EAGLE TOWER, a distinctively ugly high-rise, glowers over the Regency splendour of Cheltenham’s posh Montpelier district. However notorious an eyesore, it is also a valuable one; the tower is the centre of Britain’s cyber-security industry, worth about £3.5bn ($4.6bn) a year. Cheltenham used to have the feel of a glorified retirement home. Now it is home to about 10,000 techies, more per person than almost any other town in Britain.

This makeover has a lot to do with the doughnut-shaped building on the edge of town, which houses the Government Communication Headquarters, Britain’s secret cryptography and eavesdropping centre. Until a few years ago GCHQ, which has about 6,000 staff at its Cheltenham site, was largely sealed off from the outside world. But that is changing rapidly. GCHQ is playing a central role in developing a cyber-security industry, in which Britain is one of the West’s biggest players, along with America and Israel.

About five years ago some of the agency’s more entrepreneurial staff began leaving to set up their own companies beyond the wire, in response to a boom in the cyber-security business. One of the most successful of those original startups is Ripjar, founded by Tom Griffin and other ex-GCHQ colleagues. Based in Eagle Tower, Ripjar uses data analytics and AI to counter financial- and cyber-crime. It has expanded rapidly. Earlier this year Sir Iain Lobban, a former head of GCHQ, joined as an adviser. On July 23rd it was announced that Accenture, a big consultancy, had bought a stake in the company, in order to use its technology for its own clients.

Previously people who left GCHQ tended to be frozen out, regarded pretty much as deserters. But where Ripjar first ventured, GCHQ has officially followed. The agency has acknowledged that, as its main purpose is to protect Britain from online threats, it is useful to encourage a proliferation of companies, and experts, that might help it to do that job. This is part of the government’s larger cyber-security strategy, launched in 2016.

For a start, GCHQ has created sites where its experts can work with tech companies. Thus the National Cyber Security Centre (NCSC) was set up last year in London. It is now recruiting a second cohort of participants in a scheme called Industry 100, in which cyber-experts from the business world can work alongside, and learn from, GCHQ staff. A similar site called Tommy’s (after Tommy Flowers, the Englishman who built Colossus, the first programmable electronic computer) has been created in Cheltenham.

More directly, GCHQ has started an “accelerator” programme, to kick-start or scale up companies with bright ideas in cyber-security. Nine firms have just finished a year in Cheltenham, in which each company got a grant of £25,000 and office space at a site called Ada (after Ada Lovelace, who laid some of the mathematical foundations for the computer). The first companies have just joined a similar programme in London that the NCSC helped to start.

Licence to code

One participating firm in the Cheltenham accelerator is Cybershield, a startup that specialises in detecting phishing e-mails. Paul Chapman, Cybershield’s boss, argues that having the company’s work scrutinised and approved by GCHQ experts was the most valuable part of the exercise. Cybershield also worked with GCHQ’s Socio-technical Security Group, which draws on behavioural science to examine how people interact with the online world—when choosing passwords, say.

More such collaborations are planned. A “cyberpark” is being built next to GCHQ’s Cheltenham base, costing £22m. This will mainly house cyber-security firms, conveniently close for expert advice.

Not everyone at GCHQ was happy to be drawn into the world of startups and unicorns. Robert Hannigan, who founded the NCSC while head of GCHQ in 2014-17 (and now works for BlueVoyant, a New York-based cyber-security company), says it was “quite a culture shock”. But Chris Ensor, a deputy director, argues that making GCHQ more open has been “hugely beneficial” for the agency, “making us think more agilely.”

There have already been discussions on how to take GCHQ’s baby steps into the commercial world further. For example, Britain could copy In-Q-tel, a venture capital fund set up by the CIA in 1999 to invest in companies that could help the country’s spies, including the National Security Agency, America’s equivalent of GCHQ. In-Q-tel (whose name is a reference to Q, the quartermaster who supplies gadgets to James Bond) is accessible and open, argues Mr Hannigan, making it still easier for techies to bring their new ideas into the secret world.

Israel also holds lessons, in the way that it fast-tracks former members of its secret signals agency, Unit 8200, into successful cyber-startups. It has worked hard to cultivate a pipeline of tech talent, from school onwards. Britain has copied some of this with its Cyberfirst programme, which sponsors undergraduates to study for careers in cyber-security. But more could be done in schools, especially to get greater numbers of women into the industry. Spying has long been portrayed as a game for tough guys and smooth talkers. These days, the game is being won by nerds.