235. How M&S saw off the cyber criminals and its plan for the next 100 Years (Part 1)

0:09Hello and welcome to The Rest is Money with me, Robert Peston.

0:13Steph McGovern:And me, Steph McGovern. And we have a guest with us today, Archie Norman, who, if you don't know his name, you'll definitely be impressed by his credentials. He's someone Robert and I have followed throughout his career because he's a prominent businessman, former politician as well, had a very long and successful career in retail. He was chief exec of Asda in the 90s and he helped turn it around, to be honest, making it the second biggest supermarket in the UK. Not long after that, it was sold to Walmart. He went into politics in the 90s. He was an MP from about 97 to 2005 and had senior roles in the Tory party at the time.

0:56Steph McGovern:Then he went into being chairman of ITV. So he was Robert, your boss for a while, wasn't he? I think, were you there at ITV when he was chairman? Briefly, yeah. Yeah. And then M &S, and he's been chairman of M &S since 2017. he's just extended his commitment to be chair, which is interesting. So he's going to stay on until 2029. Interestingly, that's kind of longer than, you know, the normal corporate governance rules say, isn't it? So normally it's about nine years. He's going to be, he'll have done 12 by the end of it. But he's clearly very committed to Marks and Spencers and there's loads to ask him about, not least the, you know, the cyber attack, of course, which left them not able to sell clothes and furniture and things online for about seven weeks, wasn't it?

1:46Steph McGovern:And that took a big hit on profits. But lots of other things as well around the retail sector and where the ambition lies for M &S. That's right. And, you know, he is somebody who within, I suppose, the community of British business leaders, it is quite hard to find somebody who is as respected as he is. I was slightly amazed that he was staying on for those extra years because normally shareholders won't let you, you know, it shows, I suppose, the confidence that M &S's owners have in him that they agreed to this extension of his tenure. Yeah, here's our interview with Archie Norman.

2:31Archie, it's great to see you. We're living through what we hope was going to be a slightly more stable year for the UK, but it has been a very turbulent year and it's been a pretty turbulent year for you at M &S. How do you feel? Look, I came to M &S after give or take 25 years of drift. I mean, there have been good times and bad times, but I came to change the institutional, the business to create a great business for the next few decades. And that's what the team are here for. So, yeah, there's a sense in which this has been a lost year for us because of the cyber incident, which we don't much like to talk about now because it's behind us.

3:17But it is one of those traumatic things that has happened. But we're now laser focused on building the future. and yeah, it has been a difficult year but that's business life, isn't it? It is and I know you don't want to dwell on it and we won't dwell on it on the podcast but I remember just sort of seeing the way that your operations were being so damaged by this cyber attack and just thinking, my goodness, imagine being on the inside of that. I mean, for you and your thousands of colleagues, the trauma must have been immense. Yes. In business life, for business leaders, you know, there are sort of things that you have to go through as part of your rite of passage.

4:08A hostile takeover, an activist attack, probably a boardroom scandal, you know, a strike action. These are the weapon morphed of business stress. And a cyber attack is part of that. It's when you get, you know, everybody's, all business leaders and all boardrooms have rehearsed for cyber. They've had red team attacks. They've had role plays and sophisticated consultants come in and talk you through what happens. But nothing prepares you for the first whiff of gunshot. And when you get that phone call, in my case, on Easter Saturday at eight o 'clock in the evening, Stuart Machen, my chief executive, calls.

4:51And by the way, if you know Stuart, it's not unusual for him to call at eight o 'clock in the evening. You know, we talk all the time. I thought probably he's had a bad day in some shops. And he says, look, we've just been informed that one of our administrator accounts is behaving strangely. And there are two others that may be suspect. and that is the moment when your heart drops because you know that is the beginning as it turned out of of really three months of complete immersion into a different world the world of you meet people you'd never met before you know consultants arrive from america people are flown in from cincinnati you get uh um you're dealing with a language you haven't heard talk of threat actors for five successive nights.

5:44You have people somewhere in the world, you're not even sure where, trying to attack your business and close your shops and stop people shopping with you and extricate your data. So it's very unusual in warfare that happens, but in business life, to have somebody proactively trying to destroy your business and you're trying to defend it, or playing whack-a-mole, and your best defense is to close systems down, that is different. That's a different world, yeah. And then what people don't – it's so hard to explain to people. Once you close all your systems down, yeah, we continue trading. We never close a shop, but we depend on everything.

6:27I mean, knowing what to supply to the shops, that all depends on the system. Basically, now you sell a prawn sandwich, you order a prawn sandwich into the shop. That's all gone. So explaining to people why this has happened, because it's an alien world to them, and then also why it takes months to recover and rebuild your systems. It's really tough, and it's really tough on your people. And, you know, one of the things, crisis brings people together. So you do see people make heroic efforts. and we people pale-faced, we had meetings at midnight, people had three hours sleep a night, all of that.

