the blend of those capabilities is, and there is a much bigger discussion about the overall funding, which is obviously one for main spending reviews.

Tom Tugendhat MP: It is in that spectrum—forgive me—and working with allies that one starts to see holes appearing. For example, Royal Marines winter training in Norway to defend the northern flank is an area that we have spoken about in the past, yet it appears to be one of the areas of strategic vacuum.

Mr Mark Sedwill: I am not an expert on that particular deployment, but when I was in Norway we had a rich conversation about how Norway, the UK and other allies can operate more effectively on that northern flank to deal with an evolving Russian threat. I probably need to come back to you on the detail, having taken a bit more expert advice.

Q10 Dr Julian Lewis MP: If the threats are intensifying, as Michael Fallon stated and as you have just been outlining, why are cuts in defence capability being so widely anticipated as a consequence of this review?

Mr Mark Sedwill: You will be aware that there has been a great deal of public speculation about that, but the former Defence Secretary and now the new Defence Secretary have both been clear about the floor, as Mr Tugendhat puts it, and the growth in the defence budget. Very careful consideration is being given to the capabilities that can be developed. I have not had a chance to look at all the detail of the report that you have just issued about the efficiency programme and so on, but I have seen the summary. The programme is designed to deliver Joint Force 2025, which is a very impressive set of military capabilities that will be available to this country in the mid-2020s, and that remains our target capability baseline.

Dr Julian Lewis MP: Are you saying that there is no chance of significant cuts in existing defence capabilities resulting from this review?

Mr Mark Sedwill: It is not for me to pre-empt decisions that Ministers will take—

Dr Julian Lewis MP: I am not asking you to be specific; I am asking you to be general. Are you telling us that as a result of this review we need not be concerned that there will be cuts in existing capabilities, given that the review is supposed to be being held because the threats are getting worse?

Mr Mark Sedwill: Ministers need to have options about making adjustments to capabilities and to the programme, and that may mean reducing some and increasing others. That is for Ministers to decide, and while this review is in flight I probably cannot say much more than that.

Dr Julian Lewis MP: Did not James Gray get to the heart of it when he asked you a question about this trade-off between an increasing threat on the one hand, leading to a cut in the capability to meet another threat on the other, unless you increase the overall defence budget? Was not the game given away by your answer when you said that this is meant to be a fiscally neutral exercise? The threats that led to the capabilities being drawn up in 2015 may not have changed, but other threats may have got a lot worse and because you are not willing to recommend an increase in the defence budget—indeed, you seem to be rather complacent about its size, from what you have just been saying—this means we have to make cuts in capabilities that we really need in order to meet other threats that have got worse. Is that not the logical consequence of everything you have been telling us?

Mr Mark Sedwill: I do not agree. When I said that the 2015 review was fiscally neutral, it was fiscally neutral within a growing envelope. The 2015 review already has significant increases coming into a range of budgets. The defence budget, as you know better than I do, has a fixed floor of 2% of national income and will grow by 0.5% per year in real terms, and there are other commitments within that. So the defence budget is increasing. The budgets available to the security and intelligence agencies are increasing. So even if you take just the hard-power end of this, we actually have an increasing envelope. In answer to the question from Mr Gray that I was trying to respond to, it is about how we balance off the decisions within that increasing envelope.

Of course, there is a question about whether, overall, that is sufficient. But this exercise is looking at how we can make best use of the resources available to us now, against the threat picture, and we will reach the conclusions at the end of that exercise.

Dr Julian Lewis MP: But do you or do you not have the ability to make a recommendation, if you believe that you cannot meet the new and intensified threats without making cuts in capabilities that we decided only two years ago were necessary and important? Do you have the ability to say to the Government, “We need to enlarge the financial envelope”, to use the jargon?

Mr Mark Sedwill: If we concluded that the total set of capabilities, optimised across that £56 billion, was insufficient to meet the threats, of course we would say that to Ministers. That is not a conclusion I expect to reach, but of course I always have the freedom to give Ministers candid advice. As I have already said, the Government have just announced, even in the short term, a significant increase in funding for policing because of the intensification of that threat. So there are areas in which this is being considered.

Dr Julian Lewis MP: With respect, you keep lumping together—I know that is your job, because you are the National Security Adviser and not the Defence Secretary—the budgets for all these things. There is no doubt that because of terrorist threats in particular there have been very substantial increases in budgets for the intelligence services, for example. But the budget for defence is £36 billion and that is the budget that gives us our NATO comparator of 2% as a minimum. You say that one of the main reasons why the threat has intensified has been a newly assertive Russia. The last time we had an assertive Russia was in the 1980s, and we were spending not 2% on the defence budget then but between 4.6% and 5.1%.

Tom Tugendhat MP: Our allies were spending comparatively more as well.

Dr Julian Lewis MP: Thank you, Tom. Even after the Cold War came to an end, between 1989 and 1991, and even after we took the peace dividend cuts, as late as the financial year 1995-96 we were not spending a bare 2% of GDP on defence, but 3%. Given that we used to spend a much greater percentage of GDP on defence and have defence much higher on our scale of national priorities than we do now, in comparison with other high-spending departments, are you still saying to me that we should not be concerned that we are talking about deleting entire capabilities such as the Royal Marines’ amphibious capability, when in only January of this year I was being assured that HMS Albion and HMS Bulwark were due to leave service in 2033 and 2034? How can you tell me that we do not need an enlarged defence budget if we cannot deal with intensifying threats without cutting other capabilities that, only two years ago, we decided we needed?

Mr Mark Sedwill: With respect, the direct example you gave is of course speculative; no decisions of that kind have been taken. There is a lot of speculation in the press, some of it very well sourced, but no decisions have been taken.

On your general point, the historical comparison is of course correct in the sense of our own expenditure, but let us not forget the nature of the threat we faced in the 1980s. I do not think that the way to measure this is just through budgets, because it is actually about the effect that you are seeking to achieve. But taking that as a proxy, as I mentioned if you put together the British, French and German defence budgets, even now—even before Germany and France hit the 2%—it is about twice the Russian defence budget.

What they get for that and the way they deploy themselves are clearly different, and you will be the first to tell me that that is no direct comparison, but that is my point about budgets: we cannot just compare to our own historical experience. Areas in which we may decide to deal with the Russian threat because of the diversifying nature of that threat exist outside the defence budget. I do not dispute the basic analysis that you are setting out, but it is right in my job to think about the whole set of capabilities, not just the biggest one.

