Maggie Miller - Politico.com
Albania was hit by a cyber attack a few months ago, and the attack was so devastating that the government considered the possibility of seeking a NATO declaration, which could have led all member countries to a confrontation with Iran.
It would be the first time a NATO member state used a cyber attack to invoke Article 5, which treats an attack against one member as an attack against all, requiring collective defence.
"In the end, Albania decided not to take that action, which would risk escalation and antagonize powerful allies," said Rama in an interview from his office in the Albanian capital.
Rama did not say how seriously the option to seek the implementation of Article 5 was considered or for how long.
"I have too much respect for our friends and allies to tell them what to do," said Rama.
"We are always very careful to be very humble in our assessments," he emphasized.
The debate within the Albanian government on Article 5 underscores the ongoing debate over whether a cyber attack will ever be serious enough to actually trigger a full NATO collective defense response, which could include cyber retaliation against the attacking nation by all NATO members or crippling sanctions.
The provision has only been invoked once, just days after the September 11, 2001, attacks on the US, and the consequences have not been fully defined for a cyber attack. NATO member countries must come to the aid of the country requesting the implementation of Article 5, but each member country can determine the extent of their response.
For Rama, the July attack, which forced the country to shut down government websites used for everything from paying utilities to obtaining a driver's license, was pushed to the limit.
"It's like bombing a country," Rama said of the cyber attack, which was widely attributed to Iranian hackers.
"Ninety-five percent of Albania's government services are offered online, which means daily operations are disrupted in government offices across the country," he said.
"Hackers also tried to delete sensitive government data", adds Rama, "but they were not successful".
Albania severed diplomatic relations with Iran in response - believed to be the first time a country has taken this step over a cyber attack.
However, Rama decided not to take this incident to NATO.
"It was too much for us to think and come to the decision that we should ask NATO to promote the implementation of Article 5", said Rama.
In possible retaliation for the severance of relations, Iranian hackers again attacked Albania in early September, disabling several systems used in border and customs processing.
Rama warned that his country expects more attacks from Iran and is working to strengthen cyber defenses.
The line around when a cyber attack can trigger Article 5 is blurred. NATO's Joint Cyber Defense Center of Excellence described its application to a cyber attack as "an ambiguous but stable NATO position," while NATO Secretary General Jens Stoltenberg said in 2018 that "the level of cyber attack to trigger collective defense must remain deliberately vague".
"I have often been asked under what circumstances would NATO trigger Article 5 in the event of a cyber attack?" My answer is: we will see," Stoltenberg said at the time.
Jim Lewis, director of the Strategic Technologies Program at the Center for Strategic and International Studies, said NATO is likely still working through the "menu of options" it would use to respond to a cyber attack. "It's going to be murky for a while until we sort out what we can do non-violently that might have an effect."
The Iranian cyberattacks may have caused widespread disruption, but they did not lead to any deaths or permanent destruction of systems. These facts, coupled with Albania's small size in terms of geography and population, made the implementation of Article 5 even more remote.
"If the attack had been more damaging, they might have gotten some support," Lewis said. "Nobody was hurt, so it's hard to say that Article 5 was needed."
The Russian invasion of Ukraine has intensified these discussions, given recent warnings that Russia is preparing to intensify cyber attacks against Ukraine as the winter months approach and that a cyber attack against Ukraine could spread to neighboring NATO countries. s.
Many NATO members, including Albania, have provided cyber security support to Ukraine.
"We have done our part", said Rama about the help provided by Albania, "but what has happened with Iran imposes a different speed".
NATO and its member countries took action to support Albania after the July strike. NATO issued a statement condemning the attack and pledging to provide support to strengthen Albania's cyber defenses. The US Treasury Department sanctioned Iran's intelligence agency and its leader, and the Justice Department sued suspected Iranian hackers for widespread attacks against critical global infrastructure.
The FBI and the Cybersecurity and Infrastructure Security Agency issued a joint advisory in September detailing how Iranian hackers gained access to victimized Albanian networks 14 months before the attack, periodically stealing emails related to the Albanian government. The British government noted in a separate alert that Rama's emails were among those accessed.
Rama cited US assistance after the attack, which included providing expertise personally to investigate the incident, as a "great support" and noted that Albania is currently awaiting US financial assistance for the effort. of cyber protection.
"Every dollar that will come will be greatly appreciated", said Rama.
"I think they are needed and they will show us that they support us in this situation", he concluded.