Preparing for Digital Disruption

Abstract

Prevention is better than cure, goes the adage. There is much to be said for prevention, especially when there is a chance to avoid the consequences of disruption altogether. But even if we take every preventive measure under the sun, we can never entirely exclude the possibility of serious disruption to the normal functioning of society. We therefore need to be prepared and to have early-warning mechanisms that can alert us when things are going awry. If disruption does occur, adequate follow-up action is vital. Recovery and reconstruction are key if society is to resume its normal functioning as rapidly as possible.

4.1 Introduction

Prevention is better than cure, goes the adage. There is much to be said for prevention, especially when there is a chance to avoid the consequences of disruption altogether. But even if we take every preventive measure under the sun, we can never entirely exclude the possibility of serious disruption to the normal functioning of society. We therefore need to be prepared and to have early-warning mechanisms that can alert us when things are going awry. If disruption does occur, adequate follow-up action is vital. Recovery and reconstruction are key if society is to resume its normal functioning as rapidly as possible.

For physical risks such as major flooding or a severe flu epidemic, the government and other actors have identified measures to increase preparedness, detect early signs of disruption, minimize the impact and facilitate recovery. Probably more than any other event, the Covid-19 outbreak has underlined the importance of swift and coordinated responses. The Dutch government, however, has only recently recognized the risk of societal disruption due to the failure or disruption of digital infrastructure. Partly for this reason, we are unprepared. Extant policies focus on cyber security and prevention rather than on handling disruptive events as they unfold. This section discusses how our plans for digital disruption could be designed to include better preparation for its effects on society. We distinguish between four stages: preparedness, detection, mitigation, and finally, recovery and reconstruction.

4.2 Preparedness

Detection, mitigation and, in particular, recovery and reconstruction largely depend on how well we are prepared to handle societal disruption. Unlike prevention, they involve measures that seek to limit the effects of the disruption and to facilitate recovery. They are comparable to the role played by firebreaks in a forest or artificial hills in flood defences, which do not prevent flooding but provide protection from the rising waters and limit the number of victims. Precautionary measures can likewise limit the societal disruption caused by ‘digital fires’. The first stage is preparedness. Within this category, we distinguish between four areas: fall-back options, isolation, cyber security exercises, and the provision of information.

4.2.1 Fall-Back Options

Options for switching to different facilities come in many shapes. The most well-known is the back-up facility, a diesel generator to generate power in an emergency. A crucial issue is how long this type of facility would have to function. With back-up facilities for digital systems, one consideration is how long data needs to be retained, which would depend on the type of data involved. Following the NotPetya attack, Maersk was able to save much of its data by contacting data centres around the world. But what was missing was a back-up of how the company’s own IT system – the digital core of the company – was set up.¹ The Maersk case shows the importance of companies to plan ahead. Some processes have become so large and complex that back-up facilities are practically impossible to implement, partly due to cost. In short, back-up facilities are important but are no longer the obvious solution for certain processes.

Another possibility when considering fall-back options is using multiple providers, applications or infrastructures so that contingency options are available. But this is not always feasible. There is no real alternative to the global internet, where the only realistic approach is a long-term joint effort by national governments, companies, non-governmental organizations and experts to make the internet more secure.² Another hurdle for having multiple contingency options is the poorly functioning market for digital services and products, particularly in the field of cyber security.³ The result is that governments, companies and organizations worldwide must choose between a handful of large providers.⁴ Precisely because of their size and importance, these providers are attractive targets for geopolitically motivated attacks. At the same time, they have become ‘too big to fail’ for major sections of the global economy.

That said, concentration also has advantages when it comes to limiting disruption. Precisely due to their scale, large cloud providers are often better protected against cyber-attacks than the organizations that use them to host their data. With economies of scale, the services of these providers are often cheaper than those of smaller parties. At the same time, customers need to be confident that these giants are taking adequate measures to handle disruption. If many customers simultaneously face the same problem, questions will inevitably arise about who gets priority. The outage of Google Cloud (see Sect. 4.1) showed that Google had all kinds of contingency plans in place. The question is to what extent these plans are consistent with the public interests that the government represents.

An alternative fall-back option would be returning to more ‘old-fashioned’ ways of working. In the event of disruption or the failure of digital facilities, organizations are usually still able to temporarily revert to less efficient modes of working through paper-based methods or the manual operation of mechanical installations. But this assumes that employees are still able to work with these older systems, and that those systems remain available. The rise of digitization and robotics has meant that manual skills and ‘old-fashioned’ facilities (such as local bank branches), and even cash itself, are rapidly disappearing. Preparedness implies that alternative methods and skills to assure crucial societal functions remain available. An illustrative example comes from the US Navy, which has decided to teach recruits how to navigate by the stars again.⁵

4.2.2 Isolation

Firebreaks are used in forests to contain large fires. In the event of a nuclear disaster, the reactor is encased in a concrete shell to minimize radiation leaking into the environment. For every form of disruption, there are strategies for containing the incident and preventing the damage from spreading. For digital disruption, network separation could play this role. Network separation entails placing partitions between different systems and the digital processes that handle these systems. The most radical form of network separation is for an organization to disconnect from the global internet, known as ‘islanding’ among IT experts. But in a highly connected world, this is not always realistic.⁶ After all, these systems are connected for a reason, and islanding deprives them of this connectedness.⁷ The partial separation or temporary deactivation of specific networks are more attractive options.

