Part II: Understanding the Important Communities

Mainstreaming will be a challenge. In order to make progress, we need to understand two primary stakeholders: The development community and the cybersecurity capacity building community. These communities, and the benefits of bridging them, are described here.

Two distinct communities of practice hold equity in mainstreaming cybersecurity in development. The first, the international development community, has existed as a community of practice for the better part of a century. The second, the cybersecurity capacity building community (which we cover in more detail in Chapter 4: Understanding Cybersecurity Capacity Building), has existed for closer to a decade and developed largely outside of major development institutions. These two communities possess complementary and often overlapping goals, yet in large part they operate in isolation from one another. To successfully mainstream cybersecurity in development, the work and lessons from the cybersecurity capacity building community must be folded into the development community. Understanding the activities, organization, and equities of each will be key to bringing these two communities together.

In this section, we provide a high-level overview of what constitutes the development community, how it works and is funded, what it does, and its notable equities when it comes to cybersecurity. If you are already deeply familiar with the inner workings of the development community, skip this chapter and move on to Chapter 4: Understanding Cybersecurity Capacity Building.

Organization

The development community can be divided, in large part, into four categories: (1) institutional donors, (2) bilateral aid agencies, (3) intergovernmental organizations, and (4) nongovernmental organizations.

Figure 1: The Development Community¹

The way major institutions organize themselves can be seen as a legacy of early ICT for development phases from the 1990s and early 2000s. The early infusion of digital technologies into development practice with a focus on connectivity meant that many of the “digital development” practitioners were folded into existing transportation development teams, due to the similarities in “connecting” people. This structure is maintained today within the World Bank’s Transport & ICT Global Practice. Though the World Bank was a leader in folding an ICT practice into their work, other major development organizations have created separate teams focusing on digitization. In the case of the World Bank, these sector-specific teams or groups then often work closely with country-specific teams to craft projects or programs tailored to specific aid and project recipients in the form of Country Partnership Frameworks (CPFs) and Systematic Country Diagnostics (SCDs) which identify core local challenges and guide the bank’s support to a given country.

As digital technologies became increasingly important across sectors, the stovepipes in many of the prominent development organizations became more rigid and impermeable. In most cases, rather than enabling digitization specialists who could assist with digitization projects across different sectors, folding digitization into existing portfolios became the task of existing teams. In practice, for example, this meant that financial sector specialists led the digitization efforts for banking systems. The primary exception to this rule was, again, the transport groups in most major development organizations. Rather than focusing on digitization of specific sectors, transport became the home for connectivity initiatives focused on increasing the percentage of a given population able to access the internet.

In recent years, as major development institutions have begun to view “digital, data and technology as enablers rather than an end goal,” some have begun to reorganize to better reflect this reality, sprinkling “digital” throughout their programmatic areas, rather than creating a new digital stovepipe. However, progress in many of the larger institutions is slower.

Relevant activities

Two separate strands of development activity—which are sometimes conflated—are pertinent to cybersecurity capacity builders: connectivity initiatives and digitization programs.

Connectivity initiatives seek to build out internet infrastructure in order make the internet reach more of the population. These initiatives often also focus on providing the broader population of a country or region with the tools necessary to leverage newfound connectivity, like computer literacy. Running fiber optic cables to rural areas or increasing 4G satellite coverage and distributing cellphones are examples of connectivity initiatives.

Digitization efforts, by contrast, focus on bringing technological advances—like computer systems, networks, and the internet—into different aspects of society to improve efficiency. Often associated with the concept of “going paperless,” bringing government services online and the advent of e-banking are examples of digitization. Digitization can be digitizing existing industries, processes, and infrastructure, but can also involve just about any other project that incorporates or creates reliance on ICT. Connectivity and digitization are complementary. The more connected a given country, the broader and greater the impact digitizing key industries or services.

