Cyber Security And The Responsibility Of States To Protect Critical Infrastructure
Author: LawSphereX
Category: Technology, Cyber & Privacy
Published:
Updated:
CYBER SECURITY AND THE RESPONSIBILITY OF STATES
TO PROTECT CRITICAL INFRASTRUCTURE
Pramita Sil, IILM University, Gurgaon
INTRODUCTION
Critical Infrastructure is a collection of systems, facilities, assets, which is considered essential by the government for everyday life, constituting a network, physical or virtual, vital for the functioning of a society and a stable economy. With the growth of technologies and rapid digitalization, the threat of cyber-crime has increased and the ever-evolving nature of crimes made it more difficult. Most economic, cultural, social, and commercial contacts between nations, people, and institutions are now conducted online. Therefore, if any of these faces a threat then the whole system will be affected. The attacks against individuals or organization are carried out by nation-state cyberattacks to cause disruption. For instance, the nation-state attacks done by Russia against Ukraine were delegated to cause interference and negatively impacted the Ukrainian war.
This shows the vulnerabilities on the system. In order to obtain information and access to industrial control systems in the energy, nuclear, water, aviation, and vital manufacturing sectors, nation-states are focusing on critical infrastructure. Furthermore, coordinated nationwide attacks against government and private sector entities, internet service providers and critical infrastructure providers facilitate espionage, steal intellectual property, preserve continuous network access and possibly create the groundwork for further offensive actions. The most common attacks used are ransomware and phishing. To keep a track on this the states have certain duties and at the same time the public-private cooperation is also necessary.
An estimate by cybersecurity company KnowBe4 indicates that from January 2023 to January 2024, worldwide critical infrastructure saw over 420 million assaults, averaging over 13 attacks per second1.
1. LEGAL ACCOUNTABILITY OF STATES IN PROTECTING CRITICAL
1Bahadir Candan, Top 5 Critical Infrastructure Cyberattacks, (Oct. 17,2024), https://www. anapaya. net/blog/top- 5-critical-infrastructurecyberattacks#:~:text=A%20report%20from%20cybersecurity%20firm,approximately%2013%20attacks%20per %20second INFRASTRUCTURE FROM CYBER THREATS- Examining cybersecurity events as natural disasters rather than purposeful damages helps justify imposing duties on affected states. These reasons are both inside and outward-looking. A state has responsibility to both its citizens and those in its borders. Human rights, international humanitarian, and sovereignty laws impose such obligations. The justification for sovereignty now includes the rights of individuals and their right to a safe framework to enforce their autonomy and pursue their interests, rather than solely relying on sovereignty's presumptive legitimacy.
The UN Secretary-General's High-level Panel on Threats, Challenges, and Change study, titled “A More Secure World: Our Shared Responsibility”, takes a comprehensive approach to security, examining both state and human security. The Panel defined human security broadly to include both negative (freedom from fear and violence) and positive (freedom from want) freedoms, linking state security to human security. The Panel redefined state sovereignty as a concept of responsibility-based, stating that states not only enjoy the privileges of sovereignty but also accept its responsibilities, including external obligations to other states and the international community, and internal obligations to protect their own peoples. States protect them because they are necessary for achieving dignity, justice, and value, not because they are innately good safety of citizens.
As computer networks and the real world become more linked, cybersecurity events pose a greater threat to individuals fundamental rights and potentially their health and life. Computers and networks are ubiquitous in contemporary life, including phones, automobiles, traffic lights, hospitals, dams, airport control, and electrical grids. If a state fails to protect its computer networks or address damage quickly, it may hinder citizens' access to fundamental rights like health, privacy, movement, and association, and even the right to life. 2 Below are some of the legal obligations imposed on the states. • Due Diligence- The Theory of Responsibility (Corfu Channel Case) based on this theory; states must take precautions to avoid cyberattacks on other states. After discovering harmful activity from its jurisdiction, a state must take reasonable and practicable measures to halt it.
