Cyberattack could trigger Article 5 – NATO

A large-scale state-sponsored attack on a NATO member could trigger the bloc’s Article 5 collective defense clause and result in a military response, the chair of NATO’s military committee, Admiral Rob Bauer, said on Saturday.

Bauer made the remarks at the Shangri-La Dialogue, an annual security conference organized by the International Institute for Strategic Studies (IISS) in Singapore. Speaking about cybersecurity threats, the admiral reaffirmed the bloc’s readiness to respond militarily – even to a viral attack.

“In NATO, we have agreed amongst all allies that, in principle, a cyberattack can be the start of an Article 5 procedure. So it’s not only a physical attack, but also a cyberattack can be the basis of an Article 5 debate and of course result in the follow-on procedures,” Bauer stated.

A collective response to a cyberattack, however, could be subject to various uncertainties, he admitted. Unlike in the case of a “physical” attack, it could be hard to determine who exactly was behind it or whether a state-level actor was involved.

You have to attribute the attack to someone, I mean, if you don’t know who attacked you, it’s very difficult to declare war to – who?

A potential cyberattack, even if proven to be state sponsored, would also have to be disruptive enough to justify a military response, Bauer suggested.

“You have to look at how disruptive is it, for a society, because this is an attack on our information space, so to say. If it means that essential critical services to our societies are endangered in such a way that societies are unable to function, then you come close to the point when you will act upon it in a way that is close to acting on a physical attack,” he explained.

The US-led bloc has long warned that a “serious cyberattack” by “malicious actors” could result in triggering Article 5. The exact conditions for triggering the collective defense clause through a digital strike, however, remain blurry and have never been clarified in detail. The collective defense clause has been invoked by the bloc only once, in the aftermath of the 9/11 attacks on the US.