Dr Julian Lewis MP: I have to stop now, but may I just say that anyone who underestimates Russia’s military potential and the size of its GDP does so at their peril? I have many more questions that I would like to put, but I fear that they will have to wait for a different forum from this one.

Lord King of Bridgwater: Are you the right person to whom Dr Lewis should be directing these questions? Quite simply, do you feel that it is in a sense your responsibility to work within the terms of reference that may have been implied to you? Perhaps you feel that you are not in a position to challenge the Treasury head on. Is that right or wrong?

Mr Mark Sedwill: Perhaps there are two parts to the question and two parts to the answer. Dr Lewis and I have exchanged some correspondence, as has the Prime Minister. I genuinely think, and it is the government position, that questions of this detail should be addressed to the Defence Secretary and the Permanent Secretary at defence, because they are responsible for this area of work.

On the broader question of whether I can have frank conversations with the Prime Minister, the Chancellor and the Treasury about the overall allocation of resources, absolutely, and I would expect to do so, but, as always, in private.

Q11 Baroness Lane-Fox of Soho: You referred, I think, to the large, growing and diverse cyber threat. I am interested in how much your view on this has shifted since 2015, because it feels to me as though a lot has shifted since last week. How would you begin to characterise the threats and how do you plan for them?

Mr Mark Sedwill: You know this area much better than I do, but I hope you would agree about the rate of change in this area. Essentially, individual threats have become sharper and the diversification of the threats has progressed faster than we, or indeed anyone else, expected two or three years ago. As you say, it almost feels as though there is something different all the time.

What strikes me about the cyber threat, and I dealt with this a lot when I was at the Home Office, is how it cuts right across any definition of national security and, indeed, of public safety. Let us take an individual small business like the florist that is near my flat in Battersea. It saw two crimes in the space of a week, one of which was to smash up its stuff outside the shop while the other was a cyber attack on its bank account. The second was much more difficult for the police to address.

The cyber threat is not only a national strategic threat of the kind we have been discussing where a hostile state could achieve through cyber activity the same kind of effect it could achieve through significant military action; it is also a threat that goes right down to individual businesses or, as you know, individual citizens, particularly the most vulnerable. It is therefore not one that we can parcel up and put in one place. It is now essentially a place, a battle space—if one likes that language—or a domain that runs right across the national security and public safety agenda.

Therefore—again, one could talk about this at great length—the approach has to be, as it is in other areas, in very generic terms to tackle the threats as best we can, reduce them and go after the people responsible for them. You get a blend of state and non-state, criminal, political et cetera, as well as improving resilience. As you know, this is not something that the Government can do alone; we have to improve the resilience of the citizen, of businesses and of government as a whole. I am happy to talk at length about this, but perhaps I should stop.

Baroness Lane-Fox of Soho: How can £1.9 billion even begin to scratch the surface of this threat? How do you see that number in relation to the overall budget?

Mr Mark Sedwill: The £1.9 billion is for the government cybersecurity programme. As I say, this is as much about societal and economic resilience; it is not just about government. That is designed to try to improve government activity. It is what has funded the National Cyber Security Centre, which was launched, I think, since the Committee last discussed this issue. A big part of that unit’s job is to improve best practice in businesses and among citizens to make people more cyber streetwise and so on so that we improve resilience across the economy and society. I do not think this is an area that is simply about the Government spending money to change things. It is about changing the way that people and businesses conduct themselves online, and it is something that they need to build in.

Q12 Baroness Lane-Fox of Soho: Can we talk for a minute about the specific NHS WannaCry attack? I am not sure whether the decision about a centre for security operations was taken before that attack or whether it was decided afterwards that the NHS should establish a centre for security. Can you tell us about that? Also, my understanding of the challenge was that it was a failure by people over a long period of time to consistently upgrade the software they needed to. How are you approaching this as a challenge across all our critical infrastructure?

Mr Mark Sedwill: On your first question, I believe that the operation existed before, but it has been essentially energised since. I am not absolutely sure, and if I have that wrong I will write to the Committee to correct that, if I may.

On the second point, you are absolutely right. Without going into detail that exposes vulnerabilities, you will be aware that in some areas, but not all, there was old software that is no longer fully supported and had not been patched. This attack hit individual fragments of the NHS and not most NHS and other government systems—actually, this attack also hit Russian businesses and others—because while most of the NHS and government systems were resilient, some were not.

That basic message in a sense goes back to the first question. It would not matter what the government budget for cyber is, because this is as much about IT departments in businesses, hospitals and elsewhere indulging in the basic hygiene of updating their systems and making sure that the software is patched. That will not guarantee against all cyber threats, but it will significantly increase their resilience against this kind of threat. As you will be aware, some of this is also about backing up data properly so that if there is a ransomware attack that freezes your system, you have lost only a day’s work because everything up to the day before had been backed up in a different system.

There is a whole load of practice, of good cyber or IT hygiene, that will make any organisation or indeed any individual much less vulnerable to a cyber attack.

Baroness Lane-Fox of Soho: How can you influence making sure that we have the skills in place and that attention is paid to these issues?

Mr Mark Sedwill: In the economy as a whole, this is led by DCMS, which is the lead department for the digital economy. It has responsibility for trying to ensure that as businesses exploit the digital economy—as you know, we are one of the most connected countries in the world—they do so in a way that is safe and protects them properly.

The main contribution that we make in the national security community is the National Cyber Security Centre, which has had a very good first few months of operation. It supports businesses and government in defeating cyber attacks or dealing with them quickly and effectively, as well as improving resilience generally. That is probably the main contribution that we can make more widely.

Of course, within the national security departments and agencies we have to make sure that our own systems are resilient. There are parts of our supply chains that we are addressing quite carefully.

Baroness Lane-Fox of Soho: I know that different Ministers have different bits of this issue, and as you say it is a complex web, but do you think there should be a single Minister with responsibility for cyber security?

Mr Mark Sedwill: I do not, to be honest. It is now too distributed an issue to say that there should be a single Minister for Cyber. I set out briefly in my letter to the Chair where that responsibility now lies. We have consolidated some of it compared with where we were a couple of years ago. We have DCMS, which is responsible for the digital economy and ensuring that it is safe. That sits with the department’s core responsibilities. The Home Secretary is responsible for dealing with the civil contingencies effect of any cyber incident, and again that sits with her core responsibilities. The NCSC is part of GCHQ so the Foreign Secretary has oversight of it. Then we have the First Secretary of State, which is a change because it means that we now have a very senior Cabinet Minister in charge of the national cyber security programme and strategy. That feels like a good mix of responsibilities to me.

