Over the past several years, cyberspace has become yet another domain of warfare, along with sea, land and air. In some cases, the consequences of a severe cyber attack can be compared to the outcomes of a conventional military offense, and the NATO alliance has taken notice of it.
During a NATO defense ministers’ meeting in Belgium last month, Secretary General Jens Stoltenberg reminded that a major cyber attack against one member state can be considered a case for the entire alliance and trigger Article 5, the alliance’s collective defense principle.
“A severe cyber attack may be classified as a case for the alliance. Then NATO can and must react,” Stoltenberg told Germany’s Bild newspaper. The bloc’s response, he said, would “depend on the severity of the attack.”
A NATO official, who spoke to Grasswire about the rules of engagement in case of a cyber attack, pointed at the Wales Summit Declaration as the current guiding principle for the bloc.
The declaration, adopted in September 2014, says:
“Cyber attacks can reach a threshold that threatens national and Euro-Atlantic prosperity, security, and stability … A decision as to when a cyber attack would lead to the invocation of Article 5 would be taken by the North Atlantic Council on a case-by-case basis.”
NATO Wales Summit Declaration
In late June, another massive wave of ransomware attacks hit companies and IT departments across the world. The malware, dubbed Petya, was first detected in Ukraine, where it targeted multiple businesses and forced local authorities to switch to manual monitoring of radiation at the Chernobyl nuclear plant.
During a trip to Kiev on July 10, Stoltenberg said the NATO alliance recently delivered “state of the art” cyber defense equipment to Ukraine, which should help the country’s military to tackle threats, improve security and investigate incidents.
Recently #NATO delivered state of the art #cyber defence
equipment, helping #Ukraine to improve cyber security – @jensstoltenberg 🇺🇦 pic.twitter.com/1nUdDbV5kx— Piers Cazalet (@NATODepSpox) July 10, 2017
Stoltenberg did not detail the nature of the equipment. Ukrinform reported on that NATO is in the process of providing Kiev with “new equipment for some key government institutions and authorities, which will enable Ukraine to investigate who is behind certain cyber-attacks.”
After receiving the equipment and talks with top NATO officials, Ukrainian President Petro Poroshenko said on July 10 his country intends to seek membership in the alliance within the next three years.
Ukraine has started a discussion on acquiring @NATO Membership Action Plan – President @poroshenko https://t.co/ZE22y8a0Xr pic.twitter.com/6h2gvNHBB1
— The Bankova (@TheBankova) July 10, 2017
German and Canadian cyber efforts
However, NATO member states have not only been working to assist allies, but to boost their own defenses as well.
A spokesman for the German Ministry of Defence told Grasswire that NATO heads of state and governments would decide in the North Atlantic Council what actions to take in case of a major cyber attack.
“In principle, cyber-engagements are not different from other military engagements. Therefore, the same rules apply. These are especially international law, national law and the political mandate provided by our parliament,” the spokesperson noted.
Another NATO member, Canada, has been actively working on defining the rules of engagement for the cyber domain.
A spokesperson for the Canadian Department of National Defence told Grasswire that Ottawa continues to develop cyber warfare capabilities.
“These cyber capabilities and their corresponding Rules of Engagement, are not releasable to the public, in order to ensure operational security,” the spokesperson added.
In June, Ottawa deployed some 450 troops to the NATO enhanced Forward Presence (eFP) battle group in Latvia. They include “cyber warriors” who are working to protect computer networks and counter disinformation, according to the defense ministry.