One of the links in the 28 June guest post was to a post on the ICS cyber security blog published here on 26 June. In it, the author described the cybersecurity-related developments of the Biden-Putin summit of 16 June and assessed their potential impact, with some undisguised scepticism.
The news tsunami surrounding the summit somewhat obscured a no less important story. Also attended by President Biden, the NATO Council Summit took place in Brussels on 14 June. Its lengthy final communiqué dealt, among other things, with the handling of cyber-attacks on NATO member states. Point 32 of the communiqué states
certain cyber activities directed against them may, in certain circumstances, constitute an armed attack.
These may justify the application of Article 5.*
NATO will decide on this on a case-by-case basis.
Following the meeting, NATO Secretary General Jens Stoltenberg was even clearer:
because an attack in cyberspace is “as damaging and dangerous” as an armed attack and “as serious as any other attack against a NATO ally”.
Note that this is a qualitative leap! NATO has now made it clear that, unlike in the past, the perpetrator of a major cyber attack, e.g. against critical infrastructure, can now expect the widest possible range of responses.
The ransomware attack on the Colonial Pipeline and the resulting major fuel shortages on the US East Coast are believed to have played a role in this decision.
But, as it turns out, this attack was explicitly designed to make money. It’s bad to think that a possible future response to a – possibly misinterpreted – attack on a NATO member state could now include an armed counter-attack!
However, the possibility of a “real” – i.e. APT – attacker might indeed make a “casus belli” worth considering. For example, there is now a serious stake in “toying” with a country’s critical infrastructure – say its electricity system.
Either way, cyberspace is now increasingly becoming a new arena for mutual deterrence, alongside mutual nuclear deterrence.
In the light of all this, it is perhaps unnecessary to justify why the above development in the ‘lee’ of the Biden-Putin summit should not be overlooked…
* NATO considers and treats an attack on one of its members as an attack on NATO as a whole.
We welcome messages either agreeing or disagreeing with the above. For example, a new post could respond to them and even lead to a substantive exchange of views.