U.K. Outlines Position on Cyberattacks and International Law:
[…] a big process question is how the U.K. position might catalyze broader diplomatic endeavors to clarify or create rules for cyberspace. Efforts within the U.N. to reach global consensus on these issues have so far failed, mostly because states' interests are poorly aligned. Expert processes like the one that produced the Tallinn manuals can play useful roles, but they are no substitute for state practice and the articulation and defense of legal interpretations.
(Via Lawfare - Hard National Security Choices)
UPDATE: Isa Qasim's take is deeper and describes eight key points from the speech:
United Kingdom Att'y General's Speech on International Law and Cyber: Key Highlights:
First, it is important for states to publicly articulate their understanding of international law, especially in cyberspace. […]
Second, cyber is not lawless. […]
Third, cyber-operations that result in an "equivalent scale" of death and destruction as an armed attack trigger a state's right to self-defense under the UN Charter's Article 51. […]
Fourth, the Article 2(7) prohibition on interference in "domestic affairs" (the principle of non-intervention) extends in the cyber context to "operations to manipulate the electoral system to alter the results of an election in another state, intervention in the fundamental operation of Parliament, or in the stability of our financial system." Wright acknowledges, however, that the exact boundary of this prohibition is not clear.
Fifth, there is no cyber-specific rule prohibiting the "violation of territorial sovereignty" beyond the Article 2(7) prohibition described in the point above. […] This appears to be a rejection of the Tallinn Manual's position on the issue, which had articulated an independent international legal rule prohibiting certain cyber operations as a violation of sovereignty.
Sixth, states are not bound to give prior notification of countermeasures when "responding to covert cyber intrusion." […]
Seventh, there is no legal obligation to publicly disclose the information underlying a state's attribution of hostile cyber-activity to a particular actor or state. Similarly, there is no universal obligation to publicly attribute hostile cyber activity suffered.
Eighth, a victim state does not have free rein to determine attribution for a malicious cyber operation before taking a countermeasure. Wright stated that "the victim state must be confident in its attribution," and he added later, "Without clearly identifying who is responsible for hostile cyber activity, it is impossible to take responsible action in response." This view contrasts with other writings in this field (see Sean Watts' article at Just Security).
(Via Just Security)
Also on: