Drivers of change 33. The coming decade will see the continued rapid expansion of data and digital connectivity to almost every aspect of our lives. Huge global growth in Internet access and usage, underpinned by data and the infrastructure upon which data use relies, is creating new markets and increasing convenience, choice and efficiency. But it also makes countries much more dependent on interconnected digital systems, providing more opportunities for malicious activity and significant ‘real-world’ impact. As critical and non-critical technologies continue to converge across sectors these risks are spreading to new areas of our economy, and the movement of data and services into the cloud – and often out of the UK – is further increasing our exposure. 34. We are increasingly seeing the interaction of established businesses in regulated sectors, such as telecoms and energy, with new and largely unregulated businesses, such as those providing microgeneration, electric vehicle charging or ‘connected places’ capabilities. Critical infrastructures will become much more distributed and diffuse and this fundamentally changes how regulation will impact the security of the critical functions and services we rely on. This diversification will also affect our wider national security, making it more difficult to gain access to information whether for law enforcement or cyber security. This change in environment will also affect products and services more widely outside of our traditional critical national infrastructure. 17 35. This increasingly complex landscape will make it even harder for states, businesses and society to understand the risks they face and how they can and should protect themselves. Increased dependency on third party suppliers of managed services, which often have privileged access to the IT systems of thousands of clients, is creating new risks that need to be addressed. Devices and networks will increasingly be connected to the internet as standard, extending cyberspace to our homes, vehicles, built environment and industrial infrastructure. Sensors, wearables, medical devices and biometrics will further blur the boundary between offline and online activity. Cyber risks will become pervasive, increasing the volume of personal and sensitive data generated and the potential impact if systems are breached. 36. Against this backdrop, the threats in cyberspace will continue to evolve and diversify as high-end cyber capabilities become commoditised and proliferate to a wider range of states and criminal groups. The number of actors with the ability and intent to target the UK in cyberspace will increase and states will employ a wider range of levers to conduct disruptive activity, including the use of proxy actors. The accelerated transition to hybrid working and restrictions on international travel resulting from the pandemic have led to greater reliance on digital services and incentivised organised crime groups towards cyber crimes. We are already beginning to see signs of this trend with the latest crime survey estimating that cyber crimes have increased significantly between 2019 and 2021.17 ONS, Crime in England and Wales: year ending June 2021 (2021) 29