The Russia report tells us that intelligence oversight in the UK is at risk

The UK’s independent parliamentary oversight committee for intelligence and security (ISC) finally published its Russia report last Tuesday, ten months after it was completed and sent to the government for clearance. The report reads as a pointed rebuke of the failure of successive British governments to recognise and address the complexity and significance of the Russian threat to the UK. It highlights failures in strategy, inter-departmental coordination, and the political will to address the variety of threats posed by Russian cyber operations, electoral disruption and disinformation, and the potentially corrosive impact of Russian money and influence on the economic and political life of the UK, particularly its capital, London.

The report had become controversial long before its publication. The government’s failure to clear the report for publication before the December 2019 general election became a sensitive topic during the campaign. To the government’s critics, this signified a lack of respect for the independent oversight process, a self-interested effort to evade damaging headlines ahead of the election, or both.

In the wake of the report’s publication, prime minister Boris Johnson alleged an ulterior motive for criticism of the government’s Russia policy, namely opposition to his effort to fulfil the 2016 referendum vote for Britain to leave the European Union (the so-called ‘Brexit’). Notwithstanding the implausibility of this deflection, the substantive impact of the Russia report risks being undermined by the wider political controversy surrounding its delay and associated tensions between government and the committee.

The perception that the government was undermining the ISC’s ability to operate was exacerbated by the long delay in reconvening the committee after the election. The ISC – the only legislative oversight committee with responsibility for scrutinising the UK intelligence and security agencies – was not in place until two weeks ago, more than nine months since its last meeting before the December 2019 election. Nine months in which the UK intelligence community was not subject to oversight by any legislative committee.

The process for selecting the ISC is opaque. Its nine members are put forward by the prime minister. Five members are elected legislators from the governing Conservative party; three are elected opposition legislators; and one is a peer from the unelected second chamber, the House of Lords. Whilst the prime minister chooses the members, opposition members are selected in consultation with the leaders of their parties, and all prospective members are subject to pre-appointment security vetting.

No-one knows why exactly it took so long to get the ISC back into business, although previous post-election re-starts had also been protracted. It might have been foot-dragging by the parties in nominating their members; it might have been procedural issues in the vetting process; it might simply have been that no-one saw it as a priority to try to move faster.

The result, however, was emphatic: no legislative oversight of intelligence and security for the first half of 2020. And, because the committee had to be reconstituted first, none of the reports completed by its previous incarnation could be published in the meantime. Hence both the Russia report and the most recent annual report on the ISC’s work (2018-19) were only published last week.

There were sporadic press reports and some frustrated commentary during the hiatus between the election and the committee’s re-emergence. One of the most prominent stories, however, indicated that the government had a preferred candidate to become the committee’s chairman. The allegedly preferred candidate, former cabinet minister Chris Grayling, is something of a satirical punchline whose ministerial career was marked by a reverse-Midas touch.

Under the provisions of the act defining its creation, remit and powers, the committee elects its own chair. In effect, the stories about Grayling’s ascendancy implied that the governing party’s members were being parachuted into the committee with a direct instruction to appoint the government’s favoured candidate as chair. What actually happened, however, added a further farcical footnote to Grayling’s political career. One of the Conservative members of the committee, Dr Julian Lewis – as a former chairman of the parliamentary Defence committee, a better qualified prospective ISC chair – broke ranks with the other Conservatives and secured the support of opposition members to win the chair. Signalling that the government hadn’t anticipated or wanted this outcome, it promptly ‘removed the whip’ from Lewis – a quaint expression for kicking him out of the parliamentary party, making him an independent.

This is the fraught political context in which the Russia report was published. The report addresses the nature of the Russian threat to the UK and the UK government’s response to that threat. There were, however, no bombshell revelations to be found in its pages. It is not that the report contains no criticism of the government’s response to the threat. The report is a severe judgement on the failure of successive governments to recognise and effectively counter the complexity and significance of the Russian threat.

