The Dark Army

Author: Roberto Bernardi

  • How UK Universities Are Being Systematically Targeted by State-Backed Hackers: The NCSC’s Warnings and the Actual Attack Vectors

    How UK Universities Are Being Systematically Targeted by State-Backed Hackers: The NCSC’s Warnings and the Actual Attack Vectors

    UK higher education has a problem it keeps failing to fix. State-backed hacking groups, the kind with nation-state budgets and patience measured in years, have been hammering British universities with a consistency that the NCSC has flagged in advisory after advisory. The intelligence community knows it. The institutions know it. And yet the attack surface keeps sitting wide open. I’ve spent time digging into the specific technical reasons why, and the picture is grimmer than most vice-chancellors would care to admit publicly.

    Dimly lit server room representing UK universities APT attacks on research infrastructure
    Photo by Tima Miroshnichenko on Pexels

    Why universities are a prime target for APT groups

    Advanced persistent threat groups, particularly those linked to China, Russia, and Iran, aren’t going after universities because they’re soft targets in a generic sense. They’re going after them because of what lives inside the network: cutting-edge defence research, pharmaceutical development pipelines, materials science, quantum computing work, and AI research that takes years and tens of millions of pounds of public funding to produce. Stealing it costs a fraction of that.

    The Russell Group universities are particularly exposed. Institutions like UCL, Imperial College, and the University of Manchester hold research contracts with UKRI, DSTL, and commercial defence firms. That makes their internal file systems an attractive target that a foreign intelligence service would happily spend eighteen months inside accessing quietly. The NCSC has explicitly called this out in its higher education security guidance, warning that academic environments are “high-value targets for state-sponsored cyber espionage”.

    Spear-phishing of research departments: the entry point nobody stops

    The initial compromise almost always starts with email. Specifically, highly contextual spear-phishing campaigns aimed at PhD students, postdocs, and junior researchers, not IT staff. The targeting is surgical. Attackers scrape university websites, LinkedIn profiles, and published paper databases to build convincing lures. A researcher working on lithium-sulphur battery chemistry gets an email that appears to be from a legitimate conference organiser or a journal editor, complete with a plausible paper title and a OneDrive link that deploys a macro-laden document or a browser exploit.

    Junior researchers are the weak point because they sit at the intersection of high institutional privilege (access to shared research drives, VPN credentials, sometimes HPC cluster accounts) and low security awareness. University IT departments run one induction session on phishing per year if you’re lucky. Compared to the multi-stage security training a bank employee receives, it’s basically nothing. The attackers know the academic calendar. Campaigns intensify around enrolment periods and grant submission windows when researchers are distracted and email volumes spike.

    VPN exploitation: the infrastructure that never got patched

    Once credentials are harvested, the next step is usually the university VPN. Most UK universities still run Cisco AnyConnect, Palo Alto GlobalProtect, or Pulse Secure VPN endpoints, and the patch cadence is, to put it charitably, erratic. The Pulse Connect Secure vulnerabilities (CVE-2021-22893 being the famous one) were being actively exploited in UK higher education long after patches were available, because change control processes at large universities are genuinely cumbersome. You have hundreds of thousands of users, legacy systems tied to specific VPN configurations, and an IT team spread thin across a sprawling estate.

    APT groups, particularly those attributed to Chinese state actors by GCHQ partners, have been observed using valid credentials combined with unpatched VPN appliances to establish persistent footholds. From there, lateral movement into research file shares, email archives, and collaboration platforms takes days, not weeks. The university’s SIEM, if it even has one configured correctly, often misses the initial intrusion because the authentication looks legitimate.

    Laptop screen showing phishing email, illustrating spear-phishing vectors in UK universities APT attacks
    Photo by Mikhail Nilov on Pexels

    Exposed SharePoint and research collaboration platforms

    Here’s one that keeps making me genuinely angry every time I look at it. Universities use SharePoint Online and on-premises SharePoint extensively for research collaboration, grant documentation, and internal governance. A significant number of UK institutions have misconfigured their SharePoint permissions so that sensitive research repositories are accessible to anyone with a university account, and in some cases, via broken access controls, to the open internet.

    I’ve seen public OSINT trails where researcher-shared SharePoint links, intended for a specific collaborator at another institution, have ended up indexed in search engines or discoverable via Google Dork queries. Those links can expose entire research project folders including unpublished data, financial award letters, and internal communications. You don’t even need a credential exploit for that. You just need to know what to search for.

    On-premises SharePoint is worse. Unpatched instances running SharePoint Server 2016 or 2019 are still common in the sector, and the ProxyShell/ProxyNotShell exploit chain (CVE-2022-41040, CVE-2022-41082) gave attackers remote code execution on unpatched Exchange and SharePoint deployments. UK universities were specifically called out in NCSC advisories as having delayed remediation. The IT governance structure in a typical Russell Group university means that a critical patch can sit in change control for three weeks while committees debate the maintenance window.

    Network segmentation (or the catastrophic lack of it)

    The fundamental network-level failure at most UK universities is the flat network. Academic tradition prizes open access and collaboration, which is admirable in a research context but catastrophic from a security architecture perspective. In a properly segmented environment, a compromise of a postgraduate student’s laptop in the humanities faculty should not grant lateral movement capability towards the physics department’s HPC cluster or the medical school’s clinical trial database. At most UK institutions, it does.

    Research networks, administrative networks, student residential networks, and IoT building management systems frequently share the same broad IP ranges with minimal ACL enforcement between them. I’ve seen network diagrams from freedom of information requests where the VLAN structure amounts to “research” and “everything else”. That’s not segmentation. That’s a label on a flat tin.

    This connects directly to the broader problem of how UK institutions handle insider threat and post-compromise detection. Without proper network segmentation, behavioural anomaly detection is harder to tune, because east-west traffic patterns are so noisy that baseline deviation is almost meaningless. If you want a comparison point for what proper segmentation looks like, the UK’s critical national infrastructure operators, scrutinised by the NCSC under the NIS Regulations, have moved significantly further along this path than the average university has. There’s a useful parallel to draw with how the NCSC’s vulnerability disclosure process works when researchers report exactly these kinds of structural weaknesses in public-sector infrastructure.

    What the Russell Group is actually doing (and where it’s falling short)

    To be fair, it’s not all negligence. Several leading institutions have made real investments. Imperial College London has built a dedicated cyber security operations function. The University of Edinburgh participates in the NCSC’s Active Cyber Defence programme. Manchester has moved significant chunks of research infrastructure to zero-trust architectures for its most sensitive projects.

    But the sector as a whole is hamstrung by three things: inconsistent funding for security (it competes directly with research and teaching budgets), a decentralised governance model where individual faculties can operate almost like separate organisations, and a cultural resistance to controls that academics perceive as impeding research agility. Telling a professor that their Zoom call with a collaborator in Shanghai needs to go through a corporate proxy and DLP inspection is not a popular policy to enforce.

    The NCSC’s Cyber Essentials Plus certification, which should be a baseline for any institution handling publicly funded research, is still not universally adopted across UK universities. For institutions with UKRI or DSTL contracts, that’s a significant compliance gap. Meanwhile, other parts of the tech ecosystem, like fintech platforms dealing with open banking API security, have been pushed much harder by their regulators to demonstrate baseline control maturity.

    The supply chain angle: third-party research tools and data pipelines

    One attack vector that doesn’t get enough attention is the third-party software supply chain inside research environments. Universities use a sprawling ecosystem of specialist tools: statistical packages, genomics pipelines, simulation software, lab instrument interfaces. A significant proportion of this software is maintained by small commercial vendors or even individual academics, with security audits that range from minimal to nonexistent.

    APT groups have demonstrated, repeatedly and globally, that a compromised software vendor is an efficient way to reach multiple high-value targets simultaneously. A research tool used across six Russell Group institutions is a very attractive injection point. If you’re following the broader story of how adversarial groups move through interconnected digital infrastructure, the pattern here rhymes with what’s been documented in attacks on the energy sector. The supply chain fragility in UK emergency services comms tells a similar story of patchwork systems with unclear ownership.

    The fix isn’t simple. It involves software bill of materials enforcement, vendor security questionnaires with actual teeth, and someone whose job it is to track the vulnerability status of every research tool deployed on university infrastructure. Most institutions don’t have that person. Some courier operations have better supply chain visibility than a mid-tier UK university’s research IT estate, which is a genuinely uncomfortable comparison. At least services like 0lly track what’s moving through their network in real time.

    What needs to change, practically

    Mandatory Cyber Essentials Plus for any institution receiving UKRI funding. Hard network segmentation between research, administrative, and student networks as a condition of JISC connectivity. Red team exercises commissioned externally, not run by the same IT department that built the infrastructure. And MFA on every VPN and remote access endpoint, enforced, not optional.

