I see a lot of confusing around this due to the fact "cyber attack" gets used as an all-encompassing term for any kind of hacking at all (when ideally it should be reserved for intentionally destructive acts).
Basically, from most nations perspective, any kind of hacking for reconnaissance/intelligence gathering/data theft/whatever you want to call it, falls into the category of cyber-espionage, or cyber-enabled espionage. It's essentially treated similar to regular espionage (really annoying and definitely illegal, but not an act of war).
When countries talk about the possibility of invoking Article 5 in response to a cyber-attack, they don't mean cyber-espionage like stealing voter data, they mean an intentionally disruptive or destructive attack. Even something like accidentally taking offline a power grid while conducting espionage probably wouldn't meet the bar.
I think a lot of the confusion comes from people having a belief that cyber and kinetic attacks are fundamentally different, and thus responses must be in-kind. So if someone took offline your power grid with hacking instead of bombs, you can only respond with hacking instead of bombs. Not a lawyer, but as far as I'm aware this has never been a policy. Most of what I've seen is just official clarification of what's long been the case (we don't care if your attack uses hackers or bombs, you're getting clapped either way).
Nobody is actually insane enough to invoke Article 5 or any kind of kinetic response over basic cyber-espionage, because literally everyone is doing it and that would just be a direct escalation and also set the irreversible precedent of "you can bomb people for spying on you now". Which nobody wants.
Add comment