Chief legal advisor to government says UK can legally launch cyberattacks against hostile nations, and calls for international “rules of the road”
The United Kingdom can legally launch cyberattacks against hostile nation states, that attack critical industries, the Attorney General has confirmed.
The clarification was provided by Attorney General, the Rt Hon Suella Braverman QC MP, when she set out the UK’s position on applying international law to cyberspace in a speech at Chatham House.
While explaining how countries using defensive countermeasures if key services are targetted, Braverman also called for global agreement on international law and how it should be applied in cyberspace.
Attorney General, the Rt Hon Suella Braverman QC MP
However Braverman insisted that cyberspace is not lawless and argued that a cyberattack should be treated the same as physical attack, and that nation states must lead the debate on what they see as the ‘rules of the road’.
The Attorney General said that nation states can legal introduce sanctions as well as cyber countermeasures, provided they were “proportionate to an unlawful attack by a hostile nation.”
Braverman pointed out that the threat from cyberattacks is very real, and disruptive state cyber behaviour has caused chaos across the world. She cited that before its illegal invasion of Ukraine, Russia targeted destructive malware against hundreds of systems across Ukraine affecting its IT, energy, and financial sectors.
“The United Kingdom’s aim is to ensure that future frontiers evolve in a way that reflects our democratic values and interests and those of our allies,” said AG Braverman.
“The law needs to be clear and well understood if it is to be part of a framework for governing international relations and to rein in irresponsible cyber behaviour,” she added. “Setting out more detail on what constitutes unlawful activity by states will bring greater clarity about when certain types of robust measures are justified in response.”
Legal cyberattacks
Speaking to the Daily Telegraph about the matter, she admitted there was “confusion” and “vacuum” over how internal law should apply in cyberspace. She believed that there would be a consensus but there was, as yet, no legal document.
And she stressed the governing principle should be the governing principle of non-intervention, but steps would need to be agreed if a nation faces “coercive and disruptive” acts that are deemed unlawful.
She identified the four most significant sectors vulnerable to cyber attacks:
She said clearing up international law on these matters would meant nation states could be clear about the range of potential options that could lawfully be taken in response.
“If a state says ‘We believe we have been on the receiving end of an unlawful cyberattack‘; they would legitimately have a right to respond through countermeasures,” she told the Daily Telegraph.
“It could include economic sanctions, restricting freedom of move. That is Visa bans – you could exclude a nation from an international groups and other diplomatic measures.”
The Telegraph then asked her if it could include cyberattacks against the hostile state.
“They can be of the same character,” she replied. “They could involve cyber and non cyber. If you clearly established unlawfulness and if it was the most and most proportionate means (of responding), it would be justified. It is defensive cyber, effectively.”
Waiting for international law
The intervention of the UK’s Attorney General about the legalities concerning cyberattacks by nation states was noted by Jake Moore, global cybersecurity advisor at ESET.
“Cyber law is one of the most complex and difficult areas to manage due to how the occurrences are often unattributable to any particular country,” said Moore. “The dynamics and of course the differences between nations can cause conflict of their own or even the ability to avoid any given situation.”
Jake Moore, ESET
“Clearly a framework to counter hostile states is vital but the intricacies in this context remains a difficulty in its own right to agree on,” said Moore. “It is clear that more needs to be done to combat as well as fight international cybercrime such as espionage and increasing cyber war but waiting for a set of international rules can often leave a far greater opportunity given the time it takes for this approval.”
The exact nature of the UK’s offensive cyber weaponry is a closely guarded secret, but in a submission to a report December 2017 by parliament’s intelligence and security committee, GCHQ said the capabilities of its cyber unit extended to “the high end of counter state offensive cyber capabilities.”
The NCF combines personnel from intelligence, cyber and security agency GCHQ, the MoD, the Secret Intelligence Service (MI6) and the Defence Science and Technology Laboratory (DSTL), under one unified command for the first time.
Its remit is to carry out offensive cyber operations, which “can disrupt hostile state activities, terrorists and criminals threatening the UK’s national security – from countering terror plots to conducting military operations.”
