By Graeme Downie MP
Britain is already paying a tax it never voted for.
It does not appear on a payslip. HMRC does not collect it. There is no line on a household bill telling you how much you have paid.
Yet a new report I have published with Dr Dominic Reed estimates that hostile Russian activity costs the United Kingdom at least £2-£2.5 billion every year through cyber-attacks, sabotage and disruption. I call it the Putin Tax.
The report is the first attempt to quantify the economic burden that hostile-state activity imposes on British businesses, public services and taxpayers. The costs we can identify are substantial, but they are almost certainly only part of the picture.
For a Labour government focused on growth, resilience and national renewal, understanding these hidden costs is not a niche security issue. It is an economic necessity.
Every cyber-attack that halts production, every act of sabotage that damages infrastructure and every pound spent responding to hostile threats carries a cost. Those costs mean less investment, lower productivity and greater pressure on public services. Yet Britain has never attempted to systematically measure the total bill.
Over recent years, warnings about Russian hostile activity have become increasingly common. Intelligence agencies, ministers and security experts have highlighted cyber-attacks, interference campaigns and threats to critical infrastructure.
Much of this activity is described as operating below the threshold of conventional conflict.
I have always been uncomfortable with that language. Nothing feels "below the threshold" to a business that loses millions after a ransomware attack. Nothing feels "below the threshold" to patients whose healthcare services are disrupted by a cyber incident. Nothing feels "below the threshold" to workers sent home because production lines have stopped running.
The consequences are real, and so are the costs.
One of the most striking discoveries during this research was how little government knows about the economic impact of hostile-state activity.
Through Parliamentary Questions, I asked ministers what major incidents had cost the country. Repeatedly, the answer was the same. No estimate existed. Operational details were often available, but assessments of wider economic damage were not.
That leaves a significant gap in our understanding of the threat.
You cannot effectively defend against something if you do not understand its impact. You cannot make informed decisions about resilience if you do not know where the damage is greatest. And you cannot have an honest conversation with the public if you cannot explain what hostile-state activity is already costing them.
The evidence that does exist paints a worrying picture.
Our report identified more than 300 Russia-linked cyber incidents affecting UK companies since 2022. We estimate that proven attacks since the invasion of Ukraine have already cost hundreds of millions of pounds. Using industry data, we also estimate that a conservative Russia-linked share of the cyber-crime burden facing British businesses amounts to around £1.47 billion each year. Exposure from damage to subsea infrastructure adds hundreds of millions more.
Taken together, these findings suggest an annual burden of at least £2-£2.5 billion.
Importantly, that figure should be viewed as a minimum estimate. Many incidents are never reported publicly, attribution remains difficult, and the wider effects on investment and productivity are often impossible to quantify accurately.
This matters because hostile-state activity is not simply a national security challenge. It is an economic one.
Modern economies depend on interconnected systems. Energy networks, data cables, transport infrastructure, healthcare providers and financial services all support prosperity and growth. Disrupting those systems allows hostile actors to impose costs without crossing into open warfare.
Britain has made significant progress in strengthening cyber defences and protecting critical national infrastructure. But resilience starts with understanding the scale of the challenge.
That is why the recommendations in our report are straightforward.
Government should publish an annual assessment of the economic cost of hostile foreign-state activity. The National Cyber Security Centre should provide annual assessments of significant hostile-state cyber activity, including attribution and economic impact wherever possible. The Ministry of Defence should develop a methodology for assessing the cost of physical sabotage, while government should launch a public awareness campaign on hostile-state threats and preparedness.
One reason hostile-state activity remains poorly understood is that the costs are dispersed. They appear in insurance premiums, resilience budgets, delayed investment decisions and disrupted services. Rarely do they arrive in the form of a single invoice. Yet the burden is no less real because it is hidden.
For too long, national security and economic policy have been treated as separate conversations. Increasingly, they are the same conversation. A more secure country is a more prosperous country, and a more resilient economy is a stronger deterrent to those who seek to undermine us.
Britain is already paying the Putin Tax.
The question now is whether we are prepared to measure it, understand it and reduce it.
Graeme Downie is the Labour MP for Dunfermline and Dollar.
