A former GCHQ intern has pleaded guilty to transferring data from a top-secret computer onto his work phone.

Hassaan Arshad, who was arrested in 2022, is alleged to have downloaded the stolen data onto a hard drive connected to a personal computer. He pleaded guilty to a charge under Section 3ZA of the Computer Misuse Act 1990, which relates to "unauthorised acts causing, or creating risk of, serious damage".

Areas and equipment labeled "top secret" within GCHQ house the government's most sensitive data. Information compromised here might cause a threat to life and/or the economic security of allied countries.

The case raises many questions about the highest level of the UK's national security and is a stark reminder of the vulnerability that mobile phones can create.

As Jake Moore, global cybersecurity advisor at ESET, puts it, the most serious data breaches often don't come from outsiders; they can simply stem from internal errors, poor controls, or invisible insider threats.

Moore previously worked for the Digital Forensics Unit and Cyber Crime Teams in the Dorset Police force, and spent 14 years investigating computer crime. He said the GCHQ case is another reminder of how easily sensitive data can fall into the wrong hands without robust preventative measures.

"Organizations need to remember to implement strict access controls such as locking down removable media and ensuring that only those with direct operational needs have access to sensitive areas," Moore said.

"Businesses also need to think about reducing the risk of mobile devices being used to capture sensitive data. It is worrying that personal devices were not banned from certain areas, but when phones are required, it can be effective to deploy Mobile Device Management (MDM) tools to limit device capabilities in high-risk zones, such as removing the use of the cameras."

When and where we use our phones has always been a big concern for security teams. Devices with electronic signals are often completely barred from high-level institutions, such as the CIA.

In the fallout of the Signal leak, where a journalist was inadvertently added to a classified conversation about an impending air attack in Yemen, the focus has mainly been on the use of the chat app.

However, as former CIA official William D. Murray pointed out, why was the director of the CIA using a mobile phone in the headquarters of the CIA?

MORE FROM ITPRO

• Nearly half of security practitioners told to ‘keep data breaches under wraps’
• Businesses must get better at sharing cyber information, urges former GCHQ chief
• Nearly half of EMEA data breaches were due to internal blunders

The former head of GCHQ has warned businesses face increasingly sophisticated cyber attacks on critical national infrastructure (CNI), urging firms to pay closer attention to geopolitics and collaborate on fighting the next generation of threats.

Jeremy Fleming, who served as director of the agency from 2017 to 2023, says the ‘big four’ – generally understood as China, Russia, North Korea, and Iran – are launching attacks on CNI to an unprecedented degree.

He also noted attackers are using pre-positioning, in which they embed themselves into systems for future attacks.

“Some of the things we're seeing and the way in which particularly pre-positioning is happening on critical national infrastructure, we haven't seen that before,” Fleming told attendees at the Palo Alto Networks Ignite event in London this week.

“Now you know that's really hard to do, I know as an intelligence professional, that's really hard to do but we are seeing it. We've seen it in the water industry particularly in America, we're seeing it across healthcare, we're seeing it in other areas.”

Fleming pointed to the recent Salt Typhoon attack on US telecoms infrastructure as an example of the sophisticated threat posed by state-sponsored threat actors, noting that more attacks of its kind using living off the land techniques can be expected in the near future.

Fleming said that regardless of company size, from small businesses to the largest enterprises, can repel these threats on their own. To achieve this, however, he called for far more information sharing between firms.

“We have to do better, you all have to do better, at sharing your understanding of the threats,” he said.

“It’s the pace at which we're able to share this information because some of you, one of you will solve something which is important from a state actor perspective for anyone else. That’s just the way it works. So how are we going to accelerate that data sharing amongst that?”

Haider Pasha, chief security officer, EMEA & LATAM at Palo Alto Networks, led the discussion with Fleming onstage during the Ignite keynote. He pointed to the Palo Alto Networks’ Cyber Threat Alliance, which grew from an information sharing agreement with a few close competitors to an organization of 26-27 industry leaders in cybersecurity, as an example of

“But I think, as you said, we need to do a better job of this,” Pasha noted.

This will be especially key as AI threats ramp up, Fleming noted, adding that sentiment on whether AI benefits attackers or defenders more is shifting due to growing caution in the cyber field.

While Fleming maintained that he’s still optimistic about how AI can benefit cybersecurity, he qualified that pace of delivery would make all the difference here.

Competing pressures on cyber teams

One of the major barriers organizations and nation states face in the coming years will be to meet their own data sovereignty requirements without withdrawing from vital information sharing agreements.

“So we are going to find that whilst I am airily talking about partnerships and whilst I’m airily talking about information sharing, quite a lot of the political pressure is going to get us to look inwards as nations,” Fleming said.

Against the backdrop of state-backed groups, Fleming also issued a stark warning:

“If you are faced with a determined state adversary, you will not stop them. That’s just the reality. Because a determined state adversary is not only trying to attack you from a cyber perspective, it’ll be looking for insider weakness, it'll be looking for other aspects of leverage.

But Fleming clarified that most businesses don’t need to be concerned about state adversaries, suggesting instead that raising cybersecurity levels to the level required to block most attacks is sufficient and not beyond any capable organization.

He also acknowledged what Palo Alto Networks calls ‘mega breaches’, large attacks on organizations that severely disrupt services and cause hundreds of millions of dollars in losses. Fleming stated that these attacks are lucrative and often carried out by groups based in North Korea.

A recent example is the recent Bybit crypto heist, in which $1.5 billion of digital tokens were stolen from an international cryptocurrency exchange. Fleming cited this as an example of a for-profit attack typical of North Korean threat actors.

Profit-driven groups also lean on ransomware attacks to an increasing degree, with February 2025 having been the worst month for ransomware on record.

Despite efforts by international law enforcement to seize leak sites on the dark web and take down groups like LockBit, ransomware groups persist – and Fleming was frank about the low chance these efforts will succeed.

“Globally, we haven't been able to take the steps necessary to disrupt ransomware at its source,” he said.

“And by that I mean, because many of the spaces where the ransomware actors are operating are denied spaces, law enforcement is unable to go after those in a way which is broad enough to make material difference.”

As with the threat posed by state-backed groups, Fleming urged firms to focus on the fundamentals and greater collaboration to shield themselves from ransomware.

MORE FROM ITPRO

• Global cyber attacks jumped 44% last year
• February was the worst month on record for ransomware attacks
• Manufacturing firms are struggling to handle rising OT threats

Plans have been submitted for a £1 billion development in Cheltenham that will include one of Europe's largest tech campuses.

Golden Valley will cover 47 hectares and, along with 1,000 low-carbon residential properties, include more than a million square feet of commercial space, targeting businesses with a focus on science and technology. 

The development is expected to create 12,000 new jobs.

"Golden Valley is the first development of its kind to be delivered in the UK – it sits at the heart of the Government’s Cyber and Technology strategy and underpins the UK’s ambitions to become a science and technology superpower by 2030," said Adam Brady, executive director at developer HBD x Factory.

The site will house the National Cyber Innovation Centre, which received £95 million in funding last month. Detailed proposals are expected to be submitted in the new year. 

As well as serving as a general innovation centre focused on the AI, deep tech and quantum sectors, there are plans to use the site as a test ground for new smart city concepts.

"Here in Cheltenham, we will be host to an internationally significant cyber and technology focused campus which, subject to planning permission, will provide the catalyst for delivering economic growth for the town and regeneration of local communities," said councilor Mike Collins at Cheltenham Borough Council.

Developers said Gloucestershire is already home to one of the UK’s most significant technology clusters, and has the largest concentration of cyber companies outside of London. 

In Cheltenham alone, there are an estimated 590 technology firms employing over 3,100 people, with Gloucestershire as a whole housing 2,300 businesses.

More than 120 of these are cyber security businesses, developers said, making the density of cyber security firms 11 times the UK average.

The location, developers said, boasts good rail and road links to Bristol, Birmingham, London, and other key parts of the country, and is within 90 minutes' travel to 20 universities.

Golden Valley security collaboration

The new development is also close to GCHQ, which is supporting the creation of the new centre.

Paul Killworth, deputy chief scientific adviser for national security at GCHQ, said the launch of the centre could foster closer collaboration between the security service and cyber security sector. 

"The opportunity offered by Golden Valley will lead to a sea-change in national-security relations between government, academia and industry," he said.

"The National Cyber Innovation Centre was described as 'a true international centre of innovation' in the National Cyber Strategy, and the development will also be a key part of the transformation of the intelligence community’s science and technology effort," Killworth added. 

“GCHQ already plays a prominent role in these sectors both locally and nationally and it looks forward to participating in this exciting development."

Intelligence and defence chiefs in the UK and US have confirmed their intentions to "impose consequences" on shared enemies in the world of cyber space.

Meeting at the Cyber Management Review in Maryland earlier this month, the two nations also pledged to continue to jointly innovate to tackle evolving threats in the cyber security landscape.

It said cyber space is an increasingly contested space and continued threats from both sophisticated criminals and hostile states continue to impact both countries' people and ways of life.

Representatives from Government Communications Headquarters (GCHQ), the National Security Agency (NSA), and the US Cyber Command met at the annual forum which helps to shape the two countries' intelligence relationship and helps drive "world-class cyber capabilities," GCHQ said.

"As like-minded allies for two centuries, the United Kingdom and the United States share a close and enduring relationship," read a joint statement issued by the intelligence and defence chiefs. "Our two nations today face strategic threats in an interconnected, digital world that seek to undermine our shared principles, norms, and values.

“We agree that strategic engagement in cyber space is crucial to defending our way of life, by addressing these evolving threats with a full range of capabilities. To carry this out, we will continue to adapt, innovate, partner, and succeed against evolving threats in cyber space," it added.

The two nations didn't identify specifically any common threat actors but said proportionate action would be taken to stop anyone or any group committing malicious cyber activity.

Any action would be "legal, proportionate, and necessary," the two countries said.

"As democratic cyber nations, the UK and US are committed to doing so in a responsible way in line with international law and norms, setting the example for responsible state behaviour in cyberspace,” the officials added.

The meeting earlier this month was the first time the UK and US had met at the Cyber Management Review in 2 years.

In attendance were Jeremy Fleming, Director at GCHQ, and General Sir Patrick Sanders, commander of UK Strategic Command, for the UK. General Paul Nakasone, director of the US National Security Agency and Commander of US Cyber Command represented the US.

The Cyber Management Review is supported by work carried out at multiple levels of the intelligence and defence organisations involved, providing guidance for future military and intelligence efforts specific to cyber space.

GCHQ and NCSC have revealed that when they encounter vulnerabilities in its tech, including the technology that other government departments and some businesses use, they don't always inform the vendor.

In an impressive display in transparency, the two national security agencies said that during daily operations, analysts working at GCHQ or other areas of government sometimes encounter vulnerabilities and while its default stance on the situation is to notify the vendor as soon as practicable, "sometimes - after weighing up the implications - we decide to keep the fact of the vulnerability secret and develop intelligence capabilities with it".

Stockpiling exploits doesn't have a strong history. Most recently, the WannaCry ransomware, which cost the NHS an estimated 92 million, was so successful as a result of stolen exploit information from the NSA. While the NCSC understands that its process might not be met with everyone's approval, the logic is sound.

"We've tried to make the description of the process as simple as possible to show the important characteristics," said Ian Levy, Technical Director at the NCSC in a blog post.

"We say our default position is to disclose the problem and there has to be a very good reason not to - either an overriding intelligence case or the fact that disclosing could reduce the security of people who use the product - and we really do mean it."

Levy says that the decision not to disclose a tech vulnerability that could leave businesses open to attack is not an easy one, but a necessary one. To make the difficult decision, it has a codified process called the 'Equity Process'.

The Equity Process

There are three separate bodies by which decisions must have approval before they are made. The Equities Technical Panel (ETP), The GCHQ Equity Board (EB) and The Equities Oversight Committee all consist of industry experts and NCSC representatives are involved at all stages. All decisions are reviewed within twelve months and sooner if new evidence is acquired. The decision pathway is illustrated below.

A set of decision criteria are used and the decision on whether to retain or release known vulnerabilities must be considered on the basis of:

1) Exploring routes to mitigate the vulnerability, would the release of it be at the detriment of national security?

2) Consideration of value to intelligence, is it worth keeping a secret?

3) Consideration of the potential risk to the UK and its allies in not releasing it

Essentially, decisions are made on the balance of potential damage. If the NCSC believes that knowledge of the vulnerability could be used to the UK's advantage, then it's retained, if not, then it's released.

"Some people will say that we don't need this process and that we should just disclose everything. In my opinion, that's nave - and I don't think it's got much to do with the NCSC being part of GCHQ and the wider UK intelligence community," Levy said.

"If we were separate, the rest of the community would still do vulnerability research and we would be much less likely to see those vulnerabilities and have a voice in how they're handled, so the UK would likely be at a greater security risk. But the NCSC is integral to the process and our job is to minimize the harm that cyber attacks can cause to the UK, and to also make the UK the safest place to live and do business online."

Benefits of non-disclosure

While it understands that businesses, hospitals, government departments and private citizens could be left vulnerable to attacks as a result of its silence, GCHQ ensures that the same vulnerabilities could be used to gain actionable intelligence. This means terrorist groups and child exploitation rings could be discovered and neutralised.

