Analysing the Russia Report

(See the github repo here.)

The UK’s Intelligence and Security Committee’s report into Russian activity in the UK was finally published on the 21 July 2020.

The heavily-redacted text is available on the ISC website and in this github repository.

I’m going to have a look with the aid of some tidyverse widgets.

First, load packages and the text into R.

devtools::install_github("inductivestep/handbag")
library(handbag)
library(tidyverse)
library(knitr)
library(pdftools)
library(stringr)
rr_text <- pdf_text("20200721_HC632_CCS001_CCS1019402408-001_ISC_Russia_Report_Web_Accessible.pdf")

The pdf_text command returns a character vector with one element per PDF page. The main report text is on pages 8-42.

First go

Finding the juiciest pages

I’d like to know where the juicy pages are - maybe it’s those with the most redactions, ***?

Let’s count redactions per page:

redact_n <- str_count(rr_text, pattern = "\\*\\*\\*")

Now add these to a tibble, alongside the (pdf, as opposed to printed) page number and original page text for later analyses.

rr_tib <- tibble(page = 1:length(rr_text),
                 text = rr_text,
                 redactions = redact_n)

Histogram

A histogram of those redactions:

ggplot(rr_tib, aes(x=redactions)) +
  geom_histogram(binwidth = 1, fill = "firebrick", color = "white") +
  labs(x = "Number of redactions",
       y = "Count",
       title = "Redactions per page in the Russia Report") +
  theme_classic()

Which pages have the most redactions?

rr_tib %>%
  filter(redactions >= 10) %>%
  select(page, redactions) %>%
  arrange(redactions) %>%
  kable()

page	redactions
17	10
27	11
45	11
20	15
37	15
38	19

The section on PDF pages 37-39 (printed pages 30-32) is the winner: “Rising to the challenge”. Here’s a link to the pdf pages.

Word counts

For this, I’ll use the tidytext package, which is introduced in a great book by Julia Silge and David Robinson.

library(tidytext)

Here’s a tidy tibble with all the words, using unnest_tokens:

rr_words <- rr_tib %>%
  select(page,text) %>%
  unnest_tokens(word, # name of the new column
                text) # column with text

The top 20 most common words, excluding stop words, are:

rr_words %>%
  anti_join(stop_words, by = "word") %>%
  count(word) %>%
  arrange(desc(n)) %>%
  head(20) %>%
  ggplot(aes(x = reorder(word, n),
             y = n,
             fill = n)) +
    geom_bar(stat = "identity") + 
    coord_flip() +
    labs(y = "Count",
         x = "Word") + 
    theme(legend.position = "none")

It might also be fun to find initialisms like MI5, etc. - we can do that with a regular expression.

The previous scan of all words reduced them to lower case, so let’s go again using unnest_tokens with to_lower = FALSE:

initialism_regex <- "([A-Z]{2})|(([A-Z].){2})"

rr_initialisms <- rr_tib %>%
  filter((page >= 8) & (page <= 59)) %>%
  select(page,text) %>%
  unnest_tokens(word,
                text,
                to_lower = FALSE) %>%
  filter(str_detect(word, initialism_regex))

It’s apparent that this picks up too many, e.g., there are some upper case words like “INTELLIGENCE” in sectio headings. I’ve selected a few interesting actual initialisms for later.

rr_initialisms %>%
  group_by(word) %>%
  count() %>%
  mutate(length = str_length(word)) %>%
  arrange(desc(n)) %>%
  kable()

word	n	length
UK	99	2
GCHQ	48	4
MI5	42	3
SIS	35	3
UK’s	29	4
HMG	23	3
US	22	2
NATO	19	4
DCMS	18	4
NCA	18	3
EU	10	2
HC	9	2
ICE	9	3
RIS	8	3
SIGINT	8	6
GRU	7	3
HUMINT	7	6
RT	7	2
AND	5	3
CNI	5	3
GEOINT	5	6
JIC	5	3
MASINT	5	6
MP	5	2
NCSC	5	4
USSR	5	4
FARA	4	4
GCHQ’s	4	6
NSS	4	3
OBE	4	3
OSCT	4	4
CMG	3	3
FCO	3	3
OFFICE	3	6
UN	3	2
CONTEST	2	7
HMG’s	2	5
INTELLIGENCE	2	12
ISC	2	3
KCMG	2	4
MPs	2	3
OPCW	2	4
PEP	2	3
PR	2	2
SECURITY	2	8
SERVICE	2	7
SIS’s	2	5
SOC	2	3
AGENCY	1	6
ALLOCATION	1	10
ANNEX	1	5
CABINET	1	7
CBE	1	3
CCS1019402408	1	13
CCTV	1	4
CLASSIFIED	1	10
CO	1	2
COMMONWEALTH	1	12
COMMUNICATIONS	1	14
COUNTER	1	7
CPNI	1	4
CRIME	1	5
CT	1	2
CYBER	1	5
CyberUK	1	7
DEFENCE	1	7
DISINFORMATION	1	14
DSTL	1	4
EEA	1	3
EFFORT	1	6
ENGAGEMENT	1	10
EVIDENCE	1	8
EXPATRIATES	1	11
FCO’s	1	5
FOR	1	3
FOREIGN	1	7
GOVERNMENT	1	10
HARD	1	4
HEADQUARTERS	1	12
INFLUENCE	1	9
INTERNATIONAL	1	13
INTRODUCTION	1	12
JIO	1	3
JTAC	1	4
KCB	1	3
Leave.EU	1	8
LEGISLATION	1	11
MI6	1	3
NAC	1	3
NATIONAL	1	8
NCA’s	1	5
NOCP	1	4
NSC	1	3
OF	1	2
ORAL	1	4
ORDINATION	1	10
PARTNERSHIPS	1	12
QC	1	2
QPM	1	3
RAF	1	3
RUSSIA	1	6
RUSSIAN	1	7
SECRET	1	6
STRATEGY	1	8
TARGET	1	6
TASKING	1	7
TD	1	2
TERRORISM	1	9
VOSTOK	1	6
WITH	1	4
WITNESSES	1	9
WRITTEN	1	7

Sentence-level analysis

Is there a relationship between which intelligence service (e.g., MI5, MI6, or GCHQ) is mentioned and whether there is a redaction in that sentence?

Again I’ll use unnest, but this time at the sentence level.

rr_sentences <- rr_tib %>%
  unnest_sentences(sentence, text,
                   to_lower = FALSE) %>%
  select(-redactions) # remove page-level count of redactions

rr_sentences$sentence_i <- 1:nrow(rr_sentences)

That worked reasonably well, though:

• Citations at the end of sentences confused it (possible to fix this by using unnest_regex).
• Footnotes need to be addressed separately (they are sentences beginning with numbers, once the aforementioned sentence problem has been fixed).
• It doesn’t deal with sentences which cross pages (it may be possible to fix this problem by removing footnotes, gluing all the sentences together, and unnesting again).

Next: code redactions and whether sentences mention one of the big three intel agencies (and some other organisations, for comparison).

I’ll use (the fantastic!) fuzzyjoin for this, which joins two tables based on a regular expression.

library(fuzzyjoin)

Here’s the mapping:

mapping <- tribble(
  ~regex,                                ~code,
  "MI5|[s|S]ecurity [s|S]ervice",        "org_MI5",
  "MI6|SIS|Secret Intelligence Service", "org_MI6",
  "GCHQ",                                "org_GCHQ",
  "Defence Intelligence|DI",             "org_DI",
  "GRU",                                 "org_GRU",
  "NATO",                                "org_NATO",
  "RIS",                                 "org_RIS",
  "NCSC",                                "org_NCSC",
  "NSS",                                 "org_NSS",
  "OSCT",                                "org_OSCT",
  "ISC",                                 "org_ISC",
  "FCO",                                 "org_FCO",
  "UN",                                  "org_UN",
  "RAF",                                 "org_RAF",
  "JIC",                                 "org_JIC",
  "DCMS",                                "org_DCMS",
  initialism_regex,                      "initialism",
  "\\*\\*\\*",                           "redacted"
)

Now, fuzzyjoin and reshape so that each row is a sentence and there’s a binary variable for each feature:

rr_mentions <- rr_sentences %>%
  regex_left_join(mapping,
                  by = c(sentence = "regex")) %>%
  group_by(sentence_i, code) %>%
  count() %>%
  pivot_wider(names_from = code,
              values_from = n,
              values_fill = 0) %>%
  rowwise() %>%
  mutate(any_org = 
           max(c_across(starts_with("org_")))) %>%
  select(-"NA")

rr_sentences <- rr_sentences %>%
  left_join(rr_mentions, by = "sentence_i")

