Deterring Russian cyber warfare: the practical, legal and ethical constraints faced by the United Kingdom

This article examines both the nature of the cyber threat that Russia poses to the United Kingdom and the efficacy of the latter’s responses to it. It begins, and making use of original Russian sources, with a review of why a Russian cyber campaign is being conducted against the UK and how it is being operationalised. This article then goes on to analyse the UK’s ability to defend itself against this campaign by employing the concepts of both deterrence-by-denial and deterrence-by-punishment. Such deterrence will, though, and as the UK government has made clear, only ever involve the use of cyber tools. The UK will not threaten to use kinetic means to deter to any Russian cyber attack, no matter how serious its consequences. But can this UK cyber deterrence actually work? The idea of cyber deterrence-by-denial seems to be impractical, while there are specific issues with employing cyber in a deterrence-by-punishment capacity. In particular, how can the UK employ its own offensive cyber capabilities against Russia and yet remain within international law and ethical boundaries? Indeed, the UK government has already accepted that, in any future use of its offensive cyber capabilities, it cannot do so.