The Evolving Dynamics of Cyberspace: Assessing The Landscape Of Changing Strategic Priorities In Cyberspace

Kersti Kaljulaid

The analysis examined several significant topics related to technology, cybersecurity, and regulation. One key point raised was the increasing threat of AI in military systems and cybersecurity. The speakers highlighted the potential harm that AI worms could cause to military systems, as well as the planting of false data. The risks posed by these threats require proactive actions to address and mitigate them.

Another important topic discussed was the lag between the legal cycle and the tech cycle. The speakers emphasized the need for a better-functioning legal framework that can keep up with the rapid advancements in technology. They highlighted the challenges posed by emerging technologies such as predictive AI, 5G, 6G, and space technologies.

The manageability of current cyber attacks was also examined. The analysis revealed that Estonia experienced approximately 2,500 serious cyber attacks in the past year, with only one causing disruption in train ticket purchases. While the situation is considered manageable, it comes at a growing cost.

Cooperation and standardization were highlighted as crucial factors in addressing cybersecurity challenges. The analysis noted that countries like Saudi Arabia can play a significant role in promoting positive technological developments by encouraging industry adherence to set standards.

Corporate transparency and the voluntary sharing of development details with governments were emphasized. It is important for companies to share information about their technological advancements with relevant authorities to enable effective regulation.

The speakers also expressed support for imposing sanctions on companies that interfere with political processes. They argued that mechanisms should be in place to hold such companies accountable and negatively impact their share prices.

The European Union’s AI act was seen as a positive development. It was recognized that the General Data Protection Regulation (GDPR) became a de facto global standard, and the speakers believed the AI act should do the same. Global adherence to this act is seen as crucial for ensuring industry security, preventing conflicts, and addressing regulatory queries.

In addition, having a certain set of standards for investment security was highlighted. Regulations play a vital role in preventing potential conflicts and questions in various countries. The importance of basic principles such as human rights and the rights of nation-states was reiterated, as well as involving more women in the cybersecurity sector.

Overall, the analysis emphasized the need for proactive measures to address the increasing threat of AI in military systems and cybersecurity. It highlighted the importance of a functioning legal system that keeps pace with technological advancements, the manageability of current cyber attacks, cooperation and standardization, corporate transparency, global adherence to the European Union’s AI act, and involvement of women in the cybersecurity sector. It concluded that basic principles and compassion should guide the development and application of technology, defining the future of humankind.

Jose Manuel Barroso

The analysis highlights several key points regarding cybersecurity and global cooperation. First, advancements in fields like artificial intelligence and quantum computing pose challenges for maintaining a high level of cybersecurity. This is because these developments can make it difficult for security measures to keep up with new threats, leaving data and networks vulnerable to cyber attacks. The supporting fact provided is that developments in sectors like artificial intelligence and quantum computing might make it difficult to maintain a high level of cybersecurity.

Second, confidence and sincere cooperation among major powers, such as the United States, China, and Europe, have been decreasing. This lack of cooperation is a negative sign for global cybersecurity efforts, as collaboration and shared knowledge are essential in combating cyber threats effectively. The supporting fact is that there was a level of cooperation between major powers such as the United States, China, and Europe when Barroso was in the European Commission, but it might not be the case today.

Furthermore, cyber criminals do not stop at borders, highlighting the need to view technology as a global public good. This means that efforts to ensure cybersecurity should not be limited to individual countries but should instead involve international collaboration and cooperation. Some powers may resist supranational regulation, which emphasizes the need for shared responsibility in addressing cyber threats. The supporting facts provided are that cyber criminals do not stop at borders and that some powers may resist supranational regulation.

Moreover, Saudi Arabia, as an important member of the G20, has the potential to play a significant role in fostering dialogue and cooperation in cybersecurity. By leveraging its position and influence, Saudi Arabia can offer spaces for dialogue and collaboration in addressing cyber threats. The supporting facts are that Saudi Arabia is an important member of the G20 and can offer spaces for dialogue and cooperation in cybersecurity.

In the context of public health, while COVAX successfully distributed 2 billion vaccines across 146 countries, disparities in vaccine access between developed and developing countries were observed. This highlights the need for equitable distribution and access to vaccines to ensure global health security. The supporting facts are that COVAX distributed 2 billion vaccines and that disparities were seen in vaccine access between developed and developing countries.

A multi-stakeholder approach is deemed necessary for addressing global challenges like public health and cybersecurity. This approach involves the participation of governments, businesses, research institutes, and civil society to collaborate and find effective solutions. However, not all countries may be willing to share their expertise in cybersecurity due to defense and war implications. Public-private partnerships can reduce cybercrime, as the cost of cybercrime is expected to reach $10.5 trillion in two years. The supporting facts are that Gavi uses a multi-stakeholder approach involving governments, businesses, research institutes, and civil society, and that public-private partnerships can reduce cybercrime.

Saudi Arabia, with its good connections with both China and the US, can serve as a bridge between the two countries in technological aspects. This can facilitate cooperation and dialogue, leading to advancements in cybersecurity measures. The supporting facts are that Saudi Arabia has good connections with both sides of global arguments, is a member of G20 and BRICS+, and is developing capabilities in the field.

On the subject of regulations, there are some countries that do not support supranational regulation and binding agreements on cybersecurity. This presents a challenge in establishing cohesive and universally applicable cybersecurity measures. The conventional wisdom is to follow the principles of international law on cybersecurity. The supporting facts are that there is a stalemate in the United Nations on cybersecurity and that the conventional wisdom is to follow the principles of international law on cybersecurity.

In terms of strengthening cybersecurity, like-minded countries can forge ahead and extend areas of consensus. By finding common ground and cooperating, these countries can work towards improving cybersecurity measures on a global scale. The supporting fact is that like-minded countries can forge ahead and extend areas of consensus to strengthen cybersecurity.

