As cyber attacks become more sophisticated and destructive, some global organisations are beginning to tackle this form of warfare head-on, realising it is a bigger and more serious threat than perhaps previously expected.

While cyber warfare had become a popular buzz word in recent years, it seems the world is finally starting to treat cyber attacks as a tangible threat that could endanger the lives of civilians – just like real physical warfare.

NATO recently issued the 215-page Tallinn Manual on the International Law Applicable to Cyber Warfare, which applies existing international law for warfare, part of which was established at the 1949 Geneva Convention, to digital and cyber attacks.

The manual lays out cyber warfare rules that have declared government attacks on “civilians, hospitals, nuclear power plants, dams and dykes” as acts of war if the intent is to cause injury, death, damage, and destruction. In other words, state-sponsored attacks on critical civilian infrastructure is not on.

Currently, NATO is the fi rst to set up rules for responding to cyber attacks by a state. The organisation cautions “that online attacks could lead to full-blown military confl icts”. The foundation of the NATO document is that war doesn’t stop being war simply because it occurs online.

The manual, compiled by 20 legal experts, over a period of three years, is expected to shape cyber warfare policies among Western nations, spelling out when and how nations can legally conduct online aggression against one another. It also outlines guidelines for neutral states to remain neutral even in online attacks. Thus, a cyber attack cannot be launched using an IP address originating in a neutral state, just as traditional military operations cannot be launched from a neutral territory.

The Cooperative Cyber Defence Centre of Excellence, which edited and published the manual, notes that it “is not an official document, but instead an expression of opinions of a group of independent experts, acting solely in their personal capacity”. At this stage, the document does not reflect official NATO doctrine, but it is certainly a large step in the right direction.

* Don’t miss the ITWeb Security Summit 2013, taking place from 7-9 May, at the Sandton Convention Centre.

Happy reading!

Martin Czernowalow