Q13 Baroness Lane-Fox of Soho: I have one short question to follow that. Do you think that you personally can recruit the talent that you need to think about this issue?

Mr Mark Sedwill: I would generally take people on secondment, so it is not really an issue for me in the secretariat. Although GCHQ and the NCSC are in a very competitive market, which you will know better than I, they can offer something to computer scientists and graduates coming out of universities that the private sector cannot, which is a sense of purpose and the sheer fascination of the work. They feel that they have a pretty good record of attracting highly-skilled people, but they are not people like me because they will not want to spend 25 or 30 years in one organisation. There are innovative programmes with scholarships and bursaries through universities, internships and so on. Creative things are being done to attract the right people and I think that they feel they have a good handle on that question.

Lord King of Bridgwater: On this issue, do you really think that people have yet woken up to the seriousness of the whole cyber situation? It seems to me at the moment that it goes right across government. I am surprised that DCMS, which is not seen as the most heavyweight department in government, has overall responsibility. I make no criticism of Matt Hancock, who is the Digital Minister. Starting with critical national infrastructure, in the old days if you wanted to attack a country you bombed its airports, damaged its railway lines and so on. Now you just shut those systems down. Obviously aviation is under a major threat from cyber, as is any transport system, along with power generation. All that can shut a country down.

It seems that we still have not woken up to the enormous scale of what is going on, with cyber attacks in numbers that I find incredible either by hostile nations or by enterprising young men, and perhaps young women. You have talked about putting people through university. I hope we are going to recruit a lot of people in this field to defend us before they ever get to university because they are some of the brightest.

Also, we know that businesses cover up the fact that they have been attacked. How good a picture do we actually have of what is going on right across government and our critical national infrastructure, major suppliers to government and the nation — the whole of the national fabric? How good are we at covering the whole of that waterfront?

Mr Mark Sedwill: You make the point very eloquently. For the economy and for society as a whole, you are right: people have not really appreciated the seriousness of this threat. One needs to think about these issues at the most prosaic levels—as a parent as much as anything else. The social harms ranging from cyber bullying, revenge porn—all these kinds of things—are new factors that young people are dealing with and go right the way up to the much more strategic questions that you have set out. There is a role for schools in this as well as for businesses. You are absolutely right that we need to recruit people straight out of school and put them through bursaries. Indeed, the cyber security centre and GCHQ are doing just that. As you know, that is a challenging prospect for government, because we have not traditionally done that, but it has been able to do so.

On the broader strategic question about the critical national infrastructure, the supply chains into national security capabilities and so on, let me assure you that we are on this question. I would not claim that we are completely on top of it. There are vulnerabilities, and very sophisticated and innovative attacks are being mounted. But we are very conscious of the threat, whether it is in the private or in parts of the public sector, and we are building that into our programmes. That is a big part of the National Cyber Security Centre’s work.

On your point about companies’ disclosure in this kind of attack, this is an area where the NCSC is working in a genuinely sophisticated way. It will agree with companies how they would handle an attack, beginning with a confidential conversation so that companies feel that they can share that vulnerability with the NCSC. They discuss what needs to be done thereafter to reassure customers or shareholders that they have handled it properly. We are seeing one or two examples of where that did not work. NCSC has sought to learn lessons and help companies to deal with this kind of attack and not increase their vulnerability by going public at the wrong time, while obviously going public at the appropriate time.

Q14 Tom Tugendhat MP: Very briefly, you referred to cyber as an electronic crime but it is also a physical crime. You will have read the Policy Exchange report written by Rishi Sunak MP on undersea cables. Would you care to comment on that?

Mr Mark Sedwill: The Chief of the Defence Staff spoke about this at some length last week. It goes to the point that Lord King has just made. In the modern era you can achieve the same effect as used to be achieved in, say, World War Two by bombing the London docks or taking out a power station by going after the physical infrastructure of cyberspace in the form of internet undersea cables or going after the hardware or indeed the software through attacks that either freeze or tip over systems. We have to take both of those seriously.

Tom Tugendhat MP: That emphasises the overlap that you talked about earlier on defence capability, and not simply as a standalone capability under the Permanent Secretary but one that you should take an active interest in yourself.

Mr Mark Sedwill: Of course, I take an active interest in all the capabilities, but in the end they are delivered by individual departments. What those departments deliver, how effectively those departments deliver them and whether they are on budget or not is very much a matter for them. My job is to try to help the NSC as a whole to see the entire picture and play that co-ordinating role. I run a relatively small secretariat, and some of the caricatures that I have seen in the press of my influence on these matters are perhaps slightly exaggerated.

Lord Hamilton of Epsom: There was a report in the press yesterday that companies are accumulating bitcoins so that they can pay off blackmailers on the cyber side. Are you confident that if that happens, although it would not be in the public domain, these companies would inform you, or is this going on without you knowing anything about it at all?

Mr Mark Sedwill: This goes to the point that I made to Lord King. I cannot be absolutely confident, but companies which indulge in that are simply laying themselves open to more and more of the same problem. I suppose that part of the test of whether our cyber strategy and cyber resilience across the economy as a whole are working is if companies feel that they need to insure themselves through that kind of mechanism. However, I can assure you that companies that face this kind of vulnerability, believe that they do so or indeed experience an incident, can go in confidence to the NCSC. As I say, the NCSC will help them to manage the public disclosure of it in an appropriate way.

Q15 Theresa Villiers MP: I would like to move on to counterterrorism. In March, the previous Committee heard from the Home Secretary. It asked about what was happening on the Contest strategy and the publication of the document that is generally referred to as Contest 2.0. At the time, she acknowledged that it was running late and restated the importance of getting it out. That was clearly somewhat overtaken by events, but it would be useful to hear from you how the shift from Contest 2.0 to Contest 3.0 has affected your thinking? Why was there not a case for pressing ahead with the publication of the Contest review document that was expected, even in the expectation of further work being done on the new strategy or review that was announced after the general election?

Mr Mark Sedwill: The question of publication is, of course, very much one for the Home Secretary and Ministers. I think they felt that, given the nature of the attacks and the fact that we needed to take another look at it — an operational review was conducted with David Anderson’s assurance — it did not make sense to put out one document at a time when we would not have known whether there would be significant changes. I would guess that it could have caused confusion. I was not directly involved in the decision about the non-publication of it at the time.