Make a summary variable of the organisations mentioned.

rr_sentences$mentioned_services <- rr_sentences %>%
  select(starts_with("org_")) %>%
  handbag::binary_patterns_var(strip_prefix = "org_")

Let’s count them:

rr_sentences %>%
  count(mentioned_services) %>%
  arrange(desc(n)) %>%
  kable(col.names = c("Service(s) mentioned", "n"))

Service(s) mentioned	n
(None)	706
DI	39
MI5	30
GCHQ	26
DCMS	18
MI6	15
GCHQ & MI6	10
NATO	8
JIC	5
GCHQ, MI5 & MI6	4
GRU	4
NCSC	4
RIS	4
DI & GCHQ	2
DI & NATO	2
DI, GCHQ, MI5 & MI6	2
DI, GCHQ, MI5, MI6, NSS & OSCT	2
ISC	2
MI5 & MI6	2
NSS	2
UN	2
DI, GCHQ & MI6	1
DI, GCHQ, OSCT, UN, FCO & RIS	1
FCO	1
GCHQ & MI5	1
GCHQ & NCSC	1
GCHQ & NSS	1
GCHQ, FCO & GRU	1
GRU & RIS	1
ISC & GCHQ	1
MI5 & OSCT	1
NATO & GRU	1
NATO & RAF	1
OSCT	1

Does mention of any of these organisations in a sentence predict a redaction in the same sentence?

redacted_tab <- rr_sentences %>%
  group_by(mentioned_services, redacted) %>%
  summarise(n = n()) %>%
  mutate(perc = 100*n/sum(n)) %>%
  pivot_wider(names_from   = redacted,
              values_from  = c(n,perc),
              values_fill  = 0,
              names_prefix = "redact_")

redacted_tab %>%
  select(-perc_redact_0) %>%
  arrange(desc(perc_redact_1)) %>%
  kable(col.names = c("", "Unredacted (n)",
                      "Redacted (n)",
                      "Redacted (%)"),
        digits = 0)

	Unredacted (n)	Redacted (n)	Redacted (%)
GCHQ & NSS	0	1	100
GCHQ, FCO & GRU	0	1	100
ISC & GCHQ	0	1	100
NSS	0	2	100
MI6	5	10	67
JIC	2	3	60
GCHQ	12	14	54
DI & GCHQ	1	1	50
DI & NATO	1	1	50
DI	24	15	38
MI5	19	11	37
GCHQ & MI6	7	3	30
GCHQ, MI5 & MI6	3	1	25
NCSC	3	1	25
(None)	631	75	11
DCMS	17	1	6
DI, GCHQ & MI6	1	0	0
DI, GCHQ, MI5 & MI6	2	0	0
DI, GCHQ, MI5, MI6, NSS & OSCT	2	0	0
DI, GCHQ, OSCT, UN, FCO & RIS	1	0	0
FCO	1	0	0
GCHQ & MI5	1	0	0
GCHQ & NCSC	1	0	0
GRU	4	0	0
GRU & RIS	1	0	0
ISC	2	0	0
MI5 & MI6	2	0	0
MI5 & OSCT	1	0	0
NATO	8	0	0
NATO & GRU	1	0	0
NATO & RAF	1	0	0
OSCT	1	0	0
RIS	4	0	0
UN	2	0	0

As a picture:

redacted_tab %>%
  mutate(percentage_redacted = perc_redact_1) %>%
  ggplot(aes(x = reorder(mentioned_services, percentage_redacted),
             y = percentage_redacted,
             fill = mentioned_services)) +
    geom_col() + 
    coord_flip() +
    labs(x = "Organisations mentioned in sentence",
         y = "% of sentences with a redaction",
         title = "Predictors of redacted sentences",
         caption =
           "Bars are labelled with counts (redactions/total)") + 
    expand_limits(y = 105) +
    theme(legend.position = "none") +
    geom_text(aes(label = paste0(n_redact_1,"/",
                                 n_redact_1+n_redact_0),
                  y = percentage_redacted+1,
                  hjust = 0),
              size = 4)

(The winner there, NSS mentioned alone, with 100% redactions is only two sentences.)

View the text

First, a function to make it easier to view the text.

viewSentences <- function(the_sentences) {
  the_sentences %>%
    mutate(nice_sentence = gsub(pattern = "\\*\\*\\*",
           replace = "\\*\\*\\*[redacted]\\*\\*\\*",
           x = sentence)
    ) %>%
    select(page, mentioned_services, nice_sentence) %>%
    arrange(mentioned_services) %>%
    kable(col.names = c("Page", "Services", "Sentence"))
}

Note: be careful interpreting the numbers - they’re mostly superscript citations! Most quantities have been redacted in the report.

Sentences mentioning an organisation and redacted

rr_sentences %>%
  filter(any_org == 1 & redacted == 1) %>%
  viewSentences()

