Development of Cyber capacities in emerging economies | IGF 2023 Open Forum #6

Audience

During the discussion, several crucial topics were brought up, including digital diplomacy, cyber diplomacy, cyber capacity building, digital education, administrative risk, cyber security, DNS, OTT, CEO awareness, investment in cybersecurity tools in developing countries, AI in cyber intelligence, cyber certification, and cybersecurity education.

One of the main points emphasized was the need to differentiate between digital diplomacy and cyber diplomacy. A curious audience member posed the question to the speaker, highlighting the audience’s interest in understanding the distinction between these two terms.

Another key point was the importance of cyber capacity building in achieving broader development goals. It was argued that cyberspace is an integral part of a country’s development, and investment in securing cyberspace significantly affects the success rate of other policy initiatives. Academia and policymakers have stressed the need to integrate cyber capacity building and development policies.

The significant contribution of digital education in dealing with cyberspace issues and developing cybernetics was also highlighted. Digital education involves utilizing the internet critically and reflectively, and it was argued that long-term digital education can prepare a society for life in a cybernetic context.

The critical role of cyber security in economic development was another focal point of the discussion. Evidence from a research program sponsored by UNECA demonstrated that an increase in cyber security maturity could lead to a substantial increase in GDP per capita. The research incorporated data from Africa, Asia, and Latin America, providing a broader perspective on the impact of cyber security on economic growth.

The need for leadership and policymakers to recognize the connection between cyber security and economic development was emphasized. The results of the research program sponsored by UNECA were seen as a persuasive tool for promoting this understanding among decision-makers.

Concerns regarding the affordability and sustainability of investing in cybersecurity tools in developing countries were also raised. A concerned individual highlighted the challenges of providing affordable and sustainable cybersecurity solutions in countries with limited resources.

The discussion also touched on the challenges of balancing the use of AI in cyber intelligence and preventing its malicious misuse. It was noted that AI can be a powerful tool for cyber intelligence, but precautions must be taken to avoid its misuse for malicious purposes.

The deficit of cyber security experts and the expensive nature of cyber certification were also mentioned. It was argued that cyber certification is an expensive process, and there is a scarcity of skilled cyber security professionals, highlighting the need for more investment in cybersecurity education.

In terms of cybersecurity education, the level of education required was brought into question. The audience member wanted to know whether cybersecurity education should be basic or advanced, underscoring the importance of understanding the appropriate level of training needed in this field.

Overall, the discussion covered a wide range of topics related to digital diplomacy, cyber diplomacy, cyber capacity building, digital education, administrative risk, cyber security, DNS, OTT, CEO awareness, investment in cybersecurity tools in developing countries, AI in cyber intelligence, cyber certification, and cybersecurity education. The arguments and evidence presented shed light on the critical role these areas play in today’s digital world.

Sandy Palma

Central America is facing significant challenges in the field of cybersecurity. The region is underdeveloped in terms of cybersecurity, with a shortage of trained professionals in the field and limited availability of universities offering education in cybersecurity. This lack of expertise and education contributes to the vulnerability of Central America’s digital infrastructure.

One key issue is the underreporting of cybersecurity attacks in the region. Due to the absence of policies and laws around cybersecurity and the non-disclosure of cyber attacks, incidents often go unreported. It is only when individuals are personally affected and voice their experiences on social media that the wider public becomes aware of these violations. The low reporting rate hinders efforts to effectively address and mitigate cyber threats.

The exponential growth of cyberattacks in Central America has necessitated resilience in all sectors. The switch to virtualization as a response to the pandemic has made several academic centres, from preschools to high schools, victims of cyberattacks. To combat these threats, schools and universities have had to implement internal policies, rules, and protocols. This demonstrates the urgent need for increased resilience and cybersecurity measures in the region.

Another concern is the lack of participation from government authorities in platforms like the Internet Governance Forum (IGF). Over the past five years, only one decision-maker or government representative from Central America has taken part in the IGF. This lack of participation hampers the region’s ability to shape policies and strategies related to cybersecurity on a global scale.

Creating awareness through education and training is seen as essential in addressing cybersecurity issues. It is suggested that cybersecurity should be included in the curriculum, covering areas such as laws and computer rights. This would help to equip individuals with the necessary knowledge and skills to protect themselves and contribute to cybersecurity efforts. Furthermore, policymakers, who are mainly government authorities, should prioritize cybersecurity education within the region.

In conclusion, Central America faces significant challenges in cybersecurity. The region has a shortage of trained professionals and limited educational opportunities in the field, leading to vulnerabilities in its digital infrastructure. Cybersecurity attacks often go unreported due to the lack of policies and public awareness. The region must focus on building resilience and increasing participation in platforms like the IGF. Creating awareness through education and training is crucial in combating cybersecurity threats. By including cybersecurity in the educational curriculum and prioritising it as a policy agenda, Central America can address these challenges and enhance its cybersecurity capabilities.

Cláudio Lucena

Universities have faced criticism for their slow integration of cybersecurity into their formal curricula, resulting in a shortage of cybersecurity professionals. This has become a pressing issue as the scale and nature of cybersecurity threats have evolved with the increasing reliance on online activities. Traditional approaches to education may no longer be adequate to address the demand for skilled professionals in the field.

Furthermore, the importance of cybersecurity extends beyond just technical expertise. It is essential for universities, particularly those in the Global South, to play a significant role in promoting cybersecurity awareness. By understanding the importance of the digital ecosystem and cybersecurity, universities can adapt their curricula accordingly. Public universities in the Global South have the potential to effectively reach out and raise awareness about cybersecurity among their communities.

In addressing the digital transformation, it is crucial to consider the elderly population, who are often neglected in cybersecurity initiatives. Elderly individuals may lack the instinctive ability to navigate online activities safely and protect themselves from threats. However, initiatives like the UAMA program implemented by Paraíba State University in Brazil have shown promise in educating elderly people about cybersecurity. The results of the program’s first semester demonstrated a significant increase in awareness and participants’ ability to protect themselves online.

On the other hand, allowing elderly individuals to manage their own digital transformation without proper guidance can have negative consequences. It highlights the importance of providing targeted education and resources to ensure that the elderly are equipped with the necessary skills to navigate the online world safely.

Overall, academia in the Global South has tremendous potential for community engagement in cybersecurity awareness. Universities such as Paraíba State University have harnessed this power by implementing programs like UAMA. By actively engaging with communities, universities can contribute to reducing the cybersecurity skills gap and promoting a safer digital ecosystem.

In conclusion, universities need to restructure their cybersecurity education to keep pace with the evolving threat landscape. The integration of cybersecurity into formal curricula, especially in the Global South, is vital in creating awareness and bridging the skills gap. Additionally, targeted programs that focus on educating the elderly about cybersecurity are essential to ensure that everyone can participate safely in the digital transformation. To maximize their impact, universities in the Global South should leverage their potential for community engagement and work towards building a more secure online environment.

Christopher Painter

Capacity building in cybersecurity is highlighted as crucial for combatting threats and driving economic growth. It enables countries to navigate the challenges of digitisation and the digital economy effectively. The COVID-19 pandemic has further emphasized the reliance on technology, leading to the recognition of the necessity for robust cybersecurity measures.