Another noteworthy observation is that the implementation of GDPR initially faced criticism but is now considered a significant improvement. GDPR, a data privacy regulation introduced by the European Union (EU), has set a global standard, with California following closely in its footsteps. This highlights the positive impact and influence of global standards in regulating and safeguarding data privacy. The supporting facts are that GDPR faced criticism initially, businesses in Europe now agree that GDPR was an improvement, and California followed closely EU’s GDPR, setting a global standard.

Despite the difficulties and time-consuming nature of establishing global standards, they are deemed beneficial and necessary. Negotiation and consensus-building are essential in creating these standards, which may present challenges. However, having global standards is preferable to each country making its own regulations and can contribute to greater international cooperation. The European Union is cited as a good example of successful cooperation. The supporting facts are that creating global standards requires negotiation and consensus, the European Union is a good example of successful cooperation, and despite the difficulty, global standards are preferable to each country making its own regulations.

Cooperation and scale in regulations are crucial for global competitiveness. By cooperating and creating uniform regulations, regions like Europe gain the necessary scale to compete with major players such as the United States, China, and India. This emphasizes the importance of collaboration and the creation of a level playing field in global markets. The supporting facts are that all countries in Europe are considered small, cooperation gives them necessary scale, and cooperating and creating uniform regulations like GDPR allows Europe to compete with the likes of the United States, China, and India.

Furthermore, cybersecurity is a specific but crucial part of overall security concerns. The European Agency for Cyber Security estimates that Europe needs 200,000 cyber experts, highlighting the growing importance of addressing cybersecurity risks. Although there has not been a major catastrophic event globally in terms of cybersecurity, it is seen as a prominent and emerging threat. The supporting facts are that the European Agency for Cyber Security estimates that Europe needs 200,000 cyber experts and that until now, there has not been a major catastrophic event globally of cybersecurity.

In conclusion, the analysis emphasizes the challenges and importance of cybersecurity in a rapidly evolving technological landscape. It highlights the need for global cooperation and collaboration in addressing cyber threats. The involvement of multiple stakeholders, equitable access to resources, and the establishment of global standards are deemed crucial. Additionally, the potential role of Saudi Arabia in fostering dialogue and cooperation, as well as the significance of GDPR and the multi-stakeholder approach, are underscored. Solutions to cybersecurity challenges require proactive measures, efficient risk management, and increased public investment. Overall, the analysis calls for collective efforts to safeguard data, networks, and global security in the face of technological advancements.

Shyam Saran

Shyam Saran emphasises the need for international collaboration in tackling pressing issues such as cybersecurity and climate change. He argues against the competitive negotiation frameworks that are currently in place and advocates for a more collaborative approach. Saran believes that competitive frameworks often lead to compromised results, whereas a collaborative approach can yield optimal results in dealing with cybersecurity and climate change.

Saran also highlights the challenges and opportunities presented by the digital space. He stresses the importance of inclusion in India, where the digital space has enabled a degree of inclusiveness. However, Saran acknowledges the tremendous assault on cyberspace by malevolent forces, highlighting the need for measures to protect against such attacks.

The scale of the cybersecurity challenge is exemplified by the thousands of cyber attacks on sites associated with the G20 summit. This serves as a clear indication of the magnitude of the challenge that nations face in protecting their digital infrastructure.

India stands out as a proactive player in tackling cyber threats, actively collaborating with various partners to address the growing menace. Saran argues that the current international system seems insufficient in dealing with the cyber threat, making collaboration all the more necessary.

One of the key challenges in regulating technological advancements lies in the gap between policy makers, decision-makers and the pace of technological innovation. This gap makes it difficult to develop effective regulations that can keep up with the rapid changes in the digital landscape.

Saran highlights the importance of forums like the Future Investment Initiative in creating awareness among decision-makers and policymakers. Recent initiatives by President Biden and the European Union are mentioned as steps towards tackling cybersecurity issues, indicating a growing recognition of the need for action.

The advancements in the digital space have both positive and negative societal impacts. While it has enabled inclusiveness and positive changes, there have also been negative effects, including infringements on women’s rights. Preventing these negative effects requires proactive measures, including the active participation of women.

Recognising the value of women’s participation in the digital landscape, Saran emphasizes its importance in addressing negative trends and contributing to economic growth. He also calls on universities to actively participate in supporting changes brought about by technology and fostering gender equality.

Despite the usefulness of digital technology as a tool, Saran cautions against allowing it to dominate human beings. He highlights the importance of maintaining a balance and ensuring that humans remain in control, rather than being controlled by digital technology.

In conclusion, the need for international collaboration to address cybersecurity and climate change is crucial, according to Shyam Saran. He emphasises the importance of adopting a collaborative approach, rather than relying on competitive negotiation frameworks. Saran also brings attention to the challenges and opportunities posed by the digital space, urging inclusiveness and vigilance against cyber threats. The scale of the cybersecurity challenge is exemplified by the attacks on the G20 summit. India’s proactive collaboration efforts and the value of women’s participation in the digital landscape are highlighted. Saran encourages universities to support technological changes and promote gender equality. Lastly, he reminds us to maintain a balance and ensure that digital technology does not dominate human beings.

Introduction

The plenary session titled “The Evolving Dynamics of Cyberspace” began in Riyadh, with a distinguished panel of experts comprising Jose Manuel Barroso, former President of the European Commission and Prime Minister of Portugal, Kersti Kaljulaid, former President of the Republic of Estonia, and Ambassador Shyam Saran, former Foreign Secretary of India. These esteemed individuals were invited to share their extensive knowledge and insights on public policy and governance in the context of cyberspace.

