Security1 publisherNot yet confirmed elsewhere3 min readPublished
Most of a Labour MP's £2bn 'Putin Tax' floor rests on an assumed 10% cybercrime share
Labour MP Graeme Downie's report puts the yearly cost of Russian cyberattacks and sabotage to Britain at £2bn to £2.5bn, a figure it calls a floor. It arrives before a budget expected later this month, arguing the harm cannot be weighed against defence spending while government does not count it.
The Watch · Security desk
What happened
- The largest input assumes Russia causes 10% of the £14.7bn a year the government says cybercrime costs British businesses, a share not based on precise attribution.
- The remaining figures, including hostile activity threatening subsea cables, come from models and not from public data.
- Downie's parliamentary questions to several departments found ministers held no estimates of the economic impact of Kremlin-linked incidents.
- No analysis was done of the costs of the ransomware attacks on NHS software supplier Advanced and on Royal Mail.
- The report asks for annual government assessments of the economic cost of hostile foreign-state activity, and for the NCSC to publish cost estimates alongside attribution.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- constraint Budget-setters weighing Russian harm against defence spending have no official number to test this one against. Between 59% and 74% of it depends on a share the authors did not attribute precisely.
- decision A department that wants to argue the floor down only has to dispute the 10% share. Each percentage point it removes takes £147m off the yearly total.
- precedent If the NCSC priced each incident it attributes, as the report asks, attributed cases would begin to test the 10% assumption against evidence.
Ten percent of £14.7bn is £1.47bn [18]. That one assumption supplies about 74% of the report's £2bn lower bound and about 59% of its £2.5bn upper bound [2][19]. Take it out and between £0.53bn and £1.03bn is left. That remainder is the modelled part of the estimate [20][6].
Downie wrote the report with postdoctoral researcher Dominic Reed [1]. The authors say their methodology was limited and that their main point is the lack of an official alternative [7]. The "floor" label holds only if Russia's real share of UK cybercrime losses is 10% or more [2][5]. The strongest finding in the report is the parliamentary answers showing ministers hold no estimate [3]. The £2bn figure is weaker evidence, because most of it moves with one assumed percentage [19].
The report sets the gap against how other harms get budgeted. "The costs of flooding are measured or estimated because flood defenses cost money. The costs of fraud are measured because anti-fraud activity costs money," it says [11]. It adds: "Yet no equivalent effort has been made to understand its cumulative financial impact." [11]
The incidents it draws on mix cyber and physical activity, and attributed and unattributed harm. The group behind the Advanced and Royal Mail ransomware attacks is alleged to act with the Kremlin's unspoken approval and, in some instances, to have links to Russian intelligence [4]. Russia's Wagner Group ordered a 2024 arson attack on a London warehouse [10]. The report also references the August 2025 attack on Jaguar Land Rover, estimated to have cost the British economy $2.5bn [9]. The UK government has not formally attributed that attack to Russia-linked actors [9].
The report is timed to the budget. Prime Minister Andy Burnham's new government is expected to deliver a difficult first budget later this month [8]. The report argues that a public unable to see what Russian activity costs cannot weigh that burden against the cost of defending against it [8].
Gen. Sir Jim Hockenhull, the former head of Britain's Defence Intelligence, made a related case to Recorded Future News earlier this year. He argued that the evidence for security spending stays classified [14]. "We assume the public understands the connection, but if our insight stays highly classified, in the hands of senior officials and politicians, we're effectively asking people to trust us without seeing the evidence," he said [14].
Downie's response to that gap is a national public awareness campaign on hostile-state threats and cyber resilience [16]. He also wants the Ministry of Defence to develop a methodology for costing physical hostile activity [17]. "The challenge now is not proving that the Putin Tax exists but ensuring that Britain starts measuring it," Downie said [13]. The Cabinet Office did not immediately respond to a request for comment [15].
What to watch
- Whether the Burnham government's budget later this month cites any cost figure for Russian or other hostile-state activity.
- Whether the Cabinet Office or any department commits to the annual economic assessment the report recommends.
- Whether the UK formally attributes the August 2025 Jaguar Land Rover attack, which would bring an incident estimated at $2.5bn into the attributed record.