NATO’s role in the cyber domain is unclear.

slide_6.jpgArticle 5 of the NATO Treaty

NATO’s role in the cyber domain remains unclear. Clearly, NATO will seek to protect its own networks and platforms. Yet, the extent to which NATO’s remit expands further remains to be seen. 

It is unclear how Article Five will apply to cyber attacks. Clearly, petty cyber crimes and financial fraud are outside of NATO’s remit. However, it is at least plausible that Article Five could be invoked if a state experienced a serious cyber attack on critical national infrastructure. An attack threatening vital goods and services, such as the provision of electricity or water, would be regarded as a significant incident that could potentially justify the use of Article Five in response to a cyber attack. 

Equally unclear, is what a NATO response would look like. If the intended strategy is to respond to serious cyber attacks in kind, NATO would have to develop its own cyber weapons. This would be problematic given the inexperience and technical limitations of a NATO workforce that has not previously operated in the cyber domain. Alternatively, NATO could respond to cyber attacks through more traditional expressions of power: via armed soldiers, missiles, navy vessels, and fighter jets. Although potentially more viable, precedents over the point at which a cyber attack merits a physical or kinetic response are yet to be established by the international community. 

The Tallinn Manual, produced by the NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE), has, has sought to respond to some of these questions by exploring how international law can be applied to cyber conflicts. However, the study is regularly misunderstood. Although commissioned by the NATO CCDCOE, the Tallinn Manual does not represent NATO doctrine and is purely an academic, non-binding study, intended to make a start in answering some of the contentious legal questions posed by cyber conflicts. In this regard, whilst the Tallinn Manual makes an important academic contribution, it by no means clarifies NATO’s evolving role in the cyber domain. 

Although NATO has adapted to evolving security threats before, the cyber domain offers altogether new challenges. 

First, there are a number of flaws in the militarisation of the cyber domain. The majority of those with the necessary technical skills to respond to the cyber security challenges work outside of the military sector. In addition, a large proportion of the infrastructure within the cyber domain is privately owned and operated. This prevents NATO from making a substantial contribution to its protection. Crucially, NATO does not have any rights, or powers, to intervene in the private sector. Given NATO’s current lack of expertise in the area, private sector firms are unlikely to welcome NATO assistance. 

Second, not all NATO members agree on the role the organisation should play in the cyber domain. Given the sensitivity of information, states such as the US and UK appear to prefer close collaboration with only a small group of trusted countries. Intelligence-sharing platforms such as Five Eyes (between the US, Canada, UK, Australia and New Zealand) are preferred. In this regard, small, high-trust cooperation forums may be viewed more favourably in the cyber domain when compared to other security domains.

From NATO’s original remit to provide collective defence in a post World War period, the organisation has evolved numerous times, adapting to the challenges faced by the Cold War, the breakup of the Soviet Union, and the emergence of terrorist cells and other non-state actors since 9/11. Although the cyber domain brings altogether new challenges, it would be unwise to write NATO off just yet. 

Jamie Collier:

 

« IBM Watson's Goodbye To Privacy
Russian Air Crash Investigation Changes The Encryption War »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

CloudPassage

CloudPassage

CloudPassage, a cloud security and compliance pioneer, safeguards cloud infrastructure for the world’s best-recognized brands.

Dataglobal

Dataglobal

Dataglobal is an industry-leading provider of Information Archiving/Governance and Unified Data Classification solutions.

Hivint

Hivint

Hivint is a new kind of Information Security professional services company enabling collaboration between our clients to reduce unnecessary security spend.

Irish National Accreditation Board (INAB)

Irish National Accreditation Board (INAB)

INAB is the national accreditation body for Ireland. The directory of members provides details of organisations offering certification services for ISO 27001.

Jobsite

Jobsite

Jobsite is an award winning job board in the UK providing job listings in the key sectors of IT, Engineering and Finance.

Zeusmark

Zeusmark

Zeusmark are a digital brand security company. We enable companies to successfully defend their brands, revenue and consumers online.

Port53 Technologies

Port53 Technologies

Port53 Technologies is focused on delivering enterprise-grade, cloud-delivered security solutions that are easy to deploy, simple to manage and extremely effective.

Contechnet Deutschland

Contechnet Deutschland

Contechnet Deutschland started as a specialist in the area of IT disaster recovery and has since broadened its portfolio into information security and data protection.

BOXX Insurance

BOXX Insurance

BOXX Insurance Inc. is a new type of insurance company for a new type of risk. Cyberboxx is the first fully-integrated cybersecurity and insurance solution for small-to-medium-sized businesses.

RMRF Tech

RMRF Tech

RMRF is a team of cybersecurity engineers and penetration testers which specializes in the development of solutions for early cyber threat detection and prevention.

Open Source Security Foundation (OpenSSF)

Open Source Security Foundation (OpenSSF)

OpenSSF is committed to collaboration and working both upstream and with existing communities to advance open source security for all.

GuardYoo

GuardYoo

GuardYoo's SaaS platform allows cybersecurity professionals to perform Compromise Assessment remotely from anywhere in the world.

Bittnet Training

Bittnet Training

Bittnet Training is the leader in the IT Training market in Romania. We develop the IT skills of IT professionals as well as those who wish to start a career in IT.

Kirk ISS

Kirk ISS

Kirk ISS are the leading provider of IT services in the Cayman Islands. We offer best-in class hardware, software, communications and cloud computing, all backed by professional services support.

eMudhra

eMudhra

eMudhra is a leader in Identity and Transaction Management Solutions.

Somos

Somos

From voice to messaging to fraud prevention and beyond, Somos are committed to developing innovative solutions that ensure that our ability to maintain trustworthy connections never stops.

Everfox

Everfox

Everfox (formerly Forcepoint Federal) has been defending the world's most critical data and networks against the most complex cyber threats imaginable for more than 25 years.