During the 45-minute session, the panelists had ample time to delve into the complex intricacies of cyberspace and its far-reaching impact on societies worldwide. They discussed the shifting dynamics and emerging challenges within this rapidly evolving domain, while also highlighting the opportunities it presents for governments and policymakers.

Jose Manuel Barroso stressed the necessity of effective regulations and cooperative frameworks at the national and international levels to combat cyber threats, such as cyberterrorism and cybercrime. He emphasized the importance of governmental collaboration and the sharing of best practices to ensure the safety and security of citizens in an interconnected world.

Kersti Kaljulaid emphasized the significance of prioritising cybersecurity as an integral part of a nation’s overall security strategy. She shed light on Estonia’s pioneering efforts in this field, highlighting proactive measures such as investment in IT infrastructure, public awareness campaigns, and strong public-private partnerships.

Ambassador Shyam Saran elaborated on the geopolitical dimensions of cyberspace and its implications for national sovereignty. He underscored the need for robust international cooperation and adherence to norms to maintain an open, secure, and trustworthy cyberspace.

The panelists’ insightful discussions deepened the audience’s understanding of the complex issues at hand and fostered a constructive dialogue on innovative approaches to addressing the challenges of cyberspace.

The session was skillfully moderated by John Defterios, who facilitated the conversation, allowing each panelist to articulate their perspectives and engage in productive exchanges. John’s expertise in the subject matter and his ability to steer meaningful discussions contributed to the success of the session.

In conclusion, the plenary session on “The Evolving Dynamics of Cyberspace” provided a platform for world-class experts to share their knowledge and insights on the challenges and opportunities within this ever-changing domain. The panelists highlighted the importance of international collaboration, effective regulations, and proactive cybersecurity measures. The session served as a catalyst for further exploration and dialogue on how governments and policymakers can navigate the complexities of cyberspace to protect their citizens and harness its transformative potential.

John Defterios

The analysis explores various aspects of cybersecurity and its global implications, emphasising the Kingdom of Saudi Arabia’s role as a convener and active participant in cybersecurity discussions. With its strategic geographical position, the Kingdom is well-positioned to effectively address cybersecurity challenges.

One key finding is the increasing prevalence of cybersecurity as a global issue. Increased awareness and collaboration are needed to counter evolving threats in cyberspace. The full attendance at the panel session indicates growing interest in the topic. The Kingdom’s role as a convener demonstrates international recognition of its active involvement in addressing cybersecurity concerns.

John Defterios emphasises the importance of international collaboration in tackling global issues, including cybersecurity. The analysis highlights the need for a more collaborative approach, as existing negotiation frameworks often yield minimal results.

The analysis raises questions about how to balance the opportunities and disruptions brought by rapid advancements in artificial intelligence and cyber innovations. This emphasises the need for careful consideration and proactive measures to manage their impact on cybersecurity.

The analysis also acknowledges the mixed results of international cooperation in addressing the COVID-19 pandemic. While initiatives like COVAX have distributed a significant number of vaccines globally, there are disparities in vaccine access between more developed and poorer countries. Additionally, vaccine nationalism has led to excessive accumulation of vaccines by some countries. This highlights the challenges and complexities of international cooperation in addressing global crises.

Another key argument is the necessity for collaboration between countries and corporations in the field of cybersecurity. The expected increase in cybercrime underscores the need for collective efforts to combat this growing threat.

Saudi Arabia is recognised for its potential role as a bridge between China and the US in geopolitical matters, including cybersecurity. Its neutral stance and convening ability position it as an influential player in facilitating dialogue and cooperation between these two superpowers.

The analysis also underscores the crucial role of cybersecurity in digital development and the corporate sector. Proper implementation of cybersecurity measures is essential to protect and foster growth in countries like India and Nigeria. Neglecting cybersecurity could erode the progress these countries have made.

Furthermore, the analysis highlights the positive trend of increased female workforce participation. Female participation in the workforce has risen to 37% and continues to grow. This prompts examination of universities’ role in keeping pace with technological changes and ensuring gender equality in the workforce.

In conclusion, the analysis provides insights into various aspects of cybersecurity and its global implications. It emphasises the need for increased awareness, international collaboration, and proactive measures to effectively address the challenges posed by cyberspace. Saudi Arabia’s role as a convener and its strategic geographical position make it an influential player in cybersecurity discussions. The analysis also underscores the importance of balancing opportunities and disruptions brought by rapid advancements in artificial intelligence and cyber innovations. Additionally, it highlights the mixed results of international cooperation in addressing the COVID-19 pandemic and advocates for increased collaboration in tackling global issues like cybersecurity. Finally, the analysis emphasises the significance of cybersecurity in digital development, the corporate sector, and ensuring gender equality in the workforce.

Introduction:
So let’s get into it. Allow me to introduce our plenary session, The Evolving Dynamics of Cyberspace. Over the next 45 minutes, we’re all going to listen and hear from some of the world’s foremost experts on public policy and leading government. So please join me in putting your hands together and give a warm Riyadh welcome to our esteemed panelists, Jose Manuel Barroso, former President of the European Commission and Prime Minister of Portugal. Kersti Kaljulaid, former President of the Republic of Estonia. And Ambassador Shyam Saran, former Foreign Secretary of India. And Your Excellencies, ladies and gentlemen, our moderator today, my good friend, John Defterios. John, the floor is yours.

