Cyberattacks: A New False Flag Frontier

All my investigations are free to access, thanks to the generosity of my readers. Independent journalism nonetheless requires investment, so if you took value from this article or any others, please consider sharing, or even becoming a paid subscriber. Your support is always gratefully received, and will never be forgotten. To buy me a coffee or two, please click this link.

At the start of June, Admiral Robert Bauer, head of NATO’s military committee, announced that the military alliance had finalised plans to recognise state-backed cyberattacks on its members as a dedicated pretext for activating Article 5. Reportedly “a joint decision of all allies,” from now on, foreign hacking blitzes can be countered with a collective NATO response, up to and including military measures. Bauer’s disclosure passed the media by entirely - but this is a seismic development, heralding a modern, digital form of ‘false flag’.

Article 5, which provides for collective defence in the event a NATO member is attacked, was a core component of the military alliance’s founding treaty. While it has been invoked just once - by the US, in the wake of 9/11, to invade Afghanistan - there have been efforts to spark it before and since. Most recently, in November 2022, the government of Ukraine falsely declared a missile fired by Kiev that struck Poland, killing two people, was Russian in origin.

Admiral Robert Bauer

The purpose of this deceit was undoubtedly to embroil NATO formally and directly in the proxy war. Wise to the ruse, US officials harshly rebuked President Volodmoyr Zelensky publicly for the World War-threatening fraud. Such incidents amply underline Article 5’s susceptibility to abuse. Yet apparently, military alliance chiefs - and the bloc’s members - are keen to ever-expand its terms, well-beyond its initial remit. Adding cyberattacks to the roster of grounds for collective response is a long-standing objective.

In August 2019, NATO secretary general Jens Stoltenberg authored a bombastic op-ed declaring the military alliance would “guard its cyber domain and invoke collective defence if required.” A “serious cyberattack” on one member state could be “treated as an attack against us all,” he wrote, triggering Article 5 in the process. Fast forward two years, and Keith Alexander, US National Security Agency director 2005 - 2014, called on the ‘Five Eyes’ global spying network to construct a global unified cyberattack “radar”:

“Imagine if we built a radar picture for cyber that covered not only what impacts Australia, but what impacts other countries, and we could share, in real time, threats that are hitting our countries…What we can do is share information and work together…Cyber is going to be hugely important for our future. It’s the one area where adversaries can attack Australia and the US without trying to cross the oceans…We have this anomaly: how are you gonna defend that which you can’t see?”

Alexander, who lied brazenly to the public about his agency’s spying capabilities - including while while testifying under oath to Congress - during his time as NSA chief, suggested this worldwide dragnet would contribute significantly to collective defence, in the obvious spirit of NATO’s Article 5. Given “proposals” for Orwellian, futuristic resources from Western politicians and military and intelligence officials almost invariably presage their real-world rollout, we can only assume in light of Bauer’s announcement such a “radar” is incoming.

‘Security Failures’

This interpretation is reinforced by Bauer observing how invoking Article 5 could only happen once it was confirmed a cyberattack was carried out by a state actor, not a private person or structure. “In that case, it would not be clear who to go to war with,” he added. It’s certainly a source of some relief that NATO is committed to securing clarity on “who to go to war with”, before launching a military “response” to a cyberattack.

However, these comments illuminate a very obvious, grave problem with adding cyberattacks to Article 5’s ambit. Identifying who or what is responsible for them to an absolute certainty is extremely difficult. This task is further complicated by a frequent lack of certainty over whether hackers operating from a particular state are doing so at the behest of authorities. For example, much has been made in Britain recently of  Russian hacking group Qilin, which supposedly infiltrated NHS servers.

Mainstream media reports have universally framed Qilin as a malign instrument of the Kremlin, although whether Russian officials command the group, let alone even know of its existence, is far from clear. A representative iNews article refers to Qilin as “a syndicate made up of more than 100 groups…not believed to be under the direct control [emphasis added] of the Russian government.” Instead, Qilin is claimed to be “a useful tool of global disruption the Kremlin is happy to turn a blind eye to.”

