Search

Begin New Search Topic Cybersecurity Political Geography Europe

21. The sixth domain: The role of the private sector in warfare

Author:
Franklin D. Kramer
Publication Date:
10-2023
Content Type:
Special Report
Institution:
Atlantic Council
Abstract:
The United States and its allies have for some time recognized, as NATO doctrine provides, five operational domains—air, land, maritime, cyberspace, and space.1 Each of those arenas fully fits with the understanding of a domain as a “specified sphere of activity” and, in each, militaries undertake critical wartime actions. But in the ongoing Ukraine-Russia war, certain key operational activities have been undertaken by the private sector as part of the conduct of warfare.2 By way of example, private-sector companies have been instrumental both in providing effective cybersecurity and in maintaining working information technology networks. As part of such efforts, these firms have established coordinated mechanisms to work with relevant government actors. These operational and coordinated activities by the private sector demonstrate that there is a “sixth domain”—specifically, the “sphere of activities” of the private sector in warfare—that needs to be included as part of warfighting constructs, plans, preparations, and actions if the United States and its allies are to prevail in future conflicts. As will be elaborated below, that sphere of activities focuses mainly on the roles of information and critical infrastructures, including their intersections—ranging from the transmission and protection of information to the assurance of critical infrastructure operations. Many of the United States’ activities in the sixth domain will take place in the United States homeland. However, while “defending the homeland” is listed as the first priority in the 2022 National Defense Strategy, insufficient attention has been paid to the actions that will be required of the private sector beyond just the defense industrial base as part of accomplishing an effective defense.3 Likewise, when US military forces are engaged in overseas combat, private-sector companies in allied countries (as well as US companies operating overseas) will be critical for the effectiveness of US forces, as well as for the allies’ own militaries. In short, establishing an effective strategy for the private sector in warfare is a key requirement for the United States and its allies.
Topic:
Cybersecurity, Drones, Artificial Intelligence, Private Sector, Defense Industry, and Russia-Ukraine War
Political Geography:
Russia, Europe, Ukraine, and United States of America

