Updates

Cyberconflict

2018

Symantec published a report revealing the details on the cyber espionage group acting in 2017-2018 to gather intelligence on targets in telecom and IT services that opened the access to oil and gas sector mainly in Pakistan and Turkey. Seedworm also affected Russia (11 victims belongs to one Russian firm), Saudi Arabia, Afghanistan, Jordan, and organizations in Europe and North America that have ties to the Middle East. The group used GitHub to store the malware and exploit several publicly available open-source tools like LaZagne and Crackmapexec which they customize to carry out their attacks.

The European Commission adopted an updated version of the EU cyber defence policy framework.  The purpose of the framework is to take into account the changing security challenges since the original framework of 2014. The updated framework identifies six priority areas for cyber defence: development of cyber defence capabilities, protection of the EU Common Security and Defence Policy (CSDP) communication and information networks, training and exercises, research and technology, civil-military cooperation and international cooperation. and clarifies the roles of the different European actors. It also clarifies the roles of European actors within these six areas, including EU member states, the European Commission, the European Defence Agency (EDA), the European External Action Service (EEAS), the European Security and Defence College (ESDC), the European Network and Information Security Agency (ENISA), the European Cybercrime Centre (EC3) and CERT-EU.

ASEAN countries signed multiple statements on deepening cooperation in cybersecurity with various key partners. During the East Asia Summit (EAS), ASEAN countries and their eight partners issued a statement on deepening cooperation in the security of information and communications technologies (ICTs), vowing to promote an open, secure, stable, accessible, and peaceful ICT environment; work together to protect their ICT networks and provide assistance to states that do not have sufficient capacities in this regard; foster cooperation to support a secure and resilient digital infrastructure; and strengthen cooperation on personal data protection. ASEAN countries also issued a joint statement with Russia, acknowledging the need to elaborate on the already proposed norms of responsible behaviour of states in cyberspace; the importance of developing a peaceful, secure, and resilient rules-based ICT environment; the need to prevent the use of information resources or technologies for criminal or terrorist purposes; and to narrow the digital divide. ASEAN countries stated they will consider the initiative of the Russian Federation on an ‘ASEAN-Russia Dialogue on ICT security-related issues’. On 16 November, ASEAN countries issued a statement on cybersecurity cooperation with the USA as well, pledging to strengthen cybersecurity in ASEAN; committing to promote norms of responsible state behaviour in cyberspace in peacetime developed by the UN Governmental Group of Experts (UN GGE) in 2015; and to explore ways and build capacities to counter the use of ICTs for terrorism as well as its forms and manifestations on the Internet. 

At the opening of the annual UN Internet Governance Forum (IGF), held at UNESCO premises in Paris, French President Emmanuel Macron launched the “Paris Call for Trust and Security in Cyberspace”, a high-level declaration on developing common principles for securing cyberspace. The Paris Call builds on the WSIS Tunis Agenda’s definition of the ‘respective roles’ of states and other stakeholders. It also resonates with the UN Group of Governmental Experts reaffirmation that international law applies to cyberspace. The declaration invites for support to victims both during peacetime and armed conflict, reaffirms Budapest Convention as the key tool for combating cybercrime, recognises the responsibility of private sector for products security, and calls for broad digital cooperation and capacity-building. It than invites signatories to, among other, prevent damaging general availability or integrity of the public core of the Internet, foreign intervention in electoral processes, ICT-enabled theft of intellectual property for competitive advantage, and non-state actors from ‘hacking-back’. The Paris Call has strong initial support from hundreds of signatories, including leading tech companies and many governments. Yet the USA, Russia, and China are missing. The declaration and its effects will be discussed again during the Paris Peace Forum in 2019, as well as during the IGF 2019 in Berlin.

The Global Commission on the Stability of Cyberspace (GCSC) has released its 'Singapore package' with the six new proposed norms for state and non-state behaviour. The norms focus on tampering with products, vulnerability disclosure and responsibility, botnets, cyber-hygiene, and conduct of offensive cyber operations by non-state actors. According to its Commissioners, the GCSC may still work on development of few additional norms, but will now put more focus on exploring the ways to steer other processes with its proposed norms.

Two new resolutions on cybersecurity issues have been adopted by the UN First Committee of the General Assembly (GA): one proposed by Russia by a vote of 109 in favour to 45 against, and the other by the USA with 139 in favour to 11 against. The resolution proposed by Russia (A/C.1/73/L.27.Rev.1), which has undergone number of changes since the draft was introduced mid-October, establishes an open-ended working group, to initially convene in June 2019, which will involve all interested states, hold intersessional consultations with business, NGOs and academia, and report to the UN GA in Autumn 2020. The group is mandated to, on a consensus basis, further develop the eleven norms of the 2015 report of the GGE (spelled out again in the resolution, but with certain changes in wording comparing to the GGE report) as well as the role of private sector and civil society, and discuss their implementation; it will also discuss models for ‘regular institutional dialogue with broad participation’ under the UN. The US resolution (A/C.1/73/L.37), underlines the reports of the UN GGE (2010, 2013, and 2015), and calls for the establishment of another GGE, mandated to further study norms, confidence-building measures and capacity-building measures, taking into account effective implementation of those, to report to the UN GA in Autumn 2021. It particularly suggests that the report should contain written national submissions on how international law applies to cyberspace. It also invites UNODA to conduct consultations with regional organisations (namely AU, EU, OAS, OSCE and the ASEAN Regional Forum), and the UN GGE chair to organise two open-ended informal consultative meetings with all the interested states.

Pages

 

The GIP Digital Watch observatory is provided by

in partnership with

and members of the GIP Steering Committee



 

GIP Digital Watch is operated by

Scroll to Top