7:05And they've come through it magnificently, but it has been really, really tough and it's been very, very expensive.

7:14Steph McGovern:And I bet you had never imagined, Archie, that you would ever, as a British retailer, end up talking to the FBI for something to do with the business. I mean, that must have felt really surreal as much as anything else. No, as I said, you meet people you've never heard of before. And consultants, you know, but to me, one of the lessons is when this happens, the first thing is go to the end point. What does that mean? What's the end point? Just assume this is a serious attack and your systems are going to be corrupted. Oh, I see. So assume the worst. As soon as it happens, plan for the worst. So plan for the worst.

7:55People will say to you, we think we've got it contained. I understand why they say that, but you don't believe a word of it. Just assume it's going to be a serious, because very often cyber attacks turn out to be far more serious than people contemplate. And then you call up the A-team. What's the A-team? It's the best people in the world who've been through cyber multiple times before, who know exactly who you're dealing with and how to handle it. Because you need the best in the world, because they're going to live with you for the next few months.

8:31Steph McGovern:That's great advice about assuming the worst. I, not long after it happened, was chairing a big retail conference at the World Retail Congress, and everyone was talking about it and everyone was saying, what are the learnings? What would you say are the key learnings for other retailers and businesses generally from what you went through? Look, I think cyber is sort of ubiquitous now. It's just a prevalent part of the landscape. So anybody who says, oh, we're cyber proof or we've got great systems, defense systems, I mean, it's fine to take that view, but you probably, you must assume you're permeable.

9:11So we have 50 ,000 people on our systems. Our whole business runs on systems now, and we're investing a lot more in it. So to assume that what they call the perimeter can't be penetrated is probably delusional. Somehow someone can get in. And often it's not, no, this is well publicized. It's not very technical. It's impersonation. It's fraud. But it's clever fraud. Don't think it's, you know, you don't just leave the back door open. Some very clever people and they can come in through third parties, not through our systems. The third part is that you think you're entitled to trust. So you have to assume, first thing is assume you're permeable and then ask then what?

9:55If they get into your system, how can you defend it? Where can they go? What barriers have you between? What can they get access to? And then... It's like medieval warfare. You've got to have a series of moats, haven't you? Well, ideally, it's an unfortunate analogy, but it should be like the Titanic. You've got sealable compartments, So you can't travel laterally across the system. But in practice, all our systems are interconnected. So it's a very hard thing to do. So it's quite technical. It's very important to have, if you can, perimeter detection. So you know when it's happened. On average, they say that most cyber threat actors, they call them, are in your systems for at least 20 days before you know about it.

10:41Now, in our case, we do know it was three days. Oh, really? It was as little as that? We got the exact date of, and we got tape recordings, by the way. Oh, wow. So we understand exactly what happened. We understood very quickly what had happened. And in your case, it was a third-party person who was conned, basically. That's a sort of colloquial way of putting it, yes, yes. The initial penetration happened through, I say, a third-party person. I mean, a partner of us. Yeah. But it was, as you say, a sort of basic tricking them into believing that the hacker was a reputable, genuine person. A lot of it.

11:26I think this thing goes in fashion, but a lot of the successful attacks this year happen to come through sophisticated impersonation. So remember that they'll go online. They'll find Robert Peston on LinkedIn. they'll find all your background they'll know your job title they know who you report to so they'll come on to your your system in some form maybe it's a help desk or whatever and they may even have your phone number and they'll look like robert best and they'll sound like it yeah and with a of course this makes it all the more it's going to get yeah they're going to get better at Yeah. But, you know, as I say, you've got to assume this is the weapon morphed of business life now.

12:09It's ubiquitous. You've got to be armor plated. But you've also got to know what happens if they do succeed and no way to go. And just I'd love to move on just your ambitions for the for the business in a in a minute. But just in terms of now having unfortunately had to immerse yourself in this, there is money making gangsterism when it comes to cyber. There is sort of anarchist groups who just think it's a good idea to bring down capitalism. There are rogue states, you know, Russia, North Korea. If just for any institution with a cyber system, do you have to worry about all three? Is there one source of threat that for you seems at the moment to be the most pernicious and the most prevalent?

12:5990 % of the attacks appear to be, and I'm basing this on our interchange with the security people, but they appear to be ransomware. So it is money making. Yes, even the state sponsored attacks. So there could be a group in Russia who are working full time on this. But some way in it, money will be involved. And there'll be, and the same even North Korea. I mean, the famous cyber attack that succeeded in extricating. This is all the Bitcoin. The Bitcoin or was it Ethereum from, was it Bybit or I can't remember if it was in the Middle East, that was 1.3 billion. But they did extricate, you know, the North Koreans don't mind having 1.3 billion.

