Part I: The Case for Action

The cybersecurity challenge in the developing world is of increasing importance. Cyber insecurity can challenge or even unwind progress in growing economies, improving governance and enhancing the quality of life of individuals more broadly. Given the pervasiveness of ICT to development, cybersecurity should be mainstreamed across the development community. In this part, we outline the case for cybersecurity in development and explain why mainstreaming cybersecurity across the development community will lead to better outcomes.

In 2016, the World Bank’s World Development Report (WDR) Digital Dividends, a cardinal document in the development community that is often used to drive the strategy of the community as a whole, explicitly acknowledged the importance of cybersecurity as a concern for international development. For the first time in a WDR, the importance of managing digital risk was enumerated, as the report noted, “some of the perceived benefits of digital technologies are offset by emerging risks.”¹ Today, 80 percent of World Bank projects have information and communications technology (ICT) as a fundamental component, and this number is only likely to increase in the future.² Despite recognition from the World Bank, donor institutions and the development community are not doing enough to address risks stemming from increased reliance on ICT. Likewise, many in the developing world have embraced digital technology, but not always in its most secure form.

Digital risk in lower- and middle-income countries is not new and was recognized by some early on. In fact, to help manage these risks, a burgeoning cybersecurity capacity building community emerged in the early 2010s. Patryk Pawlak of the EU Institute for Security Studies describes the work of this community—cybersecurity capacity building—as “an umbrella concept for all types of activities (e.g. human resources development, institutional reform or organizational adaptations) that safeguard and promote the safe, secure and open use of cyberspace.”³ For the better part of a decade, the focus of this activity has been on strengthening national capabilities, developing collective capability, and facilitating international cooperation and partnership in cybersecurity.⁴

The work of this community is integral to better and more sustainable development. Good cybersecurity enables growth in the users and uses of ICT. This increased use in turn helps to grow economies and wealth, increase transparency, and enable easier communication and greater information transfer. However, as the Internet Society (ISOC) notes, “Diminishing trust is a challenge to the Internet. To protect the opportunities of the Internet, we have to counter diminishing trust.”⁵ The diminishing trust cited by ISOC is driven by poor cybersecurity. The Internet Governance Forum’s (IGF) Best Practices Forum on Cybersecurity report further outlines why poor cybersecurity leads to diminished trust and ultimately diminishes the effectiveness of ICTs for development:

Poor cybersecurity threatens the growth of ICTs and Internet Technologies. Poor cybersecurity exposes organisations and individuals to risks and attacks, and opens doors for ill-meaning parties to spy on actors or meddle with democratic affairs. In a more indirect way, a perception of insecurity creates distrust in ICTs and the Internet and a diminishing adoption of new technologies. Poor cybersecurity will reduce the use and effectiveness of these technologies, and thus limit the opportunities to help achieve the SDGs.⁶

Policymakers around the globe, and particularly in lower and middle-income countries, are “facing an important challenge today: How to fully embrace the digital revolution while, at the same time, ensuring the safety and security of their citizens.”⁷

Later in this chapter, we provide examples for how cyber insecurity can impact development outcomes. More work is needed to identify the ways in which cyber insecurity stunts economic growth, leads to institutional instability, and decreases human security, but reliance on ICT for large swaths of society, the economy, and governance is unsustainable without acknowledging and managing the risks associated with the use of computers and computer networks. Lower- and middle-income countries, and by extension development projects, are not intrinsically immune to these risks.

Global cybersecurity incidents like the WannaCry and NotPetya ransomware outbreaks catalyzed heightened interest and investment in many resource-rich, higher-income countries. However, in much of the lower-income world—the part of the world where the digital economy is growing nearly two times as fast as in the higher-income world, the part of the world where developments in e-government and e-governance could have an outsized impact on the quality of human life—the importance of managing new risks of digitization has often been overlooked and could threaten to undo these advances.

Cybersecurity helps achieve sustainable development outcomes and the SDGs

The benefits of digital development have been the subject of entire reports. Here, rather than focusing on digital development writ large, we will explore how cybersecurity enables the sustainable and resilient delivery of development outcomes and—in some cases—delivers development outcomes on its own.

As the U.K.’s Department for International Development (DFID) notes, “digital technologies have the potential to revolutionise the lives of the poor, unlock development and prosperity, and accelerate progress towards global goals.”⁸ However, the 2016 WDR acknowledges that, although “digital technologies have boosted growth, expanded opportunities, and improved service delivery… their aggregate impact has fallen short and is unevenly distributed.”⁹ For the World Bank, the “emerging risks” associated with digital technologies may offset some of the “perceived benefits.”¹⁰

The Sustainable Development Goals (SDGs) provide a set of goals around which the development community coalesces.¹¹ Digital development and ICT for development (ICT4D) are means through which many of these ends are pursued. Among these goals are efforts like attaining zero hunger, quality education, gender equality, decent work and economic growth, reducing inequality, building strong peace and justice institutions, as well as building resilient industry, innovation and infrastructure. What these goals have in common is that they all seek to improve human security, institutional stability, and economic stability and growth.

Technology can aid in the attainment of every SDG. But in order to fully reap the immense benefits of connectivity and digitization, the technology that underpins it must be secure and the people that use it must understand how to do so responsibly and securely. At the end of this report, we offer a table outlining the SDGs, some notable targets, and how good cybersecurity contributes to the goals and targets. For those interested, this chart can be found in the appendix. Instead of going through this exhaustive list here, we focus on how cybersecurity and insecurity impacts three crucial pillars of development: (1) the economy, (2) governance, and (3) human security, using the SDGs as a framing device where appropriate.

The economy

There is a good economic case for cybersecurity. Sustainable Development Goal #1, end poverty, targets to halve the number of humans living in poverty by 2030 and reduce inequality of economic opportunity.¹² Similarly, SDG #8 on promoting “inclusive and sustainable economic growth, full and productive employment and decent work for all” strives to “Achieve higher levels of economic productivity through diversification, technological upgrading and innovation, including through a focus on high-value added and labour-intensive sectors.”¹³ The internet has been called the “great transformer” and is viewed by many in all corners of the globe as a great enabler of economic growth and prosperity. According to one study by McKinsey, the internet “contributed 7 percent of [GDP] growth over the past 15 years and 11 percent over the past five.”¹⁴ The same study found that “Internet ecosystem maturity related to rising living standards,” and that “the internet drives business transformation and economic modernization.”¹⁵ However, a June 2014 study from the Center for Strategic and International Studies suggests that cybercrime results in a loss of .2 percent of GDP.¹⁶In order to foster consumption and encourage businesses to leverage the internet and other communications technologies, stakeholders must trust the systems they are using. Good cybersecurity supports economic growth by preserving the trust in and therefore the benefits of digitization and IT systems.

Sustainable Development Goal #10 strives to “reduce inequality within and among countries.”¹⁷ As much as technology could reduce economic inequality and enhance trade, bad cybersecurity can exacerbate existing inequalities. Cyberattacks affecting digital commerce, critical sectors, and government agencies threaten to undo advantages gained through digitization. As the IGF cybersecurity report notes,

Effective cybersecurity is essential ‘to engage fully in the increasingly cyber-dependent [sic] trade and commerce. Robust cybersecurity frameworks enable individuals, companies and nations to realise the full potentials of the cyberspace, without fear or reservation, promoting cross-border delivery of services and free flow of labour in a multilateral trading system.’¹⁸

Because evidence of cyber insecurity leads to mistrust in the ICT environment of a country, cyber insecurity puts lower-income countries at a disadvantage on trade and foreign investment. How, for example, can lower-income countries competitively offer services and platforms in the global market if they are deemed insecure? How can developing countries attract foreign direct investment if the ICT environments are perceived as risky? The gap between cybersecurity haves and have-nots could create further obstacles to more evenly distribute the benefits of digital inclusion.

Finally, on the economic front, Sustainable Development Goal #9 seeks to “Build resilient infrastructure, promote inclusive and sustainable industrialization and foster innovation,” because efficient infrastructure generates employment and wealth and can drive economic growth.¹⁹ These infrastructures include ICT infrastructure, but also things like transportation and manufacturing infrastructure. Although not specifically in the lower- or middle-income context, the 2017 outbreak of the WannaCry ransomware attack clearly demonstrated the capacity of actors to disrupt digitized sectors, disrupting transportation systems, ports, and many others.²⁰

Governance

The internet has the potential to be used for both good and ill. If it is insecure and used for ill, it could undermine good governance. Sustainable Development Goal #16 aims to “Promote peaceful and inclusive societies for sustainable development, provide access to justice for all and build effective, accountable and inclusive institutions at all levels.”²¹ Nascent technologies and techniques—like digital hashing, blockchain, and cloud computing—hold great potential for reducing corruption and creating accountability structures for public institutions. Relatedly, SDG #11 strives to “Make cities and human settlements inclusive, safe, resilient and sustainable.”²² The rise of electronic governance (e-governance) and government (e-government) as well as the potential for big data to drive better policy decision-making has led to greater efficiency in the delivery of services, tallying votes, collecting and utilizing information on the citizenry to craft better policies, and more.