In the age where cyber intelligence is the deciding difference between having a bomb detonate in a school and the arrest of the bomber, there's an argument that it's paramount trust is placed in UK security services.

A report by the Intelligence and Security Committee said GCHQ spies have "over-achieved" in the last 12 months, developing twice as many potential hacks than its targets.

The GCHQ is developing these hacking capabilities to use against criminals when they launch cyber crimes. It means the UK government is prepared to attack another country's vital infrastructure, such as their communications systems or automated weapons.

There are three stages to the GCHQ's mission, the first of which has been completed ahead of schedule according to the Intelligence and Security Committee report.

"We actually over-achieved and delivered [almost double the number of] capabilities [we were aiming for]," an official from the agency told the Committee (via the BBC).

Although much of the information has been omitted from the public version of the Committee's report, it did reveal that not all attempts to create offensive cyber-weapons were successful. For example, the Foxtrot project was designed to combat encryption, with the project described as an "equipment interference programme to increase GCHQ's ability to operate in an environment of ubiquitous encryption".

However, a lack of skills in the specific area means it hasn't been able to complete the work and needs to find better resources to help it finish the project.

Also highlighted was Project Golf, which focuses on supercomputing and enhancing the government's data analysis to help combat threats, but its development has been halted until next year.

Similarly, the MI5's Alfa project, which has been designed to manage the organisation's information, has been delayed and "significant risks" are stopping it from being completed.

Canada's cyber defence agency has made the source code for its internal malware prevention tool publicly available to help in the fight against online threats.

The Communications Security Establishment, which is essentially Canada's equivalent to GCHQ in the UK, has released its "Assemblyline" tool as "an opportunity for the cyber security community to take what CSE has developed and build upon it to benefit all Canadians".

The tool is described as a highly configurable early warning system that is able to alert agents to malicious files when they are received.

An example given by the CSE describes how a financial officer may receive an email from an external sender that includes a password-protected zip file containing a word document and spreadsheet. This email may then be passed on to three colleagues within the department.

"Assemblyline will start by examining the initial email," the CSE explained in a statement. "It automatically recognizes the various file formats and triggers the analysis of each file. In this example, the Word document contains embedded malware, although the financial officer is unaware of this. The whole file is given a score when the analysis of each file is complete."

High scores will trigger alerts to a security analyst, who would then manually examine a file and disarm the malware to prevent it spreading further.

The main benefit of the system is its scalability, according to the CSE, as the tool is able to automatically rebalance workloads depending on the volume of data, making it an ideal catch-all solution for enterprises.

"Assemblyline was built using public domain and open-source software; however the majority of the code was developed by CSE," the statement added. "It does not contain any commercial technology, but it is easily integrated into existing cyber defence technologies. As open-source software, businesses can modify Assemblyline to suit their requirements."

The complete program is available on bitbucket to anyone who owns an account.

It's relatively uncommon for a national security agency to willingly share its tools with the world. The UK's GCHQ released the source code for its graph database program Gaffer in 2015, which is able to sift through vast amounts of data and analyse information to determine patterns.

At the time GCHQ promised further contributions to the open source community, but has yet to release any more of its toys to the public.

The National Security Agency in the US also has 32 projects running on GitHub, although these are mostly outdated programs, or specialist tools such as a GPS tracker, and are fairly useless as business tools. For the NSA's most high profile projects, you'll need to turn to the Shadow Brokers.

Image: Bigstock

Britain's new National Cyber Security Centre, a new institution tasked with defending the country against cyber attacks, was officially opened today by Queen Elizabeth II.

The new division, which is part of GCHQ, officially replaces various other government agencies that had cybersecurity roles, including the CCA, CESG, CERT UK and more.

It will be responsible for advising businesses and public bodies on infosec issues, as well as undertaking security research and handling incident response for major security breaches.

Speaking at the opening ceremony, NCSC chief Ciaran Martin was bullish about the future of cybersecurity in the UK, saying that he aims to make it "the best place to live and work online".

"Today, London becomes a key global player in the fight against the world's biggest and fastest growing threat," he said, "and it is the perfect location for the National Cyber Security Centre. It is the perfect place to coordinate our cybersecurity and manage incidents across the UK."

He also highlighted the importance of education and training among young people, presenting a gender-balanced roster of some of the first beneficiaries of the NCSC's youth outreach programmes.

However, Martin also said cyber attacks are "a fact of modern life" for a prosperous country like the UK.

His comments follow on from a statement he made yesterday, in which he warned of the dangers posed by state-sponsored Russian hackers and said that he expects a "category one" cyber attack to hit the UK at some point in the future.

Martin was frank about the potentially rocky start the institute will face, too. "It's ambitious. We will make mistakes. Initiatives will disappoint. Things will go wrong. Bear with us, because we'll make it work for the whole country."

Philip Hammond MP, Chancellor of the Exchequer, said the digital sector is worth 118 billion to the UK economy, adding: "This cutting-edge centre will cement our position as world leader in cyber security and work carried out here will ensure our country remains resilient to potential attacks.

"Britain is transforming its capabilities in cyber defence and deterrence. It's crucial we take action now to defend ourselves and protect our economy."

Private sector welcomes NCSC

The private sector has responded favourably to the NCSC's opening, praising the government's commitment to strengthening the country's infosec position. "Whilst the UK has not suffered from a tier one cyber threat, the growing level of sustained cyber attacks on UK businesses means we must not be complacent," said techUK's head of programme for cyber and national security, Tala Rajab.

"The NCSC, with the help of the private sector, must work to make the UK the hardest possible target for cyber criminals and help protect our growing digital economy. In order for the NCSC to do this, it must be accessible by both businesses and the general public, protecting a far wider range of sectors beyond just Critical National Infrastructure."

Rajab added: "Recently announced policy initiatives, such as the trialling of proactive cyber defence services on government departments before recommending them to businesses, are to be applauded and techUK looks forward to working with the NCSC to help it achieve its target of making the UK the safest place in the world to live and work online."

Kaspersky Lab's principal security researcher, David Emm, was particularly pleased with the NCSC's engagement with young people, saying: "Our dependence on technology and the ever-growing online security threat go hand-in-hand, so it's crucial that we start raising awareness and equipping children with cybersecurity skills as early as possible. It is crucial that, once taught cybersecurity skills, young people use these skills for the good of society instead of turning to cybercrime."

Britain is under attack from Russian hackers attempting to steal classified government data, the country's top cybersecurity chief has warned in an interview with the Sunday Times.

Over the past three months, the UK has been hit by 188 serious cyber attacks, averaging out at more than 60 per month, according to the National Cyber Security Centre (NCSC), the new GCHQ division set up to strengthen the UK's defences against cyber attacks. The department is set to be officially opened by the Queen on Tuesday.

NCSC head Ciaran Martin told the Sunday Times that Putin's government has been stepping up its attacks against Western nations like the US and the UK.

"Over the last two years there has been a step change in Russian aggression in cyber-space," he said. "Part of that step change has been a series of attacks on political institutions, political parties, parliamentary organisations and that's all very well evidenced by our international partners and widely accepted."

Martin classified the attacks on the UK as "category two and three" and said that many of them "threatened national security".

"In the case of government departments, [the aim is] getting into the system to extract information on UK government policy on anything from energy to diplomacy to information on a particular sector. With companies, it could be to steal intellectual property and sometimes you would get states in that business," he said.

Britain has yet to experience a 'category one' cyber attack, which would be comparable to the hack of the US Office of Personnel Management in 2015, an incident which resulted in the theft of 25 million federal employees' personal and biometric details.

However, Martin said that he expects "there will be a category one incident at some point in the future," citing the fact that "most of our major allies in similar countries have experienced what I would call a category one attack" and that "the intent and capabilities are there to deploy the sort of attack against similar and allied partner countries".

The US election was plagued with accusations of Russian hacking, with US security agencies and former President Barack Obama accusing the country of hacking emails belonging to the Democratic National Committee, with President Donald Trump eventually suggesting the country was likely behind these breaches.

However, Martin is confident about Britain's prospects of repelling such attacks. "We've got some very capable adversaries, but we've done a good job in detecting and managing those sorts of attacks," he said.

"We have very good capabilities where we watch the main actors that we know about very closely and we look at where they're attacking and we work very closely with key government departments and the parliamentary network to protect their systems."

"We can't eliminate the threat, but defeatism drives me mad," he added. "We shouldn't be defeatist about this; there's plenty we can do to strengthen defences at all levels."

The government outlined its Government Transformation Strategy last week, citing the increasing range of cyber threats as a motivating factor to improving Whitehall's digital skills.

Teenage girls across the UK are being invited to test their hacking skills in a cybersecurity competition, in a bid to raise interest and increase the number of women joining security agencies.

The CyberFirst Girls competition, hosted by GCHQ's newly formed National Cyber Security Centre (NCSC), will pit young security enthusiasts against each other in a series of challenges designed to test cyber skills that are sorely needed across all industries.

Girls aged 13-15 will be able to enter the competition in teams of four to engage in preliminary online challenges, with the possibility of advancing to the national final held in London in March. This initial stage will last one-week, between 27 February and 6 March, and consist of puzzles in four categories: Logic and coding, networking, cyber security and cryptography.

The top ten teams will then compete against each other in a series of tasks that challenge participants to investigate suspicious cyber activity and identify the source of the threats.

"I work alongside some truly brilliant women who help protect the UK from all manner of online threats," said GCHQ director Robert Hannigan. "The CyberFirst Girls competition allows teams of young women a glimpse of this exciting world and provides a great opportunity to use new skills."

The pupils from the winning team will each take home individual prizes, and their school's IT department will receive 1,000 worth of new equipment.

Teachers from all subjects are encouraged to enter, as there are no knowledge or computer skill requirements for pupils, and a single school may enter multiple teams.

The competition forms part of the new National Cyber Security Strategy unveiled in November 2016, which aims to address the cyber skills gap - a problem that has seen women massively underrepresented in the industry. Globally women make up only 10% of the entire cyber workforce, and in the UK the number of women employed in computer services accounts for just 16%.

CyberFirst will also be launching a series of free activity days and courses in February 2017, for pupils in Year 8 through Year 13, which will give students the possibility of applying for a CyberFirst Student Bursary of 4,000 per year for undergraduate study.

Teachers can now pre-register their interest at the NCSC website, where they will receive an information and Q&A pack. Once registered, teams will then be invited to register fully for the competition from 13 February.

The National Cyber Security Center's technical director Ian Levy has slammed commonly-accepted cyber security advice, equating the security industry to "witchcraft" and accusing it of deliberately creating unnecessary fear around cyber threats.

Speaking at Future Decoded 2016, Microsoft's annual digital transformation conference, Levy argued that cyber security is not transparent and that the industry is "blaming the user for designing the system wrong".

"We have to make [security] much more user-centric - stop blaming the user, give them information, let them make decisions," he said.

He also argued that traditional security wisdom regarding email attachments and passwords is too complex and difficult for users to follow. According to his team's research, maintaining secure, regularly changed passwords for the average number of online sites and services equates to memorising a different 660-digit number every month.

Another target of his ire was the level of hyperbole surrounding the security industry. He took particular issue with the portrayal of hackers, which are commonly labelled 'advanced persistent threats', or APTs.

Instead, he argued that it should stand for 'adequate pernicious toerags', based on the fact that many attackers use older exploits and vulnerabilities with patches that are available, but not installed. By presenting hackers as super-skilled experts, however, he states that security companies are creating a climate of fear.

"Everything that we do as an industry is about making it sound really, really bad; because then you can't possibly defend yourself," he told attendees. "There's no other part of public policy that I'm aware of that allows this to happen. Nowhere else in public policy do you allow fear to rule."

The sentiment clashed somewhat with a statement from chancellor Phillip Hammond, who stated that the UK needed to develop offensive cyber weapons in order to prepare the country for retaliation in case of a cyber attack from a foreign nation.

Levy argued for greater transparency within the secure industry, and the creation of a climate in which the UK can have an informed national conversation about the threats facing both private citizens and companies operating in Britain. To that end, the National Cyber Security Centre will be publishing information and documents through their website in order to inform the public.

"I want to get to a point where we have data, we have metrics, and we can start to explain to the public how we're defending the UK," he said.

The government has announced its latest initiative to fight cyber crime in business - the National Cyber Security Centre (NCSC).

The scheme will see the public sector joining forces with private sector companies, sharing the information they have about cyber threats so a more unified approach to prevent hackers from breaking into their systems.

"The Centre will be the bridge between industry and government, simplifying the current complex structures, providing a unified source of advice and support, including on managing incidents," Matt Hancock, Minister for the Cabinet Office, explained. "It will be a single point of contact for the private and public sectors alike."

Ciaran Martin, who will head up the National Cyber Security Centre as CEO explained the facility will unify intelligence from CESG, the information security arm of GCHQ, the Centre for the Protection of National Infrastructure, CERT-UK and the Centre for Cyber Assessment, sharing knowledge and using it to identify and address vulnerabilities.