Political buy-in is seen as essential for the long-term sustainability of cybersecurity objectives. Without political support, capacity-building efforts in cybersecurity would not be sustainable. Capacity building should be integrated into a country’s economic priorities to ensure commitment and success.

Cybersecurity has a tangible impact on creating trustworthy systems and facilitating economic success. Progress has been made in several countries in establishing reliable systems to counter various threats, demonstrating the positive potential of cybersecurity in enhancing economic growth.

The integration of cybersecurity into political and economic priorities is crucial, as it is not solely a technical issue but also a geopolitical and economic concern. Handling cybersecurity issues is compared to nuclear matters, underscoring its multifaceted nature and broader implications.

Efforts are being made to improve policymakers’ understanding of cybersecurity to address the evolving cyber threat landscape. There is growing recognition of the importance of cybersecurity among policymakers, as evidenced by increased awareness and prioritization of cybersecurity issues under various administrations.

The Department of Homeland Security has established an action board to review major cyber incidents. This board includes renowned experts like Jeff Moss and focuses on investigating and learning from cyber incidents while preparing reports.

There is a shift in how cybersecurity breaches are handled, with increasing requirements for disclosure due to changing laws and regulations. The Securities and Exchange Commission mandates publicly traded companies to disclose significant breach events, and Europe is introducing laws that compel companies to disclose cybersecurity breaches.

Digital diplomacy and cyber diplomacy are considered similar, focusing on economic aspects, telecommunications, cyber security, and geopolitical issues. The convergence of the development community and the cyber community is seen as critical, aiming to bring together different perspectives and expertise.

In summary, capacity building, political buy-in, and a multidimensional understanding of cybersecurity are central to addressing threats and driving economic growth. Efforts to educate policymakers and establish clear protocols and mechanisms are necessary to address cyber incidents. The evolving regulatory landscape and emphasis on transparency shape the future of cybersecurity.

Mark Datysgeld

The Domain Name System (DNS) is a crucial component of the internet, responsible for managing the translation of domain names into IP addresses. It operates most of the internet, enabling users to access websites, send emails, and use various applications. However, the security of the DNS has not always been given the necessary attention, leaving it vulnerable to abuse and exploitation by cybercriminals.

Neglecting DNS security can have severe consequences for the integrity and reliability of the internet. Cybercriminals can exploit weaknesses in the DNS to launch devastating attacks, such as phishing, botnets, malware distribution, and malicious spam. This not only puts users at risk but also undermines trust in online platforms and services.

To tackle these issues, there is an ongoing initiative to combat different forms of DNS abuse. The initiative focuses on specific use cases and recommends that registrars and registries, who operate the DNS, adopt measures to block these harmful practices. By implementing these measures, it aims to strengthen DNS security and safeguard the internet ecosystem.

Mark, who presided over the working group dedicated to DNS security, advocates for increased DNS security and the broad implementation of the proposed measures. His optimism stems from the belief that rules blocking the malicious use of DNS will be adopted worldwide within the next year. His advocacy highlights the importance of prioritising DNS security and taking proactive steps to mitigate the risks associated with DNS abuse.

Another aspect being emphasised is the need for operators to include reporting mechanisms in their contact forms. Users play a critical role in identifying and reporting DNS abuse. With an increased requirement for operators to include reporting options, users will have an easier way to directly report instances of abuse. This not only facilitates the reporting process but also enhances interaction between users and operators, ensuring prompt action is taken against malicious activities.

Moreover, educating people about the wide-ranging roles and importance of the DNS is crucial. Many individuals perceive the DNS as only relevant when they have a URL in their address bar. However, the DNS is integral to the functioning of most apps and devices, powering the entire internet infrastructure. By raising awareness and providing education on the significance of the DNS, users can develop a better understanding and appreciate its vital role in supporting online activities.

In conclusion, prioritising DNS security is essential for maintaining the integrity and reliability of the internet. The ongoing initiative to combat DNS abuse, along with the advocacy for increased security measures and reporting mechanisms, showcases the collective effort to address these issues. By raising awareness and educating people about the importance of the DNS, we can build a safer and more secure internet ecosystem for all users.

Olga Cavalli

The discussion focuses on the topic of cybersecurity in Latin America, particularly in relation to its importance, capacity building, resilient infrastructure, and the impact of immigration. One key argument raised is that cybersecurity is not seen as a primary concern in the region, as it is overshadowed by economic and security issues.

However, there is increasing recognition of the need for resilient infrastructure to effectively cope with cyber threats. Recent events related to ransomware attacks have highlighted the value of having a solid and resilient infrastructure. It is argued that without such infrastructure, economic development cannot occur. This positive link between resilient infrastructure and economic development is seen as crucial for the region.

One concern raised is the scarcity of specialized cybersecurity education programs in the region. It is noted that only a few universities offer programs or careers focused on cybersecurity. This lack of specialized education is seen as a significant obstacle in developing a strong cybersecurity workforce.

The lack of transparency and open discussion surrounding cyber attacks is also a concern. It is pointed out that the only way people get to know about these attacks is through individuals sharing their experiences on social media. This lack of transparency and open discussion is seen as a problem that needs to be addressed.

Another significant observation is the loss of cybersecurity professionals from developing economies to countries with higher demand. It is argued that the demand for cybersecurity professionals in other countries is causing a brain drain, depleting the talent pool in developing economies. This loss of professionals is seen as a challenge that needs to be addressed to ensure the cybersecurity capabilities and resilience of these economies.

The role of universities in generating cybersecurity experts is emphasized, and it is suggested that universities should play a vital role in offering cybersecurity education. Specifically, it is advocated that cybersecurity should be included as part of the formal curriculum in universities. This inclusion is seen as essential for developing a skilled workforce to meet the growing demand for cybersecurity professionals.

Furthermore, attention is drawn to the vulnerability of older adults in the digital world and the need for cybersecurity education that includes them. It is highlighted that older adults often lack digital literacy and are therefore more susceptible to online risks. This vulnerability underscores the importance of including all demographic groups, including the elderly, in cybersecurity measures and education.

In conclusion, the discussion underscores the importance of cybersecurity in Latin America and highlights various challenges and areas that need to be addressed. These include the lack of prioritization of cybersecurity, the scarcity of specialized education programs, the need for resilient infrastructure, and the vulnerability of older adults. The role of universities in generating cybersecurity experts and the importance of transparency and inclusion in cybersecurity initiatives are also emphasized.

José Cepeda

Spain is taking steps to enhance its understanding and awareness of critical infrastructures, with a particular emphasis on parliaments. The country is evaluating the critical nature of all parliaments in order to develop a comprehensive understanding of the potential risks and vulnerabilities they face. This signifies a positive development in Spain’s approach to safeguarding essential entities.

However, there exists a significant gap between the technical understanding of cybersecurity and the realm of politics. Many politicians lack the necessary technical knowledge to effectively make informed decisions regarding cybersecurity. This knowledge deficit often hinders the policymaking process and can lead to suboptimal outcomes. Therefore, it is crucial to bridge this gap to enable more effective decision-making in matters of cybersecurity.

To address this issue, Spain is collaborating with the Interparliamentary Union to formulate resolutions that define critical infrastructure. The focus of these resolutions is on parliaments, recognizing their indispensable role in the functioning of the state. By establishing clear definitions and guidelines, Spain aims to strengthen the protection of parliaments as essential entities within the broader critical infrastructure framework.

