The strengthening of interstate cyber defense and security is being tasked to the Nordic Defense Cooperation, or NORDEFCO, the primary vehicle for joint military collaboration between the Nordic armed forces.

The primary objective for a unified approach among Nordic countries is to develop more effective joint cyber defense capabilities based on enhanced information sharing, identifying best-practice computer emergency responses and more regular cybersecurity based defense exercises.

NORDEFCO has already run a number of preliminary cyber-defense collaboration projects. These have included identifying possible legal and unidentified barriers to deepening collaboration among Nordic militaries.

A fundamental area of investigation, within the framework of joint collaboration, will be to analyze the cost benefits and operational gains from cooperation relating to immediate threat warnings in the cyber domain.

Within NORDEFCO, Finland has taken the lead role to develop Computer Emergency Response Team capabilities that have the capacity to better protect Nordic defense IT, core force systems and critical infrastructure against cyberattacks.

The deepening of Nordic collaboration is running parallel to increasing defense and hybrid threat cybersecurity investments by governments in all four countries.

Finland established the Helsinki-headquartered European Center of Excellence for Countering Hybrid Threats (Hybrid CoE), which commenced operations Oct. 3, to develop advanced solutions that improve civil-military capabilities, resilience and preparedness to counter hybrid threats with a special focus on European security.

“Hybrid threats have become a permanent part of the Finnish and European security environment. The Helsinki Center will respond to this current challenge,” said Jori Arvonen, chair of the Hybrid CoE’s Steering Committee.

The Hybrid CoE will collaborate with NORDDEFCO and NATO, as well as national and military cyber-defense units across the Nordic countries.

Finland has also launched a joint cyber research project in partnership with the United States. The initiative comprises a new Cyber Research Institute located in Oulu, Northern Finland. The U.S. partner is the U.S. National Science Foundation’s Industry University Cooperative Research Center program.

The Finnish-U.S. cybersecurity research cooperation project will be largely funded using capital injections from the state-owned Finnish Funding Agency for Innovation.

For its part, Norway has launched an international cyber strategy to confront and manage hybrid digital security challenges and vulnerabilities. The integrated strategy aims to harness military, civil defense and international expertise to develop systems that enhance protection of critical infrastructure from threats emanating from cyberspace.

The expanding role of cyber defense within Nordic Armed Forces is also reflected in larger capital spending in military budgets for 2018.

Sweden has increased spending on the Armed Force’s cyber defense budget by $12 million in 2018. This extra spending will be routed to different cyber defense and counter-terrorism programs run by the National Defense Radio Establishment, the Armed Force’s signals intelligence section, as well as the Military Intelligence Unit and the national security service agency MUST.

“One of the motivating factors behind the exercise is to promote improved cooperation between the European Union and NATO,” said Jüri Luik, Estonia’s defense minister.

Called EU CYBRID 2017, the strategic level table-top exercise is scheduled to take place in Tallinn on Sept. 7. The exercise is being run as part of Estonia’s six-month Presidency of the Council of the European Union.

The need for such a dedicated exercise is more urgent that ever, said Luik. NATO as well as European countries, he observed, face ever more aggressive security threats in cyberspace.

“There are no borders between countries or organizations on the internet. Barriers to cooperation between the European Union and NATO must be reduced to counter threats in cyberspace,” said Luik.

Significantly, the September cybersecurity exercise is happening in response to enhanced defense collaboration initiatives within the European Union. These are strategically aimed at harmonizing rules of cooperation and engagement both at EU-policy level as well as project-specific collaboration between EU states.

For EU leaders, the EU CYBRID 2017 exercise will take place against a backdrop where leading global information communication technology, or ICT, corporations, including Microsoft and Deutsche Telekom, are calling for a Digital Geneva Convention-style treaty to regulate cyber operations between sovereign states.

According to ICT chiefs, a Digital Geneva Convention is fundamental to empowering nation states to better protect civilians and national infrastructure against cyberwarfare attacks in peacetime.

However, researchers at the Tallinn-based NATO Cooperative Cyber Defense Center of Excellence, or CCD-COE, think tank are less than lukewarm to the idea of a ‘Digital Geneva Convention,’ describing it as both “legally confusing and politically unrealistic.”

“The original Geneva Convention and Additional Protocols form part of international humanitarian law, or law of armed conflict,” said Tomáš Minárik, a research analyst at NATO-CCD-COE’s Law Branch. “They are designed primarily for an armed conflict, such as the ongoing war between Russia and Ukraine. They apply to cyber operations that have a link to an armed conflict. However, they have a limited applicability outside the scope of an armed conflict.”

Other rules of international law play a major role with respect to peacetime cyber activities, said Lt. Col. Kris van der Meij, a senior researcher in NATO CCD-COE’s Law and Policy Branch.

“These protections are included in the Council of Europe’s Convention on Cybercrime as well as customary legal rules regarding the responsibility of states for unlawful activities that have been set down in the International Law Commission’s Draft Articles on Responsibility of States for Internationally Wrongful Acts,” van der Meij said.

The momentum exists for states to improve cybersecurity as it relates to critical infrastructure, said Minárik. For states, the focus should be on extending the right to privacy extra-territorially while curbing indiscriminate online surveillance and data retention.

Addressing international law violations by governments are important and realistic goals, Minárik said.

“They are achievable through gradual progress and do not require universal consensus. Devoting efforts to a Digital Geneva Convention that has little chance of ratification by most countries would be counterproductive,” said Minárik.

Minárik questions the level of inter-state unity that exists for a Digital Geneva Convention given that a number of member countries in the United Nations Group of Governmental Experts, or UN-GGE, recently failed to agree on a joint position as to whether armed conflict applies to cyberspace.

The UN-GGE’s special area of focus covers developments in the field of information and telecommunications that impacts international security.

It is hard to imagine, said Minárik, the adoption of a broadly multilateral cyber-specific treaty “anytime soon.”

“Even in the unlikely event of such a treaty coming to fruition, it is unclear if there is a technically viable mechanism by which it could be verified,” Minárik said.