6th European Conference - Academic Conferences

Ulf Haeussler
following the invocation of Article 4 by Turkey, NATO's collective security and defence mechanisms
rely on the assessment of the Nation affected. Though NATO first and foremost provides an umbrella
enabling Allies' mutual support, it may also decide to launch operations led by the Alliance, such as
Operation Active Endeavour following the 9/11 attack. NATO's strategic policy choices regarding
cyber security and defence may in a similar manner serve as an interface for connecting national
security and defence efforts. After its adoption, Cyberstrategy 3.0 may demonstrate what the U.S.
expects as well as what it is prepared to contribute to achieve such 'greater levels of cooperation [as]
needed to stay ahead of the cyberthreat' (Lynn 2010, 105).
4. Cyberstrategy 3.0 – cyber defence as an integral part of national defence
NATO's positive acknowledgement, through its strategic policy consensus, of a nation's sovereign
right to consider cyber defence as an integral part of national security and defence, has clear legal
implications. It is this acknowledgement by which NATO has confirmed that national cyber security
and defence is eligible for support through its collective security and defence mechanisms. That said,
there are two different ways of looking at national cyberstrategy. On the one hand, a national
cyberstrategy is likely to represent the codification of national cyber security and defence concerns
ranging from a description of the situation, own and adversarial, through a survey of the broader
operating environment to the resulting assessment and conclusions. On the other hand, a national
cyberstrategy may also indicate in what situations NATO could theoretically expect to receive
requests for consultation under Article 4, or for collective self-defence under Article 5 of the North
Atlantic Treaty, as well as what capabilities might be available to support collective efforts made under
the auspices of the Alliance.
The description of the situation in cyberspace in which constitutional democracies in general and
NATO Nations in particular are likely to find themselves is comprised in the observation that: 'In less
than a generation, information technology in the military has evolved from an administrative tool for
enhancing office productivity into a national strategic asset in its own right' (id., 98).
Adversaries can easily exploit this situation by leveraging off the shelf technology which is not only
available at comparably low cost but also can be put to use by a limited number of personnel – '[a]
dozen determined computer programmers' (ibid.) – 'if they find a vulnerability to exploit' (ibid.). The
unpleasant reality is that 'today anyone with a computer can engage in some level of cyber
destruction' (Vamosi 2011, quoting the National Defense University's F.D. Kramer). In addition, the
estimates that programming the Stuxnet code may have taken about half a year also indicates that
warning periods regarding a force build-up in the cyberspace are much smaller than regarding a
conventional force build-up. However, there may not be any warning period at all if, like in the case of
Stuxnet, an adversary manages to launch a zero-day attack or leverage a zero-day exploit (Wikipedia,
Zero Day Attack).
That said, it is not surprising that '[i]n cyberspace, the offense has the upper hand', factor requiring a
flexible strategy since '[i]n an offense-dominant environment, a fortress mentality will not work' (Lynn
2010, 99). Accordingly, evolving U.S. cyber strategy is likely to put less emphasis on containment
than traditional strategy as embodied in military doctrine. According to the U.S. Deputy Secretary of
Defense, 'traditional Cold War deterrence models of assured retaliation do not apply to cyberspace,
where it is difficult and time consuming to identify an attack's perpetrator' (ibid.). This observation
does not simply shift the emphasis from containment to arms control. On the contrary, '[t]raditional
arms control regimes would likely fail to deter cyberattacks because of the challenges of attribution,
which make verification of compliance almost impossible.' (id., 100).
In essence, this means that both traditional elements of deterrence seem to be considered
unsatisfactory for the purposes of cyber deterrence. It is hence fairly unlikely that efforts made by
some States to leverage support for cyber arms control within the United Nations will yield tangible
results any time soon. Whilst cyber deterrence does not abandon the approach based on influencing
potential adversaries' mindsets (Vamosi 2011) it will most likely have to rely on different methods to
achieve this desired effect. In particular, cyber 'deterrence will necessarily be based more on denying
any benefit to attackers than on imposing costs through retaliation' (Lynn 2010, 99sq). This approach
couples elements of 'defensive resilience [within] cyber networks' (Vamosi 2011, quoting F.D. Kramer)
and active defence. To that end, it may require different models of 'international norms of behavior in
cyberspace … such as that of public health or law enforcement' (Lynn 2010, 100). Normative models
derived from international environmental law might also be instrumental. In the U.S., active defence of
103