C4iSR: Joint & Common Equipment

‘Locked Shields’ 2019 seeks to clarify domestic and military cyber response roles

17 April 2019

Participants in ‘Locked Shields’ 2019, which NATO CCDCOE bills as the world’s largest live-fire cyber exercise. Source: NATO CCDCOE

Cyber exercise ‘Locked Shields’ 2019, which was held on 8-12 April, focused on gaining a better functional understanding between technical experts and strategic decision-makers, as well as between operators from different NATO nations, the event’s organisers told Jane’s .

‘Locked Shields’ is the largest “live-fire” cyber exercise in the world, according to its organisers, the NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE). This year’s exercise was its largest to date, said Lauri Luht, CCDCOE head of cyber exercises, with 23 teams and about 1,500 participants. While many of the teams represented individual countries, some were made up of participants from multiple countries or organisations. The exercise saw defence personnel working alongside experts from industry and other parts of government, including operators focused on critical national infrastructure (CNI) protection.

The scenario of this year’s exercise focused on a fictional island nation, ‘Berylia’, which experienced co-ordinated cyber attacks and a deteriorating security situation during and after a national election. The attacks caused severe disruption to electric power generation and distribution grids, maritime awareness capability, water purification systems, and other CNI. They also affected national perception of the election results, causing public unrest, according to the CCDCOE.

About a fifth of participants represented strategic decision-makers, with the rest being technical experts from national Computer Emergency Response Teams (CERTs), military cyber services, and other organisations, said Luht. The goal was to train these groups to work more closely together, just as they would in a real-life scenario.

“The technical side had to make sense of what was going on and report this accurately so that the strategic teams could make decisions and decide on further actions that were derived from the explanations received from the technical teams,” he explained.

Want to read more? For analysis on this article and access to all our insight content, please enquire about our subscription options at

(310 of 534 words)