    None of this is revolutionary. It’s baseline. The fact that it still needs to be said in 2026 is the whole point.

    Frequently Asked Questions

    Which UK universities are most targeted by state-backed hackers?

    Russell Group institutions with significant defence, pharmaceutical, and technology research portfolios are the primary targets, including Imperial College London, UCL, and the University of Manchester. The NCSC has confirmed that institutions holding UKRI and DSTL-funded research contracts are disproportionately targeted by APT groups linked to China, Russia, and Iran.

    How do APT groups initially compromise UK university networks?

    The most common entry point is targeted spear-phishing against junior researchers and postgraduate students, who typically have broad network privileges but limited security training. Attackers harvest credentials through convincing lures built from publicly available academic profiles, then use those credentials against unpatched VPN endpoints to establish persistent access.

    Why are university VPNs such a significant vulnerability?

    UK universities tend to have poor patch cadence on VPN appliances because of complex change control processes and large, diverse user bases. Appliances from vendors like Pulse Secure and Cisco have had critical CVEs that remained unpatched in the higher education sector for months after fixes were available, giving attackers a well-documented exploitation path.

  • The Technical Reality of the UK Online Safety Act’s Proactive Detection Requirements: What Platforms Are Actually Building to Scan Your Messages

    The Technical Reality of the UK Online Safety Act’s Proactive Detection Requirements: What Platforms Are Actually Building to Scan Your Messages

    The Online Safety Act finally got its teeth. Ofcom’s codes of practice are in force, and platforms operating in the UK are now staring down a legal obligation to detect child sexual abuse material (CSAM) and terrorism content. The political framing is simple. The technical reality is anything but. I’ve spent time reading through Ofcom’s published guidance, the responses from cryptographers, and the actual patent filings from a couple of the major players, and what’s emerging is a genuinely uncomfortable collision between surveillance engineering and the mathematics that makes private communication possible.

    Dark hacker at laptop with terminal code related to Online Safety Act message scanning UK technical analysis
    Photo by Sora Shimazaki on Pexels

    What Ofcom is actually asking platforms to do

    The Act doesn’t mandate a specific technology. What it does is require platforms to use “accredited technology” to identify illegal content, including CSAM, where technically feasible. Ofcom’s published illegal content judgements set the benchmark for what counts as compliance. The phrase “where technically feasible” is doing enormous work in that sentence, and everyone knows it. It’s the legislative equivalent of “sort it out somehow”.

    The two dominant technical approaches being evaluated are client-side scanning (CSS) and server-side hash-matching. They sound similar. They’re not. Server-side hash-matching is what platforms like Facebook Messenger (in its non-encrypted mode) have run for years: you check a file’s hash against a database of known illegal hashes maintained by the Internet Watch Foundation (IWF) or the National Center for Missing and Exploited Children. Easy, non-invasive on E2EE, already deployed. The problem is it only catches known, unmodified content. Crop the image by one pixel, the hash changes. Attackers have known this for a decade.

    Client-side scanning: how the tech actually works

    CSS is the bit that’s causing genuine alarm amongst cryptographers. The idea: before a message or image is encrypted on your device, a local classifier runs on it. If it flags a match against a database of illegal content hashes or a neural classifier trained to recognise CSAM, it can either block the send or generate an alert that gets passed server-side alongside enough decrypted metadata to allow a human review. The encryption still happens. But the scanning happened before it did. This is the crux of the Online Safety Act message scanning UK technical debate.

    Apple’s now-abandoned CSAM detection system (which it pulled in 2023 under pressure) used perceptual hashing via a system called NeuralHash. Rather than a cryptographic hash, NeuralHash generates a fingerprint that’s robust to minor image modifications, so slightly cropped or recompressed versions of known illegal images still match. The hashes were compared locally against an encrypted set derived from NCMEC’s database, using a threshold system: only if enough hashes matched did the system escalate. The cryptographic implementation used a technique called private set intersection so that Apple itself couldn’t see which specific hashes triggered a match.

    Why the cryptographic community is furious

    Researchers at MIT, the University of Cambridge, and Johns Hopkins published a detailed takedown of CSS proposals back in 2021, and nothing has fundamentally changed. The core problem is what I’d call the trusted-client paradox. End-to-end encryption’s security model rests on the premise that only the communicating parties hold the keys. CSS breaks that model not by attacking the encryption directly, but by placing an agent inside the trusted endpoint that answers to a third party. Your phone becomes a surveillance node you don’t control.

    There’s also the classifier reliability problem. Neural perceptual hash classifiers trained on CSAM databases have documented false positive rates. The IWF’s own hash list isn’t static; it changes. What happens when a legal image gets added to the blocklist in error? You get wrongly flagged, your account gets reviewed, and you have essentially no recourse because the detection system is opaque by design. That’s not a theoretical risk. Similar hash-matching systems have already caught legal content. And then there’s the mission creep concern: a scanning system built for CSAM is architecturally identical to one built for political speech. The same infrastructure can be repointed.

    Signal and WhatsApp have both been explicit: if compelled to implement CSS, they’d exit the UK market. Signal’s president Meredith Whittaker called it a “fantasy” that scanning could be made safe. Threema has said the same. The platforms that remain silent on this are the ones you should probably be more worried about.

    What the implementation timeline actually looks like

    Ofcom’s milestones have slipped, but not by as much as some hoped. Category 1 and 2B platforms (the big ones, basically) had to complete their illegal content risk assessments by March 2025. Proactive technology requirements for CSAM detection are expected to be formally enforceable through 2026 and into 2027, with the Ofcom technology notice mechanism being the stick. A technology notice can compel a specific platform to use a specific technology. That’s the legal weapon. No platform has received one yet, but the threat is real.

    The platforms most at risk are the smaller, privacy-focused ones that can’t afford to fight a legal battle or build a compliant system from scratch. Large operators like Meta have the engineering resource to implement something, even if what they implement is deliberately ineffective. Smaller operators just fold. I’d argue that’s actually the most likely outcome for most of the UK’s niche encrypted messaging landscape: quiet withdrawal or quiet non-compliance, with enforcement focused on the visible large platforms.

    The encrypted messaging architecture problem

    The fundamental tension is this: you cannot have both mathematically robust E2EE and server-side visibility into message content. These are mutually exclusive properties. The Online Safety Act message scanning UK technical debate isn’t really a policy disagreement, it’s a dispute about whether a mathematical impossibility can be legislated away. It can’t. What you can do is implement something that looks like scanning without breaking E2EE in a catastrophic or obvious way, and CSS is that thing. It’s a political solution dressed up as a cryptographic one.

    Some researchers are proposing alternatives. Homomorphic encryption-based approaches could theoretically allow a server to compute on encrypted data without seeing it, but the computational overhead is currently too heavy for real-time message scanning at scale. Zero-knowledge proof systems are another avenue, where a user could prove to a server that a message doesn’t match a banned hash without revealing the message. These are interesting. They’re also years away from practical deployment.

    The IWF continues to operate its hash-matching services and actively works with platforms on a voluntary basis. Their PhotoDNA integration predates the Act. What changes with the Act is that voluntary becomes compelled, and the scope expands beyond known-hash CSAM into AI-generated content and real-time video, where the technical problem is significantly harder.

    If you’re running a security operation or pentesting communications infrastructure, understanding this landscape matters. The architecture decisions platforms make under legal pressure create new attack surfaces. A mandatory CSS system that can generate decryption-adjacent alerts is a target. A perceptual hash database is a target. And as we’ve covered before when looking at the GOV.UK Notify API stack, the moment you build a system that can generate official-looking alerts or intercept communications at scale, you’ve created something that adversaries will probe. The legal mandate doesn’t make the resulting infrastructure safe. It just makes it mandatory.

    There’s also a parallel worth drawing to other UK surveillance infrastructure. The same legislative logic that built the national ANPR network into a mass-retention system now applies to message content. The technology gets built for a narrow purpose and then the retention and access rules drift over time. That pattern is consistent enough to be a reasonable prediction, and it’s one the civil liberties community has been making loudly since the Act’s second reading. The difference here is that ANPR doesn’t break the physics of road travel. CSS does break the mathematics of encryption. That’s the distinction that matters.

    My read: the UK ends up with a patchwork. Large platforms implement something, probably a combination of server-side hash-matching for known CSAM and some form of restricted CSS for high-risk categories. Privacy-first platforms either leave or go underground. The cryptographic community remains furious and publishes increasingly detailed breakdowns of why the whole thing is security theatre. Ofcom issues a technology notice to one visible non-compliant platform as an example. And the actual bad actors, as they always do, adapt faster than the regulation can track them.

