The scale of MI5 security threats has reached a critical turning point, with the UK’s domestic intelligence chief warning that foreign adversary activity has quadrupled over the last decade. In a significant annual address delivered at the MI5 headquarters in Thames House, London, Sir Ken McCallum, the Chief of the Security Service, detailed a rapidly intensifying landscape where state-sponsored hybrid warfare, technological disruption, and domestic terrorism are converging to challenge national stability.
Key Takeaways
- Quadrupled Threats: Foreign adversary threats against the UK have increased fourfold over the last ten years, driven primarily by Russia and Iran.
- Terrorism Alert: The UK’s national terrorism threat level was recently raised to “severe,” the first such increase in five years.
- AI as a Force Multiplier: Artificial Intelligence is “supercharging” the capabilities of attackers in cyber reconnaissance, information warfare, and potential bioweaponry.
- Russia’s Diminishing Footprint: Following the invasion of Ukraine, the UK has expelled nearly 1,000 Russian spies, forcing the Kremlin to rely on criminals and proxies.
- Iranian Activity: There have been 50 arrests in the past year linked to Iranian-sponsored activities, including suspected plots against military sites like RAF Fairford.
- Islamist Terrorism: Groups such as Al Qaeda and ISIS remain primary drivers, continuing to direct and inspire attacks through digital networks.
- Extreme Right-Wing Terrorism: This threat is characterized by extremist versions of anti-immigration and anti-Muslim grievances. McCallum observed a concerning trend where ERW terrorism tends to “skew young.” He cited a recent investigation into a radicalized 13-year-old in the UK, whose intelligence allowed an international partner to prevent a lethal attack, illustrating the speed at which radicalization can occur in the digital age.
- For Citizens: You may notice an increased security presence at sensitive locations, including transport hubs, religious sites, and military installations. The rise in hybrid warfare also means that personal digital security and awareness of disinformation are increasingly vital components of personal safety.
- For the Tech and Business Sector: Companies developing AI and drone technologies should expect heightened scrutiny and closer collaboration with intelligence agencies. The establishment of the AI Threat Assessment Centre suggests that the line between commercial innovation and national security is becoming increasingly thin.
- For Political and Social Leaders: The rise of ERW terrorism and the use of AI in information warfare mean that managing social cohesion and combating radicalization requires new, technologically-literate strategies. The ability to distinguish between legitimate political grievance and state-sponsored or AI-driven radicalization will be a key challenge.
- Implementation of the National Security Act: The 2023 Act will continue to be the primary legal tool used by MI5 to target threats from China, Iran, and Russia. The efficacy of this act in prosecuting proxy-led hybrid attacks will be a major test.
- AI Threat Assessment Centre Progress: The output of this new center will dictate how the UK Intelligence Community integrates AI into its defensive and offensive capabilities.
- Terrorism Threat Level Monitoring: Intelligence agencies will be closely monitoring the drivers of both Islamist and ERW terrorism to determine if the “severe” threat level remains justified or requires further escalation.
- International Intelligence Cooperation: Given the global nature of AI and state-sponsored cyber threats, the level of data-sharing between the UK, NATO, and its intelligence partners will be a critical factor in maintaining a defensive edge.
- www.bbc.com
- www.washingtonpost.com
What happened
On Tuesday, Sir Ken McCallum delivered a landmark speech from Thames House that signaled a massive shift in the UK’s intelligence priorities. McCallum reported that the agency is now dedicating more resources to countering state-sponsored threats than at any point since the Cold War. This shift comes as the intelligence community grapples with a dual-front struggle: managing sophisticated hybrid warfare from foreign powers and managing a domestic terrorism threat that is now roughly “equal in scale” between Islamist and extreme right-wing actors.
McCallum’s address provided specific evidence of escalating tensions. He highlighted that while the UK has successfully degraded Russian intelligence capabilities by expelling approximately 1,000 spies since the start of the invasion of Ukraine, the Kremlin has not retreated. Instead, it has pivoted to more clandestine and less predictable methods. Simultaneously, the agency has seen a surge in Iranian-linked activities, resulting in 50 arrests over the last 12 months. These activities have reportedly targeted high-security installations and vulnerable community groups, specifically Jewish communities.
Why it matters
This evolution in MI5 security threats matters because it represents a fundamental change in how modern conflict is waged. The traditional boundaries between “war” and “peace” are blurring through the use of hybrid warfare—a strategy that utilizes non-military tools like cyber-attacks, sabotage, and disinformation to achieve geopolitical goals without direct kinetic engagement.