When implemented properly, network separation can stop disruption in its tracks or prevent further contamination. Network separation is desirable for certain key societal functions, also because it reduces dependence on third parties. Nevertheless, most government organizations currently lack clear strategies for network separation and there is limited coordination. Organizations often independently decide on the form and extent of network separation. Departments are often reluctant to set requirements due to the additional costs.⁸

4.2.3 Cyber Security Exercises

At the national level, within the European Union and in the context of NATO, cyber security exercises focus on critical infrastructure. There are also sectoral initiatives such as in the telecommunications, water, and financial sectors. Cyber security exercises give us a more realistic picture of the form disruption could take and its potential consequences.⁹ They also enable parties to identify risks and hazards, familiarize themselves with emergency procedures and practise taking decisions under duress. An additional goal is strengthening mutual trust, essential when responding to an emergency.¹⁰

The number of cyber security exercises rose sharply worldwide between 2002 and 2015.¹¹ They increasingly involve a mixed group of private and public organizations (see inset).

Cyber Security Exercises for Financial Institutions

The TIBER (Threat Intelligence-Based Ethical Red Teaming) initiative launched by the Netherlands’ Central Bank (DNB) tests connectivity within the financial sector. It is a public-private partnership that includes, among others, the police, the National Coordinator for Security and Counterterrorism, banks, insurance companies, pension funds and the stock exchange.

TIBER focuses on simulating cyber-attacks on financial institutions, with ethical hackers copying the working methods of real hackers. Following the test, both the attacker and the bank provide crucial information about the resilience of digital security. Lessons learnt can be used to benefit the entire financial sector.

According to DNB, the TIBER test programme is an example of successful cooperation in the field of cyber security and could also be applied in other key sectors. A pilot programme is currently taking place in the energy sector in collaboration with the Cyber Security Alliance.

While the majority of cyber exercises take place in Europe, they do not cover all key sectors. Some exercises do not focus on digital infrastructure at all.¹² Exercises that involve multiple organizations, focusing on the complex chains and networks within which they operate, are few in number. But such exercises are vital, not only to identify dependencies, but to gain better insight into the various standards and protocols that organizations use. Cyber security exercises help organizations to learn how others respond and who should be approached in common situations.¹³

4.2.4 Provision of Information

Another way of mitigating the effects of digital disruption is to provide information about what is happening and how to best respond. What constitutes useful information varies. Organizations affected by disruption need to know what actions they can take to limit the impact as much as possible. For instance, there are detailed communication requirements for the failure of electronic payment transactions, designed to help restore confidence.¹⁴ Emergency services must have eyes on the ground; members of the public must know about first aid, emergency escape routes, and how to notify the authorities. The digital equivalent would include providing information about the installation of patches and about additional measures to reduce the risks of being affected.

The provision of information to citizens merits particular attention. During and immediately after societally disruptive events, citizens are often seen saving themselves and assisting others.¹⁵ But the longer a disruptive situation lasts, the more it affects people’s capacity to respond rationally. Little can be done about this. Research shows that citizens hardly ever prepare for disruptive events. They generally underestimate the likelihood of disruption or believe the consequences will be manageable. While people attach great importance to the government’s response to crisis situations,¹⁶ many governments prioritize asking citizens to take preventive measures. Information on coping with and responding to digital disruption is largely absent.¹⁷

Digital channels and social media can play key roles in crisis communication.¹⁸ As almost everyone is connected to everyone else, people can be informed of disruptive events very quickly, even in real time, and be advised on how to get back to their normal daily business. Of course it is not only the government that uses social media: citizens communicate about incidents among themselves, sharing pictures and video clips, as happened during the attack on the Boston Marathon in 2013.¹⁹ Social media can also be a highly disruptive factor in crisis communication. In the event of an incident, it is often members of the public who occupy ‘front-row seats’, broadcasting what they are witnessing to large numbers of other people and giving their own, often emotional, account of events. If an incident were to disrupt or take out digital channels of communication, this would – in a society accustomed to rapid digital communication – only exacerbate people’s feelings of unease. It has become extremely challenging for governments to maintain the upper hand in providing information. In cross-border cyber incidents, EU member states only coordinate their public communications to a very limited extent.

