John Ferris - Behind the Enigma: The Authorized History of GCHQ, Britain’s Secret Cyber-Intelligence Agency

BEHIND THE ENIGMA

Contents

This account of GCHQs history brilliantly brings to life many of the people and events that have shaped this critical institution over the past 100 years. It shows how far we have come, as well as the broader impact made by our predecessors in developing the technology that enables all of our lives today.

I often wonder what the men and women who founded the Government Code & Cypher School in 1919 would make of the modern GCHQ and what would they think of the organisation we are building for the future?

I hope they would recognise their legacy. Certainly, they would see themselves reflected in the brilliant people working tirelessly, and with great integrity, to keep the country safe. I expect they would be proud to see that the values they forged in those early days still underpin everything we do. They would also be pleased that the partnerships they started to develop with Defence, MI5 and MI6, European allies and with the Five Eyes alliance and beyond have not only stood the test of time but have become an integral part of what GCHQ is.

In 1919 the country was dealing with the fallout of a global pandemic and, as I write this, the world is battling a similar foe. This time we face a pandemic with a society that is utterly reliant on technology and data. A new technological age, the Fourth Industrial Revolution, means the way we live, work and interact with each other has changed beyond recognition. The threats we face are different too. The current crisis has shown that the security of health systems, the cyber-resilience of businesses and the ability of every citizen to safely live their lives online are central to recovery.

As it has done throughout its history, GCHQ is evolving rapidly to adapt to this new landscape. The creation of the National Cyber Security Centre (NCSC), as part of GCHQ, to build on our long-standing cyber-security remit and to protect the digital homeland, is the latest example. Professor Ferriss narrative shows us as an organisation set up to collect and analyse intelligence and with an amazing track record of shortening wars, countering hostile states, thwarting terrorist attacks and disrupting serious criminals. Today, the reality is that GCHQ is a citizen-facing intelligence and security enterprise with a globally recognised brand and reputation. We owe all of that to our predecessors.

Of course, GCHQ is still full of brilliant people, many with strong technical backgrounds, who are working at the forefront of this new digital landscape. They are the successors to Joan Clarke, Alan Turing, Gordon Welchman and countless other unnamed pioneers whose efforts are reflected in this account. Their work, often not attributed, continues to influence the development of technologies that underpin the UKs status as a great science, technology and cyber power.

GCHQs mission means that much of our work is carried out in secret, but for some time we have been on a path towards greater transparency. Being open about what we do, even where we cannot describe exactly where we are focused, or how we deliver operations, is crucial to maintaining our licence to operate. Indeed, it underpins the world-leading ethical and legal framework that is the basis for all of our work.

And thats why this book is so essential. Many of the stories are being told for the first time. Its right that they see the light of day so we can explain our past and be open about our failures as well as successes. I hope that not only will readers be better informed about our history, they will understand the role GCHQ has played on their behalf.

Professor Ferris was given access to significant portions of our archives, and he has done a huge amount of work to piece together the most consequential moments in our history. I am most grateful for his insights and professionalism. He has worked independently, and his views are, of course, his own. For those who want to research further and form their own conclusions, we are also releasing the source material to The National Archives.

This Authorised History is just the first chapter in the story of GCHQ. With the establishment of the NCSC, and the recent opening of our superb new offices in central Manchester, we can already see how the next chapter might unfold. Whatever its final shape and location, I know that GCHQs future success will be assured if we retain and recruit a diverse mix of minds. This history shows that when we do, anything is possible.

Jeremy Fleming, Director GCHQ

June 2020

The archives of the Government Communications Headquarters (GCHQ) stand at the end of a corridor in the basement of the Doughnut, its iconic headquarters at Cheltenham. Behind a specially secured door is a long rectangular room dominated by shelves holding thousands of boxes of documents. Halfway down the room is an enclosed cage, some 5 metres wide and 10 metres long. Metal columns stretch from metalled floor to ceiling, with bars spaced every foot apart on the cage. Few staff can open the cage. Within it are tens of thousands of paper files, none copied digitally. Each file contains the positive vetting record of a member of GCHQ their personal secrets collected from interviews with friends and families before hiring. These records are intended to remain secret forever: they are read only under restrictions and destroyed whenever anyone dies. Nothing better typifies GCHQ than this focus on privacy for people who strip secrecy from Britains foes.

Many people regard intelligence as magic, or the hidden master of policy. Only when you know the intelligence record, they think, can you understand how and why things really happened. Such folk believe that intelligence should be completely reliable, understood, useful, and used well. Evidence has no ambiguity. You should know what you need to know and acquire complete and accurate information whenever you wish. Intelligence eliminates uncertainty. The truth and nothing but the truth can be known. It shows what should be done, and the consequences of doing so. Actions taken on knowledge have the effect one intends, and nothing else. Perfect information can be perfectly usable, because action is easy. Anything less than perfection in comprehension and action is failure, which is rare and associated with idiots.

It all sounds simple, but reality is more complex. To understand an environment and act effectively within it are hard. Intelligence provides snippets of information, always containing error and surrounded by uncertainty. Mistakes and failures are inevitable in intelligence, the only questions being: how often and significant? Intelligence rarely affects the determination of policy. Frequently, it shapes the background to decisions, how statesmen understand their environment. Often, intelligence determines the execution of policy. Sometimes, it enables decisions at the highest common denominator and effective actions. Intelligence merely is one of many inputs into a process. Before an event, the effect of intelligence is unpredictable. During one, this effect ranges widely and may be minor, betraying those who trust too much in it. The average result is balance between both sides, or superiority without significance. In a large minority of cases, however, intelligence is a winning factor.

Academics and practitioners agree that signals intelligence Sigint, material derived from reading the content or assessing the external features of messages is the source most likely to achieve that aim. Sigint is marked by high reliability and mixed relevance. Its reliability produces characteristics which are unique among sources, trusted by users and a gold standard against which to measure all other forms of intelligence. Sigint provides more useful intelligence on secrets, especially major ones, than any other source. Generally it provides first-rate material on second-rate matters and second-rate evidence on first-rate issues, along with a host of repetitive and minor data. Sigint works on an industrial scale, which swamps any organisation unable to handle complex problems of data processing. Anyone able to do so, however, understands basic elements of power and policy in a way inaccessible to any other source.