On the work done since the election, it is quite broad-ranging. As you know, there have been the operational reviews, which have produced significant lessons learned about how the operational and casework mechanisms need to change — better data sharing and more intense engagement with mainstream policing and other actors of that kind. More broadly, the threat has diversified and diffused. We have seen people being radicalised online at a much greater rate than even a few years ago. I was very struck by that particular phenomenon when I was at the Home Office.

Then we need to put in place a broader structure that deals with the more diffuse threat whereby people can be radicalised quickly and can use everyday implements—knives, cars et cetera—to carry out terrorist attacks. That means that we have to engage a much broader community in dealing with the terrorist threat.

The Contest 3.0 review, as you refer to it, is in progress. It is part of the capability review portfolio and, as with the capability review as a whole, will be published in due course.

Theresa Villiers MP: I appreciate that it is an awkward question when there is yet to be publication, but would you envisage a significant difference in emphasis following the low-tech, lone-actor attacks earlier this year? Will those have a big impact on the thrust of the next iteration of the Contest programme?

Mr Mark Sedwill: We were already seeking to deal with that. That threat had already emerged, as you will recall. As the Anderson review sets out, the casework model that was in place, which had an intense focus on a relatively small number of high-threat cases, needs to be complemented with a broader picture of closed SOIs, as they are called in the trade—people who were on the list of potential threats and were then taken off—and of trying to identify new and emerging threats.

That is a complex business that involves some of the more intrusive powers of online surveillance et cetera that Parliament granted in the legislation last year. But fundamentally it is a question, as I was saying, of data-sharing: making sure that we have the whole picture of all the government data on individuals and can therefore assess risk. It is partly about applying algorithms and artificial intelligence to that data to enable the experts to make risk judgments in a more sophisticated and time-sensitive way, and it is also engaging that wider set of stakeholders, particularly at the local level. That is a challenging prospect. It is about taking security issues into areas that are not traditionally familiar with or, in some cases, comfortable with security. So there are some institutional and cultural questions there too. We will want to pilot some of those approaches just to learn and test from experience. But those will be the main changes that we are likely to see, and they came out of the Anderson review.

Theresa Villiers MP: As part of that, could more be done to engage with and strengthen neighbourhood policing so that officers who are embedded in communities can help to provide early warning of individuals at risk of radicalisation? Will there be something in the new Contest review that might give us a fresh perspective on how we use those tremendously important assets more effectively in countering terrorism?

Mr Mark Sedwill: Again, without prejudging the final review, which has not yet been to Ministers for a decision, the basic point that you make is correct and, indeed, came out of the Anderson review. Engaging local actors—neighbourhood policing, but other local actors too—and ensuring that they have the information they need in order to do their jobs effectively in relation to tis set of threats, as they do about gangs, criminal threats and other social problems, is one of the conclusions of the Anderson review and doubtless will be followed through in the broader review that I presume the Home Secretary will want to announce in the new year.

Q16 Theresa Villiers MP: It would be useful to get your thoughts on the very serious statement by the head of MI5 concerning the dramatic upshift in the terrorist threat in the United Kingdom. He has clearly spoken out in the strongest terms, and it would be useful to hear your thoughts on the main drivers of this very significant change in the level of activity and threat that we face.

Mr Mark Sedwill: First, I entirely agree. This is a subject that the director-general and I discuss often, and we discussed it a lot over the last few years when I was doing my previous job. I think all of us are still seeking to understand better what has really driven this. There are a number of factors that we can see evidence of, such as online radicalisation by people in Syria—based in Raqqa, for example, until recently at least—of people in the UK, often quite impressionable youngsters.

There have been some trends. The average age of the people under scrutiny has come down, and there are more women than would have been the case a few years ago. The question is quite why that is and what has driven those individuals into that situation. Obviously, there will be individual cases. As the Prime Minister has pointed out on occasions, a relatively high proportion of people have had mental health problems in this cohort, whom these people are exploiting. They are exploiting that particular vulnerability. I do not want to caricature that. Of course, it is not the case across the board, but there are some significant factors of that kind.

So the nature of the radicalising threat has become more sophisticated, and it perhaps goes to Baroness Lane-Fox’s point about the cyber threat. The adversaries who are targeting these individuals and reaching into our communities have definitely become more sophisticated. The tools and techniques that they use are more sophisticated. As people who have been in Syria return to the UK, although we will try to manage the situation as effectively as we can, we will need to be alert to that possibility as well.

We understand some of the trends, so we can give a pretty good answer to the “what”. It is harder to give an answer to the “why”, and that is probably a matter as much for academic research as for our own analysis.

Q17 Theresa Villiers MP: You have slightly anticipated my next question. It has come across very strongly from a number of your answers today that one thing that has changed is that people are becoming radicalised more quickly than previously, so it would be really useful to understand what you and your team, and the Government, are doing to try to understand that as a means of addressing and countering it in future.

Mr Mark Sedwill: We are exactly trying to understand that. Let me give you an example. You will recall the high-profile case of the schoolgirls from Bethnal Green who went out to Syria. They were young women who had shown no evidence to close friends or family of being radicalised, and suddenly off they went. It turned out that within an essentially private space they had been radicalised and had been able to conceal that from people who knew them, such as school friends.

That was a new phenomenon, and we have been working to understand that. It was partly that that led to the Prevent duty. You will recall that that was fairly controversial legislation that, for several million public servants, extended to this area the duty to report, just as they would report another vulnerability—for example, if they believed a child was being subject to physical or sexual abuse in the home. It requires teachers, for example, to report if they observe the kind of behaviour that leads them to believe that a vulnerable young person is at risk of being radicalised.

I have seen quite a lot of Prevent casework. Some members of the Committee will be familiar with the Channel programme, which I have seen in operation. It is often focused on quite young people and a whole range of interventions—most of them from social actors, the third sector, charities, et cetera—in order to deal with that threat. We are trying to ensure that those programmes are triggered as early as possible and to learn from the experience of others. I would not wish to characterise it as “me and my team”, except in the sense that the national security community as a whole is that. This is an area that the Home Office, DCLG, the devolved Administrations and of course the Security Service and the police are looking very carefully at.

Q18 Theresa Villiers MP: Thank you. To move on to my last question, now that Daesh has lost most of its territory, which threat do you believe is the greatest: returning fighters or people who have stayed at home but find themselves inspired by Daesh propaganda online?

Mr Mark Sedwill: To be honest, I am not sure that I would want to say which one is greater, as both are a threat. We probably have more control points over returning fighters. Many would come from Turkey and we have a very strong relationship with the Turkish authorities. We have been able to bring people home—if they have to come home—under control, although we want to try to stop them, and if they have dual nationality we might remove that. We probably have more control points, including at our borders, on people returning home, as long as we have intelligence about them.