Page	Services	Sentence
18	DCMS	With that said, we note that – as with so many other issues currently – it is the social media companies which hold the key and yet are failing to play their part; DCMS informed us that [redacted].
14	DI	18 Oral evidence – Defence Intelligence, [redacted] February 2019.
28	DI	Defence Intelligence has advised that currently [redacted] of its All Source analysts spend more than 50% of their time on Russia and a further [redacted] spend less than 50% of their time on Russia.
28	DI	84 This represents [redacted]% of Defence Intelligence’s current analytical resource being focused on Russia (written evidence – Defence Intelligence, 6 March 2019).
29	DI	88 Oral evidence – Defence Intelligence, [redacted] December 2018.
33	DI	In relation to the Agencies and Defence Intelligence, given the difficulties in working against Russia (explored in the next section), it is particularly important that all sources – HUMINT, SIGINT, MASINT, GEOINT, 101 open source and others – are used to complement each other as much as possible, and that they are used across all aspects of the co-ordinated Russian threat ([redacted]).
33	DI	Given the combined nature of the Russian threat, it is essential that the Agencies’ and Defence Intelligence’s work on [redacted] is not viewed separately from wider Russian foreign policy and influence efforts.
34	DI	104 We recognise that it may not be appropriate for Defence Intelligence to be covered by ICE, but we were surprised to discover that Defence Intelligence is not included in the tri-Agency approach: [redacted].
34	DI	Whilst we would not expect to receive highly 104 Oral evidence – Defence Intelligence, [redacted] December 2018.
34	DI	105 Oral evidence – Defence Intelligence, [redacted] January 2019.
37	DI	The Agencies and Defence Intelligence must therefore be particularly discerning [redacted].
38	DI	Defence Intelligence has sought to [redacted] “try to understand how they think and why they think”.
38	DI	115 [redacted] 116 Oral evidence – Defence Intelligence, [redacted] December 2018.
38	DI	117 Oral evidence – Defence Intelligence, [redacted] December 2018.
44	DI	The Agencies and Defence Intelligence are increasingly working with [redacted] on the Russian threat.
45	DI	147 Oral evidence – Defence Intelligence, [redacted] January 2019.
38	DI & GCHQ	120 This raises the question of whether return now to a ‘normal’, relatively low, level of [redacted] effort against Russia would undermine this, or whether it would now be more 113 GCHQ and Defence Intelligence staff working on Russia are UK based.
45	DI & NATO	Defence Intelligence also observed that the impact of the Salisbury attack on the NATO intelligence community had “been significant in terms of bolstering individuals”, noting that [redacted] (oral evidence – Defence Intelligence, [redacted] February 2019).
12	GCHQ	10 GCHQ told the Committee that there is “a quite considerable balance of intelligence now which shows the links between serious and organised crime groups and Russian state activity” and that “we’ve seen more evidence of [redacted] serious and organised crime [redacted] being connected at high levels of Russian state and Russian intelligence”, in what it described as a “symbiotic relationship”.
12	GCHQ	11 Oral evidence – GCHQ, [redacted] February 2019.
14	GCHQ	[redacted] – GCHQ acknowledged that [redacted] it would have to broaden its recruitment base, with a shift towards recruiting on aptitude rather than on pre-existing skills.
14	GCHQ	17 Oral evidence – GCHQ, [redacted] February 2019.
17	GCHQ	31 Nonetheless, GCHQ informed us that “[redacted]”, 32 and the Deputy National Security Adviser noted that “there is a lot of work going on [in relation to electoral mechanics] to map the end-to-end processes … [redacted] and to make sure where we can we are mitigating the risks there”.
17	GCHQ	32 Oral evidence – GCHQ, [redacted] February 2019.
20	GCHQ	45 Oral evidence – GCHQ, [redacted] December 2018 [redacted].
28	GCHQ	81 Approximately [redacted]% of GCHQ’s current operational effort is on Russia.
28	GCHQ	This is understandable: the 80 Oral evidence – GCHQ, [redacted] December 2018.
29	GCHQ	90 Oral evidence – GCHQ, [redacted] December 2018.
37	GCHQ	increasing privacy protection – including ubiquitous encryption – presents particular problems for GCHQ, and in the case of Russia it faces a real SIGINT challenge with the use by the Russian government of [redacted].
37	GCHQ	108 Oral evidence – GCHQ, [redacted] December 2018.
38	GCHQ	116 In relation to SIGINT, GCHQ has focused on not only deploying a broad range of capabilities against Russia, but in joining up with others to use their capabilities in tandem, allowing them to [redacted].
43	GCHQ	143 Oral evidence – GCHQ, [redacted] February 2019.
30	GCHQ & MI6	SIS and GCHQ planned to change their operational effort against Russia still further – to [redacted]% and [redacted]% respectively by 2020.
38	GCHQ & MI6	For example, SIS usually deploys only [redacted] of its overall operational Russia effort in support of [redacted], whilst GCHQ uses approximately [redacted].
38	GCHQ & MI6	118 Oral evidence – SIS and GCHQ, [redacted] January 2019.
17	GCHQ & NSS	31 Oral evidence – GCHQ, [redacted] December 2018; oral evidence – NSS, [redacted] February 2019.
12	GCHQ, FCO & GRU	• GCHQ has also advised that Russian GRU 6 actors have orchestrated phishing 7 attempts against Government departments – to take one example, there were attempts against [redacted], 8 the Foreign and Commonwealth Office (FCO) and the Defence Science and Technology Laboratory (DSTL) during the early stages of the investigation into the Salisbury attacks.
32	GCHQ, MI5 & MI6	However, it is clear that Russia is a high ministerial priority: the Home Secretary has informed us that he meets the Director-General of MI5 “at least once a week, sometimes more, and … in … [redacted] … there has been some discussion around Russia”, 98 and, when asked about how much he speaks to the Chief of SIS and the Director of GCHQ about Russia, the Foreign Secretary replied “[redacted]”, 99 explaining his concern that Russia-related problems – whilst serious – risk crowding out broader global issues.
12	ISC & GCHQ	8 [redacted] 9 GCHQ, Quarterly Report to the ISC, July–September 2018.
17	JIC	33 This was reflected in the Joint Intelligence Committee (JIC) judgement in May 2017 that “the UK paper-based voting process is protected from cyber operations but [redacted]”.
20	JIC	In May 2017, the Joint Intelligence Committee (JIC) concluded that “[redacted]” and that “[redacted]”.
20	JIC	46 [redacted] 47 [redacted] 48 JIC Key Judgement, [redacted], 26 May 2017. 49 [redacted] (written evidence – HMG, 29 June 2018).
18	MI5	This matter is, in our 38 Section 1(2), Security Service Act 1989; MI5 has informed us that it currently has a role to (i) “investigate leads to any of this sort of clandestine activity by foreign states”; (ii) “translate [the] intelligence picture into protective advice to defend our systems”; and (iii) “provide assessed intelligence reporting into the policy system to assist in policy formulation” (oral evidence – MI5, [redacted] December 2018).
24	MI5	We welcomed this process, but questioned whether the Intelligence Community has a clear picture of how many Russians there are in the UK who are at risk – for example, would MI5 or any other relevant agency [redacted]?
27	MI5	76 Written evidence – MI5, 12 March 2019; MI5’s overall resource has increased significantly over this period. [redacted] allocation of effort on Hostile State Activity has [redacted], spending on Hostile State Activity has [redacted].
29	MI5	87 Oral evidence – MI5, [redacted] December 2018.
30	MI5	92 MI5 is [redacted] and seeking to [redacted] on Hostile State Activity.
30	MI5	For example, MI5 told us that: We quite frequently find ourselves quarter on quarter taking [redacted] decisions about … how we will [redacted] across these different subject areas and at the moment we have stuck with some of the resourcing that’s surged towards hostile state work after Salisbury, despite the fact that our CT [Counter-Terrorism] investigations suspensions rate remains higher than we want it to be.
30	MI5	93 Oral evidence – MI5, [redacted] November 2018.
37	MI5	109 Oral evidence – MI5, [redacted] November 2018.
40	MI5	123 Oral evidence – MI5, [redacted] February 2019.
40	MI5	126 Oral evidence – MI5, [redacted] January 2019.
41	MI5	128 Oral evidence – MI5, [redacted] January 2019.
12	MI6	10 Oral evidence – SIS, [redacted] February 2019.
27	MI6	Areas of intelligence coverage work that SIS undertakes in relation to Russia include cultivating agents who are in a position to pass on secret information, particularly in relation to the capabilities and intent of the Russian government, and its intelligence effects work includes [redacted].
27	MI6	In 2001, SIS’s operational effort against Russia was [redacted]%.
29	MI6	89 Oral evidence – SIS, [redacted] December 2018.
34	MI6	106 Oral evidence – SIS, [redacted] December 2018.
37	MI6	111 Whilst there are a [redacted] group of staff working on this issue, SIS was clear that a sudden surge in numbers would not yield results more quickly.
37	MI6	111 Oral evidence – SIS, [redacted] December 2018.
37	MI6	112 Oral evidence – SIS, [redacted] December 2018; we note that SIS [redacted] and has a “series of protections” around the people who do go into the team.
38	MI6	114 Oral evidence – SIS, [redacted] December 2018.
45	MI6	150 Oral evidence – SIS, [redacted] December 2018.
12	NCSC	5 The National Cyber Security Centre (NCSC) has advised that there is [redacted] Russian cyber intrusion into the UK’s CNI – particularly marked in the [redacted] sectors.
13	NSS	When attacks can be traced back – and we accept 12 Oral evidence – NSS, [redacted] February 2019.
17	NSS	33 Oral evidence – NSS, [redacted] February 2019.

Sentences mentioning the organisations but not redacted

rr_sentences %>%
  filter(any_org == 1 & redacted == 0) %>%
  viewSentences()

