Two separate UK announcements are being merged into one alarming story: a government campaign telling households to keep three days of supplies at home, and a speech by the head of the National Cyber Security Centre about what old, neglected technology could do to shops and power supplies. Neither one says an attack is about to happen.
The first is household advice, built mostly around storms and wildfires. The second is a warning about the next few years, aimed at the bosses of organisations that run ageing systems. Here is what each actually said, where they meet, and what a reader in Pakistan can take from them.
Be Ready: a checklist, not an alert
Be Ready arrived on 22 October with a Cabinet Office announcement calling it stage one of a three-year programme. It targets temporary outages of electricity, water, mobile signal and broadband, and the examples it gives are weather: storms last winter and wildfires this summer. The three-day figure is the same one France, Ireland and the Netherlands use, and much of the advice carries over from the “Prepare” site the government has run since May 2024.
The campaign’s checklist asks for three litres of drinking water per person per day, long-life food that needs no cooking, a torch, a battery or wind-up FM radio, a charged power bank and first-aid items. It also lists cash in coins and notes in case card payments or ATMs stop working, plus printed copies of IDs and key phone numbers. Cyber attacks get one line on the homepage: “From severe weather to cyber attacks, emergencies can disrupt the services you rely on.”
Nothing in the announcement names a threat or a date. Dan Jarvis, the security minister, put it as an ordinary precaution: “Those who can follow this advice should follow this advice.” The aim, the release says, is that if households that can look after themselves do so, emergency services can concentrate on people who need more help.
The cyber link came from ministers two days later. Reuters reported on 24 October that the government pointed to that week’s PHP software flaw, which knocked some services offline, as a reason the campaign matters, and that Wes Streeting, the defence secretary, said such incidents would become more common as AI makes weaknesses easier to find.
What the NCSC chief said on 3 November
Richard Horne, the NCSC’s chief executive, gave his speech as the centre published its annual review, “The State of the Cyber Nation”. His warning was about volume: “In the coming months, we face a real prospect of an unprecedented rise in the number of cyber incidents.” He was explicit that AI has not invented new attacks; it lets “vulnerabilities that have been tolerated for far too long” be found and exploited faster than before.
The line that travelled furthest was addressed to leaders of organisations. If they do not change course, Horne said, they will one day have to explain, “When food isn’t on the shelves, when lights aren’t on, businesses have gone under.” That is a conditional about choices, not a prediction that shelves will empty this month. His complaint was “tech on the cheap”: ageing systems left running another year, upgrades postponed, and access handed out where it was easy rather than necessary.
He also pointed beyond office IT to systems that run electricity switching, water sluice gates and refrigeration, citing the disruption of refrigeration units across Europe as an example of that exposure.
The NCSC’s accompanying release carries the forecast behind the headlines: by 2028, the NCSC judges, a ransomware attack on UK critical infrastructure using AI-powered malware is highly likely. That is a judgement about a kind of attack within two years, with no date or target. The release also lists money the Chancellor announced the week before: £60 million to start building a national Cyber Shield, and £70 million for a new centre, called NERV, meant to spot weak points across critical infrastructure and the economy. Horne also said that after the PHP flaw the NCSC sent more than 110,000 proactive notifications and early warnings to UK organisations.
Advice versus warning
Put side by side, the two messages ask different people to do different things. Be Ready asks households to hold a few days of basics, and its own site says it will not carry live information during an emergency. The NCSC asks organisations to replace unsupported technology, keep critical physical systems off the internet and treat Cyber Essentials as a starting point. Horne also promised a National Cyber Action Plan soon, and pointed to the Cyber Security and Resilience Bill, which would put a floor under how resilient critical national infrastructure has to be.
The Pakistan side: who to tell
The household steps are written for UK residents. The Priority Services Register, which tells utilities who needs extra help in an outage, is open to customers in England, Scotland and Wales, and 105 is the number to report a power cut there. Pakistani families with relatives in Britain can pass those on; the rest of the checklist is generic good practice.
For Pakistan, the useful parallel is who to tell when something breaks. The National CERT’s incident form is meant for organisations and infrastructure; people hit by fraud, scams or blackmail are told to go to the NCCIA instead. NCERT’s recent warning to banks about AI bots that fake account balances shows the same worry the NCSC raised: old weaknesses used at greater speed.
The National Cyber Action Plan is the next UK step to watch, since the NCSC says it will set out the actions needed to strengthen the country’s defences.
