As described in Chapter 2, the origins of Article 42(7) can be traced back to the early 1950s, a period where most threats were still kinetic in nature and there was less reason for disagreement about what is meant by an ‘armed attack’ and ‘territory’. From the perspective of international law it is clear that ‘territory’ refers principally to a state’s land area, its territorial waters and the airspace above. But in the modern era, threats are far more diffuse in nature and states’ key infrastructure may not only be located on their physical territory but also in cyberspace or in space itself. This chapter will therefore discuss some of the key questions facing policymakers when they debate the applicability of Article 42(7) to the digital domain, or to other areas where interpretations of ‘territory’ may diverge but confrontations could nonetheless occur, such as in space, in the maritime domain and on the overseas territories of EU member states.[24]

Are cyberattacks armed attacks?

In general, cyberattacks are difficult to attribute. While the originators of incoming missiles, bombs and other kinetic hits can be traced relatively easily, cyberattacks consist of computer code that is only visible to digital experts. Moreover, there are no borders in cyberspace and cyberattacks may actually target digital infrastructure such as servers which are physically outside the country’s territory. Yet, the impact that cyberattacks can have on modern societies which heavily rely on digital technologies can be enormous. Already in 2011 the Dutch Advisory Council for International Affairs (AIV) concluded that cyberattacks could amount to ‘armed attacks’ and warrant self-defence if the consequences are similar to those of conventional attacks – or if they seriously disrupt the functioning of the state.[25] Although the General Assembly of the UN stated in 2015 that international law in general, and in particular the Charter of the United Nations, is fully applicable to cyberspace just as much as to traditional conflict areas on land, at sea and in the air, the international community is still struggling with this issue.[26] The influential ‘Tallinn Manual’ on law and cyberspace argues that a cyber operation that “seriously injures or kills a number of persons or that causes significant damage to, or destruction of, property” would meet the scale and effects of an actual armed attack.[27]

There is an emerging consensus that cyberattacks, within the broader category of hybrid attacks, that exceed a certain threshold of damage could warrant invoking the right of (collective) national self-defence under international law. The problem is, of course, that the wording “significant damage”, often referred to as the “threshold”, may be subject to different opinions. How, for instance, can one measure the damage resulting from an attack on digital systems, if the effects are creating societal chaos instead of actual casualties, and are thus much less directly visible than damage created by bombs and bullets?

Moreover, for an effective response to cyberattacks, convincing attribution of the attack is required. Not all countries have the digital forensic capabilities for this, and even if they have, it often takes too much time and effort to come to conclusions that can be proven beyond reasonable doubt. There is even the risk of so-called ‘false flag operations’ in which cyberattackers behave as another actor. The situation is made even more complicated by the trend that state actors increasingly allow or encourage non-state actors to conduct cyberattacks on their behalf with the aim of making attribution and retaliation even more difficult.[28]

So far, states suffering from large-scale cyberattacks have responded in various ways, varying from legal procedures to economic and political sanctions, and in a few instances even threats of (covert) counterattacks.[29] Yet, no examples are known of states qualifying a (series of) cyberattack(s) as an armed attack and consequently invoking the right of national self-defence or of collective defence clauses. NATO has declared on various occasions that cyberattacks could trigger the invocation of Article 5 but is struggling with the concept as well. NATO mostly uses the wording that ‘serious cyberattacks’ may trigger Article 5, but what ‘serious’ concretely means is not at all clear.[30] In fact, NATO keeps its language on the threshold deliberately ambiguous by adding that a decision as to when a cyberattack could lead to the invocation of Article 5 ‘would be taken by the North Atlantic Council on a case-by-case basis’.[31] In its response to the Dutch Advisory Council on International Affairs, the Dutch Government concluded in 2012 that in principle Article 5 could also apply to cyberattacks.[32]

Could Article 42(7) be triggered by a cyberattack?

The EU Cyber Security Strategy of 2020 shies away from definite conclusions on this question and instead it intends to “reflect upon the interaction between the cyber diplomacy toolbox and the possible use of Article 42(7) TEU and Article 222 TFEU”.[33] As long as there is no clear common language on the circumstances under which cyberattacks may be used to invoke one of the two articles, it remains up to the victims of such cyberattacks themselves to decide whether or not to invoke either of the articles – or both. Cyberattacks that take place entirely in cyberspace and do not have a direct or indirect impact on the territory or functioning of a state or the physical infrastructure on that state’s territory should in principle not justify the invocation of Article 42(7), considering that territory is by law limited to the physical territory of a state, its territorial waters and the airspace above the two. Moreover, as cyberattacks generally tend to fall below the threshold of an armed attack[34], in most cases it would not be warranted to invoke Article 42(7). Nevertheless, there are situations in which a member state considers that a cyberattack does meet the threshold of an armed attack, and then questions could always be raised regarding possible requests for mutual assistance.[35]

Finally, it is unclear how convincing the attribution should be when any countermeasures are deliberated[36]; it could be assumed that cooperation in attribution is also an important part of the mutual defence efforts, but this is not clearly stated anywhere. From that perspective, improved cooperation in the EU context to increase common attribution capabilities of cyberattacks could be seen as a welcome step that may even have some deterrent value of its own.