Page	Services	Sentence
13	DCMS	Indeed, there are a number of other Ministers with some form of responsibility for cyber – the Defence Secretary has overall responsibility for Offensive Cyber as a ‘warfighting tool’ and for the National Offensive Cyber Programme, while the Secretary of State for the Department for Digital, Culture, Media and Sport (DCMS) leads on digital matters, with the Chancellor of the Duchy of Lancaster being responsible for the National Cyber Security Strategy and the National Cyber Security Programme.
18	DCMS	They informed us that the Department for Digital, Culture, Media and Sport (DCMS) holds primary responsibility for disinformation campaigns, and that the Electoral Commission has responsibility for the overall security of democratic processes.
18	DCMS	However, DCMS told us that its function is largely confined to the broad HMG policy regarding the use of disinformation rather than an assessment of, or operations against, hostile state campaigns.
18	DCMS	And without seeking in any way to imply that DCMS is not capable, or that the Electoral Commission is not a staunch defender of democracy, it is a question of scale and access.
18	DCMS	DCMS is a small Whitehall policy department and the Electoral Commission is an arm’s length body; neither is in the central position required to tackle a major hostile state threat to our democracy.
18	DCMS	39 Written evidence – DCMS, 13 February 2019.
19	DCMS	We agree, however, with the DCMS Select Committee’s conclusion that the regulatory framework needs urgent review if it is to be fit for purpose in the age of widespread social media.
19	DCMS	41 DCMS Select Committee, Disinformation and ‘Fake News’, HC 1791, 18 February 2019.
19	DCMS	42 The DCMS Select Committee’s report Disinformation and ‘Fake News’ (HC 1791, 18 February 2019) surveys and comments on some of these studies.
21	DCMS	55 We note that the DCMS Select Committee has called on the Government to launch an independent investigation into foreign influence, disinformation, funding, voter manipulation and the sharing of data in relation to the Scottish independence referendum, the EU referendum and the 2017 General Election.
21	DCMS	If the Government were to take up this recommendation for a wider investigation, the assessment we recommend should take place could feed into it (DCMS Select Committee, Disinformation and ‘Fake News’, HC 1791, 18 February 2019, recommendation 39).
43	DCMS	The Digital, Culture, Media and Sport (DCMS) Select Committee has already asked the Government “whether current legislation to protect the electoral process from malign interference is sufficient.
43	DCMS	We note that physical interference in the UK’s democratic processes is less likely given the use of a paper-based system – however, we support the DCMS Select Committee’s calls for the Electoral Commission to be given power to “stop someone acting illegally in a campaign if they live outside the UK”.
43	DCMS	141 We note – and, again, agree with the DCMS Select Committee – that “the UK is clearly vulnerable to covert digital influence campaigns”.
43	DCMS	140 DCMS Select Committee, Disinformation and ‘Fake News’, HC 1791, 18 February 2019.
43	DCMS	141 DCMS Select Committee, Disinformation and ‘Fake News’, HC 1791, 18 February 2019.
43	DCMS	142 DCMS Select Committee, Disinformation and ‘Fake News’, HC 1791, 18 February 2019.
6	DI	5 A sophisticated player ……………………………………………………………………………………………5 Leading the response ……………………………………………………………………………………………..6 Attribution: a new approach ……………………………………………………………………………………6 HMG as a player: Offensive Cyber………………………………………………………………………….7 International actions ………………………………………………………………………………………………7 DISINFORMATION AND INFLUENCE ……………………………………………………………..
6	DI	19 Coverage ……………………………………………………………………………………………………………19 Did HMG take its eye off the ball? ………………………………………………………………………..21 Future resourcing ………………………………………………………………………………………………..23 STRATEGY, CO-ORDINATION AND TASKING ……………………………………………..
9	DI	We have been told, repeatedly, that the Russian Intelligence Services will analyse whatever we put in the public domain and therefore, on this subject more than any other, the potential to damage the capabilities of the intelligence and security Agencies and Defence Intelligence was both real and significant.
9	DI	The Report covers aspects of the Russian threat to the UK (Cyber; Disinformation and Influence; and Russian Expatriates) followed by an examination of how the UK Government – in particular the Agencies and Defence Intelligence – has responded (Allocation of Effort; Strategy, Co-ordination and Tasking; A Hard Target; Legislation; International Partnerships; and Engagement with Russia).
14	DI	It was also interesting to hear that Defence Intelligence is taking steps to develop and retain these skills through revision of the military resourcing model, which will mean military personnel remaining in cyber roles for longer than the current one to two years.
14	DI	We commend Defence Intelligence for being the first to recognise this problem and take action.
16	DI	DISINFORMATION AND INFLUENCE 27.
28	DI	82 Defence Intelligence 71.
28	DI	Defence Intelligence has wide-ranging responsibilities for intelligence collection and analysis, and a key role within Government in the preparation of All Source intelligence on Russia.
28	DI	Defence Intelligence effort on Russia also underwent significant reduction in the early 2000s.
28	DI	Although Defence Intelligence has been unable to provide figures for its allocation of effort over the past 20 years, we have been told that in 2013 there were relatively few All Source analysts in the Russia/Eurasia team (in addition to Russia-focused analysts in other teams).
28	DI	Defence Intelligence told us that it seconded its analytical effort on counter- terrorism to the Joint Terrorism Analysis Centre (JTAC) when it was established in 2003.
28	DI	This was estimated to be 20 posts by 2006/07 – just 1% of its then workforce (written evidence – Defence Intelligence, 21 March 2019).
29	DI	87 Defence Intelligence viewed it similarly: So in terms of relative prioritisation, rather than losing focus … our coverage of Russia undoubtedly suffered as a consequence of that prioritisation, which was necessary for the conduct of military operations.
32	DI	STRATEGY, CO-ORDINATION AND TASKING The cross-Whitehall Russia Strategy 78.
33	DI	Defence Intelligence is tasked by a separate Ministry of Defence process.
33	DI	102 Intelligence coverage is the collection of information (or acquisition of information from allied intelligence services) by the Agencies and Defence Intelligence.
34	DI	The Chief of Defence Intelligence recognised that “there is an absolute need for Defence Intelligence to be closely co-ordinated and potentially synchronised with the activity that is going on in ICE” but caveated that “whether we go fully into the ICE process I think is a much harder question to deal with”.
34	DI	There appears to be a plethora of plans and strategies with direct relevance to the work on Russia by the organisations we oversee: the cross-Whitehall Russia Strategy, the ICE Plan requirements for Russia, the tri-Agency joint approach for Russia, a separate tasking and prioritisation process for Defence Intelligence, and the Fusion Doctrine overlaying them all.
34	DI	We asked the Agencies and Defence Intelligence to assess their current performance against the strategic objectives and plans in place in relation to the Russian threat.
38	DI	Defence Intelligence brings to the table a range of specialised geospatial intelligence (GEOINT) and measurement and signature intelligence (MASINT) capabilities, which can be used to observe Russian targets at a distance, with a focus on military capabilities and organisations.
38	DI	117 Defence Intelligence is also involved in the expansion of HMG’s open source intelligence capabilities (i.e. the analysis of information that can be accessed freely on the internet, or bought through commercial providers) through the Defence Intelligence Open Source Hub.
38	DI	Analysis of open source information is being increasingly used by the Agencies and Defence Intelligence to enhance their overall situational awareness, and can be fused with a smaller proportion of secret intelligence to provide a richer picture. (iii) Real-world threat, real-world outcomes 107.
44	DI	The West is strongest when acting in coalition, and therefore the Agencies and Defence Intelligence have a role to play in encouraging their international partners to draw together.
14	DI & GCHQ	The Committee was assured by the Chief of Defence Intelligence that: By executing a joint mission, we [the Ministry of Defence and GCHQ] can move seamlessly between one set of authorisations and another, making sure we’re acting appropriately, but those that are managing the capability are able to make that switch and run those operations effectively.
44	DI & NATO	We are encouraged to note that Defence Intelligence shares its intelligence assessments with NATO, which we were told aim to try “to ensure as common an understanding of the nature of the Russian threat and situation that we face”.
33	DI, GCHQ & MI6	Given the differences between Defence Intelligence’s work and that of the Agencies – including the fact that, in its assessment function, it is a customer for SIS and GCHQ intelligence products 100 HMG, National Security Capability Review, March 2018.
29	DI, GCHQ, MI5 & MI6	On figures alone, it could be said that they took their eye off the ball; nevertheless, the Heads of MI5, SIS, GCHQ and Defence Intelligence all sought to defend against this suggestion.
32	DI, GCHQ, MI5 & MI6	The Home Secretary holds ministerial responsibility for MI5, the Foreign Secretary for SIS and GCHQ, and the Defence Secretary for Defence Intelligence.
4	DI, GCHQ, MI5, MI6, NSS & OSCT	The Committee oversees the intelligence and security activities of the UK Intelligence Community, including the policies, expenditure, administration and operations of MI5 (the Security Service), MI6 (the Secret Intelligence Service or SIS) and GCHQ (the Government Communications Headquarters)* and the work of the Joint Intelligence Organisation (JIO) and the National Security Secretariat (NSS) in the Cabinet Office; Defence Intelligence (DI) in the Ministry of Defence; and the Office for Security and Counter-Terrorism (OSCT) in the Home Office.