John Defterios:
Please, if I can get my microphone up. Thank you very much. It’s great to see you. Ryan, thanks for the kind introduction. And it’s phenomenal to be back for a second time. And as Ryan was suggesting, the room is full for a reason, because cybersecurity is taking greater prevalence than ever before. I think it’s commendable, by the way, that the Kingdom is serving as what I like to call the Intel chip inside the computer, if you remember the ad campaign from the 2000s. It was the chip that was driving the computer at the time. I think the Kingdom has a very unique role to play as one that convenes everybody, like we are doing today, lead from behind to take action for the future. And I would suggest geographically, straddling north and south and east and west, it has a particularly strong position in which to do so. Governor, it’s great to see you. And thank you for the opening remarks. And it’s nice to be in Riyadh again. I think I’m here 10 times a year because of the transformation that’s taking place. Can we give a nice round of applause for the excellent panel that’s been assembled today? And we’ll get right into the debate. We have 45 minutes in which to delve into these very key issues. And you all three sit at the nexus of geopolitics and geoeconomics. If it’s okay, Governor, I think it’s also worth noting that we should recognize the global crisis that we’re facing today when it comes to conflicts, and we’d love to see a solution. But our role here at the GCF is to hone in on cybersecurity and a safe cyberspace for all. So we’d like to see solutions, but at the same time, clearly, not in this room because everybody works in cybersecurity, but globally, awareness needs to raise about the opportunities and the threats because cyberspace knows no boundaries. And because you’re both specialists in geoeconomics and geopolitics, how do you see, President Barroso, the forces driving the change in this sector today, and what we should be aware of? Because it’s, what would you call, extreme complexity in the world, there’s no doubt about it.

Jose Manuel Barroso:
Thank you. Thank you, John, for your introduction, Your Royal Highness, Ministers, Excellencies, dear friends. I believe the developments are quite worrying, to be very frank, in terms of cybersecurity in the sense that we have, on one side, technological change in some sectors, like artificial intelligence, generative artificial intelligence, and what we can call superintelligence, and also quantum computing and other areas that will probably make it more difficult to keep high level of cybersecurity. So this technological change is a challenge for the protection of data, protection of networks and cyber systems. And on the other side, as John, you mentioned, there are the very worrying geopolitical developments. From that point of view, I can share with you my experience. I remember when I was in the European Commission that, for instance, in the G20, by the way, where Saudi Arabia is a very important member, there was some level of cooperation and sincere cooperation between the United States, China, Europe, and others. I’m not sure, to be very frank, this is exactly what’s happening today. So the level of confidence and sincere cooperation globally is going down. Technology should be seen as a global public good because, as you said, cyber criminals, they don’t stop at borders. They are threatening all of us. But the reality is that because of the links to technology, some powers, they will try to keep as much as possible their prerogatives. They will resist any kind of, let’s say, supranational regulation or system. So that’s why I think it’s very important to find spaces like this one here in Saudi Arabia. And I’m not saying that just to be nice to you, most of you here coming from Saudi, but because I think Saudi Arabia has a good place globally, being also a member of the G20, to foster some dialogue, being realistic, what can be achieved at some level between all the powers of the world and in other areas, being more, let’s say, precise about what we can develop further. But it’s going to be a very challenging task from a geopolitical point of view. Good.

John Defterios:
Madam President, we had a founder of CNN, Ted Turner, who said he was in cable before cable was cool, right? He was an entrepreneur that wanted to break new boundaries. And Estonia was very much an early mover and an early example of both e-government but also recognizing the role of cybersecurity. I’d love to have you share your perspectives of the key factors you see at play today. Number one, we’ve come out of COVID-19 with record spending by government, right? And high debt. Ten years before that, we had the global financial crisis. And one of the things you noted is that we have to be very aware of what’s going on in society, but you’re seeing the cost of this to fortify industry, academia, our civil society overall in terms of day-to-day living. What are you seeing here as a cost driver and the importance of getting deeper collaboration amongst governments?

Kersti Kaljulaid:
Well, I’ve used an example for about eight years to start these kinds of discussions. And this example tells you about the little AI worm. It’s a little worm which is specifically designed to enter military systems, weapon systems, maybe even nuclear systems. And it is able to gather all the data which you have in that system and hurt it, destroy it. This is how it is trained. But now imagine this system is somewhere and somebody has contaminated the data set of that system by using a computer which also was used to browse the World Wide Web. And therefore, our little AI worm finds some information which shouldn’t be there. And guess what? That information is a press release by United Nations which says United Nations is getting ready to vote on banning and destroying artificial intelligence in military capabilities. Now what our little AI worm will do, having had this information? It does know it is an AI system in a military capabilities. Therefore, my question is, will this little worm do what it was planned to do, destroy the system or take a name at UN Global Headquarters? When I started telling this story, most people would have considered technology part of this as a fantasy. Nowadays, most people think that it is a fantasy, that UN can never come to a global conclusion to ban AI from military systems. This is what we have seen just in 10 years’ time. And of course, I mean, trying to contain these kind of risks, we need to think about singularity. Because if we think about singularity and take into account that our tech cycle is so much quicker than our legal cycle which deals with our international law space, only then can we protect us from the current level of risk where we have predictive AI only, 5G, 6G, space technologies. But you asked about costs. Estonian National Cyber Security Authority budget in last five years has risen five times. I’m really worried.

John Defterios:
You know, you raise a fantastic point because in this week we saw President Biden sign an AI executive order. When he came into office, four months into office, he signed an executive order for cyber security. But Shyam, I’d love to get your thoughts as a former foreign secretary and ambassador. And Madam President talked about it. There’s 21 international laws that touch upon cyber security, but it’s not a holistic legislative bandwork. And at the same time, countries want to maintain their sovereignty, right? So this is the challenge. So how do we advance this idea to protect sovereignty but also protect our society today in the cyberspace? It’s not an easy balance. And you can use the Indian example as president of the G20 this year.