Local institutions in Spain, due to their limited security infrastructure, are particularly vulnerable to cyber attacks. The majority of attacks in Spain occur on Fridays at 5 p.m. This timing allows cyber attackers to operate throughout the weekend, when there are typically fewer personnel available to detect and respond to such incidents. This vulnerability highlights the urgent need to enhance the security measures and resources available to local institutions.

In response, the Spanish government is developing a hierarchical security infrastructure that caters to institutions at all levels. This initiative ensures that designated individuals at both the national level and in each autonomous region are responsible for the security of municipalities and corporations. Establishing a comprehensive security infrastructure is a positive step towards bolstering cybersecurity across various institutions in Spain.

Furthermore, there is a proposal to create an institutional shield aimed at safeguarding critical infrastructures. This shield would enable institutions, companies, and even citizens to connect with public administrations and governments for enhanced protection. It offers a coordinated and collaborative approach to cybersecurity, ensuring that all stakeholders have direct access to a network of resources and support.

Moreover, Spain is actively involved in developing a global report for the Interparliamentary Union, focusing on cybercrime. The report is currently being analyzed and debated in meetings at the Department of Communications. Additionally, there are plans for a world summit on cybersecurity at the United Nations, demonstrating Spain’s commitment to addressing this pressing issue at an international level.

Recognizing the United Nations’ potential to lead in cybersecurity, there is a proposal to leverage the organization’s resources to establish it as a paradigm of cybersecurity. This would involve utilizing the U.N.’s expertise and infrastructure to provide cybersecurity resources to regions, such as remote parts of Asia and Africa, that are particularly in need of support.

Lastly, an interesting proposition is being considered to create a technological branch called ‘Cyber Blue Helmets’ within the United Nations. Inspired by the current Blue Helmets body, this branch would be dedicated to providing worldwide cybersecurity coverage. This idea holds promise in enhancing global cybersecurity efforts and demonstrates a forward-thinking approach towards addressing cybersecurity challenges.

In conclusion, Spain is taking significant steps to improve its understanding of critical infrastructures, particularly in relation to parliaments. While there is a need to bridge the gap between technical cybersecurity understanding and politics, Spain’s collaboration with the Interparliamentary Union in formulating resolutions for defining critical infrastructure is a positive development. Enhancing the security infrastructure for local institutions and proposing an institutional shield to protect critical infrastructures further demonstrates Spain’s commitment to cybersecurity. Participation in the development of a global report and the proposal to make the United Nations a paradigm of cybersecurity showcases Spain’s international engagement in addressing cybercrime. Additionally, the prospect of ‘Cyber Blue Helmets’ within the U.N. highlights innovative thinking in providing worldwide cybersecurity coverage.

Olga Cavalli:
participants, but we are not able to I cannot I cannot open the zoom Okay, thank you Okay, thank you for for being with us in the meantime. Just let’s let’s start our conversation and They’re in okay, but I cannot I cannot see them I Moderate and moderate in the dark Okay, oh, I can mark the mark solution at all of problems. Okay. Thank you. Thank you very much for being with us so in respect of the time and people that are Punctually joining us this this afternoon. Let me introduce myself. My name is Olga Cavalli Presently, I am the national director of cybersecurity of Argentina and I also do the several other activities in in my Academic side. I am the director of the South School of Internet Governance and University teacher as well and with me I have a lot of friends and very well-known and respected specialists that were so kind to be with me this afternoon Mrs. Chris Painter Chris is he has been the first cyber diplomat in the world he’s very well known for his work with the President Obama and I I met him for the first time in IGF in Turkey and and since then we have been in contact and he has been participating in all the schools of Internet Governance that we organize in countries of the Americas whether in person or remotely he’s always keen to Help us with his knowledge and his presence and all the activities that sharing all the activities that he does With me is my dear friend Claudio Lucena Claudio is He’s a professor in Universidad de Paraíba in the northeast of Brazil We recently organized the South School of Internet Governance there in the beautiful city of Campina Grande where he lives and he is based there. So thank you for receiving us there. To my right I have my dear friend, Mark is one of these young jewels of the Internet governance space. He is very active in ICANN, he’s a GNSO Council Member, and also he’s involved in several research activities related with the Internet. And I have remote, my dear friend remote participants I have Sandy. Sandy, are you there? Are you there, dear?

Sandy Palma:
Hello, dear.

Olga Cavalli:
Hello, Sandy. Sandy Palma, she’s from Honduras. She’s the CEO of a non-governmental organization named Honduras Cibersegura. And she is very active in all related with cybersecurity. Also, she has been a student, a fellow of the South School of Internet Governance. And I have Jose. Jose, are you there? Jose Cepeda, he’s a diplomat, he’s a parliamentarian from Spain. Hello, dear Jose, how are you? Jose, good question. In between us, do you want to speak in Spanish or English? I don’t care, I can do a non-simultaneous translation if you prefer to speak in Spanish.

José Cepeda:
Well, the truth is that we prefer it, I think.

Olga Cavalli:
Okay, we always want the language. Okay, fantastic. No problem. No problem. So, I have drafted some questions for my dear colleagues. And I would like to start with Chris. Chris is now the… What’s the director? CEO?

Christopher Painter:
President, yeah.

Olga Cavalli:
President of the Global Forum of Cyber Expertise. And he travels all around the world contributing and organizing different capacity-building activities related with cybersecurity. And I have kind of a weird question. How do you see the impact of all the activities that you do around the world? Do you see that it’s really changing the cybersecurity… landscape in the countries that you visit, especially focusing on developing economies, countries that, what I see, at least in Latin America, is that priorities are always other priorities. It’s not cybersecurity, it’s not the main priority, it’s usually problems with economics, it’s the security, exporting goods, or some other problems related more mainly with economy. How do you see that evolving after, through all the work that you do? You feel that that has an impact and something is changing, and then we can ask some other questions to you. And thank you for being with us.

