Fighting hacking with bombs: Future cyberattacks could be met with military action

As tensions rise following another global cybercrime outbreak, blamed on a sophisticated strain of malware dubbed "Petya", government and military officials from Nato and the UK have warned that a stronger military response to such attacks may soon be on the cards.

In a press conference on 28 June, Nato secretary general Jens Stoltenberg said cyberattacks against members of his alliance will be considered a military issue – meaning they will be judged on the same level as the more traditional warfare domains of land, sea, air, space and information.

Stoltenberg spoke roughly 24 hours after the Petya malware ripped through computer systems in Ukraine before spreading to more than 60 countries.

He claimed future incidents of this nature may trigger Nato's Article 5, which states that an attack on one ally member is viewed as a collective attack on all.

Last month, a similar outbreak occurred, blamed on a ransomware known as "WannaCry" which infected more than 200,000 computers in 150 countries. Stoltenberg claimed the cyber assaults underline "the importance of strengthening our cyber defences."

He said: "We are implementing our cyber defense pledge which is ensuring that we are strengthening the cyber defences of both Nato networks but also helping Nato allies.

"We share best practices and technology and we also work more and more closely with all allies looking into how we can integrate their capabilities, strengthening Nato's capability to defend our networks. We have also decided that a cyberattack can trigger Article 5."

Days prior to the Petya crisis, UK government networks were in a state of lockdown after a "sustained and determined" cyberattack targeted parliamentary email accounts. An investigation found MP's credentials, stolen from social media firms, were also being traded online.

Military action?

This week (27 June), UK defence secretary Sir Michael Fallon warned a strike on UK systems "could invite a response from any domain - air, land, sea or cyberspace".

But with attribution a murky business, it remains unclear how the security services would even know who to retaliate against.

According to The Mirror, Fallon, addressing a Chatham House foreign affairs think tank stated: "We're building up a new 21st Century Cyber Corps [...] who are going to advise us on how to keep ahead in the cyberspace race."

He echoed the view that Nato's Article 5 could be used following a major cyberattack, but did note that responses would have to be "differentiated" based on if the targeted country was hit by criminals hackers, terrorists, digital activists or nation state governments.

He said: "Clearly there has to be a point at which they cross a certain threshold, endangering the state itself, the daily existence of its people and that is why we have pressed for Nato to be clear that a cyberattack can be just as threatening as any other kind of physical attack."

It appears, based on Stoltenberg's own comments, the message got through.

The BBC reported Fallon said that, after being identified culprits should then be found and detained, but added the UK security services are building "full spectrum capabilities" which seemingly included online-based combat, often referred to as 'hacking back'.

"We are making sure that offensive cyber is an integral part of our arsenal," he asserted.

"We now have the skills to expose cybercriminals, to hunt them down and to prosecute them. To respond in kind to any assault at a time of our choosing."

It's not unprecedented. In 2015, British-born Junaid Hussain, was killed in a US air strike after being linked to a series of Islamic State (Isis) cybercrimes. The Guardian reported that the 21-year-old went by the name "Trick" while working with a hacking group dubbed "Team Poison."

The British national cyber security strategy (2016-2021) talked tough on offensive capabilities held by the UK. "We detect, understand, investigate and disrupt hostile action taken against us. We have the means to take offensive action in cyberspace, should we choose to do so," it stated.