9	DI, GCHQ, MI5, MI6, NSS & OSCT	2 Throughout this report the term ‘Intelligence Community’ is used to refer to the seven organisations that the Committee oversees: the intelligence and security Agencies (MI5, SIS and GCHQ); Defence Intelligence in the Ministry of Defence; the Office for Security and Counter-Terrorism (OSCT) in the Home Office; and the National Security Secretariat (NSS) and Joint Intelligence Organisation (JIO) in the Cabinet Office.
50	DI, GCHQ, OSCT, UN, FCO & RIS	Jim Hockenhull OBE – Chief of Defence Intelligence Other officials FOREIGN AND COMMONWEALTH OFFICE Sir Philip Barton KCMG OBE – then Director-General Consular and Security, FCO, and cross-Government Senior Responsible Owner for Russia Other officials GOVERNMENT COMMUNICATIONS HEADQUARTERS Mr Jeremy Fleming – Director, GCHQ Other officials NATIONAL CRIME AGENCY Ms Lynne Owens CBE QPM – Director-General, NCA Other officials OFFICE FOR SECURITY AND COUNTER-TERRORISM Mr Tom Hurd OBE – Director-General, OSCT Other officials 43
32	FCO	This Implementation Group is co-ordinated by the HMG Russia Unit in the Foreign and Commonwealth Office (FCO), and chaired by the Senior Responsible Owner for implementing the Strategy (currently the FCO’s Director-General Consular and Security).
12	GCHQ	GCHQ assesses that Russia is a highly capable cyber actor with a proven capability to carry out operations which can deliver a range of impacts across any sector: • Since 2014, Russia has carried out malicious cyber activity in order to assert itself aggressively in a number of spheres, including attempting to influence the democratic elections of other countries – for example, it has been widely reported that the Russians were behind the cyber-enabled ‘hack and leak’ operation to compromise the accounts of members of the French political party En Marche!
14	GCHQ	The Government announced its intention to develop an Offensive Cyber capability in September 2013, and in 2014 the National Offensive Cyber Programme (NOCP) – a partnership between the Ministry of Defence and GCHQ – was established.
14	GCHQ	The Ministry of Defence and GCHQ have described it as a “genuinely joint endeavour”.
14	GCHQ	GCHQ and the Ministry of Defence have in recent years adopted a more open posture on Offensive Cyber, 19 for example with public references to the successful prosecution of a major Offensive Cyber campaign against Daesh.
14	GCHQ	19 The Director of GCHQ referenced the cyber campaign against Daesh in a speech at CyberUK on 21 April 2018.
17	GCHQ	In terms of the direct threat to elections, we have been informed that the mechanics of the UK’s voting system are deemed largely sound: the use of a highly dispersed paper- based voting and counting system makes any significant interference difficult, and we understand that GCHQ has undertaken a great deal of work to help ensure that the online voter registration system is safe.
27	GCHQ	GCHQ is the UK’s signals intelligence (SIGINT) agency – also focusing on intelligence gathering.
27	GCHQ	79 GCHQ’s intelligence effects work primarily comprises Offensive Cyber.
28	GCHQ	At the height of the Cold War, 70% of GCHQ’s effort was focused on the Soviet bloc.
28	GCHQ	Alongside GCHQ, it also has a major role in the UK’s Offensive Cyber capability.
28	GCHQ	81 Written evidence – GCHQ, 8 March 2019.
28	GCHQ	82 Written evidence – GCHQ, 14 December 2018.
27	GCHQ & MI5	Areas of intelligence coverage work that GCHQ undertakes include: applying selectors to emails obtained by bulk interception; targeted interception of the phone calls of 70 Section 1(2) of the Security Service Act 1989. 71 www.mi5.gov.uk/espionage 72 Written evidence – MI5, 31 October 2018.
21	GCHQ & MI6	Whilst it may be true that some issues highlighted in open source did not require the secret investigative capabilities of the intelligence and security Agencies or were at the periphery of their remits, the Agencies nonetheless have capabilities which allow them to ‘stand on the shoulders’ of open source coverage: for example, GCHQ might attempt to look behind the suspicious social media accounts which open source analysis has identified to uncover their true operators (and even disrupt their use), or SIS might specifically task an agent to provide information on the extent and nature of any Russian influence campaigns.
27	GCHQ & MI6	76 SIS and GCHQ 68.
29	GCHQ & MI6	88 By comparison, SIS and GCHQ saw it as due to the longer lead time required for work on Russia.
29	GCHQ & MI6	89 And GCHQ agreed: A bit like [SIS’s] point, some of the kind of hardcore capabilities that were necessary to keep in the business we maintained and then, really, as the reviews and the discussion around what happened in Crimea really brought minds more to the fore again on Russia, that then led us to move in ramping up again.
33	GCHQ & MI6	The Intelligence Coverage and Effects (ICE) process is the method by which SIS and GCHQ are tasked by the Government.
33	GCHQ & MI6	On Russia, the ICE requirements represent SIS and GCHQ’s tasking in relation to the cross-Whitehall Russia Strategy.
34	GCHQ & MI6	It does not appear that they measure their performance in quite such a developed way: GCHQ and SIS informed us that their assessment of their performance against the ICE Plan was in a comparatively less granular format (which broadly assesses whether or not they had exceeded, met or not met each requirement) and SIS told us that “the question of performance management and metrication … this is a process which is in evolution”.
13	GCHQ & NCSC	The NCSC – part of GCHQ – leads on protecting the UK from cyber attack and, as the authority on the UK’s cyber security environment, sharing knowledge and addressing systemic vulnerabilities.
28	GCHQ, MI5 & MI6	However, by 2006, operational effort was being directed to the fight against international terrorism: in 2006/07, MI5 devoted 92% of its effort to counter-terrorism work, 85 with SIS and GCHQ at 33%.
33	GCHQ, MI5 & MI6	In contrast to SIS and GCHQ, MI5 is self-tasking: it prioritises its work against threats to the UK based on its assessment of their severity.
33	GCHQ, MI5 & MI6	We have been informed that MI5 does, however, align its work on Russia with that of SIS and GCHQ in an agreed tri-Agency approach.
12	GRU	6 The GRU is the Main Intelligence Directorate of the General Staff of the Russian Armed Forces.
13	GRU	This new approach was indicated first by the response to the November 2017 WannaCry attack (with a statement by Foreign Office Minister Lord Ahmad condemning the attack) and the subsequent response to the February 2018 NotPetya attack, then more recently when the Foreign Secretary took the step, on 3 October 2018, of announcing publicly that the UK and its allies had identified a campaign by the GRU of indiscriminate and reckless cyber attacks targeting public institutions, businesses, media and sport 14 – including attribution of the attempted hacking of the Organisation for the Prohibition of Chemical Weapons (OPCW) in the Hague.
45	GRU	Following the GRU attack in Salisbury, the UK’s goal was to respond quickly, and – understanding that Russia is not overly concerned about individual reprisal – to ‘internationalise’ any action against Russia by building as broad a coalition as possible.
45	GRU	This diplomatic response, and the subsequent exposure of the responsible GRU agents, sent a strong message to Russia that such actions would not be tolerated, and provides a platform for the future.
36	GRU & RIS	The well- publicised mistakes Russian operatives made in Salisbury, and later in trying to infiltrate the Organisation for the Prohibition of Chemical Weapons (OPCW), have led to public speculation about the competence of the Russian Intelligence Services (RIS), and the GRU in particular.
4	ISC	Keith Simpson MP The Intelligence and Security Committee of Parliament (ISC) is a statutory committee of Parliament that has responsibility for oversight of the UK Intelligence Community.
23	ISC	The Committee does not oversee the NCA; its work and operations usually fall outside the remit of the ISC.
17	JIC	34 JIC(17)053.
26	JIC	This situation needs to be addressed and managed by Ministers and the JIC [Joint Intelligence Committee].
18	MI5	In our opinion, the operational role must sit primarily with MI5, in line with its statutory responsibility for “the protection of national security and, in particular, its protection against threats from espionage, terrorism and sabotage, from the activities of agents of foreign powers and from actions intended to overthrow or undermine parliamentary democracy …”.
19	MI5	41 We would add to that a requirement for social media companies to co-operate with MI5 where it is suspected that a hostile foreign state may be covertly running a campaign.
19	MI5	In response to our request for written evidence at the outset of the Inquiry, MI5 initially provided just six lines of text.
26	MI5	68 In 2003–2004, the Committee again expressed concern: We remain concerned that, because of the necessary additional effort allocated to counter-terrorism by the Security Service, significant risks are inevitably being taken in the area of counter-espionage.
27	MI5	MI5 66.
27	MI5	MI5’s remit – as set out in the Security Service Act 1989 – is the “protection of national security and, in particular, its protection against threats from espionage, terrorism and sabotage, from the activities of agents of foreign powers and from actions intended to overthrow or undermine parliamentary democracy by political, industrial or violent means”.
27	MI5	70 MI5 states its objectives in this area as being to “seek to find those trying to pass sensitive UK information and equipment to other countries and ensure they don’t succeed” and to “investigate and disrupt the actions of foreign intelligence officers where these are damaging to our country’s interests”.
27	MI5	Twenty years ago, MI5 devoted around 20% of its effort to Hostile State Activity, which includes Russian activity alongside the hostile activity of other states, such as China and Iran.
27	MI5	This fall continued until, by 2008/09, only 3% of effort was allocated by MI5 to all its work against Hostile State Activity (noting that reductions in proportion of overall effort do not translate directly into changes in resource).