As to the nature of domestic radicalisation and people who are radicalised online, I recommend the Anderson report, which is not long, to those who have not read it. The report sets out how it is possible for people to hide in plain sight, having been radicalised online. It is even more challenging for the police and other authorities to be aware of that threat and then to put the right set of interventions in place. The kinds of changes that I have talked about—those already in place, such as the Prevent duty, and those that are coming up as we approach the Anderson review—are designed to deal with those threats.

Theresa Villiers MP: Do the Defence Secretary’s recent statements about our approach to returning fighters signal a formal change of approach in the Government’s security policy, or were they more just general commentary?

Mr Mark Sedwill: They do not signal a formal change of approach. As you will be aware, there have been occasions when we have had to take lethal strikes in theatre and when that has been the appropriate thing to do. In some cases, if people have dual nationality, we will seek to remove that nationality so that they cannot return to the UK and present a threat. Other people we will bring back under control and they will either face a criminal justice process or potentially TPIMs or other executive measures of that kind, depending on what is appropriate to the individual case. There is that full suite of interventions. The Defence Secretary is absolutely right that among those interventions are lethal strikes when that is necessary.

Theresa Villiers MP: Okay, but the Defence Secretary’s statements envisaged a greater use of drone strikes than previously was the case.

Mr Mark Sedwill: They are used when appropriate.

Q19 Baroness Healy of Primrose Hill: In light of the 2017 attacks, how is the capability review taking into account the recommendations recently identified by MI5 and CT policing for improving counterterrorism operations? Is Prevent also part of that strategy?

Mr Mark Sedwill: This is one of the dozen or so projects in the capability review. Essentially, as we were just discussing, these lessons will be accounted for in the counterterrorism project, the Contest 3.0 project.

Baroness Healy of Primrose Hill: Will the capability review be delayed as a result of having to do that?

Mr Mark Sedwill: I do not anticipate that, no. The work is in hand. The Anderson review has reported on the timeline that we expected and the Contest work is ongoing, but there is no delay.

Baroness Healy of Primrose Hill: Is the money that you mentioned which has just been announced—the additional £50 million—part of assisting this process?

Mr Mark Sedwill: The Home Secretary will set that out in more detail on the Floor of the House of Commons when she announces the police funding settlement, which I believe she is doing tomorrow or on Wednesday—this week, anyway. The £50 million that she and the Chancellor set out at the weekend is to deal with the capacity issue that the police have faced this year and next year in dealing with the increase in operational activity dealing with immediate threat. That is related to but somewhat separate from the changes in process and the broadening out of the involvement of other parts of government that will come through as a result of the Anderson review and as part of the overall Contest 3.0.

Baroness Healy of Primrose Hill: Do you see one of your main responsibilities as trying to ensure co-ordination between all these different groups? Is that one of the lessons?

Mr Mark Sedwill: That is a function that I probably would say was my responsibility when I was at the Home Office, trying to pull together all the homeland security actors. Again, if I compare us to other countries, the co-operation that we see between our intelligence agencies, between the intelligence agencies and the police and increasingly between those security actors and the wider social policy community stands comparison with what is happening anywhere. I think that most countries would look to us, particularly with regard to the Prevent programme and the involvement of schools, social security and other social policy actors in our counterterrorism work. Most other countries have nothing comparable to the kind of liaison that we have. Of course we can always work on improving that. We need to make sure that the data flows and the expertise are at the optimum level, which is part of what the Anderson review and the lessons of the Anderson review talk about.

Q20 Lord Trimble: You said that the threat that we face has intensified and diversified. I refer you to the threat from Russia, which the Foreign Secretary recently said was at a higher level than has been the case for decades. Could you talk to us about that, particularly the phrase “modern deterrence”? To what extent is that about involving a diversification and intensification of our efforts?

I also draw your attention to the recent statement by Robert Hannigan, the former head of GCHQ, that the United Kingdom had underestimated “Russia’s ability and intent to use unconventional methods”.

Mr Mark Sedwill: This is something that all western democracies have faced. We saw a mixture of propaganda and cyberattacks in the French election, for example, and there are other high-profile cases of that kind. If we take that as an example, it was quite clear that it was not aimed to change the result—there was no way that any intervention from outside could have shifted the overall result of a 2:1 election victory—but it clearly was designed to undermine the citizens’ trust in their systems.

We see quite a lot of that elsewhere. We have seen fake news, to use the fashionable term, or propaganda, to use an old-fashioned one, seeking to undermine public support in the Baltics for the Enhanced Forward Presence, including the British Enhanced Forward Presence. There are stories about the conduct of soldiers and so on, all of which are untrue and are designed to undermine support. They are clearly on this agenda, and, as I said, while we recognised in 2015 the nature of that threat, it has intensified at pace and at a greater pace than was anticipated then.

Modern deterrence is one area of the capability review that we are looking at—the general approach that we take to being able to deploy all our capabilities both in response to threats and to exploit opportunities. If we think about the Russian example, let us say that we are hit with a cyber and propaganda attack, probably a deniable one, maybe from a non-state actor of whom the Russians will disavow all knowledge, even if it was on their behalf. The correct response might not be in the same area of operation; the correct response might be to push back or disrupt in an entirely different area where we are exploiting our strengths and their weaknesses. You will understand that I do not want to go into too much detail on that in a public session, but read your Sun Tzu: you fight on the ground of your choosing, if you can, rather than the opponent’s. Modern deterrence means being able to deploy a range of different capabilities that exploit our adversaries’ vulnerabilities, not necessarily to respond in an area where they have sought to exploit ours.

Lord Trimble: One thing that we would want to do as well is to minimise our vulnerabilities and, to use an old-fashioned term, subversion. Are we looking to see the extent to which foreign state actors, particularly Russian but maybe others, are simply trying to subvert our institutions and our way of doing things?

Mr Mark Sedwill: Yes, we are. We have a strategy that sits under the rubric of national security—that is, our national security strategy for hostile state activity and cyber—and it is designed to do just that.

Tom Tugendhat MP: On the question of subversion, I do not know whether you have read the works of people like the Guardian journalist Luke Harding or Oliver Bullough, who is a freelance journalist, on the various elements of state-sponsored corruption of British institutions, including finance and economic output. We are seeing a noticeable increase in levels of corruption in British organisations that is not exclusive to economic output. It includes things like political parties. Have you diverted resources away from other elements of MI5’s responsibilities and towards what might be seen as the rather more fundamental elements of British state security?