These criticisms are not, however, aimed most pointedly at Johnson’s government. They apply most robustly to an earlier period, between the murder of Alexander Litvinenko in 2006 and the invasion of Ukraine in 2014. The criticism is that, whilst the relative prioritisation of countering the Russian threat might have been legitimately affected during an era of counterterrorism and counterinsurgency operations, insufficient resources and focus were dedicated to it during this period.

Furthermore, the ISC’s contemporary criticisms focus on the official rather than the political side of the executive, concluding that efforts to counter the Russian threat are too narrowly focused; inter-agency coordination is sub-optimal; and new legislation is needed for the UK intelligence community to effectively counter a complex threat involving espionage, illicit finance and other enablers of hostile activity.

The report describes itself as the outcome of ‘a major Inquiry, spanning a number of evidence sessions with a broad range of witnesses over the course of eight months, in addition to a substantial volume of written evidence.’ However, the report lists only five witnesses from outside of government. Each of these outsiders is publicly notable – including Anne Applebaum, Bill Browder, and a former UK intelligence officer who might be familiar to US readers, Christopher Steele. Collectively, however, these outsiders hardly comprise a broad cross-section of views on the various overlapping aspects of the inquiry’s remit.

The committee also took evidence from three ministerial witnesses and nine senior officials, as well as an unspecified number of more junior officials. If this is the totality of witnesses called to give evidence to the inquiry (and given that so much of the report is redacted or presumably contained in the classified annex, it is perhaps necessary to reserve judgement on this question), then the committee’s definition of a ‘major’ inquiry arguably requires some improvement. This might reflect a lack of secretariat capacity or investigative powers to undertake more extensive inquiries, or a lack of ambition from the previous committee’s members. It may surprise US readers, used to more significant staffing of congressional oversight committees, but the ISC’s 2018-19 annual report states that the committee has only 10 full-time staff. A review of its secretariat arrangements might be a good place for the new committee under Dr Lewis to start, if it wants to intensify the rigour of future inquiries.

The Russia Report is not revelatory and largely summarises threats familiar to readers from information already in the public domain. It mentions the Russian cyber threat to critical infrastructure, implying in one section (punctuated with redactions) that Russian cyber pre-positioning operations had been observed in unspecified parts of UK infrastructure. This is not a new revelation. Nor is it confined to the UK, given reporting about similar threats to US critical infrastructure, or the destructive cyber attacks on Ukrainian infrastructure.

Moreover, given reported US cyber pre-positioning on Russian infrastructure and the assertive turn in US offensive cyber operations under the Trump administration, involving both Cyber Command and the Central Intelligence Agency, it is possible to conclude that these activities have simply become, for the foreseeable future, an integral feature of adversarial relationships between states with the cyber capabilities to exploit vulnerabilities in critical infrastructure. As the UK moves (slowly) towards its goal of a national cyber force with 2000 personnel, it is to be hoped that the ISC and other committees return to this issue in greater depth.

In another echo of US experience, the committee explored the potential vulnerability of UK democracy to disinformation and operations to disrupt or pervert the course of election campaigns. Arguably the report’s most damaging claim is that the government appears not to have tried hard enough to determine whether UK elections had been adversely affected by Russian interference. The report rightly draws an explicit comparison between this omission and the public assessment of Russian interference in the 2016 US presidential election published by the US intelligence community.

Whilst the government’s response to the ISC report highlights routine lines of intelligence collection and analysis that would raise the alarm, this is not the same thing as a dedicated review and commitment to publish its results. The ISC report also highlights the vulnerability of London as a location and instrument of Russian influence. As a former two-term Mayor of London during this period, prime minister Boris Johnson might reasonably be expected to have a principled desire to shine a brighter light on this issue as part of such an inquiry.

The brief section on ‘Russian Expatriates’ in the UK is another politically-sensitive part of the report, focusing as it does on the extent to which wealthy individuals with connections to the Russian government have been able to invest and build influence within the UK over the last 25 years.