Funding

The way development donors support these activities varies depending on institution. The way multilateral donor institutions like the World Bank and the regional development banks raise their funds is complicated, but includes things like “funds raised in the financial markets, from earnings on its investments, from fees paid in by member countries, from contributions made by members (particularly the wealthier ones), and from borrowing countries themselves when they pay back their loans.”¹⁴

At the World Bank, the International Development Association (IDA), the institution that gives no-interest loans and grants, is the primary recipient of contributions from donor countries, though it has recently incorporated other funding mechanisms into its work.¹⁵ Country contributors can put conditions on their contribution and donors may attempt to steer money to a “limited number of ‘special themes’” during the process of replenishing IDA’s reserves, which happens every three years.¹⁶ Once money is allocated, the bank’s 13 global thematic teams and regional units then work with recipient countries to develop projects funded by this money.

Most major multilateral development finance institutions also utilize trust funds to support conceptual or pre-implementation work, pilot new models, and develop new knowledge. Thus, donor institutions often rely on trust funds to expand their work into new areas. In the World Bank’s case, these trust funds provide “predictable multi-year funding that is crucial for effective development,” and allow donors to “coordinate and target their scarce aid resources across multiple sectors.”¹⁷ The trust money is often used alongside other “projects developed and financed” by the lending institution.

The funding structures of bilateral aid agencies, like DFID and USAID, are relatively simple in comparison to their multilateral brethren. Although there is some variation in how funds are appropriated, these agencies are generally funded by national governments via taxpayers. In most cases, an aid agency is tasked with developing a budget request, which outlines the strategy for spending its allocation to be approved by national governments or boards. In some cases these bilateral aid agencies will allocate funds to global donor institutions in the form of trust funds, as discussed above.

Notable equities

The primary objective of the development community is to reduce inequality and cultivate better opportunities and outcomes for all people. The community coalesces around the SDGs. However, how the community has gone about achieving its goals has morphed over its many decades of existence. Today, a key equity worth understanding is the development community’s relationship with metrics.

Rooted in the economics discipline from its beginning, the development community, and donor institutions more specifically, rely heavily on metrics to decide how to spend money and monitor and evaluate their projects and programs. For prominent development economist Joseph Stiglitz, good metrics are imperative for development because they, “monitor and diagnose what is going on,” provide a means to “assess the source of the changes,” and “motivate civic action.”¹⁸ In many cases, these empirics are quantitative, though recent push back against Gross Domestic Product (GDP) as a primary measurement has lent a resurgence to qualitative metrics. However, because “society is too complicated to be summarized in a single number,” Stiglitz and other economists have advocated for the use of a dashboard “small enough to be easily digested [and] large enough to include monitors of key issues.”¹⁹ Rubrics for evaluating development practice do not conflict with the aims of cybersecurity capacity builders, and lessons from the development community’s experience in developing these rubrics can provide pathways for progress in the cybersecurity capacity building context.

At a high level, there are two primary goals of the cybersecurity capacity building community—develop cybersecurity capacity around the world to (1) safeguard against systemic ICT risk (i.e. risk to the global financial system), and (2) deliver sustainable dividends from digitization and increased ICT adoption. Although more empirical work is needed to draw correlations, the work of the cybersecurity capacity building community often contributes directly to the achievement of SDGs and sustainable human progress more broadly, as described in Chapter 2. Most of the SDGs and the targets that contribute to them imply the use of ICT to further human development. In many of these cases, cybersecurity—and by extension the work of the cybersecurity capacity building community—serves to underpin confidence and trust in these ICT systems.

Organization

Today, the cybersecurity capacity building community consists of a set of broad categories of actors not dissimilar to those of the development community. The nascency of this community of practice means that major actors and their roles are less clearly defined than in the development community. Although the primary actors are arguably technology companies and government agencies, intergovernmental and nongovernmental organizations play important roles as well. As Norwegian scholar Lilly Pijnenburg Muller noted in 2015, the composition of the cybersecurity capacity building community faces challenges of its own as a great number of organizations exist to help measure capacity and maturity, but actual capacity developers are less numerous.²⁶ Although the infusion of more money and the increasing maturity of the field have spawned more implementers, this problem persists today. In addition, the focus of some donor countries has shifted towards a model of exporting their experiences and frameworks as a part of their global cybersecurity agenda.