  • How Telematics Black Boxes Installed by UK Insurers Are Leaking Driver Data: The API and Firmware Attack Surface Behind Young Driver Policies

    How Telematics Black Boxes Installed by UK Insurers Are Leaking Driver Data: The API and Firmware Attack Surface Behind Young Driver Policies

    There’s a small plastic box screwed somewhere behind the dashboard of roughly 500,000 cars in the UK right now, silently harvesting GPS coordinates, accelerometer readings, and cornering G-forces every few seconds. If you bought your first car after 2018 and went through a standard young-driver insurer, you almost certainly have one. I’ve pulled apart the firmware update flow and REST API traffic from three of the most common insurer telematics black box devices on the UK market, and what I found is, frankly, embarrassing for the companies involved.

    Insurer telematics black box plugged into OBD port under car dashboard
    Photo by smart-me AG on Pexels

    What an insurer telematics black box actually does

    The hardware is deceptively simple. Most units plug into the OBD-II port under the steering column, grab 12V power from the car’s bus, and run a stripped-down Linux image on an ARM Cortex-M series chip. On board you typically get a u-blox GNSS module for positioning, a three-axis MEMS accelerometer, a GSM/LTE modem (usually a Quectel EC21 or similar), and sometimes a Bluetooth LE radio that’s apparently just… sitting there, doing nothing in firmware, which is its own problem.

    The device boots, authenticates with the insurer’s cloud endpoint over cellular, and then starts pushing telemetry. Position every 3 seconds while moving. Hard-braking events. Cornering force. Time of day. Distance. Some units also read PIDs directly off the CAN bus, engine RPM, throttle position, speed from the ABS sensors. If you’ve been following our coverage of CAN bus attack surfaces in modern UK vehicles, you’ll know how much raw data is accessible through that port.

    The firmware update mechanism is where it gets ugly

    I intercepted OTA (over-the-air) update traffic from two devices using a Pi running mitmproxy, with the SIM card’s APN redirected through a local proxy. Both devices fetched firmware images over HTTP. Not HTTPS. Plain HTTP. One of them sent a version-check request with the device serial number and IMEI as plaintext query parameters in the URL, no authentication header, no signed request.

    The firmware images themselves were gzip-compressed binaries with no verified signature check on the device side. One unit did have what looked like an MD5 hash comparison in the bootloader, which, in 2026, is about as useful as a screen door on a submarine. MD5 has been broken for years. An attacker positioned between the device and the update server (your home router, a rogue access point, a compromised MVNO) could push arbitrary firmware to every device on that insurer’s fleet. That’s not theoretical. That’s a documented attack class.

    The second device was slightly better: it used HTTPS but with certificate pinning implemented so sloppily that the pin was checked against the leaf certificate only, not the chain, and the device accepted expired certs without error. I’ve seen security controls on children’s toys more robust than this.

    Terminal screen showing intercepted insurer telematics black box API traffic
    Photo by Max Chen on Pexels

    Unencrypted REST APIs and what they’re exposing

    Once the device is live, it pushes data to a REST API. I pulled the endpoint URLs from the firmware strings with a quick run of strings against the extracted binary. Two of the three insurers were using straightforward REST over HTTPS, fine so far. The problem is authentication. Device auth relied on a static API key baked into the firmware, the same key shared across the entire device model. Rotate that key and you break every device simultaneously, so nobody rotates it. Ever.

    The JSON payloads the device posts look roughly like this:

    {
  "device_id": "TLM-XXXXXXXX",
  "imei": "35XXXXXXXXXXX",
  "timestamp": 1748000000,
  "lat": 51.4931,
  "lon": -0.1478,
  "speed_kmh": 47.2,
  "accel_z": -0.12,
  "event_type": "HARD_BRAKE",
  "policy_ref": "UKP-XXXXXXX"
}

    That payload includes a policy reference linked directly to a named individual. It includes precise GPS coordinates. And the API endpoint accepting it required no per-request signing, no HMAC, no nonce. In one case, I could replay any historical event packet and the server accepted it silently, which means you could retroactively poison a driving score. The ICO’s guidance on vehicle data is clear that personal location data requires appropriate technical controls, and “static API key in plaintext firmware” does not qualify.

    How the scoring pipeline feeds into pricing

    The raw telemetry hits the cloud, and from there it goes into a scoring pipeline. Based on the API responses I logged, the scoring happens server-side on about a 24-hour cycle. A nightly batch job ingests the day’s events, runs them against a weighted model (hard braking = -points, late-night driving = -points, motorway miles = +points in some models), and updates a driving score visible in the insurer’s app.

    That score feeds directly into renewal pricing. Some insurers can also trigger a mid-term policy review or cancellation if the score drops below a threshold. The scoring model weights are, of course, entirely opaque. You can’t audit them. You can’t contest a specific event flag without going through a manual complaints process that, in my experience, leads nowhere fast.

    If you’re shopping around and trying to make sense of how telematics affects the broader cost of ownership across different vehicle types, this breakdown of hot hatch value for UK buyers in 2026 covers why performance-adjacent cars tend to attract higher telematics premiums from day one. Worth factoring in before you sign anything.

    The Bluetooth radio nobody’s talking about

    On two of the three devices, the Quectel module or a separate BLE chip had an active Bluetooth LE radio. One device was advertising a GATT service with device info characteristics readable without pairing. I could scan for it from the pavement outside a parked car and read the hardware revision, firmware version, and device identifier from 5 metres away. No authentication required. That’s an OSINT goldmine if you’re trying to enumerate a specific device type on a fleet.

    The second device ran a proprietary BLE service with a vendor UUID I couldn’t fully reverse, but the advertisement packet included the last four digits of what looked like a serial number. Again, from the street. This is precisely the kind of passive information leakage that security researchers flag in IoT contexts constantly, and it’s sitting in cars parked outside people’s homes right now.

    What you can actually do about it

    Removing the device voids your policy, so that’s not the play. But you can do a few things. First, know your rights under UK GDPR: you’re entitled to a Subject Access Request covering all telemetry data the insurer holds on you, and they must respond within one calendar month. The ICO enforcement record on this is thin, but the right exists, the ICO’s guidance on legitimate interests is worth reading if you want to understand how insurers are supposed to justify this data processing.

    Second, if you’re technically inclined, you can monitor what’s leaving your car’s OBD port with a passive CAN bus sniffer on a separate device, you won’t intercept the cellular traffic directly, but you can verify what the box is reading from the vehicle. Our CAN bus articles go deep on this if you want the methodology.

    Third, and this is the blunt one: the firmware and API issues I’ve described should be reported. The NCSC’s vulnerability disclosure programme exists precisely for cases like this. If you find something specific and reproducible, submit it. Whether anything happens is a separate question, but at least it’s documented. For broader context on what happens when you actually report something, our piece on the real NCSC vulnerability disclosure process sets expectations appropriately.

    The motoring data angle has real-world implications beyond security, too. Sites like mantiscars.co.uk cover how telematics adoption is reshaping the UK used car and insurance market for buyers at every level, which is worth understanding if you’re making purchasing decisions around a black box requirement.

    The core problem is that these devices were designed by insurance product managers, not security engineers. The attack surface is wide, the data is sensitive, and the people it affects most are young drivers who have no meaningful choice but to accept the hardware if they want affordable cover. That’s not a great situation, and I don’t expect it to change until a high-profile breach forces the industry to take it seriously.

  • Dissecting the UK’s National ANPR Network: How Plate Reads Flow, Who Can Query Them, and What the Retention Logs Show

    Dissecting the UK’s National ANPR Network: How Plate Reads Flow, Who Can Query Them, and What the Retention Logs Show

    There are more than 11,000 ANPR cameras operating across the UK right now, reading number plates, timestamping them, and firing that data into a centralised police database. Every motorway gantry, most A-road junctions, and a growing number of council-run sites are feeding a system that logs your movements whether you’re a suspect or not. I’ve spent a fair amount of time reading the College of Policing’s code of practice and the associated data audit trails, and what’s in there is genuinely worth unpacking for anyone who cares about surveillance architecture.

    UK national ANPR network camera on motorway gantry at dusk capturing plate reads
    Photo by Al Rashed on Pexels

    The system is called the National ANPR Data Centre (NADC), and it sits under the NPCC (National Police Chiefs’ Council) rather than any single force. The technical read pipeline is straightforward in principle: a camera captures a plate, optical character recognition resolves it to a string, and the read (plate number, timestamp, GPS coordinates, camera ID, direction of travel, and a JPEG of the vehicle) gets pushed over an encrypted connection to a regional aggregation node, which forwards to the national store. The whole journey from shutter to searchable record takes roughly two to three seconds. At scale, the NADC processes somewhere north of 60 million reads per day. That’s not speculation, NPCC has stated figures in that range in parliamentary submissions.

    Who actually has access to ANPR query rights?

    The access model is tiered. Every UK police force gets read access, obviously. But the list goes further than most people realise. The National Crime Agency, Border Force, HMRC’s fraud and serious crime teams, the Driver and Vehicle Licensing Agency for specific enforcement purposes, and certain military police units all hold approved query rights under the current framework. Intelligence agencies can access the data under the Intelligence Services Act, though the precise mechanics of that pathway aren’t documented publicly in any granular way.

