Security News > 2021 > March > Analyzing the UK's Nuclear Deterrence Theory for Cyberspace
Britain's 2021 Defence Review states that the nation will not use nuclear weapons against any non-nuclear state party to the Treaty on the Non-Proliferation of Nuclear Weapons 1968.
Around the same time, the UK Attorney General, Jeremy Wright QC MP, said, "The UK considers it is clear that cyber operations that result in, or present an imminent threat of, death and destruction on an equivalent scale to an armed attack will give rise to an inherent right to take action in self-defense, as recognized in Article 51 of the UN Charter."
The key phrase to what might elicit a kinetic response from the UK seems to be "Cyber operations that result in, or present an imminent threat of, death and destruction on an equivalent scale to an armed attack." This effectively means a destructive attack against the industrial control systems and programmable logic controllers of one or more of the critical industries, such as water, power, healthcare or finance.
Added to the statement that the UK will "Improve its ability to detect, understand, attribute and act in response to aggression across the range of state threats, whether in the physical domain or in cyberspace, and whether military or non-military in nature," reinforces the notion that the UK will know who attacks it - and will respond.
The question remains how likely is a nuclear response from the UK. The big danger is accurate attribution of attacks, with most cyber experts suggesting that it is impossible to be 100% certain of online aggressors using online detection.
"The challenge of applying deterrence theory to cyberspace," explains Tom Kellermann, head of cybersecurity strategy at VMware "Is that it's a free fire zone with a multiplicity of nation-state and non-state actors. 'Nuclear' deterrence theory is only effective if you can discern your enemy and they are a rational actor, which is often not the case."