16 December 2020

Feature article - Cyber Coalition 2020: NATO builds cyberspace situational awareness

by Gerrard Cowan

NATO’s ‘Cyber Coalition 2020’ exercise, which took place virtually between 16 and 20 November, provided a means of testing the alliance’s capabilities in the domain and enabled it to trial new techniques and technologies, with a particular focus on building situational awareness within cyberspace.

While exercise controllers usually run the event from the Estonian Cyber Range 14 (CR-14), this year they and the participants were distributed internationally for the first time as a result of Covid-19 restrictions.

The Cyber Coalition 2020 exercise scenario took place in a Europe-based geography, focused on a fictional island in the North Atlantic. (NATO)

Cyber Coalition is a collective exercise, rather than competitive, meaning participants work together towards a particular goal, instead of competing to solve problems or achieve specified tasks, said US Navy Commander Robert Buckles, Cyber Coalition 2020 exercise director. The exercise included about 1,000 participants from 25 NATO member states, four partner nations, and the European Union (EU), specifically the EU Military Staff and the Computer Emergency Response Team for the EU (CERT-EU).

The exercise scenario took place in a Europe-based location and focused on a fictional island in the North Atlantic. This island – called Icebergen – was divided into two nations: one of these, Andvaria, had recently become a NATO member state, while the other, Harbardus was neutral. In the scenario, NATO had recently established a mission in Andvaria, although the recently elected government of Harbardus was antagonistic towards its neighbour and to the alliance in general.

“This created tension within the exercise, enough to generate cyber effects through advanced persistent threat [APTs] and other means,” Cdr Buckles told Janes. APTs are a form of cyber attack in which an adversary slowly and covertly expands its presence in a network, usually over long periods of time. These and the other cyber effects in the exercise were technical in nature and demanded a response from the exercise participants through cyber defensive operations, Cdr Buckles said.

The exercise also provided a platform for warfare development through experimentation, Cdr Buckles added, bringing in new types of situational awareness tools or testing NATO defences against more current cyber threats.

“In one way, we provide a training platform for the teams to exercise, but we also provide a platform for experimenting with new tools.”

This year the focus of the experimentation was on “enriching situational awareness for the military commander”, said Dr Alberto Domingo, technical director of cyberspace operations, Allied Command Transformation (ACT), who spoke during a briefing at the conclusion of the exercise. While situational awareness is a long-established discipline, “in cyberspace, it’s quite novel, it’s quite difficult to grasp at the moment”, Domingo said. As a result, a core aim of the exercise, was to validate the use of an under-development cyberspace situational awareness concept that could support decision making.