CyberPeace Institute

Campus Biotech Innovation Park, 15 avenue de Sécheron, 1202 Geneva, Switzerland

https://cyberpeaceinstitute.org

The CyberPeace Institute, an independent, neutral, and collaborative non-governmental organization, was created to enhance the stability of cyberspace. It aims to decrease the frequency, harm, and scale of cyber-attacks on civilians and critical civilian infrastructure, and increase the resilience of vulnerable actors. The Institute subscribes to the following principles in its work:

• Impact: Reducing the frequency, harm, and scale of cyber-attacks by pushing for greater restraint in the use of cyber-attacks, increasing accountability for attacks that occur, and enhancing capabilities to prevent and recover from attacks. • Inclusiveness: Being inclusive and collaborative in the approach, cooperating with, and supporting, existing synergistic efforts. • Independence: Operating free from the direction or control of any other actors, including states, industries, and other organisations. • Integrity: Ensuring that its work and interactions with the cybersecurity community and victims of cyber-attacks reflect the highest ethical and analytical standards. • Neutrality: Supporting the stability and security of cyberspace rather than the interests of individual actors; as such, engaging with stakeholders and cyber-attack victims regardless of geographic location, nationality, race, or religion. • Transparency: Being transparent about its operations and methodologies, when it is feasible and responsible.

The Institute’s work is structured around three pillars: accountability, assistance, and advancement. These pillars form the core of the Institute’s mission, building on the simple reality that infrastructure, networks, regulations, norms, and protocols are merely enablers in cyberspace.

To fulfil this mission, and to deliver products and services which have a real impact, the Institute aims to achieve four strategic objectives, ensuring a human-centric response to the technological, ethical, and regulatory challenges of cyberspace. Each of these objectives enables operational, tactical, and strategic responses with the goal of empowering people by maintaining a vibrant, open, free, and peaceful online space. The first three objectives are aligned with the three pillars, while the fourth objective ensures that the Institute and its staff are at the forefront of what will be tomorrow’s challenges in cyberspace. • Strategic Objective 1: To increase and accelerate support towards the most vulnerable. • Strategic Objective 2: To close the accountability gap through collaborative analyses of cyber-attacks. • Strategic Objective 3: To advance international law and norms in order to promote responsible behaviour in cyberspace. • Strategic Objective 4: To forecast and analyse security threats associated with emerging and disruptive technologies, to innovate breakthrough solutions, and to close the skill gap to address global cyber challenges.

The Institute has an international scope, and is independent, apolitical, and impartial in its operations, publications, and partnerships.

Digital activities

The Institute provides assistance to vulnerable communities, analyses cyber-attacks to increase accountability, advocates for the advancement of the role of international law and norms for responsible behaviour in cyberspace, forecasts future threats (with a focus on disruptive technology), and supports capacity building. Example of operational activities include:

• Mapping the threat landscape in relation to critical civilian infrastructure. • Supporting the delivery of assistance at scale to the most vulnerable victims of cyber-attacks. • Co-ordinating resources to amplify the impact of existing assistance efforts. • Conducting forensic and impact analyses of sophisticated cyber-attacks and cyber operations, in co-operation with a consortium of experts from academia, industry, and civil society. • Co-ordinating relief efforts through a network of volunteers and providing knowledge products to increase resiliency. • Advancing the role of international law and norms governing the behaviour of state and non-state actors in cyberspace. • Analysing responses to violations of norms, and how normative or legal gaps are

exposed or undermined. • Increasing public awareness of the real-life impact of cyber-attacks, and providing a platform where vulnerable populations can tell their stories. • Analysing potential threats and opportunities stemming from the convergence of disruptive technologies (e.g. artificial intelligence, brain machine interface, augmented Reality, virtual Reality, 5G, etc.). • Acting as a platform to share innovative approaches and capacity-building strategies.

Digital Policy Issues Cybersecurity basket

Critical infrastructure

Consistent with its human-centric approach, one of the Institute’s key focuses is the protection of civilian infrastructure from systemic cyber-attacks. For instance, in 2020, the Institute, together with a number of partners, launched Cyber 4 Healthcare, a targeted service for healthcare organisations fighting COVID-19. The initiative helps people find trusted and free cybersecurity assistance provided by qualified and reputable companies. The Institute has also issued a call for governments to stop all cyber-attacks on healthcare organisations and to work with civil society and the private sector to ensure that medical facilities are protected and that perpetrators are held accountable.

Network security

To increase the scale and impact of its efforts to assist civilian victims of cyber-attacks, the Institute is building a CyberVolunteer Network, composed of volunteers from a range of backgrounds and locations worldwide, as well as partners with established assistance capabilities. The network provides emergency incident response and longer-term recovery plans to civilian victims recovering from significant cyber-attacks perpetrated by malicious actors. It also assists vulnerable individuals in increasing their resilience and guarding against future cyber-attacks.

Sociocultural basket

Interdisciplinary approaches

In order to contribute to closing the accountability gap in cyberspace, the Institute seeks to advance the role of international law and norms. This includes initiatives such as: publishing analyses of the economic and social impacts of cyber-attacks; driving external engagement with stakeholders, individuals, and organisations focused on enhancing the stability of cyberspace; conducting reviews of cyber-attacks based on international law and norms; and assessing potential remedies to fill the identified gaps. The Institute is actively engaged in the work of the Open-Ended Working Group on Developments in the Field of Information and Telecommunications in the Context of International Security, and joined the Paris Call for Trust and Security in Cyberspace.

