Illustration by Rebecca Zisser / Axios
NATO is so unprepared for a cyber attack that the group of experts it assembled to write about cyber espionage can't definitively say whether it's legal or not. As the NATO Cooperative Cyber Centre of Excellence report put it, "cyber espionage, as a general matter, does not violate international law."
Why it matters: Countries under attack are paralyzed to defend themselves since the definition of a lawful response is unclear. That leaves NATO's responses to cyber attacks on member countries at a standstill.
Why is that the case? Due to gaps in current international law, there is no set standard for how states can respond to attacks, and there's no agreed upon definition for what a "cyber attack" even is. Some interpretations say there must be a "use of force" for a cyber action to be a "cyber attack," while others say it must be an "armed conflict."
What this tells us about Russian hacking: Those legal gaps have left the door wide open for states with hacking capabilities to interfere in other countries basically unchecked, because how states can respond to attacks is legally unclear, too — and Russia knows it. As Retired Major General Charlie Dunlap told Axios:
Russia seeks to exploit the ambiguity and uncertainty in the law today.
Why doesn't someone clarify what's legal? It's strategic, according to Dunlap, who told Axios the "U.S. and other countries may not want such a norm to develop because it would obviously restrict their own activities."
Just last year NATO agreed a cyber attack on a member state justifies using NATO mutual defenses, and six years ago the U.S. decided it would respond to cyber attacks just as it responds to other attacks on land, air, or sea. But even then, the U.K. Defense Secretary warned the "NATO machinery is not geared up" for a cyber attack, and two weeks ago U.S. Sen. Jeanne Shaheen said Congress should determine whether Russia's election hacking was an act of war.
So how can the U.S. or any country respond to attacks?
- Proportionally: Gleider Hernández, who helped draft the NATO expert manual on cyber espionage, said he personally believes "...countermeasures must...be proportionate and may not be retaliatory...it is generally understood that countermeasures cannot themselves be forcible acts."
- Or militarily — and this is key: Ret. Maj. Gen. Dunlap agreed that responses must be proportional but said countries can lawfully employ traditional military attacks (those outside of the cyber realm) to take a stand.