4.3 Detection and Early-Warning Systems

The early detection of disruptive events is important because the longer the signs go unnoticed, the greater the potential for damage.²⁰ Early detection can take many possible forms, including the monitoring of networks and data flows; this approach is mainly technical in nature and will not be considered in detail here. We turn to the sharing of information between parties, an effective means to guarantee the performance and continuity of key sectors.²¹ How this is organized and the development of a strategic information position are important factors.

4.3.1 Organizing the Exchange of Information

The exchange of information in many countries is organized through public-private partnerships. At the European level, the European Union Agency for Cyber Security (ENISA) and the European Computer Response Team (Cert-EU) are the primary information node and centre of expertise, representing the institutions of the European Union in numerous national and international forums. At the state level, National Cyber Security Centres fulfil similar functions, serving as the Computer Security Incident Response Team for national governments and critical service providers.

In the Netherlands, the exchange of information between government bodies and public and private actors has become much more comprehensive. Digital processes such as the government’s electronic message service and the identification and authentication of citizens and companies wishing to use government services have been designated as critical services. The implementation of the Network and Information Security (NIS) Directive means that internet exchange points, top-level domain name registries and DNS service providers fall under this regime.²² The NIS Directive obliges major digital service providers to report incidents and to take measures to manage risks and reduce the consequences of incidents.²³ Although this extension of legislation is an important step, questions remain about the structure of the current system.²⁴ While the exchange of information is largely organized along sectoral lines, digitized societal processes are often interconnected, meaning any disruption could be accompanied by cascade effects between sectors. A quick and effective response to disruption would require the exchange of information not only within sectors but between them.²⁵

The exchange of information is also hampered by the distinction between ‘critical providers’ and ‘non-critical providers’. While critical providers exchange information with each other and with the government through Information Sharing Analysis Centres, many organizations classified as critical use the services of parties whose products and services are not classified as critical. The latter are not bound by the same reporting obligations as critical providers, although their operations may have a major impact on the continuity of critical processes (see inset).

Power Supply Under Pressure from Digitization

The electricity system is classified as critical infrastructure in almost every country. Because this system increasingly relies on digital technology, any issues with digital technology could have a major impact on the supply of power. Yet the suppliers of digital technology are often not required to meet the same safety and security requirements as providers of critical services.

Advanced software and algorithms play a growing role in the supply, transport, and distribution of electricity. This trend is introducing new vulnerabilities. The risk of outages due to programming errors increases because processes in power plants and electricity networks are controlled by increasingly complex software programs. Disruption can also occur if autonomous digital systems behave in unexpected ways and/or respond to one another in unexpected ways – a risk with pre-programmed systems for energy production and supply from solar panels and wind turbines. Our digitized electricity system is also vulnerable to deliberate disruption, particularly now that many parts of the system are connected to the internet.

Because more and more societal functions depend on electricity, the consequences of incidents are likely to be more serious. And because the power supply of many European countries is now interlinked, vulnerabilities in the electricity system of one country also pose risks to the electricity systems of other countries.

The question is to what extent the current distinction between ‘critical’ and ‘non-critical’ providers should be retained. The same question arises for the critical and non-critical parts of government, because information flows transcend the departmental boundaries and levels of government.²⁶

The distinction between critical and non-critical processes also affects businesses and societal organizations. While companies and organizations deemed non-critical receive less information about vulnerabilities, they often fulfil key societal functions such as supplying medicines or checking the quality of drinking and swimming water.²⁷ To bridge this gap in the Netherlands, the Digital Trust Centre has been set up as a counterpart to the Information Sharing Analysis Centres for the private sector. But the companies served by the Digital Trust Centre vary enormously in the information they need, their ability to take remedial measures, and the potential impact on society of any disruption in their functioning. The same problem exists in other countries. The British Cyber Security Strategy identifies a number of ‘preferential sectors’ in addition to 13 vital sectors, on the grounds that ‘other companies and organizations’ also need more support.²⁸

Although information sharing has improved significantly in recent years, the definition of society’s core processes requires adjustment. As these processes are increasingly digitized and embedded in complex networks, clear distinctions between ‘critical’ and ‘non-critical’ processes can no longer be made; nor will measures solely targeting critical processes necessarily improve our security. There are so many ‘unknown unknowns’ that it is impossible to know in advance exactly which processes or outages would lead to disruption.²⁹ The cross-border chains and networks within which critical providers operate necessitate international information sharing. We need a more strategic approach to information to better understand the dependencies involved.

4.3.2 Strategic Information

Cyber risks are relatively new and remain difficult to identify and evaluate. Nevertheless, important steps have been taken in recent years to share information on digital security measures, vulnerabilities and incidents.³⁰ We know, for instance, that every piece of commercial software has many vulnerabilities, the majority of which have not yet been discovered.³¹ In the meantime, vulnerabilities are also appearing in hardware (such as chips), meaning that it is possible to read the memory of computers without authorization.³² The landscape of malicious actors is also constantly changing. All this means that the task of identifying potential issues and publicizing the available solutions is never finished. Given the global and sometimes geopolitical nature of the threats, robust international cooperation and the structural involvement of intelligence services are vital.