Christopher Painter:
Really happy to be here with my friend, Olga, and the other panelists, and all of you. Well, I shouldn’t say no, then I’d have to find another job. I’d just say, no, I do think it has an impact. And I should say that capacity building was one pillar of what I did when we started the office at the State Department, the Cyber Diplomacy Office. And now there are like 45 of them around the world, some of them are in this room, and that’s great. And that’s important to look at this as not just a technical issue, but also as a diplomatic issue, as a policy issue. And I’d say that, even back when we started the office, we were doing capacity building in different parts of Africa, other parts of the world. We also focused with the Organization of American States and others, and one of the reasons for that is I think of capacity building in the cyber realm, but really in everything, as the enabler for all, not just to fight all the bad things we see, all the threats that are continuing to grow and evolve, but also to enable all the good things we want out of the internet. And more importantly, to your point, Olga, to enable something that every country wants now, which is to seize on digitization, and seize on the digital economy, and take advantage of this relatively new platform where they all see, you know, this is bridging gaps between communities is always interesting. The security community doesn’t talk to the economic innovation community. This was true when I worked in the White House, too. There was a National Economic Council, National Security Council, they had different views of things, so they didn’t always coordinate. And when we did the cyber strategy at the White House, getting them together was itself kind of a Herculean effort because they’re just different viewpoints. So if you can message it in a way that both the security people and the economic people understand, which is this enables this digitization, this seizing of the digital economy that you all want to grow your economy, particularly in developing countries, that makes it something where they say, okay, this really is a priority, because that’s a priority. And if cyber security is going to enable that priority to succeed, then we want to be part of this. Then we understand what the end game is, that it’s not just a cost, it’s something that’s going to achieve something. And to get that, you often, you know, for this capacity building to work in cyber or anything else, you need real political buy-in. It can’t just be, you know, the technical people you’re training say, yes, we want more, which is great that they do. But if you don’t get the larger political buy-in, it’s not sustainable in the long term. You end up doing one-off trainings, one-off things that are great when they happen, but then five years later, it’s lost. So you need to have a sustained effort, get it ingrained in that country, and that’s really tying it to the economic priorities as well. And I think we’ve seen that, you know, the pandemic had a silver lining in the sense that countries recognized how reliant they were on these technologies, that it wasn’t optional anymore. And they see it in terms of infrastructure projects, water, power, financial, everything is controlled by cyber and security is something that will make that more trustworthy and also operational. So the couple things that I’d say is in Africa, we created a cyber experts group. I think that’s having real impact, certainly in the Latin American Caribbean region. I’m working through the OAS as our kind of regional hub too. We’ve been partnering with them. There’s been lots of great efforts to build certs. Computer emergency response teams have national strategies, which are the kind of framing policy document. And I have seen real, I think, impact there, which is good. ASEAN countries, I just came from Fiji, where we launched our Pacific hub, so for the Pacific Islands. More and more countries are understanding, and that was with the Deputy Prime Minister of Fiji, so I think, again, that political level was important. We’ve seen that connection, but we have to sustain this. And my organization was brought together to have more, as a community, really, it’s supposed to coordinate and make sure we put this on a higher level. And we’re having a big conference in Ghana, which is a worldwide conference, not just an Africa conference, at the end of November, to bring some of these communities together, including the traditional development community. We all know the SDGs, but the cyber community and the development community, again, two separate spheres, and bringing them together is critically important if we’re gonna make progress. So my long answer is, yes, there has been an impact. Yes, I’ve seen it. It’s hard to measure these things, but I’ve seen, I think, real progress in a number of countries as they, I think, create a more trustworthy system against all the threats that will help them succeed economically.

Olga Cavalli:
Thank you. I think that some recent events, perhaps related more with ransomware, are showing the value of having a resilient infrastructure and be aware and have a rising awareness about all these things. And I find very interesting the link that you make with the development of the economy. If we don’t have that infrastructure in shape, that won’t happen. So I think this latest new attacks are perhaps putting this issue more in the spot.

Christopher Painter:
Yeah, I mean, look, I’ve been doing cyber now for 33 years. So for a long time, I was a prosecutor prosecuting cyber crime cases when no one cared about them back in the 90s, and then went to help run the computer crime section was at the FBI, the White House, and the State Department. And through that whole time, the cyber people were not cyber people. but we do cyber stuff, we would be saying this needs to be a priority. And to be sure, in the US, under, at the end of the Bush administration, certainly the Obama administration, because his campaign was hacked into. And now in the Biden administration, it’s, you know, it’s, it’s a priority, but it can’t just be one priority of like 300. Right? When we had the ransomware attacks, where people had to wait in line for gas, where you might not get your hamburger, because it went after a meatpacking plant, where in the Irish healthcare system, you might have your healthcare impacted. That makes it a backyard issue. It makes it, it makes it a political issue. And it makes it a real priority. And so that’s what I’ve seen, not just in the US, but around the world is more and more, this is becoming a priority. The other thing is, the cyber people are pretty bad at explaining this, being the translators to policy people, you know, and we need that translation. We can’t make this a magic thing. It has to be something that they understand. This is a geopolitical issue. It is a capacity building issue. It’s an economic issue. And we need to put it in those terms. You know, I remember used to going and with the exception of Janet Reno, as the Attorney General, who got this completely early on, on cybercrime, but most senior ministers or cabinet officials for us, you talk about cyber, their eyes would roll back in the back of their heads and go, Oh, my God, that’s a technical issue. I’m afraid of that. They’re not afraid of like nuclear issues. And those are really technical, you don’t need to be a nuclear engineer to deal with those issues. And you don’t need to be to be a coder, to understand the implications of cyber and cybersecurity. You need to have some of those people on your staff, but you don’t need to be and I think we need to make sure that the policymakers can grasp that. And I’ve also seen that both in the government and in companies. And that’s, I think, a real change to

Olga Cavalli:
think this is why capacity building so important to build bridges in between technical people and policy people, which is always challenging, especially technicians and lawyers. No, I’m an engineer. Okay, José, are you there? José, did I miss you? Yes. Hi, I’m going to ask you a question in Spanish, but then I’m going to translate it and then I’ll give you the word. Of the comments you sent me for this workshop, I found this initiative that you are carrying out very interesting, these blue helmets, cyber blue helmets, and if you can tell us a little about that, and also another initiative of a mapping of critical infrastructures. Now I’m going to explain it in English and then I’ll give you the word, and after you speak, I’ll translate it into English. Thank you very much for being here with us. José Cepeda, he is a parliamentarian from Spain, and he has been going around the world, and he’s engaged in a very interesting initiative, perhaps you have heard of it, I’m sure you have heard about it. It’s a, how do you say helmet in English? Helmet. Helmet. Cyber helmet. Cyber helmet. And you’re involved in that initiative from the United Nations. José, maybe you can tell us about that, and also another initiative that you told me is about a map about cyber critical infrastructures and related with parliamentarian activities. So maybe you can start with the cyber helmet issue, and if you speak in Spanish, then I can translate to the audience. Many thanks for being with us this afternoon. Morning, early morning for you in Spain.

José Cepeda:
Muchas gracias. Thank you so much, Derek, for this meeting, and especially to Olga Cavalli. Thank you so much. I prefer to speak in Spanish because my English is very bad.

Olga Cavalli:
Sounds good.

José Cepeda:
Okay, okay. Well, thank you. The truth is that talking about the blue cyber helmets or talking about the maps of critical infrastructures in Spain in particular, for me it is a great opportunity in this world forum. I’m going to talk first about Spain, if you like, and then about the more international or more global part. With respect to Spain, it is true that they are developing, following a bit the last resolutions that we have approved in the Interparliamentary Union, a greater awareness of what it is and a greater deepening in the idea of what are really critical infrastructures. For example, we are already evaluating in a serious way that all the parliaments are critical infrastructures. Before, I liked a bit what Christo Cernó and Olga were talking about, about the fusion of the bridges between the technical and the political. I think it is essential. Unfortunately, there are not many politicians who understand technically cybersecurity. This often generates a problem when trying to make decisions.

Olga Cavalli:
Jose, I will translate. So, Spain is… He will focus first on Spain. They are developing resolutions, especially with the Interparliamentary Union, in definition of critical infrastructure. They are starting to think that the parliaments and the parliamentarians are a critical infrastructure. Also, he finds interesting this idea of building bridges between technical people and policy makers, and also the politicians to be involved with the value and the importance of cybersecurity. You go on. Sorry for interrupting you.