What constitutes acceptable action relies on the state's technological capabilities and situational understanding. 2 Oren Gross, Cyber responsibility to protect: Legal Obligations of states directly affected by Cyber-Incidents, https://ww3. lawschool. cornell. edu/research/ILJ/upload/Gross-final. pdf
Trans-boundary Harm Principle- Based on the principle of Trail Smelter Case; no state has the right to use its own territory in such a way that could harm another state. States must prevent cyber operations that could damage critical infrastructure across borders. • International Humanitarian Law (IHL)- In armed conflicts, IHL forbids attacks on civilian objects, especially essential infrastructure, unless they are military objectives. States must guarantee their cyber activities follow these humanitarian norms. • United Nations- States should cooperate to improve (Information and Communication Technology) ICT stability and security, and prevent harmful practices that threaten international peace and security, in line with UN goals States should evaluate all essential facts, including context, when investigating ICT occurrences. States may need to adopt additional actions.
A state shall not deliberately destroy essential infrastructure or otherwise hinder its usage and functioning to offer public services via ICT activities according to international law. • General Obligations- States must handle ICTs with sovereignty, non-intervention, and peaceful conflict settlement in mind. They must also prevent non-state actors from using their territory to launch cyberattacks on other nations. Effectiveness of implementation across jurisdictions: • United States: In number of rules and regulations, such as the National Institute of Standards and Technology's (NIST) Cybersecurity foundation, a strong foundation was established by the United States which has safeguarded the vital infrastructures. But there is a constant conflict between federal governments and provincial governments as they have different objectives.
• European Union: All member states must implement cybersecurity measures in accordance with the (Directive on Security of Network and Information Systems) EU's NIS Directive. Due to difference in countries requirements it can lead to varying security standards and criminals often look for weakest systems and they may target the link which is in that location. And this difference can hinder the international and national cooperations which make it difficult to trace the criminals.
Australia: The governments are getting aware of the critical infrastructure sectors which are highly vulnerable to cyberattacks as disruptions of such can cause severe problems to the public life. To address this issue many countries are enacting laws which includes regular security assessments and detection systems. The operators are also being hired by the states to share information about the attacks. But still it’s hard to cope up with the current evolving nature of crime due to the economic factors as other vital infrastructure are also required to look after. But promoting international cooperation might help. • International Consensus: Even after the recommendations from UN, there is no universal definition which is globally accepted which brings varying interpretations among the countries.
Traditionally infrastructures are referred to physical assets like health care systems, power grids etc but in modern sense it’s all about technology. So, the definition should be considered same globally for the betterment.
2. PROTECTION OF CRITICAL INFRASTRUCTURE FROM CYBER-ATTACKS
THROUGH PUBLIC-PRIVATE PARTNERSHIP- In recent years, cybercrime has grown in incidence, volume, and complexity. Perpetrators target persons, organizations, and important sectors providing essential services. To successfully combat cybercrime and improve cybersecurity, coordination across industries is necessary due to the ever-changing cyber threat environment. Private sector cooperation, including Privatepublic partnerships (PPPs) are crucial in combating cybercrime, since many important ICT infrastructure and digital services are owned and run by private organizations.
To combat cybercrimes, the governments must have the access to the resources, expertise and innovative technologies of the private sector, to have a better understanding of cyber threats and its vulnerabilities and should have the ability to stop cyber activities with advanced information sharing and its intelligence gathering. The private sectors should protect the sensitive data and critical infrastructure, with advanced capabilities and risk management practices. They should improve customer trust and confidence with the reduction in damages and financial losses. The PPPs stands for sharing vital information about threats, vulnerabilities and reports. They should take joint operations for incident response on specific cybersecurity initiatives and train the educating professionals by collaborating on research projects to develop new technologies and solutions.
The non-profit organisations i. e. stakeholders can help in raising awareness and can contribute in policy developments. The PPPs are of dynamic nature which changes over time as different stakeholders can involve in different stages of PPPs. 3 Types of public-private partnership The private-public relationship has become essential to fight cybercrime by sharing, coordinating and exchanging information and data about emerging threats, cybercrime trends, tactics, indicators, vulnerabilities and attack techniques with their efforts to respond to cyberattacks to minimize damages. They conduct joint operational collaborations to disrupt the criminal activities by taking down malicious infrastructure and websites by providing technical assistance to law enforcement agencies.
