US call for Nato cyber-strike capacity causes division

The Pentagon's push for a Nato "active cyberdefence" is the most divisive issue so far, EUobserver has learned.

"Active cyberdefence is a very sensitive topic. Many experts have brought it up, that in order to have defence, you need some offence as well. I would be very surprised if Nato at 28 will find consensus to include it," a diplomat from one of the Baltic states said.

Broader wording outlining cyber-attacks as a growing threat and the need for Nato to be "adaptable and flexible" in its capacity to react is a likely compromise.

Following attacks in 2008 on its "classified military network" the Pentagon established a new cyber-command, making "active cyberdefence" one of its policy pillars, US deputy secretary of defence William J. Lynn said on 15 September in Brussels at an event hosted by the Security and Defence Agenda think-tank.

The US cyber-command goes beyond the passive "Maginot Line" mentality of the past, he explained. Passive defence systems are sufficient to meet 80 percent of attacks. But the other 20 percent need active systems, such as sensors that operate at network speed to detect and block intrusions.

At the heart of the Pentagon's new cyber policy lies the recognition that military networks cannot be safe unless other critical infrastructures, such as power grids and financial networks, are protected. The US is itself suspected of having created Stuxnet, a computer worm that cane be introduced via USB sticks into industrial plants and used to sabotage operations, including in nuclear facilities. Over 60 percent of reported Stuxnet cases are in Iran.

Against this background, Mr Lynn in September called for "collective defence" - the core principle of the alliance - to be applied to computer networks. "The Cold War concepts of shared warning apply in the 21st century to cyber security. Just as our air defences, our missile defences have been linked so too do our cyber defences need to be linked as well," he said.

European allies are keen to protect themselves against Estonia-type cyber strikes (which saw bank and government websites paralysed in 2007). But they are showing little appetite for US-model "pre-emptive cyber-strikes" on hostile countries or organisations.

A group of experts chaired by former US secretary of state Madeleine Albright tasked by Mr Rasmussen to do a report on the new Nato strategy was cautious on the subject.

"Over time, Nato should plan to mount a fully adequate array of cyber defence capabilities, including passive and active elements," the report, published in May, said. It underlined the need for Nato to co-operate better with the EU, as this could be "helpful in addressing unconventional threats such as terrorism, cyber-attacks, and energy vulnerabilities."

In a bolder move the report suggested giving Mr Rasmussen or Nato generals "pre-delegated authority" to respond in emergencies "such as a missile or cyber attack." But the idea is unlikely to fly, diplomatic sources said.

French nukes

Another contentious area is that of common nuclear planning - balancing the Washington-led drive for nuclear disarmament while keeping nuclear warheads in Europe as a "deterrent" to hostile countries.

France, which re-joined Nato's military structures in 2009 after staying out for over 40 years, is legally bound by its constitution have exclusive sovereign power over its nuclear arsenal. It has opted out of a Rasmussen-chaired "nuclear planning group" in the alliance which is looking at drawing down Nato's reliance on atomic weapons.

"Anything on nuclear policy will have to be agreed with France. There is no consensus over this at the moment," one Nato source told this website.

Nato-Russia relations, normally a hot topic between the alliance's older and newer members, have meanwhile slipped into the background of the Strategic Concept discussions.

Nato froze relations with Moscow for half a year after the Georgia war in 2008 only to restart them again, even though Russian troops are still stationed in Georgia's separatist regions in violation of a ceasefire agreement. Tbilisi has filed for Nato membership, but the prospect, although confirmed at a Nato summit in 2008, remains distant.

"There is a sense that nothing will move in the foreseeable future on Georgia," the Nato source said.