José Cepeda:
No, no, no. Thank you very much, Olga. What is happening? One of the biggest cyberattacks, we are seeing them, is being developed in the most basic local institutions. The majority of the attacks that we are receiving in Spain are usually on Fridays at 5 p.m. Why? Because this way they have the whole weekend free to be working when they know that there are no employees and there are no employees behind or controlling the machines. There should be, but there really are not, especially in the small institutions, in the local corporations, not in the municipalities. So, let’s say that from the institutions, from the government of Spain, an infrastructure has been developed that from the highest level to the lowest level, there is a capillarity in the responsibility when it comes to appointing. For example, there are people in charge at the national level, but then they have been created autonomously by regions, and then each of those regions is in charge, in turn, of helping and controlling each of the municipalities and corporations so that the whole institutional structure is protected.

Olga Cavalli:
Ok Jose, I will translate, In Spain they noticed that most of the attacks occur on Friday at 5 pm, so they have all the weekend to work with the infrastructure that they have intruded. So, the government has started to work with all levels of the government, which is national, regional, and municipal, local level. And also establishing responsible people, CISOs, responsible people of cybersecurity, in all of these different levels of the government. You go on, Jose.

José Cepeda:
Thank you. So, it is true that what has been taken as a decision is to develop this institutional shield so that all the critical infrastructures, not only the institutional ones, but from the institutions, there is the possibility of developing a map in each locality, in each region, and in the whole country. so that not only the question of institutions or politics, but that all companies can have direct access to this network, and in the end, even any citizen who may have a problem, so that they know where there can be a connection with public administrations, with governments, whether local, regional or the central government of the state, to protect all citizens and all companies and all infrastructures that depend directly on the government. Well, and if you don’t mind, now we are going to talk about the blue helmets, cyber blue helmets, right? As you well know, I have been working for some years on the development of a global report, precisely at the institutional level for the Interparliamentary Union, and this report is being analyzed and debated in the meetings that are being held at DOC on cybercrime and cyberterrorism, a commission at DOC that is being developed, supposedly for the future, the forecast is that there will be one or two years, to make a great world summit in the United Nations on cybersecurity, better known as cybercriminality, cybercrime, well, cyberterrorism and cybercrime in general, right? And it is true that in that context, the idea arose to look for the United Nations to become a paradigm of cybersecurity as well, right? If it is security at a global level, why not also provide it with resources, with means, so that they are also a little bit the leaders, that above all, as Christopher also commented, there are some places in the world where cybersecurity is very far away, for example in Africa, there are some remote places in Asia, some places in Africa. It is important that in the end, as in a pandemic, when we talk about cybersecurity, all countries have some minimum resources to protect themselves. And it is true that the United Nations can do a great job there. That is why our proposal is aimed at the fact that, if the Blue Helmets already exist as a structure of the United Nations, also to safeguard the decisions of the Security Council and safeguard and prevent conflicts that go further, as unfortunately we are seeing lately all over the world, our proposal would be for the United Nations to develop, even more so, the Blue Helmets body in a technological area that could provide coverage to all countries in the world.

Olga Cavalli:
So, there exists this concept of the Blue Helmets that are taking care of security and organized by the United Nations. So, he has been working with the Inter-Parliamentary Union to promote the creation of a summit in the United Nations focused on cybersecurity, cybercrime, with this United Nations paradigm focused on security. Why not having cyber helmets for cybersecurity, as they have already cyber normal Blue Helmets to try to help bring security to all different places in the world? So, the idea would be to develop this concept of cyber helmets in this summit that would happen in one or two years. I hope I haven’t forgotten anything. I think I’ve said everything. I’m receiving myself as a non-simultaneous translator.

José Cepeda:
Wonderful, wonderful. You translate fantastically well.

Olga Cavalli:
Thank you. Is there anything else you want to tell us for now? Then I’ll come back with another question, José.

José Cepeda:
No, in principle, nothing else. Thank you very much and I’m sorry for all this double work I’m commenting on.

Olga Cavalli:
That’s how I learn more. Your English is not bad. I’m going to tell you that for the little I heard, it was very good. Sandy, are you there?

Sandy Palma:
Hi, dear.

Olga Cavalli:
Hi, dear Sandy. There I see you. How beautiful the background.Now I have to switch to English, Sandy Palma, she’s from Honduras.edit She’s the CEO of a non-governmental organization named Honduras Cibersegura. And she has been very, very active, apart from the fact that she has been one of the students of our school several times. She was in Buenos Aires last year and she’s a good friend of our group and our community. Sandy, how do you see the situation in Central America? We see, especially, I see all these immigrants going through Central America, trying to reach the United States, going through borders. I don’t know how this has an impact in the infrastructure, how these people handle the situation. How do you see the situation in Central America in relation with cybersecurity? How do you see the capacity building in bringing a difference in that region? And thank you very much for being with us today. What time is for you? It must be the middle of the night. Thank you for that.

Sandy Palma:
No, just like Jose, I’m going to speak to you in Spanish because my English is not so good. Yes, it’s 12.40 in the morning, so it’s an honor. But no, don’t worry, I’ve been all these days at the same time. I’m going to speak in Spanish, so you have to translate as well.

Olga Cavalli:
It’s my turn, but did you understand what I said?

Sandy Palma:
Yes, the question, yes? Yes, I understood it, no problem, but I prefer in Spanish. Okay, in Central America, I tell you, we are like in diapers, we are at the capacities, professionally we are very few in the area, as well as at a global level, the reports indicate that there is a great need for professionals specialized in cybersecurity, however, there are very few universities in the region that allow you or have included the subject matter in their curriculum. I don’t know if I stop or continue, right? A little more and then I’ll translate. Okay, in terms of cybersecurity, as you all know, even one of our brother countries, Costa Rica, suffered very strong cyber security attacks at the governmental level, however, it is not the exception, this happens daily in all of Central America, the difference is that they are not made public, this happens at the private level, at the private sector and also at the public level, but since there is no director, there are no policies, there are no laws that talk about the subject matter, so they are not made public and all those affected realize only when the citizen uses a social network to report that he was a victim or his data was violated in a private or public institution. Otherwise, they are not made public, but we do have a big gap to cover in cybersecurity.

Olga Cavalli:
Sandi is saying that the region has a lack of professionals in cybersecurity, which I think, is a problem all around the world, and many professionals from developing economies are moving to being captured perhaps by other countries demanding the capacity of these professionals. They have a high necessity of infrastructure. Few universities have programs to train. And this is something that I want to speak with Claudio in a moment. Few universities have careers focused on cybersecurity. And a country in Central America, Costa Rica, we all know they have really suffered a very, very strong ransomware attack that practically immobilized the government for several days. So she said something very, very interesting that I have been thinking about after I heard something in the school in Campina Grande. Nobody talks about what is happening. The only way that people get to know about attacks is through some citizens explaining that something is happening in social networks. This is something complicated. And someone in the school said something very interesting, that the aviation industry uses all the information of every unfortunate event, like an accident, to improve the security of airplanes. And now we all know that it’s safer to go in an airplane than crossing the street. We all know that. But that is because and thanks to all the information that has been provided and captured after something wrong is happening. So someone said, I cannot recall who said that in the school. And I said, why don’t we find a way to capture all the details of the attacks? Perhaps taking away the name of the institution, or bank, or organization, or country that is being attacked. But using all this information to really try to improve. advance the way to solve or to be resilient. Sorry, I got excited telling a story that I heard in Brazil, Sandy, so now I give you the floor again. I don’t know if you understood what I said, that I found it very interesting from the aviation industry, to capture all the information to improve how to solve attacks. Now the floor is yours.

