Want to learn more about Russia’s invasion of Ukraine?
Check out my new book “What Caused the Russia-Ukraine War.”
Click on the video description below for more information.
On June 27, 2022, Lithuania announced that it was the target of a cyberattack.
Hackers, evidently based in Russia, launched a distributed denial of service attack on
the country.
This overloads the target’s systems and makes them inaccessible for legitimate
users.
In particular, the targets were Lithuania’s airports and other transportation hubs to
stall movement in the country They also hit the Lithuanian government itself,
apparently in response to a decision made a few days earlier.
The European Union had imposed a ban on Russian steel exports in retaliation for Putin’s
invasion of Ukraine four months earlier.
This presented a problem for Russia because rail transit from mainland Russia to its semi-exclave
Kaliningrad runs through Belarus and then Lithuania.
But Lithuania is a member of the European Union.
They were enforcing the ban, which meant no steel for Kaliningrad.
Immediately afterward, the European Union began negotiating with Russia to seek a solution
that would allow Russia to transport the goods into Kaliningrad,
provided that they are not exported further.
Regardless of the outcome there, the incident highlights two issues that come along with
Article 5 of the North Atlantic Treaty.
They are important because even if the sides resolve this particular situation without
further drama, they are likely to resurface at some point in the not-so-distant future.
We begin with some quick background.
The North Atlantic Treaty is the founding document of the NATO alliance,
which covers most of Western and Central Europe, and also peaks into Eastern Europe.
That includes Lithuania, which was the source of the sanctions incident.
Article 5 is the most important provision of the treaty.
It says that “an armed attack against one or more [members]
… shall be considered an attack against them all.”
In response, “each of them … will assist the Party
or Parties so attacked.”
This is known as the collective security approach to military defense.
In theory, it means that if you mess with a single NATO country,
you are actually messing with all of them.
Recognizing the calamity that would create, would-be attackers just leave NATO countries
alone.
It appears that Article 5 has been very effective.
Since the treaty was signed in 1949, Article 5 has been invoked only once:
September of 2001.
Although Article 5 is simple in theory, it is complicated in application.
Right now, the major issue is the phrase “armed attack.”
The North Atlantic Treaty was written in the aftermath of World War II.
Undoubtedly, its authors had that era of combat in mind when designing Article 5.
Computers looked like this at the time.
An “attack” on such a computer would occur like any other type of combat in that era:
via guns and bombs.
We have since moved into an era where the same computer I am using to record this video
could also be used to attack another computer on the other side of the world.
As a result, the central question for NATO for the new millenium is whether a cyber attack
constitutes an “armed attack”.
This is straightforward for the cyberattack in question in Lithuania.
It was disruptive and financially damaging but no one died.
The question is more complicated for grander cyberattacks.
What if the target is a hospital, causing it to shut down all of its operations?
That will cause people to die, and so we are venturing into realm of more traditional armed
conflict.
What about a cyberattack designed to shut down a power plant in the middle of winter?
Heaters will turn off, and now people will freeze to death.
If the point of Article 5 was to prevent a rival state from killing member states’
citizens, these examples are in line with the original intent.
This is a question that NATO has been grappling with since its 2002 Prague Summit.
It did not get much attention at the time because it was massively overshadowed by George
W. Bush announcing that “should Iraqi President Saddam Hussein choose
not to disarm, the United States will lead a coalition of the willing to disarm him.”
The relevant point from the declaration was the very simple line that “We have therefore
decided to … strengthen our capabilities against cyberattacks.”
That’s it.
By 2014, NATO had become more serious about the subject.
The declaration from the Wales summit acknowledged that
“Their impact could be as harmful to modern societies as a conventional attack.
We affirm therefore that cyber defence is part of NATO's core task of collective defence.”
But is it Article 5 worthy?
“A decision as to when a cyber attack would lead to the invocation of Article 5 would
be taken by the North Atlantic Council on a case-by-case basis.”
What does that mean?
One brigadier general within NATO cited a 2007 cyberattack on Estonia—over a World
War II era statue of all things—as an example where Article 5 would now be invoked.
