What GCHQ Actually Does, and Why The Lost Key Isn't Science Fiction

Most people know GCHQ as the place that listens. That's not wrong, but it's a small piece of what the organisation actually does, and it's the piece least relevant to what happens in The Lost Key.

What GCHQ actually does

GCHQ is the UK's signals intelligence agency, and for the past decade its most public-facing work has run through the National Cyber Security Centre, the arm of GCHQ that exists to defend Britain's digital infrastructure rather than penetrate someone else's. That distinction matters. The public image is offensive: intercepting communications, tracking targets, the Bond-adjacent version of intelligence work. The reality, for a large share of what GCHQ does day to day, is defensive. It is about understanding where the country is exposed before someone else finds out first.

That defensive posture is the starting point for The Lost Key.

Why a simulation drive is more dangerous than a weapon

The device at the centre of the book isn't a weapon, a list of agents, or classified communications. It's a training and simulation drive, the kind used to model how a hostile actor might move through the UK's critical systems if they got access. In security work, that kind of material is sometimes more dangerous than the real thing, because it isn't a single vulnerability. It's the map of every vulnerability someone already found, tested, and catalogued, compressed into a single object.

That's the premise I wanted to write from. Fiction tends to build tension around stolen secrets: names, locations, plans. Real cyber risk more often looks like stolen knowledge of how systems fail, because once someone has that, they don't need to discover the weakness themselves. They need only use it before it gets patched.

The infrastructure nobody thinks about until it fails

Power. Water. Payments. Rail signalling. None of it looks dramatic until it stops working, and that's deliberate. Critical infrastructure is designed to be invisible when it functions. The people who think about it professionally, inside GCHQ, inside NCSC, inside the private contractors who service these systems, spend most of their time reasoning about failure modes the public never sees, because the job is to make sure they stay that way.

That's the world James O'Neill gets pulled back into in The Lost Key: not a bomb, not a shootout, but a quiet, procedural race to recover something that maps exactly how the country's most essential systems could be made to fail, before someone with the wrong intentions works out how to use it.

Why MI5 and GCHQ rarely work alone

Fiction often treats agencies as siloed rivals, useful for dramatic friction but not accurate to how a real cross-agency threat gets handled. When something touches both national security and critical infrastructure, the response draws in more than one organisation almost immediately: GCHQ for the technical picture, MI5 for the domestic threat and human element, often others depending on what's actually at risk. Sarah Sterling, the MI5 officer at the centre of the Key Series, exists partly because that overlap is realistic. The technical threat and the human threat are rarely separate problems. They're usually the same problem, approached from two directions at once.

Why I wrote it this way

I spent years around people whose job was to think about exactly this kind of exposure, long before "critical national infrastructure" was a phrase most people recognised. The instinct in that world isn't paranoia. It's the opposite: a methodical respect for how many ordinary, boring systems the country depends on, and how little margin there is if the wrong person understands them better than the people defending them.

That's the tension I wanted The Lost Key to sit inside. Not a race against a bomb. A race against knowledge, once it's in the wrong hands.