Experts: NATO Policy Lags Behind Nations in Cyber Defence

NATO cyber defence policy lags behind member states’ policies and capabilities, a new policy brief published by the NATO Cooperative Cyber Defence Centre of Excellence reveals.  Experts at the Tallinn-based think tank emphasise that the Alliance needs to clearly recognise that network defence does not equal collective defence in cyberspace and develop the full range of military capabilities to defend the Alliance and its interests.

Is NATO Ready to Cross the Rubicon on Cyber Defence? by Matthijs Veenendaal, Kadri Kaska and Pascal Brangetto, published today, looks at NATO and national military cyber defence policies beyond the Warsaw Summit and lays tracks for the future. It offers insight into how Allies could best deploy cyber capabilities in cooperative defence that goes beyond the current NATO policy on cyber defence. Full text of the cyber policy brief can be found at: https://ccdcoe.org/sites/default/files/multimedia/pdf/NATO%20CCD%20COE%20policy%20paper.pdf.

“NATO will need to bridge the gap between the national cyber operations strategies of various Allies and its own policy on cyber defence. Recognising cyberspace as a domain of warfare would be an important step in the right direction. This will impel the Allies to define not only terms and definitions but also to establish common ambitions, procedures, and doctrine,” highlights this cyber policy brief.

Cyber defence is expected to take centre stage at the Warsaw Summit in July where cyberspace will be declared an operational domain along space, air, sea and land. The Wales Summit of 2014 reconfirmed the Alliance’s commitment to cyber defence and the applicability of collective defence to cyber space, including the possibility of an Article 5 response to cyber incidents the effects of which are comparable to an armed attack.

“Given modern armed forces’ dependency on digital technology, it is legitimate to expect that NATO would adapt to this new reality. Since 2002, NATO has invested significantly in improving the defence of its networks. However, NATO has shown little inclination to move away from its current purely defensive posture in cyber defence,” the policy brief reads. “In order to achieve a more mature and realistic cyber defence posture, the Alliance must address two important issues. Firstly, it must clearly recognise that network defence does not equal collective defence in cyberspace. Secondly, given that NATO accepts the applicability of collective defence in cyberspace, Allies should develop the full range of military capabilities to defend the Alliance and its interests.”

The authors recommend that NATO, in addition to recognising cyberspace as a domain for military operations, develop doctrine and procedures to allow for the use of cyber capabilities as operational military capabilities. Furthermore, the Alliance has to distinguish the policy mandate applicable to network defence in peacetime from the policy mandate applicable for cyber operations in military operations and collective defence. This would prompt the development of a new policy that will enable the Alliance to ensure that it has the full range of capabilities necessary to deter and defend against any threat in and through cyberspace.

The Tallinn-based NATO Cooperative Cyber Defence Centre of Excellence is a NATO-accredited knowledge hub, think-tank and training facility. The international military organization focuses on interdisciplinary applied research and development, as well as consultations, trainings and exercises in the field of cyber security. The heart of the Centre is a diverse group of international experts, including legal scholars, policy and strategy experts as well as technology researchers with military, government and industry backgrounds.

Membership of the Centre is open to all Allies. Currently, the Czech Republic, Estonia, France, Germany, Greece, Hungary, Italy, Latvia, Lithuania, the Netherlands, Poland, Slovakia, Spain, Turkey, the United Kingdom and the United States have signed on as Sponsoring Nations of the Centre. Austria and Finland have become Contributing Participants – the status available for non-NATO nations.

The Centre is staffed and financed by its sponsoring nations and contributing participants. The Centre is not part of NATO command or force structure, nor is it funded from the NATO budget. Many of the Centre’s publications, as well as a number of interactive databases, are accessible through www.ccdcoe.org.