Sandy Palma:
Okay, well, look, here in the region we have had to be resilient in all sectors, even during the pandemic, we have seen exponential growth in cyberattacks, especially in the academia sector, right? Taking into account that they had to change their way, the way of teaching that they had decades to use, and they had to change it in 30 days, switch to virtualization. And many of these academic centers, from all levels, from preschool to high school, were victims of cyberattacks. So what happened? This did not stop. The universities did not stop, the schools did not stop, but they did have to be resilient in this regard, and start implementing policies, rules and protocols at the internal level. Although our countries do not have a national cyber security strategy, a national cyber security policy, or even the clearest example, if you look at the history of events like this, like the IGF, and look at how many government representatives have registered or have participated in Central America, you will realize that there is only one in the last five years. A single person, representative, decision-maker. I have participated, I have worked in the government sector, but I am not a decision-maker. There are ministers, there are chancellors, there are presidents, and no one has participated. And those who create policies are the government authorities, right? So there is something very important that we have to create awareness. And to achieve this, Olga, it is related to something that you indicated to me in the questions you sent me. What should we do? Well, how are we going to do it? And this cannot be achieved in any other way if we do not create awareness through education, training of public servers, of users, of people. And this is not easy to achieve. As I was saying, the academy has to include in its educational curriculum to talk about cybersecurity, as well as we talk about ethics, mathematics, science. We have to talk about cybersecurity, and cybersecurity is not only hacknetic, but also laws, computer rights, more and more.

Olga Cavalli:
And they had to develop their own internal policies, because some countries in the Central American region, as per what she is explaining, they don’t have a national cybersecurity strategy, or perhaps they don’t have the policies in place, so the different organizations have been organizing themselves in having their own internal policies. And she talks about the lack of participation, perhaps, in this forum of governmental officials, or people that are involved in developing policy, especially from Central America, and the importance of rising awareness and education of public servants, and the lack of activities in the academia. Sandy, can I give the floor now to Claudio, because I want to follow up a question to him in relation to what you have been saying. Is that okay?

Sandy Palma:
Yeah, sure.

Olga Cavalli:
Chris wants to make a comment in between.

Christopher Painter:
Yeah, so it’s interesting, this idea of doing something like the National Transportation Safety Board does for airplanes. in the U.S. And actually this is something I think our Department of Homeland Security, I’m no longer in the government, the Department of Homeland Security, has done is they have this action board to look at major cyber incidents. They have a number of luminaries on it, Jeff Moss, our friend and others, who look at things and try to learn and have reports on it. So it’s still in its infancy, but that’s exactly what they’re trying to do.

Olga Cavalli:
Yes, but what we notice, at least in Argentina, is that in general, who has been attacked doesn’t want to say because of different reasons. Because if it’s a bank, they want to keep their reputation for their customers. They don’t want that the customers go away to other banks because they think that their deposits will disappear. Or if you’re a government or government agency, perhaps you’d…

Christopher Painter:
But that’s been true for like 30 years, right? And I think it’s changing a little bit because now, in certain parts of the world, there are disclosure laws. If there is a breach, they have to disclose it. Securities regulators, like the Securities and Exchange Commission, are saying if you’re a publicly traded company and this is a significant event, you need to disclose it. Europe has laws they’re passing now as part of their package of laws. And I always used to say to companies who didn’t report it, and the same with government, better report it and get it out of the way, and people will understand that you’re on top of it. Then it’d be found out a year and a half later, then you risk more reputational harm, I think. But it’s still a challenge, I agree.

Olga Cavalli:
I think it’s challenging. I think it’s a process that it’s starting to be more transparent. But we still have a kind of a lack of transparency in general to learn from experience. Claudio, Sandy mentioned something that I think is really important, the role of universities. There are few universities that really have a career in cybersecurity. As far as I know, there is one university in Argentina, in Buenos Aires, the Universidad de…What is the name? No.Ok, I forgot No, no, no. Ok, I forgot I cannot remember the name of the university. They have created one career on cyber security. They have a very high demand of students. It’s not virtual yet. It’s still for some demands of the bureaucracy, local bureaucracy of universities, but they plan to go virtual. How do you see the role of universities? Because I’ve been a university teacher for 20 years and I teach these issues to my students but not as part of the formal program. I share with them information, try to motivate them to learn about these things, but it’s not really in the formal program of the career that they do, which is general informatics. How do you see that being someone so much involved in this process and being a university teacher?

Cláudio Lucena:
Thank you very much, Olga. Thanks for the invitation, for the space, and thank you. Good afternoon, everyone. That’s a very good question for which I obviously do not have the answer, I do not have the truth, but I might have a suggestion of a path to follow, and I think it should be based on at least three pillars. The first one is we have, from the academia, we have to acknowledge that the presence of the digital ecosystem is much more different now than it was 33 years ago when Chris started. I think that’s a very good starting point in scale and in nature. I’ll elaborate a little bit on it a bit more. Second, the university has to understand its role in the process and it’s difficult to make universities change. University professors who are here are already starting to laugh. And the third, it should be for universities to understand that traditional approaches, such as courses, curricular reform, as Sandy was mentioning, to us might not be good enough. It might not be enough for the amount of the challenge that we have. On the first point, back in, let’s say, 2005 in Tunis, and when the IGF started, cybersecurity was already an issue. So there were critical infrastructure. There were particular professions that were concerned about it. It was important, but still a niche thing, if we could say so. Fast forward 15 years, and now visiting a temple in Kyoto during the IGF might raise cybersecurity concerns. So it’s not only the scale, it’s the nature. I’ve written a paper during the pandemics that was an initiative from the Latin American office of the Conrad Adenauer Foundation. And we were trying to analyze cybersecurity aspects of what happened after the pandemics in the scenario of Latin America. There was some data that I collected from a friend from the University of Chile that stroke me absolutely. He mentioned that by February in the COVID time, before the COVID, right, before the declaration of the pandemics, 0.6% of the Chilean population had some online activity connected to labor. 0.6% of the Chilean labor force was somehow connected to working online. If he measured then it again in April, three months later, the percentage had risen to 5.6%. And he measured it again in July. The percentage had risen to 18% of the Chilean population doing some kind of regular activity connected to work. It’s not cybersecurity, but it’s attack surface. It’s an aspect of people that had not been online yet. And it’s a personal digital transformation that accelerated a lot. So that is to end this point is to say a lot of our life. It’s not a niche thing. It’s not an aspect. It’s not a fraction of the human lives. Cybersecurity is an embedded aspect, an embedded dimension of everyone’s life that touches, it’s a backyard issue. So I think this consciousness is not obvious to universities. And the second and third points, I think they’re together. And this, I speak a little bit more from a Global South perspective in public universities to be very specific. Because those are institutions that have a different role in the Global South. They have a different outreach. They are able to work on that awareness. And as I say, bringing you numbers, Sandy here brought a deficit of cybersecurity professionals. I have an estimate of around 300,000 professionals that we lack today around that mark. And I can confirm that 300,000 professionals in Brazil only. We do not and we will not fill that gap with regular courses, reforming curricula, formalizing this. For one, because the university simply does not do that. We do not reform curricula overnight or depending on that.

Olga Cavalli:
Takes forever.