22. The Economic Impacts of the Proposed EUCS Exclusionary Requirements: Estimates for EU Member States

Author:
Matthias Bauer and Philipp Lamprecht
Publication Date:
10-2023
Content Type:
Working Paper
Institution:
European Centre for International Political Economy (ECIPE)
Abstract:
The EU Agency for Network and Information Security (ENISA) is proposing a far-reaching “European Cybersecurity Certification Scheme for Cloud Services“ (EUCS) to be established in the European Union (EU). According to the latest draft of August 2023, leaked by Politico in September 2023, the proposed EUCS would by design prevent non-European vendors from providing “high assurance level” cloud services in the EU. In this study, we show that the proposed “immunity” requirements, i.e., foreign ownership and headquarter restrictions, local staff requirements, and data localisation would lead to significant losses in Member States’ aggregate economic activity and drive a big wedge between economic growth in the EU and the growth of non-EU economies. The projected losses in annual EU GDP will vary from EUR 610 billion to EUR 29 billion within approx. two years of implementation, contingent upon the specific sectoral coverage of high-assurance use cases under the cloud service evaluation level CS-EL4. The results fit into the overall picture of EU digital policy, which has weakened rather than strengthened the competitiveness of EU industries in the past. Our findings align with the broader impacts of EU digital policy, which runs the risk of exacerbating the growth gap and technology disparity between the EU and other advanced economies. Cloud services have become increasingly popular and integral to Europe’s economy. Cloud services are granting businesses of all sizes equal access to global data and resources, stimulating collaboration, and bolstering competitiveness. Advanced cloud services are levelling the playing field in domestic commerce and international trade. Smaller enterprises can harness advanced IT capabilities, particularly cloud-based supply chain management, to streamline their operations. Cloud computing solutions are also playing a crucial role in modernising public services, offering transformative potential for government administrations and service quality. Cloud services adoption is expected to grow substantially in the years ahead, driven by data analytics, AI applications as well as quantum and edge commuting solutions. The global cloud computing market is on a rapid growth trajectory and is expected to reach some EUR 2,080 billion by 2030. Industry forecasts indicate that cloud services and transversal cloud-based technologies like AI applications, quantum, and edge computing will experience consistent growth in innovation and are increasingly finding broader applications across various industries. Overall, the global market for IT services is highly competitive and dynamic, with global cloud service providers competing against a broad range of IT service providers of varying scale, including on-premises hardware vendors, private and co-located data centre providers and software providers. Despite showing a trade deficit in international cloud services trade, trade in ICT and digitally enabled services is not a one-way-street for the EU. Recent trade data reveals that the total value of EU exports in digital and digitally enabled services to the rest of the world is roughly equivalent to the total value of EU imports from the rest of the world. This balance in trade is also observed in EU digital trade with the US, where EU exports of ICT services to the US nearly match US exports of digital services to the EU. The proposed EUCS exclusionary requirements entail various negative consequences. As recognised by the European Commission’s latest progress report on digitisation in the EU, European companies have yet to reach the “Digital Decade” targets, especially when it comes to embracing cloud-supported technologies such as AI and big data, as the adoption of digital technologies remains significantly below these objectives.[1] Exclusionary requirements would create operational inefficiencies and increased production costs for cloud services providers and cloud adopters. They would undermine investments in the domestic economy, resulting in reduced international trade, competition, and innovation. The imposition of exclusionary requirements by the EU could create a domino effect of restrictions caused by retaliation and protectionism. Data localisation and nationality requirements stifle innovation and competition, particularly in data-driven industries. The creation of redundant capacities in the EU would have adverse environmental impacts, including increased energy consumption, land use, and electronic waste. Immunity requirements would increase rather than mitigate cybersecurity risks, creating a security deficit for EU cloud adopters that lose access to proven global risk detection and prevention solutions. This study provides estimates of potential GDP and industry output effects from the implementation of exclusionary requirements under the proposed EUCS framework.[2] It is shown that the strict “immunity” requirements in the EUCS cybersecurity certification framework would severely limit European customers’ access to advanced technologies, innovation and global ICT industry growth trends. The study’s findings highlight the significant economic consequences of potential restrictions on access to global cloud services across three scenarios of different sectoral coverage. It is shown that even in the least restrictive scenario, where “immunity” requirements would only be applied to a narrow spectrum of sectors and highly critical use cases, the reduction in the EU’s annual GDP could be substantial. In scenario 1 (broad critical sector coverage), reflecting political demands of the current French government, the EU’s annual GDP is projected to decrease by 3.9% when accounting for lost cloud capacities and forgone cloud capacity and productivity growth, within 2 years of implementation. For scenario 2 (medium critical sector coverage) and scenario 3 (narrow critical sector coverage), the estimated annual losses in GDP amount to -2% and -0.2%, respectively. In terms of current EU GDP, annual losses would amount to EUR 610 billion, EUR 317 billion, and EUR 29 billion, respectively, underscoring the significant magnitude of the potential impacts. For the broad critical sector coverage scenario, our results also show that the EU’s annual GDP losses accumulate over longer periods of time. After 5 years following the implementation of exclusionary EUCS requirements, the annual growth losses for the EU and its Member States remain significant. This is due to the inability of European businesses and the EU’s public sector to tap into the worldwide innovation and productivity gains offered by globally accessible technologies and services. For the EU, we estimate the annual GDP loss to be -3.6%, with a trend to further accumulate in subsequent years.
Topic:
Science and Technology, European Union, Cybersecurity, Digital Economy, and Digitization
Political Geography:
Europe

