In the last few years, some of the UK’s biggest cultural institutions have experienced major threats to their security. A report by the public accounts committee (PAC) has warned that such incidents have exposed serious weaknesses across the sector but that the government has failed to devise a strategy to prevent them. This has left Britain’s cultural institutions open to similar future attacks.

We live in a time when digital systems underpin everything from ticketing to surveillance and building access. Sidelining cybersecurity leaves museums vulnerable to attacks that could threaten both their finances and their collections.

If the UK wants to avoid major attacks and thefts, it needs to learn a lesson from the recent Louvre heist where €88 million (£78 million) of jewels were stolen. An audit conducted just weeks before the incident exposed the Louvre’s spending priorities that left them vulnerable to theft. The report found that €169 million was spent on artwork and exhibitions but only €26.7 million on all forms of maintenance, including security.

The likely thinking of cultural institutions is that to remain financially resilient they have to spend more on money-making attractions, like artwork and exhibitions. However, this means that security sometimes becomes a low priority – less money is spent and less thought given to the importance of keeping it up to date. However, the financial loss from theft affects financial resilience by eroding emergency cash reserves and driving up insurance premiums.

As the Louvre’s audit shows, the museum could have perhaps avoided the theft had it taken its findings more seriously.

The issue of outdated security measures at the Louvre goes back to at least 2017. An audit at the time found that “certain workstations [had] obsolete operating systems (Windows 2000 and Windows XP) which no longer guarantee effective security”. Security updates for Windows 2000 ceased in 2010, and Windows XP in 2014.

Three weeks after the heist in 2025, the Louvre was criticised by France’s Court of Auditors for not taking the audits seriously and spending money on art instead of security in the years before the theft.

Similar weaknesses in investment priorities as the Louvre’s were exposed in a report made by The British Library in March 2024 into their cyber-attack.

In October 2023, The British Library experienced a severe cyber-attack. The library’s systems were infiltrated by hackers who locked out all network users and demanded a ransom of 20 Bitcoin (approximately £590,000). The ransom was not paid and the stolen data was auctioned and then leaked on the dark web.

The library’s report into the attack acknowledged that it happened because it had muddled through with a historical mixture of old systems from many sources, which didn’t have a recovery plan. This meant it took the British Library months to restore the most basic tool – the online catalogue. And even now, five major services, including the catalogue of illuminated manuscripts, remain unavailable.

The cultural institutions, government and even the PAC make the classic mistake of divorcing cybersecurity from physical security.

The report by PAC does mention “bringing together chief digital information officers and chief information security officers” and separately it praises the “National Museum Security Group”. However, there is no mention of encouraging dialogue between the groups.

This divide is very common, and is often built into organisational system. The most junior person responsible for both physical and cybersecurity is often the CEO, or possibly a chief operating officer (COO). This structure worked in the days when physical security did not rely on computers. However, today, when so much physical security relies upon technology, it just does not make sense. There should be someone further down the chain, such as a “chief security manager” or equivalent.

As the report by Apolo Security into the Louvre attack found: “this case highlights another growing challenge: the convergence between operational technology (OT) and information technology (IT). When camera, climate or access control systems are connected to the network, any digital divide can have immediate physical consequences.”

This false split between standard IT cybersecurity (the domain of the chief information security officer), operational technology (the unnoticed computer-enabled devices that keep things working like electronic doors or intruder alarms) and physical security is far from unique to the scope of PAC’s report.

A classic example is the cyber-attack on the Colonial Pipeline in 2021 – an American energy system that connects 29 refineries and serves major airports, military bases and more than 50 million Americans. Only the classic IT systems (billing) were attacked, but management shut down the entire operation as they feared the attack spreading to the operational devices on the pipelines themselves. This stopped all pipeline operations leading to flight alterations, panic buying and over 10,000 petrol stations running dry.

A more integrated approach was exhibited by the train operator Go-Ahead in 2022 in the UK, which had a similar attack on its systems. The company was able, however, to keep the trains running and deal with the source of the attack instead of halting all their operations.

It would be good to think that the UK culture sector would also learn these lessons. But alas, neither the evidence the government gave PAC nor the final report give us any reason to believe that things will become more connected when it comes to a joined-up view of security and stopping future attacks.

James Davenport is a Chartered Fellow of the British Computer Society, and sits on relevant British Standards Institute Committees.

Speak into a phone and an app can render your words in another language in seconds. AI-powered speech translation can be fast, convenient and fluent. But fluency does not guarantee that people will understand one another.

