PARLIAMENTARY DEBATE
Cyber-space: International Law - 21 June 2018 (Commons/Commons Chamber)

Cyber-space is an integral part of the rules-based international order, and there must be boundaries of acceptable state behaviour in cyber-space, just as there are everywhere else. In my speech on this subject at Chatham House on 23 May, I underlined that hostile actors cannot take action by cyber means without consequence, both in peacetime and in times of conflict.

Nation states can mount cyber-attacks under the cover of non-state actors to escape censure. Will my right hon. and learned Friend confirm that, if that happens, they should still be censured and subject to international law?

I can confirm that, and my hon. Friend and the House will know that, where it is possible and appropriate to attribute these cyber-attacks to nation states, that is exactly what we do. He and others will recall the attack on, among others, a number of NHS institutions, which we were able to attribute to the North Koreans. We have done so again in relation to the Russians, and that is entirely right because nation states should be held to account for what they do.

The World Economic Forum has listed cyber-attacks as the third greatest threat to global stability. Given that there are no borders in cyber-space, does my right hon. and learned Friend agree that we need to work to build international consensus on how international law is applied to cyber-space?

Yes, I do agree. We should recognise the progress that has been made, difficult though it is. In 2015, 20 nation states agreed that the provisions of the UN charter should apply in cyber-space. Included among those 20 nation states were Russia and China, so we have been able to make some progress. In the end, every nation state takes responsibility for its own actions, and it is right that the UK gives leadership where it can.

It has been accepted by the NATO Secretary-General that cyber-attacks can, of themselves, trigger the collective defence provisions within article 5. What is less clear is the nature and extent of such a cyber-attack that would cross that crucial threshold. Given the potential repercussions, do we not need clarity on this as a matter of urgency?

We do, and my speech was intended to deliver at least some of that clarity. My hon. Friend is entirely right, and I believe it has now been established that the provisions of the UN charter that mean states are entitled to defend themselves from armed attack also apply in cyber-space. If a cyber-attack is essentially equivalent to an armed attack in its effects, it seems to me appropriate that it should be treated as such. This country is entitled to respond by cyber means, or by other means that are necessary and proportionate.