Magazine menu Close Magazine menu

law

Latest stories

One click to attack critical infrastructure: What can we do?

  • min read
    • Growing digitalization in the industrial sector makes attacking critical infrastructure (CI) easy for cybercriminals. For example, ransomware attacks on critical sectors hit headlines in 2021. But what can we do about it? Can the international community cooperate across borders to respond fast and effectively? I've written before on how the world could improve its cross-border firefighting. Now there's a new UN cyber dialog with diplomats from 193 countries getting together to discuss using information and communication technologies (ICTs) for cyber stability, security and peace. And we may now be a step closer to a solution. Kaspersky organized the workshop, One click to attack critical infrastructure: What can we do? at the 2021 UN Internet Governance Forum (IGF) with experts from cyber diplomacy, cybersecurity research and incident response worldwide. Many national perspectives We looked at national approaches and existing good practice in critical infrastructure protection and heard how states implement the UN cyber agreements and critical infrastructure protection norms. Germany: Cyber protection is a whole-of-society issue Ambassador Regine Grienberger (@GERonCyber) of Germany's Federal Foreign Office said Germany's approach to critical infrastructure protection is whole-of-government and whole-of-society. Close public-private cooperation with sharing information and lessons learned are essential parts of it. Ambassador Grienberger says, "In Germany, we've built a national framework for critical infrastructure protection, which is embedded in the legal framework at European Union level and complemented by our cooperation with our international partners. Lack of human resources remains a serious challenge. We need greater investments in cyber capacity building." Switzerland: Sharing responsibility Daniel Klingele, Senior Advisor at Switzerland's International Security Division of the Federal Department of Foreign Affairs, said cost of regulatory action versus incentives, decentralized structure of responsibilities and building an inventory of critical functions all guide their regulatory approach. Mr. Klingele also thinks it's important to focus on public-private partnerships to ensure a shared responsibility, but critical infrastructure operators must also understand their responsibilities to manage cyber risks. Singapore: Three areas for international cooperation Dan Yock Hau is Assistant Chief Executive for National Cyber Resilience at Singapore's Cyber Security Agency. Mr. Dan highlights three areas for international cooperation: Consensus (states agreeing on 'rules of the road',) collaboration (keeping digital domain safe and secure through effective collaboration and partnerships) and capabilities (investing in capacity building to spearhead a systemic response to cybersecurity.) Mr. Dan believes governments should lead in strengthening cooperation because the weakest link can provide an entry point to a system but also risk to other countries. He says, "Cyber threats are not confined within geographical boundaries. Bilateral, multilateral cooperation are key to share timely information and respond to incidents swiftly." Australia: Mandatory reporting requirements for operators Johanna Weaver (@_johannaweaver) Director of Tech Policy Design Centre, Australian National University, highlighted Australia's new legislation outlines mandatory reporting requirements for critical infrastructure operators and extends government powers to take control of infrastructure if there's a serious cyberattack. Ms. Weaver says governments and the private sector must have regularly tested plans for effective incident response. "All states have now agreed they should protect critical infrastructure and they are not going to intentionally damage other states' critical infrastructure using ICTs. But not enough countries are being transparent about the use and development of offensive cyber capabilities. Australia is among the few countries that publicly commit that we are not going to use these to damage other states' critical infrastructure." A UN cyber emergency phonebook? We also explored the idea of a UN 'cyber emergency phonebook' in our workshop. If an attacked state can't respond and protect itself, who should it ask for help? And where a cyberattack affects critical infrastructure in several jurisdictions, how should cross-border cooperation happen? Serge Droz, Board of Directors at Forum of Incident Response and Security Teams (FIRST,) said most incident response teams run into limits handling incidents and don't have access to infrastructure operated by third parties. Mr. Droz says the international community should invest in developing trusted relationships, but trust is hard to institutionalize. Regular collaboration helps, and trust between individuals spreads further into teams. Mr. Droz also highlighted the importance of neutrality in Computer Emergency Response Teams (CERTs.) "CERTs' key role is to respond to incidents. They shouldn't be party to other activity like attribution or using offensive capabilities. Focusing on their role is key to ensuring their neutrality during a cyber emergency." Carmen Corbin, Head of Counter Cybercrime Programming for West and Central Africa, UN Global Programme on Cybercrime (UNODC,) agreed with Mr. Droz and added the need to keep an ongoing focus on capacity building and training in helping states be more effective in protecting critical infrastructure. "Experiencing cyber emergencies together helps experts and communities build closer and trusted relationships." Pierre Delcher, Senior Security Researcher at Kaspersky, said multiple factors trigger cooperation – like common values, shared commitments and compatible capabilities – but trust underpins it all. He believes continuous collaboration and experiencing common events develops trust. "Cybersecurity incidents are usually global, but the response, almost never. Cross-border cooperation should bring better results," says Mr. Delcher. "An emergency phonebook may be a good start. It could be done through existing cooperation mechanics." What should happen next? We're not alone in the wilderness when dealing with critical infrastructure incidents. Since 1998, states have talked about working with ICTs in the interests of peace and security. The new five-year long round of the UN cyber dialog continues soon. Hopefully the international community will have new practical achievements even sooner.
Jonathan Kewley tech lawyer