23. The Weight of History: Challenges for Police in the Governance of Cybercrime in Spain

Author:
Cristina Del Real
Publication Date:
12-2023
Content Type:
Journal Article
Journal:
Journal on International Security Studies (RESI)
Institution:
International Security Studies Group (GESI) at the University of Granada
Abstract:
El cibercrimen presenta diversos desafíos para la policía, incluyendo la complejidad y globalidad de las acciones criminales, la dificultad de rastrear el ciberespacio y la constante evolución de estas actividades delictivas. A través del marco conceptual de institucionalismo histórico y discursivo, este artículo explora los retos de la policía en la gobernanza del cibercrimen en España. El artículo destaca la importancia de situar la policía en el contexto del sistema de gobernanza de la ciberseguridad para comprender sus desafíos y adaptaciones. A través del análisis de 36 documentos clave, se argumenta que los orígenes y la evolución de las políticas de ciberseguridad se fundamentaron en narrativas centradas en la protección de la información y el incremento de la confianza de la sociedad en las tecnologías digitales, ambas narrativas alejadas del discurso centrado en la ciberdelincuencia. El estudio de caso en España enriquece la literatura sobre gobernanza de la ciberseguridad al explorar cómo la evolución histórica y las narrativas impactan en la posición de los actores involucrados en el sistema de gobernanza.
Topic:
Crime, Governance, Cybersecurity, Institutionalism, and Police
Political Geography:
Europe and Spain

24. The Cyber Defense Assistance Imperative – Lessons from Ukraine

Author:
Aspen Digital
Publication Date:
02-2023
Content Type:
Special Report
Institution:
Aspen Institute
Abstract:
Russia’s further invasion of Ukraine in February 2022 was a watershed moment, and unique in that a major nation-state had engaged in coordinated, convergent digital and physical attacks in an effort to conquer a neighboring country. Leaders will draw lessons from this conflict for years, but one is already clear: the ability to deliver cyber defense assistance must be a key national security capability. Informed by the ongoing work of a variety of organizations providing operational cyber support to Ukrainian institutions through the Cyber Defense Assistance Collaborative, this paper seeks to define cyber defense assistance, outline its primary component parts, and identify key lessons learned that can help inform how such assistance can be provided in future geopolitical conflicts. It also makes the case that an effective national security toolkit requires the ability to deliver cyber defense assistance to allies.
Topic:
Defense Policy, National Security, Cybersecurity, and Russia-Ukraine War
Political Geography:
Russia, Europe, and Ukraine

25. Why Belgium Needs a Cyber Command

Author:
Alexander Mattelaer
Publication Date:
11-2022
Content Type:
Policy Brief
Institution:
EGMONT - The Royal Institute for International Relations
Abstract:
On 19 October 2022, the Belgian Ministry of Defence declared the Initial Operating Capability of its new Cyber Command. Responding to the trend of states seeking competitive advantages in a new operational domain – as illustrated by several high-profile cyber-attacks on Belgian State institutions – the choice for developing a new instrument of statecraft has been made. This Egmont Policy Brief outlines the growing importance of developing cyber defence capabilities, discusses the organisational set-up for this Cyber Command, and finally zooms in on the challenges ahead.
Topic:
Security, Defense Policy, Cybersecurity, and Leadership
Political Geography:
Europe and Belgium

