Sign up for our daily briefing
Make your busy days simpler with Axios AM/PM. Catch up on what's new and why it matters in just 5 minutes.
Stay on top of the latest market trends
Subscribe to Axios Markets for the latest market trends and economic insights. Sign up for free.
Sports news worthy of your time
Binge on the stats and stories that drive the sports world with Axios Sports. Sign up for free.
Tech news worthy of your time
Get our smart take on technology from the Valley and D.C. with Axios Login. Sign up for free.
Get the inside stories
Get an insider's guide to the new White House with Axios Sneak Peek. Sign up for free.
Catch up on coronavirus stories and special reports, curated by Mike Allen everyday
Catch up on coronavirus stories and special reports, curated by Mike Allen everyday
Want a daily digest of the top Denver news?
Get a daily digest of the most important stories affecting your hometown with Axios Denver
Want a daily digest of the top Des Moines news?
Get a daily digest of the most important stories affecting your hometown with Axios Des Moines
Want a daily digest of the top Twin Cities news?
Get a daily digest of the most important stories affecting your hometown with Axios Twin Cities
Want a daily digest of the top Tampa Bay news?
Get a daily digest of the most important stories affecting your hometown with Axios Tampa Bay
Want a daily digest of the top Charlotte news?
Get a daily digest of the most important stories affecting your hometown with Axios Charlotte
Illustration by Rebecca Zisser / Axios
NATO is so unprepared for a cyber attack that the group of experts it assembled to write about cyber espionage can't definitively say whether it's legal or not. As the NATO Cooperative Cyber Centre of Excellence report put it, "cyber espionage, as a general matter, does not violate international law."
Why it matters: Countries under attack are paralyzed to defend themselves since the definition of a lawful response is unclear. That leaves NATO's responses to cyber attacks on member countries at a standstill.
Why is that the case? Due to gaps in current international law, there is no set standard for how states can respond to attacks, and there's no agreed upon definition for what a "cyber attack" even is. Some interpretations say there must be a "use of force" for a cyber action to be a "cyber attack," while others say it must be an "armed conflict."
What this tells us about Russian hacking: Those legal gaps have left the door wide open for states with hacking capabilities to interfere in other countries basically unchecked, because how states can respond to attacks is legally unclear, too — and Russia knows it. As Retired Major General Charlie Dunlap told Axios:
Russia seeks to exploit the ambiguity and uncertainty in the law today.
Why doesn't someone clarify what's legal? It's strategic, according to Dunlap, who told Axios the "U.S. and other countries may not want such a norm to develop because it would obviously restrict their own activities."
Just last year NATO agreed a cyber attack on a member state justifies using NATO mutual defenses, and six years ago the U.S. decided it would respond to cyber attacks just as it responds to other attacks on land, air, or sea. But even then, the U.K. Defense Secretary warned the "NATO machinery is not geared up" for a cyber attack, and two weeks ago U.S. Sen. Jeanne Shaheen said Congress should determine whether Russia's election hacking was an act of war.
So how can the U.S. or any country respond to attacks?
- Proportionally: Gleider Hernández, who helped draft the NATO expert manual on cyber espionage, said he personally believes "...countermeasures must...be proportionate and may not be retaliatory...it is generally understood that countermeasures cannot themselves be forcible acts."
- Or militarily — and this is key: Ret. Maj. Gen. Dunlap agreed that responses must be proportional but said countries can lawfully employ traditional military attacks (those outside of the cyber realm) to take a stand.