Encryption & Key Management , Governance & Risk Management , Next-Generation Technologies & Secure Development

Former MI5 Director Cautions: Keep Calm and Slowly Evolve

After London Attacks, Don't Rush Changes, Stella Rimington Says
Former MI5 Director Cautions: Keep Calm and Slowly Evolve
Stella Rimington opened Infosecurity Europe with a keynote presentation on lessons learned from her MI5 tenure. (Photo: Mathew Schwartz)

After a terrorist attack, people first blame the terrorists. Quickly, however, the blame game shifts to organs of the state - police and intelligence services - with questions relating to why they failed to prevent the attack. Politicians, too, are questioned about whether they have devoted enough resources to intelligence and police services.

See Also: Cyber Insurance Assessment Readiness Checklist

So said Stella Rimington, the former director of MI5, Britain's domestic intelligence agency, Tuesday at the Infosecurity Europe conference in London.

While the blame game is a fact of life, Rimington said, in the wake of any crisis, too often there's a push to "throw the whole thing up in the air" and start over.

But in a wide-ranging keynote speech - delivered just three days after the London Bridge and Borough Market attacks on Saturday - she cautioned against such moves, saying well-considered changes are the only proven way to successfully evolve.

Rimington is no stranger to terrorist attacks and other crises. She became the first woman to serve as director general of MI5 - Britain's domestic counter-intelligence and security agency, officially known as the Security Service - in 1992, and held the post until her retirement in 1996. While director general, she led the agency into taking a bigger role in the fight against Irish republican terrorism. Previously, she had also been in charge of the agency's counterterrorism and counter-subversion operations.

Reflecting on lessons learned from her tenure, Rimington said that the balance between security and privacy would inevitably shift in times of crisis, and she stressed that transparency remains key.

She also cautioned against making organizational changes to police and intelligence services without carefully thinking them through. "Change is constant; change has been going on since the dawn of time in this field," she said. "But the key thing is, it has to be carefully managed; it should not be rushed."

Unfortunately, of course, the nature of the threats that MI5 and other intelligence agencies and police services are attempting to counter also continues to change.

Following Saturday's incidents, London Metropolitan Police Commissioner Cressida Dick described recent attacks as "unprecedented" but promised that the police "will change and adapt to what appears to be a new reality for us."

Rimington offered a similar assessment, saying that today's threats "are worse and more complex and more difficult than at any time in my career." She said that includes cyber espionage "which nobody really knows effectively how to deal with."

And she cited a world of "very, very complex communications," which makes it more difficult for intelligence services to do their jobs, as well as "hideous ideologies with a determination to kill people."

Countering the IRA

In many ways, Rimington said, lessons learned from dealing with a group such as the Provisional Irish Republican Army cannot be applied to jihadists. "At least with the IRA, they had a mission, and they were anxious to not kill a lot of people," she said. IRA members hoped to plant their bombs, or shoot targets, and then escape, she noted. In addition, she said, Britain's security services had so successfully infiltrated the IRA that the group no longer had military options - only political ones, leading to the 1994 provisional IRA ceasefire. "The lesson I learned from the peace process is that it's no good trying to have a peace process until the other side, i.e. the terrorists, are ready for it."

By contrast, many jihadists have launched - and will no doubt continue to attempt to launch - suicide attacks. "As far as I understand Islamic state of whatever they call themselves, these are not people who are ready for any discussion or rational debate ... Their ideology is that they want to win, and by winning, they will kill everybody."

Rimington didn't explicitly address details related to Saturday's London Bridge attack, but she did appear to be responding to recent commentary directed at police and security services. For example, at least some of the three knife-wielding men who launched the attacks Saturday were known to police and intelligence services in Britain and abroad.

It's not possible to keep tabs on anyone who might have jihadist or terrorist leanings, Rimington said. "In a democracy, that would not be acceptable - to have a security service and police force that is so enormous that it could cope with this."

Met Police Plan Counterterrorism Shakeup

The comments from the former head of MI5 came as Britain grappled with how its intelligence and security services - as well as laws - might best evolve to counter the threat (see Britain's New Mass Surveillance Law Presages Crypto Fight).

Changes, however, are afoot. Britain's chief counterterrorism official, Mark Rowley, an assistant commissioner at London's Metropolitan Police, said in a Sunday press briefing that to counter the jihadi threat, the U.K. needs to rethink its approach to counterterrorism.

"In nine weeks, we've had five plots foiled and three successful attacks," Rowley said, the Guardian reports. "That is completely different to anything we have seen for a long time. As the prime minister has indicated, we're going to need to do some things differently."

Rowley added: "We're going to have to think again about the next iteration of our police and security service model, which has constantly had to innovate over many decades."

Prime Minister Theresa May, in her first public remarks following the Saturday attacks, placed part of the blame for the episode on "the big companies that provide internet-based services." She argued that they had been creating "safe spaces online" for extremists and their recruitment activities (see London Bridge Attack Sparks Call for 'Cyberspace Regulation').

"We need to work with allied, democratic governments to reach international agreements that regulate cyberspace to prevent the spread of extremism and terrorist planning," she said.

Existing Powers

Jim Killock, executive director of Open Rights Group, a human rights organization, says police already have extensive powers to censor online material. "Police censor extremist content from internet platforms without any need for a court order, nor with any particular oversight," he says. "Censorship lists are created and distributed to private companies. Now the government wants algorithms and machine learning to do this censorship work."

Furthermore, many security experts say that it's impossible to prevent criminals from getting their hands on - or building - encrypted communications tools or using tools offered by the "big companies that provide internet-based services" that May references. They also warn that attempting to do so could have a profound, negative impact on the safety of law-abiding citizens.

"[The] focus on 'big companies' is misleading," says Thomas Rid, a professor of war studies at King's College London, responding via Twitter to May's comments. "A range of secure comms channels will remain available to militants no matter what big firms do."

About the Author

Mathew J. Schwartz

Mathew J. Schwartz

Executive Editor, DataBreachToday & Europe, ISMG

Schwartz is an award-winning journalist with two decades of experience in magazines, newspapers and electronic media. He has covered the information security and privacy sector throughout his career. Before joining Information Security Media Group in 2014, where he now serves as the executive editor, DataBreachToday and for European news coverage, Schwartz was the information security beat reporter for InformationWeek and a frequent contributor to DarkReading, among other publications. He lives in Scotland.

Around the Network

Our website uses cookies. Cookies enable us to provide the best experience possible and help us understand how visitors use our website. By browsing bankinfosecurity.com, you agree to our use of cookies.