According to NATO’s decision, a cyberattack on a member country could be considered an attack on the entire US-led alliance, potentially triggering a military response.
Does this translate to “You hack us, we nuke you”? While on one hand cybersecurity is as much part of the global security system as physical security and should therefore be considered in any defensive plans of any country or alliance, on the other hand this new doctrine is a very dangerous one, due to the very intangible nature of cyberattacks.
Here’s a very recent example. Our media were full of reports that “Russian government hackers penetrated the computer network of the US Democratic National Committee” and “Russia ‘hacked Democrats data on Trump’ says US”. A good enough excuse to scramble a squadron of NATO bombers and target a Moscow suburb where the suspected hackers are hiding? But then this lone hacker came forward and said “No, it was me! I was there first!” and offered the stolen documents for download. Recall the bombers, recall the bombers!
The internet is full of stories of global powers blaming one another or being blamed for hacks, cyberattacks, cyber espionage, etc. (the famous US/Israeli Stuxnet cyberattack against Iran is a good example). Even at ESET, we were involved in uncovering a few, such as the 2014 Targeted Attacks in Ukraine and Poland and the Cyberespionage in Ukrainian war zones.
But unlike physical incidents of air or sea incursions where the public has at least some idea of what may have happened, we have absolutely no insight into the cyber wars. Cyber forensics, tracing attacks and determining the people behind them are a very difficult nut to crack even for our top cyber security experts. If our countries decide to go to war over a “hack”, how will we ever know it was really over an enemy one and not over a falsely attributed one? Or even a false flag one?
While cyberattacks do require a response and a defense plan, I am not convinced a military response is the optimal solution, particularly in times of rising tensions we’re witnessing now.
by Urban Schrott, ESET Ireland