13:42No, no. But there's also an element of, you know, these are people who, in our case, as we understand it, and by the way, you never get to meet them and they don't send you a letter in a second class post. as we understand it these are people who grew up in in computer gaming no they're sort of cyber punks and and they they enjoy what they do probably there's a little bit of they like the publicity by the way they communicate through the media in our case particularly through the bbc so you'd be brushing your teeth brushing your teeth in the morning and and on comes somebody from the bbc who their cyber correspondent says i just had a communication from the people attacking MS.

14:24Because I noted that at the time. That was their deliberate sort of strategy of trying to get their message across, was it? It's getting their message and putting pressure on the institution they're attacking. So in the case of the co-op, they were able to release information to the BBC that demonstrated they felt the effectus of their attack, which obviously puts pressure on their victim. and there are lots of questions arise about it

14:55So should the media I work for ITV should we be on our is there a risk that we're being somehow used when that happens? 100 % of course but the question to ask is whoever sometimes it comes through a journalist in a magazine you never heard of but you would think it would be civilised to notify the victim that you had this information responsible before you broadcast it. And that didn't happen? No. You would think it would be reasonable to notify the National Crime Agency that you'd been in contact with a criminal party threatening to extricate money from a business. And again, that didn't happen.

15:38Steph McGovern:Did you pull the BBC up about that, Archie? Did you say anything to them? Because you must know people in the leadership team. Did you contact them or anything? Yes, I did. But look, I'm not in the business of saying we want to move on from this. I'm not in the business of fighting wars over what they did. To some extent, I trust them to do the right thing. But I've raised it with them and they say they... Follow their guidelines. Yeah. Yeah. But all I can say is that we had no prior notification. Yeah. So that was an interesting breakfast listening to the radio. Well, it's an interesting question for a broadcast or newspaper, isn't it?

16:23Is it in the public interest that I put this out in the public domain or should I not disclose it, in which case they'll probably go through another channel or how do I handle it in relation to the criminal enforcement? I'm not in the business of criticizing the BBC, but it does seem odd to me that they didn't, even as a courtesy, let you know what they were about to broadcast. That is slightly odd. I thought it was surprising. But as I said, I'm, you know, we had other fish to fry. I'm not in the business of going to war over that sort of thing.

16:54Steph McGovern:But if you, in journalism, Robert, you and I have to get a right of reply from people. You know, if you're going to talk about someone and say something, you have to go to them and say, this is what we're going to say as well, don't you? And so there's two diligence. No, totally. I mean, in television, normally the responsibilities of getting stuff like this on air are incredibly onerous. So I'm a bit surprised by all of this, if I'm honest with you, that that's what happened. There's loads more we still want to chat to you about, Archie, but sit tight because we're going to go to a quick break.

17:42Steph McGovern:should we talk about some other big things then because obviously that was particularly tough for you um for you as mns but there's been lots of other things haven't they're happening this year which have put a lot of pressure on retailers so the changing you know employment rights bill the national insurance contributions going up the minimum wage going up the change in business rates all of which impact retailers like yours has that added to your wars when you say it's been a you know a tough year i don't think there's been a time you know in my lifetime leading large companies mostly trouble companies um where the weight of regulatory incoming has been quite as high, whether it's tax, minimum wage.

18:30I mean, the regulatory burden on M &S increased by about 140 million in the last year. Wow, 140 million pounds worth. Well, part of that, I'm including the increase in the minimum living wage, most of which we would have met anyway. So there's a bit of double counting. But That national insurance, the packaging tax, new HFSS rules, etc. And there's no cost in there for the employment legislation, which hasn't come in yet? No. I think a lot of business leaders bought into the Labour narrative prior to the election that they were going to put growth and stability first. And they assumed that all the other things that Labour wanted to do were going to be treated as secondary.

19:15In other words, we were going to pay for the indulgences through growth. And it's taken a year or so for the disappointment to set in and people to realize that there was no growth strategy, that there was something that was said in order to please them. And it has been from business growth, productivity, investment point of view, by any standards, a poor year. And I say that, you know, I'm in a post-partisan incarnation. I'm not a public figure anymore. I'm just fighting for our business. But for the business, it's been really tough and really disappointing. And the outlook for the next year is more of the same.

19:55And we should not assume that the budget is the end of it. The Employment Rights Bill is... I mean, look, what's really happened from a regular point of view in the last year is we've seen a big attack on almost a cultural wall and the things that Labour doesn't like. farmers who they see as essentially as landowners, not people striving, working hard to pass on the farm to their families, entrepreneurs who built up a business they see as wealthy people. I understand wealthy foreign people in the UK who they think are not paying the right amount of tax, people who send their children to private schools.

