Last August, Jaguar Land Rover (JLR), Britain’s biggest car manufacturer, was hit by a cyber attack that forced it to shut down its IT systems and halted production for more than five weeks. At the time, three groups of English-speaking hackers going by the names of Scattered Spider, Lapsus$ and ShinyHunters claimed joint responsibility for the attack – believed to be the most costly in British history. Hackers from Scattered Spider had already been linked to attacks on M&S, Co-op and Harrods last year. But were they really responsible for targeting JLR too?
Over the weekend, video footage emerged in which the former defence minister Al Carns was filmed stating that ‘we know that the Jaguar Land Rover attack was state-sponsored’. Carns was speaking at an event hosted by the think tank Chatham House in July, just weeks after his resignation over the funding of Keir Starmer’s Defence Investment Plan. While he didn’t elaborate at the time on which state he believed to be responsible, he subsequently stated this weekend that ‘it would be highly unlikely for an attack of that scale to emanate from anywhere without the host state knowing about it’. This was not, he clarified, based on any official assessments by the Ministry of Defence.
Does the Foreign Secretary believe that Russia was responsible in some way for the cyber attack on JLR?
Carns’s comments mark the first acknowledgement by a government official that a hostile foreign state may have been responsible for the attack last August. JLR employs approximately 34,000 people in Britain; thanks to its far-reaching supply chains, the company’s five-week shutdown after the cyber attack is believed to have affected more 5,000 organisations. The Cyber Monitoring Centre estimates that the attack caused an estimated £1.9 billion in damage to the UK economy, with the government backing a loan to JLR worth £1.5 billion ‘in the national interest’ to help its recovery.
One of the key indicators suggesting that Scattered Spider, Lapsus$ and ShinyHunters may not be – at the very least solely – actually be responsible for the cyber attack on JLR is the fact that no ransom was ever demanded while the attack was ongoing. This suggests that, in targeting a company of JLR’s size, the motive may have been sabotage rather than financial.
Pressure has been mounting on the government this week to confirm if the cyber attack on JLR was state-sanctioned and if so by whom. Prompted on the subject by shadow defence minister David Reed in the Commons yesterday, Foreign Secretary Ed Miliband gave a somewhat cryptic response, stating that he ‘wouldn’t get into the details of that attack’. He continued, however: ‘We are absolutely happy to name those who are engaging in this information warfare and I’ve talked an awful lot in this session about Russia and about what it is doing.’
Does the Foreign Secretary believe, then, that Russia was responsible in some way for the cyber attack on JLR? Or was this just a sloppily-worded answer from the despatch box? Pressed a little later on the same subject, security minister Dan Jarvis also dodged the question, saying he would have ‘more to say’ with the launch of the national cyber action plan later this year. Could Jarvis or his cabinet colleagues choose that, perhaps, as the moment to reveal the attack’s full attribution?
The Conservatives are calling on the government to follow the lead of other European countries in publicly confirming and naming the state they believe to be responsible for carrying out such an attack. Just last month, the German government announced that it held Russia responsible for orchestrating a series of drone attacks on Leipzig airport last August.
In the past year or so, Russia has been carrying out an increasing number of cyber attacks and other forms of so-called ‘grey zone’ acts of warfare and sabotage against European allies of Ukraine. Moscow appears to be motivated by a desire not only to sow chaos in those countries but also, as the drone attacks in Leipzig demonstrated, to actively harm them with the aim of weakening their ability to aid Ukraine. Germany and several other European countries have, in recent months, seemed more willing to take a tougher stance in calling out the Kremlin’s actions on their home soil.
The government says that it ‘does not comment on ongoing investigations or operational activity’. But it might also be the case that the British government wants to preserve its ability to escalate its response by publicly blaming Russia down the line. Critics have suggested, however, that Miliband and Jarvis’s reticence to name the state actor responsible for the JLR attack stems more from a reluctance or inability to retaliate appropriately.
Either way, it appears that the government is perhaps missing out on an opportunity by currently refusing to acknowledge that a state actor may have been responsible for the cyber attack. This week marks the launch of the government’s ‘Be Ready’ campaign, urging the public to stock up on emergency provisions in the event of, among other things, cyber attacks or supply chain issues ‘caused by hostile state actors or terrorists’. Shadow defence minister David Reed told The Spectator:
The government cannot expect the British public to prepare for threats while keeping them in the dark about the threats we actually face. If hostile states are attacking British industry, ministers must level with the public. People deserve to know what they are preparing for and why.
Indeed, just last week Defence Secretary Wes Streeting said the public should be ‘prepared for increasingly sophisticated cyber attacks on our businesses’. Publicly attributing responsibility for the JLR cyber attack this week would certainly have added gravity to the campaign and helped people understand how serious the need for resilience is – whether or not Russia is responsible.
The post Was Russia behind the Jaguar Land Rover cyber attack? appeared first on The Spectator Australia.