They also focus on instructing cybersecurity professionals, lawmakers, and the public about best practices of cyber threats. By developing research tools and collaborating on research projects they help in preventing cybercrimes as well as advancing knowledge in cybersecurity. They work together to formulate effective policies by mentioning the coordinating efforts to implement such by maintaining the standard with cybersecurity standards and regulations. They also raise awareness by providing educational programs engaging with communities to promote best practices about cybersecurity. Public-private partnerships on cybercrime in the America, Africa and Asia AMERICAS
The Inter-American Committee Against Terrorism (CICTE) has contributed to publicprivate cybersecurity frameworks. CICTE helps member states develop national Computer Security Incident Response Teams (CSIRTs) and shares information via the CSIRTAmericas network, which has 29 CSIRTs from 20 OAS members. • The Organization of American States (OAS) has launched cybersecurity initiatives to strengthen national capacity to fight cybercrime. These initiatives encourage PPPs by encouraging law enforcement and business sector players to exchange threat information and best practices. United Nations office on Drugs and Crime, Public-Private relationships on Cybercrime, https://www.unodc.org/documents/NGO/PDF/CSU-CyberCrime-240807-WEB.pdf
AFRICA
The African Joint Operation Against Cybercrime (AFJOC) seeks to enhance national law enforcement capacities in Africa by fostering collaboration among member nations. AFJOC gathers information, conducts cooperative operations, and shares best practices to fight cybercrime. • INTERPOL's (International Criminal Police Organization) Cybercrime Operations: There efforts in Africa include both governmental and private sectors, boosting cybersecurity. These operations attempt to disrupt criminal networks and increase regional cyber security cooperation. • Cyber Awareness Campaigns: Promoting good cyber practices for people and enterprises is essential for fostering cybersecurity awareness in African countries.
ASIA
Asia UNODC Global Cybercrime Programme: UNODC (United Nations Office on Drugs and Crime) activities in Asia enhance cybercrime responses via technical support, training, and capacity development. These projects promote governmentprivate sector partnership to improve investigative capacities. • Regional Capacity Building: Southeast Asia programs equip law enforcement and judicial professionals to investigate and prosecute cybercrime offenses. The significance of a coordinated response across sectors is stressed in digital forensics and evidence handling courses. • Recent initiatives in Asia have aimed to create a gender-inclusive environment for cyber workers, acknowledging the value of varied viewpoints in tackling cybercrime.
Challenges faced by public-private partnerships and its solution • Collaboration between public and private institutions may be hindered by a lack of trust and communication. Without confidence, organisations may not communicate vulnerable and danger information. Solution: Communication and conversation are essential. U. S. initiatives like the Joint
Cyber Defence Collaborative (JCDC) foster stakeholder trust and information exchange. Information-sharing agreements may boost partner trust if transparent. • Priorities and goals conflict. Challenge: Public and private sectors have differing aims, which might cause strategy and priority mismatch. Solution: Setting objectives that benefit both sectors may align interests. Grants and praise for cybersecurity projects may boost teamwork. Attending seminars or collaborative planning sessions may help align goals. • Law and Regulation Roadblocks. Challenge: Data privacy rules and regulations might make sector-to-sector information exchange problematic. Solution: Governments should unify data sharing laws while protecting privacy. By clarifying PPP law, Canadian legislation may enhance collaboration.
• Resource restrictions may hinder successful collaboration engagement between both sectors, including financing, technical competence, and manpower. Solution: Combining resources from both areas maximizes effect. Private enterprises may improve cybersecurity with knowledge and new solutions, while governments can support or help them. • Coordination Challenges: Clear roles and duties in PPPs might be hindered by bureaucratic structures in government agencies. Solution: Definition of partnership roles fosters responsibility and clarity. Structured governance with established points of contact improves collaboration and streamlines activities. • PPPs must adapt to the ever-changing cyber threat landscape to respond quickly to emerging vulnerabilities.
Solution: Flexible solutions for continuing evaluation and adaption are required. Regular cyber event simulations help equip both sectors to react rapidly to new threats. • Limited cybersecurity specialists provide a challenge for public and private sectors to collaborate successfully. Solution: Both industries need joint training programs to improve abilities. Educational partnerships with universities and technical institutions may create a cybersecurity talent pool.
