NATO’s flagship cyber defence exercise Cyber Coalition has successfully concluded in Estonia, bringing together more than 1,300 cyber defenders to enhance NATO’s, Allies’ and partners’ resilience to cyber threats and their ability to conduct cyber operations together. The NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE) is proud to continue supporting the exercise by providing both operational/ technical and legal storylines.
In total, the exercise tested cyber defenders through seven complex and realistic scenarios, designed to simulate real-world cyber challenges such as attacks on critical national infrastructure, space-related cyber incidents, “Ghost in the Backup’’, and disruptions to NATO and Allied operations.
The training audience faced a series of demanding cyber incidents affecting critical national infrastructure, requiring them to maintain operational continuity and coordinate effectively with Allies and partners. Among the simulated systems was a power-grid control network—an attractive target for malicious actors, as a successful intrusion could trigger cascading disruptions across multiple countries and critical sectors, including energy distribution, transportation hubs, and communication networks. This years storyline provided by CCDCOE included the most complex technical situations ever done before in this exercise, mirroring real world cases and threats.
Cyber operations are never purely technical; they are shaped by domestic and international law, NATO frameworks, and political constraints. The legal storyline ensured the exercise mirrors real-world conditions by embedding legal dimensions into operational decision-making. Legal advisors confronted issues such as satellite disruptions and breaches involving data embassies. For example: Could a large-scale disruption that blinds early-warning satellite ground stations constitute a use of force or even an armed attack? What legal rights and limitations apply to data held in a state’s data embassy abroad? Participants explored these and many other questions throughout the exercise.
The CCDCOE has contributed storylines to Cyber Coalition since 2010.