The West has strengthened Ukraine’s resolve by providing military hardware that has blunted Russia’s initial offensive and, as the conflict has become more entrenched, will likely prove to be the tipping point against Russian aggression. A tidal wave of inflammatory statements by the Kremlin has escalated fears that Russia may use tactical nuclear weapons, especially now that it has annexed four Ukrainian regions that it already partially occupied. But more realistic than a nuclear strike is the risk that Russia may decide to launch debilitating cyberattacks. Offensive cyber is central to the strategic thinking of the Russian military apparatus, especially against NATO states.

While President Vladimir Putin may be bluffing about pressing the nuclear button, he may effectively turn off the West’s internet and disrupt military depots and critical energy infrastructure—a glimpse of which we saw with the sabotage attacks against the Nord Stream pipelines in the Baltic Sea. These are scenarios for which the British government and private companies have been long preparing.

With its limited resources, the concern is that the new emphasis on bolstering Ukraine’s cyber defenses may weaken the United Kingdom’s own cyber command at home. Priorities will need to be determined and while operational secrecy in the context of an ongoing war is understandable, little is known about Britain’s role in cyber operations in Ukraine. Is it an open-ended commitment? What are its parameters? The United Kingdom’s principal adversaries within this arena, namely China and Russia, have invested heavily in their cyber capabilities. If Britain continues to allocate resources and threat intelligence to the war in Ukraine, then it will either need to compromise its response to threats from China, Russia, Iran, and North Korea or commit to significantly increasing its investment in Ukraine to ensure its ongoing operational capabilities match the reality of a protracted conflict.

It is fair to assume that the United Kingdom can retaliate against Russia with a cyberattack on its interests. Cyber specialists within the NATO alliance, especially the United States and the United Kingdom, have been effective frontline fighters waging a quiet battle behind the screens and working to deter, counter, and respond to Russian cyberattacks on Ukrainian targets that could have wider consequences for Europe. It is no secret that Russia has been behind disruptive cyberattacks on Ukraine’s infrastructure, notably the attack on satellite company Viasat. On February 23, one day before the start of the invasion, most key Ukrainian government institutions had their websites attacked.

According to the UK’s Integrated Review published last year, the United Kingdom is the third most powerful cyber actor in the world, ranking high in defense, intelligence, norms, and offensive capabilities. Under former prime minister Boris Johnson, the National Cyber Security Centre, as well as the National Cyber Force (NCF)—a joint GCHQ and Ministry of Defence partnership with offensive cyber capability—were established.

The United Kingdom’s cyber offensive capabilities are both cloaked in secrecy and of public record, with centers located around the country, most notably at GCHQ within the leafy confines of Cheltenham and its associated military sites. However, these public sites are accompanied by numerous other discretely maintained facilities that combine with resources across the UK military and intelligence network within the coordination of the NCF. In February, Defense Secretary Ben Wallace told MPS, “I’m a soldier, I was always taught the best part of defence is offence,” adding that Britain was prepared to launch retaliatory cyberattacks if Moscow targeted Britain’s online networks.

The 2022 National Cyber Strategy sets out the United Kingdom’s goal to “be a leading responsible and democratic cyber power.” But while caution and operational secrecy may be commonplace around offensive operations, there are questions for which accountability and transparency will be inevitably required. Specifically, how is “offensive cyber” organized, and what are the rules of conduct with respect to adherence to international law, ethics, and diplomacy? These are debates that Britain needs to have.

British intelligence officials tend to be cautious about discussing the United Kingdom’s offensive cyber capabilities, and understandably so. As Dr. Andrew Dwyer, co-lead of the UK-focused Offensive Cyber Working Group told me, there is little in the public domain about what precisely London is doing to support Ukrainian war efforts In June, U.S. Army Gen. Paul Nakasone, who heads U.S. Cyber Command and serves as the director of the National Security Agency, revealed that the United States has been supporting Ukraine with cyber operations, including offense, defense, and information activities. The NCF collaborates closely with its counterpart in the United States and the British government has repeatedly emphasized its commitment to contribute cyber capabilities within NATO.

According to Dwyer, the United Kingdom does appear to have significant intelligence capability (which is likely supported by both cyber-enabled and human intelligence espionage operations) and a significant capability in electronic warfare: “There is no doubt that the UK is selectively sharing such intelligence with Ukraine and other allies derived from its capabilities in Russia and elsewhere.”

Ukrainian forces have effectively not only anticipated the movement of Russian troops but disrupted their operations, forcing them to abandon many mobile communications in favor of sending senior commanders to the frontlines. According to Ukrainian sources, as many as fourteen Russian generals have been killed during the invasion—an unprecedented number since World War II. Put simply, through predominantly electronic intelligence provided by the West, Ukraine has been able to systemically decapitate the leadership of Russia’s capability and in so doing, sowed both doubt and chaos within its ranks.

A seminal report published last year by King’s College London concluded that the United Kingdom should retain primacy within its domestic cyberspace. Dwyer, one of the authors, told me, “The UK, from its National Cyber Security Centre to its offensive cyber capability (including its soft cyber diplomacy and increasing attention to technical standards) show a capable actor who is able to influence—but not steer—global geopolitics.” While it is essential that Ukraine continue to receive unabated support from the West, the British government must be wary of overextending its cyber resources and putting the public in danger on the home front.

Dr. Burcu Ozcelik is a research fellow at the Henry Jackson Society and holds a Ph.D. in Politics from the University of Cambridge. 

Image: DVIDS.