"Whilst retaining access to the world-leading capabilities, partnerships and people of the intelligence community, this new centre will have an open door' policy which will make it easier for businesses of all sizes to get the best support available for cyber issues," Ben Gummer, minister for the Cabinet Office and paymaster general, added.

The NCSC's first project will be working with the Bank of England to advise other companies in the financial sector about the impact of cyber crime on their business.

Another scheme will be to work with some of the biggest companies in the UK to set up a giant firewall, which will be used to filter malicious content and websites.

"Given the industrial-scale theft of intellectual property from our companies and universities, as well as the numerous phishing and malware scams that waste time and money, the NCSC shows that the UK is focusing its efforts to combat the threats that exist online," Robert Hannigan, director of GCHQ, added.

Around 20 celebrities were spied on by British security services and these operations may not have been justified or warranted.

The disclosure came to light at an investigatory powers tribunal brought by campaigning organisation Privacy International.

According to a report by the Guardian, government lawyers on behalf of GCHQ and MI5 showed that between 2009 and 2013, three searches into high-profile people were "not operationally justifiable."

Another 17 searches, carried out by five officers were said to be possibly not "operationally justifiable". The lawyers added that conversations with those officers were not recorded, meaning it is "not possible to ascertain whether they were in fact operationally justifiable".

The report said that these individuals were not notified of the surveillance and officers were warned that if they were caught misusing their powers they could face disciplinary action.

Government lawyers initially refused to release the figures on grounds of "damage to national security", but documents were released on the second day of the hearing following repeated request by Privacy International.

The intelligence officers have since been banned from using the security services' data to "search for and/or access information other than that which is necessary and proportionate for [their] current work".

Millie Graham Wood, legal officer at Privacy International, said the security services should have informed the celebrities involved they were being spied upon. She said it should be a serious concern that there is no procedure to notify victims.

"Without such a mechanism, and in the absence of independent or judicial authorisation, a victim of abuse has no prospect of ever securing a remedy."

The Investigatory Powers Tribunal has ruled that the 650 people who said they were wrongfully spied upon by British and American authorities will have to provide further evidence of surveillance before the government will listen to their claims.

If the claimants provide the evidence, the Tribunal will then decide whether the cases will be fully investigated or not. The Tribunal stressed that they will not automatically be looked into.

The complaints came forward after Privacy International campaigned for people who thought they had been unlawfully watched to state their concerns about GCHQ digging into their digital life without their permission last year.

Around 650 people responded and said they wanted the government to investigate into what information had been mined and why they had been selected for investigation.

"Given that these claims arise in the context of the bulk surveillance activities of the UK and US Governments, the Tribunal's requirement that claimants submit further information on why they think they would be spied on before deciding whether to fully investigate their claims is unacceptable," Scarlet Kim, legal officer at Privacy International said.

The Investigatory Powers Tribunal also stated that non-UK residents could not make a claim against the UK government for violating the European Convention on Human Rights, but Privacy International believes this is wrong and goes against the Convention, because the law states that anyone is protected, regardless of where they are located.

"The Tribunal's refusal to recognise the human rights claims of non-UK residents is ill-founded," Kim added. "When a member state to the European Convention on Human Rights commits a human rights violation on its own territory - whether by unlawfully suppressing free speech rights, expropriating property, or conducting surveillance - the victims are entitled to judicial relief no matter where they live."

"An essential feature of any true democratic society is that covert breaches of the law are disclosed to the victims. The Tribunal's decision is yet another example of the lack of genuine and rigorous public scrutiny of the British intelligence services," she concluded.

UK government listening post GCHQ revealed today that its has joined Twitter, with a view to becoming more transparent.

GCHQ is the first UK government intelligence agency to join the social network.

Andrew Pike, director of communications at GCHQ, said in a statement: "In joining social media GCHQ can use its own voice to talk directly about the important work we do in keeping Britain safe."

The agency added that it wanted to be "more accessible and to help the public understand more about our work".

Part of this will include reaching out to the technical community and adding its voice to social media conversations about technology, maths, cybersecurity and other topics, the agency said.

GCHQ's Twitter account first tweeted at 11:02 BST, and so far has more than 6,000 followers.

Social media has become an important arena for security agencies, who have used it to scour for developing threats and leads on parties they have taken an interest in. Services, such as Dataminr, which Twitter invests in, are also known to have provided security agencies will early alerts of terror attacks and other crises.

Elsewhere in the world, other intelligence agencies have had Twitter accounts for several years. The FBI has had a presence on the social network since November 2008, and the NSA since December 2013.

GCHQ, however, has preferred a less talkative demeanour. Reports that the agency has allegedly been spying on all UK citizens, in the wake of the Edwad Snowden revelations, had also fuelled fears that giving the intelligence agency further powers in the form of the Investigatory Powers Bill, or Snooper's Charter could be a bad thing for privacy.

The intelligence agency has made some efforts to make some its own technology available, though, such as making its database retrieval tool, Gaffer, to the data community.

The GCHQ has developed VoIP encryption tools with a built-in backdoor, allowing both authorities and third parties to listen in on conversations.

The backdoor is embedded into the MIKEY-SAKKE encryption protocol and has a 'key escrow' built in, allowing those with authority - whether an employer or government agency - to access it if a warrant or request is made.

The backdoor was uncovered by Dr Steven Murdoch, a security researcher from the University of London, who wrote a blog about the potential snooping tool.

He explained that MIKEY-SAKKE has a monopoly over other security protocols used by approved government voice communications, meaning almost all software used for communication is using the encryption, with the enbedded backdoor. GCHQ can also insists the technology is used in other products used by the public sector and companies "operating critical national infrastructure".

"Although the words are never used in the specification, MIKEY-SAKKE supports key escrow," Murdoch wrote. "That is, if the network provider is served with a warrant or is hacked into it is possible to recover responder private keys and so decrypt past calls without the legitimate communication partners being able to detect this happening."

He explained this is being marketed as a benefit to using MIKEY-SAKKE rather than a bug, with documentation issued by GCHQ advertising it means employers can listen into voice communications when investigating into misconduct trials.

"The Government should come to the realisation that the inclusion of backdoors in encryption isn't merely a legislative or privacy mandate, however, it is technically impossible to control the use of a backdoor in this way." Justin Harvey, chief security officer at Fidelis Cybersecurity said.

"I liken the pro-backdoor encryption movement to complaints about the weather; some people complain about rain, snow or sunshine and wish it were otherwise, but in the end, we can't do anything about it. The same is true for strong encryption."

Government spy agency GCHQ has released one of its tools, Gaffer, on Github.

Gaffer is a graph database program which is "optimised for retrieving data on nodes of interest", and "makes it easy to store large-scale graphs in which the nodes and edges have statistics such as counts, histograms and sketches".

Essentially, it acts as Big Data analytics, sifting through huge volumes of information in order to determine patterns.

The software also lets the user "specify flexible views on the data", and "can be used for machine-learning applications".

The target audience for this code is likely to be those with intensive research and analysis needs, rather than more general users.

The software has been released for free under an open source Apache 2 license, meaning anyone is free to edit or use it.

Intelligence agencies releasing open source code is not unheard of - Gaffer itself is based on the Accumulo framework, which was released by the NSA under the same license in 2008.

Speculation is rife as to exactly why the repository has been released, but according to a spokesperson, "Gaffer is expected to be the first of many contributions that GCHQ will make to open source software".

"GCHQ hopes that Gaffer will be useful to others in the community, as well as helping its own technical staff as they continue to develop the software in the future," a GCHQ representative told TechWeekEurope.

"As a government department and technology organisation, GCHQ software developers and technologists aim to contribute to open source software projects."

Image credit: Stephen Clarke / Shutterstock.com

US whistleblower Edward Snowden has revealed that UK intelligence agency GCHQ has the tools to hack into and control phones without the owners being aware they are being tracked.

He explained that authorities can implement tools - called Dreamy Smurf, Nosey Smurf, Paranoid Smurf and Tracker Smurf - by sending a smartphone an encrypted text message.

"Dreamy Smurf is the power management tool which means turning your phone on and off without you knowing," Snowden said."Nosey Smurf is the 'hot mic' tool. For example if it's in your pocket, [GCHQ] can turn the microphone on and listen to everything that's going on around you - even if your phone is switched off because they've got the other tools for turning it on."

He explained that Tracker Smurf is a geo-location tool that could potentially allow GCHQ to follow smartphone users better than using standard cellular location towers.

Paranoid Smurf is a self-protection tool that can be used to stop you getting rid of the other tools on a device. If you spot something strange is going on with your device and take it to a phone shop to fix the problem, for example, Paranoid Smurf would hide the evidence so technicians wouldn't find anything wrong.

Snowden spoke to the BBC's Panorama programme from his base in Russia, where he ran away to after leaking other snooping allegations about the GCHQ and US's National Security Agency (NSA).

The NSA also have a similar set of tools to use in the fight against terrorism, Snowden said. The US security organisation reportedly spent $1bn on the tools to respond to terrorists' increased use of smartphones.

Although he did not specifically say the GCHQ and NSA wanted to partake in mass surveillance, they have both invested in software that would allow them to hack into devices in order to track what you're saying, what you're doing and where you are.

"They want to own your phone instead of you," he said.

The UK government commented: "All of GCHQ's work is carried out in accordance with a strict legal and policy framework, which ensures that our activities are authorised, necessary and proportionate, and that there is rigorous oversight, including from the secretary of state, the interception and intelligence services commissioners and the Parliamentary Intelligence and Security Committee. All our operational processes rigorously support this position."

A spy programme known as Project Echelon has been tapping into billions of phone calls a year for the last half-century, according to a campaigning journalist writing for The Intercept.

The scheme was jointly-run by US agency NSA and British agency GCHQ, and signalled the advent of mass surveillance by ushering in an age of "Big Brother"-style snooping, according to one source.

Starting in 1966, the project leapt into life when the NSA fronted the money for the GCHQ to build a station in Bude, Cornwall, capable of intercepting satellite communications from Intelsat, the first commercial communications satellite network.

Journalist Duncan Campbell and fellow reporter Jim Bamford located a second site in Yakima, America, that intercepted US-Asia communications.

Campbell wrote: "At the dawn of the era of mass surveillance, almost 50 years ago, the ECHELON stations at Bude and Yakima were the global mass surveillance system."

The Echelon system was automated, and able to sift through vast swathes of data from these satellites to sort and categorise it all.

Speaking to a former Lockheed (now Lockheed Martin) employee in the late 1980s who was responsible for managing NSA databases at a new site in California, Campbell learned how Echelon was spying on politicians, and his source also shared plans for the IT system underpinning the project.

He wrote: "The plans showed how ECHELON, also called Project P415, intercepted satellite connections, sorting phone calls, telex, telegraph and computer signals.

"Although the internet was then in early infancy, what was carried digitally was covered. The way ECHELON had been designed, she said, demonstrated the targeting of U.S. political figures was not an accident."

Campbell added that the scale of the operation had shocked him.

"The NSA and its partners had arranged for everything we communicated to be grabbed and potentially analyzed," he said. "ECHELON was at the heart of a massive, billion-dollar expansion of global electronic surveillance for the 21st century."

However, Campbell's expose of the spying programme in 1988 was ignored for 11 years, until the European Parliament commissioned an investigation in 1999.

Though the parliament mandated extensive action against mass surveillance in 2001, a few days later the Twin Towers were destroyed in the 9/11 terrorist attack.

"Any plans for limiting mass surveillance were buried with the victims of 9/11," wrote Campbell.

Since Edward Snowden's revelations about the NSA laid bare the extent of spying programmes against US and European citizens, public interest has spiked in privacy, and some of the documents leaked actually confirmed Campbell's reports.

GCHQ and the NSA stand accused of reverse-engineering consumer anti-virus software in order to hide their operations, it has been revealed.

Hacking efforts by UK spy body GCHQ have been stymied in the past by security vendors such as Kaspersky Labs, according to a warrant renewal request published by The Intercept.

The warrant states that the Russian AV company in particular continues to "pose a challenge" to GCHQ, and that the agency's goal is to be able to "exploit such software and to prevent detection of [their] activities".

In order to circumvent this type of security, the agency examined various elements of it for vulnerabilities, using a technique known as Software Reverse Engineering.

As part of the "computer network exploitation" tactics covered by the warrant, GCHQ likewise examined popular forum software vBulletin, which the document claims is "widely used to run terrorist web forums".

It is also, however, used to run and maintain a huge majority of legitimate forums such as NEOGAF and SomethingAwful, and SRE methods have previously yielded the recovery of an unspecified number of user credentials.

As these SRE techniques could potentially constitute "an infringement of copyright", GCHQ requires a legally-protecting warrant from the government that must be renewed every six months.

It was one such renewal request, dated from 2008, that was published today as part of the Snowden files. It is unclear whether this practise of reverse-engineering security software is still common, as well as what GCHQ hoped to achieve in the process.

The warrant also notes that the agency's success in reverse-engineering strategies have led to developing capabilities against Cisco routers. This allows UK spies entry into the Pakistan Internet Exchange, where they have "access to almost any user of the internet inside Pakistan".