The potential of ICT to help achieve these goals is unquestioned. However, as with economic growth, strengthened governance institutions and services based on technological interventions must be underpinned by trust in those technologies. India’s experiment with biometric and digital identification provides a clear case study in the potential for bad security to undermine the delivery of good governance and government services. Because so much personal data is stored in one place, the digital ID data set has become a frequent target for identity thieves and other criminals.²³ The result is that a project intended to enhance India’s ability to govern may result in more and new problems for the same people whose lives it intended to improve.

Human security

Security, including cybersecurity, has traditionally been the purview of foreign offices and ministries of defense. However, cybersecurity is as much about human security as any other kind of security. A myriad of SDGs seek to address human security concerns. From ensuring the delivery of better healthcare (SDG #3) and ending hunger (SDG #2) to the delivery of critical utilities like water, sanitation, and energy (SDGs #6 and #7), ICT and digitization can deliver improved human security. Digitization in sectors like healthcare, agriculture supply chains, power delivery, and water and sanitation is yielding immediate dividends and improving the lives of millions around the world. However, as technology enables these improvements to reach more and more people, those same people become increasingly dependent on their reliable delivery. And yet, it is becoming increasingly easy to disrupt services like these via cyber means. In digitizing these services, decision makers are creating new dependencies, which, if disrupted, could lead to not only net-zero outcomes, but potentially net negative outcomes.

As alluded to above, no sector was immune to the WannaCry ransomware and the healthcare sector in the United Kingdom was very publicly disrupted.²⁴ In addition, the world has witnessed at least two instances where cyber vulnerabilities were exploited to cut off power to entire regions during cold winter months.²⁵

More people will be coming online, and they will be doing different things with it and coming from different perspectives and backgrounds, we need to ensure that the internet and connected technologies continue to provide the value it has provided to date. Put simply, as the network expands we need to do more to ensure it is secure.

These three pillars demonstrate that there is not only a good argument for greater attention to cybersecurity from those who work in development, but an imperative. Cybersecurity is not just about state on state cyberwar, it is about the economy, good governance, and human security.

Lower- and middle-income countries are not immune to cyber risk. Take, for example, one of the most high profile data breaches in the last five years, the Bangladesh Bank heist. Sometime between February 4th and 5th, a suspected nation-state, advanced persistent threat actor (APT) used Bangladesh Bank’s networks and credentials to request upwards of US$851 million from various other financial institutions.²⁶ Bangladesh is not the only lower- or middle-income country to fall prey to a cyber attack in recent years. Indeed, Ecuador, the Philippines, and Vietnam all experienced similar incidents with their banking sectors. The novel risks are not confined to the financial sector, however. This exposure is evidenced by the targeting of the Ukrainian power grid successively in December 2015²⁷ and December 2016²⁸ as well as the spate of ransomware attacks that disrupted government services around the world, most notably in India.²⁹

One trait that all of these countries have in common is that development donors and global financial institutions assisted in spreading internet use and bringing key sectors of their economies and government services online. Throughout this process of building better access and digitizing society, more could have been done to help these countries manage heightened and novel risks posed by increased use of information and communications technology, and development institutions should play a key role in building this cybersecurity capacity. In an era where APTs present challenges to defenders even in higher-income and more cybersecurity-advanced parts of the world, middle- and lower-income countries are no less at risk.

In his seminal 1957 piece, “Technical Change and the Aggregate Production Function”, Massachusetts Institute of Technology economist Robert Solow proved that technical change correlates strongly with increased production. Over the course of the next few years, technology came to be seen as the driver that international development could rely on to grow lower-income economies and pull countries out of poverty. Today, this mentality persists, and since the early 1990s, the prevailing technological driver has been information and communication technology (ICT). But the use of ICT for development (ICT4D) creates new risks that have, until recently, gone understudied, misunderstood, and unarticulated. As these risks and the measures needed to manage them clarify, so too does the imperative of folding these measures into development practice underpinned by ICT.

