1. Cybersecurity: global developments, challenges and strategic responses
Addis Ababa, July 2018
Vladimir Radunović
Director, cybersecurity and e-diplomacy
Who we are: CB
online and in-situ
research
support
alumni
Today:
- to map what we should take into consideration when doing strategies

2. Context
Trends 2

3. Factor 1: Cyber-dependence
[not only climate change!  ]
Dependence on data and services 3

4. Factor 2: Increasing risks
Risks increasing: WiFi, PGP, Intel/AMD/Qualcomm/Arm chips... WEF on threats, US intel community has cyber among top threats...
Secret life of a vulnerability 4

5. Factor 3: Cyber-armament
Cyber-armament and militarisation
Secret life of a vulnerability
Available at: 5

6. Geopolitics
Broader context 6

7. Hybrid warfare
Under the threshold of armed attack so how to apply IHL? 7

8. New economies
Annual turn-over of some of the biggest of those companies in larger than GDPs of some African states!
Amazon over Tunisia and over Ghana; Apple over Kenya; Microsoft over Libya; Gogole over Cote d'Ivoire; Facebook over Namibia or Rwanda
In fact, only 4 African states (Algeria, Egypt, Nigeria and South AFrica) have higher GDP than annual turn-over of Apple. These states have millions of inhabitants while Apple has employees. There is enormous difference in economic might in digital economy.
Digital transformation awards innovations: digital trade, e-commerce, big data, AI and VR, quality content, …
But trends is also another wave of convergence of services:
Telecoms becoming OTTs (examples: ATT&Time Warner, Verizon & Yahoo, telecoms and e-banking),
OTTs becoming telecoms (examples: Facebook drones, Google balloon and fibre, …)
and all about data 8

9. Development agenda
How to these emerging technologies contribute to SDGs?
For majority, in fact! no poverty, health, education, gender equality, economic growth, industry innovation and infrastructure, reduced inequalities, sustainable cities and communities, climate action, peace justice and strong institutions, partnership for goals
Let’s focus on economy 9

10. Targets
U, me, everybody 10

11. Attacks
Source: Hackmageddon 11

12. Attacks
Terrorism?
Source: Hackmageddon 12

13. Future targets Source: IBM/ 13
dependence on ICT: costs of DDoS, Ukraine and CI, ransomware in hospitals cars, - > victims?
Source: IBM/ 13

14. Response
Mechanisms 14

15. Driven by people. Strategic approach Legal Operational Law Edu
Partnership
Law
Standards
Driven by people.

16. Risk = Assets x Threats x Vulnerabilities
Addressing the risks
In cyberspace, all three components are grand!
anyone can be a crocodile from anywhere
al our data are in digital form (we just don't value that yet)
systems are full of vulnerabilities
Strategy should
protect assets (data, networks and systems, people)
reduce vulnerabilities (responsibility, vulnerability disclosure, security by design, network security, standards)
reduce threat (combat criminals, promote disarmament)
minimize the impact (strengthen cooperation, incident response)
Risk = Assets x Threats x Vulnerabilities 16

17. Dimensions of cybersecurity
Political
Military
Economic
Technical
Citizens' 17

18. Areas What to cover? 18 EU Cyber Security Strategy (2012)
Achieving cyber resilience (enhance public and private capacities, resources and processes to prevent, detect and handle cyber security incidents) -> CIP and National Crisis Management
Drastically reducing cybercrime
Developing cyberdefence policy and capabilities related to the Common Security and Defence Policy (CSDP)
Develop the industrial and technological resources for cybersecurity
Establish a coherent international cyberspace policy for the European Union and promote core EU values 18

19. Network and critical infrastructure
Resilience:
standards, protecting the chain
vulnerability disclosure
CIIP and CIP (also digital services) – define (categories or functions) 19

20. Driven by people. Incident response
Particularly information sharing across sectors and states, expert approach, trust, PPP
Driven by people.

21. Child protection Crime 21
Cross-border cooperation, bilateral and regional agreements, international agreements (eg. Budapest convention) 21

22. Peace and security 22 De-militarisation IHL!
norms and responsible behaviour
UN GGE, OSCE and regional, ...
Geneva Dialogue... 22

23. Competences, education and capacity building
Uni programmes supported by govs:
KU Graduate School of IS and Department of Cyber Defense IS / KAIST Graduate School of IS (Korea)
Cybersecurity Centers (Germany)
Management and decision-makers training:
Korean Internet Security Agency (KISA) (Republic of Korea)
Deutschland Sicher im Netz (Germany) 23