27	MI5	73 It was not until 2013/14 that effort began to increase significantly, rising to 14.5% 74 – a level that MI5 says meant that slightly more staff were working on Russia than had been during the Cold War.
27	MI5	74 Written evidence – MI5, 31 October 2018.
28	MI5	85 Written evidence – MI5, 31 October 2018.
29	MI5	MI5 was clear that there was an inevitable reprioritisation due to the terrorist threat: … back then it’s how can we possibly do enough to get ahead of this appalling terrorism problem which … back then was larger than we could see the edges of and one of the things we used to say about it, at exactly the time you’re talking about, was we haven’t yet found the edges of this problem.
32	MI5	In particular, it is our view that, whilst MI5 already works with the police regional Counter- Terrorism Units (which have responsibility for Hostile State Activity), there is scope for them to work more closely together in this area.
33	MI5	This is appropriate given the defensive focus of MI5’s role.
40	MI5	122 The Director-General of MI5 told us that: … there are things that compellingly we must investigate, everybody would expect us to address, where there isn’t actually an obvious criminal offence because of the changing shape of the threat and that for me is fundamentally where this doesn’t make sense.
40	MI5	125 The Director-General of MI5 echoed this, saying: The purpose of [a potential new Espionage Act] is to be able to tighten up on the powers that have become, you know, dusty and largely ineffective since the days of the Official Secrets Act, half of which was drafted for First World War days and was about sketches of naval dockyards, etc., and then there was a 1989 … addition to it, but we are left with something which makes it very hard these days to deal with some of the situations we are talking about today in the realm of the economic sphere, cyber, things that could be, you know, more to do with influence.
41	MI5	The Director-General of MI5 explained that FARA-type legislative provisions would create: … the basis therefore of being able to pursue under criminal means somebody not declaring, thereby being undercover.
41	MI5	It is essential that there is a clear commitment to bring forward new legislation to replace it (and a timetable within which it will be introduced) that can be used by MI5 to defend the UK against agents of a hostile foreign power such as Russia.
27	MI5 & MI6	This operational effort also benefits from the support of corporate and ‘enabling’ services across MI5 (which is not reflected in these figures). 77 www.sis.gov.uk 78 Written evidence – SIS, 17 December 2018.
51	MI5 & MI6	SECRET INTELLIGENCE SERVICE (MI6) Sir Alex Younger KCMG – Chief, SIS Other officials SECURITY SERVICE (MI5) Sir Andrew Parker KCB – then Director-General, Security Service Other officials Expert external witnesses Professor Anne Applebaum – Institute of Global Affairs Mr William Browder – Head of the Global Magnitsky Justice Movement Mr Christopher Donnelly CMG TD – Head of the Institute for Statecraft Mr Edward Lucas – Writer and consultant specialising in European and transatlantic security Mr Christopher Steele – Director, Orbis Business Intelligence Ltd 44
18	MI5 & OSCT	38 The policy role should sit with the Office for Security and Counter-Terrorism (OSCT) – primarily due to its ten years of experience in countering the terrorist threat and its position working closely with MI5 within the central Government machinery.
12	MI6	Russia has sought to employ organised crime groups to supplement its cyber skills: SIS has observed that “this comes to the very muddy nexus between business and corruption and state power in Russia”.
27	MI6	SIS is the UK’s foreign human intelligence (HUMINT) agency, with a “global covert capability” 77 focusing on intelligence gathering.
28	MI6	86 Written evidence – SIS, 17 December 2018; Intelligence and Security Committee of Parliament Annual Report 2007–2008 Cm 7542.
29	MI6	SIS said: I don’t think we did take our eye off the ball.
37	MI6	SIS told us that this means operating with “strategic patience” in terms of both recruiting agents and increasing staff.
8	NATO	It is also seemingly fed by paranoia, believing that Western institutions such as NATO and the EU have a far more aggressive posture towards it than they do in reality.
8	NATO	It appears that Russia considers the UK one of its top Western intelligence targets: while we may not experience the level and type of threat that countries on Russia’s borders suffer, witnesses have suggested that we would sit just behind the US and NATO in any 1
9	NATO	This perception will have been reinforced by the UK’s firm stance recently in response to Russian aggression: following the UK-led international response to the Salisbury attack – which saw an unprecedented 153 Russian intelligence officers and diplomats expelled from 29 countries and NATO – it appears to the Committee that Putin considers the UK to be a key diplomatic adversary.
44	NATO	NATO remains at the heart of strategic thought: the Kremlin considers that any further enlargement of NATO would constitute a breach of the 1997 NATO–Russia Founding Act, and an unacceptable encroachment into its perceived ‘sphere of influence’.
44	NATO	Diminishing the strength of NATO is therefore a key aim of the Kremlin, as is undermining the credibility of Article V of the 1949 North Atlantic Treaty, 146 and “delivering NATO and non-NATO deterrence” therefore forms a key part of the 2019 cross-Whitehall Russia Strategy.
44	NATO	Defence Intelligence highlighted several “really important part[s] of how we feed into the NATO 144 ‘Rise of far-right in Italy and Austria gives Putin some friends in the west’, The Guardian, 7 June 2018.
44	NATO	146 Article V of the 1949 North Atlantic Treaty concerns the principle of ‘collective self-defence’, and states that an armed attack against one or more NATO Members will be considered an attack against them all, and that all NATO Members will act to repel the attack against the affected Member State(s).
45	NATO	As mentioned previously, the resulting expulsion of 153 Russian intelligence officers and diplomats from 29 countries and NATO was an unprecedented international response.
16	NATO & GRU	23 Examples include: • use of state-owned traditional media: open source studies have shown serious distortions in the coverage provided by Russian state-owned international broadcasters such as RT and Sputnik; 24 • ‘bots’ and ‘trolls’: open source studies have identified significant activity on social media; • ‘hack and leak’: the US has publicly avowed that Russia conducted ‘hack and leak’ operations in relation to its presidential election in 2016, and it has been widely alleged that Russia was responsible for a similar attack on the French presidential election in 2017; and • ‘real life’ political interference: it has been widely reported that Kremlin-linked entities have made ‘soft loans’ to the (then) Front National in France, seemingly at least in part as a reward for the party having supported Russia’s annexation of Crimea, 25 and the GRU sponsored a failed coup in Montenegro in October 2016 26 – an astonishingly bold move in a country just a few months from its accession to NATO.
45	NATO & RAF	system”, including “working very closely with NATO colleagues, putting assessments into NATO, [and] working very closely with the NATO Intelligence Fusion Cell at RAF Molesworth”.
13	NCSC	Accountability is an issue in particular – whilst the Foreign Secretary has responsibility for the NCSC, which is responsible for incident response, the Home Secretary leads on the response to major cyber incidents.
13	NCSC	14 NCSC, Reckless campaign of cyber attacks by Russian military intelligence service exposed, 3 October 2018, (www.ncsc.gov.uk/news/reckless-campaign-cyber-attacks-russian-military-intelligence-service- exposed).
17	NCSC	37 We note that the Centre for the Protection of National Infrastructure (CPNI) and the National Cyber Security Centre (NCSC) also support the Government security architecture and play a role in protecting the mechanics of elections, including informing improvements to electoral management software and through protective security advice to political parties.
32	OSCT	This appears unusual: the Home Office might seem a more natural home for it, as it would allow the Office for Security and Counter-Terrorism’s (OSCT) experience on counter-terrorism matters to be brought to bear against the hostile state threat.
24	RIS	61 They are of interest to the Russian Intelligence Services (RIS), which may seek to target them in a number of ways: • it is possible the RIS will seek to monitor some of these individuals using human sources (i.e. agents) and by technical means, for example by intercepting phone calls and hacking into their personal electronic devices; • RIS collection of intelligence could also be used in support of ‘influence operations’, with the objective of degrading an individual’s ability to encourage international or domestic Russian political opposition to Putin and his government; or • the RIS may seek to identify or engineer opportunities to arrange an individual’s arrest and transfer to Russia to stand trial, or indeed meet a worse fate.
36	RIS	Whilst these attacks demonstrate that the RIS are not infallible, it would be foolhardy to think that they are any less dangerous because of these mistakes.
36	RIS	Indeed, the likelihood is that the RIS will learn from their errors, and become more difficult to detect and protect against as a result.
36	RIS	The Russian decision-making apparatus is concentrated on Putin and a small group of trusted and secretive advisers (many of whom share Putin’s background in the RIS).
8	UN	The strengths which Russia retains are largely its inheritances from the USSR and its status as a victor of the Second World War: nuclear weapons, a space presence and a permanent seat on the UN Security Council.
15	UN	While the UN has agreed that international law, and in particular the UN Charter, applies in cyberspace, there is still a need for a greater global understanding of how this should work in practice.

