76th Session of the United Nations General Assembly
Statement by Ambassador Sven Jürgenson at UN Security Council Arria-formula meeting on preventing civilian impact of malicious cyber activities
December 22, New York
I would begin by thanking again today’s speakers, Her Excellency Ms Izumi Nakamitsu and Dr Helen Durham, for their participation and insightful briefings.
In addressing the potentially devastating consequences on civilians and critical civilian infrastructure stemming from the malicious use of cyberspace, I wish to focus on three aspects: threats, the existing boundaries in place, and the importance of further awareness raising and capacity-building.
First, critical civilian infrastructure is increasingly reliant on the smooth operation of cyberspace. This reliance will only increase, along with the level of threats and vulnerabilities. The potential impact on civilian lives and livelihoods becomes very real when we consider how power grids have been targeted during winter months, how the activities of malign cyber actors have caused disruption to the life-saving work of hospitals, which are already under excessive strain from the Covid-19 crisis, and how operations against the supply chain have paralyzed the provision of essential services and resulted in widespread economic loss.
Second, in order to manage these threats, it is important to turn our sight to existing rules of the road. Significant progress has been made in the UN by developing the framework for responsible state behaviour in cyberspace, which clearly sets out that provisions under international law apply in cyberspace. The framework additionally includes eleven voluntary non-binding norms, several of which pertain specifically to critical infrastructure protection. There is still scope to consider in more detail the topic of international humanitarian law obligations in relation to cyber operations.
Estonia firmly believes that international humanitarian law sets boundaries for states’ activities in conflict, protecting civilians and civilian objects. Importantly, it acts as a constraint, not a facilitator of conflict. Armed conflicts today and in the future may involve offensive cyber capabilities, and it is vital that the use of such capabilities would be subject to obligations deriving from international humanitarian law. As the ICRC has also outlined in its position paper on “International humanitarian law and cyber operations during armed conflicts”, since civilian and military networks are so interconnected, assessing the expected incidental civilian harm of any cyber operation is critical to ensure that the civilian population is protected against its effects.
Finally, we need to ensure that international discussions on these topics continue. The Security Council is the principal organ of the United Nations dealing with international peace security and as such it has an important role to play in remaining up-to-date on evolving threats and preventing conflict, including in cyberspace. Discussions like today’s can form an important part of confidence building if we agree that protecting civilian lives and preventing possible human cost of cyber activities is our key consideration. We also need to do more to tie up cyber capacity-building with the most urgent needs of states and ensure critical civilian infrastructure is resilient against cyber operations everywhere.
Colleagues,
Minimising civilian impact from malicious cyber activities requires concerted effort. We need political commitment to responsible behaviour in cyberspace, adherence to international law, international cooperation and a genuine focus to improving cyber resilience.
I thank you.