24. Awareness 24

25. Internet governance and cyber-diplomacy
International cyberspace policy 25

26. Holistic
Multi* 26

27. Holistic approach 27

28. Security and economic development
Openness!
Today economic model: where is the money
Internet ACCESS model (it is ‘old’ Internet model) which focuses mainly on telecom business model. Who pays for the Internet traffic? Get more users, plus get them to use more/pay more.
Internet CONTENT model (there is no financial transactions. It is model of Googel and Facebook - mining data) - data!
Internet PLATFORM  model (there is transaction like Uber and AirBndB, e-commerce, e-banking) - particular importance for Africa
SMART model (cycle model involving AI - IoT - Big Data).
 Proper environment can make Africa profit from demand for local goods (ex: e-commerce platforms)
ACCESS: Africa has new cables that, according to some statistics, Are utilised only 20%. The main problem is last mile, Where many actors are fighting for. For example, Facebook drons and Google baloons. It will Be the main challenge for African countries – how to Make fair deals for providers of last mile access.
ACCESS
CONTENT
PLATFORMS
SMART SOCIETY 28

29. Security and human rights
not either/or – security practices can help human rights, human rights practices (eg encryption) can help security 29

30. Future-proof Among top 12 by WEF (2017)* Linked sensors / IoT
3D printing
Because emerging technologies will also be about data:
Wef 6 out of 12 for the next 10 years
IoT: by 2020 will be 50 billion devices!
But, while solving problems of today, Africa should be also aware of the future technologies. If Africa does not prepare for the future, it may loose dynamics.
Blockchain
Artificial intelligence
Virtual/augmented reality
New computing technologies 30
* Source: Global Risks Report 2017, WEF

31. Collaborative responsibility
Int. and MS cooperation - depolitisation: govs and institutions, PPP- corp.sector/CIIP, CERTs, combating crime, building trust 31

32. Complexity 32

33. Perceptions
Provided by Ed Gelbstein 33

34. Multiple professional cultures
Let’s not forget that all this is not easy!  34

35. Education
Competences 35

36. Comprehensive capacity building
CB for diplomats (eg Diplomatic Toolkit of EU, but primarily understanding!)
Development of hard and soft capacities requires carefully designed training, coaching, and organisational-building activities. In addition, to be effective and comprehensive, capacities need to be developed on various levels.
a stronger focus on organisational development is required, which includes developing the organisational capacities of governments, civil society, business associations, and academia among others. In particular:
Capacity building should reflect local cyber dynamics, taking into consideration local political, social, cultural, and other specific conditions in developing and implementing capacity-development programmes and activities.
Existing cybersecurity training activities should be enriched by – for example – adding sessions on legal and economic aspects of cybersecurity to pure technical training, and vice-versa.
The urgency for cybersecurity capacity building could be addressed by providing just-in-time learning as a part of policy processes. Some elements of this approach are used by DiploFoundation and the GIP, in just-in-time training programmes for diplomats, as well as dedicated programmes for newcomers within ICANN, as part of its Fellowship Programme, and the Internet Society, as part of the Internet Governance Forum Ambassadors Programme.
Longer capacity-building impact should be achieved on a systematic level, by including cybersecurity aspects as well as digital literacy in the curriculum of academic and professional training centres.
The GGE and the regional forums should continue to outline key capacity-building requirements and needs, and propose particular co-operation measures. More importantly, they should also move beyond normative ground into the practical implementation of comprehensive capacity-building programmes, in partnership with academic institutions, civil society, capacity-building and training organisations, the private sector, and the technical community.
Source: Swiss Agency for Development and Cooperation (2006) 36

37. Comprehensive capacity building37

38. "Walking the talk": online learning38

39. Multidisciplinary academic programmes
Here you can add our Internet Research Fair which aims to increase awareness among universities about Internet studies. You can offer them to contact us to organise at their local universiteis (provide something concretely). 39

40. Messages
The Region 40

41. Start
Each on its own
Available at: 41

42. Progress Available at: www.diplomacy.edu/cybersecurity 42
Joint efforts
Available at: 42

43. Desired situation Available at: www.diplomacy.edu/cybersecurity 43
Coordinated
implementation of CBMs
regional and bilateral agreements
capacity building (esp MFAs and political level, capabilities for attribution)
cross-sectoral cooperation and PPP (Serbian model)
involvement in policy- and norms-shaping processes, (GGE but also GCSC, GFCE, FIRST, CCDCOE (Romania to join the NATO Cooperative Cyber Defence Centre of Excellence in 2019), ENISA (Bulgarian presidency initiative)..)
developing competences and research
operational and political cooperation
Use regional organisations –like RCC...
Use Digital Agenda for Western Balkans where funds for cybersecurity are
Available at: 43

44. Diplo’s repository
Courses, IG, trade and cybersec CB and training programmes for Ministries and other stakeholders
DW!
- provide them with some concrete offer (courses, help in Geneva to cover IG)
- higlight more IGF context in Geneva ‘Digital Geneva 2017) and invite their missions to contact us for help in covering all IG events in 2017
- add cybersecurity as the second topic. You may frame your presentation around these two pillars: economy (main focus) and security. 44

45. Visit:
dig.watch
Contact:
Twitter:
@vradunovic