UK Will Name The Nations Sponsoring Cyber Attacks
Britain will name and shame foreign states that hire hackers to carry out cyber-attacks or interfere via the Internet in national elections, the British attorney general has warned.
In a speech referring to Russian and North Korean “campaigns of intrusion”, Jeremy Wright QC called for international sanctions to be applied against countries that exploit cyberspace for illegal purposes.
“If we stay silent, if we accept that the challenges posed by cyber technology are too great for the existing framework of international law to bear, that cyberspace will always be a grey area, a place of blurred boundaries, then we should expect cyberspace to continue to become a more dangerous place,” Wright told an audience at Chatham House in central London.
“The question is not whether or not international law applies, but rather how it applies and whether our current understanding is sufficient ... Hostile actors cannot take action by cyber means without consequence, both in peacetime and in times of conflict. States that are targeted by hostile cyber operations have the right to respond to those operations in accordance with the options lawfully available to them ...
“If it would be a breach of international law to bomb an air traffic control tower with the effect of downing civilian aircraft, then it will be a breach of international law to use a hostile cyber operation to disable air traffic control systems which results in the same, ultimately lethal, effects.”
Such rights are already established in the UN charter, Wright said, including prohibitions on interventions in the domestic affairs of states and the threat or use of force against the territorial independence or political integrity of any country.
Cyber operations that cause, or present an imminent threat of, death and destruction on an equivalent scale to an armed attack also give rise to an inherent right to take action in self-defence as recognised under article 51 of the UN charter, Wright said.
“If a hostile state interferes with the operation of one of our nuclear reactors, resulting in widespread loss of life, the fact that the act is carried out by way of a cyber operation does not prevent it from being viewed as an unlawful use of force or an armed attack against us.”
Counter-measures cannot involve the use of force, he said. They must be both necessary and proportionate to the purpose of inducing the hostile state to comply with its obligations under international law.
The UK does not believe that it is always legally obliged to give prior notification to a hostile state before taking counter-measures against it.
“It could not be right for international law to require a counter-measure to expose highly sensitive capabilities in defending the country in the cyber arena, as in any other arena.”
Wright’s comments, which follow an FBI inquiry into alleged Russian interference in the 2016 US presidential election, are intended to deter hacking attacks from abroad and attempts by foreign states to influence domestic politics. Wright is keen to ensure that international law keeps up with the rapid pace of technological development and that the international community does not let cyberspace degenerate into a “lawless world”. The UK, he added, is prepared to identify states that recruit proxy actors or hackers to disguise the source of online attacks.
The WannaCry ransomware incident last year, which affected the NHS, was attributed by the UK and its allies to North Korean-sponsored hackers.
The new National Cyber Security Centre has a mandate to protect Britain’s interests in cyberspace. In the past year it identified on average 4.5m malicious emails per month. The UK government has said it is investing £1.9bn in cybersecurity.
Other cyber-attacks in which the UK has named and shamed state actors include the hack and leak of Democratic National Committee emails in the run-up to the US election.
This year, Britain blamed the Russian military for the NotPetya ransomware attack, which started in the Ukraine and spread around the world.
In April, the National Cyber Security Centre, the US Department for Homeland Security and the FBI issued a joint statement saying there had been an extensive and sustained Russian campaign of intrusions into the internet infrastructure of the UK and the US.
You Might Also Read:
