Technology has had an impact on nearly every aspect of society, and will continue to do so in the coming years. Many of today’s activities are increasingly dependent on information systems, electronic devices, and data networks – a trend which is leading to hyperconnectivity. At the same time, we are seeing new threats and vulnerabilities emerge, and as a result, security risks are increasing in number, frequency and impact.
Therefore, the ascendancy of technology in today’s societies, and the risks associated with its use, demonstrate the need to protect information and other assets at various levels and in various fields, not just for industries, companies and users, but also for countries. Legislation in several countries is requiring increased and improved security, based on objective moral and ethical criteria.
RELATED READING: So you thought your personal data was deleted? Not so fast
"We are seeing new threats and vulnerabilities emerge, and as a result, security risks are increasing in number, frequency and impact."
The promulgation of laws relating to the scope of cybersecurity highlights the importance of implementing large-scale regulatory frameworks, which would contribute to reducing security incidents and preventing IT crime, all while developing and establishing a culture of cybersecurity. But despite the benefits that such legislation may bring to data security, the reality is that there are various tensions, positions and counterpoints, which mean that setting it up is not an easy task. In this section, we will look at some of the most significant legislation, in international terms, and some of the current and future challenges facing states, companies and users/ citizens around the world.
Cybersecurity: organization, collaboration and diffusion across the globe
We have recently seen the emergence of a trend towards new cybersecurity legislation across the world. Based on collaboration between public and private sectors to effect the exchange of information and the creation of national cybersecurity agencies, the aim is to develop tools to cope with the risks of the digital era and to legislate against cybercrime.
European Union
The EU recently adopted the NIS Directive for the security of information networks and systems, seeking the promotion of legislation encouraging member countries to be equipped and prepared to respond to incidents, by having a Computer Security Incident Response Team (CSIRT) and a national authority competent in this area.
The creation of a CSIRT network is intended to promote rapid and effective cooperation, the exchange of risk-related information, and the development of a culture of security among sectors vital to Europe’s economy and society, such as energy, transport, finance, health, and digital infrastructure. The new laws are aimed at encouraging the homogeneous development of cybersecurity capacities and at preventing incidents that threaten economic activities, infrastructure, the confidence of users, and the operation of systems and networks critical to each country.
United States
"Through the use of information gathering, security checks and other protective measures, organizations and governments are able to coordinate intelligence and defensive actions."
At the end of 2015, the United States Congress approved what is known as the Cybersecurity Act of 2015 to protect the country from cyberattacks responsibly and promptly, through a framework promoting the exchange of information between the private sector and the government about computer threats.
Under the act, information about a threat found on a system may be shared with the aim of preventing attacks or mitigating risks that may affect other companies, agencies or users. Through the use of information gathering, security checks and other protective measures, organizations and governments are able to coordinate intelligence and defensive actions.
Latin America
In a recent report, a model was applied to determine cybersecurity capacity in Latin America and the Caribbean. This document highlights the importance of responsible disclosure of information in public and private sector organizations when a vulnerability is identified.
It also emphasizes the importance of legislative frameworks, investigation, the processing of electronic evidence, and the training of judges and prosecutors in the field of cybersecurity. Adherence to international conventions, such as the Budapest Convention, and being a signatory to cross-border agreements for cooperation, are other decisive factors. Similarly, adoption of best practices along with the use of security technologies are considered, for the formation of a “resilient cyber society”.
Asia-Pacific
Another study seeking to ascertain the level of sophistication in cybersecurity, which focused on countries in the Asia-Pacific region, also considers legislation as a basic indicator of the security landscape. In 2016, several countries in this region launched new cybersecurity policies or strategies, and also updated existing standards, in order to adapt to new challenges and emerging issues.
For example, Australia has implemented a cybersecurity strategy, which provides for additional funds and has sought increased commitment from the private sector to engage with the country’s cyber policy. Other countries, like New Zealand, have launched national cybersecurity strategies, focusing on improving their resilience, international cooperation, and the ability to respond to cybercrime.
Challenges and implications of the enactment of laws relating to cybersecurity
The current status of risks presents the need for regulatory frameworks for security management – an increasingly popular organizational trend. Similarly, when we refer to legislation, we are referring to the application of standards on a large scale, with a view to cybersecurity regulation at the national level. Generally, legislation is quite effective when it comes to regulating behavior.
However, there are challenges to be overcome for effective application of the laws. For example, the Global Agenda Council Report on Cybersecurity presents the challenges faced by countries that have started to legislate in this area, based on the Budapest Convention. Nevertheless, these countries can enter into other global or regional conventions, and even take part in specific local initiatives.
Evidence suggests that, given the influence of technology and the habits it instils, implementation of legislation can impact various stakeholders ranging from technology companies to users themselves. These tensions lead to different conflicts and challenges, which we shall consider below.
