The United Kingdom Economic Warfare Prevention and Response Act: An Emergency-Powers Model for Immediate Deterrence

Economic warfare is cheap to commence, difficult to attribute and capable of producing physical and societal harm after the period in which ordinary legal process can prevent it. English law divides the response amongst cybercrime, intelligence, sanctions, civil contingencies, data protection, sector regulation, corporate law, military prerogative and international law. Each instrument was drawn for a part of the problem. None provides one evidential and constitutional route by which a minister can receive an incident, preserve the disappearing fact, restrain a private controller, impose cost upon a foreign payer and, where an actual or imminent armed attack makes force necessary, defend the United Kingdom before a hospital, water system or winter grid fails. This paper sets out the United Kingdom Economic Warfare Prevention and Response Act in model clauses. The Act defines economic-warfare acts by function and effect rather than actor or weapon; creates graduated reporting; establishes a central Authority and the federated MOSAIC evidence service; brings private strategic capacity and PMSCs under a control relationship rather than a compliance duty, through designation, a recorded control map, a registered stop capability and a strategic decision manifest; permits urgent preservation, identification, account, credential, service and asset orders; authorises targeted sanctions and coordinated countermeasures; and requires an attribution and harm assessment before serious response. Speed is a constitutional requirement of effectiveness. The model does not make prior parliamentary debate a condition of every emergency measure. Existing law already recognises urgent executive action followed by short, automatic review: the Civil Contingencies Act 2004 requires emergency regulations to be laid and approved within seven days; the Investigatory Powers Act 2016 permits defined urgent warrants subject to later Judicial Commissioner approval; sanctions legislation employs urgent procedures; and the convention concerning military action recognises that prior Commons debate may be inappropriate in an emergency. The Act adopts that pattern whilst shortening operational decisions to minutes or hours. The most coercive route contains the strongest conditions. Force cannot be a countermeasure under the law of State responsibility and cannot punish a completed theft. It may be considered only if the United Kingdom is subject to an actual or imminent armed attack, including a cyber operation whose scale and effects are equivalent; force is necessary to halt, repel or prevent that attack; the target is lawful; expected civilian harm is not excessive; and the action complies with international law. The United Kingdom's published position already recognises that anticipated death, injury and physical destruction bear upon the cyber armed-attack assessment and that self-defence may extend to actual or imminent attack by non-State actors. Proportionality must not be confined to the damage already realised. The decision maker must assess maximum reasonably credible and foreseeable harm from access, capability, target, season, persistence and replication. Erasure of NHS data or interruption of energy in winter may kill without an explosive. A keyboard which produces the scale and effects of an armed attack does not become legally gentle because the instrument lacks mass. The model is firm against both payer and operator. A State purchasing contractor attacks may face swift attribution, sanctions, procurement and export restrictions, collective response and lawful countermeasures. A poor, off-grid or deniable operator may face direct account and infrastructure restraint, arrest, seizure, cyber isolation and, only at the armed-attack threshold, force against a lawful person or object. The Act cannot create an international right to do any of these abroad; it creates domestic power, decision discipline and immediate machinery to employ the measures which international law permits. The safeguard is not delay. It is a named decision maker, independent evidence, legal certification, minimum necessary scope, collateral assessment, automatic expiry, rapid judicial review, parliamentary recall, correction and personal consequence for abuse. A law which demands deliberation after the attack has become irreversible supplies ceremony rather than protection. Publication edition, revised October 2026; not yet peer reviewed.