The NSA has also been undertaking similar projects. In a briefing from 2010, also part of the Snowden files, the US spy agency's "Project CAMBERDADA" was revealed to be intercepting malware-flagging email traffic between end-users and anti-virus vendors.

This information is used to compile a list of malware that vendors like Kaspersky have not yet adapted to combat. The agency's Tailored Access Operation unit then "repurpose the malware", allowing them piggyback access to machines and networks.

Kaspersky has been a notable opponent of state-sponsored intrusion. The Russian company had a hand in detecting and flagging multiple examples of suspected government malware such as the Gauss, Flame and Stuxnet viruses.

Earlier this month, the company discovered that it had itself been hit by the Duqu 2.0 worm, which founder Eugene Kaspersky believes to be a "nation-state sponsored campaign".

The company said in a statement that "we find it extremely worrying that government organizations are targeting security companies instead of focusing their resources against legitimate adversaries."

It decried the fact that government divisions are "actively working to subvert security software that is designed to keep us all safe."

Along with Kaspersky Labs, a total of 23 vendors were listed in the presentation on a slide jauntily titled "more targets!" These included Bit-Defender, Avast, Avira and Checkpoint, with examples from multiple US-allied countries although none from within the US itself, or the UK.

However, while this may come as a shock to some, others in the infosec community are less than astonished. Ben Johnson, Chief Security Strategist for Bit9 + Carbon Black, points out that "AV tools can be bought and pulled apart by anyone".

He notes the logic of GCHQ's operations, asking "is it really a surprise that intelligence agencies try to circumvent technologies that might prevent them from collecting information? Or test these technologies for weaknesses?"

He likens this probing of vendor proficiency to real-world combat tactics; "In the hacker world as well as the military world before conducting any operation it is vital to test offensive tools against defensive capabilities".

Infosecurity 2015 has been a great place to be if you care about IT security either from the vendor or enterprise perspective. The biggest event of its type in Europe, you would have expected a big-hitter to open things and that's what you got in the shape of Ciaran Martin, Director General of Cyber Security at GCHQ.

Or at least that's what you might think you were getting, until the actual point that Martin started talking that is and you realised that what you actually got was a spin-doctor. The key theme of the keynote presentation was how cyber attacks are driven by power, money and propaganda, and how apt that turned out to be seeing as Mr Martin used his position of power to push the government privacy argument position of you have nothing to fear from us'.

An odd mix of vendors going for the hard sell alongside technical workshops and roundtable discussions pretty much sums up Infosecurity. I attended one of those roundtable events an hour or so after the GCHQ presentation, which included our very own occasional contributor Tom Brewster asking whether vendors control the narrative when it comes to media reporting of IT security. You may not categorise GCHQ as a vendor, but I would argue that Mr Martin was certainly trying to sell a product; namely the ability to pry on our private communications wrapped up in the packaging of protecting us from evil.

Vendor-esque overtones or not, Mr Martin certainly attempted to control the narrative by not only stating from the get go that he wouldn't be talking about the so-called Snoopers' Charter but also ended things by only having time for one question from the floor. A question asking about tech firms leaving the UK over the likelihood of forced encryption back doors, I hasten to add, that was answered by quoting someone else confirming that GCHQ was no threat to our privacy.

None of this should come as any great shock of course, what with Mr Martin previously having been the lead negotiator on the referendum for Scottish independence for the Prime Minister in his role as Constitution Director' at the Cabinet Office. Something of a career civil servant with roles as Head of the Cabinet Secretary's Office and Director of Security and Intelligence behind him, I wasn't that surprised when his speech ended up like something from Sir Humphrey out of Yes Minister.

Now it would be disingenuous of me to suggest that Mr Martin, given both that Director of Security role and his current one, knows nothing about IT security. Just like it would be disingenuous of the government to suggest there is no political motivation behind speeches such as this one.

A speech entitled Building Cyber Security for Tomorrow' with Sir Humphrey, sorry I mean Mr Martin, spelling out right from the start that he would be focusing his comments on who is attacking us and how, what defensive and response strategies are most effective to combat them and what the role of GCHQ is in all of this.

Needless to say we never really discovered the who or how, and the combat strategies were just a repeat of usual broad sweep basics of business IT security 101. He did, however, take some time to explain why he wouldn't be talking about the Snoopers' Charter, which he didn't mention by name.

Here's exactly what Mr Martin said:

"Our role only really works because we have a world class intelligence capability to draw on. If we want to protect the UK from the darkest aspects of cyber space, we have to be able to understand how that works. That intelligence role has been the source of well-known controversy around privacy.

"I won't and can't talk about that in any detail today. The Queen's speech set out a process for considering legislation on the proper powers for national security and law enforcement bodies and it is for Ministers to propose and for Parliament to debate. All I would say is that everyone in GCHQ is acutely conscious that we are entrusted with significant power under the law, and we use it extremely carefully.

"Just over a year ago, the Interception Commissioner, Sir Anthony May, who was formerly one of England's three most senior judges and had ruled against the intelligence services in the past, compiled a report on the various allegations. He had full access to the papers and staff of GCHQ. He asked the question: "does GCHQ engage in the random mass intrusion into the private lives of law-abiding citizens?" The answer was "emphatically no".

"To get back to cyber, one of the things that has almost flippantly been said in our defence is that even if we wanted to do such things we don't have enough people to engage in such unlawful mass intrusion. And size naturally affects our role on cyber. We're simply not big enough to put a big cyber umbrella over the UK: no single organisation could possibly do that over any country."

The clue is at the end of all of that, of course, in that the bill which the Home Secretary and Prime Minister want passed into law would mean that it's the Internet Service Providers which would be forced into both collecting and storing the vast amounts of data required to snoop on users, and then handing over the bits (no pun intended) to GCHQ that relate to specific users upon request.

Which puts quite a different perspective upon it. David Cameron has also made it quite clear that he wants encrypted messaging services banned, and/or back doors put into encryption services.

Quite how an ability to devalue the ability to encrypt data serves to help British business in the fight against cyber crime, which was the main thrust of the Martin presentation remember, is frankly beyond me. Just as all the themes of Intelligent Security' as set out by Infosecurity Europe appear to be beyond Mr Martin, GCHQ and this government. Those themes were Protect - Defend - Respond - Recover. Mr Martin certainly achieved the first two with his presentation, and when he responds properly we might be able to tell if GCHQ can recover...

GCHQ's cyber security chief warned that the nation's businesses are at risk of being attacked by criminals and terrorists whose main motivations are money, power and propaganda.

Giving a keynote speech at the Infosec conference held in London this week, the intelligence agency's Director General for Cyber Security, Ciaran Martin, said that organisations should take their lead from GCHQ and render them as "irrelevant as possible".

He said that in the last 10 years, the security industry has moved from talking about "what might happen" to what is now happening on a daily basis". He told delegates that it had fallen to the agency to be the UK's "top scarer". He explained that the three main motives in cyber-attacks were money, power and propaganda - particularly as intellectual property and corporate reputation gain increasing importance to organisations.

"We're genuinely surprised at the variety of UK organisations that can been subject to intrusion," he said. He urged firms to think about what would make them "attractive as a target" to criminals as a good way of approaching IT security.

Martin said that organisations faced too many incidents to be concerned about "stopping attacks everywhere" and now the main aim in IT security was to protect "what you care about most".

But the UK market, despite increased awareness of attacks, displayed a "relative immaturity of norms and practices", even in supposedly secure institutions, said Martin. He hoped that new GCHQ standards would prevent the sorts of attacks that wiped bank drives in Asia and affected a Saudi Arabian oil firm in 2012.

Martin distanced his agency from the controversial allegations that it conducted mass surveillance of British citizens and said that GCHQ's powers were "strictly circumscribed" and "needed clear justifications as laid down by parliament".

When questioned on the upcoming Investigatory Powers Bill, or 'Snooper's Charter', that the government plans to enact, Martin refused to give an answer but added that the agency's roles only worked "because we have an intelligence capability".

"If we want to protect the UK from the darkest reaches of cyberspace, we have to know how it all works."

Privacy International has revealed the GCHQ cannot get in trouble for hacking after the government pushed through legislation that makes it exempt from surveillance laws.

The organisation said it heard from the government ahead of a court case relating to the GCHQ's operations which, it claims, includes hacking in the Investigatory Powers Tribunal.

The government notified the claimants in the trial that the Computer Misuse Act was amended on 3 March 2015 to exempt the GCHQ intelligence service from rules set out in the act relating to hacking.

Privacy International, along with a group of other privacy and human right organisations filed complaints to the Investigatory Powers Tribunal, claiming the actions of the organisation were classed as hacking under the Computer Misuse Act and were therefore illegal.

The changes mean the GCHQ is able to continue carrying out its work by whatever means possible. Privacy International said it appears "no regulators, commissioners responsible for overseeing the intelligence agencies, the Information Commissioner's Office, industry, NGOs or the public were notified or consulted about the proposed legislative changes."

In February, a draft code was released giving UK spy agencies like the GCHQ powers to hack targets, including theose that don't have any link to crime or are a risk to national security, Privacy International said. However, very few details about the code have been released.

Eric King, deputy director of Privacy International, said: "The underhand and undemocratic manner in which the Government is seeking to make lawful GCHQ's hacking operations is disgraceful. Hacking is one of the most intrusive surveillance capabilities available to any intelligence agency, and its use and safeguards surrounding it should be the subject of proper debate.

"Instead, the government is continuing to neither confirm nor deny the existence of a capability it is clear they have, while changing the law under the radar, without proper parliamentary debate."

OPINION:Porn sites will have proper age restrictions if the Conservatives are returned to government following May's general election.

Prime Minister David Cameron's pledge aims to protect children after a Childline survey found 18 per cent of 12-13 year-olds had seen upsetting pornography pictures on the web.

Many porn sites do require a visitor to enter their date of birth or confirm they're aged over 18, but users can simply select a date or tick a box rather than provide any real proof of age.

However, the Tories say an independent regulator would require ISPs to block porn sites that don't comply.

Culture secretary Sajid Javid said: "We need effective controls online that apply to UK and overseas.

"This is about giving children the best start in life; we do not want to prevent adults from accessing legal content but we do want to protect our children from harmful material, so they are free to develop a healthy attitude to sex and relationships."

This regulator would also be tasked with finding out the best way to introduce age restrictions, the Conservatives say.

But Javid told BBC Breakfast one way to age-check porn users would be with credit cards presumably for paid-access sites.

Another method, he said, was adopting electronic IDs (EIDs) as used in countries such as Finland.

Restricting porn access is a laudable principle, but not one that should be automatically supported without consideration of just how it will be done.

Javid's suggestions of age-checking people with their credit cards, or with EIDs, is worrying due to the potential for misuse.

But, as Sally Annereau, data protection analyst from Taylor Wessing law firm, says, it's probably the only way to do it.

"Implementing online processes that can reliably verify a person's age will inevitably require the collection of, access to, or sharing of even more unique information about people," she warns.

Such a measure raises many questions around data protection how can these details be collected and safeguarded to protect privacy?

Furthermore, it raises the risk of ID theft, fraud, and surveillance.

"It would be a privacy own goal to implement online safeguards without first taking account of all the wider risks and legal challenges for society that those measures also raise," Annereau says.

The GCHQ isn't exactly averse to a bit of spying, with ex-NSA whistleblower Edward Snowden revealing the NSA had provided the British spy agency with data on UK citizens from its own snooping programmes.

Additionally, the Tories' own record on security is questionable in the extreme.

Cameron recently pledged to ban encrypted communication services that make it hard for spooks to see what people are saying.

Then there's the Snooper's Charter, officially the Communications Data Bill, which the Lib Dems managed to block, but introduced by their coalition partners.

If passed, it would have made it easier for law enforcement and intelligence agencies to access communications data, forcing ISPs and websites to store information on users for at least 12 months.

The Tories may try to push the bill through Parliament again after May 7, and GCHQ is no doubt resorting to other methods to collect data on citizens but why make it easier for them?

As content filtering company Bloxx's sales director, Mark Gibson, says: "It seems naive to suggest this would not impeach on people's privacy - if implemented the system will, to a degree, monitor people's browsing."

Instead, there must be another way forward - Taylor Wessing's Annereau certainly thinks there is.

She points to a range of potential technologies that also offer more privacy-friendly features and give parents greater control and peace of mind.

However, she adds: "One big consideration around placing the onus on sites is that it may be challenging to develop standardised solutions."

Gibson suggests another route. "There needs to be education and discussion about adult content, to try and tackle the reason more and more children are searching it out, rather than placing it behind a set of easily bypassed barriers," he says.

Either way, while we might agree with the sentiment proposed by the Conservatives, it's hard to see how it will prove practical without further eroding the privacy of UK citizens.

A discussion on the prevalence of porn in today's society should be encouraged, but there's no quick answer thinking through the possible consequences takes time and introducing such a measure shouldn't be left to a single party with a poor record on privacy.

Amnesty International is taking the government to the European Court of Human Rights over its mass surveillance of UK citizens.

The organisation claims the government's practice of mass surveillance goes against human rights, and has issued the legal challenge with another nine bodies.

All object to the government's methods of interception, collection, inspection, distribution and retention of communications "without any judicial authorisation," their filing said.