Sentences mentioning none of the organisations but still redacted

rr_sentences %>%
  filter(any_org == 0 & redacted == 1) %>%
  viewSentences()

Page	Services	Sentence
5	(None)	The Committee believes that it is important that Parliament and the public should be able to see where information had to be redacted: redactions are clearly indicated in the report by [redacted].
10	(None)	We note here, however, that there have been a number of cross-cutting themes which have emerged during the course of our work: • Most surprising, perhaps, was the extent to which much of the work of the Intelligence Community is focused on [redacted].
16	(None)	25 [redacted] 26 Written evidence – HMG, 29 June 2018.
17	(None)	34 [redacted].
17	(None)	35 We note that the formal HMG assessment categorises the UK as a “[redacted]” target for political influence operations.
17	(None)	36 In addition to providing secret intelligence, the Agencies may [redacted].
19	(None)	It stated that [redacted], before referring to academic studies.
19	(None)	43 This was noteworthy in terms of the way it was couched ([redacted]) and the reference to open source studies [redacted].
20	(None)	44 However, at the time [redacted].
20	(None)	It appears that [redacted] what some commentators have described as potentially the first post-Soviet Russian interference in a Western democratic process.
20	(None)	We note that – almost five years on – [redacted].
20	(None)	49,50 [redacted].
20	(None)	[redacted].
20	(None)	In October 2018, the Electoral Commission – which had been investigating the source of this donation – referred the case to the National Crime Agency, which investigated it [redacted].
20	(None)	51 [redacted] 13
21	(None)	This focus on [redacted] indicates that open source material (for example, the studies of attempts to influence the referendum using RT and Sputnik, or social media campaigns referred to earlier) was not fully taken into account.
21	(None)	52 However, we have found [redacted] which suggests that [redacted].
21	(None)	[redacted]. (iii) Lack of retrospective assessment 47.
21	(None)	We have not been provided with any post-referendum assessment of Russian attempts at interference, [redacted].
21	(None)	[redacted].
21	(None)	52 [redacted] 53 [redacted] 54 Office of the Director of National Intelligence, Assessing Russian Activities and Intentions in Recent US Elections, 6 January 2017.
23	(None)	The extent to which Russian expatriates are using their access to UK businesses and politicians to exert influence in the UK is [redacted]: it is widely recognised that Russian intelligence and business are completely intertwined.
23	(None)	The Government must [redacted], take the necessary measures to counter the threat and challenge the impunity of Putin-linked elites.
24	(None)	We have been told that [redacted].
24	(None)	64 [redacted].
24	(None)	We were assured that all figures at risk – Russian or otherwise – receive protection according to the level of risk, through a police-led process [redacted].
24	(None)	This would appear to be an immediate and obvious way in to the issue, and the [redacted], so it would appear manageable.
24	(None)	In response we were told that [redacted].
24	(None)	61 These include such high-profile figures as [redacted].
24	(None)	64 [redacted] 65 Oral evidence – [redacted] February 2019.
27	(None)	75 The past two years have seen [redacted]: currently, [redacted]% is allocated to Hostile State Activity, approximately [redacted] which is dedicated to countering Russian Hostile State Activity.
27	(None)	This declined to [redacted]% in 2007.
27	(None)	It only began to increase significantly in [redacted] and currently stands at approximately [redacted]%.
28	(None)	83 It also holds a SIGINT role [redacted], and has a HUMINT unit which is primarily used to support military operations.
29	(None)	[redacted].
30	(None)	The Home Secretary told us that, in his view, resourcing on Russia [redacted] and that there “needs to be more resources in … countering the Hostile State Activity”.
32	(None)	The latest iteration of the Strategy – in March 2019 – has an overarching long-term ‘vision’ of “A Russia that chooses to co-operate, rather than challenge or confront”, 96 [redacted].
33	(None)	In some cases, we have noted that it has not been clear [redacted]: this must be addressed.
33	(None)	102 The ICE Plan for Russia requires [redacted] coverage outcomes and [redacted] effects outcomes, which are prioritised at five levels: ‘non-negotiable’, high, medium, low and ‘opportunity only’.
33	(None)	103 [redacted] 26
34	(None)	Defence Intelligence clearly explained that “we survey our customers of our product, on a scale that we set out from zero to nine, at the moment … the score that we have aggregated across all of our Russia work is [redacted]”.
36	(None)	While some are generic problems that are heightened by Russian ability to exploit them (for example, [redacted]), others are unique to Russia (for example, [redacted]). (i) Structure 94.
36	(None)	However, [redacted]: a way must be found to maintain this momentum across Government. (ii) Technology and data 97.
37	(None)	In terms of human intelligence (HUMINT) operations, technological advancements that gather and analyse data on individuals have generally increased the difficulty [redacted].
37	(None)	The expansion of smart city technology (such as CCTV, smart sensors and mobile device tracking), and the capability that this provides, has increased the ability of [redacted].
37	(None)	108 [redacted]. (iii) The risk of escalation 99.
37	(None)	Due to the difficulty of [redacted], the Intelligence Community have focused their effort on [redacted] main strategic targets, which they assess will provide insight on the most important strategic topics, with intelligence on the lowest priorities collected on an ‘opportunity-only’ basis.
37	(None)	These key targets are [redacted].
37	(None)	[redacted].
38	(None)	Russia is a particularly hard operating environment for other countries’ intelligence officers, so [redacted].
38	(None)	113 [redacted].
38	(None)	This may be [redacted].
38	(None)	The Committee was struck by the relatively small proportion of [redacted] work that is carried out by the Agencies in relation to Russia, compared with the intelligence coverage of Russia that is undertaken.
38	(None)	As a result, the Agencies’ effects work primarily concentrates on [redacted]; capability-building (the sharing of knowledge and capabilities with partners); and counter-intelligence work to disrupt [redacted] operations.
38	(None)	We note that the focus on [redacted] work increased significantly following the events in Salisbury as HMG [redacted] engaged in a substantive and concerted diplomacy effort to co- ordinate a strong international response to the use of chemical weapons against civilians on UK soil.
43	(None)	It is important to include local authorities [redacted].
44	(None)	It is clear that this partnership provides valuable capabilities that [redacted] to the UK, and avoids the duplication of coverage through effective burden-sharing.
44	(None)	However, there remains a question as to whether [redacted].
44	(None)	Their perspectives are particularly useful: whilst UK and Western resources were diverted towards the threat from international terrorism in the early 2000s, [redacted].
44	(None)	As well as providing a wealth of [redacted] intelligence on Russia, they also share the UK’s approach to the Russian threat, and have been willing to stand alongside the UK in taking an increasingly assertive approach to Russian activities.
44	(None)	Whilst there appear to be increasing signs that others in Europe are taking the threat from Russia more seriously [redacted] there has clearly been less success in translating this into building public support for the UK’s diplomatic approach to attribution and condemnation of Russia’s cyber activities.
44	(None)	144 We also note reporting that Israel [redacted] has welcomed Russian oligarchs and their investment, and has thus far been unwilling to challenge the Kremlin openly.
45	(None)	[redacted].
45	(None)	In terms of its ‘near abroad’, Russia clearly intends keeping these countries within its ‘sphere of influence’, and conducts cyber activity and pursues economic policy to that end in [redacted].
45	(None)	HMG initiatives [redacted] are therefore essential.
45	(None)	However, we note that this is not a short-term project: continuing investment and a long-term strategy are required [redacted] against Russian influence.
45	(None)	148 The UK Government ([redacted]) embarked on a diplomacy effort to provide allies with the evidence related to the attack, and to persuade them to join the UK in taking action in the form of expulsions and strengthened sanctions.
45	(None)	149 Whilst the fact that chemical weapons were used – in clear breach of international law and attracting the opprobrium of the international community – was undoubtedly a factor in persuading countries to join forces with the UK, the quick and co- ordinated response from [redacted] HMG more widely, which provided evidence and reassurance to partners, made it easier for them to join in the public condemnation.
45	(None)	148 [redacted] 149 It presents a stark comparison with HMG’s slow and isolated response to Russian aggression after the murder of Alexander Litvinenko in 2006 (despite the use of a radioactive substance in that case).
46	(None)	If HMG is to contribute to peace and security in the Middle East, the Intelligence Community must [redacted], and the UK must have a clear strategy as to how this should be tackled.
48	(None)	153 These were subsequently closed in 2014 after the Games, but re-opened in 2016 ahead of the Euro 2016 tournament and kept open in the run-up to the 2018 Football World Cup, to ensure the security of Russian citizens visiting the UK and UK citizens visiting Russia respectively. [redacted] more proactive engagement, or relationship-building, has been frozen recently, as has planned ministerial engagement.
48	(None)	The ability to have direct conversations enables an understanding of the intentions of both sides in times of crisis – [redacted].
48	(None)	Any public move towards a more allied relationship with Russia at present 153 [redacted] 154 We note, however, that these two pillars only make up a very small part of the overall action.
52	(None)	ANNEX [redacted] 45
54	(None)	CLASSIFIED ORAL AND WRITTEN EVIDENCE [redacted] 47

Sentiment analysis

There’s increasing interest in the sentiment of text- roughly, what emotion is expressed - and a variety of tools for modelling it.

