NATO Responsiveness to the Russian Cyber-Mедведь

Richard Self

Vol. 38 Contributing Editor

In mid-January, the U.S. military deployed the 3rd Armored Brigade Combat Team, 4th Infantry Division to Poland.[1] The deployment is the largest United States military deployment since the end of the Cold War and is intended to deter Russian aggression in Eastern Europe.[2] Poland has been a signatory to the North Atlantic Treaty (establishing the North Atlantic Treaty Organization, or “NATO”) since 1999, when it joined the organization during NATO’s first major post-Cold War expansion.[3] The core provision of the North Atlantic Treaty states that if one party is subject to an armed attack, that attack shall be considered an attack against all parties.[4] This triggers the right to collective self-defense provided in Article 51 of the United Nations (UN) Charter,[5] which would allow all NATO parties to use armed force against the initial attacker “in order to restore and maintain the security of the North Atlantic area.”[6] The critical question in today’s evolving combat environment is how to define an “armed attack” that would trigger the right to collective self-defense. When NATO was first created in 1949, the concept of an armed attack was fairly straightforward given the technological limitations of the era. However, the recent proliferation of cyber warfare has muddled the legal analysis for what would qualify as an armed attack. This is particularly important to NATO’s goal of deterring Russian aggression, as Russia has been accused more and more often of engaging in cyber operations against NATO signatories.[7] The U.S. Department of Defense (DOD) Law of War Manual gives some early guidance on this question. It states that a cyber operation may qualify as a use of force if it causes “effects that, if caused by traditional physical means, would be regarded as a use of force under jus ad bellum.”[8] The manual then gives several examples that may qualify, and these examples can be sorted into two categories. The first is cyber operations that would cause bodily harm and/or death to civilian populations on a significant scale: operations that would “(1) trigger a nuclear plant meltdown; (2) open a dam above a populated area, causing destruction; or (3) disable air traffic control services, resulting in airplane crashes.”[9] The second category involves military targets, such as a cyber operation that “cripples a military’s logistics systems, and thus, its ability to conduct and sustain military operations.”[10] The manual also takes the position that the response in self-defense may consist of forms other than a cyber action, including conventional armed warfare.[11] However, the response must still meet the international law requirements of necessity and proportionality.[12] If the DOD manual is controlling, any Russian cyber operation that has an immediate physical manifestation of harm to a civilian or military target of a NATO country would trigger the right to collective self-defense, including use of conventional military force against Russia. Though it may be less taxing on the user to engage in warfare sitting behind a computer screen, aggressors towards NATO should be on notice that these actions, including actions targeting Poland, will carry the same consequences as a conventional attack.

[1] Laura Smith-Spark & Atika Shubert, Poland welcomes thousands of US troops in NATO show of force, CNN (Jan. 14, 2017, 5:38 PM), http://www.cnn.com/2017/01/14/europe/poland-us-troops-nato-welcome/. [2] Soraya S. Nelson, U.S. Troops Arrive In Poland, But Will Trump Keep Them There?, NPR (Jan. 12, 2017, 5:18 PM), http://www.npr.org/sections/parallels/2017/01/12/509520482/u-s-troops-arrive-in-poland-but-will-trump-keep-them-there. [3] Member countries, North Atlantic Treaty Organization (Mar. 10, 2016), http://www.nato.int/cps/en/natohq/topics_52044.htm. [4] North Atlantic Treaty, art. 5, Apr. 4. 1949, 63 Stat. 2241, 34 U.N.T.S. 243. [5] U.N. Charter art. 51. [6] North Atlantic Treaty, supra note 4. [7] See, e.g., Robert Windrem, Timeline: Ten Years of Russian Cyber Attacks on Other Nations, NBC News (Dec. 18, 2016, 3:53 AM), http://www.nbcnews.com/news/us-news/timeline-ten-years-russian-cyber-attacks-other-nations-n697111. [8] U.S. Department of Defense, Law of War Manual ¶ 16.3.1 (2016) (hereinafter DOD MANUAL). Regarding the terminology “use of force” rather than “armed attack”, the United States takes the position that the two terms are synonymous when analyzing when the right to self-defense attaches. Other countries are more likely to treat the two phrases separately, as a “use of force” may not always reach the level of an “armed attack”. Id. at ¶ 1.11.5.2. [9] Id. at 16.3.1. [10] Id. [11] Id. at 16.3.3.2. [12] Id.