Their complaint is based on revelations leaked by ex-NSA contractor Edward Snowden, who revealed information on secret US data collection programmes like PRISM, collecting communications data including emails, text messages, phone calls and social media without permission.

The court filing mentioned Tempora, Upstream and PRISM as three of the mass surveillance programmes it was hoping to stop, saying the operations were making it increasingly difficult for Amnesty International to carry out its work.

While based in the US, the PRISM and Upstream programmes extended to UK-held data. Meanwhile Tempora is the UK's own GCHQ programme, giving spooks access to vast swathes of data on millions of people.

"It is thanks only to Edward Snowden's revelations, and the scant disclosures we and the other claimants have been able to prise from the government, that we know anything whatsoever about what the intelligence services are up to," said James Welch, Legal Director for Liberty.

The filing also detailed how a closed hearing took place, outlining Amnesty International and the other applicants' concerns, but none of the bodies were invited to attend because of the sensitive nature of the country's security.

Nick Williams, Amnesty International's legal counsel said: "The UK government's surveillance practices have been allowed to continue unabated and on an unprecedented scale, with major consequences for people's privacy and freedom of expression. No-one is above the law and the European Court of Human Rights now has a chance to make that clear."

Carly Nyst, legal director of Privacy International, added: "Mass surveillance is a violation of our fundamental rights. Intercepting millions of communications every day, and secretly receiving millions more from the NSA by the back door is neither necessary nor proportionate."

SIM card maker Gemalto has shared details of its investigation into claims British and US securities services hacked the company to steal billions of encryption keys.

Privacy International blasts security services

"GCHQ has lost it's way. In stealing the SIM card encryption keys of millions of mobile phone users they have shown there are few lines they aren't willing to cross," the charity told IT Pro.

"Hacking into law-abiding companies, spying on their employees and stealing their data should never be considered 'fair game.'

"The mentality of 'Act first, worry about the law later' has to come to an end. Unrestrained, unregulated Government spying of this kind is the antithesis of the rule of law and they must be held accountable for their actions."

The two agencies are said to have joined forces to set up a specialist Mobile Handset Exploitation Team (MHET) in April 2010, documents by The Intercept revealed. The unit's mission was to target vulnerabilities in mobile devices.

Operatives worked to infiltrate Dutch company Gemalto, which produces 2 billion SIM cards a year and serves 450 telecoms operators across the globe, it was claimed.

A top secret slide (below) confirmed the NSA and GCHQ had gained access to Gelmato's network and mined the private communications of engineers and sales employees.

The claims are the latest in a long line of revelations to have been made public by NSA whistleblower Edward Snowden.

By stealing encryption keys, the intelligence agencies were able to monitor mobile communications without approval from telecom companies and foreign governments, all without being traced.

In a statement published on 25 February, the organisation said it has reason to believe the NSA and GCHQ were behind a series of attempts made in 2010 and 2011 to hack into the company and its network.

"At the time we were unable to identify the perpetrators but we now think they could be related to the NSA and GCHQ operation," the statement reads.

"These intrusions only affected the outer parts of our networks - our office networks - which are in contact with the outside world.

"The SIM encryption keys and other customer data in general, are not stored on these networks," the statement added.

Therefore, it denied claims the security services were able to steal the SIM encryption keys because the NSA and GCHQ appear to have only succeeded in breaching its office networks.

Instead, Gemalto's investigation into the matter has suggested the NSA and GCHQ may have targeted other parts of its SIM card supply chain to get access to the encryption keys, rather than via its own network.

Furthermore, it also denies that it ever sold SIM cards to four out of the 12 operators listed in the leaked documents.

Gemalto described the attacks as as "serious and sophisticated", but said no signs of malicious activity were observed anywhere else in its networks.

"No breaches were found in the infrastructure running our SIM activity or in other parts of the secure network which manage our other products such as banking cards, ID cards or electronic passports," the statement continued.

"We are conscious that the most eminent state agencies, especially when they work together, have resources and legal support that go far beyond that of typical hackers and criminal organisations.

"And, we are concerned that they could be involved in such indiscriminate operations against private companies with no grounds for suspicion," the statement concluded.

When the allegations first came to light last week, Gelmato said in a statement that the security services appear to have tried to reach as many mobile phones as possible.

"We cannot at this early stage verify the findings of the publication and had no prior knowledge that these agencies were conducting this operation," the firm said.

"We take this publication very seriously and will devote all resources necessary to fully investigate and understand the scope of such sophisticated techniques."

This article was originally published on 25/2/15 and updated on the same day to include details of Gemalto's investigation.

The Investigatory Powers Tribunal (IPT) has declared British intelligence services acted unlawfully by accessing the personal communications data gathered by the US National Security Agency (NSA).

The IPT, set up 15 years ago to oversee the activities of GCHQ, MI5 and MI6, ruling follows a complaint made by several civil liberties organisations, including Amnesty International, Privacy International, Bytes for All and Liberty.

The Tribunal said the way intelligence was shared between GCHQ and the NSA's Prism surveillance programme was unlawful up until December 2014, because the rules governing the practice were kept secret.

Post-December 2014, this was no longer the case, as the details of it were made public through the work of the Tribunal.

The existence of Prism came to light in a series of disclosures by NSA whistleblower Edward Snowden during the summer of 2013.

Through the programme, it's alleged the NSA was able to access data used by the a wide range of tech giants, including Microsoft, Yahoo, Google and Facebook, and share it with GCHQ if needed.

As a result of today's outcome, Privacy International and Bytes for All have asked for further clarification from the court regarding the interception and collection of their communications data.

If it transpires that their data was unlawfully collected before December 2014, the parties are set to demand its immediate deletion.

They also want to challenge the assertion that GCHQ's activities after December 2014 were lawful, and have vowed to lodge an application with the European Court of Human Rights on this point.

Eric King, deputy director of Privacy International, said the ruling should put an end to security agencies acting like they can operate outside of the law.

"We must not allow agencies to continue justifying mass surveillance programs using secret interpretations of secret laws. The world owes Edward Snowden a great debt for blowing the whistle, and today's decision is a vindication of his actions," he said.

"But more work needs to be done. The only reason why the NSA-GCHQ sharing relationship is still legal today is because of a last-minute clean-up effort by Government to release previously secret arrangements'.

"That is plainly not enough to fix what remains a massive loophole in the law, and we hope that the European Court decides to rule in favour of privacy rather than unchecked State power."

James Welch, legal director for Liberty, added: "The Intelligence Services retain a largely unfettered power to rifle through millions of people's private communications and the Tribunal believes the limited safeguards revealed during last year's legal proceedings are an adequate protection of our privacy. We disagree, and will be taking our fight to the European Court of Human Rights."

Whistleblower Edward Snowden has claimed all iPhones feature spyware that can track users' every move via remote tracking.

The ex-NSA contractor, who was responsible for leaking confidential intelligence documents to expose government spying, thinks the software embedded on iDevices can be switched on by whoever fancies keeping tabs on the owner.

Snowden's lawyer Anatoly Kucherena said: "Edward never uses an iPhone, he's got a simple phone. The iPhone has special software that can activate itself without the owner having to press a button and gather information about him, that's why on security grounds he refused to have this phone."

Neither Kucherena or Snowden revealed what type of spyware is allegedly integrated in the devices or who has access to the data mined from them, although Apple has been accused of spying in the past by Snowden.

The iPhone manufacturer was said to be part of the NSA's PRISM data mining initiative, which apparently allowed the security agency to access SMS messages, on-board data, live microphone feeds, and positioning information from smartphones.

According to other documents, leaked by Snowden to The Independent, British intelligent agency GCHQ also may have used iPhones' UDID identifiers to track people, although none of Snowden's leaked documents so far refer to spyware installed on smartphones.

Apple said in a statement: "Apple has never worked with the NSA to create a backdoor in any of our products, including iPhone. Additionally, we have been unaware of this alleged NSA program targeting our products. We care deeply about our customers' privacy and security."

At the launch of iOS 8, Apple said its newest update prevented any law enforcement officers from accessing personal phone data.

Science is being used to counter "technically aware terrorists", as part of a wider technology push for countering international terror threats, according to the UK government's recent Protecting the UK Against Terrorism policy document.

Because of the nature of the counter-terrorism beast, exactly what technology is being used and how it is being implemented is not in the public domain. That doesn't mean, however, we are unaware that communication monitoring techniques are at the very heart of the surveillance and interception policy and have been for many years.

Indeed, the 1991 Intelligence Services Act and the 2000 Regulation of Investigatory Powers Act give law enforcement and security agencies fairly sweeping authority to intercept and monitor everything from mobile phone calls to email and social media usage.

I'm not going to cover old ground, on the basis that everyone knows about the Edward Snowden revelations by now. However, only a fool would think spies are going to stop spying; it's what they do, and when 'the threat' could be any one of us they will spy on all of us.

I don't like it and there's a very fine line between counter-terrorism and wholesale State monitoring of citizens. Which is why, post-Snowden, the big players have woken up to encryption and the newly-enlightened public's desire to embrace it.

It's also why Robert Hannigan, the UK spymaster general at GCHQ, has accused companies of enabling platforms that have become "the command and control networks of choice" for terrorist groups like ISIS.

Breaking encryption is, one would assume and if you'll excuse the pun, another key to counter-terrorism success. Which is why during a recent visit to Professor Andrew Blyth, director of the Information Security Research Group based at the University of South Wales, I wasn't surprised to learn government agencies have already expressed an interest in his lab's ability to break the device encryption employed by iOS 8.

Intercepting communications will be at the heart of every counter-terrorist investigation, just as it has always been, because as one intelligence officer so aptly put it "terrorists have to communicate." How they communicate, of course, is also part of the growing problem for the counter-terrorism guys.

Looking beyond the cloak and dagger, encoded messages and dark corner conversations, some terrorist communication is much more open. Use of the web, via YouTube videos and social media has become de rigueur when it comes to the distribution of extremist material, propaganda and misinformation alike.

All of which are powerful weapons in the terrorist arsenal, and which have been used with devastating effect recently by ISIS for both showcasing executions and recruiting new fighters for its cause. In an attempt to proactively defend against such tactics, the Metropolitan Police established a dedicated Counter Terrorism Internet Referral Unit (CTIRU) in 2010 that deals with public reports of online content "of a violent extremist or terrorist nature." Since it started, CTIRU has removed some 55,000 pieces of content and 34,000 of those have been in the last year alone.

More controversially, the UK government is putting pressure on Internet Service Providers to block 'extremist' content at source, so that customers would not be able to see it. This blocking would, if successful, take the form of optional filtering such as is already in place for pornographic content, for example.

Quite how effective this might be is one legitimate question being raised by both the ISPs themselves and internet rights groups, with opt-in filters not proving that popular with the public and methods of circumventing them being readily available for anyone who cares to Google for it.

Another legitimate question is who determines what content is extremist, and how is that determination reached? Whenever we talk of political censorship we have to be very careful to be transparent and open, otherwise it's a very slippery slope leading further down the road to state-controlled media.

I appreciate such a view will, no doubt, have some readers on the verge of an aneurysm but there has to be a method of knowing who is blocked and why, and an appeals mechanism for when the system inevitably screws up.

According to CTIRU, examples of what is currently considered extremist include speeches or essays calling for racial or religious violence, videos of violence with messages of glorification' or praise for terrorists, postings inciting people to commit acts of terrorism or violent extremism and messages intended to generate hatred against any religious or ethnic group.

Of course, even if such a method of filtering online material were to be agreed it would need to be implemented by every UK-based ISP to be effective. And there lies the next stumbling block, and one the likes of CTIRU has to deal with: most social media organisations are not based in the UK and are not obligated to remove content when asked to by UK law enforcers.

I'm not saying they won't or don't, but the process is an entirely voluntary one and that's why definitions of extremism and terrorism have to be front and centre of the counter-terrorism tech debate. The international element also raises another concern over counter-terrorism measures when they flow into the social media and online realm, namely who gets to participate in the takedown process? Free speech is a two-way street and with social media being a global game there are players whose politics and definitions of extremism and terrorism differ from ours.

Social media is no longer a two-horse race with just Facebook and Twitter to deal with, smaller players quickly gain traction with the young (who are the main targets of extremist propaganda, remember) and may be less amenable to kicking the freedom of speech ball out of play. Especially in a post-Snowden world where tech companies have seen the backlash when any hint of being in bed with the spymasters becomes public.

Facebook has been outed as the unnamed internet company accused of failing to flag details of an online conversation between one of Fusilier Lee Rigby's killers and a fellow extremist where he outlined plans to kill a solider.

A report published yesterday by the Intelligence and Security Committee (ISC) of Parliament into the circumstances that led to the murder of Lee Rigby in May 2013 said an "unnamed "internet company could have taken steps to prevent it, and the BBC has since confirmed the company in question is social networking giant Facebook.

According to the ISC document, one of the perpetrators of the crime - Michael Adebowale had an online exchange with a fellow extremist where he detailed plans to murder a British soldier in December 2012.

Details of this exchange only emerged after the fatal attack against Rigby took place, but it could have been detected earlier, the report claims, if the social network had flagged it.