Cláudio Lucena:
Yeah. So thinking about other alternatives, but the university and the academia in general and in the Global South, it happens a lot. We have a huge mobilizing power, community engagement. So through other alternatives, we can try to hit one of those aspects. And I can bring you a good practice from my university, Paraíba State University, which is the UAMA, which stands in Portuguese for the Open University to the Elderly. I think it’s something we discussed over the SIG. It’s a program. It’s a formalized program in the university that is directed to the elder, 60 plus people. We include various, the idea of the program is to bring them back to the university and make them do interesting things in life again. So they have language classes. health for their age, human rights notions. And then last year, in the beginning of last year, because they have suffered a lot in their personal process of digital transformation, that was a segment of the population that was hitting hard. So the director of the program asked me, he phoned the law school and said, why can’t we prepare a cybersecurity course for these people, 60 plus? And I thought the idea was just brilliant. And then I thought, looking at stakeholder-wise, and it seems like that for children, we’re very much concerned. They learn how to grow up in this environment. We help them navigate. It’s pretty much taken care of. It’s far from being solved. They’re far from being safe, but it’s pretty much taken care of. For us, we manage, right? We’ll get around, we’ll get around. But it seems that for 60 plus, we have just forgotten them. Just left them on their own. And they do not instinctively act adequately and appropriately. And the results of that first semester of two groups with 30 people was absolutely amazing. How much engaged, how much more aware they were, how much more they were able to defend themselves in this environment. Because then again, and I close here, the cybersecurity dimension that we have to tackle today is not only institutional anymore. It’s not only collective anymore. It’s also on an individual basis. And I think universities have an incredible role that can play in this, provided that they meet these three aspects and understand those three criteria.

Olga Cavalli:
It’s interesting what you mentioned, because where I work in the directory of cybersecurity, we’re promoting some papers that we’re writing. And I did write about old people, because I experienced that with my mom. And she had a Facebook and she used… She died two years ago, but she used a lot of social networks. And she tended to believe that everyone was thinking like her because all the people were her friends. And it was very difficult for me to explain to her that that was not the whole universe of the connected world. And yeah, she was very vulnerable about the information that we received, what she read. And I think that’s a target that it’s totally forgotten. And I agree with you. And so I wrote something about that. So now I will go to my dear friend Mark. He has been so kind to do the translation in the chat of the Zoom room when I was translating into English and Spanish, which is my new profession now. Mark is very active in the GNSO. GNSO is one of the spaces of participation of ICANN. ICANN is the organization that gathers all the different millions of different networks in the world together through some unique identifiers. And one of these unique identifiers is the domain name system. And Mark has been working very actively in a working group about security in the domain name system. So why don’t you share, Mark, with us what is that? And how does it affect the cybersecurity? And what us should know about that and how people can learn about it? And thank you for your participation here.

Mark Datysgeld:
Thank you so much, Olga. It’s a pleasure to be here with everyone. I will try to be that guy that is the bridge between the technical and the normal. So let’s give this a try. So when we talk about the domain name system, we’re talking about pretty much anything that resolves using that system. People don’t think about that. But when you’re using WhatsApp, it is using the DNS. You just don’t see it. So, the Domain Name System actually operates most of the internet as we know it. So, it’s one of the only, one of the few shared resources that we really have in the world, that are truly global. And that’s why caring for its security should be a priority. The problem is, and we have people here in the room who are very active in ICANN as well, who can say I’m wrong or right, but for a long time this was not put as a priority. This was put as something important to be looked into, and certain aspects of security were maintained, but that was on the very, very deep technical level, at the security level of the protocol. So, it’s like, how secure is the technical part of the DNS, right? Is it running smoothly? Can it be tempered with? That was the concern for a long time. But, as we see an increasing amount of cyber attacks, different types of initiatives that really seek to harm users around the world, then we had to expand the conversation a little bit. Who are the actors who are using the DNS to do things that are simply not secure, that simply do not fulfill the mission of the DNS, which is being reliable, secure and available for all? And there are some cases in which we arrived at that simply do not have a positive use. So, the operation of a botnet, there are no good botnets out there. There’s nobody doing charitable, nice things with a botnet. It’s always criminals and always of the worst kind as well, might I add. So, why are we allowing these people to make use of the system that is a global good, to leverage this for their attacks, right? That was the sort of question that started this working group, this process that I chaired. And the reality is that there are a few categories. of questions that we arrived at, that we believe are not good uses of the DNS. And as a working group, we recommended that to the people who run the systems of the DNS. So we’re talking here about the registrars and registries, which are basically the people who either have custody over a certain suffix, like say .ninja, or they sell those domain names using that suffix. And we approached them and said, you know, we think that in this very specific, very narrow use cases, this cannot go on. So we settled into a list that is basically botnets. So for those who don’t know, it’s basically leveraging machines from around the world to carry out a concerted attack or to carry out a disruption in mass. So phishing, which is sites that impersonate another institution or another organization and use that to steal credentials from users. Malware distribution, so it’s sites that only exist to perpetuate malware. So there is no other use for that domain name other than spreading a virus or an attack or being a bridge for an attack. There’s nothing else there other than that. And farming, which is when a website only exists to collect information of users for malicious purposes. There’s also an addition to that, which is spam. But when I mention spam, you shouldn’t really think about it that way because it’s spam as a vector to the things that I said before. It’s very specific, right? So this is not about fighting spam, which might have legitimate users. It’s about fighting spam that leads a user to a malware website. And this has been presented to these operators, and so far what we think is that they agree with us that this is something that would be desirable. that it would be better for the Internet if they adopted these changes to block these specific use cases. So, the term that we use is DNS abuse, but if we are to be very, very accurate, it’s technical DNS abuse. We’re talking intellectual property infringements, anything that has to do with honor or anything like that, anything that’s content is not going to be touched upon by that because ICANN has a technical mission. What we’re trying to fight is some forms, this is not even all forms, right, we didn’t actually arrive at all forms, but we arrived at some forms that malicious people used to leverage the DNS in a negative way, and we are now in very deep into the negotiation of this being a standard. For the entire world, no. So, it is for generic names. The country codes, they operate under their own rules. We hope that some of them adopt this or want to talk to us about this or think that this is a good idea, but this is each nation’s prerogative. So, our expectation is that within the next year or so, this will come to be, these new rules will come to be, and with that, we’ll be able to add a little bit extra security to the Internet. It’s not even like the tip of the iceberg, but we are hoping that at least we can show that we are actually looking into this, that this is not a known issue and that we understand that there are very, very bad criminals leveraging this public resource for things that it should not be used for. So, that’s the general idea. If anybody is more interested in this, I can offer more technical material, but this is the overview, sort of. So, thank you very much for your attention.

Olga Cavalli:
Marc, this is an issue of operators only or global cities, individuals can have a say or do something? to prevent that? Can I do something against the DNS abuse or just have to suffer it and hope that my operator or my registrar do something about it? How do you think?