Technology and the law: What will we see next?

  • min read
    • Too few lawyers are at home in law and tech – a vulnerability in highly digitized economies. Jonathan Kewley is working to bridge the gap, leading a team of specialists in technology and the law at Clifford Chance and founding IGNITE, combining legal training and tech development. I caught up with him to discuss global artificial intelligence standards, the proliferation of ransomware attacks, and diversity in tech and law. Elisabeth: The lack of AI (artificial intelligence) standards is a rapidly growing problem. Is there hope for international agreement? Jonathan: Government will has never been greater, but how do you get from will to an agreement? The European approach has been like a land grab: Proposing global standards in the form of the new AI Act. The EU is good at setting technology standards that can be applied globally because that's easier for companies than to adhere to many standards. But the EU is likely to struggle to enforce outside the EU, for example, in China. So we see increasing fragmentation around AI standards. There are different priorities. The US is concerned regulating AI might harm innovation, and China speaks about the need for security. But the elephant in the room is the security of private information. Other countries with highly developed financial infrastructure think a lot about these issues because it could mean financial instability if AI goes wrong. There should be areas all countries can agree on, like the security of children's data and protecting vulnerable groups from AI bias and prejudice. There, we can build consensus and establish a global, multi-lateral approach. Recent ransomware attacks have brought down many vital services, yet nobody knows how to stop them. What would work? Ransomware attacks are rapidly proliferating. There are so many now that law enforcement support to victims is much less than two years ago. Ransomware attacks can bring down a company, especially since digitization of customer service and working from home brought on by the pandemic. If those services are affected, the company often feels they must pay the ransom or face ruin. Companies must make sure their workforce understands ransomware risks. Many attacks begin because people innocently allow attackers in, for example, through phishing emails. And as people use digital services more, they become more comfortable in the digital environment and more trusting. Criminals exploit that. Employers must make sure employees realize they're on the frontline. We need new digital-age ways to lean over to a colleague and ask if an online request looks suspicious. Today, law and tech firms are more open to all kinds of employees, but they're not very successful in attracting minorities. What are they missing? The two industries have some similar challenges. Traditionally they have been male-dominated and tend to draw talent from privileged backgrounds. At times, tech and law still feel intimidating and closed-off to people from minority and disadvantaged backgrounds. It's vital for people from minority backgrounds to know they belong in tech and law, and that they can rise to the top. To help change the narrative, I've established a scholarship program where I studied at Hertford College, University of Oxford, supporting people from disadvantaged backgrounds to study computer science. Diversity in tech education is not just about winning hearts and minds – people also need money. It's not about diversity for diversity's sake – it's about getting a range of perspectives around the table. It will mean tech is designed and built by representative groups: Safer and more ethical technology for all. Tech and law firms often say in job ads that they invite people from minority groups to apply. What else should they do to attract a more diverse workforce? They need to go far beyond that. At Clifford Chance we do outreach with schools and local communities to show young people that there are people like them at our firm. We're also committed to achieving a more neurodiverse workforce. We've worked with autism specialists to review and adjust how we interview and assess candidates. Then there are practical steps like ensuring we don't have a one-size-fits-all approach to appraisals and acknowledging a more diverse talent pool will have different training needs and priorities. Which trends do you see shaping the technology and legal field in the next few years? Algorithms. We've already seen the car crash created by the exams algorithm misfiring in the UK, allocating school grades on a postcode lottery. If this is magnified in a business of scale, it will bring that business down. Secondly, technology ethics boards are already starting to appear and will be common in five years. These will inspire change at C-suite level by being more diverse, creative and challenging than conventional oversight structures.
Plumia digital nation