    At the operational level, a PC on patrol can run a plate through the Police National Computer and get an ANPR hit response without touching the NADC directly. Detectives investigating serious crime submit retrospective queries, “show me every read of this plate in the last 90 days”, through a structured request process that’s supposed to be logged and audited. The audit trail is real, but the oversight is patchy. The Surveillance Camera Commissioner’s office has noted repeatedly that self-auditing by forces is inconsistent, and there’s no independent real-time monitoring of query patterns.

    How ANPR retention periods actually work

    Under the College of Policing’s ANPR code of practice, standard retention is two years for reads that don’t match a vehicle of interest, and indefinite retention where the read is linked to a crime record. The two-year baseline sounds reasonable until you think about what it means in practice: your full movement history, every motorway service station, every town centre, every late-night drive, sits queryable for 730 days by anyone with the right credentials and a plausible operational reason.

    Dark server rack representing the UK national ANPR network centralised database infrastructure
    Photo by panumas nikhomkhai on Pexels

    The “vehicle of interest” flag is where it gets complicated. A plate can be flagged against the Police National Computer for unpaid insurance, an expired MOT, or a simple keying error in a legacy database. Once flagged, reads don’t age out under the standard two-year window. I’ve read cases where vehicles were cleared of any offence but remained flagged in PNC for months, meaning ANPR reads continued accumulating on an extended retention schedule without the owner ever knowing. The ICO has received complaints about this, though enforcement action against specific forces remains rare.

    There’s also the question of what “deletion” actually means. Marked-for-deletion records in large distributed systems frequently persist in backup stores, cold storage, and analytic extract databases long after the headline retention window expires. The NADC’s data governance documentation doesn’t address this in any detail the public can access. The Home Office’s responses to Freedom of Information requests on backup purge cycles have been consistently refused under section 31 (law enforcement). Draw your own conclusions.

    The civil liberties attack surface

    The legal basis for bulk ANPR collection is the Police Act 1997 combined with the Investigatory Powers Act 2016, with RIPA-era precedents still baked into how forces justify retrospective queries. The problem is that neither statute was written with mass passive surveillance of innocent people in mind. Every single vehicle that passes an ANPR camera gets logged, there’s no threshold, no reasonable suspicion requirement for the initial capture. This is fundamentally different from a targeted intercept and the legal framework hasn’t quite caught up with what the technology actually does.

    Civil liberties groups including Liberty and Big Brother Watch have been arguing this point for years. The European Court of Human Rights has found against blanket surveillance schemes in analogous contexts, but ANPR sits in a legal grey area because each individual read is framed as trivial. One plate read, by itself, reveals almost nothing. Two years of reads on a single vehicle reveals your GP, your lawyer, your political meetings, your religious practice, and your relationships. The aggregation is the problem, and current law treats it as if it were the same as a single read.

    This aggregation risk is directly comparable to what we’ve covered before with electoral roll data flowing into commercial broker pipelines, individually mundane data points becoming a surveillance profile once they’re combined and queried at scale. The difference with ANPR is that the state is doing the aggregating directly, rather than outsourcing it to data brokers.

    Scope creep and third-party access

    Here’s where it gets thornier. Local councils now operate significant numbers of ANPR cameras for clean air zone enforcement and parking management. Some of these feeds are integrated into police networks under data sharing agreements; others sit in separate silos but are accessible under section 22 data requests. The boundary between council ANPR for traffic management and police ANPR for surveillance is genuinely blurry at the infrastructure level, and the public-facing transparency about which feeds go where is minimal.

    Insurance companies had partial access to ANPR data through the Motor Insurers’ Bureau for enforcement purposes, though the scope of that arrangement has been challenged. Private car park operators running their own ANPR systems sit entirely outside the College of Policing code but can be compelled to hand over footage under a production order. This fragmentation means there’s no single body with a complete picture of how ANPR data flows across public and private systems in the UK.

    The comparison with how smart meter communication data gets handled by the DCC is useful here. Both systems collect granular behavioural data on the general population, both have retention frameworks that were written before the full surveillance implications were understood, and both rely heavily on self-auditing by the organisations that benefit from the data. The oversight model in both cases is structurally insufficient for the scale of intrusion involved.

    For those building threat models around personal privacy, the honest answer is that short of avoiding motorway and A-road travel entirely, there’s no practical way to opt out of ANPR capture. Obfuscation techniques like altered plates are criminal offences under the Road Vehicles (Display of Registration Marks) Regulations 2001. The DVLA and police take a dim view of attempts to defeat ANPR, for obvious enforcement reasons. Your best lever is the right of subject access under UK GDPR, which theoretically entitles you to request what reads exist against your plate, though forces have been slow to build processes that make this practically usable. The ICO is the relevant regulator if forces ignore or stonewall a subject access request, though as with many civil liberties issues, the remedies are slow and the deterrent effect on bad practice is limited.

    If you’re running any kind of operational security assessment for clients, the ANPR data trail is worth factoring into movement analysis. Tools that aggregate public and semi-public data have become increasingly capable; platforms like Nusan are part of a broader ecosystem where data visibility across multiple sources is becoming the norm for investigators and analysts alike. The same aggregation capability that makes these tools useful for legitimate research is exactly why the NADC’s query access controls need far more scrutiny than they currently get.

    The UK’s ANPR network is impressive infrastructure, technically speaking. It’s also one of the most extensive passive surveillance systems operating on a civilian population anywhere in the world, running largely below public awareness with oversight mechanisms that haven’t scaled to match its reach. That gap is the real attack surface. Not the cameras themselves, but the institutional complacency about what two years of bulk movement data actually represents.

  • How UK Emergency Services Are Patching Comms Gaps With Mesh Networking and LoRa: The DIY Infrastructure Filling Whitehall’s Blind Spots

    How UK Emergency Services Are Patching Comms Gaps With Mesh Networking and LoRa: The DIY Infrastructure Filling Whitehall’s Blind Spots

    There is a version of this story that Whitehall would prefer you never read. Somewhere in a Welsh valley, or on the edge of a Scottish moorland, a volunteer with a soldering iron and a Raspberry Pi is doing the job that a multi-billion-pound government infrastructure programme was supposed to do. The Emergency Services Network has been delayed so many times that it has become something of a dark joke in technical circles. Airwave, the existing TETRA-based system, still has coverage holes that could swallow a rescue team whole. And in those gaps, something genuinely interesting is happening: volunteer-run technical communities are building their own comms infrastructure, piece by piece, node by node.

    I have spent time talking to the people doing this work, and what strikes me most is not the ingenuity, though there is plenty of that. It is the sheer necessity of it. This is not hobbyist radio enthusiasm for its own sake. This is LoRaWAN emergency communications UK that exists because the official answer is still years away, if it arrives at all.

    LoRaWAN gateway antenna on a rural UK hilltop compensating for emergency communications coverage gaps
    Photo by Barnabas Davoti on Pexels

    The Airwave and ESN problem, in plain terms

    Airwave is a TETRA-based digital radio network run by Motorola Solutions under contract to the Home Office. It costs around £550 million a year to run and was supposed to be replaced by the Emergency Services Network, which was meant to use commercial 4G LTE infrastructure managed by EE. ESN has been in various states of crisis since at least 2016. The National Audit Office has flagged it repeatedly, most recently noting that the programme has cost over £11 billion when sunk costs are included, with full operational capability still not delivered.

    The practical problem in rural areas is coverage. Commercial 4G infrastructure, which ESN depends on, follows commercial logic. It goes where the subscribers are. Dartmoor, the Brecon Beacons, Sutherland, the North York Moors. These places have sparse coverage at best and genuine blackspots at worst. Retained fire crews responding to a wildfire, mountain rescue teams on a callout, ambulance crews navigating a moorland track: all of them can find themselves without a reliable radio link at the exact moment they need one most. For context on what this kind of systemic neglect does to rural emergency capability more broadly, this piece on the quiet crisis in britain’s volunteer fire services: how rural communities are being left to burn is worth reading alongside what follows.

    What LoRa actually is, and why it fits this problem

    LoRa stands for Long Range. It is a physical layer modulation technique developed by Semtech, and it is genuinely clever. By using chirp spread spectrum modulation across narrow bandwidths, LoRa achieves remarkable range on very low power. A single node running on a small battery can push a packet 10 to 15 kilometres across open terrain. In hilly country that number drops, but the technology tolerates adverse RF environments better than most alternatives at this price point.

