EU governments to declare that cyber attacks are an ‘act of war’
EUROPEAN Union governments will formally state that cyber attacks can be an act of war in a warning to countries such as Russia and North Korea.
Diplomats and ambassadors in Brussels have drafted a document, obtained by The Daily Telegraph, that represents an unprecedented deterrent aimed at countries using hackers and cyber espionage against EU members.
The British-backed document, set to be agreed by all 28 EU members states in the coming weeks, warns that individual member states could respond “in grave instances” to cyber attacks with conventional weapons. The Government said last week it was all but certain that North Korea was behind the “Wannacry” malware attack that hit NHS IT systems in May.
The EU paper was precipitated by fears that Russia would attempt to influence this year’s German elections and over “hybrid warfare” employed in Ukraine. The Framework on a Joint EU Diplomatic Response to Malicious Cyber Activities states that a country under attack can exercise its “inherent right of individual or collective self-defence” under international law. “The EU is concerned by the increased ability and
‘This will make an attacker weigh the consequences of a cyber attack more carefully’
willingness of state and non-state actors to pursue their objectives by undertaking malicious cyber activities,” the paper reads.
In a clear signal of governments’ desire to send a strong message, the document explicitly states that a member state can invoke the EU’S mutual defence clause. Article 42 (7) of the EU Treaty allows a member state to demand “aid and assistance” from its fellow EU governments. “If a member state is the victim of armed aggression on its territory,” the article states, “the other member states shall have towards it an obligation of aid and assistance by all the means in their power”.
The mutual defence clause was invoked for the first and only time by France after the Paris terror attacks in 2015. EU defence ministers agreed unanimously to provide France with military assistance.
“This will make an attacker weigh the consequences of a cyber attack more carefully,” said one EU source, “and setting out the steps in a formal document shows we are serious.”
The EU move comes after Nato said an Article 5 response was possible if a cyber attack met the international legal definition of an act of war. Article 5 obliges Nato countries to treat an attack on one member as an attack on all members. Most, but not all EU member states, are members of Nato.