As Faire Sans Dire commented in its first ever news article in February 2012 cyberspace had become like the Wild West since the clocks kept ticking after midnight on 31st December 1999. Now it is not just individuals and corporates but entire countries that face risks that were unimaginable a decade or so ago.
Are risk managers of organisations involved in multinational activity taking these country risks into account? From our research even countries aren’t so the likelihood of many others doing so is negligible. For example, NATO is still languishing in a world built before 1950!
The North Atlantic Treaty was created in 1949, inter alia, to make the West feel safe. Article Five of the Treaty sets out the “one for all and all for one” terms if any NATO member is “attacked”. The trouble is that when Article Five was written there was no cyberspace as we know it now and the Treaty’s definition of an “attack” is based on Second World War thinking.
Interestingly and in hindsight somewhat surprisingly, the only time Article Five has been invoked was by the USA after 9/11. The reason it is surprising is that the “attacker” couldn’t be defined as envisaged by the Treaty.
Article Five needs rewriting because no one in NATO would know how to respond were a cyber war to break out and reaching agreement on whether or not an “attack” per Article Five had actually occurred could take weeks assuming NATO members could even communicate one with another! Indeed, not even the USA, Russia and China know for certain what real cyber warfare capabilities anyone else has so their definitions of a cyber “attack” will differ in any event.
One thing is quite likely though. Any electrically powered “equipment” including aircraft carriers, nuclear submarines, airplanes and even tanks and smaller vehicles would probably be quickly rendered redundant by both sides in any modern war. After all, to be effective they all rely on electricity one way or another (directly or otherwise) and electrical systems are vulnerable not only because they are linked to computers.
Assuming nuclear bombs weren’t dropped the outcome of any modern war involving NATO would not depend on who won any ensuing physical conflict between the armed forces of the opposing sides. All the nations embroiled would face a more immediate threat at home. They would be quickly shunted to anarchy if not the brink of civil war without any electric power or communications. Even normal supplies of food, water, petrol and medicine would run out quickly.
Every nation’s reliance on electricity has become its Achilles’ heel. This means that a “David and Goliath” situation could arise more easily than many imagine. For example, any small country or terrorist group armed with superior niche skills in cyber warfare could quickly cause devastating damage to any member of the United Nations Security Council and disrupt the world’s balance of power and economy.
Cyber warfare has barely been tested yet but it can turn the lights out more effectively than a nuclear bomb and leave the land available for occupation later. Indeed, as researchers at Rutgers University in New Jersey know only too well it will not be long before the weather can be weaponised using cyberspace.
NATO needs more cyber troops and skills, not more traditional troops and armaments.
This article was first published on 21st February 2015.