The overall conclusion of this section is that the UK government was slow to recognise and respond to this threat, but that recent efforts have indicated that it is improving its approach, particularly to the investigation of serious organised crime. The committee recommends that more should be done in this area, as well as in mitigating the potentially adverse impact of Russian influence on UK politics, eg in the transparency of Russian business connections to UK parliamentarians, several of whom hold positions on the boards of Russian companies. Perhaps there are highly damaging revelations about such connections that might appear in future, but they are not the subject of this report.

The committee’s report describes Russian state decision-making as a centralised, secretive and swift process, presenting a challenge for the slower and more cumbersome decision-making processes of liberal democracies like the UK. The report also notes briefly that covert action against Russia would be fraught with risk, particularly in light of paranoia in Moscow about Western intentions and the relative lack of bilateral engagement at a senior political level, creating opportunities for misunderstanding and overreaction.

Redactions obscure the details here, but the committee appears to have been surprised by the relatively small proportion of operational effort dedicated by the UK intelligence community to covert action and effects, rather than to intelligence collection. This prioritisation was reportedly partly motivated by the agencies’ focus on what will most reliably contribute to achieving the objectives of the government’s Russia strategy, and partly by concern about ‘the need to tread carefully so as not to provoke unexpected escalation.’

This is a revealing observation about a British strategy for countering the Russian threat that appears to be as cautious and careful about controlling the risk of escalation as its adversary appears to be aggressive and reckless. The ISC is complimentary about the UK’s diplomatic response to the 2018 Skripal attack, after which the UK and its allies coordinated the expulsion of 153 Russian spies and diplomats – albeit with President Trump reportedly angry with aides when he realised that the US had expelled more than any other state.

The ISC is similarly approving of the UK and allied turn towards publicly attributing Russian responsibility for cyber attacks, a development that has continued in the 10 months since the ISC concluded its report, with public attributions this year of Russian cyber operations against the former Soviet state of Georgia (in late 2019) and more recently against targets associated with coronavirus vaccine development.

What is missing, however, is an attempt to assess the overall effectiveness of this strategy. This is not a criticism of the ISC: such an assessment falls outside its remit. But the various strands of activity incorporated within the UK’s Russia strategy should ultimately be assessed according to their ability to deter Russia from hostile activity in the UK. Like most other areas of British foreign policy, this cannot easily be disaggregated from analysis of the US strategy for countering Russia has been in recent years. As the only legislative oversight committee with a remit to explore the work of UK intelligence and security agencies, the ISC has an important role to play in contributing to this strand of such a wider assessment.

Unaddressed by the Russia report is the question whether the UK is still regarded as a soft target, whether for political manipulation or assassinations. The ISC report refers to the UK’s concern to reduce the risk of escalation. This indicates a significant asymmetry in risk appetite between UK and Russian decision-makers. It is at least arguable that the UK should consider increasing its risk appetite and identifying areas to impose higher costs if it is to effectively deter hostile activity in future.

Expulsion of intelligence officers, public attribution of cyber operations, and the imposition of targeted sanctions might each have their place in a wider strategy. But the reported absence or surprisingly small contribution of more punitive, covert responses as part of that strategy, suggests that too little may have changed since the Skripal attack in 2018.

And if the UK is to adopt a more robust response to the Russian threat, it will be all the more important for legislative oversight of these activities to be strengthened, for the intelligence community to provide more extensive cooperation with the ISC than the committee felt it had received in its Russia inquiries, and for the Johnson government to demonstrate a greater respect for the integrity of the ISC’s independence than it has in its handling of the committee’s post-election reconstitution and the election of its chair. As it stands, there are currently few grounds for optimism on any of these counts.

Dr Joe Devanny is a Lecturer in the Department of War Studies, and deputy director of the Centre for Defence Studies, King’s College London. He writes here in a personal capacity.