Five good reasons for NATO’s pragmatic approach to offensive cyberspace operations

Figures & data

Figure 1. Cyberspace operations and sub categories.

Table 1. NATO’s general approach to different categories of military means.

NATO level of coordination	Conventional (non-cyber) military means	Defensive cyber means	Military nuclear capabilities	OCOC
Available information of member’s capabilities (numbers, types, readiness etc.)	Available in considerable detail	Yes (regarding defense of NATO systems)	Available in general terms. Some capabilities in considerable detail.	None
Available information of capabilities’ effects	Available in considerable detail	Yes (regarding defense of NATO systems)	Available in general terms	None
Coordinate development and/or acquisition	Yes	Yes (regarding defense of NATO systems)	No	None
Coordinate use (NATO command and control)	Yes	Yes (regarding defense of NATO systems) plus potential for allocating national resources to crisis area, e.g. Estonia 2007	No	None
Integrate capabilities and effects in plans	Yes	Yes	Yes	Not possible without prior knowledge
Integrate effects in operations	Yes	Yes	(Yes)	Yes (without prior knowledge of available effects)

Table 2. Choices and consequences for use of offensive cyber means by NATO members.

Course of action (COA) for ally with CNA-capability	Outcome if NATO accept risks induced by CNA	Outcome if NATO does not accept risks induced by CNA
COA 1: Share detailed information prior to CNA with NATO (or influential allies, e.g. the US)	Coordinated use of CNA.	No CNA (or go to COA 3).
COA 2: Notify NATO, but do not share information on CNA	Integrated, but uncoordinated CNA (SCEPVA).	No CNA (or go to COA 3).
COA 3: Conduct CNA without notifying NATO or in spite of NATO refusal of SCEPVA	Individual NATO-member conduct CNA uncoordinated with NATO and without NATO’s permission.