Further muddying the picture, it has been confirmed that Western intelligence services can falsely attribute cyberattacks, with devastating effect. In 2017, CIA files published by WikiLeaks revealed how the Agency masks its hacking exploits, to make it appear another state actor was responsible. Dubbed ‘Marble Framework’, among other things the resource inserts foreign-language text into malware source codes to misdirect security analysts. The Framework can obfuscate in this manner via Arabic, Chinese, English, Farsi, Korean, and Russian.

Excerpt from leaked Marble Framework files

Moreover, CIA hackers employ crafty tricks and double bluffs to reinforce these bogus attributions, such as creating the appearance of attempts to conceal foreign-language text. Thus, forensic investigators are successfully conned into concluding even more strongly that the country framed by Langley is responsible. Unbelievably, this seismic disclosure prompted no Western journalist to reappraise the widely received narrative that Moscow’s GRU was responsible for the hack and leak of damaging Democratic National Committee emails in 2016. 

That conclusion, universally reinforced by the Western media, was initially peddled by Matt Tait, a former GCHQ spy. He didn’t base his conclusions on anything technical, but “basic operational security failures” he detected on the part of the individual(s) who released the communications, including their computer username referencing the founder of the Soviet Union’s secret police, and “ham-fisted” attempts to pose as Romanian. Which is, of course, precisely how the CIA would cover its own tracks via Marble Framework.

‘Irrevocable Proof’

There has similarly been no mainstream discussion of why the Agency would seek to acquire and maintain this capability in the first place. Now that NATO considers cyberattacks an Article 5 matter, this question has never been a more urgent question, given the CIA’s extensive and deplorable history of false-flag operations to overthrow governments, and kickstart conflicts.   

For example, in April 1953, the CIA and MI6 launched a welter of covert actions to undermine Iranian Prime Minister Mohammad Mosaddegh, in order to lay the foundations of his ouster. One key tactic in which the pair engaged was bombing mosques, and homes of prominent Muslim figures by operatives posing as members of Tehran’s Communist Party. A subsequent internal review of the coup noted that this incendiary activity mobilised Mullahs to take action against Mosaddegh. 

These efforts were judged to have contributed to the “positive outcome” of the wider coup effort. Such a glowing appraisal of these false flag manoeuvres may have informed the dimensions of Operation Northwoods, a daring set of proposals under which the CIA would stage and commit acts of terrorism against US military and civilian targets. These could then be blamed on the government of Fidel Castro, precipitating all-out war with Cuba.

Potential false-flag actions outlined in extraordinary declassified documents include assassinating of Cuban immigrants on US soil, sinking boats ferrying Cuban refugees to Florida, shooting down US civilian airlines, blowing up US ships, and more. One specific element of Operation Northwoods is particularly relevant to consider in light of alleged state cyberattacks becoming Article 5 worthy. If the 1962 Mercury launch - the first US orbital spaceflight - went awry, Castro would be blamed by concocting:

“Irrevocable proof…the fault lies with the Communists…this to be accomplished by manufacturing various pieces of evidence which would prove electronic interference on the part of the Cubans.”

While Northwoods was ultimately rejected by President John F. Kennedy, the US military and intelligence community continued constructing false-flag blueprints thereafter. In 1963, a Pentagon policy paper advocated making it appear that Cuba had attacked a member of the Organization of American States (OAS), justifying US retaliation:

“A contrived ‘Cuban’ attack on an OAS member could be set up, and the attacked state could be urged to take measures of self-defense and request assistance from the US and OAS.”

Langley’s cyberattack connivances have surely only grown more sophisticated, and more complex to unravel, in the years since Marble Framework was publicly exposed. Pinning blame on a foreign country for a cyberattack it didn’t actually commit is no doubt even easier and more effective today. Resultantly, a false flag tripwire for Beijing, Moscow, or any other Washington-mandated ‘enemy’ state to unwittingly and unwillingly stumble over, triggering the outbreak of global war, has now been forged by NATO.