How digital nations like Plumia are giving digital nomads wings

  • min read
    • The growing phenomenon of the digital nomad – people who live and work where they want to, even in other countries from their employer – offers businesses a chance to secure the world's best talent and retain experienced staff longer. People earning good money are starting to bring their spending and energy to rural areas, small towns and places with lower living costs. Several countries have seen the potential and are working to attract digital nomads, but the barriers of negotiating work visas, tax and local employment laws remain high. What if digital nomads could become citizens of a 'digital nation' that saw its role as advocating for, protecting and smoothing the ride for its citizens? Plumia is one such nation starting to do just that. Digital nomadism is growing fast People have taken their work on the road for centuries, but it was tech legend Tsugio Makimoto who in 1997 predicted advances in tech would encourage people "to live, work and exist on the move." He coined the term 'digital nomad' in the title of his book. COVID-19 has seen digital nomadism grow faster than ever before. Statista says in 2020, nearly half the US workforce worked from home full-time. 'Deep jobs' platform MBO Partners report Google searches for 'digital nomad' have been increasing for years but soared in August 2020. When the world went into lockdown, millions of remote workers abandoned US and European cities for suburbs, the countryside and other countries, creating 'Zoom towns.' Today, 35 million digital nomads worldwide spend around 787 billion US dollars a year. Location-independent workers now rival Canada in population with the global annual spending power of Saudi Arabia. Large numbers of digital nomads in tech MBO Partners research also found tech has the most digital nomads: 12 percent of the total digital nomad workforce. "COVID-19 prompted an acceleration of technology adoption and digital transformation," says Lauren Razavi, digital nomad and author of Global Natives: The New Frontiers of Work, Travel and Innovation. "Companies are redesigning their organizations from the inside out, and workers across all industries are demanding more flexibility." World Economic Forum projects worldwide numbers of permanent remote workers will double from the start of the pandemic to the end of 2021, reaching 34.4 percent. Facebook, GitLab and other international tech companies are leading the way. Economic value of digital nomads Continued travel restrictions aside, anywhere with good internet is fair game for digital nomads. Several industries have noticed this new consumer base. After large revenue loss during the pandemic, hospitality and travel companies began catering to remote and location-independent workers with long-term stay discounts and alternative offices. Cities dependent on tourism found creative ways to take advantage of the new remote tech worker diaspora with relocation cash incentives. Countries devastated by lack of tourism are offering visas for remote workers. After Estonia started offering a digital nomad visa in 2020, Georgia, Bermuda and dozens of others followed. Portugal's temporary stay permit and Germany's freelance visa predate the pandemic. Razavi says there's still a lot to do. Many organizations still try to limit workers' travel, creating blanket policies about where their employees can work, to comply with local employment regulations. Remote tech companies and entrepreneurs struggle to find global health insurance and offer retirement plans, often choosing to scale abroad without employee safety nets. Individual country border, visa and tax regulations make staying in one place for more than a few months hard. A comb through the list of digital nomad visas reveals high fees and income requirements that may restrict millions. What do we need to do to make sure tech workers and other digital nomads are free to roam? The answer may lie in a unique online movement called Plumia. What digital nations could offer remote workers Digital nations or internet countries like Plumia turn the idea of a country on its head. These projects map their