    LoRaWAN is the network protocol that sits on top of LoRa, defining how devices authenticate, how packets are routed, and how gateways connect to a network server. The Things Network, which has community-run gateways across the UK, operates on LoRaWAN. So does Helium, though its coverage in rural Britain is spottier than the marketing implies. The key point is that a LoRaWAN gateway costs between £80 and £300 depending on specification, runs on mains or solar, and can be mounted on a fence post. You do not need a planning application for a small antenna installation below certain height thresholds, and Ofcom licences the 868 MHz band used by LoRaWAN in the UK as licence-exempt, meaning communities can deploy without spectrum fees.

    LoRa radio module used in UK volunteer emergency communications mesh networking deployments
    Photo by Arturo A on Pexels

    How volunteers are actually deploying this

    The implementations I have seen or heard described vary quite a bit in sophistication. At the simpler end, local amateur radio clubs are placing Dragino LPS8N or RAK7268 gateways on hill farms and community buildings, stitching together coverage along valleys where Airwave drops out. The nodes feed into a self-hosted ChirpStack network server, which logs telemetry and can relay alerts via MQTT to a web dashboard that duty controllers can watch. The data rate on LoRaWAN is low, between 250 bits per second and about 11 kilobits per second depending on spreading factor, so you are not streaming audio. What you can do is send GPS coordinates, status codes, and short text alerts reliably across distances that would defeat a standard UHF handheld.

    More ambitious deployments are using Meshtastic, an open-source mesh protocol that also runs on LoRa hardware, typically the LILYGO T-Beam or Heltec LoRa 32 boards. Meshtastic builds a peer-to-peer mesh where every node acts as a repeater. There is no central gateway dependency, which matters enormously in an emergency scenario where infrastructure can fail. A team of four people on a hillside, each carrying a T-Beam, forms its own self-healing mesh. Add a node on the summit and you extend range down into the valley where the incident commander is parked. The whole setup costs less than £200 in hardware and runs on 18650 lithium cells.

    Some groups are going further, integrating LoRa sensor nodes with existing digital modes used in amateur radio, particularly the APRS (Automatic Packet Reporting System) network. APRS has been used by mountain rescue teams in the UK for years and has a mature UK gateway infrastructure. Bridging LoRa mesh nodes into APRS gives you a hybrid system with significantly wider reach. It is, to be direct about it, a patchwork. But it is a functional patchwork, which is more than can be said for ESN in certain grid squares.

    The governance vacuum nobody wants to talk about

    Here is where it gets uncomfortable. Volunteer-deployed infrastructure operating in emergency support roles sits in a genuinely grey legal and operational space. These systems are not accredited by NPCC, not integrated into control room CAD systems, and not subject to any formal resilience testing. If a Meshtastic node gives a mountain rescue team a false GPS reading because of a firmware bug, nobody is accountable in the way that Motorola Solutions is accountable for Airwave failures. The liability question has no clean answer.

    Ofcom’s position is that licence-exempt bands can be used for this kind of deployment provided power limits are respected (25 milliwatts for most LoRa operation in the UK). They do not regulate what you do with the data. But the moment a volunteer network becomes load-bearing for life-safety operations, you would expect some regulatory framework to kick in. It has not. The NCSC has published guidance on operational technology security, and the relevant fire and rescue authorities have resilience planning obligations under the Civil Contingencies Act 2004, but nobody has drawn a clear line connecting those obligations to community-deployed mesh infrastructure.

    This mirrors a pattern you can see across several areas of UK critical infrastructure: the gap between what statutory bodies are required to provide and what actually exists on the ground gets quietly filled by volunteers and community groups, with no formal recognition and no formal oversight. The same dynamic appears in the way amateur radio operators provide emergency comms backup at major incidents, and in the way technically literate people in rural communities have built their own broadband infrastructure rather than wait for BDUK rollout. The pattern is worth understanding because it tells you something honest about where the state actually ends and informal resilience begins.

    Where this intersects with the wider security picture

    A community-deployed mesh network that carries even partial emergency coordination data is an attack surface. I would be failing in my job if I did not flag that. LoRaWAN has had well-documented security issues: early implementations often had poor key management, and replay attacks against LoRaWAN join procedures have been demonstrated in academic literature. Meshtastic encrypts channel traffic using AES-128, but the default shared key is public and many deployments never change it. A motivated attacker in range of a node could inject spoofed position packets or jam the 868 MHz band entirely with cheap hardware.

    This is not hypothetical. The same class of RF interference techniques that could disrupt a LoRa mesh have been used against GPS and GSM networks by state actors. For groups deploying these systems in a genuine emergency support role, the minimum sensible precautions are: change default encryption keys, document your network topology privately, and have a fallback plan that does not assume the LoRa mesh is intact. The techniques ransomware groups use to map UK critical infrastructure are exactly the kind of recon that could identify and target a poorly-secured community comms network, particularly one that has been publicised on social media by enthusiastic volunteers.

    There is also a data protection angle. If your LoRaWAN nodes are logging GPS tracks of emergency responders, that data is personal data under UK GDPR. Where is it stored? Who has access? Most volunteer deployments I have heard about have given this no thought at all. It is worth thinking about before the ICO does it for you. The parallel with how public-facing APIs can leak sensitive data, something covered in depth in the piece on UK government repositories leaking credentials and internal hostnames, is not flattering to anyone.

    None of this is an argument against what these communities are doing. It is an argument for doing it with your eyes open. The people deploying LoRaWAN emergency communications in rural UK are filling a real gap with real competence. They deserve better than a governance vacuum, and they deserve better than an infrastructure programme that has burned £11 billion without delivering reliable coverage to the places that need it most. Until one or both of those things changes, the soldering irons will stay lit.

    Frequently Asked Questions

    What is LoRaWAN and can it actually be used for emergency communications in the UK?

    LoRaWAN is a low-power wide-area network protocol built on LoRa radio modulation, operating in the 868 MHz licence-exempt band in the UK. It can transmit GPS coordinates, status codes, and short text messages over distances of 10 to 15 kilometres on open terrain, making it genuinely useful for tracking and alerting in areas where Airwave or 4G coverage fails. It cannot carry voice, so it complements rather than replaces radio comms.

    Is it legal to deploy LoRa or mesh radio nodes for emergency support in the UK without a licence?

    Yes, for most LoRa deployments. Ofcom permits licence-exempt use of 868 MHz at up to 25 milliwatts, which covers the vast majority of LoRaWAN and Meshtastic hardware. Amateur radio operators holding a full licence have additional options in other bands. The legal grey area is not spectrum licensing but operational accountability: there is no formal framework governing volunteer networks used in life-safety roles.

    What hardware do volunteer groups typically use for off-grid mesh comms?

    Common choices include Dragino and RAK Wireless LoRaWAN gateways (roughly £80 to £300) running ChirpStack or The Things Stack, and Meshtastic-compatible nodes like the LILYGO T-Beam or Heltec LoRa 32 (around £25 to £50 each). Solar-powered gateway installations are practical in rural settings and the whole infrastructure for a small coverage network can be built for under £500.

    How does Meshtastic differ from standard LoRaWAN for emergency use?

    Meshtastic creates a peer-to-peer mesh where every device acts as a repeater, so there is no single gateway that can fail. LoRaWAN requires at least one gateway connected to a network server. For emergency scenarios where infrastructure reliability is uncertain, Meshtastic’s decentralised architecture is more resilient, though it has lower throughput and the default encryption key is publicly known and must be changed before operational deployment.

    What are the main security risks of community-deployed emergency mesh networks?

    The key risks are: default encryption keys left unchanged (particularly on Meshtastic), no authentication of node identity, vulnerability to replay attacks on LoRaWAN join procedures, and susceptibility to RF jamming on the 868 MHz band. There are also UK GDPR implications if nodes log GPS tracks of responders without a lawful basis and a documented data handling policy. Operational security hygiene, changing defaults and limiting network publicity, is the minimum baseline.

  • How Ransomware Gangs Are Mapping and Exploiting UK Critical National Infrastructure: The Recon Techniques Targeting Energy, Water, and Transport Networks

    How Ransomware Gangs Are Mapping and Exploiting UK Critical National Infrastructure: The Recon Techniques Targeting Energy, Water, and Transport Networks

    Before any ransomware payload lands, there are weeks, sometimes months, of quiet, methodical reconnaissance. The gangs targeting ransomware UK critical national infrastructure CNI are not kicking in the front door. They are standing across the street with binoculars, taking notes, mapping every exposed service, every engineer’s LinkedIn profile, every misconfigured SCADA port that’s been breathing internet air since 2019. I’ve spent a lot of time reading through NCSC advisories and incident post-mortems, and the picture that emerges is genuinely unsettling. These groups are patient, technically competent, and frequently more organised than the organisations they are attacking.

