Understanding the Armed-Attack Threshold: Schmitt Criteria in Cybersecurity

What Are the Schmitt Criteria?

The Schmitt Criteria, named after German physicist Oskar Schmitt, are a set of guidelines used to determine whether an action constitutes an armed attack under international law. These criteria include elements such as severity, invasiveness, and military character. In the context of cybersecurity, these principles help assess whether a cyber operation meets the threshold for being considered an 'armed attack.'

These criteria are particularly relevant in the digital domain where traditional methods of warfare may not apply.

How Do the Schmitt Criteria Apply to Cybersecurity?

In cybersecurity, the Schmitt Criteria help distinguish between minor cyber incidents and those that could be classified as armed attacks. For instance, a cyber operation might need to meet multiple criteria simultaneously to be considered an armed attack. The severity of the impact, the extent of invasiveness into critical infrastructure, and whether it has a military character are all factors.

The criteria also consider the attribution of the operation, which is crucial in determining state responsibility for cyber operations.

Why Are These Criteria Important?

Understanding the Schmitt Criteria is essential for policymakers, legal experts, and cybersecurity professionals to navigate the complex landscape of international law in cyberspace. They provide a standardized approach to assessing cyber incidents and can influence how states respond to such events.

These criteria also help ensure that responses to cyber operations are proportionate and consistent with international norms.

Real-World Examples

Historical examples like Stuxnet, NotPetya, SolarWinds, and Viasat have been analyzed using the Schmitt Criteria. Each incident has different levels of severity, invasiveness, and military character, making it challenging to categorize them as armed attacks.

The criteria are also used in simulations to predict how states might respond under Article 5 of NATO, which defines an armed attack against one member as an attack against all members.

Frequently asked questions

Try it live

Everything above runs in your browser — open Armed-Attack Threshold: Schmitt Criteria Simulator (2D) and change the parameters while it is running. Nothing is installed, nothing is uploaded, the whole model lives in one tab.