The armed forces minister, Nick Harvey, told the Guardian that "action in cyberspace will form part of the future battlefield", and though he said cyber-weapons would not replace traditional weapons, he admitted he now regards them as "an integral part of the country's armoury". It is the first official acknowledgment that such a programme exists.
Recognising that there is bound to be concern about when such weapons are used and who would sanction it, Harvey said they would be governed by the same rules that apply to the deployment of other military assets such as special forces.
"We need a toolbox of capabilities and that's what we are currently developing," he said. "The circumstances and manner in which we would use them are broadly analogous to what we would do in any other domain."
He added: "Cyber is a new domain but the rules and norms, the logic and the standards that operate in any other domain … translate across into cyberspace.
"I don't think that the existence of a new domain will, in itself, make us any more offensive than we are in any other domain. The legal conventions within which we operate are quite mature and well established."
Though the nature of the weapons being developed remains top secret, it is understood that the Cabinet Office and the Cyber Security Operations Centre at GCHQ have taken the lead on the issue, and that in time there will be some input from the Ministry of Defence. The MoD recently appointed General Jonathan Shaw to head a defence cyber-operations group, and though he does not have an IT background, his experience as a battle-hardened commander from the Parachute Regiment will help refine what might be useful to the military. Shaw told the Guardian cyberspace represented "conflict without borders".
The potential damage caused by highly sophisticated computer viruses was underlined last year with the discovery of the Stuxnet virus, which successfully disrupted Iran's uranium enrichment programme. The Iranians have accused the Israelis and the US of designing and deploying Stuxnet, which set some of their centrifuges spinning out of control. Experts have described the virus as being so complex and technically advanced that is "beyond any threat we have seen in the past". "Someone had the intent to weaponise a virus," said Ilias Chantzos, a security expert.
Though Whitehall officials deny Britain had any involvement in the development of Stuxnet, its discovery added to the urgency of beefing up the country's cyber-defences.
Last year's national security strategy made cyber-security a tier one priority, and an extra £650m was found for it in the strategic defence and security review (SDSR). Harvey told the Guardian that digital networks were now "at the heart of our transport, power and communications systems", and this reliance had "brought the capacity for warfare to cyberspace".
"The consequences of a well planned, well executed attack against our digital infrastructure could be catastrophic … With nuclear or biological weapons, the technical threshold is high. With cyber the finger hovering over the button could be anyone from a state to a student."
Though Harvey did not specify where future threats might come from, he warned that "it would be foolish to assume the west can always dictate the pace and direction of cyber-technology".
He highlighted how China, for one, is developing "modern militaries and modern technologies".
The foreign secretary, William Hague, told a security conference in Munich in February that the Foreign Office had repelled a cyber-attack a month earlier from "a hostile state intelligence agency". Sources told the Guardian at the time that the attack was believed to be from Chinese intelligence agencies. In his Munich speech, Hague called for agreement on "acceptable rules" for how countries behave in cyberspace.
On Monday night General Graeme Lamb, a former director of UK special forces, told the Guardian that, if anything, the SDSR had not gone far enough in addressing the country's potential vulnerabilities and should have been more radical.
He said that the national security council should have stopped the MoD from committing "its resources towards a more traditional defence posture".
"The emerging threats we face are … breathtakingly complicated and far more sinister, far more deadly and far, far more likely [to be used]. Modern technology increasingly allows the individual to bring to bear industrial violence against our citizens previously the exclusive right of states … complacency has dulled our vision. This reality has for some time been creeping up on us."
Professor Peter Sommer, an expert in technology and security affairs, said that it would not be difficult for GCHQ and other agencies to recast what they were doing to defend against cyber-attacks into a first-strike capability. "Any nation which carefully researches cyber-attack methods for defensive purposes has all the knowledge required for offensive activity. You can also easily argue that a well-targeted attack is low-cost, readily deniable and saves lives by disrupting the enemy. The interesting question then becomes, what are the rules for deployment?
"I suspect the UK will be borrowing from the doctrines which govern our special forces such as the SAS. It will all be covert but will stop at damaging civilians and assassinating heads of state. And the detailed rules will not be published."
He also warned that the UK was in danger of having "too many overlapping and competing agencies and initiatives".