3. EMERGING TECHNOLOGIES AND ITS IMPLICATIONS ON STATES CRITICAL
INFRASTRUCTURE PROTECTION.
The emerging technologies are those which are underdeveloped and innovative in nature, are rapidly developing and have the potential to make revolutionary changes in the various aspects of our lives. They are the new concept and have an evolving character which is generalized by rapid growth, disruptive effects on industries and have uncertain long-term consequences. The examples of emerging technologies are Artificial Intelligence (AI), Internet of Things (IoT), Blockchain, Virtual Reality (VR) and Augmented Reality (AR), Robotics, Nanotechnology and Biotechnology. These technologies have brought various conveniences. But due the growth of these technologies it is essential to use them responsibly as they raise concerns about privacy, ethics and the digitality. 4 Emerging Technologies offers wide range of opportunities. They are:
1. They reduce the errors and helps humans to be free to focus on complex tasks which
can help in gaining efficiency and productivity in various industries. Automation, artificial intelligence and the IoT are the examples of such smooth processes.
2. They help in easier and faster communications which helps in collaborations with
global aspects and remote work opportunities. 5G Network as technologies, video conferencing and cloud computing helps in these aspects. 4 Engr. Muhammad Mushfiqur Rahman, Emerging Technology: key challenges and opportunities (Sept.3, 2024) https://www.isaca.org/resources/news-and-trends/newsletters/atisaca/2024/volume-17/emerging-technologykey-challenges-and-opportunities
3. They also contribute to the implementation of telemedicine, precision medicine, and
drug discovery technologies in healthcare facilities. Effective learning can be achieved by transforming the educational model to include virtual reality and individualized learning platforms.
4. With the help of emerging technologies, one can get job opportunities in the field
of robotics, renewal energy and artificial intelligence.
5. By utilizing technologies like solar power, which can increase energy efficiency and
decrease the consumption of fossil fuels, they can also contribute to the creation of a sustainable future.
6. They can assist individuals with impairments by utilizing technologies such as
voice recognition and prostheses, which can establish a communication and information bridge for everybody. Challenges:
1. Emerging technologies have the potential to launch various attacks on vital infrastructures,
affecting communication networks and power grids. Once hacked, these attacks could result in extensive disruptions and physical harm.
2. They have sophisticated security flaws that allow them to alter data and interfere with
national security operations, so they can steal vital information.
3. In order to obtain benefits or build weapons, state and non-state entities attack technology
companies and steal their intellectual property.
4. The AI if used in wrong ways might be used to launch vigorous attacks without human
intervention.
5. They are often used to spread wrong information and manipulate public opinions; privacy
concerns occur related to vast data collected by these technologies which might be misused and can be used for blackmailing.
Recommendations:
1. The proactive and innovative ideas should be taken for exploring and
implementing technologies like Augmented Reality (AR) and Virtual Reality (VR) for enhanced stimulations and training.
2. Collaborating and adopting new standards of quantum-resistant cryptographic
algorithms to protect the future against quantum threats.
3. Prioritizing and updating the international collaboration to enforce
cybersecurity standards or threat intelligence standards across the critical infrastructure sectors.
4. Utilizing and implementing AI-driven predictive analysis with a Zero Trust
approach for monitoring and verifying the security incidents.
5. Investing and addressing the gaps between the digital and cyber physical
integration.
6. Establishing and expanding platforms for public-private sectors as well as cross
sectors working group and joint exercises for collaboration.
7. Collaborating and encouraging to establish and promote best practices of IoT
security framework. 8. Investing and strengthening the training programs for professionals and publicprivate partnerships for expertise and resource exchange. INSTANCES: STUXNET (2010): Stuxnet was created by the U. S. National Security Agency, the CIA and Israeli intelligence to create real-world physical effects and targeted centrifuges that used to produce the enriched uranium which powers nuclear weapons and reactors. Stuxnet was intended to spread up to Iran’s Natanz uranium enrichment but with time other groups modified the virus to target facilities like water treatment plants, power plants and gas lines. Though the facility was not connected to internet, but the malware did end up on internet connected computers and began to spread with an aggressive nature worldwide.
