NATO: “Case By Case” Decisions On Whether Cyber and Space Attacks Could Trigger Article 5

In a joint communique issued following the North Atlantic Treaty Organization’s 31st summit in Brussels, the leaders of NATO’s 30 member states stated that cyberattacks on any member, as well as attacks on member space capabilities or attacks from space, could lead to an invocation of Article 5, the alliance’s mutual self-defense clause.

During the one day summit, member state leaders endorsed NATO’s Comprehensive Cyber Defence Policy, with the communique stating that “significant malicious cumulative cyber activities might, in certain circumstances, be considered as amounting to an armed attack”. A decision on whether such an attack would result in the invocation of Article 5 will then be made by the North Atlantic Council, with each attack to be evaluated on a case-by-case basis. The communique continues that NATO will impose costs “on those who harm us”, saying that “our response need not be restricted to the cyber domain”.

In simple terms Article 5 states that each individual member state will respond against an armed attack against one NATO member state to be an armed attack against them all. The new communique appears to expand the definition of an attack against alliance members.

The Greensboro, North Carolina gas tank farm of the Colonial Pipeline. A ransomware attack attributed to Eastern European cybercriminals caused the pipeline to shut down for five days in May, causing petrol shortages and panic buying along the East Coast route of the pipeline. (Colonial Pipeline Company)

Describing secure access to space services, products, and capabilities as “essential” to NATO activities, the communique also says that “attacks to, from, or within space” pose a clear challenge to NATO security. The possible impacts of such attacks are said to be “as harmful to modern societies as a conventional attack” and hence to national and Euro-Atlantic prosperity, security, and stability, warranting a possible invocation of Article 5. Like with cyberattacks, the North Atlantic Council is to decide on a case-by-case basis on whether any such attack would result in the invocation of mutual self defense.

The joint communique reiterated NATO’s willingness to invoke Article 5 in the event of hybrid warfare against a member state as well. Should Council approval be given, NATO allies are to provide assistance to any member state “at any stage” of a hybrid campaign targeting it, potentially including the deployment of a Counter Hybrid Support Team.

Additionally, the communique stressed NATO’s commitment to acting in accordance with international law in cyber and in space, saying that NATO would support international efforts to promote responsible behavior in both domains alongside developing its collective capabilities.