Our current level of information sharing on security measures, vulnerabilities and incidents is insufficient for an adequate detection system. There are too many gaps in our knowledge about the chains and networks through which digital disruption could spread. We need detailed insight into the interdependencies between companies and organizations involved in society’s core processes, the importance of which are often underestimated.³³ The potential effects of disruption further down the chain currently remain outside of risk analyses and crisis plans.

Understanding these dependencies requires analysis from an international perspective.³⁴ While attacks often exploit generic vulnerabilities, incidents may affect European member states in different ways. The services of EU member states may be interdependent, meaning that incidents in one country can impact other countries, as seen for example in international payment traffic. Attackers’ use of networks to achieve their goals also means disruptions will have wider reach.

More knowledge is also required about the government’s strategic position. What crisis-management options are available? What dependencies would the government have to contend with? Most providers of critical services are privately owned and do not fall under direct government control; many are based overseas. What authority would the government have over such parties? The context in which the government must operate is affected by market concentration and foreign ownership. Although the risk of (foreign) share ownership is adequately contained in many sectors, it remains a key concern for critical infrastructure.³⁵ As critical processes are digitized, the same applies to dependence on (foreign) private digital service providers, such as cloud providers. Looking ahead, decisions will need to be made about investments in new digital technology. If the government does not anticipate developments early and seek to manage them, it may become more difficult to manage digital disruptions when they occur.

4.3.3 Responsibilities

Experience suggests that security within sectors does not improve unless the government takes a clear lead. But in complex, networked societies and economies, security also requires collective commitment from all parties involved.³⁶ Here the responsibility of the government is to create the conditions which ensure the effective sharing of information. At the same time, the government should encourage, and sometimes require, market actors to take their responsibilities seriously and to develop the necessary capabilities to do this. The government has traditionally played this role to ensure the continuity of core societal processes. Their digitization means that the government must play this role in the digital domain as well.

Sharing and analysing information is necessary to improve the cyber security of organizations, to make them more resilient to incidents, and to limit the damage when incidents occur. But not all parties currently participate in the Information Sharing Analysis Centres. Some are reluctant to share sensitive information in light of competition, legal restrictions, national security, and the government’s ability to use it for law enforcement purposes.³⁷ Such reluctance may be greater during a crisis with reputational damage at stake.³⁸ Nevertheless, security must be everyone’s priority.³⁹ The challenge is for the government to improve its position without jeopardizing security, confidentiality and the systematic sharing of information. The EU’s Network and Information Security Directive provides the tools for this by imposing stricter requirements on critical providers for reporting incidents.⁴⁰ But we still do not know enough about how this will be supervised, or about the consequences for violating the trust on which the sharing of information is based.⁴¹

4.4 Responding to Incidents

Digital processes have been affected by incidents large and small in recent years. Incidents in the Netherlands have been handled successfully, in that they did not lead to widespread societal disruption. This may tempt us to conclude that current instruments and regulations are adequate. But the continuing march of digitization – particularly the growing interconnectedness of the digital and physical realms – encourages us to rethink existing frameworks and procedures. There are three specific areas where we need to reassess our existing instruments. We discuss them in turn below: legal powers, cross-border mitigation, and setting priorities.

4.4.1 Legal Powers

In the physical realm, the government has emergency services such as the police, fire brigade, ambulance and rescue teams to respond to crises. These and other services have legal powers to carry out their duties, for example the ability to cordon off particular locations, enter a company’s premises or initiate an evacuation. But what resources can the government call on in the event of a digital crisis? The hack at DigiNotar in 2011 painfully revealed the government’s dependence on private actors to resolve problems in the digital realm.

The Acquisition of DigiNotar

On 29 August 2011, the government received a report of problems at the DigiNotar certificate authority, responsible for securing electronic communications from and between government bodies (known as Public Key Infrastructure or PKI). Hackers had managed to release forged DigiNotar certificates. As a result, government certificates could no longer be relied on and were possibly even unusable. Goods at the Port of Rotterdam could no longer be accepted, social security payments were blocked, and the payments system compromised.

The immediate reason for the impending crisis lay with the major browser suppliers, including Microsoft, which were losing confidence in all DigiNotar certificates, including the PKI government certificates. This was a very real threat as Microsoft could have blocked the use of all DigiNotar certificates with its monthly security update to maintain confidence in its own systems. Regardless of the parties involved, Microsoft did not want to continue supporting potentially unsafe communications.

At this point, the Dutch government had every interest in clarifying how many certificates had been manipulated or compromised. But despite urgent investigations, it was unable to retrieve this information. On 3 September, the government decided to take over the management of DigiNotar. There was no specific legal basis for this, but the Dutch government was able to count on the ‘voluntary’ cooperation of its American parent company Vasco. Microsoft then postponed its security update in the Netherlands for 1 week, which bought enough time to replace the certificates.