Mr Mark Sedwill: You will understand that I am not going to comment, particularly in a public evidence session, on the allocation of MI5 resources. You know the reasons for that. But I probably can say that MI5 is well aware of the risk and acts accordingly.

Q21 Baroness Henig: Perhaps this question is a bit old-fashioned, but I want to ask about expertise. During the Cold War, we had a lot of expertise in Britain in relation to Russia, and that was the case until quite recently. I have a sense that that expertise has been lost and that now we seem to have a much dimmer view of what is happening in Russia. Do you agree with that? If we have lost expertise, and I have a sense that that is the case not just in relation to Russia but to other countries, what are we doing to try to build it back up again?

Mr Mark Sedwill: I do not know that that is right, although I often hear it. For example, if I look at the run of ambassadors in Russia, we have deep Russia experts who have done the job one after the other and there is a sort of succession pipeline for them. I just use that as a proxy. There is clearly an overall capacity issue. When we faced essentially what was a single, existential external threat during the Cold War, we had a great deal of expertise on that, while of course the internal threat came from Northern Ireland in the form of republican terrorism. A lot of resources were devoted to both of those. We now have a lot of resources devoted to dealing with international terrorism of the kind we have just discussed. That has sometimes been exaggerated in the public debate. There has always been a balance between these things across government and across the security and intelligence agencies, and they have sought to maintain that diverse expertise. But there is always an adjustment between different areas.

Q22 Tom Tugendhat MP: Given your position as principal strategic adviser to the Government, where do you see the greatest strategic threat to the British nation? Is it from terrorism or from subversion led by state actors?

Mr Mark Sedwill: I genuinely do not think that it is an either/or.

Tom Tugendhat MP: No, indeed, but which is greater?

Mr Mark Sedwill: It’s a threat to what, I guess would be the question.

Tom Tugendhat MP: The nation state.

Mr Mark Sedwill: Of course, Russia and a strategic threat of that kind from a nuclear state has a significant strategic effect for us, but given the capabilities that we and our allies have, it is unlikely that that threat will manifest itself except in the ways that we are already seeing—essentially below the level of military conflict. However, we face an acute threat that is killing British citizens both at home and overseas from terrorists. I do not think that one can say that one is more than the other. They are different and we need to address both.

Tom Tugendhat MP: May I press you a little? I have asked you about the threat to the nation state, because we are seeing through subversion, and through what you refer to as propaganda, which is a fair use of the term, institutions such as NATO, which we have grown to trust for our security, become undermined by organisations that we see being attacked by state actors. I therefore question whether we are seeing the nation state of the United Kingdom of Great Britain and Northern Ireland being undermined by subversion by foreign state powers? Is that a greater threat to us as a nation than terrorism, damaging and painful and awful though that is?

Mr Mark Sedwill: Again, I would not characterise it in that way. To put it very simply, there is a simple way to think about risk: it is threat minus resilience. That is a simplistic way of thinking about it. If I think about the risk to this country, not only to its citizens but to the country as a whole, we have to take into account not only the nature of the threat but the nature of the country’s resilience against that threat. So yes, you are absolutely right that there are efforts to undermine NATO, to sow dissention and to undermine the confidence of the citizen in the institutions of the state, the electoral process, political parties and so on, but we should also have considerable confidence in our resilience against those threats. They have not really worked, and of course we are seeking to strengthen that resilience whether by making ourselves stronger against cyber attacks or ensuring that people understand that fake news is fake news—to put it that way.

I just do not think that one should look at this in a binary way. They are different kinds of threats. They are both national security threats, there are others, and we have to wrap the right sort of capabilities around them and improve our resilience against them.

Lord Brennan: Listening carefully to your answers gives an impression of a role for analysis, assessment and co-ordination, but here we are talking about a threat to the state from other states. Who is to give direction and leadership to counter such a threat? Is it you or the council, and, if not, who?

Mr Mark Sedwill: The National Security Council—is the short answer. We bring those issues to the council, because it requires collective effort. The council will give direction, and part of my job is to ensure that the council’s direction is implemented across government.

Q23 Dr Julian Lewis MP: We have seen a story in the media today about the CIA having assisted Russia to thwart an Islamist terrorist attack. Can we take it for granted that despite our adversarial relationship with Russia at the moment, if we had similar information we would do likewise? Does that not open up possibilities for co-operation with countries that we may have to stand up to in one theatre but where we may have a common interest in another?

Mr Mark Sedwill: The short answer is yes to both. You will be well aware of the Litvinenko measures that we put in place, but we carved out an area of operational liaison with the Russians in the run-up to the Sochi Olympics, for example, in order to ensure that we would pass on information not only about threats to their citizens but, of course, about threats to ours. So you are right that there are limited exchanges on this and we would expect them to do the same.

Whether that leads to broader co-operation—you will be aware that the Foreign Secretary is going to Russia—goes to the whole question of the overall stance, which, to use the Prime Minister’s words, is “engage but beware”. We have to be cognisant of the Litvinenko measures. We are not returning to business as usual with Russia, but there are some limited areas of co-operation which it is in our interests as well as theirs to pursue, and you have highlighted a very important one.

Q24 Baroness Henig: Returning to Brexit and the impact of Brexit, what do the Government need to do to reassure friends and allies in the EU that the UK remains committed to common security, because obviously it is going to be another area to worry about?

Mr Mark Sedwill: In a sense, the simplest thing to say is that we have already done so but because it is in our national security interest. Please forgive the sporting metaphor, but goal-line defence is not a very effective way of dealing with the kind of security threats that we face. If we think about the threats that we have been discussing, there are spillovers from conflict and instability to Europe’s south and there is an increasingly adversarial Russia to Europe’s east. Of course, in the modern era, those threats spill over into our domestic security space as well. That is true for all of us, and it is in our interests that security and defence on the European continent is as effective as possible.

As you know, the Prime Minister has spoken in several speeches about a deep and special partnership. That includes a deep and special security partnership with the EU, and we set out the British vision for that in papers published in September on internal and external security. We will now work those up into proposals for the next phase of the negotiations.

Finally, it is important to remember that European security and defence is not just about our co-operation with the EU. NATO is the other big institutional pillar. There is a range of other multilateral groups that we support, some of which exist between those two big institutions, or on their baselines. Of course, there are bilateral relationships as well, notably in the defence area with France. Since the Lancaster House treaty we have deepened our defence co-operation with France extensively.