Figure 2: The Cybersecurity Capacity Building Community²⁷

In part because there is no clear delineation of who is in and who is out of the community and in part because some of the budgets of capacity builders are not publicly available, it is next to impossible to identify a monetary amount spent on cybersecurity capacity building annually. However, the GFCE is in the process of consulting with its members to begin to grasp the scope of spending. Initial findings have not identified an authoritative amount spent on capacity building globally, but initial estimates suggest that the range of annual spending per “actor” ranges from US$8,000 to US$6,000,000.²⁸ Estimates for total public and private annual spending on cybersecurity capacity building globally based on interviews for this report range from roughly US$50 million to roughly US$1 billion, with the mean estimate far closer to the lower end of that spectrum.²⁹ Regardless, the scope of spending on this development challenge pales in comparison to spending on other issues, despite its cross cutting nature. By comparison, the total “sum of official development assistance, other official flows and private flows” from the OECD’s Development Assistance Committee (DAC) countries alone totaled over US$315 billion in 2016.³⁰

Because the community of practice is still immature relative to the development community, parts of the field still need to be built. Specifically, the cybersecurity capacity building community has three shortcomings that could in part be aided by bringing the cybersecurity capacity builders closer to the development community.

First, as depicted by Figure 2, there is a great deal of overlap with regard to the potential activities and roles of different cybersecurity capacity builders. This overlap manifests not only in principle, but also in practice. Although one of the intended roles of the Global Forum on Cyber Expertise is to coordinate capacity building activity, its limited budget and secretarial capacity means that it is not fully delivering on this promise. In addition, information sharing between cybersecurity capacity builders could be improved. Too often, project information is shared bilaterally and after the fact. The cybersecurity capacity building community could do a better job of talking to one another before projects are funded and implemented.

Second, the methodologies for building cybersecurity capacity are underdeveloped. For development, major development economists and other social scientists helped drive forward methods and good practices in development. Due in part to the nascency of the issues facing cybersecurity capacity development, the academic community has not yet applied the same empirical rigor to identifying good practices for cybersecurity capacity building as it has in the past to understanding how to grow economies or develop good governance.

Third, there is a distinct shortage of implementers and on-the-ground, local networks. In many cases, cybersecurity capacity builders—donor government representatives, their contractors, corporations, and sometimes nonprofits—fly in, conduct a workshop or training session, and leave. While this is not universally the case and some projects or programs involve more extended in-country engagement, these projects appear to be the exception rather than the rule. This reality is driven at least in part by the lack of local, grassroots networks, but is also a reflection of the relative global scarcity of the expertise and funding required to build cybersecurity capacity.

Activities

Klimburg and Zylberberg provide a useful typology for describing cybersecurity capacity building activities of donor countries, outlined in Figure 3.³¹ Each of these categories of activity generally aim to improve the cybersecurity posture of recipients as a means to enable greater dividends from digitization and increased ICT access.

Figure 3: Activities of Cybersecurity Capacity Builders³²

As depicted by Figure 3, the activities of cybersecurity capacity builders are diverse. Nonetheless, Oxford’s Global Cyber Security Capacity Center (GCSCC) and the GFCE have built a portal that attempts to capture all the cybersecurity capacity building initiatives and activities.³³ Among the activities are things like “capacity building workshops for parliamentarians and senior civil servants,” “practical awareness training and campaigns,” crisis management exercises, and computer emergency response training material.³⁴

Funding

Where development activities largely follow a structure where donors provide grants to recipients for programs and those recipients then execute specific projects (mostly) through a private sector implementer, cybersecurity capacity building does not follow the same model. Often, the donors, which are primarily foreign ministries from around the world, work directly with implementers which are sometimes private companies (like MITRE Corporation, which does much of the implementation work on behalf of the U.S. government), but can also be government agencies or competencies themselves. In many cases, rather than giving grants or loans directly to recipient countries, grants go directly to implementers earmarked for work in recipient countries. Separately, several private companies contribute resources to building better capacity on their own, without additional financial contributions from governments or other donors.