Estonian Government and Gemalto

The vulnerability in the chip of Estonian ID cards is a more recent example of the dependence of governments in solving problems in the digital realm. In September 2017, a vulnerability was discovered in a certificate that affected laptops and PCs as well as authentication to cloud applications. The vulnerability also affected ID cards in Estonia and eID cards in Slovakia, Spain and other countries. In Estonia, the ID card is used to authenticate one’s person and to digitally sign documents. In theory, hackers were able to steal users’ digital identity and access sensitive personal information, manipulate the results of e-voting, and hack into the state’s information systems.

In November, the Estonian government decided to suspend all certificates of approximately 800,000 ID cards. Intensive users such as doctors were able to update their certificates at several government locations while the remote updating of certificates was disabled. Gemalto, the company that produced the chips, and the Estonian government, seeking €152 million in damages, traded accusations. The government was unhappy with Gemalto’s handling of the security breach, especially its failure to notify the government of the problem.

At first glance, the Dutch decision-making structure for granting legal powers for crisis decision-making appears in good order. If societal disruption occurs, decisions are made through structures set out in the National Guide for Crisis Decision-Making (NHC). There is also a National ICT Crisis Plan, currently under review. In the NHC, the government has three roles: facilitation, management, and coordination. The latter, including the deployment of the police and fire brigade, and requisitioning resources, requires legal authority. The NHC also refers to ‘measures in the event of a major IT incident’ which are not set out in detail.⁴²

The national IT Crisis Plan describes an IT crisis as ‘a threat or crisis that originates in the field of information technology, which places one or more vital interests in jeopardy and for which the regular structures are not adequate.’

In the event of an (imminent) IT crisis, the IT Response Board (IRB) is activated. The IRB – a flexible public-private partnership – analyses the crisis and, if necessary, advises the Interdepartmental Crisis Management Committee, the official communication channel for the Ministerial Crisis Management Committee, chaired by the Minister of Justice and Security or the Prime Minister.

Private actors can be required to cooperate if (imminent) disruption or the failure of their systems could undermine the public interest. They are required to keep the government informed about the situation and to cooperate in tackling the causes and consequences of the disruption.⁴³ But the interests of private organizations are not always consistent with the public interest that government represents; nor does the government have the means to force private parties headquartered overseas to cooperate. The government’s role in cyber security is often limited to providing advice or assistance to the private organizations that form the critical infrastructure. Such was the case when, partly due to the lack of powers to intervene, the municipal crisis response team in Rotterdam was unable to access information about the terminals and systems of the container company Maersk as they were being hit by the NotPetya attack (see inset).

NotPetya and the Municipality of Rotterdam

In June 2017, hackers working for the Russian military distributed the NotPetya ransomware. One of the most prominent victims was Maersk, which runs container terminals around the world. The gates to ports could not be used, cranes ceased to work, trucks were unable to unload their cargo and new cargo shipments could not be booked. Maersk, an ultramodern shipping company, was forced to revert to a paper-based system.⁴⁴

The terminals in the port of Rotterdam were affected by the attack. Container transport via the port as well as the surrounding highways and rail links ground to a halt, causing congestion and long traffic jams. The city authorities were unprepared. They had difficulty gathering the relevant actors; the municipal crisis response organization responsible for public order was initially denied information about Maersk’s terminals and systems. The city authorities were thus unable to assess the situation’s seriousness and whether, for example, there was a risk to public order.

Formal assistance from the National Coordinator for Security and Counterterrorism was impossible because Maersk’s APM terminals, unlike the Port of Rotterdam itself, were not part of the ‘critical infrastructure’.

A great deal of sector-specific legislation outlines the powers of the government in exceptional circumstances. During a crisis, parties are obliged to cooperate and to follow government instructions. The legislation, however, is lengthy and complex.⁴⁵ Extensive explanation would be needed for relevant parties to understand the implications. Although sectoral legislation can provide useful starting points for government intervention, the question is whether these powers are sufficiently comprehensive and suited to the problems of a digital world.

The government can also act without making use of sector-specific provisions. In a crisis, and if circumstances warrant, the law could simply be broken in a case of ‘needs must’. This is not a desirable course of action.⁴⁶ It would require a degree of improvisation, better minimized for maintaining the rule of law.⁴⁷ Government actions – especially interventions by authorities such as the police and the public prosecution service – should be predictable and subject to accountability.⁴⁸ A crucial question is whether interventions would be justified if they did not also serve the purposes of an investigation or prosecution.

The problem extends to who takes the relevant decisions and initiates the required actions. As in the physical realm, the primary responsibility of companies operating in the digital realm is to ensure their own security and to draw up contingency plans for emergencies. Large companies need to arrange for their own cyber security departments, sector-specific Computer Emergency Response Teams or employ the services of private cyber security companies.⁴⁹ The government will only step in when circumstances involve (the risk of) societal disruption.