26. Cybersecurity and Human Rights in the Western Balkans: Mapping Governance and Actors – Case Study Serbia

Author:
Maja Bjelos and Marija Pavlovic
Publication Date:
10-2022
Content Type:
Special Report
Institution:
Belgrade Centre for Security Policy (BCSP)
Abstract:
Despite a solid legal framework, Serbia’s fight against cyber attacks and crime progresses slowly due to the chronic lack of qualified staff, as well as the politicized priorities of the competent institutions. This is one of the conclusions of the latest publication on the cybersecurity context in Serbia. Official statistics indicate an increasing trend in the number of cyber attacks and cybercrime cases in Serbia. About 26 million significant cyber attacks on information and communication technology (ICT) systems occurred in 2020 – the most common of which involved attempted intrusions into ICT systems and unauthorized data collection. Serbian citizens also witnessed massive violations of their right to privacy and personal data during the pandemic, as well as an increase in the number of attacks against human rights defenders and political dissidents in the digital and physical space. In late 2021, the idea of using biometric surveillance to counter terrorism and organized crime was reintroduced. However, due to the rapid backsliding of democracy and the rule of law, citizens fear that the new face recognition technologies will be directed against them, rather than against criminals and potential terrorists. Since the beginning of 2022, there have been several attempts to commit internet fraud and steal the identities and data of users of the Raiffeisen Bank and the Post of Serbia. In the most recent incident, a hacker attacked the country’s cadastre and shared electronic reports about bombs planted in various public and private institutions, causing widespread concern in society and temporarily disabling the day-to-day work of the institutions affected. Threats to journalists via social networks have also become more frequent. Cyber attacks are now a part of daily life in Serbia, and threats posed by the internet and social networks are likely to intensify and become more complicated in the future. It is therefore important for state authorities to be prepared to respond to any challenge, risk, or threat quickly and effectively, while respecting human rights and the rule of law. The Belgrade Centre for Security Policy addresses the topic of cybercrime from the perspective of human rights and the rule of law. In this context, the centre conducted a baseline analysis and 22 interviews with governmental and non-governmental stakeholders in Serbia, from mid-January to end March 2022, to assess the level of legal and institutional development of the competent authorities in the area of information and cyber security, as well as the challenges facing cybersecurity and human rights in the country. This publication is part of the larger report that focuses on mapping cybersecurity-related human rights opportunities and challenges, and represents an area that is under-explored in the region. There are six chapters in total, one for each economy in the Western Balkans. Each begins with essential conceptual background information regarding the cybersecurity and human rights contexts of each economy. They then each explore four core thematic issues: cybersecurity and the right to privacy, cybersecurity and freedom of expression, cybersecurity and freedom of peaceful assembly (and, where relevant, freedom of association), and cybersecurity and anti-discrimination. Finally, they present ways forward, with concrete recommendations for stakeholders. The study as a whole aims to offer recommendations for the inclusion of human rights standards in cybersecurity governance and for better implementation of cybersecurity norms within the human rights frameworks of the Western Balkans region.
Topic:
Security, Human Rights, Science and Technology, and Cybersecurity
Political Geography:
Europe and Serbia

27. NATO’s Role in Global Cyber Security

Author:
Merle Maigre
Publication Date:
04-2022
Content Type:
Policy Brief
Institution:
German Marshall Fund of the United States (GMFUS)
Abstract:
Malicious cyber activity has increased substantially over the past years, ranging from ransomware and espionage to politically motivated cyberattacks and sophisticated malware used in the war in Ukraine. NATO allies must remain on high alert. The changed nature of military conflict changes the defensive mission of NATO, which faces capable opponents in cyberspace and raises the question of how to create accountability when a hostile state fails to observe globally agreed norms. The set of action for NATO for the next five years evolves around how to impose costs and how to deny benefits against malicious actors in cyberspace.
Topic:
NATO, Cybersecurity, Geopolitics, and Russia-Ukraine War
Political Geography:
Russia, Europe, Ukraine, and Global Focus

28. Cyberattacks Integral to Russia's Political and Military Strategies

Author:
Aleksandra Kozioł
Publication Date:
12-2022
Content Type:
Working Paper
Institution:
The Polish Institute of International Affairs
Abstract:
To destabilise democratic countries that support Ukraine, Russia employs cyberattacks on the target state’s public institutions and critical infrastructure. These activities have clearly intensified since the full-scale invasion began in February 2022 and is in line with the implementation of Russian military strategy. In this context, it would be beneficial within the EU and NATO to develop joint action plans to respond to future threats in cyberspace.
Topic:
NATO, Infrastructure, European Union, Cybersecurity, Cyberspace, Military, and Russia-Ukraine War
Political Geography:
Russia and Europe

