There have been terrorist attacks in the recent past in several countries and it is now being recognized all over the world that spiteful cyber activities have been gradually evolving into a growing threat.
One needs to understand that the attribution of cyberattacks poses a number of challenges, both technical and political. This casts its own shadow on the matrix as States do not possess a similar level of the required cyber and intelligence capabilities. There is also the lack of uniformity in aspects pertaining to the political and administrative processes necessary to properly attribute cyberattacks.
The EU Council has been trying to overcome differences of opinion by ascertaining what are the least common denominators that may promote instead of hindering collective action as a common diplomatic response, In this regard, EU institutions are trying to agree on developing common threat assessments and a shared culture of attribution of cyberattacks. To achieve this, cyber experts from EU member states are advising member countries not only as to how to upgrade their information sharing but also exercising the Cyber Diplomacy Toolbox. In this context emphasis is being given on necessary strengthening of cyber capabilities, both defensive and offensive.
While doing so, importance is being underlined with regard to required investment in human and technical capacities and also in creating and updating internal procedures so that the work of cyber security professionals’ feeds into the political decision-making process. This is being taken very seriously because at the end of the day a cyberattack on any EU state will have the culpability of possible sanction being imposed by the EU on the perpetrating state. The EU in this regard is treading the ground with care as the public attribution of attacks or the use of sanctions will have to be wielded carefully, based on strong compelling evidence.
In this regard, the EU, USA and Canada are also pursuing cooperation with the private sector and with international partners. Japan, South Korea, Singapore and the BRICS community are taking special note of how the situation is evolving in the EU. They are seeing this as part of the EU's continued investment in confidence building measures.
This approach is being underlined to point out that while the cyber diplomacy toolbox might be complementary to actions by individual member states, acting together would allow countries all over the world to be more credible and send a stronger deterrent message. By responding to cyber threats as a united actor, we can then all be better placed to defend our security, our political and economic interests and be able to further enhance our credibility as an international actor.
It may be recalled that in May 2017, the WannaCry ransom ware attack quickly spread around the world, encrypting data and demanding ransom payments in the crypto currency Bitcoin. The attack was estimated to have affected more than 300,000 computers across 150 countries, causing between US Dollar 4 to 8 billion worth of damages. Among others, carmakers Renault, Nissan and Honda were affected by the attack and were forced to reduce production in France, the United Kingdom (UK), Romania, Slovenia, Japan, and India. The attack also hit the national healthcare system in the UK, which left hospitals and doctors unable to access patient data and led to the cancellation of operations and medical appointments.
Such unwanted incidents have been taking place even before that for the last three decades. In this context one remembers the 2007 cyberattacks on Estonia amid Tallinn’s disagreement with Russia about the relocation of a Soviet-era statue. It drew particular attention to this security challenge. More recently, Ukraine has also suffered a series of cyberattacks, including on its electricity grid, which temporarily disrupted electricity supply in 2015 and 2016.
In June 2017, the major Not Petya cyberattack spread from its target Ukraine, to the rest of the world, affecting numerous companies in Europe. The attack severely affected the Danish company A.P. Møller-Mærsk, the world’s largest container shipping company, which saw a large part of its IT infrastructure taken offline, creating a loss of USD 200-300 million.
Recognizing the reality of the threat, the EU, United States, Canada, Japan, South Korea and Singapore have been working over the past few years in strengthening cyber security in Europe and tackling cyberattacks against infrastructures, cyber-espionage, intellectual property theft, and hybrid threats using cyber means. They have all been primarily investing in increased prevention and early warning mechanisms.
It needs to be noted that unlike the EU and other regional groups, the US, benefiting from a less fragmented decision-making system and better equipped cyber agencies, have been more active both in bringing criminal charges against government sponsored hackers and in putting in place sanctions against them and their organizations.
In the current situation cyber security has become an important element within our governance structure. It enables us to ensure accountability and also prevent encroachment into privacy. It also assists in restricting and controlling the after-effects of fundamentalism, terrorism, sectarianism and populism.
However, in order for us to succeed in defeating malicious cyber attacks we need to guarantee both in the case of countries or institutions- preventive action, including confidence-building measures, raising of awareness and also cyber capacity building. There should also be cooperative measures, including the use of political and thematic dialogues and demarches and potential for applying restrictive measures on the guilty party.
All parties also need to understand that there is international consensus that existing international law is applicable to cyberspace. Existing international legislation includes principles agreed in the reports of the United Nations Groups of Governmental Experts (UN GGE). It would be pertinent to point out that the 2015 UNGEE report offered a non-exhaustive list of the principles of international law that states must observe in their use of information and communications technologies. Among them are “State sovereignty, sovereign equality, the settlement of disputes by peaceful means and non-intervention in the internal affairs of other States”, as well as the respect and protection of human rights and fundamental freedoms.
Muhammad Zamir, a former Ambassador, is an analyst specialized in foreign affairs, right to information and good governance, can be reached at <[email protected]>