It is often not immediately clear who or what caused an incident, and in the case of deliberate disruption, the motive.⁵⁰ It can thus be unclear whether government bodies such as the Ministry of Defence, the national cyber security authorities, the police or the intelligence services should take action. As each body has its own sets of powers and interests, the government’s approach could well depend on who responds to the incident: the police are primarily concerned with identifying perpetrators so that the public prosecutor can take action; the intelligence services are more inclined to protect their information position; the national cyber security agency, given its remit to ensure information security, openness and stability, focuses on remedial action. While the police also have the powers to provide assistance and to prevent escalation, public order and security must be at stake.⁵¹ A national cyber security authority would not always be bound by this requirement.

In conclusion, legal powers for the digital domain and for mitigating disruption are not always sufficiently clear and well defined. The emphasis is currently on advising and supporting parties within infrastructure categorized as critical. But if parties refuse to cooperate, it is unclear what powers the government has to intervene, and on what grounds. Given the limited powers of the national cyber security authority, which focuses on technical expertise and assistance, previous interventions have largely been ad hoc.

4.4.2 Combating Cross-Border Crises

Digital disruption will unlikely be confined within national borders. Research shows that cross-border crises are by definition challenging.⁵² Nevertheless, some steps have already been taken at the international level. For example, the EU has put various crisis management provisions in place, some specifically for cyber security.⁵³

The most important initiative is the Cyber Security Strategy of the European Union which dates from 2013, on which the 2016 Network and Information Security Directive and the 2018 Cyber Security Act are based. The NIS Directive obliges member states to establish a national centre for cyber security and establishes European level cooperation between these centres. The Cyber Security Act strengthens ENISA, the EU agency for cyber security.

The EU has a number of specialist cyber security organizations, including ENISA, the European Centre for Cyber Crime (EC3), which falls under Europol, the European Defence Agency (EDA), and the European Computer Emergency Response Team (CERT-EU).

A number of countries, including the Netherlands, have signed a letter of intent for a European Cyber Rapid Response Force to respond quickly in the event of a large-scale digital incident.⁵⁴

The Forum of Incident Response and Security Teams (FIRST) is a worldwide partnership of CERTs.

The capacity of these facilities has improved in recent years.⁵⁵ While cross-border initiatives have been initiated to improve cyber security in critical sectors, such as energy and transport,⁵⁶ existing mechanisms for dealing with cross-border crises are fragmented across a range of institutions. Their functions are not always clearly defined and, according to experts, their effectiveness is at best limited.⁵⁷ Although the NIS Directive should lead to improvements, it still does not provide a framework for EU-level cooperation in the case of major cyber incidents.⁵⁸ EU member states have therefore asked the European Commission to produce plans for responding to a major cyber incident involving multiple member states. In the meantime, the ‘blueprint’⁵⁹ outlines what a timely and effective response would look like. Practice exercises are needed, and since the blueprint does not provide any new legal powers, combating incidents will still fall on national crisis management mechanisms. The question is whether these are still fit for purpose.

4.4.3 Setting Priorities

Not all instruments and resources can be deployed simultaneously. Some areas will have to be prioritized, again pointing to the importance of clearly defined decision-making powers. There are questions about when the government should deploy which instruments, the most effective use of resources, and the relationship between detecting and counteracting incidents on the one hand and legal powers on the other. Many governments are also working to improve the categorization of cyber incidents.

France is considering classifying cyber-attacks according to specific response options.⁶⁰ The United States has had such a system since 2014, where The National Cyber Security and Communications Integration Center (NCCIC) reports incidents and assesses risks by assigning a score between 1 and 100 based on 8 criteria:

• actual impact on an organization;

• observed activity;

• location of detection;

• actors involved;

• type of information that has been lost, compromised or corrupted;

• recovery options;

• cross-sectoral dependencies;

• extent of societal disruption.⁶¹

The United Kingdom has recently developed a system of six categories of incidents, covering the entire spectrum from local incidents to national emergencies. The British National Cyber Security Centre links each category to a party responsible for responding to the incident.⁶²

Following the EU blueprint for preventing incidents, the European NIS cooperation group⁶³ has drawn up a taxonomy of large-scale cyber incidents.⁶⁴ Alongside malicious acts, it includes spontaneous system failure, natural phenomena such as fires, floods and earthquakes, human error, and failures by third parties. The aim is to link this taxonomy to integrated EU political crisis response (IPCR) regulations.

While the Dutch government’s assessment of incident severity is linked to its list of critical infrastructure, the examples above show the usefulness of additional criteria for combating digital incidents. For starters, the national government would not have to be involved in all incidents. A more differentiated classification system could form the basis for a more clearly defined division of responsibilities, both within the various layers of government (such as the national cyber security authority, government departments, safety regions, and municipal information security services) and between government bodies and the business community. A more nuanced classification system for cyber incidents would allow for more effective responses, as action by the central government would no longer have to be directly linked to incidents involving critical infrastructure.

