9

A recent Washington Post headline reads in part "Israel responded to a Hamas cyberattack with an airstrike. ..."

I'm looking for the first such historical instance of a physical response (an escalation) to a cyber attack between nation states (UN member states or perhaps UN limited recognition states), or an authoritative source stating that no such escalation has ever occurred.


The WaPo article mentions a prior escalation of US armed forces against the unrecognized proto-state [1] of Islamic State' "cyberwarfare activities" and "social media operatives." I am discounting this instance as the Islamic State is not a UN recognized member state, nor does it even make the list of States with Limited Recognition.

Similarly, the article cautions that the Israeli response is kind of a special instance:

... it may not even count as escalation. Israel’s airstrike took place in the midst of ongoing military operations against Hamas, prompted by the firing of 600 rockets from the Gaza Strip into Israel and the worst violence since 2004. In this context, a single airstrike in response to a cyberattack isn’t really escalation, since both Israel and Hamas were already using military violence.

Moreover, Israel didn’t escalate the overall conflict. Less than a day after the airstrike, both sides agreed to a cease-fire

Additionally, Hamas is generally regarded as a terrorist organization [2], not a nation state. Therefore, I'm not sure that this counts as escalation (a subjective line, perhaps), but it is definitely not escalation between nation states.

Perhaps the answer to my question is that there has never been escalation from a cyber attack between nation states. In that case, if there is some kind of official report from the UN or a government agency or NGO or a scholarly article (I'm trying not to be too particular) stating no such escalation has occurred, I will accept that as an answer.

Another WaPo article, from 2012, quotes the US State Department’s chief legal adviser:

Here’s the rule of thumb, as Koh stated it: “If the physical consequences of a cyberattack work the kind of physical damage that dropping a bomb or firing a missile would, that cyberattack should equally be considered a use of force.” If an attack reaches those levels, then a nation has a right to act in self-defense.

I'm not aware (not that I'm an expert) of a cyber attack resulting in loss of life, so it seems unlikely that the escalation I'm asking about has ever occurred.

Repeating the question for clarity:

I'm looking for the first such historical instance of a physical response (an escalation) to a cyber attack between nation states (UN member states or perhaps UN limited recognition states), or an authoritative source stating that no such escalation has ever occurred.


[1] Wikipedia says "unrecognized proto-state" https://en.wikipedia.org/wiki/Islamic_State_of_Iraq_and_the_Levant

[2] Again, according to wikipedia https://en.wikipedia.org/wiki/Hamas

  • not sure about tags, please edit as necessary or comment with better tag suggestions – BurnsBA May 9 '19 at 15:12
  • 1
    There has only been so many State-Sponsored cyberattacks. The answer seems to be that this was a first. – Denis de Bernardy May 9 '19 at 18:14
  • 1. If the US and North Korea ever go to war, I would be able to answer this question. – Alexander Micharski Aug 18 '19 at 2:41
  • @DenisdeBernardy: That you know of... The nature of the game is that neither sides want to discuss the successful ones. The attacker because it reveals a hole in the defenses, and the victim because they don't know who got in or more concerning how. One does not leave their house unlocked when they leave for the day, but if they forgot on the way out, they would certainly never scream "My Front Door is Unlocked" at the top of their lungs. – hszmv Nov 26 '19 at 18:17
  • Best answer is the field is too new to give a decent answer with examples, though most nations likely reserve the right that a hostile cyber attack with sufficient magnitude of real wold effects will be viewed as an act of war, most cyber attacks have been against government systems, especially military, and as said,no one wants to publicly announce that military computer systems were penetrated. – hszmv Nov 26 '19 at 18:22

You must log in to answer this question.

Browse other questions tagged .