The work of the community is important, and the world’s critical infrastructure and information systems would be far less secure without it. However, given anecdotal evidence from high-profile incidents like the global ransomware attacks, the breaches of the SWIFT system, and the continued increase of DDoS attacks, there can be little doubt that far more work needs to be done. The current scale of the community—both in terms of human capacity and financial capacity—is not sufficient.

These two communities, which have existed largely separately since cybersecurity capacity building became a community of practice around a decade ago, each contribute to the sustainability of development and should be placed in positions of complementarity and coordination rather than viewed as purveyors of separate and sometimes competing activities.

Some countries have piloted projects to bring development experts from their bilateral development institutions together with cybersecurity capacity builders from foreign ministries. The U.K., for example, has piloted projects that bring the development experts of the Department for International Development (DFID) together with the cybersecurity capacity builders in the Foreign & Commonwealth Office (FCO). The Dutch have engaged in a similar process. However, most countries lag far behind.

Learning opportunities

Despite the tepidness of the institutional response of most development organizations, the benefits of bringing these communities together to mainstream cybersecurity in development programs and projects are numerous. For a start, the development community possesses decades of expertise on capacity development, from which the cybersecurity capacity building community would benefit. Cybersecurity capacity building is not immune from some of the same plights that have plagued other development fields. For example, the development community has wrestled with identifying and measuring good practices for several decades. The Global Forum on Cyber Expertise is now working to identify global good practices in cybersecurity capacity development, but could draw valuable methodological lessons from past experiences in the development community.

Just as the cybersecurity community can bring extensive cybersecurity expertise to the development community, the development community can bring extensive experience and expertise in building capacity and capacity development and on-the-ground experience and networks. This could be crucial for improving the delivery of cybersecurity capacity building programs as many of the organizations that provide cybersecurity capacity building have little or no presence on the ground. This reality can sometimes jeopardize projects. Drawing on the development community’s local presence and association with grassroots actors could be critical in enabling the delivery of better cybersecurity capacity building programs.

Avoiding a missed opportunity

Mainstreaming cybersecurity in development will also prevent the lower- and middle-income world from missing a key opportunity: learning from the mistakes made during digitization in the higher-income parts of the world. As prominent computer science pioneer Peter G. Neumann noted when reflecting on the insecurity of the modern internet, “The fundamental problem is that security is always difficult, and people always say, ‘Oh, we can tackle it later,’ or, ‘We can add it on later.’ But you can’t add it on later. You can’t add security to something that wasn’t designed to be secure.”³⁵ As Steve Corker, former chair of the board for the Internet Corporation for Assigned Names and Numbers, notes, “we could have done more [to build security into the internet from the beginning], and most of what we did was in response to issues as opposed to in anticipation of issues.”³⁶

Decades of experience in trying to secure digital systems in early adopting areas has led many cybersecurity professionals to wish that security had been given more credence in the early stages of digitization. The later adopters of digital technologies have an opportunity to learn from those mistakes. Bringing the cybersecurity capacity building community and its expertise into development circles will enable the development community to institutionalize these learnings and leverage the cybersecurity community’s expertise and networks.

Funding for better cybersecurity

Though not the primary goal of mainstreaming cybersecurity in development, an ancillary benefit of mainstreaming cybersecurity in development would be greater financial resources devoted to building cybersecurity capacity around the world.

It is difficult to pinpoint the exact amount spent by Ministries of Foreign Affairs, intergovernmental organizations, civil society, and industry on cybersecurity capacity building. However, every interviewee from both the cybersecurity capacity building community and those we spoke to in recipient countries cited a lack of funding and high costs as one of the primary barriers to developing cybersecurity capacity. Unlocking development assistance in its many guises to help build cybersecurity capacity is one of the many ancillary benefits of mainstreaming. This includes the likes of Official Development Assistance (ODA)—a term meaning money provided by official government agencies for the promotion of economic development and welfare of developing countries as its main objective³⁷—as well as the work of donor institutions and private philanthropy more broadly.³⁸