“How does a series of hostile acts become a war?” That question, raised by Baroness Eliza Manningham‑Buller, former head of MI5, has unsettled Britain’s security conversation. In public remarks she catalogued Kremlin‑linked sabotage, cyberattacks and targeted killings as evidence of an undeclared conflict — one in which the United Kingdom may already be a combatant. Her point forces a hard look at how modern hostile activity, much of it invisible, stretches the old categories of peace and war.
Is the UK already at war with Russia?
Manningham‑Buller and a growing chorus of security professionals argue that sustained, state‑directed hostile activity can amount to a form of warfare even without tanks, troops or formal declarations. Over the past two decades London and Moscow have clashed in ways that blur the line between espionage and armed conflict: the 2006 poisoning of Alexander Litvinenko, the 2018 Salisbury nerve‑agent attack against Sergei and Yulia Skripal and later Dawn Sturgess’s death, repeated allegations of interference in democratic processes, and a stream of disruptive cyber operations against governments, businesses and critical infrastructure worldwide. The British government has repeatedly linked some of these incidents to actors tied to the Russian state, responding with expulsions, sanctions and indictments. Taken together, these patterns are why some now ask if the UK is effectively at war with Russia.
Attribution in cyber and covert operations complicates both politics and law. Cyberattacks can be routed through third parties, obfuscated by false flags, or carried out by proxies that provide plausible deniability — all features that make decisive public attribution difficult. Yet Britain’s security services, allied agencies and private cybersecurity firms have grown more confident in public attributions where forensic evidence is strong. MI5, GCHQ and the National Cyber Security Centre (NCSC) increasingly issue warnings and coordinate defensive and punitive measures with international partners.
Why this debate matters can be summarized in three political and strategic consequences.
Strategic effect and impact
Covert sabotage, espionage and cyberattacks can degrade capacities, intimidate political actors and shape public debate without provoking the legal and diplomatic consequences that accompany open warfare. These operations can steal intellectual property, disrupt supply chains, and influence elections — delivering strategic outcomes at relatively low apparent cost to the attacker. For victims, the damage is real even if the attack never appears on a battlefield.
Deterrence, escalation and policy choices
Designating such acts as “war” would force questions about proportional response. Traditional deterrence is designed for visible aggression; ambiguous and incremental hostile acts test those frameworks and increase the risk of miscalculation. If responses are too weak, attackers may be emboldened; if too strong, escalation could turn cyber skirmishes into kinetic confrontations. Policymakers thus face a delicate balancing act in signaling credible costs without triggering wider conflict.
Domestic politics and civil liberties
The blurred frontier between espionage and warfare pushes governments to expand surveillance and defensive powers. That can strengthen resilience, but it also raises concerns about civil liberties, oversight and mission creep. Democracies must decide how much intrusive capability to authorize and how to maintain accountability while responding to sophisticated covert threats.
Different specialists view the problem through different lenses. Technologists and cyber experts emphasize resilience: better defenses, rapid incident response, and improved threat sharing between public and private sectors. The NCSC has promoted “active cyber defence” and worked with industry to harden networks; private firms such as NCC Group and CrowdStrike provide forensic work that helps pin responsibility for intrusions. Legal scholars and international relations experts argue about whether to adapt law‑of‑war concepts to cyberspace or to craft new international norms — a choice complicated by the fact that major powers frequently use cyber tools as instruments of statecraft.
How should the UK respond if it accepts Manningham‑Buller’s logic that hostile campaigns amount to warlike activity? Practical steps include coordinated sanctions and indictments tied to clear attributions, improved resilience across public and private sectors through investment in incident response and supply‑chain security, and clearer rules of engagement for cyber operations under parliamentary oversight. Multilateral measures — diplomatic expulsions, joint public attributions, and coordinated economic pressure — increase the cost of malign behavior and reduce unilateral escalation risks.
There are risks either way. Downplaying covert hostility leaves infrastructure, economies and democratic processes exposed. Overreach, by contrast, risks eroding civil liberties and narrowing diplomatic options. The middle path — credible defence, transparent oversight, and sustained multilateral pressure — is difficult to maintain but likely the most prudent course.
Whether the UK is technically “at war with Russia” depends on legal definitions and political will. But the practical reality Manningham‑Buller describes — a sustained contest across invisible battlefields of code, covert operations and political influence — is already shaping strategy, budgets and public expectations. As the lines between peacetime and wartime blur, Britain and its allies must decide whether to accept a slow‑burn rivalry or to push for clearer norms and responses that reduce the risk of miscalculation. The most dangerous outcome may be complacency: treating hostile acts as mere nuisances rather than elements of a deliberate campaign. If covert aggression continues unchecked, can a democracy preserve both its security and its freedoms?
