Cyber crime and cyber attacks have been around for few decades. And yet, we are still coming to terms with how digital technology changes conflict, and what to do about it.
The hidden nature of cyber attacks and the large number of different actors involved makes it tricky to ensure that there are ground rules that are followed.
Everything from deterrence to attribution, from enforcing rules to making the culprits accountable, is far from straightforward. What we experience is the transformation of security. For centuries, our security depended only on our kinetic capabilities – how many weapons and soldiers we have.
Today in fact, we are constantly attacked by cyber attackers and these attacks have become a powerful weapon, able to execute great destructions without too much manpower behind them.
Digital technology changes conflict. However, if we wish to be safe, much greater focus needs to be directed to the cyber issues, and cyber education.
We must ensure that cyberspace is not “Wild West” that you cannot carry out cyber attacks and get away with it.
This means that we must show that the malicious use of cyberspace is not without consequences. From my perspective, it involves three key aspects:
1) We need to implement the existing norms and provisions of international law.
2) We must ensure accountability through responding to cyber incidents, including through mustering the political will to recognize and attribute attacks.
3) We must enhance our digital resilience and our capacity to defend from cyber attacks.
First, let me address the rulebook aspect. Cyber attacks are an act of crime and therefore punishable by law. Our focus should not be on reinventing the wheel. Rather than focusing on new norms, we must implement what we have already agreed.
The existing international law gives states very clear rights and obligations that also apply in cyberspace. In addition, countries have agreed on voluntary peacetime norms for responsible state behavior in cyberspace.
Second, no rules will be followed if the guilty are not made accountable.
To implement existing norms we need two things: political will and capacity.
Political will requires awareness and better understanding how to define and recognize cyber attacks, and where it is coming from and how to recognize the attacker. Here, international cooperation is absolutely critical.
This is why Estonia hosted the first-ever official meeting on cybersecurity in the UN Security Council. This is why we work hard in the framework of the EU and have the Cyber Toolbox in place.
Third, we need capacity to deal with these risks. This does not come for free. It requires funds, clear goals and educated experts. In many countries, spending on cybersecurity is still highly fragmented. What would help here would be to collectively establish best practices on cybersecurity investments.
Likewise, we should support cyber capacity building in countries who are in early stages of digitalization. One of the greatest obstacles to achieving this is the lack of experts. Europe alone lacks 300,000 cyber experts, globally the gap is in millions.
It is clear that states cannot achieve this alone. We share this responsibility with private companies and civil society. The Paris Call has been a great start. We should turn this into further coordinated capacity building, also involving the resources of companies.
So once again, let me highlight the need for a really broad cooperation and a much stronger focus on the safety of the cyber domain.
We need to make sure that existing rules are applied, that we are able to recognize and raise awareness of cyber attacks, and work together to build defensive capacity.