The report claims the unnamed communications service provider automatically closed several accounts belonging to Adebowale for terrorism-related reasons without passing on details to the authorities about the nature of his discussions.

"They [the communications provider] had not been aware of the content of these accounts before as they did not routinely monitor content in this way," it was noted.

"GCHQ understands that Adebowale's accounts were disabled as a result of an automated process, where activity met the above descriptors, but that the company did not then manually review the content of these accounts, nor pass any information to the authorities," it adds.

The report goes on to claim that, had the company passed on details of Adebowale's online activities, his discussion with the extremist may have come to light sooner.

"We take the view that, when possible links to terrorism trigger accounts to be closed, the company concerned and other communications service providers should accept their responsibility to review these accounts immediately and, if such reviews provide evidence of specific intention to commit a terrorist act, they should pass this information to the appropriate authority," the report continues.

In a statement to IT Pro, a Facebook spokesperson said the company does take action to prevent terror-related content from being shared on the site.

"Like everyone else, we were horrified by the vicious murder of Fusilier Lee Rigby. We don't comment on individual cases but Facebook's policies are clear, we do not allow terrorist content on the site and take steps to prevent people from using our service for these purposes," the spokesperson said.

The report's conclusion has been criticised by Jim Killock, executive director of privacy organisation The Open Rights Group, who said the government is wrong to use Rigby's murder to build a case for keeping closer tabs on the online activities of UK citizens.

"To pass the blame to internet companies is to use Fusilier Rigby's murder to make cheap political points," he said.

"And it is quite extraordinary to demand that companies pro-actively monitor email content for suspicious material. Internet companies cannot and must not become an arm of the surveillance state."

He goes on to add that mass surveillance, rather than reassure citizens, actually makes them more distrustful of the authorities.

"The security services should focus their efforts on the targeted surveillance of individuals like Michael Adebolajo [Adebowale's accomplice] rather than continuing to monitor every citizen in the UK," Killock continues.

"Mass surveillance erodes the basic trust between citizen and state by treating us all as suspects. If the government keeps finding new ways to justify indiscriminate whole population trawls, it will be fair to say that we have lost our liberty and the terrorists have won."

The Internet Service Providers' Association (ISPA) has also hit back at the report's suggestion that online comms providers should do more to keep tabs on users, and that the internet as a whole has become a "safe haven for terrorists."

In a statement, the ISPA said: "It is for the intelligence agencies and not service providers to identify potential subjects, and when identified by the authorities CSPs (communication service providers) can and do assist in providing communications data under a clear legal process.

"The proposal that companies should monitor all communications online runs counter to the legal framework that underpins the internet, which forbids unwarranted monitoring of customers' communications.

ISPA and its members are in active discussions around communications data capabilities, including the current Anderson Review, and the ISC's report adds to the ongoing discussions," it concluded.

This article was originally published on 25 November, before being updated with further comment from Facebook, the ISPA and others.

The new boss of GCHQ, Robert Hannigan, has warned that social networking sites have become central to terrorist groups and tech giants need to work more closely with spy agencies to address this.

In an article in the Financial Times, Hannigan said however much the tech companies may dislike it, "they have become the command and control networks of choice for terrorists and criminals, who find their services as transformational as the rest of us."

While not singling out Facebook or Twitter, Hannigan said social media sites are used by terrorists to disseminate propaganda and communicate with other members and the wider world.

YouTube was used to show beheadings of journalists and aid workers. These videos were quickly spread on Twitter.

Hannigan said freely available technology has helped terror groups hide from the security services and said major tech firms were "in denial" about this. He added that smartphones and tablets had "increased the options available exponentially" to conceal terrorist activity.

Furthermore, privacy is not an "absolute right", he continued, and GCHQ has to enter the debate over it.

"GCHQ is happy to be part of a mature debate on privacy in the digital age. But privacy has never been an absolute right and the debate about this should not become a reason for postponing urgent and difficult decisions," he said.

"I think we have a good story to tell. We need to show how we are accountable for the data we use to protect people, just as the private sector is increasingly under pressure to show how it filters and sells its customers' data."

Eric King, deputy director of Privacy International, told the Guardian that it was "disappointing to see GCHQ's new director refer to the internet the greatest tool for innovation, access to education and communication humankind has ever known as a command-and-control network for terrorists."

King added that GCHQ had lost the trust of the public and does need to enter a public debate over privacy "but attacking the internet isn't the right way to do it."

UK surveillance service GCHQ has teamed up with the Cyber Security Challenge (CSC) to launch a virtual game, dubbed Astute Explorer, to encourage more people to consider a career in information security.

In the game, which is named after GCHQ's automated code scanning tool, players are tasked with deciphering a code to locate vulnerabilities, and explain how hackers could exploit these to carry out a cyber attack against fictitious aerospace and engineering company Ebell Technologies.

Stephanie Daman, CEO of the Cyber Security Challenge, said: "Astute Explorer is an ingenious game from GCHQ which will not only provide an enjoyable challenge but will test skills that are in high demand by employers in this sector."

The game is part of a series of initiatives that Cyber Security Challenge has rolled out over the past year, and follows on from a task set by security vendor Sophos over the weekend, which asked the public to analyse a hard drive obtained from faux hacking group the Flag Day Associates.

As a result of that task, participants were made aware of a cyber threat by the Flag Day Associates against Ebell, and the shape that potential attack could take is what Astute Explorer is designed to ascertain.

This is the fourth year CSC has run a national competition like this, designed to draw talented people into the cyber security profession. GCHQ is one of CSC's platinum sponsors and one of the three UK-based intelligence agencies.

Participants who show the most promise will be invited to report for duty at secret locations scattered around the UK, investigating face-to-face in teams.

Successful candidates will take on the Flag Day Associates hacker group at the Masterclass final next year. Anyone living in the UK is invited to participate.

Those interested in taking part can register to play here.

A lack of skills in cyber security among UK graduates could lead to increased risk for businesses, industry leaders have warned.

According to statistics, only 0.6 per cent of recent graduates (2012-2013) are currently working in the cyber security sector, with others left unprepared when leaving computer science degree programs. Many technology qualifications reportedly gloss over the issue of security, creating a significant skills gap.

The concerns were brought to light by a study from the International Information Systems Security Certification Consortium, which revealed that less than 1 per cent of the 7,635 computer science graduates across the UK were working in cyber security positions.

Dr Yiannis Pavlosoglou, risk and security specialist at YBS, told the Financial Times: "The majority of graduates coming out of UK computer science and computing departments have not spent the necessary amount of time with the basic principles that govern information security and risk management."

In terms of cyber security, computer science graduates may not have an advantage over those coming from other subjects, Dr Adrian Davis, European director of IISSCC has claimed.

Organisations have been warned about this shortcoming inherent to many recent graduates, with those in the industry pointing out the risk they pose to cyber security when unable to properly protect sensitive data, extending to basic tasks such as data disposal.

"It is like building a house without locks," Derrick Bates, senior information security officer for the North Cumbria University Hospitals NHS Trust added. "What is the point in universities turning our great software developers and web designers if they have no idea how to design them securely."

In an effort to address the problem, GCHQ has approved six masters degrees focused on online security. These include offerings from Edinburgh Napier University, Lancaster University, the University of Oxford and Royal Holloway and University of London.

GCHQ said of the accreditations: "The National Cyber Security Strategy recognises education as key to the development of cyber security skills and, earlier in the year, UK universities were invited to submit their cyber security Masters degrees for certification against GCHQ's stringent criteria for a broad foundation in cyber security.

"Partnerships have been key throughout the process with the assessment of applicants based on the expert views of the industry, academia, professional bodies, GCHQ and other government departments."

Lawyers representing GCHQ and the government will appear before the Investigatory Powers Tribunal (IPT) to decide if the spy agency violated laws with surveillance activities unearthed by revelations from Edward Snowden.

The IPT will also hear complaints from privacy campaigners Liberty, Privacy International, Amnesty International as well as several other groups from abroad. The case will be heard at the Royal Courts of Justice.

The case has been lodged with the IPT to challenge a ruling in July 2013 by the Intelligence and Security Committee (ISC) that the use of data collected during the Prism programme was legal.

It is the first of several to be examined by the tribunal. The civil liberties groups alleged that private communications may have been monitored under GCHQ's Tempora programme. The groups also said that data gained through the NSA Prism programme might have been shared with UK spy agencies, which circumvented UK legal protections.

"The UK government is manipulating national laws to ensure it can continue to flout international ones," said Michael Bochenek, senior director for Law and Policy at Amnesty International.

"For the first time, UK intelligence agencies will have to answer for their activities and defend their indefensible policy for mass surveillance," Bochenek said.

In a witness statement to the tribunal, Charles Farr, the director general of the Office for Security and Counter Terrorism, said that sharing intelligence with foreign agencies had led to terrorist attacks being prevented.

He added that interception under the Regulation of Investigatory Powers Act 2000 (RIPA) is a "critical tool in investigations into the full range of threats to national security". In Farr's submission to the court he said he could "neither confirm or deny" the existence of Tempora, but did acknowledge Prism's existence as it had "been expressly avowed by the executive branch of the US government".

The tribunal may hear some of the most sensitive evidence regarding interceptions in private. It will look at whether Tempora and Prism exist and also whether either violates articles 8 and 10 of the European Convention on Human Rights.

The case comes after emergency surveillance legislation was brought in and is expected to pass in a couple of day's time. The legislation has been fast tracked after back room deals were made between the government and opposition parties.

The National Security Agency (NSA), set up to combat foreign and domestic intelligence threats to the US, has had its reputation turned upside down since whistleblower Edward Snowden began to leak details of its clandestine activities.

In the past year, Snowden's leaks have revealed more than 40 separate intelligence campaigns undertaken by the NSA or its UK allies at GCHQ.

Among the most infamous was the news the NSA had been infiltrating the data centres of US technology companies - including Facebook, Microsoft and Google - and snatching user data from the traffic.

Upstream and PRISM, the names of the surveillance operations that conducted those clandestine acts, caused outrage throughout the technology industry and the world. People began to wonder if their data was truly safe in the hands of the big companies and on the internet.

The ripples of that discovery can still be felt today, as companies attempt to side-step their involvement or relocate their services to assuage worried customers.

Yet those two operations were only part of myriad of projects the NSA and GCHQ have undertaken. The details of many more have been released by Snowden over the past year, some of which you might never even have heard of.

Angry Birds

Nowhere is safe from the prying eyes of government agencies, it seems, not even much-loved mobile game Angry Birds.

As soon as a player opened up the game and began their bird-slinging adventures, algorithms within the game's code relayed their age, sex and other information to intelligence agents.

This is according to documents leaked from GCHQ, which revealed how it and the NSA had been working on ways to tap into mobiles and collect data through apps. Not just Angry Birds fell foul of the surveillance program: Google Maps, Facebook, Twitter and LinkedIn were also targeted.

"It effectively means that anyone using a smartphone is working in support of a GCHQ system," a secret 2008 report by the British agency said.

NoseySmurf

Also known by the names "TrackerSmurf" and "DreamySmurf", the NoseySmurf project tied into the Angry Birds scheme by tapping into mobile phones to scrape data from users.

The NSA spent over $1 billion (580 million) in its search to find more efficient tracking and piggybacking methods for infiltrating targeted devices. In one top-secret presentation, the agency describes a victim uploading an image to Facebook from their phone as a "Golden Nugget!!"

From the simple act of someone uploading a picture to a social media site, later slides say, agents could glean a victim's contacts, location, gender, age, income, ethnicity, education level and even number of children.

HappyFoot

HappyFoot was the codename for an operation designed to track internet users' movements by piggybacking onto their cookies and location data.

When a consumer visits a site cookies are enabled on their computer, allowing the site's company to tailor advertisements to them, something government snoops were keen to exploit.

Slides released by Snowden and published by the Washington Post revealed the NSA had been latching onto these cookies in order to identify possible targets for further hacking operations.

Using a unique cookie from Google called PREF, intelligence agents could pick out one person from a sea of internet data in order to focus on them specifically. The NSA slides indicated that Google complied with this action entirely after being compelled to by the US government.

Squeaky Dolphin

There's a prize for anyone who can understand the reasoning behind this codename. Squeaky Dolphin was an initiative thought up by the UK's GCHQ. It involved tapping into the cables carrying the world's web traffic in order to monitor what people are up to on social media.

Documents leaked to NBC news by Snowden revealed how British spies showed off their new invention to their US counterparts. GCHQ demonstrated how it could monitor YouTube in real time and collect addresses from the billions of videos watched every day.

Analysts demonstrated how, through a central information hub, they could determine which videos were popular in which cities and at what times, as well as what each demographic preferred to click on.

The UK spooks did mention to their allies that this program was for general trends only and not for spying on individuals, but there are as yet unconfirmed rumours GCHQ used the tech to target Twitter users with propaganda.

Gilgamesh

Unfortunately, this operation has nothing to do with the fifth king of Uruk Mesopotamia.

According both to documents released by Snowden and the testimony of a former drone operator, the NSA used telecommunications devices as targets for drone strikes.

Rather than confirming with operatives on the ground, said the whistleblower, the NSA would identify a target based on the geolocation of their phone and order an assassination.

