NATO Article 5 and cyberattacks
NATO's collective defense clause, which Allies have declared since 2014 could be invoked in response to a cyberattack, case by case, including for cumulative activities.
Article 5 of the 1949 North Atlantic Treaty provides that an armed attack against one or more Allies is considered an attack against all. It has been invoked only once, after the attacks of 11 September 2001. At the 2014 Wales summit, Allies declared that cyber defense was part of collective defense and that a cyberattack could lead to invoking Article 5, the decision being taken case by case. In 2016, they recognized cyberspace as a domain of operations, like land, sea and air. In 2021, they added that cumulative malicious cyber activities could, in certain circumstances, be considered as amounting to an armed attack. The Alliance deliberately maintains ambiguity about the threshold, so as not to tell adversaries how far they can go. For insurance, this doctrine bears directly on war clauses. Invoking Article 5 after a cyberattack would be a strong signal that an armed conflict exists, and so that a war exclusion applies. But states' deliberate ambiguity meets contracts' demand for precision: a clause that depends on a political characterization, decided by consensus among thirty-two governments, passes to the underwriter an uncertainty no one can model.
Textbook case: a computer sabotage campaign paralyzes a Baltic state's ports and hospitals for a week. Allies debate invoking Article 5; pending their decision, the insurers of affected companies reserve their rights on the war exclusion rather than decide alone.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.