From Stéphane Abrial, the International Herald Tribune: The decisions taken in Lisbon are only the most recent steps in a process that began with the series of cyberattacks on Estonia in the spring of 2007, which struck not only military targets but also key civilian infrastructure. The damage they caused to an ally was a wake-up call for NATO. Our cyber-dependent societies and militaries were vulnerable.
Today, a critical element of any cyberdefense strategy is the understanding that cyberspace is international by nature. No one country can deal effectively with cyberthreats on its own. …
Several valuable tools, developed over these past few years, are becoming available to NATO. Its Computer Incident Response Center will be fully operational next year, and the Cooperative Cyber-Defense Center of Excellence, formally established in 2008 in Tallinn, Estonia, is now up and running. …
The concept of “in-depth cyberdefense,” which was endorsed at the Lisbon summit, is not intended to be a military-only, or even a military-centric, strategy. It necessarily cuts across the portfolios of a variety of actors, as it spans the technology employed, the awareness of users, and the physical protection of key elements of our hardware.
As a consequence, civilian authorities in all member nations have the lead responsibility on cybersecurity. NATO is therefore working in support of whole-of-government approaches to cyberdefense — led by civilian agencies in each nation — and with actors outside government.
Key among these are commercial suppliers and the wider industrial base, since NATO-wide, 85 percent of critical infrastructure is in private hands.
In discussing a hypothetical major attack, NATO leaders are often asked what circumstances would trigger a response under Article V of the Washington treaty — in other words, when would an attack against one be considered an attack on all?
It would not be prudent to try to define exact tripwires in advance, or to tie our hands as to how we would react. But assuredly, the alliance would respond deliberately to any significant attack, adapting its reaction to the extent of the damage, the degree of certainty in attribution, the identity of the attackers and their perceived intentions.
General Stéphane Abrial of France is the commander of NATO’s Allied Command Transformation based in Norfolk, Virginia. (photo: Getty)