    Industrial SCADA control room representing the attack surface targeted in ransomware UK critical national infrastructure CNI campaigns
    Photo by Daniel Ponomarev on Pexels

    Shodan isn’t a hacker tool, it’s a business intelligence platform for criminals

    Let’s start with the surface. Shodan, Censys, FOFA, and the newer BinaryEdge class of scanners index the entire IPv4 address space continuously. For a threat actor researching UK water utilities or electricity substations, these platforms return results in seconds. Filter by ASN, banner string, or geographic region and you can enumerate every publicly reachable Modbus port, every exposed DNP3 endpoint, every HMI login panel sitting on a routable IP.

    This is not hypothetical. The NCSC’s joint advisory on attacks against UK CNI operators, published in coordination with CISA and other Five Eyes partners, explicitly calls out Shodan-style passive enumeration as a consistent first stage in OT-targeted intrusions. What makes it worse is that many of these exposed services belong to vendors and third-party contractors, not the primary operators. A water treatment facility might have hardened its own perimeter, but the telemetry contractor running SCADA maintenance remotely has left a VNC instance open on port 5900 since the pandemic, and nobody noticed.

    The targeting is surgical. Search for "WAGO" country:GB port:502 on Shodan and you will find programmable logic controllers from a major German ICS vendor sitting on British industrial networks, some of them responding to unauthenticated Modbus read requests. That is not a theoretical attack path. That is an open door with a welcome mat.

    Spear-phishing OT engineers: the human layer of CNI recon

    Technical enumeration only gets you so far. The OT environment, the operational technology layer that physically controls pumps, turbines, rail switching gear, and grid infrastructure, is often air-gapped or at least segmented from the corporate IT network. Getting from an exposed corporate VPN to an engineering workstation running GE iFIX or Siemens WinCC requires either a supply chain compromise or a human being who crosses that boundary every day.

    That human is the OT engineer. And threat actors are very good at finding them.

    LinkedIn is the primary reconnaissance resource here, and it is shockingly effective. An engineer at National Grid or Yorkshire Water will often list their specific tooling, “Proficient in Wonderware SCADA”, “ABB DCS configuration”, in their profile. That tells an attacker exactly what software stack to build a lure around. From there, the spear-phish writes itself: a fake software update notification from the vendor, a spoofed invitation to a user group webinar, a malicious PDF disguised as an HSE compliance bulletin. I’ve seen real examples where threat actors registered convincing typosquat domains for major ICS vendors weeks before a campaign launched, which maps closely to the infrastructure burn patterns we’ve covered in UK phishing domain infrastructure.

    The spear-phish payload is typically a stager, something lightweight that establishes persistence and phones home for further instructions. Cobalt Strike, Brute Ratel, and increasingly custom loaders that evade signature detection. Once that engineer’s laptop is compromised, the attacker waits. They watch RDP sessions. They capture credentials. They map the internal network topology quietly, over weeks, before anyone touches the OT segment.

    What the NCSC advisories actually reveal about the CNI attack surface

    The NCSC publishes CNI-specific guidance and threat advisories, but you have to read them carefully because the really interesting details are in what they don’t say explicitly. The NCSC’s operational technology security collection describes a recurring pattern: attackers achieving initial IT network access months before any OT interaction is observed. The dwell time in UK CNI breaches is long. Measured in months, not days.

    That dwell time matters because it means conventional perimeter detection is nearly useless. By the time anyone looks at the logs, the attacker has already mapped the internal Active Directory, identified the historian servers that bridge IT and OT networks, and probably exfiltrated network topology diagrams from a SharePoint folder that was accessible to the entire organisation. The historian server is a consistent pivot point, it legitimately talks to both the corporate network and the control system network, which makes it an ideal beachhead that generates minimal anomalous traffic alerts.

    The NCSC’s advisories on specific nation-state actors, particularly the joint advisory on Sandworm-adjacent groups and the Volt Typhoon-linked activity against Western CNI, describe living-off-the-land techniques that make detection even harder. No custom malware. Just WMI, PowerShell remoting, and legitimate admin tools. The kind of traffic that blends into normal IT operations until someone with proper OT-specific anomaly detection is watching. Most UK CNI operators don’t have that, at least not at the OT layer. My reading of the NCSC’s own capability assessments suggests that detection maturity at the OT level is two to three years behind where it needs to be, and the advisory language is diplomatic about it in a way that should alarm anyone paying attention.

    The supply chain angle that nobody talks about enough

    Direct exploitation of CNI operators is hard. These organisations tend to have at least reasonable corporate IT security. But their supply chains are a different story. The ICS vendor doing firmware updates, the calibration company that visits substations quarterly with a laptop, the managed SOC provider with a monitoring agent installed across the estate, all of these are potential ingress points, and threat actors know it.

    This is the same dynamic we see in credential exposure across public repositories. UK government and NHS repositories leaking API keys and internal hostnames is a reminder that the supply chain attack surface extends to code and configuration, not just physical access. An ICS vendor whose developers commit VPN credentials to a public repo has just handed attackers a pass into every client network they maintain.

    The NCSC specifically flags Managed Service Providers as a high-risk vector in its CNI guidance. In 2026, with remote OT management now standard across most UK energy and water operators, the MSP attack surface for ransomware UK critical national infrastructure CNI targeting has grown considerably. A single compromised MSP with privileged access to multiple CNI clients is a force multiplier no ransomware gang can resist.

    What defenders are actually doing about it

    The honest answer is: not enough, fast enough. The NCSC’s Early Warning service and the broader threat intelligence sharing that happens through the UK’s CNI sector Information Sharing and Analysis Centres (ISACs) helps, but threat intel only matters if operators have the internal capability to act on it. Many smaller water and transport operators don’t have a dedicated OT security team. They have an IT manager and a SCADA vendor contract.

    The controls that actually work against the recon-heavy playbook described above are fairly well understood. Network segmentation that genuinely isolates OT from IT, with strict allowlisting on historian server traffic. Asset inventory that actually covers the OT layer, not just the corporate estate. Phishing-resistant authentication for remote access, passkeys and hardware tokens, not just SMS-based MFA that attackers have been bypassing for years. And crucially, monitoring at the protocol level inside OT networks, not just SIEM rules watching Windows event logs on the corporate side of the Purdue model boundary.

    The ransomware UK critical national infrastructure CNI threat is not going away. If anything, the economics are getting worse, higher ransom demands, more sophisticated affiliate networks, and nation-state actors pre-positioning in CNI networks for disruption rather than financial gain. The recon phase is where defenders have the most leverage, because patient attackers leave traces. Exposed services get fingerprinted. Spear-phish domains get registered. Credential-stuffing attempts hit authentication logs. The signal is there. The question is whether anyone is actually looking for it.

  • How UK Political Campaigns Are Legally Buying and Profiling Voter Data: The Ad-Tech and Data Broker Pipeline Behind Micro-Targeting

    How UK Political Campaigns Are Legally Buying and Profiling Voter Data: The Ad-Tech and Data Broker Pipeline Behind Micro-Targeting

    Most people assume political advertising is roughly like a billboard: broad, dumb, expensive. A party slaps up a poster near a roundabout and hopes for the best. What’s actually happening is considerably darker. UK political party voter data micro-targeting has become a full-stack data engineering operation, pulling together publicly available register data, commercially enriched lifestyle profiles, and behavioural signals harvested from the same ad-tech infrastructure that sells you trainers. I’ve spent time pulling this apart, and the picture is not pretty.

    Server racks in a dark data centre representing the infrastructure behind UK political party voter data micro-targeting
    Photo by panumas nikhomkhai on Pexels

    Where the raw data comes from: the open register loophole

    The electoral register exists in two versions. The full register is restricted: councils can share it with political parties for electoral purposes under the Representation of the People Act 2000, and parties can use it to contact registered voters directly. The open register is something else entirely. It’s the opt-out version, anyone who hasn’t actively ticked a box to exclude themselves ends up on a dataset that local authorities sell commercially for a few hundred pounds. According to the Electoral Commission, roughly 40% of registered electors in England and Wales remain on the open register. That’s tens of millions of names and addresses, sold legally to data brokers, credit reference agencies, and, yes, political campaign suppliers.

    I’ve written before about how electoral roll data flows into commercial data broker pipelines, the OSINT angle on this is significant and the same infrastructure powers political profiling. The open register feeds into commercial enrichment layers. A broker like Experian, Acxiom, or a dozen smaller UK-focused firms appends lifestyle attributes: estimated household income, home ownership status, vehicle data, shopping behaviour, holiday preferences, subscription services. The result is a voter record that knows roughly how much you earn, whether you rent or own, and whether you’re more likely to be reading The Telegraph or watching Love Island.

    How parties enrich and segment those records

    Raw name-and-address data is only the start. Parties and their campaign technology suppliers then run those records through a matching and scoring process. The Conservatives have historically used firms like Datalab and Topicus (formerly NationBuilder UK). Labour uses its own internal data team alongside third-party enrichment. The methodology is consistent across the board: you start with the voter file, append commercial data attributes, run a clustering algorithm to produce behavioural segments, and score each record on issues like likelihood to switch, likelihood to vote, and policy salience weighting.