Development

Capacity development

In 2020, the Institute established a series of webinars called CyberPeace Labs. Within the context of the COVID-19 pandemic, the first series, Infodemic: A Threat to Cyberpeace, explores how malicious actors are exploiting infodemics to facilitate cyber-attacks. The series gathers experts from academia, the private sector, international organisations, civil society, and governmental bodies as discussants. The discussions from the series produced a set of best practices and actionable recommendations to inform the Institute’s initiatives and, ultimately, to improve resilience against cyber-attacks and online peace.

The Institute aims at enabling and possibly scaling operational partnerships for cyber capacity building, notably with grassroots practitioners and civil society organisations, to maximise impact on local communities and individuals while taking into account specific human contexts.

Digital tools

The Institute organises webinars (i.e. CyberPeace Labs), provides useful video materials and discussion recordings on its YouTube channel, maintains blogs on Medium, and actively uses a number of social media channels (i.e. Twitter, LinkedIn, and Facebook).

The Institute will also develop tailored products like its Resilience Toolkits, which will be tailored to improve cyber-hygiene and designed, produced, and delivered in collaboration with local partners and stakeholders to accelerate existing efforts at the regional level.

Resources

The Institute acts at the operational and policy level, looking into potential tech disruptions and analysing the cyber-threat landscape.

Some of the latest achievements include the following initiatives:

• ‘The COVID-19 Infodemic’: A campaign explaining the nexus between disinformation and cyber-attacks, providing the public with a set of recommendations to break the chain of fake news, hate speech, and misinformation. More information here: https:// cyberpeaceinstitute.org/covid19-infodemic/

• ’A Call to All Governments: Work Together Now to Stop Cyber-attacks on the Healthcare Sector’: A campaign for all governments to take action to stop cyber-attacks on the healthcare sector. More information here: https://cyberpeaceinstitute.org/ call-for-government/

• ‘Cyber 4 Healthcare’: A pro bono initiative to co-ordinate free assistance to healthcare professionals, analyse data to determine violations of laws and norms, and hold malicious actors accountable. Cyber 4 Healthcare is the first in a series of projects which will focus on systemic attacks against critical civilian infrastructures.

More information here: https://cyberpeaceinstitute.org/cyber4healthcare/ The Institute regularly contributes to the international debate on cyber-peace via publications on its website. Its latest communications include:

• Cyberpeace Institute. (2019). Closing the accountability gap: A proposal for an evidence-led accountability framework [Position Paper]. Accessible at: https://cyberpeaceinstitute.org/news/2019-12-02-the-cyberpeace-institutes-position-paperto-the-united-nations-open-ended-working-group/ • A series of blogposts and webinars addressing the outbreak of COVID-19 and the related infodemic: • Blogpost: “Infodemic: A Threat to Cyberpeace”. Accessible at: https://cyberpeaceinstitute.org/blog/2020-03-18-covid-19-infodemic-and-cyberpeace • Webinar: CyberPeace Lab: The Nexus Between the COVID-19 Infodemic and Cyber-attacks. Accessible at: https://cyberpeaceinstitute.org/blog/2020-03-24-webinar-the-nexus-between-disinformation-and-cyber-attacks • Blogpost: What is the Infodemic? Accessible at: https://cyberpeaceinstitute.org/ blog/2020-03-25-what-is-the-infodemic • Blogpost: A Brief History of Cyber-attacks: From Ebola to COVID-19. Accessible at: https://cyberpeaceinstitute.org/blog/2020-03-26-a-brief-history-of-infodemicsfrom-charlie-hebdo-to-ebola-and-covid-19 • Blogpost: How the COVID-19 Infodemic Accelerates Cyber-attacks. Accessible at: https://cyberpeaceinstitute.org/blog/2020-03-26-the-covid-19-infodemic-andmalicious-cyber-activities • Blogpost: Protect yourself. Protect others: STOP, INVESTIGATE, CONTAIN, RE-

PORT. https://cyberpeaceinstitute.org/blog/2020-03-27-offline-and-online-protecting-yourself-is-protecting-others • Blogpost: Effects of the COVID-19 Pandemic on the Health Sector’s Risk Profile.

Accessible at: https://cyberpeaceinstitute.org/blog/2020-04-09-how-expandinghealthcare-efforts-increases-the-health-sectors-risk-profile • Blogpost: The Covid-19 Infodemic: When One Epidemic Hides Another. Accessible at: https://cyberpeaceinstitute.org/blog/2020-07-09-the-covid-19-infodemicwhen-one-epidemic-hides-another • Op-Ed: Ensuring Cybersecurity for Critical for Civilian Infrastructure. Accessible at: https://cyberpeaceinstitute.org/blog/2020-06-11-ensuring-cybersecurity-for-critical-civilian-infrastructure

The Institute regularly contributes to high-level international fora in the field of international security. Some recent examples include: • Attendance of the informal intersessional consultative meeting of the Open-Ended

Working Group on Developments in the Field of Information and Telecommunications in the Context of International Security; UN HQ, NYC, December 2019. • Review of the ‘Initial “Pre-draft” of the report of the Open-Ended Working Group on

Developments in the Field of Information and Telecommunications in the Context of

International Security’, April 2020.

Future of meetings

Series of webinars called CyberPeace Labs: initial focus on ’The COVID-19 Infodemic’ initiative as part of a dedicated campaign.