The North Atlantic Treaty Organization’s (NATO) ability to respond offensively to cyber attacks is hindered by its previous inaction and inherent difficulties surrounding cyber defense. During the 2016 NATO Warsaw Summit, NATO officially recognized cyberspace as an operational domain of warfare alongside air, sea, and land.[i] The intended purpose of that action is to allow NATO members to strengthen cyber capabilities and network protection.[ii] This includes bringing cyber attacks under the scope of Article 5 of the North Atlantic Treaty, which states that an attack on an Ally or Allies shall prompt collective defense from the Alliance.[iii]While the move seeks to clarify cyber’s position in warfare, issues with attribution and a lack of a cyber ‘red line’ make it difficult for NATO to actually invoke Article 5 in response to cyber attacks on its Allies and partners.
Inherent difficulties with establishing a cyber ‘red line’ make it difficult to know when it would be acceptable to invoke Article 5. While labeling cyber as an operational domain of warfare was not a direct response to any particular adversary’s behavior, it is clear that Russia remains the biggest concern for the Alliance. In the past, NATO has been reluctant to respond to cyber attacks on its Allies and partners. The distributed denial of service attack on Estonia in 2007, cyber blockade of Georgia in 2008, attacks on Ukrainian energy infrastructure in 2015, and numerous other incidents of cyber attacks have been attributed to Russia in recent years.[iv] Yet NATO took no offensive action to support those countries. It remains unclear what form a cyber attack would take and how severe a cyber attack would need to be in order to force NATO to invoke Article 5 or take an offensive posture. The recent Democratic National Committee hacks underscore this uncertainty and highlight NATO’s reluctance to take offensive action against Russian cyber aggression.
Difficulties associated with attributing cyber attacks to specific perpetrators also makes it difficult for NATO to invoke Article 5 in response to a cyber attacks. Highly skilled states, groups, and individuals who perpetrate major cyber attacks will attempt to avoid being attributed through various technical methods.[v] Though states often know who is responsible for a cyber attack based on the current geopolitical climate, it is not always possible to directly link a state or group to an attack with indisputable evidence.[vi] The issue of identifying an attacker is exacerbated by NATO Allies and partners’ reluctance to share cyber capability information with one another. Some Allies are concerned that others in the Alliance do not make similar investments in cyber capabilities and are thus hesitant to reveal their own capabilities.[vii] Others do not share information based on the secrecy surrounding technology and intelligence gathering.[viii] The reluctance of Allies and partners to share critical information creates barriers to preventing or halting cyber attacks.
Recent cyber attacks against NATO Allies and partners demonstrates that a defensive cyber posture is ineffective in countering cyber aggression.[ix] Labeling cyber as a domain of warfare is a step in the right direction, but a stronger framework is needed to clarify when NATO must take an offensive rather than a defensive posture in dealing with cyber attacks. A clarified offensive framework would blend conventional and non-conventional warfare and technology, creating a stronger deterrence mechanism to combat and reduce cyber attacks. However, NATO still needs to determine ‘red lines’ for invoking Article 5 and improve on sharing cyber capabilities between member states to help identify attackers and appropriately act upon attribution. Without such a pre-determined framework, NATO Allies and partners will likely be unsure of how to respond during times of cyber conflict.
[i] “Press Conference by NATO Secretary General Jens Stoltenberg following the North Atlantic council meeting at the level of NATO Defence Ministers.” North Atlantic Treaty Organization, June 14, 2016.http://www.nato.int/cps/en/natohq/opinions_132349.htm?selectedLocale=en
[ii] Ibid.
[iii] Ibid.
[iv] Alison Lawlor Russell, “Cyber Blockades.” Washington, DC: Georgetown University Press, 2014; Kim Zetter, “Inside the Cunning, Unprecedented Hack of Ukraine’s Power Grid.” Wired, Mar. 03, 2016.https://www.wired.com/2016/03/inside-cunning-unprecedented-hack-ukraines-power-grid/; “Russia was behind German parliament hack.” BBC News, May 13, 2016. http://www.bbc.com/news/technology-36284447
[v] Thomas Rid, “Cyber War Will Not Take Place.” United Kingdom: Oxford University Press, 2013.
[vi] Ibid.
[vii] Matthijs Veenendaal, Kadri Kaska, & Pascal Brangetto, “Is NATO Ready to Cross the Rubicon on Cyber Defence?” NATO Cooperative Cyber Defence Centre of Excellence. June 2016.https://ccdcoe.org/sites/default/files/multimedia/pdf/NATO%20CCD%20COE%20policy%20paper.pdf
[viii] James A. Lewis, “The Role of Offensive Cyber Operations in NATO’s Collective Defence,” The Tallinn Papers No. 8. 2015. https://ccdcoe.org/sites/default/files/multimedia/pdf/TP_08_2015_0.pdf
[ix] David E. Sanger, “As Russian Hackers Probe, NATO has No Clear Cyberwar Strategy” The New York Times, June 16, 2016. http://www.nytimes.com/2016/06/17/world/europe/nato-russia-cyberwarfare.html
No comments:
Post a Comment