The impact of last year’s NotPetya cyber attack was felt around the world, bringing several large organisations grinding to a halt and costing billions of dollars in damage and lost revenue – but the attack said to be the work of the Russian military still doesn’t cross the threshold for being classed as cyber warfare, according to one new analysis.
A new paper published by global cyber insurance and risk management firm Marsh suggests that NotPetya doesn’t meet the requirements to be classed as cyber warfare because the main impacts were only economic, focused on civilian infrastructure and that the goal of the attack wasn’t “coercion or conquest”.
Despite economic damage and the UK and US governments attributing the attack to the Russian military, “these two factors alone are not enough to escalate this non-physical cyber attack to the category of war or “hostile and warlike” activity,” said Matthew McCabe, assistant general counsel for cyber policy at Marsh.
While the economic costs have cost individual companies hundreds of millions and have cumulatively reached billions of dollars, the paper argues that for an attack…
