The private security sector and National Security risks (UK)

Recently, the UK government warned businesses in the private security industry about the risk that hostile foreign states will use them to conduct activities against British interests[1]. This warning came as the Home Office released new guidance on the National Security Act 2023 (NSA 2023) for security firms (the Guidance). The Guidance is a cogent reminder of the need for thorough due diligence and record-keeping at corporates. It also emphasises the specific criminal risks for UK persons who intentionally assist “foreign powers”[2] to undertake malign activities against Britain.

Given their specialist skills and frequent access (e.g. as private investigators) to valuable information and/or proximity (e.g. as bodyguards) to persons of interest, workers in the British security industry can make ideal proxies for hostile state actors. Several such cases have been reported in recent years.

When announcing the Guidance, the Security Minister said: “foreign states are increasingly looking to the industry as a tool to carry out their dirty work – to degrade our security, undermine our values and damage our livelihoods. I urge security professionals to take caution to protect the UK and themselves by fully checking and understanding who they are working for. If they don’t, they seriously risk breaking the law and aiding states who seek nothing more than to harm this country…”.

The Guidance

The Guidance provides a clear and concise summary of state threat risks. In our opinion, it is also relevant for raising awareness amongst businesses beyond the private security sector.

As the document makes clear, state threat activities are broad in scope. They include sabotage and espionage (including theft of trade secrets), as well as less obvious examples such as manipulating public discourse and intimidating political dissidents. The Guidance identifies particular risks to critical infrastructure and the gathering of sensitive information from government, research institutions or businesses.

The Guidance includes resources, scenarios and questions and is designed to help security professionals ascertain whether a potential client is a foreign state (or a body linked to a foreign state) seeking to carry out activities adverse to UK national security. We suggest that the Guidance scenarios and checklists raise issues that will be familiar to many corporate compliance teams: insider threat, information security, corruption risk (e.g. the Guidance’s Scenario B regarding bribery of a close protection operator), and appropriate and ongoing client – and staff - due diligence.

Offences under the NSA 2023

Parts 1 to 3 of the NSA 2023 came into force in late 2023, with the aim of providing the security services and law enforcement agencies with the tools required to tackle state threats. As underlined in the Guidance, a business or individual may commit an offence if they undertake work that could assist a foreign power in carrying out activities against the UK.

For example, a person could be prosecuted if they:

• work for a foreign intelligence service or second parties contracted by such an organisation. This includes providing information, access to information, goods, services, or financial benefits
• accept or agree to accept a material benefit that originates from a foreign intelligence service (whether received directly or indirectly). Importantly, the offence can arise if the person reasonably ought to have known that a benefit originated from a foreign intelligence service
• carry out any “foreign interference activity”[3] on behalf of or intended to benefit a foreign power
• obtain, copy, record, retain, disclose, or provide access to protected information[4] on behalf of a foreign power
• obtain, copy, record, retain, disclose, or provide access to a trade secret (without authorisation) on behalf of a foreign power

These examples constitute offences whether the conduct takes place within the UK or abroad (like most offences in Part 1 of the NSA 2023).

The Foreign Influence Registration Scheme (FIRS)

The NSA 2023 also introduces the Foreign Influence Registration Scheme (FIRS).

The FIRS compels both individuals and entities to register certain arrangements carried out in the United Kingdom at the direction of a “foreign power”. The FIRS is expected to come into force this year, with HM Government promising detailed guidance beforehand.

Our previous briefing discussing the FIRS’ requirements and likely impact on businesses can be seen here.

Next steps

The Guidance is a welcome contribution to raising awareness of national security risk for the security industry and, we suggest, professional services more broadly. Given the increase in state threat activity in and against the UK, we expect to see more relevant law enforcement activity in the near to medium future. If they have not already done so, professionals and businesses with any relationship with a foreign power should take appropriate advice and assess their due diligence and compliance processes.

Please contact us to discuss any of the issues described in this note.

[1] Security professionals urged to tackle threat from state actors - GOV.UK; A guide to the National Security Act 2023 for security professionals (accessible) - GOV.UK

[2] A “foreign power” is defined as (i) the sovereign or head of a foreign State in their public capacity (ii) a foreign government (or part of) (iii) an agency or authority of a foreign government (or part of) (iv) an authority responsible for administering the affairs of an area within a foreign country or territory (or person exercising those functions) and (v) a governing political party of a foreign government.

[3] In general, these activities are typically not conducted transparently and are outside the norms of diplomacy.

[4] Any information where, for the purpose of protecting the safety or interests of the UK, access has been restricted in any way, or it is reasonable to expect that access to the information would be restricted in any way.