BY ELISABETH BRAW
What constitutes an act of war? A military invasion, sure. Hostile acts by smaller armed formations, sure. The blowing up of a bridge by commandos or the poisoning of water, very likely. But a cyberattack? Zurich, one of the world’s leading insurers, claims that’s the case. The confectionary giant Mondelez, one of its customers, argues the opposite. This isn’t an abstract discussion: Two years ago, Mondelez was laid low by NotPetya, a computer virus unleashed by Russia against Ukrainian targets. Now the two companies are battling out the definition of war in court—and regardless of how the ruling turns out, a new fog of war is still settling over society.
NotPetya struck with devastating force in June 2017. First, the virus—subsequently traced to hackers working for Russian military intelligence—brought down virtually all of Ukraine’s government along with Ukrainian hospitals, power companies, airports, and banks. That was probably its real target. Then, however, the virus traveled on in a less predictable fashion. It crippled Maersk, the Danish shipping giant, and the global law firm DLA Piper. FedEx subsidiary TNT Express was hit, too, as was the U.S. pharmaceutical giant Merck and French construction company Saint-Gobain. Several of them lost hundreds of millions of dollars as a result of the attack.

















