What’s driving NATO’s boost in cyber operations

By: Justin Lynch  

Source Link

A soldier of the Polish Army sits in a tank as a NATO flag flies behind during the NATO Noble Jump military exercises of the VJTF forces on June 18, 2015 in Zagan, Poland. The VJTF, the Very High Readiness Joint Task Force, is NATO's response to Russia's annexation of Crimea and the conflict in eastern Ukraine. Troops from Germany, Norway, Belgium, Poland, Czech Republic, Lithuania and Belgium were among those taking part today. During the NATO summit in July, when President Donald Trump chastised world leaders and called into question the American commitment to other members, fears swirled that the transatlantic partnership might become an afterthought for U.S. officials. Instead, the 29-member alliance - including the United States - has begun implementing an agreement from that summit to deter state-sponsored cyberattacks.

In the past two weeks, plans for the alliance to operate in cyberspace have been bolstered by two announcements.

NATO hopes to have its cyber operations center fully operational by 2023, Major General Wolfgang Renner told Reuters Oct. 16. And Secretary of Defense Jim Mattis offered key support by announcing Oct. 4 that the United States would provide cyber contributions to the alliance, although specific details were not included.

“We are ready today to provide cyber support to our allies,” Mattis told reporters.

The announcements come after a recent digital inflection point for NATO. In June, the alliance released its joint air power strategy, a document that included cyberspace for the first time. The new policy was meant to deter cyberattacks from Russia. In addition, the alliance also agreed to create the new cyberspace operations center and a Joint Force Command during a summit of leaders in July.

“NATO is acting on the high-level decision of July and it is quite intense,” Sorin Ducaru, a former top cyber official at NATO told Fifth Domain. He added that the October announcements were part of an “important change” for the alliance because it is operationalizing cyberspace. “For the first time there is talk about working together to impose costs on countries who are attacking member states in cyberspace,” Ducaru said.

Although the NATO was stood-up to combat the rise of communism after World War II, today it serves as an alliance of collective security, meaning that an attack on one nation is an attack on all. This summer’s summits were an attempt to translate that logic into cyberspace, but questions remain about whether it can stand up to a flood of Russian hacking and disinformation campaigns.

“Setting up the center and having it operational doesn’t mean much if NATO doesn’t work out the rules for using the offensive capabilities,” said Klara Jordan, director of the Cyber Statecraft Initiative for the Atlantic Council. “The NATO decision makers will have to be more tolerant of risks, specifically risk to other members because they’ll be transgressing their networks when operating.”

NATO itself does not currently have offensive capabilities, Jordan said, and cyber operations are used to support battlefield effects. She said that unless the organization changes how it operates, each nation would have veto power over planned cyberattacks.

Some NATO members lag behind when it comes to cyber capabilities, Jordan added, and suggested that the U.S. should work within the alliance to bolster attribution and other capacities.

The number of NATO members has doubled as a target list for Russian hacking and information operations. Estonia, Britain, Germany, France, Montenegro, and the United States have all accused Moscow of launching a campaign of digital warfare. But some members of the alliance say there has been a pattern of mutually assured destruction in cyberspace that has served as a moderating force.

“There is actually this strange, strange balance of fear, not only of the nuclear issue but also in cyber,” Juri Luik, the Estonian Defense Minister told Fifth Domain during a September interview. “I would say that there has never been a real big cyber attack against another country which would utilize all the fearsome cyber weapons which are in the hands of many governments. People are cautious about it because they know that, you do it, it can be used against you as well.”