When a hostile state acts on British soil, is it war, crime or terrorism? How we answer shapes how we prepare.
In the early hours of Sunday morning, police received a report of three suspicious vehicles heading towards RAF Fairford. One local resident has described finding the road blocked by three vans and a group of hooded, masked men, who ran when they saw her. Five men were arrested, first on suspicion of explosives offences and then on suspicion of preparing a terrorist act. Police evacuated around 85 households while Army bomb disposal teams examined the vehicles.
Fairford isn’t just any airfield. It hosts US heavy bombers, and the US has flown operations against Iran from it since February. In July, Iran’s Revolutionary Guard publicly warned Britain that any base used against Iranian territory was a legitimate target. ITV News reports that one line of inquiry is whether representatives of the Iranian regime paid others to carry out the plot on their behalf. At the time of writing, no connection has been confirmed. The five men remain in custody, and it’s right that we let investigators establish the facts.
But whatever they find, the incident exposes a problem I’ve been thinking about for some time. Judging by the discussion on my recent posts, it clearly resonates with many of you.
An academic argument with practical consequences
When I argued that we are, in effect, at war with states using hybrid methods against the UK, people rightly challenged me on the word “war”. War has a legal meaning, and using it loosely carries real risk, not least the risk of escalation with nuclear-armed states.
So let me come at it from a different direction.
What is the difference between a state-sponsored terrorist act and an act of war? The objective is often identical: to coerce another country into changing its behaviour. Clausewitz described war as the continuation of policy by other means, and a proxy with a van full of explosives is simply another means.
The real difference isn’t the implement. It’s the rulebook each one triggers.
An act of war falls under the laws of armed conflict and can justify a state-level response. We treat an act of terrorism as a crime, for the police and the courts to handle. The first can reach the state that ordered it. The second, in practice, reaches the people caught holding the tools.
That distinction can look academic, but it decides who can respond, and how.
Choosing the box you land in
Hostile states understand this better than we do. If you want to pressure the UK without paying a state-level price, you don’t send your own forces. You recruit criminals or sympathisers, often online and often for modest sums, and you make sure the act looks like arson, vandalism or terrorism. Once it lands in the criminal box, police arrest the proxy, the courts prosecute them, and the state that directed it pays nothing.
We’ve already seen this pattern. In 2025, men recruited on behalf of Russia’s Wagner Group were convicted over an arson attack on a London warehouse storing equipment bound for Ukraine. The organisers were the first people convicted under the National Security Act 2023. MI5’s Director General has said publicly that Iran, like the Russian services, makes extensive use of criminals as proxies. In 2025 he reported more than twenty potentially lethal Iran-backed plots in a single year. Different states, same method.
Put simply, we’ve built a system for catching the hand, not the head.
The National Security Act 2023 was a genuine step forward, creating offences for foreign-directed sabotage and interference. But it still works at the level of the individual. It punishes the proxy more effectively without changing the calculation for the state behind them.
A third category
This is where Kenneth Smart’s challenge changed my thinking. Framing these acts as war, within the current framework, does risk rapid escalation, and that’s a serious concern. But the answer can’t be to fall back on treating them as ordinary crime when a state is clearly directing them.
I think we need a third category: hostile state acts below the threshold of armed conflict, with rules of their own.
We already have the tools. Diplomatic expulsions, targeted sanctions, asset freezes, proportionate cyber operations and, under international law, lawful countermeasures against a state that has committed a wrongful act. What we lack is a framework that says when we’ll use them.
We already do this for threats we have defined. When the national terrorism threat level changes, nobody improvises. The government publishes the level, and organisations plan the protective measures that follow it in advance. Hostile state acts deserve the same treatment. Whatever we choose to call them, they need to become policy, with responses agreed before the next incident rather than after it.
Salisbury in 2018 shows it can be done. The government attributed the attack to Russia on a “highly likely” intelligence assessment, rather than waiting for a conviction. It then responded at state level alongside its allies. The problem is that the government built the response after the fact, and ad hoc responses deter very little.
A framework for hostile state acts
A proper framework would do three things.
First, define what a hostile state act is, so that incidents are assessed as part of a campaign rather than one at a time.
Second, set a published standard for attribution: a high-confidence assessment rather than proof beyond reasonable doubt. It should run alongside any criminal investigation instead of waiting for it.
Third, declare the kinds of proportionate, graduated response a state can expect when that threshold is met.
The honest counterargument is that publishing a threshold tells an adversary exactly where to stop. That’s a real risk. But I’d argue the current position is worse. Right now there is no threshold at all, and the fog of uncertainty is doing our adversaries’ work for them.
Why this matters beyond defence
Businesses are already on this battlefield. Critical infrastructure, defence supply chains and the companies around them are obvious targets, but anyone whose disruption creates pressure is in scope. Organisations can’t plan properly against a threat their own government hasn’t defined. A clear national framework would give security leaders something concrete to assess risk against and to explain to their boards. It is the same need for clear definitions that sits behind Martyn’s Law for terrorism at public venues.
I don’t claim to have all the answers, and I’d genuinely welcome challenge. Is a third category the right approach? And if it is, where would you set the threshold?
A note of thanks
I’d like to thank everyone who took the time to respond to my recent posts on this subject. The volume and quality of the discussion made it clear this is something that matters to many of us working in security, defence and resilience.
In particular, I’d like to thank Kenneth Smart. His thoughtful academic input on the challenges of framing these acts as war made me think harder about the problem. His challenge is a large part of why this piece explores a third category of conflict, rather than simply arguing that we are at war.
A note on how this was written
These are my own views, shaped by that discussion. I used AI to help research and draft this piece. Mainly, that let me get it out while the conversation is still live and people are still engaged with it. It has also helped me organise my thinking and put it across more clearly. The arguments, and any errors, are mine.