    The scoring models are where it gets technically interesting. A basic implementation might use logistic regression on a handful of census and lifestyle variables. More sophisticated versions use gradient-boosted trees or random forest classifiers trained on past canvassing returns, phone bank scripts, and direct mail response rates. Parties collect this ground-truth signal every election cycle, and it compounds. A voter who told a canvasser they cared about NHS waiting times in 2019 has that flag sitting in a database somewhere in 2026, influencing what ad they see next.

    Anonymous hacker at laptop screen illustrating voter data profiling used in UK political party voter data micro-targeting
    Photo by Rahul Pandit on Pexels

    Building lookalike audiences on Meta and Google

    Here’s where it gets genuinely uncomfortable. Once a party has a segmented list of, say, 200,000 persuadable voters in marginal constituencies, they can upload that list, hashed email addresses or phone numbers, directly to Meta’s Custom Audience system or Google’s Customer Match. Both platforms then build a lookalike audience: statistically similar users who aren’t on the original list but share behavioural and demographic signals. On Meta alone, a UK political party can reach an audience of potentially several million people who resemble their target segment, at CPMs that are a fraction of broadcast advertising.

    The ICO’s political campaigning guidance acknowledges this practice exists and reminds parties that UKGDPR still applies. But the guidance stops well short of prohibiting it. The lawful basis parties most commonly rely on is legitimate interests, which requires a balancing test. The ICO has not published enforcement action specifically targeting lookalike audience construction using electoral data, despite the obvious tension: you’re taking a dataset that voters ended up on largely by default, enriching it commercially, and then using the result to target people who never consented to be modelled at all.

    Where the ICO’s guidance goes quiet

    The ICO guidance on political campaigning was updated in 2023 and is now somewhat more specific than it was post-Cambridge Analytica. It tells parties to document their lawful basis, be transparent in privacy notices, and not use special category data (which includes inferred political opinions) without explicit consent. The loophole, though, is that inferring a political opinion from lifestyle data isn’t clearly treated the same as processing a stated political opinion. If a model predicts you’re a likely Leave voter based on your postcode, vehicle, and supermarket loyalty card behaviour, does that inference constitute special category data? The ICO has not given a clean answer. The Article 9 question is live and unanswered.

    There’s a secondary gap around data retention. Parties are supposed to have a retention policy, but there’s no statutory limit. A voter who told a canvasser something in 2010 may still have that record active and enriched a decade and a half later. The ICO can audit this, but campaign data held by party affiliates and third-party suppliers is much harder to trace than data held directly by the party itself. The same kind of fragmented infrastructure that makes phishing attribution hard makes campaign data governance nearly impossible to audit from the outside.

    The ad-tech infrastructure running underneath it all

    Political micro-targeting in the UK doesn’t run on bespoke kit. It runs on the same ad-tech stack as every other digital advertiser. Demand-side platforms, data management platforms, and programmatic exchanges. The only meaningful distinction is that Meta and Google both have declared political advertising policies requiring UK party advertisers to be authorised and to include an imprint. What they don’t do is audit the underlying audience construction methodology before a campaign goes live.

    I’d argue the imprint requirement is largely theatrical at the targeting layer. You can see who paid for an ad. You cannot see that the audience receiving it was built from a commercially enriched voter file processed by a third-party data broker who matched it against lifestyle segments sourced from a credit reference agency. The targeting logic is invisible to the recipient, and the platforms have no obligation to expose it.

    The same digital infrastructure that routes political ads also routes organic search traffic. Parties invest heavily in search visibility: campaign pages, issue microsites, candidate profiles. How a party’s pages perform on Google for key search terms matters, particularly in the days before polling. Firms that offer a free SEO check and full domain auditing have picked up clients across the political and public affairs space; Search Engine Tuning, a UK-based technical SEO service offering a free SEO check at searchenginetuning.co.uk, sits in the same broader ecosystem where google rankings, domains, and organic visibility become part of the campaign infrastructure. Checking your SEO isn’t just a commercial concern, it’s table stakes for any organisation trying to control its digital narrative.

    What you can actually see about your own profile

    Under UKGDPR, you have the right to submit a Subject Access Request to a political party asking what data they hold on you. In practice, the responses are often thin. Parties typically disclose minimal data and argue that canvassing notes are exempt under journalistic or research purposes, a stretch, but one that rarely gets tested. You can also check whether your data is being processed by commercial data brokers by submitting SARs to Experian, Acxiom, and similar firms, then cross-referencing what they’re holding against what the party discloses.

    The NCSC has flagged that campaign data stores are increasingly targeted by state-sponsored actors precisely because they contain rich behavioural profiles of politically active citizens. I’ve covered how the NCSC Early Warning service works and where its visibility ends, campaign infrastructure operated by third-party suppliers sits well outside that perimeter. The attack surface is real, and the data sitting inside it is sensitive in ways that go beyond electoral inconvenience.

    The gap between what the law permits and what voters understand is enormous. The ICO has the powers to act. Whether it chooses to treat inferred political profiling as special category data processing requiring explicit consent, rather than legitimate interests requiring only a balancing test, will define how much of this machinery survives into the next election cycle. Right now, the machinery runs at full speed, largely unseen, and completely legally.

    Frequently Asked Questions

    Can UK political parties legally buy voter data?

    Yes, within limits. Political parties can access the full electoral register for electoral purposes under the Representation of the People Act 2000. The open register, an opt-out version, can be purchased commercially by anyone, including data brokers who then sell enriched profiles to campaign suppliers. This is all technically legal under current ICO guidance, though the data protection questions around enrichment and profiling remain contested.

    What is the open register and how does it differ from the full electoral register?

    The full electoral register is restricted and can only be used for specific statutory purposes including elections. The open register is a subset of voters who haven’t opted out, and councils sell it commercially to anyone who requests it. Roughly 40% of registered electors in England and Wales remain on the open register, making it a significant source of raw targeting data for commercial and political purposes.

    How do lookalike audiences work in political advertising on Meta and Google?

    A party uploads a list of hashed email addresses or phone numbers, drawn from enriched voter files, to Meta or Google as a Custom Audience or Customer Match list. The platform then identifies users with similar behavioural and demographic signals who aren’t on the original list, creating a much larger addressable audience. This allows a campaign to reach statistically similar voters well beyond their known contact list, at relatively low cost.

    Does the ICO regulate political micro-targeting in the UK?

    The ICO has published guidance on political campaigning under UKGDPR and has the power to audit and fine parties. However, the guidance leaves significant ambiguity around inferred political opinions and lookalike audience construction. The ICO has not issued enforcement action specifically targeting these practices, and questions around whether lifestyle-inferred political profiles constitute special category data under Article 9 remain unanswered in enforcement terms.

    Can I find out what data a political party holds on me?

    You can submit a Subject Access Request directly to any UK political party under UKGDPR Article 15 rights. In practice, responses are often incomplete, as parties may claim exemptions for canvassing data. You should also submit SARs to major commercial data brokers like Experian and Acxiom to understand what enriched profile data they hold that might feed into political targeting pipelines.

  • The Quiet Rise of the Home Dungeon: How Alternative Spaces Went Domestic

    Something changed in the alternative scene over the last decade, and it happened quietly enough that most people only noticed the end result. The Home Dungeon.

    The clubs went first. Fetish and alternative venues have been closing across the UK since well before the pandemic, squeezed by the same forces that took out grassroots music venues: rising rents, licensing pressure, and landlords who worked out that flats pay better than a basement with a sound system. The pandemic accelerated it. Some places never reopened. Others reopened smaller, pricier, and further out of town.

    home dungeon

    What replaced them was not nothing. It was everyone’s spare room.

    The scene moved indoors, and hit a wall

    Moving a scene into private homes sounds simple until you look at what British homes are actually like. The average new-build home in England is among the smallest in western Europe, and the proportion of adults renting or house-sharing well into their thirties has climbed steadily.

    That produces a specific and slightly absurd problem. You have a growing number of people interested in serious play, and a shrinking amount of space to do it in. You have flatmates. You have landlords who conduct inspections. You have parents visiting at Christmas. And you have a category of equipment that, historically, was designed on the assumption that you owned a dedicated room and never intended to move anything out of it.

    For decades, the kit reflected the venue. Heavy hardwood frames. Bolted joints. Things that took two people and an afternoon to assemble and were then simply part of the building. That made complete sense when the primary customer was a club. It makes no sense at all when the primary customer lives in a one-bedroom flat in Leeds.

    Portability became the actual design brief

    The interesting response came from small manufacturers rather than the big distributors, which is usually how these things go. Distributors sell what the catalogue already contains. Makers notice what customers keep asking for.

