Canada, NATO attempt to define boundaries of response to cyberattacks

Military planners in both Ottawa and Brussels are wrestling with the notion that keystrokes are as much of a threat as Kalashnikovs in this summer's deployment of the Canadian-led NATO battle group to Latvia.

NATO has placed cyberattacks on the same level as conventional warfare, but has not defined the circumstances

Canadian and NATO military planners are attempting to define the rules of engagement for so-called cyber warriors deploying to Latvia this summer. Defence experts say it's important because the major Russian challenge will likely come online. (CBC)

Military planners in both Ottawa and Brussels are wrestling with the notion that keystrokes are as much of a threat as Kalashnikovs in this summer's deployment of the Canadian-led NATO battle group to Latvia.

They are weighing how to respond to a significant cyberattack on the Baltic nation, one that would target civilian, rather than military infrastructure in a manner similar to the one that took down government agencies and banks in Estonia in 2007.

A few weeks ago Canada's chief of defence staff pledged a sizable contingent of so-called cyber warriors would be part of the deployment.

But how far they will be able to go in countering cyber and information warfare threats coming from Russia is still a matter of debate.​

"To the best of my knowledge, our [rules of engagement] are still under development, certainly from a cyber perspective," said Brig.-Gen. Paul Rutherford, commander of the military's Joint Forces Cyber Component. "I must leave it there."

But he underlined there is no intention on the part of NATO or Canada to conduct offensive online operations against hackers, state-sponsored or otherwise.

And there will be clear rules before the 450 Canadian troops depart, Rutherford said.

"It will be a strong, defensive cyber posture," he told CBC News in a recent interview. "We will work closely with our allies, with our battle group partners, and to include the Latvians."

Getting the rules just right is crucial from both a military and political perspective, say defence experts.

Two years ago, NATO placed massive cyberattacks on member nations on the same level as those conducted with bullets and ballistic missiles. The notion was reinforced at last summer's summit among the alliance's 28 leaders in Warsaw, Poland.

"NATO is ready for the Allies to invoke collective defence in response to a significant cyberattack, the equivalent of an armed attack through cyberspace," officials said at the time.

Troops from Canada's 3rd Division, composed with a platoon of 3rd Battalion and Princess Patricia's Light Infantry, participate at a NATO-led exercise. NATO considers cyberattacks on the same level as conventional ones. (Kacper Pempel/Reuters)

But defining specifically what the threshold is for a "significant cyberattack," when it triggers the alliance's self-defence clause — known as Article 5 — and when response moves from the online to the real world is a matter of debate.

The deliberation is made more important by the fact that the West is already engaged in an undeclared cyberwar with Russian hackers on a daily basis and the most likely form of attack Canadians will face in Latvia will come from the internet, said Anthony Seaboyer, the director of the Centre for Security, Armed Forces and Society at the Royal Military College in Kingston, Ont.

Having a precisely calibrated response is also important because one of the main reasons for the NATO deployment to Latvia and the other Baltic States is to act as deterrence.

Failure to respond to a massive online assault on civilian infrastructure — such the banking system or the power grid — could undermine the alliance's credibility.

Plausible deniability

But Seaboyer said there's good reason for the hesitation on the part of Canadian and NATO officials.

Hackers can launch cyberattacks off laptops anywhere in the world, cover their tracks and create a haze of deniability — something the Russians did masterfully during the annexation of Crimea.

"You can find the IP address, but how do you prove who was operating the computer at the time?" Seaboyer said. "How do you prove who paid the person who was behind the attack? They don't leave their CVs, or a card, for you to know who has hacked."

That makes the decisions by troops on the ground at NATO headquarters more complicated.

"There are huge problems," he said. "You can't just retaliate by sending a Hellfire missile, or drone strike. You just can't retaliate that way. We don't have a cyber army to send anywhere. And I don't know what a cyber army would look like other than hackers. It's a completely different space."

In this Jan. 31, 2010 file photo, an unmanned U.S. Predator drone flies over the Kandahar Air Field. A defence expert says proving who conducted a cyberattack is not easy and would not mean automatic retaliation in a drone strike. (Kirsty Wigglesworth/The Associated Press)

The rules and the systems NATO has set up over the decades "in many cases don't fit to the cyber domain" because nations can't strengthen their border or buy and aircraft carrier, Seaboyer added.

"The hammer we've had in hand doesn't fit here," he said.

NATO's cyber strategy places a lot of emphasis on member countries taking responsibility for defence of their own national computer networks, but NATO defence officials say the alliance is still struggling with how to engage each country.

Canadian cyber technicians deployed with the battle group will naturally guard against intrusions into the military networks, but what they can do for the people they are to protect remains foggy at best.

"If the rules of engagement allow us to be good coalition partners in cyber defence, then we will be so," said Rutherford.

About the Author

Murray Brewster

Defence and security

Murray Brewster is senior defence writer for CBC News, based in Ottawa. He has covered the Canadian military and foreign policy from Parliament Hill for over a decade. Among other assignments, he spent a total of 15 months on the ground covering the Afghan war for The Canadian Press. Prior to that, he covered defence issues and politics for CP in Nova Scotia for 11 years and was bureau chief for Standard Broadcast News in Ottawa.


To encourage thoughtful and respectful conversations, first and last names will appear with each submission to CBC/Radio-Canada's online communities (except in children and youth-oriented communities). Pseudonyms will no longer be permitted.

By submitting a comment, you accept that CBC has the right to reproduce and publish that comment in whole or in part, in any manner CBC chooses. Please note that CBC does not endorse the opinions expressed in comments. Comments on this story are moderated according to our Submission Guidelines. Comments are welcome while open. We reserve the right to close comments at any time.