borders around missions rather than physical spaces, redefining citizenship and nationality. Started by Norwegian nomad health insurance company SafetyWing in 2020, Plumia is a group of digital nomads and remote workers "aiming to build a country's infrastructure on the internet," says Razavi – one of the project's founding board members. Plumia wants to connect workers on the move, create a worldwide community and offer services like any nation-state, such as social benefits, global identification and legal protection. "Rather than complaining about what exists, we want to rethink the systems and show there are better, borderless ways for the world to work," Razavi says. When I heard about Plumia I was fascinated, and later joined as a founding member. While I'm not yet a digital nomad, owning a location-independent business in an expensive US city helps me see the benefits of borderless support. Future of work writer and entrepreneur Nicci Talbot has been watching Plumia with interest. She sees Plumia as a "contact point, an opportunity to connect with like-minded people and a springboard to develop ideas. Their activities and ambassadors are making the space more competitive, highlighting the growth of remote working and giving digital citizens a global mindset," she says. Plumia has an active and growing community of over 1,000 members who gather on community and messaging platform Discord to network, discuss infrastructure and draft services. They're working on identifying the best structure to support millions of remote workers worldwide and launching a member-driven set of services for nomads. Plumia board members have launched an ongoing public speaker series, inviting future of work and legal experts from around the world to share knowledge and advise the project. Borderless travel starts online Plumia isn't the only digital nation devoted to making movement easier for global citizens. The world's first internet country was Wirtland, founded in 2008 as a "democratic and peaceful alternative... for people's self-identification," according to its Statute. Wirtland has a newspaper, 8,000 citizens ('witizens') and a currency. Wirtland tried to gain recognition by acquiring lands in 2019. Digital Nomad Nation has a similar mission to Plumia. It has 140,000 members worldwide and aims to advocate for digital nomad rights and taxes, and eventually offer virtual residency. Bridging the remote work gaps To take full advantage of the work-from-anywhere movement, tech companies and entrepreneurs need digital solutions to analog workforce and travel problems. Digital nation projects like Plumia are easing remote worker bottlenecks and becoming a go-between for countries, companies and nomads. Razavi, as a digital nomad since 2013, has ideas about the best approach. "The starting point is to serve remote workers and digital nomads with useful products and services that bridge old and new," she says. "A digital platform, something I call the Global Citizen Record, could help remote workers and digital nomads navigate different countries' visa systems easily." Global Citizen Records (GCR) would, in theory, include stored identification data, proof of residency, income and education, and background checks. It could hold vaccination records, acting as a virtual passport during the pandemic. Talbot, a fan of Razavi's concept, agrees. "GCR would help streamline things and potentially solve some problems with remote work and travel." Plumia and other digital nations can also offer location-specific services, connecting nomads with on-the-ground communities, housing and coworking spaces. They can meld virtual accessibility with social safety net offers like international health insurance and retirement plans or become providers for remote companies wanting to offer global employee benefits. Digital nomadism is growing fast. These remote workers and consumers have moved beyond Instagram laptop beach shots to the forefront of a new global way of life. Internet nation projects like Plumia highlight how eager digital nomads are to help enrich and sustain this shift, and empower others to choose how and where they work.
global cyberincident response

