The western alliance has been in a “state of denial” about the danger posed by hackers acting on behalf of countries such as Russia and China, Ambassador Sorin Ducaru said.
The former NATO Assistant Secretary General for Emerging Security Challenges warned Russia has been “militarising” its cyber capabilities over the past decade while NATO only began to address the issue seriously in 2013.
He cited a series of cyber attacks on government agencies, energy networks and telecommunications services in the UK, United States and Germany – all believed to have been perpetrated by Russia – as evidence of the country’s advanced capabilities.
And the diplomat admitted the alliance had “not done enough” to counter the threat, adding: “Until recently, people were shying away from cybersecurity.”
NATO, which has 29 member states, only added cyber to the traditional three areas of battle – land, air and sea – in 2013.
Delivering a talk entitled “facing the new digital battlefield” at the House of Commons this evening, Ambassador Ducaru said because NATO is made up of so many nations, its commanders had been faced with a difficult “political balancing act” to keep each member happy.
He said: “NATO doesn’t like free riders, and we couldn’t advance into bringing cyber defence into policy until there was a guarantee that allies would deliver on their responsibility to hit their cyber defence capability targets.”
The Romanian diplomat said the reluctance of Western nations to “militarise” their internet and “put up walls” had meant countries such as Russia and China had an advantage when it came to defending against – and launching – hacking attacks.
He said: “Cyber favours offence because the defender needs to close every gate while an attack only needs to find one gate.”
Governments in places such as Russia and China, which place more restrictions on their internet, made it much easier for them to defend against a cyber attack.
And conversely, Ambassador Ducaru said, the “walls” they place around their cyberspace makes launching a successful hacking – and remaining anonymous – attack easier as well.
Explaining NATO’s delay in developing a cyber defence strategy, he said: “The truth is, it was due to a sense of responsibility.
“A sense of not jumping or not sending signals of an intention to militarise cyberspace, when the evidence was there that everything that was coming from the opponent’s side was militarised.”