This is how prominent cyber weapons and cybersecurity have become on the world stage: State-sponsored hacking and cyber espionage may be considered an act of war. So said all 28 European Union member states last week in a saber-rattling draft document meant to warn foreign nations backing digital attacks of potential serious repercussions.
The unprecedented proclamation, which is expected to be affirmed in the next few weeks, warns that “in grave instances” cyber warfare could be met with conventional weapons. Without naming names, it looks like EU governments are wagging their fingers at Russia, wary of its alleged influence on the U.S. elections last year, and North Korea, owing to its suspected ties to the destructive WannaCry ransomware attack last May.
So far, the U.S. is noticeably absent from the EU framework but could follow its lead, wrote Stu Sjouwerman, CEO at KnowBe4, a Clearwater, Florida-based security awareness training specialist, in a blog post.
“I'm expecting the USA to follow with a similar statement, to function as an additional deterrent against the recent spate of Russian and North Korean incursions,” he said. So far, there's been no word one way or another from U.S. officials.
The EU’s move follows NATO Secretary General Jens Stoltenberg’s remarks last June positioning cyber as a legitimate military domain on par with land, air and sea, capable of triggering Article 5 in which an attack on one member is an attack on all 29.
Still, a number of uncertainties could plague the EU document. For starters, establishing culpability in cyberspace is anything but certain. Educated suspicions, of course. Evidence, perhaps. But certainty is elusive and responsibility easily denied. Absent explicit accountability, can a cyber attack be regarded as an act of war worthy of a counter attack with conventional weapons?
“I don’t think anyone would think that it would be equal to an act of war, but a cyberattack could be incredibly wide spread,” Dr. James Brown, an associate professor in political science at Temple University, Japan and an expert in Russian foreign policy, told Sputnick Radio. “It could affect the critical infrastructure of a country. It could shut down a country’s transportation, health care systems and if that was the case there could be causalities. In that case it is possible that a cyberattack could be equated to an act of war.”
The legality under international law of a military response to a cyber attack is also questionable, Dr. Brown said.
International law states that aggressive war is always unacceptable, always illegal, but a force can be used when it is … in self-defense or perhaps it’s also raised by the UN Security Council. So that would be the theory of it.” Big, powerful states, however, can simply “ignore international censure,” he said.