Though computers offered a more efficient means of processing on which the banks were keen to capitalise, their rapidly growing dependency on those machines meant the need to think clearly about their security. One of the most obvious vulnerabilities was the risk of these machines failing. It would be difficult, if not impossible, to return to paper-based accounting. Barclays, for example, was one of the largest computer users in the world by the 1970s, requiring it to develop contingency plans should it suffer a computer security incident, and to test those plans in advance, much in the same way banks do today.

Unique to financial institutions is the commercial sensitivity of the data they store and transfer. Data loss was therefore a driving concern, far more so than for those managing comparable systems such as airline or even military applications. Finance required a more tailored and thorough approach to security. The answer was a combination of physical and technical measures. Controlling access to the spaces in which computers were held, through perimeter fences and CCTV for buildings and access controls on internal doors to computer rooms, were common tactics, as were the basics of employee ID cards and logon passwords.

Yet the banks were also clear that total security was unattainable. They often referred to resilience and assumed that they would inevitably fall victim to some kind of computer fraud, breach of confidentiality, or physical damage. Computer security thinking at this point therefore also took into account industrial action and even weather-related risks, with banks investing significant amounts of money in back-up sites and uninterruptible power supplies. The focus was on ensuring customers could still use their important services, mirroring contemporary thinking around operational resilience currently being led by the Bank of England.

Threats abounded. Externally, the risk came from the potential for eavesdropping either on the radiation emitted from computer terminals or the signals sent across communications lines. Such was the concern that the Bank of England wrote to GCHQ in the mid-1970s to assess the ‘vulnerability of its computer configuration to fraudulent use by persons of high intellect with a knowledge of electronic engineers’, and suggested that a ‘red-team’ of its system could prove useful. Internally, programmers could add in fraudulent code and manipulate systems to their advantage.

At around the same time, the major banks were also collaborating to develop the payment system known as CHAPS: the Clearing House Automated Payment Systems. The techniques used in CHAPS to protect its users are illustrative of the growing concern over the external threat, that of hacking and payment fraud.

Following a decade of research, by its launch CHAPS had an in-built cryptographic method of ensuring the authenticity and confidentiality of payment messages, and its encryption algorithm had been evaluated by the National Physical Laboratory. Donald Davies, the renowned Welsh computer scientist famed for his development of the packet-switching technique, which still underpins the Internet, claimed that although the cipher being used had certain weaknesses, they would not lead to a ‘very serious threat by an attacker.’

A consensus had formed by the end of the 1980s, and persists today, that the financial sector is one of the most aware and active sectors in relation to computer security. Barclays, at the time it began to use computers, recognised it ‘could not afford to take a risk with other people’s money’ and was already spending, along with its peers, prodigious amounts of money on computer and network security. Perhaps that is why by the middle of the 1970s Barclays declared it had not experienced a significant loss due to computer fraud.

Banks talked about the ‘confidentiality,’ ‘integrity,’ and ‘availability’ of data and networks, terms which pervade the sector today. The Bank of England in 1984 persuaded the banks to agree to the confidential exchange of information concerning both successful and unsuccessful attempts to misuse bank computer networks, foreshadowing the continued efforts of the sector to exchange threat intelligence and tactics, techniques, and procedures of malicious actors.

At that there were increasingly common references to the amending of payment instructions to, for example, transfer money to illegitimate recipients, exactly as was attempted in the Lazurus Heist decades later.

Though the scale of the threat, the potential losses and the scope of malicious actors in cyber space continues to evolve, there is significant continuity in the computer and network security threat that has existed since at least the late 1950s. This is bank robbery by modern means. At the core is the need for banks to protect the trust and confidence of their customers, something so fundamental to their existence. It has deep roots.