Only days after the European Commissioner for the Security Union warned the UK NCSC that cyberattacks present a ‘threat to our democracy’, EU governments are expected to formally declare cyberattacks acts of war.

It is believed that the announcement is a show of force against nations which have been linked to malicious cybercrime in the past, such as Russia and North Korea.

Titled The Framework on a Joint EU Diplomatic Response to Malicious Cyber Activities, the declaration represents an ‘unprecedented deterrent‘ according to The Telegraph, as it is expected to be co-signed by all 28 member states of the EU, including the UK.

Central to the document is a warning that ‘in grave instances’ member states may resort to conventional weapons to respond to attacks.

The declaration follows Security Minister Ben Wallace’s accusation levelled against North Korea over the weekend that it was behind the WannaCry cyber attack back in May.

Work on the document allegedly began over fears that Russia would attempt to intervene in this year’s German federal elections. There have also been concerns aired that Russia has adopted ‘hybrid warfare’ in Ukraine, strategically targeting government officials with viruses based on their internet browsing habits.

The Declaration

At its core, The Framework on a Joint EU Diplomatic Response to Malicious Cyber Activities asserts that a country under cyberattack can exercise its, “inherent right of individual or collective self-defence,” under international law.

As a clear demonstration of force, the document explicitly warns that in the wake of an attack EU members can invoke Article 42 (7) of the EU Treaty, titled the Mutual Defence Clause. First activated by France during the November 2015 Paris attacks, the clause obliges EU countries to assist a fellow member should one find itself “a victim of armed aggression on its territory“.

Activation of the clause could trigger multi-national ‘aid and assistance’, administered to the country in crisis. The limits of what this ‘assistance’ might entail are vague, and likely deliberately so. In the case of France, EU defence ministers agreed unanimously to provide the stricken country with extra military assistance.

While the EU itself cannot wage war, these multinational responses can vary greatly in severity – from public condemnation and diplomatic pressure, to sanctions such as economic measures, arms embargoes and travel bans. One source told The Telegraph: “This will make an attacker weigh the consequences of a cyber-attack more carefully, and setting out the steps in a formal document shows we are serious.”