Cyber operations and the law

We start by acknowledging an important point of agreement with the author: the article is "not a call for lawlessness." The author, as an intelligence practitioner, "fully embrace[s] regulations and oversight committees and recognises their role in legitimising and regulating … actions." 

Acknowledging the importance of law and regulation in this way is essential. While it is suggested that law reflects high ideals, providing legal, operational and policy advice on cyber operations is a very practical matter. The most effective and impactful operations occur when planners and operators work closely with lawyers and policy officials, maintaining clear lines of communication including with ministers and other decision-makers. In other words, it is crucial that everyone understands the operation, including its time critical nature, the objectives, and the wider policy and political issues at stake.

We accept that there can be a real sense of frustration when operations are delayed, or when it feels like operational creativity is stifled. In our experience, the law is almost never the only reason why an operation doesn’t proceed, much less the lawyers whose job is to interpret the legal framework. In the UK, most proposed activities do not push the boundaries of the law. Legally complex and urgent operations are considered and authorised within hours when necessary. We also share the author’s caution when it comes to the idea of using law and the process around it as a proxy for addressing what are in reality technical, operational, or policy challenges.

Furthermore, the rule of law is foundational to cyber activity, not in opposition to it. It is not optional. Last year, the UK emphasised in a publication titled Responsible Cyber Power in Practice that how we operate in cyberspace is key to being consistent with our democratic values and the principles of responsible cyber power. More recently, the Attorney General for England and Wales the Rt Hon Lord Richard Hermer KC stressed the importance of the rule of law, including the protection and promotion of international law.

Oversight of cyber activity is just as crucial. It is a key part of what grants intelligence agencies their license to operate. It also provides the necessary confidence for operators to carry out their activities and is, therefore, far from an impediment.

We do accept that the legal and oversight frameworks within which we operate must evolve. We need to ensure that they remain fit for purpose, keeping pace with evolving technology. The UK Parliament recently passed an amendment to the 2016 Investigatory Powers Act, described as best in class by the UN Special Rapporteur for the Right to Privacy in 2018, to ensure that lessons learned from preceding years of practical application were incorporated. As Lord David Anderson KC noted in his 2023 Independent Review of the Investigatory Powers Act, the IPA will likely need a revised framework in the longer term. He argues that “a law designed for the 2030s will be made stronger and more durable by the accumulation of thoughtful, knowledgeable, constructive and honest views from practitioners, activists, policy-makers, engineers, lawyers, political leaders and interested members of the public. The voices of young people, in particular, need to be heard in relation to the technologies that will affect their lives.”

So rather than single out the law or lawyers, we should acknowledge that cyber operations are a team effort. A mix of minds is critical and will continue to be so. Operations work best with clear communication and shared purpose. This requires the best possible understanding between operators, policy officials, and lawyers, through investing time and energy in relationships as well as operational planning.