Thread by @DrEricDing

CYBER RISK—-Senate Intel Chairman Mark Warner said in an interview that Putin's actions during the next few days risk triggering NATO's Article 5 collective defense principle & draw in NATO into the conflict indirectly or directly but inadvertently.🧵
axios.com/mark-warner-pu…

2) In a 2021 communique, NATO affirmed the alliance would weigh whether to trigger its Article 5 mutual defense pact over a cyberattack "on a case-by-case basis."—

Details: Warner foresees two ways a digital war could draw in NATO countries, including the US

3) 📌Putin deploys cyber weapons inside Ukraine that take on a life of their own and spread to NATO states. This has happened before — notably in 2017, when 🇷🇺’s NotPetya malware was unleashed in Ukraine and ended up causing billions of dollars in damage to companies worldwide.

4) 📌Putin retaliates against the West's toughest sanctions by ordering direct cyberattacks targeting infrastructure inside the U.S. and other NATO allies.

5) The U.S. government issued an alert this week urging businesses and agencies to protect their "most critical digital assets," citing "the potential for the Russian government to consider escalating its destabilizing actions" beyond Ukraine.

6) •"Nation states have been holding on to these malware tools. They've been storing them up; we have, too, literally for years on end," Warner said.

7) “If you unleash not one, but 5, or 10, or 50, or 1,000 at Ukraine, the chances of that staying within the Ukrainian geographic border is quite small. ... It could spread to US, to U.K., but the more likely effect will be spreading to adjacent geographic territory ... Poland."

8) •"It suddenly gets into a gray area about, what would the Polish people's reaction be? What would NATO's reaction be? What would America's reaction be? Nobody's physically shot at [American troops], but they could come in harm's way."

9) Then there are potential cyberattacks from Putin targeted at NATO member states.
•"Putin's been pretty clear that one of the first tools he would use to bring economic harm to NATO and America is cyber," Warner said.

10) •"Play over that whole scenario, just at a larger level, and all the hypothetical conversations about what will constitute an act of war ... suddenly get very real."

11) Dmitri Alperovitch @DAlperovitch, a Russian-born U.S. computer security expert, said Putin could respond to sanctions by giving ransomware groups an "implicit carte blanche" to declare "open season," while Russian forces could be ordered to target critical infrastructure.

12) “Context: The "denial-of-service" attacks reported in Ukraine during the past two weeks were significant, but nowhere near the scale of the massive Russian cyberattacks U.S. officials fear could paralyze communications and shut down critical infrastructure during an invasion.

13) “•Fears of cyberwarfare "spillover" are entirely reasonable, since many forms of malware are designed to multiply and overwhelm targets and continue wreaking havoc.
•They rarely have "off" buttons by design — and they don't recognize international boundaries.

14) “Between the lines: Warner said the U.S. and other NATO countries have avoided formulating "rules of engagement" governing cyberattacks because they see value in maintaining "strategic ambiguity."

15) Warner trying to force conversations for some time — to establish more clarity around international standards & attribution for cyberattacks & responses.
•He worries Putin's actions during the next few days could force NATO allies to answer these questions in real time.

16) •"This has been that area that's been kind of viewed as nerdy and hypothetical," Warner said. "I hope we can have a conversation a week from now, and you could say, 'Hey, senator, you were totally wrong and we're still in the same status.'"

17) Want to know what worries me the most? A cyber attack on nuclear infrastructure…

From our FAS team…

https://twitter.com/drericding/status/1496620168943792135