A Cyber Attack On NATO Could Trigger Article 5

Few nations have sophisticated cyber capabilities and for operational security reasons, they are closely guarded, rarely shared, and carefully used.

The US Senate Intelligence Committee Chair Mark Warner warned Russian President  that waging a cyber attack against a NATO country could risk embroiling Moscow in a war against multiple Western governments, including the United States. 

In 2019 NATO Secretary General Jens Stoltenberg said all 29 member countries would respond to a serious cyber-attack on one of them.

Recently a NATO official told Reuters that a cyber attack could be considered an armed attack and trigger "Article 5," it was a significant moment. How significant is harder to judge. "Article 5" is NATO's holy grail, the core of what NATO is about. It is part of the Washington Treaty, signed in 1949, that set up the North Atlantic Treaty Organisation, which started with 12 members and now has 30.

Article 5 states, "The Parties agree that an armed attack against one or more of them in Europe or North America shall be considered an attack against them all."

Mircea Geoană, Deputy Secretary General of NATO, says that when the alliance decided that cyber should be considered an “operational domain,” the bloc also made the call that a “massive cyber attack” on one member state could trigger Article 5 of NATO’s Washington Treaty. This strikes at the heart of the alliance’s defense clause, which states that an attack on one country is considered an attack on all allies.

So, for instance an attack on Poland is effectively the same as an attack on the United States, a powerful deterrent to a potential aggressor, but of course life is never that simple.

For decades it seemed simpler, as an armed attack would be obvious and NATO nations would respond with tanks, artillery, and warplanes. Now, in our new world, nations can be undermined through information warfare and infrastructure crippled by cyber attacks, often difficult to trace.

How NATO should respond to such attacks created much debate, first on the principles of whether a cyber attack could be considered an "armed attack," and secondly if it is, what to do about it.

So, if for instance Poland was attacked with tanks, individual nations are not obliged to respond with military force. Article 5 is powerful but how nations individually respond, with a lot or a little, is still up to them. Nevertheless, a conventional military attack on a NATO nation would get a massive response. Deterrence has worked.

But when we move into the grey zone of "hybrid warfare" that response is harder to predict.

This is one of the aims of Russian strategy towards NATO, to achieve its goals while operating below the threshold that will trigger Article 5. On cyber, those waters will be even muddier given how deniable activity is within cyberspace. In 2014, NATO's leaders made cyber defence a core part of collective defence but policy and activities to implement that decision are still evolving. To that end, for instance, it has a technical agreement with the European Union and a NATO Industry Cyber Partnership. At SHAPE, NATO's military headquarters, there is also a Cyberspace Operations Centre.

Currently, NATO is far more focused on defensive cyber, to secure its systems from attack, and the nature of that is a point of debate.

Some commentators say that passive cyber defence, where you simply build up your virtual walls, leaves the initiative with your adversary, enabling him to probe without consequence until he finds your weak point. Effective defence means also going after the attacker and forcing him onto the back foot, so-called offensive cyber. That is also what would be needed if NATO's responding to an Article 5 breach.

 NATO as an institution does not possess significant cyber capabilities. When it comes to activities, NATO is a command and control organisation using hardware and personnel loaned by members.

Few nations have sophisticated cyber capabilities and for operational security reasons, they are closely guarded, rarely shared, and carefully used. That means if a cyber attack did trigger NATO Article 5, then the actual use of cyber weapons would be outsourced to nations for use on behalf of the Alliance in a coordinated manner. However, as the NATO source told Reuters, a response does not have to be symmetrical, and could theoretically escalate to include a military one.

Persuading 30 nations to agree on this will be hard, and a further possibility is if NATO cannot agree there could be a so-called "coalition of the willing" operating separately. NATO has previously agreed cyber attacks could trigger Article 5, and that itself was a major decision and something of a deterrent to hostile actors. But the reality of having to act on it is now closer than ever before.

Reuters:      BBC:      Cyber Security Dive:     Daily Mail:       C-Span:      GZero

You Might Also Read: 

NATO & Ukraine Agree Deeper Cyber Co-operation:

 

« Making Sense Of The Edge
Twitter Joins Ukraine’s War Effort »

ManageEngine
CyberSecurity Jobsite
Check Point

Directory of Suppliers

TÜV SÜD Academy UK

TÜV SÜD Academy UK

TÜV SÜD offers expert-led cybersecurity training to help organisations safeguard their operations and data.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

Kent Interdisciplinary Research Centre in Cyber Security (KirCCS) - University of Kent

Kent Interdisciplinary Research Centre in Cyber Security (KirCCS) - University of Kent

KirCCS harnesses expertise across Kent University to address current and potential cyber security challenges.

National Information Security & Safety Authority (NISSA) - Libya

National Information Security & Safety Authority (NISSA) - Libya

NISSA is responsible for safeguarding the integrity, availability and resilienceof ICT infrastructure, resources, services and data in Libya.

Critifence

Critifence

Critifence provides unique Cyber Security solutions designed for Critical Infrastructure, SCADA and Industrial Control Systems.

AlAnsari Technical Solutions (ATS)

AlAnsari Technical Solutions (ATS)

ATS is a Kuwait based company specialised in delivering hardware/software, Virtualisation, IP Telephony / Unified Communication, Networking and professional IT services and solutions.

VIQU Recruitment

VIQU Recruitment

VIQU Recruitment was formed with the primary focus of providing 'Smarter People Solutions' to the UK’s professional IT & Cyber Security markets.

Haven Group

Haven Group

Haven Group and its companies are a cyber security one-stop-shop for our clients offering a full range of cyber security services to our clients in a unified and united way.

Earlybird Venture Capital

Earlybird Venture Capital

Earlybird is a venture capital investor focused on European technology innovators.

Cloud Range

Cloud Range

Cloud Range provides cybersecurity teams with access to the world's leading cyber range platform, eliminating the need to invest in costly cyber range infrastructure.

Appknox

Appknox

Appknox is the world’s most powerful plug-and-play security platform that helps developers, security researchers, and enterprises to build a safe and secure mobile ecosystem.

Cyber Octet

Cyber Octet

Cyber Octet is an IT Solution, Security, Training and Services company. We provide training and services from Web Application Security to ISO 27001 implementation.

Royal United Services Institute (RUSI)

Royal United Services Institute (RUSI)

The Royal United Services Institute is an independent think tank engaged in cutting edge defence and security research. Areas of research include cyber security and resilience.

Pixee

Pixee

Pixee fixes vulnerabilities, hardens code, squashes bugs, and gives engineers more time to focus on the work that counts.

NetAlly

NetAlly

NetAlly network test solutions help engineers and technicians better deploy, manage, maintain, and secure today’s complex wired and wireless networks.

Inveo Group

Inveo Group

Inveo group is the Italian leader for the management of privacy and data protection issues.

Aprio

Aprio

Aprio is a premier business advisory and accounting firm. We deliver advisory, tax, managed, and private client services to build value, drive growth, manage risk, and protect wealth.

ITConnexion

ITConnexion

ITConnexion is an Australian-based Managed IT Service with over 20 years of experience. We offer a complete IT management service for non-profits, SMEs, and enterprises.