Five good reasons for NATO’s pragmatic approach to offensive cyberspace operations

Abstract

ABSTRACT For decades, few NATO members, predominantly the US, had the capabilities to conduct offensive cyberspace operations (OCO). Today more than half of NATO’s members have, or are acquiring, offensive cyberspace operations capabilities (OCOC). Historically, NATO’s planning and coordination is based on shared knowledge of the members’ military capabilities, to a degree even their nuclear capabilities. In the cyber domain, the principle has evolved to include allies’ emerging defensive cyber capabilities. NATO’s approach to OCOC, however, deviates radically: NATO’s doctrine merely integrates OCO’s effects, that is, allow members to contribute with OCOs in operations without sharing information with allies on what OCOCs are available or how the OCOs deliver the effects. OCOC’s technical and tactical characteristics incentivize NATO’s members to keep OCOCs secret, also from allies. This results in a dilemma: Either the allies providing OCOC’s effects risk sharing sensitive information on the means, or the allies, who depend on the provided effects, act without sufficient knowledge of the deployed OCOCs to assess their efficacy, legality, or impact on own offensive or defensive cyber operations. NATO’s limited approach to OCOC is a pragmatic mitigation of the dilemma that allows NATO to train and develop doctrine in the field further.