Shyam Saran:
Thank you very much, John. And it’s a pleasure to be back here, Excellencies, distinguished guests, ladies and gentlemen. You mentioned the Indian experience and, of course, the chairmanship of the G20. Our effort was to try and see that in an international landscape, which is today extremely polarized, very fragmented, how do we also at the same time try to keep alive a sense of international solidarity, a sense of collaboration in dealing with issues which are really cross-national in character. They are cross-cutting in character. Cyber security or climate change, if you take some of the examples, these are challenges which no country, no matter how powerful it is, can hope to resolve by itself. You need collaboration. And I think what we are unable to find is that our whole negotiating frameworks are very competitive frameworks. If I go as a diplomat to a negotiating forum, what is my brief? My brief is give as little as you can, extract as much as you can. That is what we operate on. If you operate on that basis, should it come as a surprise to you that we always end up with a least common denominator result, when actually what you are looking for are maximal results, not minimal results. That is what cyber security is, because it is advancing so quickly that you are out of date before you even start trying to tackle it. So how do we ensure that for issues of this kind, we have a global collaborative mechanism in order to deal with this challenge? Today, we are finding that the whole landscape, as I said, is very fragmented. You mentioned the global financial and economic crisis. Since then, we have not had any kind of crisis where the world has actually come together to try and really address the issue. So going forward, how do we bring this about? And I think in that context, a forum like this, and what our hosts have been able to organize, still provides a forum where people from across the divide can still come together to try and see how we can deal with these problems. So going forward, I would say a lot of opportunities, because we have seen in India itself that the digital space has actually allowed a degree of inclusion, which we have not had before. So it is a very powerful tool. But we have also seen that there has been a tremendous amount of assault on the cyberspace from inimical forces. And how to keep that balance is what is going to occupy us going forward.

John Defterios:
Okay, if I can ask a question here on the comparisons of what we’ve seen, and I’d love to get both of our other panelists involved in this. You sit on the board of Gavi, which is in charge of global vaccines, right? We had the Rio agreement in 1992 to the foreign minister’s interjection here, and very little action for the first 25 years, and we still struggle to have cohesiveness when it comes to climate action. Can we use those two examples and say, how do we not make the same mistakes as we develop policy for cybersecurity? How do we accelerate? Because AI is moving so quickly, and it could be an opportunity, but it could also be a great disruptor. Kirsi, do you want to start, and we’ll come to President Barroso.

Kersti Kaljulaid:
Frankly speaking, our academia has been telling for a long time that the only way of dealing with it is to agree that all our analog legal space applies in a cyberspace, exactly the same things which you cannot do in analog space, you cannot do in cyberspace. And we should simply decide that this is how it is. Also, the UN working groups regularly come to the same conclusion. So what you cannot do in the real world, the same things you cannot do in the digital sphere. But as we follow the practices nowadays, for example, the physical situation doesn’t seem so bad. Estonia last year had about 2,500 serious cyber attacks, which we detected. Only one went through to the extent that real people couldn’t buy some train tickets for a while, but all the rest was captured. So it can be done, but as I demonstrated, at the spiraling cost. So if we want to really spend on health care, education, what makes our world generally better, there is nothing else, I mean, which takes us forward than to decide if this is not to be done in analog, this cannot be done in cyberspace. In practice, we have already diverged nowadays because we do not have anywhere to go and complain about these attributions, worthless, because you don’t have a security council where you can then go and complain. We should actually make our analog system, of course, work better, but then we should simply apply it also to our cyber systems.

John Defterios:
Good. President Barroso, were you a bit frustrated sitting at Gavi and seeing that the global south was not getting the vaccines fast enough? Can you apply that to the lessons here as we develop the institute further, as Saudi Arabia convenes people to take action? What would be the advice, if you will, from your personal experience, and you lived through the financial crisis as well as a leader?

Jose Manuel Barroso:
Exactly. So first of all, the results of the pandemic in terms of international cooperation were, let’s say, mixed. We created COVAX, and COVAX was in some sense very successful because we were able to distribute more than 2 billion vaccines in the world in 146 countries. But it is true that there was a difference between the more developed world and the developing poorest countries in the world. So why? Because while in theory everybody recognizes that global public health is a global public good, because there should be no borders when it comes to fight against the virus, because the virus does not know borders, so we should have a common action, the reality is, and I’m very sincere, the advantage of being… I’ve left politics some time ago, so my level of sincerity is increasing day by day. I’m telling you very frankly what I think. The reality is that we saw vaccine nationalism. We saw some countries accumulating many more vaccines than they needed. We saw disparities. At the same time, to be fair, we saw also great generosity. So some of the biggest donors increasing their donations, including in financial terms. So it’s a mixed action. But one thing I believe is important as a lesson for the future is to have a multi-stakeholder approach. I think it is okay, by the way, Gavi, that I have the honor to chair, chair of the board, is based on that concept. So we have the governments, governments of the richer countries but on developing countries, but we also have the pharmaceutical companies, we have the private sector, we have research institutes, we have civic society organizations. I think this is very important. Because on the issue of cybersecurity, I think it’s going to be even more difficult. Why? Because cybersecurity, let’s be frank, is also linked to defense matters or war. And so some of the global powers will never share all the expertise they have in cybersecurity. They may share some, but not everything. For instance, against cybercrime in business, that’s possible. According to the best statistics, it means eight trillion US dollars per year, the cost of cybercrime, expected to go to 10.5 in two years’ time. I think that’s an area where different geopolitical interests and ideology, they can cooperate against this kind of cybercrime. But let’s be realistic. There are areas where the countries will cooperate, others will not. And we need to bring also the know-how of the more prepared corporations in the world. We need also to apply here a concept of public-private partnership. That will be my advice.