20:34and you know that all of that is fine I understand those are labor commitments and in some cases they had a mandate for that but it's the problem is they put it before growth so we haven't had the growth to pay for that and then we've had the commitment to increasing the welfare budget which has opened up a whole new flank and then we've got coming down the road the Employment Rights Bill, which is, because it's called employment rights, everybody feels slightly squeamish about opposing it because we're in favour of employee rights. And by the way, it's M &S. We already provide most of those employment rights.

21:15But really behind it is, it's a trade union bill, isn't it? It's dramatically bringing back strife into the workplace, making it much more easier for unions to gain acceptance in a private sector that has become in the UK knowledge-based, motivational, union-free for the most part. And it also makes it more difficult or going to make people more wary about employing people on the margins of employment. It's exactly what we don't want to achieve. So look, I'm not saying it's all bad. I'm just saying when your priority is growth and investment. And they continue to say their priority is growth and investment.

22:02And that is part of the paradox. But I just want to push back on or at least raise one counter, which is presumably you would take the view that, for example, the way that they are trying to speed up infrastructure investment, reduce planning restrictions, some of the money that they've actually committed to improving our infrastructure, that you would presumably regard as pro-growth. Yes, but it's not a strategy for growth. You know, what's our problem in the UK? It's for 13 years, broadly speaking, we've had no significant increase in real income per capita. And behind that, productivity has been flatlining.

22:48And why is productivity flatlining? Because we're not attracting enough investment in the country, not just in manufacturing, but also skills, knowledge-based economy, et cetera. And kickstarting that, that is not a turn on the light switch thing. That is going to take years. But you need government that's committed to and puts that strategy first because that can pay for everything else. That can pay for your employment rights and the things you think are politically important. I think we've now moved into a world where in reality, this government doesn't see. Of course, they want growth because they like to pay for more welfare.

23:29But they don't want growth so people keep more money in their pockets, so that people can save more money for their children. That's not what they want. And there is a big new narrative, which is that they would say the central problem today is not a growth problem, it's an inequality problem. Well, they say so actually, weirdly, although obviously there are a lot of Labour MPs who would say precisely what you've just characterized that the issue is inequality. I am nonetheless struck. There was a very long interview that the prime minister gave to The Economist last week in which he repeated something that, as you say, many would say feel slightly odd in the context of what they've done.

24:20but he said their number one priority is wealth creation. Now, he was talking to The Economist. It's not surprising that he should say that, but it is odd in a way that he is still saying that, given that you might argue there's not a lot of that going on. I'm not close to Rachel Reeves or Keir Starmer. I've met them and I've enjoyed my meeting. And I don't think that, you know, I'm not in, as I said, in a post-partisan world, I don't think that they're malign in their tent or I do think is genuine when he says growth is a priority. But growth is a very difficult thing to do, and it requires you to make real hard choices.

24:58And to prioritize. Yes, and put some of your political priorities second. And it requires you, you know, we live in a mercantilist world now. Now, Donald Trump is doing, it's America first. He's taking industrial steps to re-industrialize and to attract investment in America. The same is, of course, true in Singapore. The same is true in China. A lot of the Europeans in France, they're not doing very well at it, but they're thinking about it. The same is true even in Italy now. We're not thinking about it. We've got this sort of agnostic view of the world. Growth will suddenly come if we build some more houses.

25:36I mean, remember, whenever they talk about the growth strategy, they talk about two things, infrastructure planning and housing. We all agree that planning reform is a good thing. We don't agree that that means you have a free-for-all to build everywhere, but planning decisions are made quickly and decisively, and there needs to be a better balance. But if you build 100 ,000 more houses worth half a million pounds each, that's roughly 50 million on GDP. It's not a speck of dust. It doesn't matter. It's not what's important. By the way, a lot of the houses you're building are building places where there's no employment.

26:11So this is, you've just got to rethink it. And my brother once helped construct the South Tower of the Humber Bridge. Do you remember the Humber Bridge? Humber Bridge was a big growth project, probably in the 1970s. And I'm sure it's a very good thing to have done, but it became known as the Bridge to Nowhere. I remember, yes. Because, of course, employment in that part of the world infrastructure has to follow investment or has to be linked to investment. You don't just build infrastructure and hope it all comes. Well, it's why we are obsessed on this program with improving skills, with investment in R &D.

26:55But skills is a very important point. You see, if you have a national strategy for success in a mercantilist world, you've got to recognize that most employment here is now knowledge-based. It's knowledge-based and skills-based, even at M &S. My view is there's no unskilled job at M &S. Everybody, whether even their stacking shelves, they're all working on our systems, even if they're serving customers. That is a skill. Actually, it's a job that a lot of people can't do very well. And we should cherish those skills.