Indeed, among the nine principles contained in the globally recognized guidelines for international development practitioners, “Principles for Digital Development,” addressing privacy and security is a top concern.³⁰ Since 2010, and as ICTs increasingly drive development outcomes, the need for more and better cybersecurity capacity building has only grown as nearly all pillars of society—from the economy to governance to social interaction—are or can be touched by ICT. Global trends only project this phenomenon accelerating, and projections suggest that nearly all sectors will be fundamentally affected, if not transformed, by new technologies in the next 20 years. These trends—increasing digitization of key industries and services, more and more internet users, and the rise of increasingly numerous and sophisticated cyber threats—signal that it is time to pay more attention to managing the risks of digitization in the developing world. In short, the time has come to fold cybersecurity in international development.

Thus, the call to build better cybersecurity capacity is not new. As early as 2010, the United Nations Group of Governmental Experts on developments in the field of information and telecommunications in the context of international security recognized the importance of building the cybersecurity capacity of nations around the world and particularly in lower-income countries.³¹ However, while digital development certainly exists, the work of the cybersecurity community exists largely separately from that of the development community. The goal of this report is to provide a roadmap for bringing these two communities (which we outline in greater detail later in this report) closer together to enable both to achieve their goals in a resilient and sustainable manner. This requires mainstreaming cybersecurity in development.

What does mainstreaming mean?

Despite recognition from the World Bank in 2016, except for a few select cases, cybersecurity has hardly been incorporated in development. Thus, the question remains: how exactly should cybersecurity be folded into international development? In the past, the development community has incorporated or focused on emerging issues as they percolated to the surface in one of two ways: prioritization or mainstreaming.

Prioritization is about identifying a key issue for the breadth of the development community to focus on. Prominent examples of prioritization from the last decade include the goals outlined in the Millennium Development Goals (MDGs)³² or Sustainable Development Goals (SDGs),³³ like achieving universal primary education, reducing child mortality, or conserving the oceans. Priorities are often identified by leading development institutions, like the World Bank, and communicated to the broader community through strategy documents like the MDGs or SDGs. In most past cases, prioritization takes an existing development focus and elevates it for critical attention.

Mainstreaming seeks to fold a new issue into existing development practice as a new equity or consideration in the practice of the community. In contrast to prioritization, mainstreaming is most relevant in the context of an emerging issue that has the potential to cut across many or all areas of development or presents a novel risk to progress in development but may not yet receive requisite focus from the community. Perhaps the most notable examples of mainstreaming have occurred in the past two decades in the form of women’s rights and human rights. Women’s rights and human rights were mainstreamed in part because of the nearly universal recognition that these fundamental rights are instrumental to creating the type of world that we want and agreed to with the UN Charter. While cybersecurity may lack some of the intrinsic qualities of these two rights movements, it is nonetheless foundational. ICT and digital technologies pervade society and provide the opportunity to improve the state of fundamental rights. But if they are left insecure, they stand to threaten progress on securing not only these rights, but also the future of the economy and good governance. Although undoubtedly different in character, mainstreaming cybersecurity in development could draw lessons from these processes.

Cybersecurity in development faces a similar challenge to that of early ICT4D efforts in the form of limited resources and competing equities. To some, “using limited development assistance funds to finance ICT4D projects” is a misuse of resources “when in some countries, clean water and sanitation, and electricity seemed more pressing” for the local people.³⁴ While this argument misses the point that ICT could enable more efficient delivery of other development outcomes and has become somewhat antiquated, it is nonetheless emblematic of a broader challenge. A paucity of data and good metrics to support the importance of cybersecurity—and ICTs more broadly—to development is an important element behind this skepticism.

For all its positives, the development community is still plagued with challenges and cannot be seen as a monolith. Indeed, one of the most vexing challenges facing the development community is the rampant siloing of issues. This stove-piping manifests in the ways development organizations—from bilateral and multilateral aid agencies to on-the-ground organizations—organize. The World Bank, for example, is divided into 13 separate “groups”, each of which take lead for a given pillar of development or sector of society. Introducing cybersecurity as a new issue or priority would likely spawn a cybersecurity stovepipe, when the reality is that it should cut across existing issues and priorities.

Later in this report, we build a framework and recommendations to begin mainstreaming cybersecurity across all development practice.