John Defterios:
Good. I want to get a quick follow-up from you, if I may, in my opening remarks. I’ll be brief. I was talking about Saudi Arabia serving as a convener. It could lead from behind, but I think geographically and strategically, with the transformation that’s taking place, and to put this into an institute and policy, can it be a bridge between China and the US, where, as you know, in technology, it’s very fierce competition? And Madam President, if you can follow up as well, please, President Barroso.

Jose Manuel Barroso:
I think so. I think, for instance, Saudi Arabia, during their presidency of G20, was doing a very important job. Now, Saudi Arabia is a member of G20. At the same time, it’s a country of this BRICS+. It has good connections with both sides of global arguments. So I think it’s a great place to have a global conversation. That’s why we are here, by the way. And at the same time, Saudi Arabia is also developing real capabilities in this field, and other countries in the region as well. So yes, I believe we need places like that that can offer a platform for cooperation, and I hope that that can be developed so that this global conversation, and not only conversation, hopefully some action can take place. But I’m realistic about what we can achieve, as you understood. And you mentioned it yourself, John, in the United Nations now, there is a stalemate on this. Let’s be frank. There is a stalemate. The, let’s say, conventional wisdom is that we have to follow the principles of international law on cybersecurity, okay. But when it comes to an idea of having some supranational regulation and forced binding agreement, then people don’t, some countries do not agree. So what we can do is, in what I call variable geometry, some, let’s say, like-minded countries can go forward and hopefully extend as much as possible the areas of consensus to have, I mean, a possibility of reinforcing our cybersecurity.

John Defterios:
Good. Madam President, you wanted to provide some follow-up as well. Go ahead.

Kersti Kaljulaid:
Yeah, absolutely. I’m quite sure that countries like Saudi Arabia can catalyze positive developments. Like, for example, my own country certainly has catalyzed digital development in European Union cross-border, because we have digital identities, Stone Age, if we talk nowadays technologies. European Union has decided that all EU countries have to offer all their citizens digital identities. And in addition, they have to interoperate. So absolutely, this country can be a catalyzed of the positive things. What needs to be catalyzed right now most is that we have to understand that if we compare 20th century to 21st century, in 20th century, most technological development always happened under control of the government. Internet happened under control of government, nuclear weapons similarly. Nowadays, far more of this development, which affects our cybersecurity, is company-led, happens in the private sector, in the industry. And here I see the great role for countries like Saudi Arabia to cooperate and call also for industry to apply the set of standards, to define the set of standards together with governments. And the first ones who are able to define these standards will normally prevail for the global standard-setting body. And by the way, these standards could give industry quite a lot of leeway in developing, which they’re anyway doing. They have more resources than governments nowadays. But it also should invite them to voluntarily share with government what needs to be onboarded all the time into the regulation because governments cannot regulate if they do not know what is cooking in the industry. And also, I think, thinking also of some incidents from the last year, if there is one company which is capable to play the government’s game, affect your political decisions by withholding their service from one party and not from the other party, there should be a mechanism which will make sure that the share price of that company tomorrow is very low. Because otherwise, we cannot keep the sovereign’s task only to the sovereigns. I’m sure Saudi Arabia understands these problems very well and can catalyze the positive process.

John Defterios:
Good. We have the benefit of having His Excellency Amin Nasser from Aramco as one of the four partners that Ryan mentioned here. So they have the corporate sector very involved in cyber security, which I think is quite crucial at the front end of this process. Minister Saran, I’d love to get your thoughts on the ability to leapfrog through digital technologies. We saw the Indian example today, called it the belle of the ball at the Future Investment Initiative because there’s so much attention, so much growth. But how do we prevent the fact that if we don’t get the cyberspace correctly, it erodes all that growth we saw in India, where you take a case like Nigeria leapfrogging away from the hard line into mobile? What’s your view of the global south and why it is so important to make sure we get this right on the collaboration our two other speakers have been highlighting so acutely?

Shyam Saran:
So just to give you an example that while the G20 summit was taking place in New Delhi, there were probably several thousand cyber attacks on the various sites which were associated with the G20 summit. And it was a huge challenge trying to protect our systems from such attacks. Now, it has just been mentioned that today, if you look at the UN system, where actually you should have a kind of collaborative responses to these kind of threats, you have actually the entire trend is going backwards. Because we started with a document which was about 40 pages, and now it is more than 70 pages. Many of the issues which had been resolved have come back again, and some new ones have been added. So we are in a situation where it doesn’t seem as if we can, for example, as India, can really depend upon the international system in order to provide us with the kind of capabilities that we need in order to deal with this situation. So this is where, at least over the next several years, our effort is really to try and see whether we can collaborate wherever it is possible, and we are doing that with many of our partners. Also, I think the importance of the forum of this kind is that, how do you regulate if you don’t understand what the problem is? And I think today, the gap between policy makers, decision makers, and the technology, the fact that, as it was mentioned, that it is the private sector which actually is leading the advancement in this technology, unless you are able to get that information, get that knowledge across to decision makers, across to policy makers, there is very little hope for regulation. So you mentioned the fact that a start had been made by President Biden’s announcement. The European Union has also, in fact, made some advance. We are trying to do that in India as well. But it is fora like this where that knowledge which is required by policy makers, that knowledge which is required by governments, perhaps this is the kind of forum where that kind of sensitization, that kind of awareness, at least, can be advanced. And that would be a very, very crucial component.

John Defterios:
What an excellent panel we have here, because you are going deep into the key topics that are faced with today. I would love to tap, President Barroso, your experience as the European Commission President and the general data protection regulations, the GDPR, if I remember correctly. We have assumed that as the norm, which is very interesting, right, because if you open a website today, it says, do you want to accept cookies or not? And people were pushing against that GDPR, but it did take public-private partnerships to kind of determine the roadmap, if you will. So it can be done, can it not, in cyber?

