In today’s information era, ICT technologies (“information & communication technologies”) increase every organization’s functioning capabilities, providing a high efficiency level, but they are at the same time a factor of vulnerability to that same organization.
If we just consider how many different domains depend on such technologies (energy, transportation, finance, governance, infrastructures, health, information, defense and security) we see clearly the level of risk to which every country and the socio-economic community it belongs to are exposed, in case of a crisis.
The functioning of our societies is so deeply dependent on technology and information technology that protecting these assets has become strategic for national security.
Among the so-called “emerging threats” to the Euro-Atlantic and international security, the cyber threat has grown at the same speed of the constant technological evolution of the contemporary world.
Cyberspace has become, in all respects, a battle field where attacks by state actors, criminal and terror organizations, hackers, sometimes even in a coordinated manner, can cause severe damage to critical infrastructures which run the state apparatus, communication systems and national industry, as well as the interactions and social well-being of individual citizens.
The threats and challenges in this field are multifold, as are the techniques used in cyber warfare and the several forms it takes. Due to the asymmetric and low-cost nature of the threat, deterrence cannot protect us completely from offensive actions.
It is thus mandatory for us to deepen our understanding on how to gain access to and operate in the so-called cyberspace, in order to preserve and protect national interests. To this purpose, cyberspace can be correctly considered as a “global common” in all respects (as I said before), meaning that access to it should be granted to the same extent, for example, as to maritime routes, outer space, the seabed and the Antarctic.
Incidentally, all the legal implications related to this new operating environment haven’t yet been investigated thoroughly enough, with the only famous and praiseworthy exception of the Tallinn Manual, that nowadays everybody is reading carefully.
However, cyber threats can only be addressed efficiently by a multidimensional approach, both at the national and international level, involving together with the defense sector also our allies, national institutional actors, industry and the private sector, as well as the academic world.
The attack on Estonia, in April 2007, highlighted for the first time the systemic vulnerability of a modern and technologically advanced country, confronting all NATO members with the dark side of the new cyber reality.
The responsibility for protecting critical infrastructures lies in the hands of member states, and Italy has recently adopted new measures to consolidate a national cyber-security architecture. At the same time, while protecting their critical infrastructures, the allied countries keep benefiting from the added value offered by NATO who started focusing on cyberspace ever since the 9/11 terror attack. The cyber-attack on Estonia I mentioned before, affecting directly the common defense and crisis management domain, caused an acceleration of processes already going on in the fields of planning, research and training.
NATO aims at improving the protection of its assets by reinforcing the member states’ capabilities in prevention, resilience and response. The consultation, information sharing and operational coordination mechanisms help improving the early warning and situational awareness capabilities at the national level, as well as the capability to deliver a common rapid and effective response, in the event of a cyber-attack, without duplicating the assets.
Incidentally, in these times of budgetary restrictions, allied countries are called upon to cooperate also in cyber warfare, based on the principles of prioritization, specialization and multi-nationalization. The integration of cyber-defense in the smart defense initiative responds to such a fundamental requirement, which must be acknowledged even more at the intra-European level. Here cooperation between NATO and the European Union is called upon, to identify areas of complementarity in the cyber sector, where forms of pooling and sharing can be implemented, in order to avoid duplication, overlaps and at the same time reinforce each other. After all, given the transnational and transversal character of the threat, the interaction of all actors concerned is necessary in order to build an effective protective system. Cooperation, pooling and sharing, mutual reinforcement based on common interests are therefore the key elements of a virtuous partnership between the public and private sector. The latter can provide know-how, experience, best practices and cost-effective solutions, particularly for the safeguard of critical infrastructures.
Fundamental is also synergy with the academic and research world, linked to the potential of developing capabilities. By analyzing threats, research identifies areas of investment, to keep the pace with the rapid changes in the cyber world and guarantee protection of critical, public and private, infrastructures. The academic and research world, moreover, can significantly contribute to design a shared NATO cyber doctrine and cyber strategy, aimed at reinforcing the credibility of deterrence and a commonresponse, in case of a cyber-attack on one or more member states.
Finally, in order to complete the whole framework, the mass media reality has to also be carefully considered, because of the social relevance it has gained (becoming a sort of sixth operational domain). In the next years, communities all over the world will be more and more part of a big communication and opinion system (Doxa Sphere) where the influence of traditional media (like TVs, radio and newspapers) will be replaced – if not already happening – by complex interactions between the producers and users of information, in a big global network of blogs, websites and social networks. The new technologies have actually allowed individuals to abandon the role of simple “passive elements” of the information received, while interacting instead with the media, so becoming active parts in the communications process. Probably the socio-political unrests defined as “Arab Springs” wouldn’t have exploded like a volcano if there hadn’t been the possibility to inform, coordinate, share opinions and gain internal and international consensus through the web, while parallel disinformation attempts were equally going on in the open networks.
So this kind of use of the web adds a new colour to the landscape of conflict situations, that of local and/or global visibilityof the individual. In this picture, the Doxa Sphere is one of the main operating areas for the so-called hybrid threats, that comprise those activities carried out by an opponent having the ability to use simultaneously conventional and non-conventional means, to achieve his goals in an adaptive way: the systematic use of disinformation on the web for strategic purposes is one of the main features of this type of threat.
The grand expansion of the media world already allows the public opinion to influence significantly decisions that affect international military actions or interventions. This trend is likely to increase in the next years, maybe in unpredictable ways. The “battles of consensus” carried out (openly or covertly) by all sorts of opinion-making teams, according to the logics of hybrid operations and the so called cross-domain synergies, and having the big global networks as battlefields, are already a reality.
To conclude, I’d like to underline how this event is a good example of the common will to create institutional synergies within an integrated system, both at the national and international level, a system that is constantly state of the art and capable of addressing the complex cyber challenges of the next future.
Opening Address at the Rome Atlantic Forum, 2nd December 2013