The United Kingdom is significantly strengthening its framework for countering hybrid threats, as outlined in a recent statement to the Organisation for Security and Co-operation in Europe (OSCE). Ambassador Holland detailed new legislative powers and collaborative international sanctions designed to protect national security and deter hostile foreign state activity. Hybrid threats are defined by the UK as covert, deniable, and often multi-faceted actions by foreign governments that fall short of direct armed conflict but harm UK interests and security.
A cornerstone of this enhanced defence is the National Security (State Threats) Act 2026, which became law last week. This legislation grants the Home Secretary powers to designate organisations acting on behalf of, or in the interests of, foreign states to carry out activities that threaten UK security. Such activities can include sabotage, espionage, and foreign interference. Once designated, it becomes a criminal offence to support, assist, or obtain material benefits from these bodies, allowing law enforcement and intelligence agencies to disrupt and deter hostile activity more effectively. The Act includes safeguards to protect legitimate activities such as humanitarian engagement and journalism.
Parliament is currently considering the first proposed designations under the new Act, which include the Islamic Revolutionary Guard Corps, the Islamic Movement of Companions of the Right, and Russia’s GRU Volunteer Corps. If approved, individuals conducting foreign power threat activity on behalf of these organisations could face substantial criminal penalties, with acts of sabotage potentially leading to life imprisonment.
In a further move to counter state threats, the UK and EU earlier this week issued their first joint cyber sanctions package. These sanctions specifically target the Russian state, including senior GRU officers and associated criminal and proxy networks, for orchestrating destructive cyber-attacks across Europe. The UK's package includes ten individuals involved in Russia’s information warfare campaigns against Ukraine. Additionally, the UK has supported EU-level attribution of a recent attempted cyber-attack on Poland’s energy infrastructure to Russia’s FSB Centre 16, an incident that could have left up to 500,000 people without electricity during winter.
In response to the escalating threat landscape, NATO has also reaffirmed its commitment to collective defence, with the North Atlantic Council issuing a statement highlighting enhanced cyber posture. This involves strengthening the framework to integrate cyber factors into the Alliance’s operations, missions, and activities. The UK has already sanctioned over 3,400 targets linked to Russia’s war effort and continues to work with allies to counter malign behaviour and uphold democratic values.