WASHINGTON, DC — A “massive” cyber attack against a NATO country that results in “very significant” fatal damages could constitute an act of war, U.S. Secretary of Defense Jim Mattis cautioned during a Senate Armed Services Committee hearing on Thursday.

Mattis indicated that a cyber attack “that threatens life, that shuts off the power to hospitals and communities in the middle winter” could prompt a NATO country to declare war under the treaty’s collective defense principle known as Article 5, which means members treat an attack against one as an attack against all.

Sen. Jeanne Shaheen (D-NH) asked the Pentagon chief to explain under what circumstances article 5 might be invoked in the case of a cyber attack.

Secretary Mattis replied:

It would be a hypothetical – as you understand, senator – but I think that as we come to grips with cyber if they get to the point of having a massive attack with cyber — I mean one that threatens life, that shuts off the power to hospitals and communities in the middle winter obviously that would be a significant attack, but it would have to be weighed against all the other things that could be done too.

Even then, it doesn’t mean the only response is military. There might be better economic responses to whoever did it. As you know, attribution is always a challenge in these things. So we would have to make sure we are firing on the right target whether it would be economic sanctions with military responses or whatever it took. But it would be something I think to go into the article 5 arena it would have to be very significant.

Since the U.S. and its allies established NATO, or the North Atlantic Treaty Organization, in 1949, Article 5 has only been invoked once after the September 11, 2001, attacks against the American homeland carried out by al-Qaeda with the help of the Afghan Taliban.

The vast majority of NATO members joined the U.S. in the wars in Afghanistan and Iraq with some troops still serving in the Afghan theater.

Although the NATO Treaty and international law as a whole fail to define a cyberattack, given that computer technology was in its infancy when the norms where established, definitions by both the White House and the Pentagon deem a cyber attack emanating from a foreign country as an act of war.

Nevertheless, the U.S. government does not spell out when a cyber attack is severe enough to constitute an act of war.

In written remarks prepared for the Senate panel hearing on Thursday, the highest-ranking military officer in the U.S., Gen. Joseph Dunford, Jr., the chairman of the Joint Chiefs of Staff who testified alongside Mattis, identified China and Russia as the top cyber threats facing the United States.

Gen. Dunford wrote:

Cyberattacks threaten our military, our economy, and our society. Although China and Russia remain the greatest threats to U.S. security, Iran, North Korea, and violent extremist organizations have all increased their capabilities and are aggressively conducting malicious activities in cyberspace.

Most of these occur below the threshold of open warfare, but they are injurious nonetheless, and their implications for armed conflict are clear.

Mattis added in his written testimony:

The 2018 National Defense Strategy recognizes cyberspace as an increasingly contested warfighting domain, where malevolent cyber incidents and attacks present significant risks to national security. Long-term strategic competitors like Russia, China, North Korea, and Iran are using increasingly aggressive methods and levels of sophistication to conduct malicious activities. The challenge facing the Department is equally applicable to public and private networks across the United States, networks that are already held at risk.

Secretary Mattis warned that U.S. military is “overstretched and under-resourced,” noting that America’s competitive edge in cyber and other domains “has eroded,” telling lawmakers:

Our military remains capable, but our competitive edge has eroded in every domain of warfare – air, land, sea, space, and cyber. The combination of rapidly changing technology, the negative impact on military readiness resulting from the longest continuous period of combat in our Nation’s history, and a prolonged period of unpredictable and insufficient funding, created an overstretched and under-resourced military.

Dunford pointed out that the proposed defense budget for the fiscal year 2019 (October 1, 2018, thru September 30, 2019) focuses on improving America’s cyber capabilities.

“This budget adds modest end strength to each of the services, allowing them to fill gaps in existing combat formations, address critical shortfalls in aviation maintenance, and increase manning in cyber and information warfare,” he testified.

Echoing the general, Mattis noted the budget would devote billions to enhancing America’s cyber strength.

“The FY 2019 budget provides $8.6 billion to build and maintain offensive and defensive capabilities for cyberspace operations. This funding also provides the resources needed to organize, train, and equip the 133 Cyber Mission Force teams whose purpose it is to perform DoD’s [Department of Defense] cyber missions,” Mattis testified.