How the world could improve its cross-border cyber firefighting

  • min read
    • If a cyberattack knocked out the energy grid or hospital in your town, you'd expect a fast response. You'd perhaps imagine critical infrastructure operators, computer emergency response teams and cybersecurity vendors would coordinate, exchanging information and helping victims. But today, global cross-border coordination mechanisms for a major attack on critical infrastructure aren't there yet. In the event of an attack, those affected tend to look around for the right person to call and ask for help, delaying response and putting users and cyber stability at greater risk. What can be done about this lack of a system? What's been achieved so far? We're not entirely alone in the wilderness when dealing with critical infrastructure incidents. Since 1998, states have been talking about working with information and communication technology in the interests of peace and security. Countries have agreed on three international documents that pave the way for a global response to a critical infrastructure attack. The 2015 UN Group of Governmental Experts (GGE) report includes non-binding norms for critical infrastructure protection and asks governments to "take appropriate measures to protect their critical infrastructure from ICT threats." It also promotes assisting victim states. The 2021 UN Open-Ended Working Group (OEWG) consensus report recommends states "consider nominating a national Point of Contact (PoC) at technical, policy and diplomatic levels." In the advance copy of the 2021 GGE report, 25 government experts elaborate on how to implement norms, including on critical infrastructure protection and assistance. States also clarify how Points of Contact (PoCs) can work. With these steps, the global community has a good base for developing a global incident response. But it's important to start implementing these agreements while clarifying what victims should and shouldn't do, the private sector's role and how any party should gather and exchange information for incident response and mitigation. High on the cyber expert agenda Experts have been discussing improving global response mechanisms, for example, at the world cybersecurity conference, RSA, in 2021. One RSA Conference session saw experts from INTERPOL, the global Forum of Incident Response and Security Teams (FIRST) and Switzerland's Federal Department of Foreign Affairs (FDFA) sharing views. Craig Jones, INTEROL's Director of Cybercrime, said information and communication technology incidents are underreported and under-investigated because there's no unified mechanism to inform everyone of an attack. Jones continued, "It's in everyone's interests to thoroughly investigate incidents and to gather and share as much information as possible." Despite the value of unified action, the current geopolitical situation contributes to a lack of information-sharing and low trust between states. Serge Droz, Chair of FIRST, says building trust in a difficult political environment can't be rushed. "Cybercriminals love 'divide and conquer.' That's why our biggest challenge is to decide how we'll all work better together." Building trust and cooperation between states Jon Fanzun, Special Envoy for Cyber Foreign and Security Policy at Switzerland's FDFA, spoke of what's needed for greater trust between states and between states and the private sector. The Geneva Dialogue on Responsible Behavior in Cyberspace, led by the Swiss FDFA and implemented by DiploFoundation, is an example of building greater trust and closer community. The dialogue shapes a joint vision of digital security and global policy processes for a trusted, secure and stable cyberspace. What should the mechanism be like? The mechanism should start by giving recommended technical and operational national Points of Contact (PoCs) in the event of an attack. These would serve as a 'final station' in reaching out to a national computer emergency response team, law enforcement agency or cybersecurity professionals to exchange technical information to help cross-border cooperation and incident response. How a global incident response mechanism might work There could be a three-step process in a scenario such as a country's energy grid being attacked. Step 1: National Points of Contact (PoCs) would facilitate further coordination with the country's other authorities, as they organize cyber exercises regularly and have developed incident notification cross-border procedures, tools and templates. Step 2: PoCs would connect the attacked energy grid with the software manufacturer and a cybersecurity company, and CERTs of the attacked country and software manufacturer's country. Step 3: PoCs would quickly exchange information on the threat and analyze and compare forensic samples to address the incident. This mechanism would ensure a timely and coordinated global response and mitigation, and enhance the global community's technical and operational capacities, contributing to cyber stability. There are encouraging signs like the UN open-ended working group on cyber and the sixth GGE process. It shows, despite confrontations in cyberspace, states want to keep up critical dialogue for cyber stability. For everyone else, including us at Kaspersky, it's important to follow these processes and engage proactively, supporting states with our expertise to help keep our shared cyberspace open, stable and secure.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries