“Cyber Challenges and Impact on Global Security”: Experts meet in Berlin

By Yvonne Hofstetter

“Cyber” adds multiple opportunities and threats to national security. Which these are was discussed by American and German security experts at the occasion of an invitation from the Embassy of the United States of America in Berlin on March 4, 2022.

Government institutions and corporates continue to face a massive increase in the malicious use of digital techniques and technologies. These include sabotage with computer viruses or worms, online espionage, and online disinformation campaigns. With the number of cyberattacks multiplied since COVID emerged, cyberattacks on systemically relevant infrastructures of warring nations or attacks on satellites that can be infected with malicious code are among the most actual cyber threats that the world is facing these days. Nevertheless, a look at Ukraine once again confirms the NATO Comprehensive Cyber Defense Policy.

As stated at the North Atlantic Treaty Organization’s 31st summit in Brussels on June 14, 2021, it cannot be assumed in principle that a cyberattack already constitutes an attack within the meaning of Article 5 of the Washington Treaty. The reason: Article 5 requires an “armed attack”. Whether a cyberattack is equivalent to an armed attack, shall be decided on a case-by-case basis, according to NATO.

In assessing whether an armed attack has taken place at all, international law looks at the means by which an attack was carried out rather than at the effects of such an attack. According to the opinion as prevailed by an expert group which published the Tallinn Manual 2.0 back in 2017, the means of an armed attack include weapons that set free kinetic energy - missiles, cluster bombs, tank guns. Cyberattacks do not fall into this category, which is why NATO recommends using the term “cyberwar” with care.

In consideration of international law and its objective to de-escalate, cautious wording makes sense. If one was to determine invocation of Article 5 after a cyberattack, this would mean: Defense is also possible with any weapon system, not only through hacking back. In this context, the Trump administration pointed out at the time that the use of nuclear weapons could not be ruled out. Coupled with the latest change in geopolitics, the term “armed attack” could eventually be softened if a cyberattack severely threatens the life and limb of a population.

Nevertheless, the need of the hour is to keep the bar up for invoking Article 5 in the event of a cyberattack. In fact, no cyber precedent is known that would have been powerful and severe enough to trigger armed defense. Such a cyberattack would be required to cause the most serious consequences, such as humanitarian ones. But that alone does not suffice to trigger armed defense. Such cyberattack would need to be clearly attributable - a government would have to be clearly responsible for the cyberattack, as opposed to a (really) private criminal hacker gang (which does not serve their government as mercenaries). However, in the case of cyberattacks such clear attribution is difficult, even impossible. But defending against an adversary who is not with certainty identified as such can have serious diplomatic consequences. It is exactly this, where the risk of hacking back lies. Anyone who hacks back at an alleged adversary, but hits the wrong person or wrong government, can unintentionally trigger political entanglements and appear as an attacker himself.

What usually remains to counter day-to-day cyberattacks is the full range of capabilities to ward them off. This includes investments in cyber security and in the resilience and civil protection of the citizens. But a victim (nation) is not completely helpless neither from a legal point of view: Even if a cyberattack does activate consequences under international law, hacking still remains a criminal offense. If you can solve the problem of attribution, you still have the legal means of criminal law at your disposal.