Adapting to the Cyber Domain: Comparing U.S. and U.K. Institutional, Legal and Policy Innovations
What are the origins and evolution of the institutional, policy and legal frameworks that have come to define both the defensive and offensive aspects of the U.K. and U.S. models?
Published by The Lawfare Institute
in Cooperation With
Prime Minister Boris Johnson made it official in a statement to Parliament on Nov. 19, 2020. “I can announce that we have established a National Cyber Force, combining our intelligence agencies and service personnel,” he proclaimed, adding that it “is already operating in cyberspace against terrorism, organised crime and hostile state activity.”
Public avowal of the National Cyber Force (NCF) came as no great surprise. Plans to take this institutional step had been discussed publicly before, after all. Nonetheless, it was a significant moment in the ongoing process of tailoring U.K. institutions, policies and legal frameworks to suit the evolving nature and scale of cyber domain threats and opportunities. The NCF embodies certain distinctive characteristics of the British system, including flexibility regarding institutional roles in general and the role of intelligence agencies in particular. Much the same can be said, moreover, for another recent British organizational innovation: creation of the National Cybersecurity Centre (NCSC).
The American experience throughout this same period has been analogous in many respects—including the creation of new organizations with defensive and offensive missions—yet it is by no means identical. As we shall see, institutional formalism is far more conspicuous in the American system, and so too are anxieties about the roles of intelligence agencies. Whether these are bugs or features is, perhaps, in the eye of the beholder. The comparison between the U.K. and U.S. models, at any rate, is instructive.