Prioritization also needs to occur on the spot. In the event of a major fire, the fire brigade can choose to put out the fire or to minimize damage by keeping nearby buildings wet; adjacent buildings may suffer water damage, but would be salvaged. Something similar may apply to disconnecting digital systems, requiring the assessment of the risks of acute interruption to operations and the risks of problems spreading further, possibly leading to broader damage. Because many digital systems are in the hands of private parties, the considerations the government will consider when intervening must be clear in advance.

Prioritization involves both technical and substantive aspects. On the technical side, the logic of the systems will play a role. This means that decisions regarding connecting and disconnecting networks will be based on a particular sequencing; here it is essential to know how the various systems and organizations in a network are connected. In terms of content, there is the question of which processes should be kept operating the longest and be restarted first in the event of failure. The government’s choices will not always be self-explanatory to all parties. Private actors may want to safeguard their own systems and those of their clients first, rather than prioritizing the public interest.

In the Netherlands, the continuity of critical processes is given priority in the event of an incident. Critical processes that fall under category A (the disruption of which would have severe economic and societal impact) are prioritized over those in category B (the disruption of which would have a more limited, but still substantial economic and societal impact). Digitization challenges this categorization. For digital facilities, the current list of critical infrastructure focuses mainly on traditional telecommunications services and their role in for instance the deployment of emergency services and communication between emergency services. The telecoms/IT sectors, however, fall under category B. Whether this is sustainable is doubtful. Second only to the power supply, the failure of digital facilities would likely lead to the most significant cascade effects. There are detailed shutdown and recovery plans for electricity companies, with the restoration of public order and safety being priorities. No such plans are in place for digital disruption, again underlining the importance of rethinking our definition of critical processes.

4.5 Recovery & Reconstruction

The final phase in dealing with digital disruption concerns recovery and reconstruction – the resumption of normal functioning. If normal everyday life is seriously disrupted, various steps will be required to get things working normally again. Often things will not return to how they were before the disruption because people and organizations learn from the incident. Companies and organizations affected by a computer virus or ransomware, or which have experienced system and process failures for other reasons, often alter their policies (for example staff only using USB sticks under strict conditions). To learn from such incidents, we must analyse what went wrong. The recovery and reconstruction process also requires adequate facilities. This means, for example, that victims are compensated for damages. Learning lessons and providing compensation are to some extent related. Those who wish to redesign core societal processes must have the resources to do this.

4.5.1 Evaluating and Learning Lessons

The recovery and reconstruction phase must be used to reflect on how new digital facilities are to be embedded. This may extend to rethinking the balance between economic interests and political and administrative authority in the organization of the digital society. Changing priorities may mean developing facilities that privilege security over speed, efficiency, and low prices.

We need more than reorientation; past incidents must lead to concrete learning.⁶⁵ This often does not happen, even in the aftermath of major incidents such as NotPetya and WannaCry.⁶⁶ The availability of historical data on cyber incidents is limited; there is currently no generally accepted definition of what constitutes an incident.⁶⁷ An additional problem is that most data on incidents does not concern vulnerabilities that could lead to societal disruption. Public data on incidents tends to focus on data breaches because legal disclosure requirements focus on them.⁶⁸ The Network and Information Security Directive will change this by introducing a reporting obligation for problems that affect the continuity of ‘essential services’. The European Payment Directive will also require payment service providers to report major incidents that jeopardize the financial interests of their users. As both reporting obligations have been introduced very recently, it is too early to draw meaningful conclusions.

As for the supervision of digital security, the Netherlands still lacks a designated supervisor.⁶⁹ Several organizations are active in specific, limited areas: the Data Protection Authority registers data breaches; De Nederlandsche Bank (the central bank) protects electronic payment transactions; the Telecommunications Agency monitors network providers. Several government departments are also involved as their remits cover critical sectors. The incident data that each of these organizations collects is only haphazardly shared and not always analysed, let alone in a coordinated manner.⁷⁰ This is a missed opportunity. Because digital disruptions always involve multiple organizations and sectors, it would be extremely useful to compare data on incidents.

4.5.2 Compensation

An important aspect of recovery and reconstruction is compensation to victims, whether through liability insurance or government payments. Adequate compensation reduces risks and damages to society⁷¹ and contributes to the recovery of the economy, social stability and trust in institutions.⁷² In principle, it is possible to insure against cyber risks.⁷³ As the market for cyber insurance is a fraction of the market for other risks, we may see considerable growth in this area.

Risks are insurable if they can be quantified in terms of their probability and impact. It must also be possible to draw on a sufficiently large group of individuals affected by the risk, who would therefore be willing to share it. Finally, risks need to be unpredictable in terms of when and where they materialize, and be beyond the control of the insured parties. Otherwise, each party would insure itself individually.

