Blog

AI

Summary of “The National Security Act in 2024” Report

A quick GROK

This document is the first annual report (dated December 2025) by Jonathan Hall K.C., the Independent Reviewer of State Threats Legislation, appointed in February 2024. It reviews the operation of Parts 1 and 2 of the National Security Act 2023 (NSA), which came into force on 20 December 2023, along with related border powers under Schedule 3 to the Counter-Terrorism and Border Security Act 2019. The review assesses whether the new laws effectively counter state threats (malign activities by foreign powers below the threshold of armed conflict) while avoiding excessive overreach, protecting rights, and ensuring proportionality.

https://assets.publishing.service.gov.uk/media/69411a3eadb5707d9f33d7e8/E03512978_-_Un-Act_The_National_Security_Act_in_2024_Accessible.pdf

Overview of the National Security Act 2023

The NSA modernises outdated espionage laws (repealing parts of the Official Secrets Acts) and introduces new offences to address evolving threats from states like Russia, China, and Iran. Key features include:

  • Broad, typology-based offences covering espionage (e.g., disclosing protected information or trade secrets), assisting foreign intelligence services (Sections 1–3, 17), sabotage (Section 12), foreign interference (Section 13, including in elections), prohibited places access (Sections 4–11), and preparatory conduct (Section 18).
  • A “foreign power condition” linking acts to foreign states (including allies, proxies, or unwitting actors), with wide extraterritorial application.
  • Enhanced police powers: arrest/detention up to 14 days, border examinations (suspicion-less under Schedule 3), and civil prevention measures (State Threats Prevention and Investigation Measures, STPIMs).
  • Aims to make the UK a “harder target” for hostile actors, inspired by incidents like the 2018 Salisbury attack.

The Act treats economic security as intertwined with national security and uses “tech-proof” language to cover cyber and remote acts.

Usage and Statistics in 2024

As the Act was new, comprehensive official statistics (unlike those for terrorism laws) were not yet published in 2024. The report notes limited data availability to avoid revealing capabilities to adversaries. No aggregate figures for arrests, charges, prosecutions, or convictions under the main offences are provided. Notable mentions:

  • One conviction under Schedule 3 for failing to comply with a border examination (R v Adam Karim, March 2024).
  • No STPIMs imposed.
  • Preliminary use of powers, with emerging prosecutions (not detailed to avoid prejudicing cases).

(The report predates some high-profile 2024/2025 cases under the Act, such as charges against individuals accused of assisting Russian, Chinese, or Iranian intelligence services.)

Notable Examples and Hypotheticals

The report uses anonymised or historical examples to illustrate risks, including:

  • Unwitting assistance to foreign intelligence (e.g., sharing public code or providing services).
  • Border examinations yielding evidence for exclusions (e.g., links to China’s United Front Work Department).
  • Scenarios involving journalists, academics, or diaspora members potentially caught by broad definitions.

Challenges and Risks

The reviewer highlights potential overreach:

  • Broad definitions (e.g., “ought reasonably to know”) risk criminalising naïve or innocent conduct, chilling free speech, journalism, protest, and academic collaboration.
  • Suspicion-less border powers and constructive knowledge elements could lead to arbitrary detention or profiling.
  • Diplomatic immunity limits prosecutions; closed proceedings raise fairness concerns.
  • Lack of defences for ordinary interactions or public information.

Outcomes and Effectiveness

The framework is described as “formidable” for deterrence, investigation, and prosecution, increasing risks for hostile actors. Early outcomes are positive but emerging, with prosecutorial discretion seen as a key safeguard against misuse. Public exposure of threats via courts could educate and deter.

Recommendations and Forward-Looking Statements

  • Publish official statistics on powers’ use by a fixed date for transparency and monitoring.
  • Strengthen defences (e.g., for reasonable beliefs or naïve cases), issue public guidance (e.g., on protests), and improve safeguards (e.g., custody visits, Code of Practice updates).
  • Monitor for chilling effects on lawful activities and unjust outcomes.
  • Future reviews (e.g., 2025) will assess progressing prosecutions and potential legislative tweaks.

Overall, the report concludes the NSA provides robust tools against state threats but requires vigilant application to balance security with civil liberties. It emphasises the need for ongoing scrutiny as case law develops.

Threat Intel

SMSBlasters Historic Incidents

Whilst some people go on about DNSSEC, PUBLIC WIFI and JUICE JACKING they seem to be missing out on a threat that is real, active and has seen increased adoption by threat actors. SMS BLASTING!

Sounds cool, but basically it’s an ISMSI Catcher/Fake CELL network that is broadcasted between 500m and 2Km that lets an attacker send SPOOFED SMS messages to any cell that connects. This can be used for scams, phishing etc.

Read more “SMSBlasters Historic Incidents”
Leadership

The danger of internet exposed RDP

There’s lots of things in cyber security to consider when looking at how to defend a network, and whilst the world goes mad about public wifi and juice jacking, the real threats are often far simpler. Imagine having say an Active Directory domain member, or even controller exposed to the internet with Remote Desktop Protocol? Might sound insane but this is a common route for entry for ransomware actors.

Read more “The danger of internet exposed RDP”
Guides

What are passkeys and how do they work?

Phishing, Brute Force, Data Breaches, Info stealers etc. are all ways in which people steal credentials. We’ve had this problem for decades, stealing something or guessing something people know is relatively trivial over the internet. This leads to a huge volume of the breaches we have seen over the last 20+ years. Whilst people seem to understand this, they don’t seem to know how to change to fix this…. (it’s not that we don’t know it’s that change is hard for lots of reasons). So there might be a solution with the adoption of passkeys! So what are passkeys?

Read more “What are passkeys and how do they work?”
Education

All your DNSSEC base are belong to us

DNSSEC (Domain Name System Security Extensions) has been around since the mid-2000s and technically works well: it cryptographically signs DNS records so resolvers can verify that the answer they got really came from the authoritative server and wasn’t tampered with. Despite that, adoption and real-world deployment remain surprisingly low outside a few countries (notably .se, .nl, .cz and some others). Here’s why it never took off broadly, and why the rise of DNS over HTTPS (DoH) has made many people conclude that pushing DNSSEC further isn’t worth the effort anymore.

Read more “All your DNSSEC base are belong to us”
Leadership

The cost of resetting a password

If someone asked you how much the cost of a task is, I bet you would struggle to given them an accurate response, the default position of most people is to underestimate a cost of doing something (but estimation science show’s us that it tends to vary based on role e.g. project managers are risk averse, engineers think they can solve things faster than they can and executives often just want it to be cheaper for the sake of it being cheaper – Parkinsons Squeeze I think that is called)

Years ago I stared looking at total cost of ownership (TCO) and Return on Investment modelling (I mean a lot of years ago….) and I’ve created a range of models for organisations for:

  • Sales Estimation
  • Business Cases
  • Budget Planning
  • Project Planning
  • System Optimisation Analysis
Read more “The cost of resetting a password”
Threat Intel

Fortiweb – CVE-2025-58034

‘CVE-2025-58034 is an OS command injection vulnerability (CWE-78) in Fortinet FortiWeb, allowing an authenticated attacker to execute unauthorized code on the system through crafted HTTP requests or CLI commands. It affects versions including FortiWeb 8.0.0-8.0.1, 7.6.0-7.6.5, 7.4.0-7.4.10, 7.2.0-7.2.11, and 7.0.0-7.0.11. The vulnerability has a CVSSv3 score of 6.7 (medium severity) and has been observed exploited in the wild, prompting its addition to CISA’s Known Exploited Vulnerabilities catalog.’

Read more “Fortiweb – CVE-2025-58034”