Are space-based assets covered by Article 42(7)?

Space will undoubtedly be one of the next areas of competition between states. In many countries, both in Europe and beyond, ‘space’ is becoming an area that is receiving an increasing amount of attention, making it a “contested and congested political and technological arena”.[37] This raises the question of to what extent collective defence and mutual assistance commitments extend to space-based assets. Even though international law does not formally define the boundaries, there is a broad consensus that a state’s airspace ends exactly where a satellite’s orbit begins, the so-called Kármán Line at a height of 62 miles above the earth’s surface.[38] But as with cyber, the boundaries are becoming blurred and political statements are introducing ambiguity. For example, during the June 2021 Brussels Summit, NATO leaders declared that “attacks to, from, or within space present a clear challenge to the security of the Alliance, the impact of which could threaten national and Euro-Atlantic prosperity, security, and stability, and could be as harmful to modern societies as a conventional attack”[39]. Therefore, attacks to, from or within space could theoretically lead to the invocation of Article 5 of the North Atlantic Treaty, in particular when they would affect the critical infrastructure on a state’s territory or the functioning of the state itself.

So far, there does not appear to be consensus within the EU to consider space as a new operational domain and it remains unclear whether an armed attack on a space-based asset could trigger the invocation of Article 42(7). Most would agree that armed forms of aggression in space – such as attacks on satellites – should have direct consequences for key infrastructure on a state’s territory in order to meet the requirements of the article. Nevertheless, taking into account the militarisation of space and the implications this might have for Europe’s security generally and critical space infrastructure specifically, the possible applicability of Article 42(7) to space-based assets of the EU or its member states should be explored in the years to come. One could think of, in this regard, a variety of scenario exercises but also explore the possibility of incorporating new domains such as space and cyberspace into EU law. Moreover, it would be helpful if the EU outlines a roadmap for the protection of its space-based assets, taking into account the potential applicability of Article 42(7). The EU Strategic Compass draft text of November 2021 calls for the development of an EU space strategy for security and defence. This could provide the context for discussing the applicability of Article 42(7) to space.

Does the territorial scope of Article 42(7) extend to overseas territories?

To determine whether Article 42(7) is also applicable to the overseas territories of EU member states, one should look at the general applicability of EU treaty law to these territories. In that regard it is important to note that the EU distinguishes between two types of overseas territories: the EU’s outermost regions (OMRs)[40] and the EU’s overseas countries and territories (OCTs)[41]. The EU counts nine OMRs, which are very distant from the European continent. The OMRs form an integral part of the EU, and therefore EU treaty law applies to these regions. In contrast, the 13 OCTs of the EU do not form part of the EU territory and the Single Market. As a result, EU treaty law, including Article 42(7), does not apply to these countries and territories. In the context of the overseas countries and territories of the Netherlands, this means that an armed attack on one of the three countries or special municipalities cannot trigger the invocation of Article 42(7). This is only reserved for the OMRs. There are also certain territories located outside of continental Europe such as the Spanish cities of Ceuta and Melilla that are considered an integral part of the EU and that would therefore be covered by Article 42(7) – which is not the case under the provisions of the North Atlantic Treaty.[42]

Applicability of Article 42(7) to the maritime domain

Article 42(7) covers the land areas, airspace and internal and territorial waters of the various EU member states. If an armed attack would occur within the scope of these areas, an EU member state could, without hesitation, invoke Article 42(7). Relying upon the maritime zones as defined in the UN Convention on the Law of the Sea, this implies that the territorial scope of Article 42(7) does not extend to the exclusive economic zone (EEZ)[43] of a country. This is an important qualification that is of particular relevance given the maritime disputes between Greece, Cyprus and Turkey in the Eastern Mediterranean.[44] Even though the EEZ would fall outside the scope of Article 42(7), there is still the matter of disputed territorial waters around the Aegean Islands where Greece might claim that the Article should apply. The specific situation of the Eastern Mediterranean is further discussed in more detail in Annex 3 to this report.

Finally, the maritime domain harbours another area where misunderstandings might arise with reference to the applicability of Article 42(7): ships sailing under the flag of an EU member state in international waters, or critical infrastructure belonging to an EU member state. As described above, it is evident that the internal and territorial waters fall within the scope of Article 42(7). But as Article 42(7) is only applicable to the territory of the EU member states, which is limited to the land areas, territorial waters and the airspace above them, the article does not extend to international waters. This means that an EU member state cannot invoke Article 42(7) if ships sailing under its flag in international waters would become the victim of an armed attack. This is again markedly different from NATO’s Article 6, which expands the territorial scope of the collective defence clause of the North Atlantic Treaty to “the forces, vessels, aircraft of any of the parties in (…) the Mediterranean Sea or the North Atlantic area north of the Tropic of Cancer”. This more restrictive wording of Article 42(7) is yet another indication of how the EU differs from NATO as a military alliance. Chapter 4 will discuss this further as part of the considerations of member states to potentially invoke both articles in various situations.