Jose Manuel Barroso:
Yes, it can, but it’s difficult. In Europe, and now I’m with the experience of the European Union, I think the first proposal we’ve made, it was my first commission, 2006-2007, but it was not entering into force before 2016, because we had to put together all the governments of the European Union. At that time, we were 28, before Brexit. And the reality is that in Europe, there is always this trade-off between scale and speed. The best thing is that we have scale, and that’s a great example for globalization, because you have to put together 27 different countries, and among them, there are cultural differences as well, economic difference and interest. But at the end of the day, usually in Europe, we come to a compromise. So we have the scale of 27 countries. But of course, it’s different to have 27 countries agreeing, or 190 in the United Nations. In Europe, it takes time to come to a consensus of these 27 countries, but it’s better than to do it only alone, each country on its own. As we very often say in Europe, at least I’ve been saying, in Europe all countries are small. The problem is that some have not noticed it yet. Because we need that scale. In Europe, we want to be on the same level as the United States and China, or India in terms of popularity. We need that scale that the cooperation gives. So I think from that point of view, it’s a very good example of trying, through negotiation, to overcome differences. But to be honest, it also takes time. It’s slower than if each country takes its own decisions. But at the end of the day, it’s better. And now, when GDPR was launched, General… data protection regulation, in terms of data privacy, it was very much criticized. People said, oh, once again, the European Commission comes with all that bureaucracy. But now, all business in Europe agree that was an improvement. Can you imagine in business in Europe, if each country in Europe, from France to Germany, from Italy to Sweden, from Netherlands to Spain, if each country had its own regulation? Of course it would be a problem. And that’s why, as you said, John, now, for instance, California, they followed very closely our GDPR. So in a way, it was setting a standard. So I think it makes sense, with some, let’s say, common sense, it makes sense and wisdom, if we try to, in some areas, to have global standards. And the European Union can be a contributor for that.

John Defterios:
Good. Madam President, you had your eyes looking at me. You’re ready to jump in. Go ahead.

Kersti Kaljulaid:
Yes, just a little advertisement. The European Union is now cooking AI act, of course. And indeed, GDPR became a de facto standard globally. But I’m sure that we need AI act to become a de facto standard globally quicker even. So I would invite all like-minded countries who want to be part of it to kind of support similar standards and adhere our practices to this act when it comes out. I’m sure this is extremely important. On the other hand, it is also important that we have this regulation for the industry, for the surety of the investment. Because if you are investing into the Wild West where you don’t know, you end up in explaining in some countries’ parliament, we’ve seen it, I mean, in the first phases of tech development. Why did you do this? Why did you do that? Because you didn’t tell us what is the regulation. And that is why I believe it is also very important in this region, which is also quite rich and important market, to come out with a certain set of standards to guarantee the security of the investment. This is extremely important. And this is what this country can do when others close here. I would also like to say that in my understanding, all we have to do is to go back to our very basic principles and values and apply them for every generation of technology. Not we have this one, we regulate this and so on. And these are human rights, the rights of nation states to organize their life as they please, that we do not force each other’s borders, all these basic principles. And simply to agree that never mind technology, this kind of decency, which we collectively have known for thousands of years, since Peloponnesus wars, basically, that this decency which applied then applies now and will apply at every new technological level.

John Defterios:
Interesting. Before I bring in the former Foreign Minister of India, I’d love to, if I can, Madam President, this is a key issue. And it’s one of those pillars that we talked about at the opening of the GCF in 2023. I say this kind of a jest, I have two daughters and they always say, that woman is impressive. She’s a girl boss. You know, she knows how to lead. I mean, you are the ultimate girl boss, president of Estonia. And it was a leader when it comes to technology. But why is it important, in your view, to get women more involved in cyber? And how do you match the curriculums of today? Because I always find, now that I’m a practicing professor, I find that it’s the business sector that goes to universities and says, we need this out of the pipeline. We need this sort of skills. And we need women engaged in this. And what’s the relationship between government and universities and the private sector? Do you want to tackle that for us? And Shem, I’d love to have you jump in as well, please.

Kersti Kaljulaid:
Well, I am an honest believer in market forces. And if Estonian technology sector, and we, by the way, have 10 unicorns per 1.3 million people, this is double the density of United States. If this sector comes together and establishes Unicorn Squad, which is the tech training only for girls, then there must be something in it. And you know, I think what there is, is what has nothing to do with cyber or digital technologies. It so happens that half of the populations are women. Therefore, half of the good ideas come into the heads of women. And if you do not tap into that reserve and these resources, then you are losing 50% of your capability. And this is a too big chance to lose for the markets. That is why Estonian tech sector has come together and done this work for the government.

John Defterios:
Good. But the universities, and I’d like to have Shem do that as well. Yeah, it’s worth noting that in the last six years, we’ve gone from almost zero female participation in the workforce to 37% and rising. It’s changing very quickly here, right? But Shem, do you want to cover this role of the universities to keep pace with the change in technology at the same time?

Shyam Saran:
You know, the big challenge really that I’m talking about the Indian experience. You know, at the end of the day, what are you trying to do? You are trying to wrap your analog mind over a digital space. And that’s very challenging. How do you how do you do that? And in that respect, you know, the participation of society in this whole endeavor, not something which is top down, but something which we see happening in India, it’s a very traditional society. And yet you see that because of these advancements in the digital space, there are good things happening. But there are also bad things happening, including as far as women’s rights are concerned. So this is something which really sort of makes you very much focused on how do you prevent those kind of negative things from happening. And participation of women in a very active way in this space is one of the ways that you can actually address those negative trends. You know, I am very impressed by the fact that in our host country, as a result of recent reforms, you have a very educated, you know, women constituency, 50%, which whose brain power has suddenly been added to this economy. And that’s a huge, huge resource, which has been brought into play. And I think in terms of cyberspace itself, if I’m not mistaken, women in Saudi Arabia are playing perhaps a very, very important and critical role. So this shows how, you know, in this space, having women as equal participants really kind of changes the societal impact of what is this technology doing to us. We have not really focused attention on the societal impact. There are, you know, impacts on the human psyche. There are impacts as far as society is concerned. And while we are very much focused on technology, perhaps we sometimes, you know, are guilty of forgetting about those kind of impacts, because we are so much dazzled by the technology that we don’t really look at the human aspect. That’s why I said with analog minds, you know, trying to manage cyberspace is not very easy.

