NATO’s role in the cyber domain is unclear.

slide_6.jpgArticle 5 of the NATO Treaty

NATO’s role in the cyber domain remains unclear. Clearly, NATO will seek to protect its own networks and platforms. Yet, the extent to which NATO’s remit expands further remains to be seen. 

It is unclear how Article Five will apply to cyber attacks. Clearly, petty cyber crimes and financial fraud are outside of NATO’s remit. However, it is at least plausible that Article Five could be invoked if a state experienced a serious cyber attack on critical national infrastructure. An attack threatening vital goods and services, such as the provision of electricity or water, would be regarded as a significant incident that could potentially justify the use of Article Five in response to a cyber attack. 

Equally unclear, is what a NATO response would look like. If the intended strategy is to respond to serious cyber attacks in kind, NATO would have to develop its own cyber weapons. This would be problematic given the inexperience and technical limitations of a NATO workforce that has not previously operated in the cyber domain. Alternatively, NATO could respond to cyber attacks through more traditional expressions of power: via armed soldiers, missiles, navy vessels, and fighter jets. Although potentially more viable, precedents over the point at which a cyber attack merits a physical or kinetic response are yet to be established by the international community. 

The Tallinn Manual, produced by the NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE), has, has sought to respond to some of these questions by exploring how international law can be applied to cyber conflicts. However, the study is regularly misunderstood. Although commissioned by the NATO CCDCOE, the Tallinn Manual does not represent NATO doctrine and is purely an academic, non-binding study, intended to make a start in answering some of the contentious legal questions posed by cyber conflicts. In this regard, whilst the Tallinn Manual makes an important academic contribution, it by no means clarifies NATO’s evolving role in the cyber domain. 

Although NATO has adapted to evolving security threats before, the cyber domain offers altogether new challenges. 

First, there are a number of flaws in the militarisation of the cyber domain. The majority of those with the necessary technical skills to respond to the cyber security challenges work outside of the military sector. In addition, a large proportion of the infrastructure within the cyber domain is privately owned and operated. This prevents NATO from making a substantial contribution to its protection. Crucially, NATO does not have any rights, or powers, to intervene in the private sector. Given NATO’s current lack of expertise in the area, private sector firms are unlikely to welcome NATO assistance. 

Second, not all NATO members agree on the role the organisation should play in the cyber domain. Given the sensitivity of information, states such as the US and UK appear to prefer close collaboration with only a small group of trusted countries. Intelligence-sharing platforms such as Five Eyes (between the US, Canada, UK, Australia and New Zealand) are preferred. In this regard, small, high-trust cooperation forums may be viewed more favourably in the cyber domain when compared to other security domains.

From NATO’s original remit to provide collective defence in a post World War period, the organisation has evolved numerous times, adapting to the challenges faced by the Cold War, the breakup of the Soviet Union, and the emergence of terrorist cells and other non-state actors since 9/11. Although the cyber domain brings altogether new challenges, it would be unwise to write NATO off just yet. 

Jamie Collier:

 

« IBM Watson's Goodbye To Privacy
Russian Air Crash Investigation Changes The Encryption War »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

ACME Communications

ACME Communications

ACME Communications specialises in the field of data centre, implementation, maintenance & operation and all aspects of other IT service.

Sparta Consulting

Sparta Consulting

Sparta Consulting is an information management and business development full service provider.

Dragos

Dragos

Dragos has built the first industrial cybersecurity ecosystem, the ultimate security defense.

QA

QA

QA is a leading IT training provider in the UK with over 1,500 courses covering all areas of IT including Cyber Security.

Cryptovision

Cryptovision

cv cryptovision GmbH is one of the leading specialists for modern, user-friendly cryptography and solutions for secure electronic identities.

Redstor

Redstor

Redstor's complete data management helps you discover, manage and control your data from a single control centre, unifying backup and recovery, disaster recovery, archiving and search and insight.

OurCrowd

OurCrowd

OurCrowd is a leading equity crowdfunding platform for investing in global startups.

Selectron Systems

Selectron Systems

Selectron offers system solutions for automation in rail vehicles and support in dealing with your railway cyber security challenges.

Netenrich

Netenrich

The Netenrich operations intelligence platform is built from the ground up to help enterprises resolve everyday and futuristic problems for stable, secure environments and infrastructures.

Quantum Armor

Quantum Armor

Quantum Armor is a next-gen cyber security monitoring platform that allows you to continuously stay aware of your security posture, and proactively spot trends, vulnerabilities and potential attacks.

Telefonica Global Solutions (TGS)

Telefonica Global Solutions (TGS)

Telefonica Global Solutions is the technological partner of wholesalers and enterprises, helping them to achieve the digitalization they need.

stackArmor

stackArmor

stackArmor specializes in compliance and security-focused solutions delivered using our Agile Cloud Transformation (ACT) methodology.

General Informatics

General Informatics

General Informatics is a team of technology enthusiasts with one mission: to make our clients even more successful through the best use of technology.

Zeva

Zeva

Zeva solves complex identity and encryption challenges for the federal government and corporations around the globe.

ECIT

ECIT

ECIT is your preferred provider of finance and IT services. We believe in the value of combining financial and IT services to streamline and improve the operation of your business.

Qevlar AI

Qevlar AI

Qevlar AI empowers SOC teams, to eliminate redundant tasks and refocus on what truly matters - making the most of every employee within the SecOps team.