U.K. cybersecurity strategy and active cyber defence – issues and risks

Amongst other issues, forthcoming cybersecurity policy and strategy will need to explain how the U.K. will use active cyber defence (ACD), a capability that has been highlighted in recent government discourse but about which few details are currently available to the public. This paper considers the implications of ACD from a cybersecurity and wider, national strategy perspective in the securitised environment prevailing in the U.K., wherein incidents in cyberspace are regarded as existential threats to the economy, society and national security. It examines risks and issues associated with: the circumstances in which active measures may be used; autonomy, decision-making and accountability; operationally related issues; the potential use of the private sector to perform functions critical to national security, including deployment of cyberweapons; and the hazards inherent in a developing ‘cyber-industrial complex’. It identifies unanswered questions, unresolved contentious issues and apparent paradoxes, with the aim of informing strategists and policy-makers. Addressing these issues in the planning and implementation of U.K. policy should ensure, so far as possible, that the U.K.’s Cyber Security Strategy provides efficient, effective and lawful protection in cyberspace, consistent with the U.K.’s national security objectives and coherent with wider-government strategy across all elements of national power.