NATO funding Article 5 cyber response ‘against Russia’

But “NATO still has a long way to go in terms of operationalizing that domain. We need to clear the first hurdles” by aligning old policies with modern capabilities, Erki Kodar, the undersecretary for legal and administrative affairs for the Estonian Ministry of Defense, told the annual meeting of NATO’s Communication and Information agency, NCI.

“We saw a lot of activity during Zapad 17,” said Rose Gottemoeller, the alliance’s Deputy General Secretary, referring to military exercise Russia had concluded in Belarus. She was speculating about reports of “Russian cyber attacks” targeting NATO members Norway and Latvia.

Without the alleged “Russian aggression”, the alliance would have a hard time selling an integrated cyber response.

NATO’s best information warrior is Britain’s GCHQ. The British have teamed with private cyber defense companies to look into such alleged attacks. GCHQ, known as the world’s top signals intelligence agency, has also offered its unconditional support to all alliance members to “help” them build stronger network defenses against Russia.

Paul Chichester, director of operations at GCHQ’s National Cyber Security Center, or NCSC, said the UK has been busy designing such anti-Russian systems. “A big part of what we do is help people design and build systems securely. Everything we do is founded on that intelligence knowledge so we have some assurance that the advice that we’re giving is based on real, hard facts about what the adversary is trying to do.”

GCHQ has implemented an email authentication protocol for NATO members, called the Domain-based Message Authentication, Reporting & Conformance, or DMARC. “One of the reasons we signed the [2016] NATO Cyber Defense Pledge was to share with NATO colleagues a lot of the details of what we do,” he said.

Chichester cited the 2015 attack on France’s TV5Monde, which for several hours displaced its programming with ISIS videos. “How would the UK handle a TV5 incident? How would we respond to that?” he wondered.

Even NATO’s smaller members have contributed. Ukrainians say if you emit, you die, a lesson learned learn from places like Donetsk.

“We might send them fake SMSs to see if they will emit certain radio signals to reveal their positions,” said one participant. “We usually only do it during their final exercise before graduating, when they are training with their brigade and their battalions, to see if someone one gives away their location in the forest. It’s the reality of what will happen, anyway. If you talk to the Ukrainians, they will say that, if you emit, you die. It’s what you learn from places like Donetsk.”

The NATO arrangement is currently with tech giant tMicrosoft. “NATO has access to all of our threats,” said Ann Johnson, vice president of Microsoft’s Enterprise Security Group. “We have an early warning system that we’ve established where we share threats from an early basis.”

But US technology companies in search of revenue growth, badly want to work with China and Russia, and that includes Microsoft. To have an intelligence-sharing partnership with a military alliance could give cyber security professionals an edge, they say. “We need a real tech refresh,” said Ian West, NCI’s chief of cybersecurity.

NATO is clearly ready to spend big on new hacking tools euphemistically called “capabilities” such as the 70-million-euro CP120 [CP stands for “capability package]. By 2024, NATO hopes to fund everything from encryption for tactical radios to cloud-integrated storage for cyber events, moving to the public cloud to allow “centralized patch management” thanks to Microsoft.

“We in NATO have incredible cyber capability. But we in NATO do not have an incredible cyber policy,” former NATO commander Philip Breedlove noted in May. “In fact, our policy is quite limiting. It really does not allow us to consider offensive operatives as an alliance in cyber.”

Gottmoeller called Breedlove “instrumental” in leading alliance to an integrated cyber command. “I agree with his critique,” she said, adding that the cyber pledge and the 2016 decision to allow collective response to information attacks under the NATO Charter’s Article 5 have “focused the mind of the alliance over all on what we need to do to make a more coherent approach to this set of problems.”

But currently NATO has no stated cyber offensive policy or strategy, and no member, including the US, has any idea what an Article 5 response in cyber would eventually look like. However, Gottmoeller said the absence of a stated response was an advantage: “You can never define a particular Article 5 response…That’s part of the strength of the alliance.”