Baroness Henig: What are the top priorities in the next few months?

Mr Mark Sedwill: Essentially, they are what we have been discussing. These are common threats that we face. We have intense operational co-operation with our European partners against the terrorist threat, and have supported several—this is a different example of the point Dr Lewis was just making—in defeating terrorist threats in their own territory because of information that we have, and we will want to continue to do that, largely but not exclusively through NATO. So it is important that we continue to modernise NATO, its capabilities and ability to deal particularly with the state-based threat, and Russia in a more adversarial mode.

On the nature of the co-operation, particularly in the EU, there will be lots of elements, particularly on the internal security side, which we set out in our paper, that we will want to find ways of continuing, whether that is data-sharing, various mutual recognition arrangements, operational co-operation, and so on. As I said, our vision is of a very close partnership, on security in particular but also on defence and foreign policy, once we have left.

Baroness Henig: So obviously one has to wait to see how that will work out.

Mr Mark Sedwill: Indeed.

Q25 Baroness Henig: In a way, that feeds into my next question. How many conclusions of the capability review are likely to be provisional until one knows the terms of the withdrawal from the EU?

Mr Mark Sedwill: I would hope none. I hope that the position that we have set out in the two security papers, internal and external, that we published in the early autumn—our proposition, if you like, to our EU friends and partners—will be accepted and then form the basis of the future partnership. It essentially on that basis that we are proceeding. We have good grounds to believe that that is the case. They were both well received, even at the time. Certainly, when I used to talk to my European counterparts in what they would call the Interior Ministry, I had exactly the same response.

We have to find a way through this and ensure that we maintain the channels of operational co-operation that are essential to our common security. Of course, we do not know how the negotiations will go. There will be significant challenges along the way—nobody is underestimating that—but there is a strong desire, not only this side of the Channel but on the other side, to see this area of work come to a productive conclusion. The Prime Minister has been in the House talking about the European Council just this afternoon, and that has been central to her vision of the future partnership since we first decided to leave.

Q26 Lord Hamilton of Epsom: I was on this Committee for quite a bit of the last Parliament, and rather late in the day I discovered that we were answerable to Parliament for the whole Conflict, Stability and Security Fund. If you are answerable to Parliament for money being spent, as a Committee you have to have some idea of how it is being spent. So we started at the thin end and said, “Perhaps you could tell us what countries it is being spent in”. “No”, was the answer, “that’s a secret. We might upset some of the countries where it is being spent it if were known that it was being spent there, and we might upset other countries that are not having any money spent on them”. So we do not even know officially what countries the money is being spent in, although, let us be honest, the names of a very large number of them are in the public domain anyway.

We then said, “Can we be told how it’s being spent?” That was an even bigger secret than where it was being spent. How can we be answerable to Parliament for the spending of all this money if we have absolutely no idea where it is being spent, or indeed how it is being spent?

Mr Mark Sedwill: I am slightly confused about the point about being answerable to Parliament, because I kind of feel that you are Parliament and I am answerable to you, but there is a whole range of parliamentary etiquette that is perhaps outside my area of knowledge.

On the substance of your question, it is clearly right, on whatever basis, that you have the right insight into the cross-government funds—in this case, the CSSF—in order for you to be able to hold me and others accountable for their expenditure. We have improved the transparency; we have just published the first annual report into the CSSF, and there is a great deal of material in there, including on some of the questions that you just raised.

Some areas are not mentioned in that report which we are keeping secret. That is not the vast majority, but there are some areas that we think should remain secret. We can probably find a way—I think it has been done in the past in other areas—of providing the Committee with a confidential briefing in camera in some way to help you to understand some of them.

As I say, we have just published an annual review, and a lot more material than before is now in the public domain about those funds.

Lord Hamilton of Epsom: For us to act as an effective Committee, surely we should be security-cleared so that we can be given rather more of this information than we get now.

Mr Mark Sedwill: At least if we are operating in private, there is a great deal of information that we can share with you. I am not aware that the levels of clearance of individual Members has been an issue, but I had better take that away if it has.

Lord Hamilton of Epsom: We went for a briefing in the Cabinet Office and we went through the usual two levels of security in the system. When we got there we asked what the classification was for this Committee and we were told that it was below secret, so there did not seem to be an awful lot of point in being there and going to all these lengths to find our way over the Cabinet Office when the people briefing us could have come here and told us all these rather banal things that were in the public domain anyway.

Mr Mark Sedwill: Was that feedback on the last two hours, Lord Hamilton?

The Chair: No.

Mr Mark Sedwill: I hope not. I take the point entirely. We need to find ways of briefing you in confidence in this forum but without the cameras on so that we are not in public, and there will be some element on which it may be appropriate to brief you in the Cabinet Office or in a more secure environment. I am not familiar with the exact sequence of events that you have mentioned, so let me take it away and I will come back to you on it. Perhaps we can talk to the clerks and the Chair to work out the modalities.

Q27 Tom Tugendhat MP: A very final question, if I may: what does global Britain mean to you?

Mr Mark Sedwill: Three things, I think.

First, it means investing and reinvesting in big partnerships, big relationships, around the world as we try to make the most of the opportunities of Brexit, with core allies and old friends in places such as the Gulf and south Asia, and investing in new partnerships in, for example, east Asia.

Secondly, it means strengthening our support for the rules-based international system, which has worked extremely well in our favour for the past 70 years, and I do not just mean on the defence side, and which will probably become more important in the 21st century as the geopolitics becomes more contested. We have a significant role to play in that.

Thirdly, it is our image, our influence—I think the Foreign Secretary sometimes uses the phrase “our prestige”—our soft power around the world, the GREAT campaign. One of the assets that we should think about, even if it is not a deployable national security asset, is some of the remarkable international NGOs that we have based here, such as Oxfam, Save the Children, the HALO Trust. These are all sources of British influence and a sense of connection with this country. The British Council and the World Service are others.

That is partly how I would characterise it. I suspect that the Foreign Secretary or the Prime Minister will give speeches on it and will characterise it differently, although hopefully not so differently that it is incompatible with what I have just said.

Tom Tugendhat MP: Would I be correct in assuming that on none of the very clear three points that you just gave could you do more for less?

Mr Mark Sedwill: No, I would not say that, actually. I think we can have a greater impact than we have now without it necessarily being a resource question. I know that has been a thread through our conversation today, but having run a big department and having dealt with an awful lot of budgetary pressures in that department—I did not get the 0.5% real over the time I was there—the Government can do a great deal achieve a greater impact with the inputs we have available to us, particularly if we pull them together and use them in a coherent way. It is not just about efficiencies. That does not mean that we should never have more resources, but if you are in my job or if you are in a job running a department, we have to make the best use of every pound of taxpayers’ money.