In the most recent census, 880,000 people in England and Wales (excluding tourists and other short-term visitors) said they could not speak English well, and 161,000 not at all. That’s more than a million residents who may need language support in their daily lives, including when trying to access essential public services.

The linguistic range is vast. London alone is home to more than 250 languages. Tight budgets and a shortage of interpreters for some languages can make it difficult to secure an interpreter with the right dialect and expertise for a pressing legal, health or social care matter.

Notice we say “interpreter”, not translator. In professional language services, translation typically deals with written texts, while interpreting facilitates spontaneous communication between users of different spoken or sign languages, whether face-to-face, by telephone or via video.

In a conversation, each person responds to what has come before and shapes what will follow. Added meaning emerges as they hesitate, restart or refer back to earlier points. Words are only part of this exchange – tone, pace, pauses and non-verbal cues can all shape how an utterance is understood.

Imagine a doctor asking a patient if they have missed any of their treatment sessions. The patient gives a hesitant “no” – perhaps because they are embarrassed, unsure or genuinely cannot remember.

On the surface, this reply sounds simple enough, whether the patient says nie in Polish, hayır in Turkish or hapana in Swahili. But would an AI-powered translation device spot the subtle inference in the hesitation?

AI systems work best when conditions are relatively stable: speech is clear, speakers take turns, and people say exactly what they mean. But human interaction is rarely so tidy.

In contrast, a professional interpreter would almost certainly understand the full meaning and context of this answer. They would preserve the hesitation, flag any ambiguities, and allow doctor and patient to repair a possible misunderstanding before it has any serious consequences.

As researchers in the field of public service interpreting, we are therefore concerned that any increase in adoption of AI translation services is done with due consideration for the skills and sensitivities that could be lost in the process.

Complexities of human interaction

Automated speech translation can offer some practical advantages, including on speed and availability. A 2024 survey of more than 2,500 workers across UK health and social care, legal and emergency services and the police found that a third of them had used machine translation at work.

Such systems use a process in which speech recognition converts verbal communication to text, machine translation renders it in another language, then text-to-speech software produces spoken output in the listener’s tongue.

Yet the appeal of instant solutions can obscure the complexities of human interaction, and the potentially serious consequences for those involved if communication goes wrong. In an asylum interview or a Mental Health Act assessment, for example, a language-related error could significantly affect a person’s health, legal status or liberty.

One approach is to reserve automated speech translation for apparently straightforward interactions. However, even a routine exchange is rarely low risk in some public services: an appointment booking may reveal alarming symptoms; a housing enquiry may uncover domestic abuse; a casual conversation with a social worker may raise a safeguarding concern.

We therefore believe technology should be introduced according to the risks of the specific interaction, with human oversight and a plan for escalation if the level of risk changes.

At the same time, human involvement does not automatically guarantee quality. Good interpreting depends on qualified professionals, effective procurement and public-service staff who know how to work with interpreters. So any responsible approach to language access means investing in both professional expertise and the systems that support it.

A hybrid future?

AI speech translation is likely to become ever-more accurate, fluent and useful. It could support qualified interpreters and, when none is immediately available, provide a temporary fallback. Ruling out its use altogether is both unrealistic and undesirable.

The more constructive questions concern when and where it is appropriate; who should supervise its use; when a human interpreter is essential; and who should be held accountable when an AI system causes harm.

It is also important to be realistic about how these systems may perform amid growing linguistic diversity. Some languages, dialects and accents are much better represented in training and test data than others. Research has documented systematic inequalities in language-technology performance worldwide as well as disparities in speech-recognition error rates within a single language.

The risks in public services are therefore uneven. Output for under-represented languages and varieties may be less accurate – and these are often the same languages for which expert interpreters may be unavailable.

As society learns to live with AI, it is important to cultivate communicative environments where technology supports and operates under human oversight, rather than replacing human expertise.

However fluent technology becomes, communication is never simply the transfer of words. Meaning emerges as an interaction unfolds: through what people say, how they say it, what they leave unsaid – and, crucially, their ability to repair misunderstandings.

These are distinctly human capabilities. Any responsible use of AI should strengthen rather than displace them.

---

AI has long been discussed as a threat to jobs and livelihoods. But what’s the reality? In this series, we explore the impact it is already having on different occupations – and how people really feel about their AI assistants.

---

Lucas N Vieira receives funding from UK Research and Innovation. He is the author of Translate: Multilingual Access to Critical Services in the Age of AI (Cambridge University Press, May 2026).

Natalia Rodríguez Vicente does not work for, consult, own shares in or receive funding from any company or organisation that would benefit from this article, and has disclosed no relevant affiliations beyond their academic appointment.