John Defterios:
Okay. I’m going to circle back afterwards, Madam President, on your foundation before we finish the session, because you’re starting to study the impact on society of technology, which I think should be a very important component. Oftentimes you look at, you know, the cyberspace and AI and speed and access to information, it should be a calculation of the societal change. But I wanted to get the panel’s view. We did a podcast for the GCF, which is a phenomenal series, but we looked at it through the media, obviously, because of my experience. And I was suggesting cybersecurity should be a top five issue of society today. And then we had a debate within the GCF Institute saying, well, maybe over time, in a very near period of time, it should be a top three issue, because it touches everyone. Do you want to share where you think? Because it doesn’t seem to be on the top radar. If you poll people, they say inflation, worried about climate change, cost of living, right? Security, conflict. Where does cyber fit into that, President Barroso?

Jose Manuel Barroso:
I agree with your concern, because cybersecurity is more specific. It’s related to other issues that are very important top concerns, namely security. The word security. And now in the world, people, besides, of course, the economic situation that is affecting so many people, they are worried with security in general, and cybersecurity is part of that. But I believe it’s going to gain preeminence. It’s true also that in spite of the very important costs, namely for business, that are paying a big cost because of all the disruption, intrusion, all the problems that we are seeing in the business sector, the reality is that until now, knock on wood, there has not been a major, let’s say, catastrophic event globally of cybersecurity. Until now. For two reasons. Those who have the power to create it are not willing to create it. I mean, the governments that have the power to create a major disruption until now have avoided it. And also those who could create it that have not the capacity. I mean, non-state actors. Because if you think about terrorist organizations, or even, let’s say, criminal networks, that could be extremely disruptive until now, apparently, they have not yet the skills, the technical capability to create that major event. But what we have to think, in terms of risk management, is what happens if one of the biggest global players, state player, decides to create a real disruptive attack globally? Or if one terrorist organization or one criminal network is able to acquire that technology and we are not yet there, I hope we will not be. So but in terms of prudent management and risk management, in terms of wisdom, if I may use the word, what we have to do is to prepare for that situation. That’s why in linking to the last question we have put, I think it’s so important that the governments of the world, responsible governments of the world, they match the technological developments with the investment, public investment, including in skills. For instance, in Europe, the European Agency for Cyber Security estimates that we need 200,000 cyber experts. We are lacking men and women, of course, men and women. But we are lacking that. So we need more investment to manage the risk that can come from cyber security threats.

John Defterios:
Okay. I’m going to wrap it up. We had a longer time here, so I’m going to just ask for two final thoughts and we’ll conclude. Madam President, and then Cheyenne, please, very quickly.

Kersti Kaljulaid:
You mentioned my foundation. President Kaluulaj Foundation was set up to understand how Estonian society, which for 20 years and slightly more, is now receiving all public service online, how this has changed our society. And guess what? This year, we understood we have to establish Academy of Democracy for our youth. You know why? Because we came to understanding that when we went to school, you and I, then we learned our emotional intelligence from interacting with each other. And we for 10 years thought that we need to prepare our children for life in tech, surrounded by tech, in teaching them tech. But it’s actually counterintuitively that we have to teach them how to remain compassionate human beings. Yeah, absolutely. And this is the most valuable conclusion. Technology is not going to make us safe and secure. Being compassionate human beings, knowing how to remain a society through all the challenges, this is which finally defines the future of humankind. Maybe somebody is disappointed. It’s not technology. It’s still us. Thank you.

John Defterios:
Yeah, trying to find that balance is important. I completely agree. And I’m sorry to rush this, but Cheyenne, your final thoughts, and then we’ll say our thanks to you.

Shyam Saran:
Well, I would only say that at the end of the day, we are still physical beings, flesh and blood. And I think while we take the digital space as an instrument, it should not overwhelm us. I think that’s very, very important. Thank you.

John Defterios:
Good. What a fantastic session. I really appreciate the depth in which you gave the thoughts of all the major topics that we’re going to have over the next two days. President Barroso, thanks for the time yesterday. We had a deep discussion of where we’re going with cyber. So President Barroso, President Khadjajad, it’s nice to see you. Thank you very much. I’ll say Madam President and Minister Chiran, great to see you again here at the GCF. Can we give them a nice round of applause for the participation? Thank you. Well, thank you to our esteemed panelists. Let’s give another round of applause for what I think was a very frank and insightful discussion. We heard the former president of the European Commission there talk about the sincerity with which he was speaking. And I think all of our panelists, and I certainly appreciate that. I think that was a great start, not just to our two days here, but for all of us as we begin down the journey in building a safer and more resilient cyberspace. So let’s keep that in mind over the next two days, that we’re here to unite across industries and countries to forge that safer and more resilient cyberspace. Thank you, Your Royal Highness, for joining us this morning. Thank you, all of you, for being here so far. We are now going to take a little break before we tackle the big issues for a little coffee and tea, and then re-energize. We’re going to come right back here and reconvene in, let me say this nice and loudly to all of you, we’re going to reconvene right here in 15 minutes. Thank you.