Sir Nicholas Soames: To ask the Secretary of State for Defence, what his Department's definition is of a cyber act of war.

Penny Mordaunt, Minister of State for the Armed Forces: There is no set definition for an act of war, cyber or otherwise.

An "act of war" and "armed conflict" are not defined within the Geneva Conventions. It is a matter of interpretation as to whether the threshold (within the context of surrounding circumstances) between a skirmish and a state of armed conflict has been crossed. Most cyber activity is criminal in nature. A key requirement to determining if there is an armed conflict taking place would be the deliberate intervention of members of a state's armed forces.

In determining if 'cyber' activity constitutes an armed attack, the UK view is that cyber-attacks can be considered as armed attacks if their consequences are essentially the same as those of a conventional kinetic attack. For example, theft of intellectual property would generally be considered to be a criminal act. However, if cyber-activity was performed on a scale which had sufficiently serious consequences for a developed economy, many States - including the UK - would likely regard this as an "armed attack".

| Hansard

37120