For the British public, this means that national security is no longer just about monitoring foreign borders or military movements; it is about protecting digital infrastructure, the integrity of information, and the safety of domestic communities from state-directed interference. The quadrupling of foreign threats in just ten years suggests that the UK is facing a permanent state of low-level, high-impact confrontation with foreign adversaries. Furthermore, the “severe” terrorism threat level indicates that the risk of domestic attacks remains at a high plateau, requiring constant vigilance from both security services and the general public.
The Russian Strategy: From Spies to Proxies
McCallum identified Russia as the “aggressor number one” in the current geopolitical climate. However, the nature of Russian aggression has undergone a forced metamorphosis. For decades, Russian intelligence operated through a structured network of professional officers embedded within Western institutions. The invasion of Ukraine has disrupted this model.
According to McCallum, the UK’s aggressive expulsion of nearly 1,000 Russian intelligence officers has effectively “eviscerated” the Kremlin’s traditional covert footprint. This loss of professional human intelligence (HUMINT) has left the Russian state in a position of weakness, described by McCallum as “not the actions of a great power with the strategic upper hand.”
To compensate for this loss, the Kremlin is now “scrambling to pay criminals” and utilizing proxies to conduct operations. This shift toward using criminal elements for sabotage or cyber-attacks makes detection more difficult, as these actors do not follow the predictable patterns of trained intelligence officers. This reliance on proxies increases the risk of unintended escalation and makes it harder for the UK to attribute specific acts of aggression directly to the Russian state.
Russian Interference and the Brexit Context
McCallum also addressed the long-standing debate regarding Russian interference in the 2016 Brexit referendum. He acknowledged that Russian “internet trolls,” “bot farms,” and media outlets attempted to influence the democratic process. However, he provided a critical distinction that has been central to intelligence debates: the difference between attempted interference and the actual outcome.
McCallum asserted that while the attempts were real, the result of the referendum is “not in dispute.” He cautioned against overestimating the effectiveness of these tactics, warning that focusing too heavily on the power of troll farms might inadvertently “make these trolls look 10ft tall,” giving them more credit for political shifts than they actually deserve.
Iranian Aggression and the RAF Fairford Incident
While Russia remains the primary state aggressor, Iran has emerged as a significant source of hybrid campaigns targeting the UK. McCallum reported that Iranian-linked activities have become increasingly sophisticated and targeted.
One of the most pressing examples involves a recent incident at RAF Fairford, a critical military airbase in Gloucestershire used by U.S. bombers. During the incident, three suspicious vans were spotted near the installation, leading to the arrest and bail of seven individuals. While McCallum did not name the base in his formal address, he confirmed to reporters that such incidents are “not unique” and that Iranian interest in the UK is widespread.
Prime Minister Andy Burnham has gone further, claiming that the RAF Fairford incident was “almost certainly directed by Iran’s Islamic Revolutionary Guard (IRGC).”
Comparative Threat Profile
To understand the current landscape, it is helpful to compare the primary actors identified by MI5:
| Threat Actor | Primary Method | Recent Activity/Impact | Target Focus |
|---|---|---|---|
| Russia | Hybrid warfare, cyber, proxies | 1,000 spies expelled; shift to criminal proxies | European stability, UK infrastructure |
| Iran | Surveillance, sabotage, hybrid campaigns | 50 arrests in 12 months; RAF Fairford incident | Military bases, Jewish communities |
| Islamist Terrorism | Direct attacks, online radicalization | Threat level “severe”; Al Qaeda/ISIS inspiration | Public spaces, religious sites |
| Extreme Right-Wing | Anti-immigration/anti-Muslim grievance | Increasing scale; targeting younger demographics | Immigrant communities, multiculturalism |
The AI Revolution: A “Supercharged” Threat
A central and perhaps most unsettling theme of McCallum’s address was the impact of Artificial Intelligence (AI) on the security contest. He warned that AI is “supercharging” the ability of both state and non-state actors to conduct attacks, creating a landscape where the speed and scale of threats could outpace human decision-making.