UKRAINIAN POWER GRID ATTACK (2015): This was first publicly acknowledged successful cyberattack done by a persistent threat group known as Sandworm during the Russian-Ukrainian war (2014-Presesnt). On December 23, 2015, the power grid in two western regions of Ukraine was hacked, which resulted in power blackout for roughly 230,000 consumers in Ukraine for (1-6) hours. COLONIAL PIPELINE RANSOMWARE ATTACK (2021): On May 7, 2021, Colonial Pipeline, an American oil pipeline system transporting gasoline and jet fuel from Houston, Texas, to the Southeastern United States, had a ransomware hack that compromised the electronic systems controlling the pipeline. The Colonial Pipeline Company ceased all pipeline operations to mitigate the assault and promptly paid the demanded sum of 75 bitcoin, equivalent to $4. 4 million USD, within a few hours.
Following the payment of the ransom, DarkSide sent an IT tool to the Colonial Pipeline Company to facilitate system restoration. Nevertheless, the instrument required an extensive duration for the system restoration to a functional condition. An emergency was proclaimed by President Joe Biden after the assault on over 17 states and Washington, D. C. KILLERNET (2022-2023): KillNet is a Russian hacking collective, once recognized for offering DDoS services at a rate of 350 per month; a singular network had a throughput of
500 GB per second and included 15 machines. The cybercriminals offered their services over
Telegram conversations that were often blocked. Following February 24, 2022, the start of the Russian-Ukrainian war, KillNet began executing DDoS (Distributed Denial-of-Service) assaults against nations who supported Ukraine. Since then, the group has executed assaults against the U. S. , Germany, Italy, Poland, and others, often appropriating data from various organizations. In late October 2022, the security channel PCrisk identified the first sample of KillNet ransomware. The organization declared a ransomware assault on an Italian chemical business using a Telegram channel. USA HEALTHCARE SYSTEM (2024): On February 21,2024, United HealthGroup’s subsidiary Change Healthcare was attacked by Russian ransomware group ALPHV Black cat, which compromised the protected data of at least 100 million individuals equivalent to one third of U. S. population.
The attack disrupted the nationwide billing at pharmacies, delayed medications as well as risks to medical practices. To protect the patient’s data, the United Health paid $22 million to the criminals behind the attack.
ANALYSIS
Critical infrastructure is the backbone of the world’s functionality. The protection of critical infrastructure from cyberattacks is one of the vital duties of the states. It is the responsibility of the state to protect its citizens and for such developments, new policies should be established with the new emerging levels of cybercrimes.
1. With the change of time, internet became the most important part of our daily life, but
it was not designed with the level of security needed with the current times. So, without the changes in policies, it will be difficult to change the inherent vulnerabilities.
2. The interdependence of essential services with non-critical systems questions the
boundaries and the vulnerabilities, which acts as a chain reaction. So, the interdependence should be looked after.
3. The competing nature of global states, and increasing cyber conflicts, hinders the
international cooperation and there’s a lack of ideas of what need to be protected, which creates a fragmented security landscape.
4. The tendency of focusing on protecting and not on the risks or criticality, both public
and private sectors often lack comprehensive understanding of the evolving cyberthreats which masks the strategies difficult.
5. The complexity of digital supply makes it challenging to identify vulnerabilities as it
involves numerous vendors and technologies.
6. The replacement of outdated technologies is important as these systems are easily
targeted by the attackers, though its costly and complex, but it’s necessary.
7. The organizations have limited budgets and expertise which hinders their ability to
invest in necessary tools, training and personnel.
CONCLUSION
Digital technologies are a vital part of our life which has made living much easier. But availability of it made the critical infrastructure more prone to cyber threats. So, the states must ensure the protection of critical infrastructures on an urgent basis. The research has also highlighted the functions of government in protecting the critical infrastructure through comprehensive approached including policy developments, risk management strategies and establishment of public-private relationship. The organizations have limited budget and limited availability of resources, legal barriers, complications in collaboration between public and private sectors. Development of new technologies should be taken into considerations for the betterment.
There should be coordination between government entities and private organizations so that states can increase their ability to detect cyber threats effectively. The states should be creative minded and should be keen on developing new ways for protecting the critical infrastructures. There should be cooperation between the national and international level with a set standard which won’t bring dilemma in future recommendations.