UK can lawfully launch cyberattacks against hostile states, says Attorney General

International law should apply in cyberspace, says Suella Braverman

Suella Braverman, the UK's attorney general, has said 'defensive' cyberattacks would be legally justified if hostile nation-states seek to hack essential systems in the country.

In an interview with The Telegraph, ahead of her speech on the issue at the Chatham House foreign affairs think tank on Thursday, Braverman appeared to confirm that a defensive cyberattack would be justifiable - if the international community could agree on the cyber rules of engagement.

The Attorney General said there is "confusion" and "vacuum" over how international law should apply in cyberspace.

While she feels a consensus will emerge on the subject in the future, though there is no formal agreement in place yet.

"International law matters in cyberspace because if we don't shape the rules here, if we don't have a clear framework to counter hostile activity in cyberspace, and if we don't get cyber security right, the effects will be likely to be felt more often and in hugely disruptive ways by ordinary people," she stated.

Ms Braverman gave an example of a single cyberattack in 2020 that cost a UK local authority an estimated £10 million in recovery costs. The breach interrupted services offered to the local community for months by shutting down IT systems and preventing the council from carrying out property purchases within the borough.

Braverman said the energy sector, medical care, economic stability, and democratic processes are four of the most susceptible areas to cyberattacks.

The Attorney General said the unified international response to the illegal invasion of Ukraine had demonstrated the necessity for a clear cybersecurity framework that clearly defines when state activity is illegal.

A cyberattack should be considered similarly to a physical attack, she said, and governments should lead the discussion on what they view as the "rules of the road."

She also stressed the need of leadership and partnerships between the UK and its allies in shaping and bolstering international cyber governance in order to promote a "free," "peaceful," and "secure cyberspace."

"The United Kingdom's aim is to ensure that future frontiers evolve in a way that reflects our democratic values and interests and those of our allies. We want to build on increasing activism by likeminded States when it comes to international cyber governance.

"This includes making sure that the legal framework is properly applied, to protect the exercise of powers derived from the principle of State sovereignty - to which this Government attaches great importance - from external coercion by other States."

The international law of non-intervention, which forbids coercive measures by one state that negatively or detrimentally interfere with the sovereignty of another state, should be the guiding principle when considering any influence by one state on another, she said.

"The UK's position is that the rule on non-intervention provides a clearly established basis in international law for assessing the legality of state conduct in cyberspace during peacetime."

"It serves as a benchmark by which to assess lawfulness, to hold those responsible to account, and to calibrate responses," she added.

Computing says:

Braverman is taking no risks with her position: her statement follows prevailing international sentiment, as countries increasingly seek to increase their power to strike back against attackers (glossing over the difficulty of assigning blame when it comes to cyberattacks).

It was less than a year ago that NATO itself suggested that Article 5 of its treaty - which states that an armed attack against any one of its member states is considered an attack against them all - could apply to cyberattacks.