NATO’s Article 5, the foundation of the alliance’s collective defence principle, mandates that an armed attack against one ally constitutes an attack against all and requires each ally to assist the attacked member with whatever action it deems necessary. However, at the time of its creation, an “armed attack” was comparatively easier to identify, as fewer diverse and rapidly evolving digital threats faced the alliance.
The September 11, 2001 terrorist attacks on the United States remain NATO’s only invocation of Article 5 and provide its clearest precedent for the application of the collective defence clause. 9/11 fit into a traditional scope and understanding of terrorism: a politically motivated act of violence that utilizes terror to achieve ideological objectives. Today, however, cyberspace and emerging technologies are actively challenging this definition, raising a related question for NATO: can cyber operations that do not involve conventional violence constitute an “armed attack” under Article 5?
The answer is yes, in theory. NATO has acknowledged the technological shift, first affirming at the 2014 Wales Summit that a cyberattack could indeed reach the threshold for invoking Article 5. This recognition marked an important step in adapting the collective defence clause to evolving technological risks. However, more than a decade later, there remains significant ambiguity over what degree of cyberattack would trigger Article 5. As cyber campaigns become increasingly sophisticated, NATO needs to redefine where the threshold for collective defence should lie.
“Armed attack” is the pillar of Article 5. NATO assesses whether this threshold has been reached on a case-by-case basis. Analyzing cyber operations, some scholars have proposed classification systems based on the gravity of damage, such as injury, destruction, or death they inflict. However, such an approach risks overlooking cascading effects that can arise from cyber campaigns that don’t cause immediate destruction. For example, a cyber operation that shuts down a hospital can directly contribute to injury or loss of life, thereby presenting a case for being deemed an “armed attack.” By contrast, a cyberattack against a major port may cause instantaneous economic disruption but may not inflict physical harm in the foreseeable future. Nevertheless, prolonged disruption to the import of essential goods can produce secondary effects that threaten public safety and human life. Shortages of food, medications or agricultural supplies can create public health risks, limit access to life-saving treatments or threaten food security. Canada, along with other allies, is already experiencing increasing cyber threats against critical infrastructure. The increase and ambiguity of an “armed attack” raises an important question about whether the severity of a cyberattack should be measured solely by its immediate physical effects, or if the alliance should also assess expected future consequences.
Previous cyberattacks on NATO provide useful insights into developing a framework to assess when digital threats reach the threshold of an armed attack. In 2017, WannaCry released ransomware that affected healthcare providers across the United Kingdom, including at least 80 NHS organizations. The disruption prompted the cancellation of more than 19,000 appointments and forced five hospitals to divert patients to alternative emergency departments. Although the malware did not destroy hospital facilities, it disrupted delivery of essential healthcare services. The diversion of emergency patients, for example, created delays for individuals receiving medical care.
It is important to note that Article 5 does not require allied countries to go to war or even provide military support; ally responses can vary in intensity and scope. In the WannaCry scenario, the malware was ultimately contained after a cybersecurity researcher discovered and activated a kill switch. Nevertheless, the invocation of Article 5 can, for example, facilitate greater information sharing and cyber defence efforts, benefitting future collective responses to similar threats. Further, the WannaCry incident demonstrated the difficulty of assessing cyberattacks solely according to their immediate physical effects. If a cyber operation can disrupt emergency healthcare services on a large scale, should this be relevant to NATO during an Article 5 analysis? More broadly, WannaCry highlights the importance of resilience and suggests that NATO countries must continue to advance their preparedness and response to withstand and prevent cyberattacks from disrupting critical national infrastructure.
The importance of resilience gains even greater significance in the context of prolonged and targeted cyberattacks with cascading effects across multiple countries. The Viasat cyberattack, for instance, occurred on February 24, 2022, hours before Russia’s full-scale invasion of Ukraine. The malware disrupted satellite communications in Ukraine, with effects extending beyond the original target. The operation disrupted internet access for tens of thousands of people across Europe and disabled remote monitoring and control of over 5,000 wind turbines in Germany. While not catastrophic, these consequences reached the European Union, disrupting the electricity grid and telecommunications services. This incident illustrates the dangers of determining the consequences of a cyber operation by its immediate target, and reaffirms the need to reexamine whether NATO’s current resilience measures could reasonably withstand the potential reach of contemporary cyberattacks.
NATO should develop a shared assessment framework that considers the non-kinetic effects of a cyber campaign. The new framework should consider the criticality of targeted systems, the level of disruption, the cumulative scope, the duration, and the intensity of a cyberattack. In assessing the cumulative scope, NATO should anticipate secondary consequences. In the Viasat cyberattack, utilizing this framework could have allowed NATO to identify the likely spread of the malicious code, before communications were disrupted in Europe.
For this framework to be effective, Canada and NATO must establish clear criteria for identifying critical infrastructure. This criteria should remain in the spirit of NATO’s nuanced, case-by-case analysis and should not establish an automatic trigger for Article 5. Under this proposed framework, for example, Russia’s evolving hybrid war would present a strong case for invoking Article 5. Russia continues to disrupt NATO countries through hybrid attacks, including drone incursions into allied airspace, such as those laden with explosives found near an airport in Leipzig, Germany. Additional incidents include the cutting of undersea wires and the December 2025 campaign against Poland’s energy infrastructure. These acts, assessed individually, may fall below the threshold for collective defence. However, taken cumulatively, they continue to threaten the security of NATO allies. Furthermore, utilizing the proposed framework would reveal that several of these attacks jeopardize critical systems and will likely induce secondary effects that could disrupt essential services, critical infrastructure, and affect large geographic areas.
As cyberspace continues to evolve, NATO’s understanding of an armed attack must adapt to recognize non-traditional and consequential effects of emerging threats. WannaCry, Viasat, and the evolving Russian hybrid war demonstrate how cyber operations can disrupt essential services and produce broader effects beyond their initial targets. Rather than establishing a rigid Article 5 threshold, NATO should develop shared criteria that take into account sub-kinetic and cascading effects. The challenge for NATO is not eliminating ambiguity, but ensuring that it does not become an obstacle to collective defence.
Photo: NATO Ministers of Defense and of Foreign Affairs meet at NATO headquarters in Brussels, by U.S. Air Force via Wikimedia Commons. Public Domain.
Disclaimer: Any views or opinions expressed in articles are solely those of the authors and do not necessarily represent the views of the NATO Association of Canada.