Here’s the plan:

1. Take the sentence level analysis from above.
2. Unnest further to the word level.
3. Explore some of relationships with sentiment, using the word-emotion lexicon by Saif M. Mohammad and Peter D. Turney (2013):

library(textdata)
nrc_sentiments <- get_sentiments("nrc")

rr_sentiment <- rr_sentences %>%
  unnest_tokens(word,
                sentence, drop = F)

rr_sentiment$word_i <- 1:nrow(rr_sentiment)

rr_sentiment <- rr_sentiment %>%
  inner_join(nrc_sentiments, by = "word")

Let’s see which report words appear by sentiment:

library(ggwordcloud)

makeWordCloud <- function(theSentiment) {
  rr_sentiment %>%
    filter(sentiment == theSentiment) %>%
    group_by(word) %>%
    summarise(n = n()) %>%
    mutate(prop = n/sum(n)) %>%
    filter(n >= 5) %>%
    ggplot(aes(label = word,
               size = prop,
               col  = prop)) +
    scale_size_area(max_size = 10) +
    geom_text_wordcloud() +
    theme_minimal() + 
    labs(title = theSentiment)
}

allTheClouds <- map(unique(rr_sentiment$sentiment)
                      %>% na.omit(), makeWordCloud)

library(patchwork)
wrap_plots(allTheClouds, ncol = 2)

I’m not entirely convinced by the words picked out for each of those sentiments (e.g., look where “government” and “money” appear) - maybe anger, disgust, and sadness show something interesting.

toView <- c("anger", "disgust", "sadness")

First glue the word-level analysis back onto the sentences.

I want a count by sentence of each sentiment (n) and also a count of whether a sentiment has been expressed at least once per sentence (the b below is for Boolean).

sentiment_counts <- rr_sentiment %>%
  group_by(sentence_i, sentiment) %>%
  summarise(n = n()) %>%
  mutate(b = as.numeric(n > 0))

## `summarise()` regrouping output by 'sentence_i' (override with `.groups` argument)

sentiment_counts <- rr_sentences %>%
  inner_join(sentiment_counts, by = "sentence_i")

Now plot by page how many times each sentiment has been expressed:

emo_by_page <- sentiment_counts %>%
  group_by(page, sentiment) %>%
  filter(sentiment != "NA") %>%
  summarise(instances = sum(n)) %>%
  mutate(p = instances/sum(instances))

## `summarise()` regrouping output by 'page' (override with `.groups` argument)

emo_by_page %>%
  filter(sentiment %in% toView) %>%
  ggplot(aes(x = page, y = instances, color = sentiment)) +
    geom_line() +
    labs(x = "Page", y = "Count")

Looks like a spike for “anger” there on PDF page 18.

emo_by_page %>%
  filter (instances > 20 & sentiment %in% toView) %>%
  kable(col.names = c("Page", "Sentiment", "N", "Proportion"))

Page	Sentiment	N	Proportion
18	anger	25	0.1315789
42	anger	21	0.1000000

sentiment_counts %>%
  filter(page == 18 & sentiment == "anger") %>%
  select(sentiment, sentence) %>%
  kable()

sentiment	sentence
anger	holding primary responsibility for the active defence of the UK’s democratic processes from hostile foreign interference, and indeed during the course of our Inquiry appeared determined to distance themselves from any suggestion that they might have a prominent role in relation to the democratic process itself, noting the caution which had to be applied in relation to intrusive powers in the context of a democratic process.
anger	They informed us that the Department for Digital, Culture, Media and Sport (DCMS) holds primary responsibility for disinformation campaigns, and that the Electoral Commission has responsibility for the overall security of democratic processes.
anger	However, DCMS told us that its function is largely confined to the broad HMG policy regarding the use of disinformation rather than an assessment of, or operations against, hostile state campaigns.
anger	Overall, the issue of defending the UK’s democratic processes and discourse has appeared to be something of a ‘hot potato’, with no one organisation recognising itself as having an overall lead.
anger	Whilst we understand the nervousness around any suggestion that the intelligence and security Agencies might be involved in democratic processes – certainly a fear that is writ large in other countries – that cannot apply when it comes to the protection of those processes.
anger	DCMS is a small Whitehall policy department and the Electoral Commission is an arm’s length body; neither is in the central position required to tackle a major hostile state threat to our democracy.
anger	Protecting our democratic discourse and processes from hostile foreign interference is a central responsibility of Government, and should be a ministerial priority.
anger	In our opinion, the operational role must sit primarily with MI5, in line with its statutory responsibility for “the protection of national security and, in particular, its protection against threats from espionage, terrorism and sabotage, from the activities of agents of foreign powers and from actions intended to overthrow or undermine parliamentary democracy …”.
anger	38 The policy role should sit with the Office for Security and Counter-Terrorism (OSCT) – primarily due to its ten years of experience in countering the terrorist threat and its position working closely with MI5 within the central Government machinery.
anger	This would also have the advantage that the relationship built with social media companies to encourage them to co-operate in dealing with terrorist use of social media could be brought to bear against the hostile state threat; indeed, it is not clear to us why the Government is not already doing this.
anger	With that said, we note that – as with so many other issues currently – it is the social media companies which hold the key and yet are failing to play their part; DCMS informed us that ***.
anger	39 The Government must now seek to establish a protocol with the social media companies to ensure that they take covert hostile state use of their platforms seriously, and have clear timescales within which they commit to removing such material.
anger	Such a protocol could, usefully, be expanded to encompass the other areas in which action is required from the social media companies, since this issue is not unique to Hostile State Activity.

Word cloud of redactions

Now we have four different levels of representations for the report: page, sentence, word, sentiment.

I’d like to compare word frequency, grouped by whether the sentence they are in has a redaction. That’s a combination of word and sentence level analyses.

It’s probably easiest to revisit rr_sentences, which has the sentence-level information, and unnest it to word-level.

rr_sentences_and_words <- rr_sentences %>%
    unnest_tokens(word,
                  sentence)

I’ll leave the stop words in - removing them by analysis, where necessary.

Firstly, let’s just do the comparison for all sentences:

rr_sentences_and_words %>%
  anti_join(stop_words) %>%
  mutate(redacted = recode(redacted,
                           `0` = "No redactions",
                           `1` = "One or more redactions")) %>%
  group_by(redacted, word) %>%
  summarise(n = n()) %>%
  mutate(prop = n/sum(n)) %>%
  filter(prop >= 1/1000) %>%
  ggplot(aes(label = word, size = prop, color = redacted)) +
    scale_size_area(max_size = 11) +
    geom_text_wordcloud() +
    theme_minimal() + 
    facet_grid(cols = vars(redacted))

The mentions of “oral”, “evidence”, and dates is probably from the footnotes of who gave evidence.

Now by what organisations were mentioned.

library(stringr)

dat4clouds <- rr_sentences_and_words %>%
  anti_join(stop_words) %>%
  mutate(redacted = recode(redacted,
                           `0` = "No redactions",
                           `1` = "One or more redactions")) %>%
  group_by(redacted, mentioned_services, word) %>%
  summarise(n = n()) %>%
  mutate(prop = n/sum(n)) %>%
  filter(n >= 2 &
         mentioned_services != "(None)") %>%
  mutate(services_wrapped = str_wrap(mentioned_services,
                                     5))

## Joining, by = "word"

## `summarise()` regrouping output by 'redacted', 'mentioned_services' (override with `.groups` argument)

Plot it:

dat4clouds %>%
  ggplot(aes(label = word,
             size = prop,
             color = redacted)) +
      scale_size_area(max_size = 10) +
      geom_text_wordcloud() +
      theme_minimal() + 
      facet_grid(cols = vars(redacted),
                 rows = vars(services_wrapped)) +
  labs(title = "Word frequency by organisation and redaction",
       subtitle = "(Words included if mentioned at least twice)")