And indeed it was a big deal at the time.
The “case-by-case” stipulation seem like an ambiguous standard, but it is basically
how everything works with alliances.
Like any other treaty, NATO’s founding document resides in the mushy world of international
law.
Laws are only as good as one’s ability to enforce them.
In most domestic situations, this is easy.
There are third-party court systems that provide remedies when one actor has been wronged.
In the international system, things are different.
Just imagine a bunch of UN blue helmets walking over to the Kremlin to arrest Putin.
Best case scenario, they get a stare down.
Worst case scenario, they receive an all-expenses paid trip to Siberia.
Leaders of other countries also don’t have an inherent obligation to follow through on
international agreements.
As a result, Article 5 is self-aware on this issue.
It does not dictate that there will be a swift military response if a member state is attacked
by any means, cyber or otherwise.
It just says that after someone is attacked, each country
“will assist the Party or Parties attacked by taking … action as it deems necessary,
including the use of armed force.”
Put differently, it says “do whatever you want.”
And you don’t need a treaty to be told that you can do whatever you want.
Nevertheless, there is little doubt that Article 5 would be invoked—with the proper follow
through—in the event of a conventional attack.
That is because NATO is a cooperative organization.
For example, if Bulgaria is attacked and Portugal does not cooperate afterward,
Portugal risks being frozen out if there were an attack the following year in Lisbon.
Potential opponents of Portugal realize that Portugal will be frozen out and become more
likely to attack.
Consequently, Portugal not only loses the assistance from NATO, it also invites the
attack to begin with.
What the 2014 Wales Declaration and subsequent declarations afterward do is coordinate expectations
about cyberattacks so member states know what risks them being frozen out.
But the details are still getting sorted out.
Right now, it still seems like a cyberattack is an “armed attack” if it looks, smells,
and feels like an armed attack.
The other problem is attribution.
Although victims of cyberattacks can often narrow down the attack’s country of origin,
determining who authorized the attack can be tricky.
In the Estonia case, the best theory of the origin of the attack is a Russian national
who may have been in the Moldovan separatist region of Transdniestria at the time.
But he was a member of a youth group with connections to the Kremlin,
which makes you wonder whether the order came from higher levels.
There is a similar story with the more recent Lithuania case.
A Russian hacker group named Killnet claimed responsibility.
In 2022 alone, Killnet also hit Romania, Moldova, the Czech Republic, Italy,
and Norway.
We could even add Eurovision to that list … it’s an international institution of
sorts.
Once again, with an underlying political motivation for each of these attacks, there is an obvious
question about Kremlin influence.
This, in turn, raises the question of how the targets ought to respond.
The modern state system in international relations dates back to the 1648 Peace of Westphalia,
which established the principle of sovereignty.
The signers declared that each country’s government is supposed to have a monopoly
on the use of legitimate force within their territory.
What that means is if another country has a problem with Russian hackers,
it is not that country’s job to directly attack the hackers.
Instead, a target country is supposed to go through the Russian government,
and the Russian government is responsible for bringing its own hackers in line.
That raises the question of what happens if Russia does not want to do that.
Well, the opposing countries still can always do it themselves.
After all, there is no external enforcement of sovereignty rights either.
The deeper problem this creates is with hacker groups that go rogue, engaging in attacks
unauthorized by the government or well-beyond what the government wants.
The victim states have a hard time differentiating between rogue actors and the opposing government
just being unwilling to police their own hackers.
If it is the former case, then the victim might prefer holding off and let the home
government eventually take care of it.
If it is the latter case, then the victim would want to fight back.
What this means is that a rogue actor could bait the target into attacking Russia.
Russia’s subsequent counterattack could trigger Article 5 and create a giant mess
for everyone.
Speaking of potential catalysts for World War 3, I have a new book on what caused the
conflict between Russia and Ukraine.
It’s a deep dive on the war, building a coherent narrative of the war in a way that
a single video cannot do.
Check the video description below to see how to get a copy.
And if you enjoyed this video, please like, share, and subscribe, and I will see you next
time.
Take care.