Ambassador Holland updates on the National Security (State Threats) Act 2026 and the recent UK and EU joint cyber sanctions package.
Thank you, Chair.
The United Kingdom has tabled this current issue to put on record recent decisions taken by the UK Government to strengthen our response to growing hybrid threats.
The UK defines state threats as overt or covert actions by foreign governments that fall short of direct armed conflict but go beyond legitimate diplomacy and expected statecraft. These actions harm or threaten the safety and interests of the UK or our allies. Hybrid threats are a subset: typically covert, deniable, sub-threshold, and often combining multiple methods to achieve their aims.
First, the UK introduced the National Security (State Threats) Act 2026 last week. It provides the Home Secretary with new powers to designate bodies acting on behalf of - or in the interests of - foreign states to carry out activity that threatens UK security and the safety of our communities.
Foreign state organisations and state-linked groups involved in such activity - which can include sabotage, espionage, and foreign interference - can now be designated.
Designation means it is now a criminal offence to support, assist, or obtain material benefits from a designated body. This enables proxy groups - when designated - to be treated in the same way as foreign intelligence services, and strengthens the tools available to our law enforcement and intelligence agencies to disrupt and deter hostile activity.
While giving the UK new powers, the Act also includes strong safeguards to protect legitimate activity, including humanitarian engagement and journalism.
The first bodies designated under these new powers will be the Islamic Revolutionary Guard Corps, the Islamic Movement of Companions of the Right and Russia's GRU Volunteer Corps. If approved by Parliament today, those conducting foreign power threat activity on behalf of one of these organisations could face significant criminal penalties. For example, an act of sabotage on behalf of these groups could result in life imprisonment for the perpetrators.
Second, the UK and EU issued our first joint cyber sanctions package earlier this week. These sanctions target the Russian state - including senior GRU officers - and closely associated criminal and proxy networks responsible for orchestrating reckless and destructive cyber-attacks across Europe.
The UK package includes 10 individuals who continue to deliver Russia's information warfare campaigns against Ukraine.
And in addition, the UK has supported the attribution - coordinated at EU level - of a recent attempted cyber-attack on Poland's energy infrastructure to Russia's FSB Centre 16. The attack failed, but it could have left up to 500,000 people without electricity in winter. This is irresponsible and destabilising behaviour by the Russian state.
In response, NATO issued a North Atlantic Council statement, highlighting that the NATO Alliance has further enhanced its cyber posture by strengthening its framework to integrate cyber factors into the Alliance's operations, missions and activities. 13. To date, the UK has sanctioned over 3,400 targets behind Russia's war effort and will continue to work alongside our allies to bear down on those carrying out hostile activity on behalf of the Kremlin, spreading dangerous lies and undermining democratic values.
Mr Chair, hybrid threats are intensifying across our region. It is time for the OSCE to raise this up the political agenda. The UK will continue to work with partners to strengthen our resilience, respond to hybrid threats, and call out malign behaviour - including in this Council.