Cyber risks are difficult to quantify due to lack of historical data. We have no clear method for classifying incidents and no insight into the resilience of companies and the types of losses they incur.⁷⁴ Cyber risks are also constantly evolving, complicating quantification. Insurers could face massive losses due to the accumulation of risks.⁷⁵ If many parties depend on the same infrastructure or suppliers, or use the same basic software, insurers will have difficulty pooling the risks across sectors or regions. Lloyd’s and Cyence have estimated a cloud software service outage, depending on its duration, to cause between $4.6 billion and $53 billion in damages.⁷⁶ The accumulation of risks is a major reason the market for cyber insurance is growing so slowly. The extensive damage (see table below) and damage claims resulting from NotPetya are additional reasons for large insurers to limit their coverage of cyber incidents.

Impact of Interruption to Business Operations Due to the NotPetya Incident

These insurance companies felt emboldened by the United States’ attribution of the cyber-attack to Russia.⁷⁷ They also explicitly excluded alternative cover from their policies, for example through liability for or damage to company equipment (so-called ‘silent cyber’).

Damage due to armed conflicts cannot be insured by law, due to the excessive financial risk. This causes few problems when war remains a distant prospect and there is a clear definition of ‘armed conflict’. But cyber-attacks, which enable countries to harm each other’s interests without ever setting foot on their soil, cannot be placed in this category so easily. A further question is whether and when computer code can be considered a ‘weapon’, particularly given the rapid evolution of malware. Most problematically, it is unclear when cyber-attacks merit retaliation; there are no international rules or definitions to determine this.⁷⁸ Now that insurers see cyber-attacks as a form of armed conflict and companies are protesting against this move, it is up to the legal system to determine the extent to which a cyber-attack carried out by a foreign state is, in fact, an act of war.⁷⁹

The handling of other major incidents shows that solutions exist. After the 9/11 attacks, insurers withdrew because they no longer wanted to compensate clients for losses due to terrorist incidents. It is likewise almost impossible to insure against flooding in the Netherlands, although a public-private arrangement now provides insurance against terrorism, for which insurers are not required to compensate all losses and for which the government acts as the guarantor of last resort.⁸⁰ Similar public-private arrangements are found in Belgium and Germany. Such constructions enable insurers to offer insurance products without unacceptably high financial risks for themselves. Applied to digital disruption, it would mean that the government provides compensation for damages exceeding a certain limit. Once this guarantee has been provided, insurers could expand the market for cyber security risks and companies would, in principle, be liable for the costs of smaller incidents.

4.6 Conclusion

The government and other parties have always taken steps to minimize the potential consequences of societal disruption. Digitization adds a new form of disruption to the list of risks we are already familiar with. This section has focused on contingency measures in anticipation of digital disruption. Our main conclusion is that these measures have yet to be adequately implemented and that the government and other parties are insufficiently prepared. A number of steps are required:

• There is currently no coherent policy for critical infrastructure: for back-up options, the isolation of chains and networks, for cyber exercises, and for providing information on how to respond to urgent incidents. While regulations diverge between sectors and organizations, other factors undermine our preparedness as a society. Back-up options disappear as analogue systems are decommissioned and organizations outsource important facilities to third parties, further increasing the interdependence between processes and sectors.

• Information sharing has recently improved and become much more comprehensive. But it is still hampered by sectoral divisions and a partly outdated distinction between critical and non-critical providers. This means that signals may not be picked up (or picked up too late) by the relevant actors. A broader perspective is needed for gathering and sharing knowledge. While the current focus is on digital security measures, vulnerabilities and incidents, there is much less clarity for service providers and governments when it comes to chains, networks and the dependencies they create. This kind of knowledge is essential if we want to be able to classify the severity of incidents and manage the spread of digital disruption.

• In combating digital disruption, the government depends on information and cooperation from private actors (many of them based overseas). But the government lacks any clearly defined authority to intervene on the basis of specific categories of digital incidents; there is also little clarity about which public bodies should take action for which type of incident. Greater powers for the government should be accompanied by adequate protection for private parties, as interventions based on coercion may have adverse financial effects.

• Digital disruption can cross national borders, calling for international coordination. The current approach relies on partly inadequate national mechanisms, which is particularly risky in light of the spill-over effects into critical infrastructure elsewhere in Europe and attacks on European institutions. The need for European and international cooperation is urgent due to the geopolitical dynamics that surround digital disruption.

• Recovery and reconstruction would currently be difficult to achieve. The funds required for recovery would be in short supply now that insurers seem to be withdrawing from the cyber insurance market. But other major incidents of damage show that solutions are possible. While learning from incidents requires wide-ranging reflection and analysis, this is currently limited by various supervisory authorities processing the available data on incidents in isolation, precluding the benefits of potential learning effects.