The drone operator was adamant the technology was aiding the War on Terror but that civilians were "absolutely" being killed en masse by the strikes.

Terrorists cottoned on to the NSA's idea, though, and began to mix up their SIM cards to avoid being tracked. Commanders would switch them with footsoldiers and footsoldiers with civilians.

The NSA often located targets based on their activity levels and not on the content of the calls, resulting in, according to the former pilot "death by unreliable data."

EgotisticalGoat

EgotisticalGoat and its sister program, EgotisticalGiraffe, were designed to help facilitate attacks on people using the anonymous network Tor.

Techniques included targeting web browsers like Firefox and giving the NSA full control over a target's computer keystrokes, online activity and files.

The Tor network is relied upon by journalists, activists and campaigners around the world to maintain the secrecy of their communications and avoid reprisals from their respective governments.

The network, oddly enough, is provided with 60 per cent of its funding by the US government.

Agents operating EgotisticalGoat admitted the Tor network was too large for them to completely crack. In one top-secret presentation named "Tor Stinks" it stated "We will never be able to de-anonymize all Tor users all the time ... with manual analysis we can de-anonymize only a very small fraction of Tor users."

With more information to come from Snowden, who claims his leaks to date are just the tip of the iceberg, do we have more cause for concern over our data than ever before? Are all of these operations a gross misconduct or a necessary evil? Let us know what you think by emailing us at comments@itpro.co.uk.

Seven Internet Service Providers (ISPs) from the UK, US, Netherlands, South Korea and others have banded together to take the UK intelligence service GCHQ to court.

It is the first time GCHQ has had to defend itself in court to a corporate body and it will have to answer snooping accusations that stem from the Edward Snowden leaks.

The group claim the government agency performed a series of "network attacks" that undermined "the goodwill the organisations rely on".

Charges filed against GCHQ include claims that Belgian telecoms company Belgacom was infected with malware, that the agency used intrusion technology to covertly monitor communications and that it spied on internet traffic flowing through Germany.

The ISPs involved in the case are GreenNet (UK), Riseup (US), Greenhost (Netherlands), Mango (Zimbabwe), Jinbonet (South Korea) People Link (US) and Chaos Computer Club (Germany).

All seven are noted as being easy targets' as they are not independent firms and not the major service provider in their respective countries.

A supporter of the case, Privacy International, claimed "the type of surveillance being carried out allows them to challenge the practices... because they and their users are at threat of being targeted."

The campaign group has filed two similar cases in the past against the surveillance programmes Tempora, Prism and against GCHQ's deployment of spyware.

"These widespread attacks on providers and collectives undermine the trust we all place on the internet and greatly endangers the world's most powerful tool for democracy and free expression," said Eric King, deputy director of Privacy International

Cedric Knight, of ISP GreenNet, added: "Snowden's revelations have exposed GCHQ's view that independent operators like GreenNet are legitimate targets for internet surveillance, so we could be unknowingly used to collect data on our users. We say this is unlawful and utterly unacceptable in a democracy."

GCHQ told the BBC that all its work is conducted "in accordance with a strict legal and policy framework which ensures that our activities are authorised, necessary and proportionate".

The Government Communications Headquarters (GCHQ) has announced the first stage of a pilot scheme allowing communications service providers to receive intelligence regarding cyber attacks earlier than was previously possible.

The initiative was revealed in the closing keynote of the private government IA14 security conference in London by Iain Lobban who will be leaving his post as director at the agency this year.

Lobban said the pilot scheme will protect those at risk of cyber attacks through the sharing of data the government and individual organisations already hold.

"Ultimately, we're seeking to use our unique capabilities and the range of insights gleaned from our intelligence and security work to offer at scale and pace classified information about threats to the UK's most critical networks," he told the group of central government, public sector, industry and academia decision-makers.

"They will be able to use this privileged awareness to take early action on the networks they manage, whether government or other critical UK networks," he continued.

The initiative will help those involved in the scheme act as the UK's first line of defence in countering cyber threats to the nation from state actors and cyber criminals, Lobban explained.

Previously, CERT-UK was the main body to deliver support to the industry and to provide information and advice regarding cyberthreats, but GCHQ's new initiative will embrace a more automated process and will extend beyond CERT-UK's partners.

Although the initial stages of the pilot will only involve service providers, there are plans to extend this to other industries in the future.

Martin Sutherland, managing director of BAE Systems Applied Intelligence, commented: "It is essential that we continue to improve the ways in which government and industry work together and we welcome this bold step by GCHQ to improve the quality of threat intelligence that the private sector has access to it will help to protect consumers, businesses and the economy as a whole."

The Communications and Electronics Security Group (CESG) has published security guidance to enable organisations to safely deploy BlackBerry 10.2.1, Android 4.4 and Chrome OS devices.

The information security arm of GCHQ has revised its rules to assist those working in IT departments on how best to rollout and use these mobile operating systems securely.

The updated guidance is available now on Gov.uk and forms part of the Cabinet Office's End User Device Security Framework. It shows how the platforms can be configured to meet security recommendations and details the threats and other security problems for each of them.

It said the advice aims to "take a balanced approach between security and usability for remote or mobile working devices" by helping to reduce common risks to an organisation's information while still providing flexibility and ease of use.

There is also information on system architectures for deploying the devices. The CESG said the advice was not an endorsement of the platforms and only there to improve the UK's overall cyber security stance.

"Rather than being an 'approval' or 'endorsement' by CESG of any of these products, this guidance helps organisations to understand and manage the risks associated with the different devices, as part of their normal risk management processes," it said.

It added that each platform's virtual private network (VPN) and encryption efforts should be areas organisations should be aware of and manage appropriately.

It said Chrome OS's VPN "has not been independently assured to Foundation Grade, and does not currently support some of the mandatory requirements expected from assured VPNs."

"The VPN can be disabled by the user and some Google traffic is sent prior to the VPN being established resulting in potential for data leakage onto untrusted networks. Without assurance in the VPN there is a risk that data transiting from the device could be compromised," it added.

It also noted similar problems with Android's VPN as well as pointing out the lack of security of SD cards and non-data partitions. Blackberry OS 10.2's VPN and native data encryption also fell short, according to the CESG.

Minor updates have also been made to guidance for iOS 7, Windows 7 and Windows 8.1.

British intelligence and security organisation GCHQ hacked Belgian telecommunications company Belgacom via spoof employee LinkedIn profiles.

The top secret' project was leaked by NSA whistleblower Edward Snowden in a presentation and revealed the victim would not have known they were being watched because the malware was invisible to them.

Profiles would have displayed as normal despite being fake set-ups, not hosted on LinkedIn - but the malware allowed intelligence officers to access their computers.

The majority of those targeted worked in network maintenance and security for the company.

LinkedIn has denied having anything to do with the hack, saying it takes the privacy of its users very seriously and "does not sanction the creation or use of fake LinkedIn profiles or the exploitation of its platform for the purposes alleged in this report. To be clear, LinkedIn would not authorise such activity for any purpose,' and was not notified of the alleged activity."

When the GCHQ had managed to access the computers of engineers, they were able to access information about the company and its subsidiary BICS, which operates a GRX router system that allows people to make and receive calls or use data abroad.

This enabled the organisation to access data about the locations of targets and who they are communicating with.

Mobile networks expert Philippe Langlois told German website Spiegel: "This way, an intelligence service could read the entire Internet communications of the target and even track their location or implant spying software on their device."

He explained, since there are several hundred wireless companies, but only about two-dozen GRX providers worldwide, it is a much easier way to track the activities of targets.

The presentation revealed by Snowden (and reportedly seen by Spiegel) mentioned other telecommunications companies GCHQ was interested in, including Swiss company Comfone and Mach, which is now owned by Syniverse and Starhome Mach.

The document went into detail about a particular employee at Mach, listing all the devices he uses, identifying work devices and personal technology. GCHQ is said to have accessed cookies on his computer and lists his Skype name, Gmail user name and other social accounts he uses.

In January this year, GCHQ was accused of hacking mobile apps Angry Birds and Google Maps to collect user data with the NSA.

It was another of the security leaks revealed by Snowden and it's said the organisations were trying to take advantage of "leaky apps" that inadvertently spill details about the age, sex and location of their users.

GCHQ, the UK Government listening post, intercepted the web chats of millions of Yahoo customers in a programme codenamed Optic Nerve, it has been alleged.

According to documents shared with The Guardian by Edward Snowden, users who were not suspected of any wrongdoing had their webcam images intercepted and stored by the British intelligence agency, working in collaboration with its American counterpart the NSA.

The Guardian claims the documents it has received show the programme from 2008 until at least 2012 and was being used for experiments in facial recognition.

Those targeted would, without their knowledge or consent, have a freeze-frame image from their chat taken every five minutes and stored by the NSA, the publication said.

It is alleged that in just one six-month period in 2008 the agency collected webcam images "including substantial quantities of sexually explicit communications" from over 1.8 million Yahoo user accounts worldwide.

Indeed, the scale of intimate imagery being collected through Optic Nerve between 3 and 11 per cent was believed to contain "undesirable nudity" led to GCHQ trying to find a way to make it "safer to use".

The revelation that Yahoo's webcam chat facility has allegedly been used as a conduit for broad-based, untargeted spying has provoked a furious response from the internet giant.

In a statement, Yahoo said: "We were not aware of nor would we condone this reported activity. This report, if true, represents a whole new level of violation of our users' privacy that is completely unacceptable and we strongly call on the world's governments to reform surveillance law consistent with the principles we outlined in December.

"We are committed to preserving our users' trust and security and continue our efforts to expand encryption across all of our services."

US and British surveillance agencies have been accused of using Angry Birds and other popular smartphone apps to gather users' personal information.

That's according to the latest round of revelations from National Security Agency whistleblower Edward Snowden, which have been made public by the New York Times and Guardian newspaper.

It's claimed the NSA and its British counterpart GCHQ have colluded on how to take advantage of "leaky apps" that inadvertently spill details about the age, sex and location of their users.

These include mapping, gaming and social networking apps, although the amount of data that's been collected in this way is not yet clear, nor is the number of users likely to be affected.

The documents suggest GCHQ and the NSA have "traded methods" for collecting location data from Google Maps users, along with address book and phone log data when users post pictures to mobile versions of Facebook, Flickr, LinkedIn and Twitter.

The report claims the two surveillance agencies have been working on ways to collect and store these types of data since 2007.

Its work to-date has reportedly focused on collecting data from older apps, but newer ones including Angry Birds are being targeted too, the latest tranche of documents from Snowden suggest.

In particular, they set out how to obtain information from Angry Birds running on Android-based devices.

The latest revelations come hot on the heels of President Obama's pledge earlier this month to curb the surveillance activities of the NSA.

In a statement to the New York Times, the NSA insisted it does not profile "everyday Americans" during its foreign intelligence missions.

"Because some data of US persons may at times be incidentally collected in NSA's lawful foreign intelligences mission, privacy protections for US persons exist across the entire process," the statement added.

GCHQ declined to comment, aside from saying its activities complied with British law.

The US National Security Agency (NSA) has been collecting up to 200 million SMS text messages every day, according to a report in The Guardian.

The revelations came through a joint investigation with Channel 4 News. The NSA managed to collect large volumes of text messages through its Dishfire surveillance programme. The agency then sifts through the messages and analyses them.

Documents leaked by whistleblower Edward Snowden revealed the NSA selects random targets and collects SMS messages from them regardless of who they are.

The NSA has also been colluding with GCHQ on the surveillance programme with the former sharing access to the SMS messages with the latter. According to slides released by the newspaper, the operation has been running since 2008.

The programme managed to collect 1.6 million notifications when people roamed from one network to another and around 800,000 messages relating to financial transactions.

With such a large amount of data collected, the NSA had to create an automated scanning tool, dubbed Prefer, to extract key metadata from the messages to "enhance current analytics".

However, an NSA spokeswoman played down the reports and told The Guardian the tool was only used "against foreign intelligence targets".

Dishfire has also helped Britain's spies as it has collected a lot of information on UK citizens without needing to make formal requests under the Regulation of Investigatory Powers Act.

A GCHQ spokesman said the organisation would not comment on intelligence matters.

"All of GCHQ's work is carried out in accordance with a strict legal and policy framework which ensures that our activities are authorised, necessary and proportionate, and that there is rigorous oversight, including from the Secretary of State, the Interception and Intelligence Services Commissioners and the Parliamentary Intelligence and Security Committee," he told The Guardian.

In other NSA-related news, President Obama is set to outline changes later today he wants the surveillance organisation to make to the way it operates.

Leaked NSA documents have revealed that the spy agency used Google's advertising cookies to identify and track targets in a hacking operation.

According to reports by the Washington Post, based on documents leaked by NSA whistle-blower Edward Snowden, both the NSA and GCHQ used the cookies to help track users across the internet.

The operation used Google's PREF cookies, which are used by the search giant to provide personalised web pages for users based on previous browsing habits and preferences.

While the cookies don't contain information such as usernames or email addresses, they do contain details such as location, language preference, search engine settings, number of search results to display per page as well as other bits of information that advertisers can use to identify a particular browser.

