Nuclear Issues

North Korea’s 3,000 to 6,000 hackers and the 10 to 20 percent of its military budget going toward online operations mean the country’s cyberthreat to the United States stands only behind that of China, Russia and Iran. If the current tensions continue to escalate, could the United States or North Korea use their cyber-capabilities as a “force multiplier” to conventional military systems?

While the issue of cyber operations beyond NATO’s own networks is a politically difficult one given the complex mosaic of national, transnational (EU), and international law; the role of national intelligence efforts in certain types of operations; and ever-present disputes over burden-sharing, the Alliance already has invaluable experience in developing policies and procedures for contentious and sensitive tools in the form of the Nuclear Planning Group (NPG). This article begins with a brief overview of actions NATO has already taken to address cyberthreats. It will then explore why these, while important, are insufficient for the present and any imaginable future geopolitical threat environment. Next, it will address the history of the NPG, highlighting some parallels with the present situation regarding cyber and drawing out the challenges faced by, and activities and mechanisms of, the NPG. Finally, it will make the case that a group modeled on the NPG can not only significantly enhance the Alliance’s posture in cyberspace, but can serve as an invaluable space for fostering entente and reconciling differences on key aspects of cyber policy. It concludes that the Alliance needs to consider offensive cyber capabilities and planning, and it needs a Cyber Planning Group to do it.

Each year, the Science, Technology, and Public Policy (STPP) Program at the Belfer Center for Science and International Affairs at the Harvard Kennedy School welcomes new pre- and post-doctoral fellows and visiting researchers to a select team of scholars exploring the critical role that science and technology play in everyday life.

"...[Y]es, I think Stuxnet had a few down sides. One of those down sides was that the actual attack code became publicly available. As far as I can tell the attack code was supposed to die and not get out onto the Internet, but apparently the same way it got into Natanz [Iranian nuclear enrichment facility], it got out...."