Opening doors beats shutting them, writes Alexander Moiseev, pictured, Kaspersky Lab Managing Director (Europe).
After half a year of work, the EU Commission delivered on its promise and presented its Digital Single Market (DSM) strategy. Although Commission officials were quick to state that it’s not the end, rather the beginning of a long road, we’ve now been afforded an insight into the priorities and directions of those responsible.
Analysts were quick to express their views on the quality and ‘implementability’ of included measures, but at this stage, I don’t think there’s any point getting bogged down in the details. There are more steps in the process before any of this begins to have a real effect, not the least of which will be winning support of the European Parliament.
For my colleagues and I at Kaspersky Lab, and I’m sure businesses right throughout Europe, the value is in recognising that we have now been presented a strategic view – one that gives more confidence to businesses and has the potential to encourage investment. At its core, the DSM is designed to remove barriers (and that can only be a good thing). The cybersecurity industry has long been advocating the importance of thinking about security from the outset of any strategic planning about the digital world (as opposed to an afterthought). So it is encouraging that among the 16 priorities outlined in the DSM strategy, the commission has recognised and shown a commitment to raising trust in digital services, which it hopes to do so by strengthening cybersecurity safeguards. In doing so, the EU has clearly shown its intention to not only build, but importantly, protect the digital market – notions which are not in themselves mutually exclusive.
Granted, it’s not the first time we’ve witnessed a commitment from the Commission towards raising anti-cybercrime capacities within Europe. But now we’re seeing progress. For example, the previously adopted EU Cybersecurity Strategy is being implemented, while the long-awaited Network and Information Security Directive, which aims to strengthen preparedness, cross-border cooperation and information exchange amongst EU actors, should soon be finalised. There is still work to be done to find a balance between privacy and security, but The General Data Protection Regulation, which addresses data protection rules, is also in the EU governing institution’s strategic pipeline, with a view to adopt it later this year. And in 2016, the Commission’s ePrivacy Directive should follow.
But there are also some new ideas. In the parts that relate to cybersecurity in particular, there is a strong emphasis on increased cooperation and ‘multi-stakeholderism’ at all levels – the most interesting of which is the establishment of contractual Private-Public Partnerships (PPP).
As the European head of a global company, working in an industry that yields immense benefits from co-operation between different stakeholders – state-to-state, public-to-private, big companies-to-SMEs – this is of particular interest.
In the cybersecurity industry, partnerships between private companies and public crime fighting organisations are becoming increasingly important and with good reason. In plain terms, they just make sense. We have a shared goal of protecting the world from cybercriminals – those who prey on individuals, governments and businesses using digital means for ill-gotten gain – be they financial motivated, political or otherwise. In fact, there’s a growing body of proof, built upon recent success stories, which illustrates how cooperation between the private sector and Law Enforcement Agencies (LEAs) have helped reveal and neutralise the most sophisticated cyber-gangs. And you don’t need to look back very far to see evidence of it.
The recent Simda Botnet takedown, which involved Kaspersky Lab, INTERPOL, officers from the Dutch National High Tech Crime Unit, the FBI, Microsoft, the Cyber Defense Institute, and a number of other stakeholders, is a classic example of the public and private sectors working together to achieve common goals.
As a result of this collaboration, 14 command and control servers were seized in the Netherlands, USA, Luxembourg, Poland and Russia and consequently, up to 770,000 computers were disconnected from the criminals who had been controlling them. Preliminary analysis revealed a list of 190 countries affected by the Simda botnet, so it was a global problem solved with global resources. Without the shared resources, the operation would not have been anywhere near as effective or extensive in its impact. But Simda was just one example.
Perhaps the greatest testament to the success of this collaborative approach is the Carbanak investigation that we reported in February this year. The investigation saw members of our research team working alongside INTERPOL, Europol and other LEAs from all over Europe uncover a criminal plot that had led to US$1 billion being stolen from banks around the world. Such was the scale of the heist, it was dubbed by some: ‘the greatest bank robbery the world has ever seen’ – a robbery that might not have been exposed without our global partnership.
While it’s still early days, it’s already clear that our partnerships with the public sector are becoming increasingly valuable for us (and the world). In fact, last year we agreed to station one of our best cybersecurity researchers, Vitaly Kamluk, within INTERPOL’s new Global Complex for Innovation in Singapore. While he is still helping his colleagues in our Global Research and Analysis Team, his posting means he now works alongside experts from various private and public organisations from all over the globe, and of course, with INTERPOL’s own, newly established cybercrime fighting unit.
There is a strong practical argument for developing and nurturing partnerships like this (what better way to fight a common enemy than to pool resources and share information?), but they also offer an opportunity to learn from each other and gain exposure to new ways of working, in turn boosting the world’s cybercrime fighting capabilities. This is incredibly important as each year, we are seeing more and more sophisticated attacks – many of which have a global impact.
It’s through the lens of our own experience that I am intrigued by the proposed cybersecurity contractual PPPs – which the commission says will not only lead to more investment and innovation in this area, but stimulate the adoption of cybersecurity solutions by citizens and enterprises. In the commission’s own words, the idea stems from the need for more ‘Innovative ideas and solutions [that can help] better protect our society and economy’. It will leverage EU, national, regional and private efforts and resources – including research and innovation funds – to increase investments in cybersecurity.
My hope is that by removing some barriers, for the sake of increased security, the EU and national authorities will not push for new fences, this time curbing competition. It would be a mistake for a continent that for years has benefited from its technology companies residing and prospering in the open cyberspace – Skype (Luxembourg), Spotify (Sweden) Rovio (Finland), Booking.com (Netherlands) and Prezi (Budapest) among others.
I also hope that the new European PPP initiative will not only increase funding for computing science and new scientific projects in the area of cybersecurity (through Horizon2020 and other new programs), but also foster genuine cooperation between the public sector and different stakeholders – academia, large companies, SMEs – whether of European origin or otherwise.
If this is the case, European authorities can rely on us as their strong supporters who are always eager to contribute to development of cybersecurity capacities making lives of European citizens more safe and secure.