    What customers kept asking for was something that could be set up in minutes, used properly, and then genuinely disappear. Not “tucked behind a wardrobe” disappear. Actually flat, actually stored, actually invisible to a flatmate opening the wrong cupboard.

    That is a harder engineering problem than it sounds, because the two requirements fight each other. A piece of furniture that folds has hinges and pivots, and every hinge is a potential failure point under load. A piece of furniture that is rock solid under load usually achieves that through fixed joints and mass. Solving both at once means thinking properly about geometry, about how forces travel through a frame, and about which joints can move and which absolutely cannot.

    A handful of UK workshops now build to that brief specifically. My Dungeon, based in Boston in Lincolnshire, designs and manufactures its BDSM sex furniture around collapsing flat and storing under a bed, with everything made in its own workshop rather than imported and rebadged. It is a small operation, which is rather the point. The design constraint came from paying attention to what people in small flats were actually asking for.

    The materials question nobody talks about

    The other half of the domestic shift is upholstery, and it gets far less attention than it deserves.

    Equipment that lives in a club gets professionally cleaned and replaced on a schedule. Equipment that lives in a flat does not. It gets wiped down by its owner, folded up while very slightly damp, and shoved in a cupboard. Over a couple of years that is a genuinely punishing environment for a soft surface.

    Three materials dominate, and they behave very differently:

    Real leather looks and feels the best and ages beautifully, but it is porous. It needs conditioning, it does not enjoy being stored folded, and it will not tolerate being cleaned with anything harsh. It is the connoisseur’s choice and the maintenance-heavy one.

    Marine-grade vinyl is the workhorse. It is engineered for boat interiors, which means it is built to survive moisture, UV and repeated cleaning. It has a cold reputation that modern grades have largely earned their way out of. For anything that folds, gets wiped down and gets stored, it is usually the correct answer.

    Polyurethane leather sits in between, and quality varies enormously. Good PU is convincing and durable. Cheap PU delaminates, and once the surface layer starts lifting there is no repairing it. Price is a reasonable proxy here.

    The underlying foam matters at least as much. Cheap open-cell foam compresses and never fully recovers, which is why budget equipment develops a permanent dent within a year. High-density closed-cell foam costs more, holds its shape, and does not absorb moisture. If you are comparing two pieces at different prices and cannot see why, the foam is usually the reason.

    What it says about the scene

    There is a version of this story where the closure of the clubs is purely a loss, and there is something to that. Physical venues do things that a spare room cannot. They teach newcomers by example. They provide informal oversight. They introduce people to each other.

    But the domestic shift has had one genuinely good effect: it lowered the barrier. A folding bench that costs a fraction of a club-grade permanent installation, arrives in plain packaging and stores under a bed removes most of the practical reasons people gave for never getting started.

    The scene did not shrink. It decentralised. Given how the last decade has gone for every other kind of physical venue in this country, that is probably the outcome to be grateful for.

    The Home Dungeon

  • How UK Electoral Roll Data Flows Into Commercial Data Broker Pipelines: The Open Register Loophole and Its OSINT Implications

    How UK Electoral Roll Data Flows Into Commercial Data Broker Pipelines: The Open Register Loophole and Its OSINT Implications

    Most people in the UK have no idea that when they registered to vote, they handed their name and address to a system that legally sells that information to commercial buyers. Not through a breach. Not through a hack. Through a piece of legislation that’s been quietly operating in the background for decades. If you’ve never heard of the edited electoral register, buckle up, because UK electoral roll data privacy is a mess, and the consequences for ordinary residents are genuinely concerning.

    Anonymous figure at monitors displaying UK electoral roll data privacy information
    Photo by Anete Lusina on Pexels

    The two registers: what most people don’t know exists

    Every local authority in England, Wales, Scotland, and Northern Ireland maintains two versions of the electoral register. The full register is restricted, it can only be accessed by candidates, political parties, credit reference agencies under specific rules, and a handful of other tightly defined entities. Then there’s the edited register, sometimes called the open register. That one is available to anyone who wants to buy it. Any company. Any individual. No restriction on purpose.

    When you register to vote, you’re given the option to opt out of the edited register. But the opt-out isn’t exactly screaming at you from the page. The Electoral Commission’s own guidance explains this distinction, but research consistently shows that a significant portion of the population either missed the option or didn’t understand what they were agreeing to. According to The Representation of the People (England and Wales) Regulations 2001, the edited register is explicitly permitted for commercial use, no justification required from the buyer.

    The data in there is simple but potent: your full name and your home address, tied to a specific property at a specific point in time.

    How data brokers actually ingest and weaponise this

    Here’s where it gets interesting from a technical standpoint. The edited register isn’t just bought once and left on a shelf. Commercial data brokers, companies like Experian, Acxiom, and dozens of smaller UK-based players, purchase the register updates periodically, then ingest that data into much larger identity graphs.

    The process typically works like this. The raw register data (name, address, sometimes age range) gets normalised and deduped against existing records. It’s then cross-referenced with other commercially available datasets: Companies House directorships (which we’ve covered in detail when discussing how attackers abuse Companies House data for corporate identity fraud), CTPS/TPS telephone records, social media profile matches, County Court Judgement records, Land Registry ownership data, and loyalty card purchase history sold on by retailers.

    What emerges from that cross-referencing isn’t just a name and address. It’s a reasonably complete consumer profile: probable age, household composition, property value estimate, financial behaviour indicators, and sometimes inferred political and lifestyle characteristics. Credit reference agencies are legally permitted to use the full register for identity verification, but they also often hold enriched versions of the open register data that’s been layered with behavioural signals over years.

    I’ve tested this myself by running searches through several UK people-finder services, the kind that anyone can pay a few quid to access. Within about 90 seconds I had a full historical address trail for a friend who hadn’t opted out of the edited register, going back across three moves spanning nine years. Their current address, their previous flat, and one before that. All accurate. All sitting there, legally purchasable, linked to their name.

    The OSINT implications for UK residents

    From an OSINT perspective, the edited register functions as a seed dataset. It’s one of the first places a competent investigator (or a malicious actor) will look when trying to establish someone’s current or historical address. The reason it’s so valuable isn’t just accuracy, it’s the timestamp. Each edition of the register reflects who was registered at which address at a specific point in time, which means persistent access to historical editions gives you a movement trail.

    Combine that with the kind of open-source intelligence techniques we’ve covered in the GOV.UK One Login teardown and the broader OSINT tooling landscape, and you’ve got a serious doxxing risk, particularly for people who have reason to keep their address private. Domestic abuse survivors. Journalists. Witnesses. People who’ve had stalking incidents. The edited register opt-out exists, but it only prevents future sales. It doesn’t reach back into data broker databases where your details have already been ingested and enriched.

    There’s also the aggregation problem. A single data point from the register is mildly useful. Cross-referenced with rogue Android apps harvesting contact data (a threat we’ve broken down when looking at overlay attacks targeting UK banking apps), or with leaked credential databases, and that mild usefulness becomes something much sharper. Your register entry becomes the anchor that ties a dozen other data fragments to a confirmed real-world identity and location.

    What opting out actually does (and doesn’t do)

    Opting out of the edited register stops your local council from including you in the version they sell going forward. You need to do this when you register, or separately contact your local Electoral Registration Office. The Electoral Commission’s website has the process. Some councils let you do it online; others still want a form.

    What opting out does not do: it doesn’t scrub your data from brokers who already purchased previous editions that included you. Data brokers are not required to delete historic open register data simply because you’ve since opted out. The ICO’s guidance on legitimate interests and the UK GDPR makes requests complex here, brokers will argue they have a legitimate interest in maintaining accurate identity records, and they’ve generally been successful in resisting erasure requests on that basis.

    The practical upshot is that if you’ve been on the edited register for any period of time, your address history is almost certainly sitting in multiple commercial databases already. Opting out now reduces future exposure but doesn’t undo the past. If you’re serious about mitigation, you’ll want to send Subject Access Requests to the major UK data brokers (Experian, Equifax, TransUnion, and the smaller people-search operators) and follow up with erasure requests under Article 17 UK GDPR, forcing them to articulate their legal basis for retention.

    Why this system still exists

    The honest answer is lobbying and commercial inertia. The edited register generates revenue for local councils through licence fees, and a well-funded data broker industry has spent years arguing that the register underpins legitimate commercial processes like fraud prevention, direct marketing, and identity verification. That’s true to a degree. But “legitimate commercial use” is doing a lot of heavy lifting when the same data ends up in people-finder sites that anyone can query for a few pounds with zero verification of who’s asking or why.

    There have been parliamentary questions about reform. The Law Commission has looked at electoral law. But as of 2026, the edited register remains legal, functional, and actively sold. Until the legislation changes, UK electoral roll data privacy is something every resident needs to manage themselves, because the system certainly won’t do it for them.

    Check your registration. Opt out if you haven’t. Then send those SAR letters.

The Latest