Delay in the enactment of laws
Various considerations determine the creation of laws in different countries, so their promulgation depends on a multiplicity of factors; for example, political issues or other issues affecting local initiatives, or adherence to international agreements encouraging the same level of development for cross-border collaboration.
However, it is on account of these very conditions and characteristics that legislation is often postponed. For example, by 2016, almost half of the countries that had ratified their participation in the Budapest Convention had taken a decade or more to complete the ratification, due to – among other things – the delay in the development of their laws. Moreover, the Convention just focuses on certain legal aspects within the range of possibilities related to the scope of cybersecurity.
Laws falling behind in context and time
In connection with the previous point, it should also be considered that technology is advancing at a rapid rate; the development of standards may, therefore, fall far behind technological advances. Just as organizations continuously update their standards in response to evolving risks and new technologies, the law must be at the forefront when it comes to responding to present and emergent issues which may need to be regulated.
"Technology is advancing at a rapid rate; the development of standards may, therefore, fall far behind technological advances."
Perhaps the way to rectify this disparity between technological innovation (and the risks it entails) and the enactment of appropriate legal measures, is to focus on regulating human behaviors, especially since technologies can become obsolete in a relatively short period. This may prove to be the most reliable way for regulation to be effective, but it is also important to note that this could lead to rising tensions in the future. An example of this might be trying to regulate the use of social networks, which are not supported by legislative enactment.
Technical and legal heterogeneity
We should also consider that countries' methods differ in the ways they adhere to international or regional conventions, and these differences even determine specific initiatives for the development of their laws. Legal and technical disparities make it difficult to respond to, investigate, and rule on cybersecurity incidents, and inhibit international collaboration. For example, regional or bilateral initiatives are developed to meet specific needs, as is the case with the EU-US Privacy Shield, a framework seeking to protect the fundamental rights of anyone in the EU whose personal data are transferred to companies in the US. This, of course, does not take into account collaboration with other countries or regions.
Conflicts of laws and basic principles
In this same context, legislation is generally quite effective when it comes to regulating behavior. However, these laws can always be improved, particularly if we consider that there are projects which could undermine not only the principles on which the internet is based but even certain basic human rights. Based on the idea that the internet is free and has no physical borders, there are cases where although legislation is applied on a national level, constitutional or legal conflicts arise, mainly concerning the meanings and conceptions of privacy and freedom of expression. In this case, the eternal debate between privacy and security may come into play.
Limitations on the scope of application
Similarly, the absence of legislation or agreements on specific aspects of certain issues can undermine international collaboration, even within the same territory. Public and private sectors face a challenge when it comes to access to information for investigations, with implications for security, the right to privacy, and commercial interests, mainly of tech companies.
As an example, we have the well-known case between the FBI and Apple, in which a US judge requested the cooperation of the technology giant in order to unlock the iPhone of a terrorist involved in an attack, or the recent case in which a judge in Rio de Janeiro ordered the blocking of WhatsApp throughout Brazil and fines against Facebook. Such events clearly demonstrate the need for local and cross-border agreements to collaborate, which avoid conflicting interests.
Working towards the development and popularization of cybersecurity culture
The promulgation of laws relating to cybersecurity has enjoyed prominence at an international level for some years now, on account of the number, frequency, and impact of incidents recorded worldwide. Various initiatives regard legislation in this area as a fundamental factor that improves a country’s maturity.
The aim is therefore to have legal measures in place for protection at various levels and in various fields. To this end, legislators have also started to consider the requirements necessary for security in their countries, including their capacity to respond to large-scale incidents, the protection of their critical infrastructure, their ability to collaborate with other countries, and even to consider the development of a security culture which can be instilled in the population. Not to mention issues already recognized such as privacy, the protection of personal details, and cybercrime.
"The need to define rules for all stakeholders becomes clear, in order to make legislation truly effective."
We are experiencing a growth in the development of new legislation that defines how a country's assets are protected in the context of cybersecurity, as well as promoting cooperation and collaboration between the public and private sectors of each country, and also at an international level so as to thwart current and emerging information threats and attacks.
However, behind the obvious benefits of this new legislation lie challenges that need to be overcome in order for it to materialise. These include understanding the needs and conditions that exist in both the public and the private sectors, and of all stakeholders in their capacity as both users and citizens. Obstacles and limitations on collaboration may include a lack of trust, ineffective legislation, and differing interests between the various sectors.
In the light of these issues, the need to define rules for all stakeholders becomes clear - rules that are based on international, regional or national agreements and that consider all parties - in order to make legislation truly effective. Without doubt, there remains much to be done and it requires the collaboration between governments, private initiatives, the academic sector, and of course, users. In this way we work towards one common goal: working towards the development of a cybersecurity culture.
This article is an adapted version of the corresponding section from ESET’s 2017 trends paper, Security Held Ransom.