Mark Datysgeld:
So as part of this, that’s actually a very good question, as part of this agreement, we’re also upping the requirements for what these operators need to include in their contact forms. Before it was very much like whatever you want, right? They needed to have some form of reporting available on their website. So you go to a big registrar, I’m not gonna cite names, but like a big registrar that sells a lot of domain names, right? And you have identified that they are the ones operating a malicious domain name. Right now, if you go there, you don’t, it’s not very clear where you can report something, but that’s gonna be standardized. It’s gonna go into their contracts that they need to have something that’s actually, the user can get there and say, hey, I noticed that this website is a phishing operation. It’s copying this website, I have the proof, here are the elements, here’s the proof of this, here are the comparisons, and this will enable people who are looking into the system to verify. That’s not an automated thing, it’s never gonna be that. It’s literally a way for you to communicate with these operators very directly. At the end of the day, it’s still their call, but we are making an effort so that people actually can report this thing. So supposing your business was cloned and you’re currently suffering an attack from that, now you can report that at the international level, which, you know, I think it’s a big win. But, you know, opinions may diverge, but still, I consider it a win.

Olga Cavalli:
That’s an event that we usually see in the national CSIRT and people having problems with domains. Okay, we have like eight minutes, any comments, questions from the audience? Yes, there’s a mic there, can you go to the mic? And can you tell us your name and where you’re from?

Audience:
Thank you. My name is James. Oh, no. My name is James. I’m from Cameroon. So my question go to- Chris, our star. The man in the middle. So quite frankly, I’d like to understand the difference between digital diplomacy and cyber diplomacy.

Olga Cavalli:
Oh, that’s a- Thank you very much. Slight difference, eh? I’ll take all the questions first. Yeah, please. Yeah, we don’t have much time.

Audience:
Hi, everyone. Good afternoon. My name is Paloma. I’m from northeast of Brazil. I would like to congratulate the panel. These speeches were wonderful and necessary, of course. Then my question, especially taking Cloud’s speech about the digitalization of personal life and the attack on individual base. And your speech, I forgot your name, sorry. When you told us that everybody’s using DNS, while we are using WhatsApp, but most people don’t see it, or about phishing cases, something like that. Well, it become clear that cyberspace is an intrinsic part of the development of any country. A strong cyber capacity is crucial for states to progress and develop in economic, political, and social spheres. The need to integrate cyber capacity building and development policies has been documented by the academia and the policy makers. And the other sectors from society. The investment in securing cyberspace affects the success rate or other policy initiative as well. However, there is a clear need for a deeper dialogue with the development community and received countries in order to better to understand how to implement cyber capacities in practice in order to achieve broader development goals. So to stimulate the debate on cyber capacity building and its impacts on social and economic development worldwide, I’d like to understand your opinion about the contribution of digital education to this issue. Since digital education involves not only learning how to use platforms and tools, but also involves a critical and reflective use of the internet and its possibilities and is capable of, in long term of course, preparing a society for life in a cybernet context. And I’m including this topic at the debate because I think that it’s a thing, it’s something really important when we are talking about administrative risk or better, we are talking about to define what kind of risk I’m able to support and to know that I need to understand which are the risks and the impacts in my society, business or whatever. I don’t know if I made myself clear, but that’s my question, contribution to the panel. Thank you.

Olga Cavalli:
We have like four minutes, so you can take all the questions.

Audience:
Okay, my name is James Ndolufuyi from Abuja, Nigeria. I have a comment and then a question. First to Chris, on the issue of connecting cyber security to development. Last year, UNECA sponsored a research program which was released at the IGF in Ethiopia. Chris, you were there and I had the privilege of actually conducting that research. I was able to really measure it, measure maturity, cyber security maturity to development as a way of persuading leadership, policy makers to see the connection. In that study, a 10% increase in cyber security maturity could yield between 0.66% and 5.4% increase in GDP per capita. And that used data from Africa, Asia and Latin America. So it’s available on the website, at least some of the data is available on the website www.cd4ir.africa. So you can check it there. The secondly, where is Mark? Okay, the question is for Mark.

Olga Cavalli:
He’s trying to get more minutes for us.

Audience:
Okay.

Olga Cavalli:
It’s very, very important.

Audience:
Okay, Mark talked about DNS with WhatsApp. I want him to expand it further because there is what we call the OTT. The number of this OTT don’t really need to depend on the root system. So I want to expand it on what you mean by even using WhatsApp. You know, there are a lot of OTT over the top application. Thank you. Good afternoon, everyone. I’m Christine Mujimba. I work with a regulator, communications regulator in Uganda. And we operate as SART there for the communication sector. So information sharing indeed is like Olga said, there’s reputational risk. And so especially the financial sector tends to keep it back. But what we have done is to have an awareness of the CEOs of companies so that they don’t see this as a technical issue. And they begin to invest in it. But I’m curious to know about investment in tools. We are talking about capacity building, but we need the eyes to know what’s happening. And that is really very, very expensive. And in developing countries, or emerging economies like we are talking, it cannot be, it’s not affordable and sustainable. So I’d like to hear from the panelists what is being done in that area. The other, when Mark mentioned, and I appreciate the issue of botnets and them only being malicious, but I know that there are use cases of AI in terms of the cyber intelligence. So where is the balancing act when they are deployed for those purposes? Especially since you said you have a list. I don’t know if it’s a black list or a white list. And then lastly, on the cyber certification, again, this is very expensive, and yes, there’s a deficit of cyber security experts. So what level are you looking at? Just the basics like how you’re taught as a child to look left, right, left, right before you cross the road, not to share your pin, things like that. Is it at that level, like with the elderly, or is it at a higher level? Thank you.

Olga Cavalli:
Okay, we have running out of time. I’m so sorry. Next year, I will book one hour and a half. I promise. My proposal is that we find a moment outside. Do you have five more minutes? Maybe you can respond quickly, and then we have to cut off the queue. I’m so sorry for that.

Christopher Painter:
Those were all great questions. Digital diplomacy and cyber diplomacy, they’re similar. I think digital diplomacy has often been the economic aspects and telecommunications, where cyber was the larger cyber security, geopolitical issues, but I think they’re merging. I think that I’d say that. I think the question about, I agree, bringing the development community and the cyber community together is critically important, and that’s what our conference in Ghana is trying to do, and a lot of our efforts are trying to do. I thank you on the GDP issue. I think that’s an important one that shows actual impact of this work, and I think that helps drive decision maker and money and funding, which is scarce, so that’s really good. So those are the ones I’ll quickly comment on. There’s many others. I wish I had more time, sorry.

Mark Datysgeld:
Yeah, very quickly, I’ll go back to my comment. This is something that I always mention when I’m giving classes. People think that the DNS only works when you have an URL on your address bar, so that’s where the DNS exists, and you go, you type, and that’s the DNS, but the DNS operates when you find something on a search engine. The DNS exists when you’re operating any app, pretty much, because they use DNS routing to actually function, so these protocols, they exist everywhere. It doesn’t matter if you’re using it through an app, if you’re using it on your microwave, or whatever you’re using, and we don’t do enough to explain this to users, so they think that this is a very specific thing. Oh, it’s about having a domain name. It’s not that. It’s an entire system that sort of runs the internet, so people can’t appreciate the importance of it because they don’t understand that it’s not just owning your name, dots, anything. Thank you.

Olga Cavalli:
Okay, big applause to everyone. Thank you, Chris. Thank you, Mark. Thank you, Claudio. Gracias, Jose. Gracias, Sandy. Muchas gracias a todos. I promise next time I will book more time. Thank you so much, Chris.

Audience:
I’m here all week, so I’ll see you guys around. Great meeting you. Congrats. Great meeting you too. Thanks a lot. Thank you.