The newspaper said that these cookies along with those from other companies have allowed the NSA to track user habits and allow remote exploitation of computers.

While the document does not say how the NSA obtained the cookies, other documents unearthed by Washing Port reporters said the agency could have made a direct request to Google using a Fisa order. Under the Fisa law, Google would not have been allowed to inform users of such an action by the NSA.

The cookies were collected by NSA's Special Source Operations (SSO) unit and are sent to the agency's Tailored Access Operations (TAO) unit. This specialises in offensive operations such as infecting target computers and networks with malware designed to obtain information and create backdoors.

As reported by sister publication PC Pro, a Lib Dem MP is pushing for greater protection for UK citizens from online spying. Former minister David Heath called for new laws to prevent spy agencies from tapping emails and calls without a warrant.

Heath wants loopholes in the Regulation of Investigative Powers Act 2000 and the Intelligence Services Act 1994 that allow wholesale data collection to be closed.

GCHQ and the NSA both infiltrated games such as World of Warcraft and the Xbox Live platform as part of their Prism operations, it has emerged.

The Guardian reported the campaign of spying was leaked in a document from Edward Snowden.

The document, entitled Exploiting Terrorist Use of Games & Virtual Environments, was written in 2008 and claimed games were a "target rich communications network" and that agencies slurped up vast amounts of data.

The NSA said the games could allow surveillance targets to hide in plain sight.

"We know that terrorists use many feature-rich internet communications media for operational purposes such as email, VoIP, chat, proxies, and web forums and it is highly likely they will be making wide use of the many communications features offered by Games and Virtual Environments (GVE) by 2010," the document said.

"The SIGINT Enterprise needs to begin taking action now to plan for collection, processing, presentation, and analysis of these communications."

The document also show how spy agencies tried to recruit informants to help find terrorists using games as a cover.

However, so many spies infiltrated the games leading to spy agencies setting up a "de-confliction" group to make sure agents didn't erroneously spy on each other.

It is unclear if the action taken by spies to infiltrate games ever resulted in the foiling of a terrorist plot. The document said the "amount of GVEs in the world is growing but the specific ones that CT [counter-terrorism] needs to be methodically discovered and validated. Only then can we find evidence that GVEs are being used for operational uses."

In a statement, Blizzard Entertainment, the company behind World of Warcraft, said: "We are unaware of any surveillance taking place. If it was, it would have been done without our knowledge or permission."

Microsoft also made similar statements.

The news comes as a group of major tech companies have asked the US government to reform surveillance laws.

Tech firms including Apple, Facebook and Google have co-authored and co-signed a letter to US President Barack Obama and the US Congress petitioning them to reform government surveillance practices across the globe.

The action has been taken in light of continuing revelations from former NSA contractor Edward Snowden regarding the widespread use of interception techniques by the American National Security Agency (NSA) and its UK equivalent GCHQ to monitor internet traffic and electronic communications.

The letter, which has been published on reformgovernmentsurveillance.com, says: "We understand that governments have a duty to protect their citizens. But this summer's revelations highlighted the urgent need to reform government surveillance practices worldwide.

"The balance in many countries has tipped too far in favour of the state and away from the rights of the individual rights that are enshrined in our Constitution. This undermines the freedoms we all cherish. It's time for a change."

The companies, which include AOL, Apple, Facebook, Google, LinkedIn, Microsoft, Twitter and Yahoo, are urging the US to take the lead in carrying out this reform.

In an individual comment posted on the same website, Larry Page, Google's CEO, said: "The security of users' data is critical, which is why we've invested so much in encryption and fight for transparency around government requests for information.

"This is undermined by the apparent wholesale collection of data, in secret and without independent oversight."

Facebook CEO Mark Zuckerberg added: "Reports about government surveillance have shown there is a real need for greater disclosure and new limits on how governments collect information.

"The US government should take this opportunity to lead this reform effort and make things right."

However, Rafael Laguna, CEO of open source software firm Open-Xchange, criticised their arguments as "flawed".

"This very public display of unity is essentially an acknowledgement from these large internet companies the public has begun to lose trust in them, and as a result in the internet as a whole.

"However, a fundamental flaw in their argument is the double standard of condemning governments for data surveillance, while at the same time harbouring the unquantifiable amounts of data that governments wish to access in the first place."

He added: "Charity begins at home, and the first step to rebuilding trust in an open internet is to address their own data retention policies before pointing the finger elsewhere."

Further revelations from the Snowden Papers this week include the infiltration of Massive Multiplayer Online (MMO) games, such as World of Warcraft, and digital communities by the NSA and GCHQ in order to spy on and, in some cases attempt, to recruit users.

Separately, Washington Post has allegedly uncovered the FBI's use of malware in order to track down a suspect who made repeated bomb threats online.

The agency also requested to be allowed to activate the suspect's webcam remotely, but a judge ruled such an action would be excessively intrusive and could violate his fourth amendment right to protection from unreasonable searches and seizures.

The Home Office's counter-terrorism chief has reiterated the government's willingness to pass the Communications Data Bill, better known as Snooper's Charter, despite evidence of mass surveillance uncovered by whistleblower Edward Snowden.

The bill would make it easier for law enforcement and intelligence agencies to access communications data, forcing ISPs and internet firms like Facebook and Google to store information on users for at least 12 months.

It was supposed to have been killed off by deputy prime minister Nick Clegg, but a number of government officials have attempted to keep it alive, using terrorist events such as the death of Lee Rigby as evidence that more powers are needed.

Charles Farr, head of the office of security and counter-terrorism, told the Home Affairs Select Committee yesterday that home secretary Theresa May supported him in his bid to get Snooper's Charter back on the table.

He said that the powers were needed, claiming GCHQ had "never collected the data required by law enforcement". "GCHQ has never and will never collect the communications data required by law enforcement which we were seeking to provide for in the communications data legislation," he added, according to the Guardian.

"Of course they do collect communications and communications data. My point was specifically about the UK and the data we were seeking to obtain through legislation. GCHQ cannot provide that data itself."

Farr's claim appears to be at odds with what the head GCHQ Iain Lobban said during a meeting with the Intelligence and Security Committee last week. Talking about GCHQ's work on tracking people using modern technologies, Lobban talked up the agency's work to "uncover the identities and track down some of those who are involved in online sexual exploitation of children within the UK".

The Home Office has repeatedly said law enforcement needed the additional powers to fight terrorists and track paedophiles - the same targets as GCHQ.

Privacy advocates remain deeply concerned about the bill and the Snowden revelations.

"There's no doubt Charles Farr will seek to get the Snooper's Charter into law. But he'd be unwise to do so, as he'd open up the whole surveillance debate," Jim Killock, executive director of the Open Rights Group, told IT Pro.

"We do need that debate, although it should be focused directly on accountability. It's farcical to imply, as Farr did, that there is no need for everyone to know that GCHQ are hoovering up as much data as possible. That ought to be the subject of a specific parliamentary decision, not built on the back of warrants designed for targeted surveillance operations."

Tim Berners-Lee, the British computer scientist who invented the World Wide Web, has hit out at spies who cracked encryption to monitor communications on the internet.

His comments, made in an interview with The Guardian, come ahead of a the first ever appearance of the heads of UK intelligence agencies MI5, MI6 and GCHQ together in front of Parliament's Intelligence and Security Committee at 2.00pm today.

Referring to the Prism internet monitoring scandal, Berners-Lee said the decision by spy agencies in the UK and US to crack open encrypted communications was both "appalling and foolish." He added that it was also counterproductive for their efforts to fight cyber crime and cyber warfare as it weakens online security.

"It's nave to imagine that if you introduce a weakness into a system you will be the only one to use it," Berners-Lee said, likening the behaviour of the agencies to those of a totalitarian state," he said.

"Any democratic country has to take the high road; it has to live by its principles. I'm very sympathetic to attempts to increase security against organised crime, but you have to distinguish yourself from the criminal."

He also slammed the oversight of surveillance by UK and US authorities as "dysfunctional and unaccountable," while commending the Guardian's reporting on the issue of Prism and whistleblower Edward Snowden.

GCHQ is descended from the UK Governmenr Code & Cypher School (GC&CS), which was founded during the First World War and whose employees, including Alan Turing, famously broke the German Enigma Code during the Second World War.

IT Pro will be reporting the news from the Intelligence and Security Committee hearing later today.

The information security arm of GCHQ has expanded its Government network certification programme to include private sector firms responsible for safeguarding industry networks.

The CESG Certified Professional (CCP) scheme was launched in October 2012 to certify the skills of cyber security professionals tasked with looking after Government networks.

According to CESG, nearly 700 cyber security professionals have succeeded in becoming certified through the scheme, which is operated by several certification bodies.

They include the APM Group, the BCS, and IISP, CREST and Royal Holloway ISG consortium.

However, the scheme is now being extended to include IT professionals responsible for protecting all industry networks from threats and vulnerabilities, as part of the CESG's plans to create a community of people with recognised qualifications in cyber security.

All qualifications awarded through the scheme are valid for three years.

Guest Editor Ken Deeks says:

"The extension of the CCP scheme by GCHQ to include private sector firms is a brilliant move.

"This swiftly follows the announcement of the joint cyber reserve scheme which aims to recruit hundreds of computer experts as 'cyber reservists'.

"Both initiatives have a good chance of success because they are both practical and highly collaborative.

"It sends out a signal that the industry as a whole has a responsibility to safeguard all networks - private and government - and this can only be a good move in the fight against cybercrime."

"I would particularly encourage those organisations...to endorse the scheme and help build a community of UK cyber security professionals that is the envy of the world," he added.

Chloe Smith, minister for political and constitutional reform, hailed the popularity of the scheme to date.

"Since its launch last year, the CESG Certified Professional scheme has been warmly welcomed and endorsed by Government cyber security professionals," she said.

"With demand growing from industry to be part of the scheme, now is the right time to open up CCP and set a unified standard for cyber security professionals right across the UK."

The scheme is a central part of the Government's wide-ranging Cyber Security Strategy, which aims to bolster the number of recognised cyber security experts in the UK.

The announcement about its extension follows on from the launch of the Government's Joint Cyber Reserve scheme, which was announced over the weekend.

Its aim is to recruit hundreds of computer experts as "cyber reservists" who will be tasked with defending the UK's cyber defences.

GCHQ and the US National Security Agency (NSA) have reportedly cracked many of the encryption methods used to protect web users' personal data and online transactions.

The claim has been published in a joint article by the Guardian newspaper, the New York Times and Propublica, and is based on confidential documents leaked by notorious NSA whistleblower Edward Snowden.

The report claims the security agencies allegedly have the means to unravel the encryption used to protect emails, banking transactions and medical records.

This has reportedly been made possible through the employment of supercomputers that use brute force to crack encryption methods.

It is also claimed the agencies have colluded with tech firms and internet service providers to insert vulnerabilities into commercially available encryption software.

The Snowden documents suggest the NSA invests around $250 million a year in working with technology companies to influence their product designs, and claims the Agency considers its decryption work to be "the price of admission for the US to maintain unrestricted access to...cyberspace."

GCHQ, meanwhile, has been accused of trying to find a way into Hotmail, Google, Yahoo and Facebook's encrypted traffic.

The documents claim the NSA has been involved in a decade-long encryption-busting programme, which made a major breakthrough in 2010 that has resulted in "vast amounts of encrypted internet data" becoming exploitable.

Exact details about the discovery that made this possible was not disclosed in the documents.

The Guardian report is the latest in a long line of revelations about GCHQ and the NSA's alleged surveillance techniques, which have been trickling out since Snowden started releasing documents back in June 2013.

GCHQ has announced it is putting in place two incident response operations that could protect critical national infrastructure from hackers.

CESG, the Information Security arm of GCHQ, and the Centre for the Protection of National Infrastructure (CPNI), has been running pilot programmes of the initiatives since November 2012.

Following the success of the pilots, it was decided that a twin-track approach was needed to protect infrastructure critical to the UK as well as defending public and private sector organisations.

The first scheme is 'broad-based' and will be led by the Council of Registered Ethical Security Testers (CREST), the professional body representing the technical security industry. Endorsed by GCHQ and CPNI, it will focus on "appropriate standards for incident response aligned to demand from all sectors of industry, the wider public sector and academia."

The second scheme is a smaller and more focused Government run Cyber Incident Response scheme certified by GCHQ and CPNI responding to sophisticated, targeted attacks against critical national networks.

GCHQ said that the approach would help organisations under cyber attack to "source an appropriate incident response service tailored to their particular needs and allow GCHQ and CPNI to focus on the most challenging attacks."

"We know that UK organisations are confronted with cyber threats that are growing in number and sophistication," said cyber security minister Chloe Smith.

"The best defence for organisations is to have processes and measures in place to prevent attacks getting through, but we also have to recognise that there will be times when attacks do penetrate our systems and organisations want to know who they can reliably turn to for help."

Industry figures have given their support to the scheme. Rob Cotton, chief executive of NCC Group said that this was a "a great example of government and industry working together to help improve standards of cyber security for businesses across the board."

"Having clear channels of help and support in place when the worst does happen will provide organisations with a massive boost, and also remove the confusion and panic in the immediate aftermath of a breach."