A NATO member is under attack.
Normally the meaning of this would be terribly clear, but it is an attack with a difference: not a physical attack, but a cyberattack; and understanding what a cyberattack means is never easy.
Transport and media sites were affected, as well as sites of various government agencies, such as the Lithuanian Tax Service, which was forced to suspend its operations yesterday.
A Russian A hacker group known as Killnet claimed responsibility for the attacks, saying in its Telegram channel that the attack was revenge for Lithuania’s decision to stop the transit of some goods to Russian territory in Kaliningrad on the Baltic coast.
The the policy of this situation is extremely complex. Kaliningrad belongs to Russia, but it is not connected with the main part of Russia – it is a small piece of Russia surrounded by NATO countries.
The Lithuanian government says it is simply imposing European Union sanctions on the goods, but Russia has responded with outrage, saying it is being denied access to its sovereign territory.
Russia has promised to respond in such a way that “it will have a serious negative impact on the population of Lithuania.”
Then, a few days later, this cyberattack took place.
Does this mean that Russia has attacked a NATO member?
Not so fast.
To begin with, the group, which has claimed responsibility, denies its connection to the Russian state, saying it “is not affiliated with any law enforcement agencies.”
The Russian government has long used criminal groups of third parties for hacking and cyberattacks, so it would not be a surprise if it was involved. However, at least the surface of the hand is clean.
Then there is the nature of the attack. So far, reports suggest that this is a distributed denial-of-service (DDoS) attack, a gross attack that involves throwing a huge amount of traffic at a website until it is disabled.
The attack has been described as “massive,” which is technically true because in order to work, a DDoS attack must be large, but that doesn’t mean it will have much effect.
DDoS attacks are so prevalent that most websites today have standard protection against them. Even if the attack works, it will not steal any data. It’s a dumb tool, a little more.
Less worry than we often believe
Cyberattacks are not similar to physical attacks when the amount of damage roughly matches the size of the attack. On the internet being “massive” doesn’t really mean that much. Just as “intense,” is another word used to describe an attack.
This is one of the reasons why, despite all the terrible rhetoric that surrounds them, many experts believe that cyberattacks tend to cause far less anxiety than we often think.
Yes, in theory it is possible to “turn off the light”, but in practice it would be almost impossible. And if they were turned off? Well, we would probably just turn them on again. It would be annoying and scary, but not catastrophic.
Although we use military language to describe them, cyberattacks are not similar to conventional attacks. They are much closer to espionage and subversion than to anything that involves weapons and the military. Even if you know who is doing it, it is often difficult to be sure exactly what caused it and for how long.
Therefore, if a Lithuanian cyberattack is an attack on a NATO member, it is not an attack that will provoke a military response. We are not at that stage yet.
Could the situation get worse
However, that doesn’t mean we’re not moving up to this point, and that a cyberattack can’t get us there.
Another way in which cyberattacks are different from physical ones is that once they start they can get out of control. Unlike a bomb or a bullet, a virus can spread in a way that even its creators do not intend to.
Almost exactly five years ago, the most expensive cyberattack in history was launched: a malicious attack called Not Petya.
It is believed that this began with the fact that Russian operatives infected a small part of the Ukrainian accounting software, intending to disrupt the Ukrainian business. But from there it spread to companies around the world, including shipping giant Maersk and food conglomerate Mondelez.
By the time this was done, Not Petya had inflicted $ 10 billion in damage.
Will such an attack be considered tantamount to a military attack in today’s tense atmosphere?
Let’s hope we don’t have to find out.