29. Sharing Cyber Capabilities within the Alliance - Interoperability Through Structured Pre-Authorization Cyber

Author:
Jan Kallberg, Todd Arnold, and Stephen S. Hamilton
Publication Date:
07-2022
Content Type:
Research Paper
Institution:
Department of Social Sciences at West Point, United States Military Academy
Abstract:
S haring cyber weapon/cyber capabilities requires trust between the member states, becoming a high-end policy decision due to the concerns of proliferation and the investment in designing a cyber-weapon that has a limited ’shelf-life’. The digital nature of cyber weapons creates a challenge. A cyber weapon can spread quickly, either self-propagating such as worms or via disclosure (and subsequent reuse) by malware researchers or malicious actors, raising proliferation concerns. Additionally, a cyber-weapon can be copied by the adversary or reverse engineered. Once the weapon is released, the adversary will eventually address the vulnerability, and the opportunity is gone. These factors raise the threshold between member states to share cyber weapons and cyber capabilities. Alliances, like NATO, prepare for a unified multinational, multi domain fight; meanwhile, the national cyber forces are still operating as solitaires with limited interoperability and sharing. There is a need in the collective defence posture to integrate the multinational cyber force to achieve interoperability.
Topic:
Security, Defense Policy, NATO, Regional Cooperation, Cybersecurity, and Alliance
Political Geography:
Europe and North America

30. Enabling NATO’s Collective Defense: Critical Infrastructure Security and Resiliency (NATO COE-DAT Handbook 1)

Author:
Carl V. Evans, Chris Anderson, Malcom Baker, Ronald Bearse, and Salih Biçakci
Publication Date:
11-2022
Content Type:
Special Report
Institution:
The Strategic Studies Institute of the U.S. Army War College
Abstract:
In 2014 NATO’s Centre of Excellence-Defence Against Terrorism (COE-DAT) launched the inaugural course on “Critical Infrastructure Protection Against Terrorist Attacks.” As this course garnered increased attendance and interest, the core lecturer team felt the need to update the course in critical infrastructure (CI) taking into account the shift from an emphasis on “protection” of CI assets to “security and resiliency.” What was lacking in the fields of academe, emergency management, and the industry practitioner community was a handbook that leveraged the collective subject matter expertise of the core lecturer team, a handbook that could serve to educate government leaders, state and private-sector owners and operators of critical infrastructure, academicians, and policymakers in NATO and partner countries. Enabling NATO’s Collective Defense: Critical Infrastructure Security and Resiliency is the culmination of such an effort, the first major collaborative research project under a Memorandum of Understanding between the US Army War College Strategic Studies Institute (SSI), and NATO COE-DAT. The research project began in October 2020 with a series of four workshops hosted by SSI. The draft chapters for the book were completed in late January 2022. Little did the research team envision the Russian invasion of Ukraine in February this year. The Russian occupation of the Zaporizhzhya nuclear power plant, successive missile attacks against Ukraine’s electric generation and distribution facilities, rail transport, and cyberattacks against almost every sector of the country’s critical infrastructure have been on world display. Russian use of its gas supplies as a means of economic warfare against Europe—designed to undermine NATO unity and support for Ukraine—is another timely example of why adversaries, nation-states, and terrorists alike target critical infrastructure. Hence, the need for public-private sector partnerships to secure that infrastructure and build the resiliency to sustain it when attacked. Ukraine also highlights the need for NATO allies to understand where vulnerabilities exist in host nation infrastructure that will undermine collective defense and give more urgency to redressing and mitigating those fissures.
Topic:
Security, NATO, Infrastructure, Cybersecurity, Alliance, Crisis Management, and Risk Assessment
Political Geography:
Europe, Ukraine, North America, and United States of America