The Context
On 9 April 2026, UK Defence Secretary John Healey announced the conclusion of a month-long military operation. Over 500 UK personnel, in concert with Norwegian and NATO allies, conducted continuous 24/7 monitoring of Russian naval assets. An Akula-class attack submarine and two specialist deep-sea vessels from Russia’s GUGI directorate were tracked conducting reconnaissance on critical undersea cables in the North Atlantic. The operation, involving the frigate HMS St Albans, P8 aircraft, and Merlin helicopters, successfully deterred the vessels. No sabotage occurred. This was not a legal case. It was a stark demonstration of hostile state intent against essential national infrastructure.
The Risk
The absence of a court ruling does not absolve liability. A board’s duty under the Companies Act 1993 is to exercise the care, diligence, and skill of a reasonable director. This includes a duty to identify and manage material risks to the company’s operations and value. A hostile actor mapping your critical infrastructure is a material risk. Failure to adequately assess and mitigate such a threat may constitute a breach of that duty. The Health and Safety at Work Act 2015 imposes a primary duty of care on a Person Conducting a Business or Undertaking (PCBU). Directors, as officers, must exercise due diligence to ensure the PCBU complies. An attack on operational infrastructure that causes harm could trigger liability under the HSWA. The maximum penalties are severe: for the company, a fine not exceeding $3 million; for an officer, a fine not exceeding $600,000 and/or imprisonment for up to five years. Precedence shows courts will look at what the board knew, or ought to have known.
The Control
Directors must mandate a formal, board-level review of geopolitical and critical infrastructure threat exposure. This is not an IT issue. It is a core strategic risk. The review must map all critical dependencies—physical, digital, and supply chain—and stress-test them against state-sponsored disruption scenarios. The resulting mitigation plan must be resourced, monitored, and reported to the board at least quarterly. Treat the threat as a standing agenda item.
The Challenge
These are the critical questions you should be raising at the board table:
| Where is the formal, board-approved threat assessment that identifies our organisation’s critical infrastructure and its vulnerability to a prolonged, covert state-sponsored attack? | |
| What specific, tested controls do we have in place to satisfy our due diligence obligations under the HSWA 2015, should such an attack cause harm to workers or the public? | |
| Can the board demonstrate, through minutes and documented advice, that it has proactively sought and acted upon expert intelligence regarding this class of strategic threat to avoid a future claim of negligence? |