McCallum noted that human history has no precedent for facing an actor “smarter than we are,” referring to the potential of autonomous or highly advanced AI systems. He categorized the risks into three distinct areas:
1. Cyber and Reconnaissance
Terrorist organizations and state actors are already integrating AI with drone technology to improve reconnaissance capabilities. AI can analyze vast amounts of data to identify vulnerabilities in physical and digital infrastructure, allowing for more precise and devastating strikes. This synergy between AI and unmanned aerial vehicles (UAVs) represents a significant leap in the lethality of non-state actors.
2. Information Warfare
AI enables the creation of highly tailored, hyper-realistic propaganda. Unlike the “bot farms” of the past, AI-driven disinformation can generate content specifically designed to radicalize individuals based on their unique psychological profiles. This makes the spread of extremist ideologies more efficient and harder for social media platforms to detect and mitigate.
3. The Threat of Bioweapons
While McCallum noted that the threat of AI-enabled bioweapons is “not yet realised,” he emphasized that it has the “potential to change the stakes” of global terrorism. The ability for AI to assist in the design or optimization of biological agents could lower the barrier to entry for mass-casualty attacks, moving the threat from the realm of science fiction to a pressing intelligence concern.
In response to these technological shifts, MI5 has launched an AI Threat Assessment Centre. This new body is designed to “separate the bluster from the realities” of AI-driven risks. The center operates as part of a collaborative framework involving the UK Intelligence Community—including MI5, GCHQ, and MI6—and the UK’s AI Security Institute.
Terrorism: The Dual-Front Struggle
Beyond the state-sponsored hybrid threats, the UK continues to face a significant domestic terrorism problem. McCallum highlighted that the terrorism threat level was raised to “severe” in April, marking a notable shift in the domestic security environment.
Crucially, McCallum noted that the scale of Islamist terrorism and Extreme Right-Wing (ERW) terrorism is now roughly “equal.”
What It Means for You
The evolving landscape of MI5 security threats has practical implications for various sectors of society:
Counterpoints and Open Questions
While McCallum’s address provided a clear direction for MI5, several areas remain subject to debate and uncertainty:
The Effectiveness of Expulsions: While the expulsion of 1,000 Russian spies is a significant tactical victory, critics question whether it effectively mitigates long-term Russian influence. If the Kremlin successfully transitions to using criminal proxies, the threat may become more decentralized and harder to track through traditional counter-intelligence methods.
The AI Uncertainty: The intelligence community is itself grappling with the “unknown threats” of AI. There is an inherent tension in trying to regulate and defend against a technology that is evolving faster than the laws and security protocols designed to manage it. How much of the AI threat is “bluster” versus a realized capability remains an open question.
The Attribution Problem: As states like Iran and Russia move toward hybrid warfare and proxy-led operations, the ability to definitively attribute an attack to a specific government becomes more difficult. This creates a risk of diplomatic miscalculation or, conversely, a failure to hold aggressors accountable for their actions.
What Happens Next
Several key developments will serve as signals for the future of UK national security:
Frequently Asked Questions
What is the current UK terrorism threat level?
The UK’s terrorism threat level is currently set at “severe.” This means that a terrorist attack is considered highly likely. This level was reached in April, marking the first increase in five years, driven by both Islamist and extreme right-wing terrorism.
How has AI changed the nature of security threats?
nAI acts as a “force multiplier” for attackers. It “supercharges” cyber reconnaissance, allows for the creation of highly personalized propaganda for information warfare, and has the potential to assist in the development of more effective bioweapons. It allows attackers to operate at a speed and scale that was previously impossible.
Why is Russia using criminals instead of spies?
Following the invasion of Ukraine, the UK expelled nearly 1,000 Russian spies, which McCallum said “eviscerated” the Kremlin’s traditional intelligence footprint in the UK. To compensate for this loss of professional intelligence officers, Russia is now turning to criminals and proxies to carry out hybrid warfare and sabotage operations.
What was the incident at RAF Fairford?
While specific details were not fully disclosed in the formal speech, the incident involved three suspicious vans spotted near the Gloucestershire airbase. This led to the arrest and bail of seven individuals. Prime Minister Andy Burnham has alleged that the incident was directed by Iran’s Islamic Revolutionary Guard.
As the UK faces a landscape where state-sponsored hybrid warfare and technological disruption are becoming the norm, the mission of MI5 is undergoing a fundamental transformation. The shift from Cold War-style espionage to a multifaceted defense against AI, proxies, and evolving terrorist ideologies marks a new, more complex chapter in national security.
References
Featured image: Image via bbc.com
