Executive Summary

Development underpinned by information and communication technologies (ICT) is unsustainable without acknowledging and taking steps to manage risks borne out of increased reliance on ICT. Without cybersecurity, ICT becomes a potential new point of failure that could threaten to undo development progress. As the development of economies, institutions, and society more broadly in lower- and middle-income countries becomes increasingly reliant on digital technologies, the imperative to do a better job of building capacity to manage digital risk increases.

The role of cybersecurity for the delivery of key development outcomes and the achievement of the Sustainable Development Goals is potentially immense, as much of the work to attain these outcomes is underpinned by information and communication technology. If this technology is untrustworthy and unreliable, countries and citizens may not fully reap the rewards of digitization. Worse yet, increased dependence on digital technology coupled with unreliability may threaten to actually create negative progress. Put simply, for technology to deliver on its immense promise, we must be able to trust the technology we use.

To help manage these risks in the lower- and middle-income parts of the world, a cybersecurity capacity building community of practice has developed across governments, industry, and civil society around the world. This community of practice, which shares many of the same goals as the development community, exists largely in isolation from the broader development community.

Given the nature of the cybersecurity challenge facing the developing world, cybersecurity must be mainstreamed in development in order to enable more resilient and sustainable development. The benefits of mainstreaming are numerous, from the delivery of more resilient development outcomes to improved development of cybersecurity capacity through shared expertise and experience.

In the face of these opportunities, four challenges exist. First, development donors—key stakeholders in the broader development community—are hesitant to fully embrace cybersecurity as a development issue. Second, in part due to the perceived complexity of cybersecurity, some recipients of development assistance—the stakeholders who largely drive the direction of spending—struggle to include cybersecurity in their development investment strategies. Third, because development spending can be perceived as zero-sum, money spent on cybersecurity could be seen as taking away from money potentially spent on alleviating other development stresses. Fourth, a general shortage of cybersecurity expertise globally means that finding affordable and willing expertise is difficult.

In response to these challenges, this report recommends a multifaceted approach to achieve both a strategic-level shift in the development community and prepare operators in the development community for success. Specific recommendations are:

• Reframe cybersecurity in the context of development by shifting discourse to “security for” instead of “security from”; reframing cybersecurity around risk management, resilience, sustainability, and trust; and creating more opportunities to communicate and collaborate.
• Build a library of credible and politically useful information to present to key development decision makers, like deep statistical studies on the impact of cybersecurity on development and a library of case studies and examples of the positive and negative impacts of cybersecurity on key development outcomes.
• Demystify cybersecurity for aid recipients by identifying good practices in cybersecurity capacity building that are backed by rigorous empirics and developing a toolkit to enable bottom-up agenda setting.
• Bring more expertise into cybersecurity donor institutions by exploring short-term solutions like fellowships and secondments and leveraging funding mechanisms to create long-term cybersecurity portfolios in development donor institutions.
• Create and implement digital risk impact assessments for development projects and programs, following a model similar to that of human rights or environmental impact assessments.