BRUSSELS — NATO must improve its ability to defend itself against cyberattacks before it tries to build its offensive cyberwarfare capabilities, Defense Secretary Ash Carter told alliance leaders Wednesday amid rising tensions with Russia, which has proven its willingness to launch computer-based attacks against other nations.
Carter's message runs counter to some experts and leaders who believe NATO should begin to develop cyberweapons, in order to deter opponents in the 21st century.
Senior defense officials said cybersecurity was one theme of Carter's remarks to the allies and to defense ministers he's met with in recent days. The officials spoke on condition of anonymity because they were not authorized to discuss the matter publicly.
According to senior defense officials, Carter also wants NATO's cybercenter of excellence, which he visited in Estonia, to be more than a think tank. They said he wants the center to take on a more active role in helping allies counter cyberthreats.
To help that along, Carter has announced that the U.S. will use its military cyber-expertise to help allies assess their vulnerabilities and reduce the risk to their critical infrastructure.
The discussion comes as cyberattacks from China and Russia dominate the headlines, including the most recent breach of U.S. government personnel and security clearance records. That attack has been linked to China, and Carter earlier this year blamed Russian hackers for a breach into an unclassified defense computer network. Russia also has been blamed for a breach of NATO's computer network last year.
Cybersecurity, however, is a thorny issue for NATO — both for individual members and for the alliance as a whole. And it's widely accepted as being more difficult than conventional warfare to develop, detect and conduct.
Even as member nations have vastly different military capabilities, there is an even wider gap in their willingness to acknowledge, let alone develop, cyberwarfare as a strategic military mission.
Last fall, after years of debate, NATO finally agreed that a cyberattack could rise to the level of a military assault and could trigger the Article 5 protections, which allow the alliance to go to the collective defense of another member that has been attacked.
But some experts suggest that it's not enough for NATO to help members harden their networks and shore up their digital defenses.
"How can you have a cyber-capability that's limited to restoring network operations. You have to think about cyber as a weapon," said James Lewis, cyber-security expert at the Center for Strategic and International Studies. "No modern military can operate without cyber-capabilities. And if NATO wants to deter opponents, it needs to have the full range of cyber-capabilities."
He noted that Estonia, which was the victim of a cyberattack in 2007 that was traced to Russia, has pressed NATO to take a more assertive posture on cyber-operations.
The 2007 attack crippled dozens of Estonian government and corporate sites in one of the world's most wired countries. Estonian leaders suggested the attack was orchestrated by the Kremlin — a charge Moscow has denied.
Russia's annexation of Crimea last year and its apparent military support for separatists in eastern Ukraine have rattled the region. And U.S. and other leaders believe that any future Russian military actions would likely include cyber-operations.
The U.S. has backed continuing efforts to enforce economic sanctions against Russia, and has also provided defensive military equipment to Ukraine. Carter has said he is open to discussion about sending lethal aid to Ukraine, an option the White House has not approved.
There are also growing fears, particularly among some Eastern European nations, that they could be the next victims of Russian aggression. Baltic defense ministers this week said they feel threatened by Russian President Vladimir Putin.
"We have reasons to believe that Russia views the Baltic region as one of NATO's most vulnerable areas, a place where NATO's resolve and commitment could be tested," said Estonia Defense Minister Sven Mikser.