Lord King of Bridgwater: You have not mentioned the Commonwealth and the Five Eyes intelligence linkage, which should certainly be mentioned when it comes to our position in the world.

Mr Mark Sedwill: I agree with that entirely. I felt that I would be trying the patience of the Committee if I went further, and I was trying to identify some fairly big handfuls. You are absolutely right that the Commonwealth summit next year is a very important opportunity for us. Again, it goes to the question about influence and our image in the world. It shows that we are an outward-facing nation and that some of the caricatures out there of our decision to leave the EU are wrong. I would put that in the second basket of our commitment to international institutions.

Q28 Dr Julian Lewis MP: As we have a minute or two left, I will squeeze in just a couple of brief questions off my long list. Have you met with the service chiefs to discuss the review? What defence expertise do you have within the National Security Secretariat? Lastly, given that out of, I believe, 12 strands in the review, at least four—defence, modern deterrence, nuclear proliferation and strategic communications—are strongly defence-related, why have you stated previously in our correspondence that because the main decisions on defence were taken in 2015, this review is not defence-focused? Surely this review has huge implications for defence.

Mr Mark Sedwill: The point I was trying to make was that it was a broad-based review looking at a whole range of different capabilities not only across defence but the Home Office, the Foreign Office, development, the security and intelligence agencies and, as you rightly say, strategic communications. By the way, nuclear proliferation is not one of the dozen projects; it is dealt with separately. We will report on the list as we report on the review itself.

I cannot remember exactly how many, but I have had a large number of meetings with the top of the MoD in different formats. I have had one-to-ones with several of the service chiefs and I have a couple more to come. As I have said to you before, Dr Lewis, the defence project within the review is being led by the MoD. Our job is to try to pull that together into the overall capability review to make sure that all the various pieces fit together. It is a small team, but I have expertise, including people from the Ministry of Defence, working on this for me, and several departments, including the MoD, have seconded people into the review team in order to ensure that we have the right connections.

Q29 Lord Hamilton of Epsom: Should not one of our Brexit ambitions be to lead European NATO?

Mr Mark Sedwill: I think we probably do that already, but it is a good objective for us to have. In securing for Air Chief Marshal Sir Stuart Peach the chairmanship of the Military Committee of NATO, I think we have shown that we are able to secure a leadership role within the alliance. Of course, leadership is about much more than jobs; it is about the agenda. We have led the 2% campaign within Europe. That commitment was made at the Wales summit and it is one that we continue to press other NATO countries to fulfil.

We generate a great deal of the thinking about the modernisation agenda and the balancing of the eastern and southern flanks, if you like, whereas many other countries are more focused on one rather than the other. We are in a good position to lead within NATO, and I absolutely agree that it is something that we should stretch our ambitions on in the future.

Q30 James Gray MP: While I entirely take your point about your job being about the whole of security and therefore not directly concerned with defence, you make the very good point that defence is an extremely important part of what you do. Is there not therefore a strong argument that in addition to this Committee you ought to make an appearance in front of the Defence Select Committee? Surely it would have a keen interest in what you have to say about the risks and the changes. Surely an appearance before the Defence Select Committee would make a great deal of sense.

Mr Mark Sedwill: I was hoping not to have to answer that question.

James Gray MP: That is why I have asked it.

Mr Mark Sedwill: Indeed. I know that time is short, but perhaps I may make two points. First, please accept that this is not about my personal willingness to appear before parliamentary committees. I appeared before a lot in my last job. I used to go before the Home Affairs Committee about three times a year on a regular basis and I am very happy to do the same with this Committee if that would suit its needs. Further, I would appear at shorter notice if there was an emerging issue and the Home Secretary felt that it should be me rather than a Minister to appear—not to mention I do not know how many Public Accounts Committee hearings. So clearly it is not about my personal appetite for appearing before the Defence Select Committee.

The Prime Minister set out the position in a letter to Dr Lewis and it relates to the Osmotherly Rules. As an official, I appear on behalf of Ministers. Except for accounting officers with the PAC, as officials we appear on behalf of Ministers and with their consent. As a Cabinet Office official, my Minister is the Prime Minister. In her view and in the Government’s view, the appropriate officials to appear before departmental committees are mostly those from the committees themselves.

There are precedents, as Dr Lewis will no doubt point out, where my predecessors have appeared before the Defence Committee. There are also precedents where Prime Ministers have refused to allow national security advisers to appear before committees. In the end, at least the convention has been that it is a decision that Ministers take whether and when officials appear before departmental committees. My own view, and I think the Prime Minister’s view, is that because my job is cross-cutting, a cross-cutting committee feels like the more natural point for scrutiny.

James Gray MP: So if the Prime Minister were to take a different view from that in front of the Liaison Committee, presumably you would then be quite content to appear before the Defence Committee.

Mr Mark Sedwill: I serve at the pleasure of the Prime Minister. Just to be clear, this is a government position. The Osmotherly Rules were carefully negotiated so that officials appear on behalf of Ministers and with their consent, and that in most circumstances departmental Ministers and their Permanent Secretaries are the appropriate people to appear before departmental committees in most circumstances.

The Chair: Thank you for the time you have spent with us and the answers you have given. I want to place just one thing on the record. I want to refer to something that Lord Hamilton touched on. I understand completely what I would call the creative tension between Select Committees and government, but it has been a long-running concern of this Committee, ever since it was first set up, that there is insufficient access and insufficient mutual confidence. I am very mindful of the way in which the ISC, for example, started off under Lord King’s chairmanship and where it is now.

My ambition for this Committee is that we should end up, not perhaps in the same place as the ISC, which is different, but in a position where there is much more sharing of information and mutual confidence than there is now. So I am grateful to you for your remarks about being prepared to consider some of that, and we would like you to do so. For example, there was concern because the secretariat could not tell us what areas of policy are being covered under the capability review. There are constant little pinpricks like that where there is a feeling of, “Oh no, we do not intend to share that with you. We don’t intend to tell you anything”. As I say, I think it would be to our mutual benefit to look afresh at all this and see what we can do to work together in the future. I will leave that helpful thought with you, and thank you again.

Mr Mark Sedwill: Thank you for the session. I remain at your disposal and I will pick that point up. Perhaps I will revert to you and to the clerks before my next hearing.