Cyber ​​attack could lead to war. But it is unlikely (analysis)

Could cyber attacks on Ukraine be war crimes?

1:10

(CNN) --

President Joe Biden issued an urgent and ominous warning to Americans and businesses Monday, saying "evolving intelligence" suggests Russia may be planning cyberattacks against the United States.

On Tuesday, an FBI advisory was sent to US companies in the energy, defense and finance sectors, warning of potential preparation work to hack IP addresses in Russia.

US prepares for possible Russian cyberattacks 1:01

This activity is "likely not about espionage, it's very likely about disruptive or destructive (cyber) activity," said Jen Easterly, director of the US Cybersecurity and Infrastructure Security Agency, during a Phone briefing with industry executives and state and local government personnel, according to three sources on the call, CNN's Sean Lyngaas writes.

Many warnings of an impending Russian cyber attack

The advisory is part of a growing chorus of warnings that US infrastructure is at risk, writes Lyngass.

"For months, the US Departments of Energy, Treasury, and Homeland Security, among others, have informed major power companies and banks about Russian hacking capabilities, and urged companies to lower their thresholds to report suspicious activity.

Some companies are not prepared

The bottom line of Biden's warning Monday and the FBI's warning was that the infrastructure behind American society and way of life is mostly in private hands and needs to be further protected from hackers.

advertising

Tips to protect your information from cyber attacks 7:34

Anyone who remembers the ransomware attacks against major US food manufacturer JBS, US cities, an oil pipeline, and hospital systems in recent years knows this to be true.

Biden has told Putin to stop

Biden has warned Russian President Vladimir Putin not to use cyberattacks against the US The president on Monday referred to the talks as an "altar call."

"We've had a long conversation about, if you use it, what would be the consequence," Biden told business leaders Monday.

Biden has more control over that consequence than he does over the readiness of American companies that are involved in American infrastructure.

He appealed to his sense of "patriotic obligation" to match his cyber defense capabilities.

He specifically mentioned the energy and financial sectors.

What would a large-scale cyber attack look like?

It has happened before.

Estonia was the victim of a large-scale cyberattack in 2007, although there was insufficient evidence to definitively attribute it to Russia at the time.

CNN's Ivana Kottasová wrote about the attack, which Estonia considered an act of cyber warfare, last June.

It all started with Estonia's decision to remove a Soviet-era war memorial from the center of Tallinn.

Here are some key lines from his report:

The attack made Estonia realize that it needed to start treating cyber threats in the same way as physical attacks.

At the time, the country was already a leader in e-government, having introduced services such as online voting and digital signatures.

While no data was stolen during the incident, the websites of banks, media outlets, and some government services were targeted in distributed denial-of-service attacks that lasted 22 days.

Some services were discontinued, while others were removed entirely.

NATO and the international community became aware of the attack on Estonia and experts developed a standard to assess cyber warfare as a result.

When is a cyber attack an act of war?

I called Tess Bridgeman, co-editor-in-chief of the Just Security website and a former Obama White House counsel who is an expert on war powers and international law.

"If a cyber attack causes significant death, destruction or injury, of the same kind that we would see in a more traditional attack using kinetic means, such as bullets or missiles, then I would call it a 'use of force' in international law," he said.

A cyberattack targeting a dam or air traffic control towers could reach this level, but the government would go to great lengths to avoid responding to a cyberattack with a military attack, he said.

The attacks against the US to date have not reached the threshold to justify a military response.

As the government looks for countermeasures to respond, Bridgeman said, it is very likely that they will not be publicly known.

"It may appear that the United States is sitting idly by, but I highly doubt that is the case," he said, arguing that defensive actions might be more effective in de-escalating the standoff.

"He's setting the example of what responsible state behavior looks like."

Could weapons be used to respond to a cyber attack?

The threat of a military response is always there for the worst cyberattacks, should they cost American lives.

"Our policy, our stated policy is, if it's a big enough attack on us and it hurts us, we will use the conventional weapons response," said Richard Clarke, who was one of President George W. Bush's top security advisers. cybernetics, to CNN's Michael Smerconish shortly after the war in Ukraine began.

"So we could easily find ourselves in a shooting war with Russia if they try devastating cyberattacks, and they would have to be devastating, like shutting down the power grid," Clarke said.

Most of these attacks are intended to be part of espionage campaigns or to be meddlesome rather than deadly.

Clarke argued that Russian attacks on US industries could be more devastating than attacks on the government itself.

He said the government doesn't really know what would happen if the cloud systems of Amazon, Google and Microsoft went offline, for example.

"I can tell you if those clouds go down, America goes down, our economy goes down, phones go down, pretty soon we'll find ourselves in the dark ages if the Internet goes down," Clarke said.

What would happen if Russia attacked a US ally?

It is not clear whether Russia would specifically want to provoke the US in such a devastating way, or how the US would respond.

While its cyberattacks in Ukraine since the war began have been less severe than some expected, according to a Lyngass report, Russia has targeted internet infrastructure in parts of the country.

There have been concerns that cyber attacks in Ukraine could spread to neighboring NATO countries and could lead the organization to invoke Article 5 of its charter, the principle that an attack against a NATO member is a attack against all members.

Could a cyber attack trigger Article 5?

A cyberattack could absolutely trigger Article 5. NATO Secretary General Jens Stoltenberg made that clear in February, right after the Russian invasion.

"An attack on one will be considered an attack on all," Stoltenberg told a news conference when asked about a possible Russian cyberattack.

But he added that NATO would be very careful when assessing an attack and make sure that a cyber attack on Ukraine (cutting off electricity, for example) that accidentally spread to Poland or Romania is not interpreted as an attack on those countries.

He also said that it is intentionally unclear what kind of cyber attack would rise to the level of invoking Article 5.

NATO, he said, would not want to "give a potential adversary the privilege of defining exactly when we activate Article 5."

cyber attack