Cyber trends in 2017: The rise of the global cyberattack

German pharmaceutical company Merck reported $310 million in direct costs and lost sales; US logistics company Fedex, $300 million; and Danish shipping company Maersk, $200 million. The Cadbury chocolate factory in Hobart was also shut down by NotPetya.

These events show that some states are actively and destructively using cyberweapons to gain advantage—either to raise money or to damage IT infrastructure.

The UN process that was attempting to negotiate limits on state behavior in cyberspace broke down earlier this year without agreement. The way ahead isn’t clear. The United States has talked of forming a coalition of like-minded countries that could engage in joint action, and Australia has committed to measures to respond to these threats in its International Cyber Engagement Strategy.

Several countries in the Asia–Pacific have started to talk more openly about military cyber capabilities. The U.S. plans to elevate its military cyber unit, Cyber Command, to a unified combatant command to give it more independence and authority. Australia has established an Information Warfare Division and has declared that it has an offensive cyber capability that it’s prepared to use to disrupt and deter cyber criminals targeting Australia. Japan has also proposed greatly expanding its military cyber investment, albeit from a very small base.

Although militaries traditionally shroud their cyber capabilities in secrecy, more transparency and doctrine-sharing would be welcome. Increased openness, collaboration, and other confidence-building measures would help to set expectations of state behavior, clarify how international law applies, and reduce the risk that cyber incidents will result in accidental escalation into armed conflict. Australia has led the way in this area; it is relatively transparent about its cyber offensive capabilities and has consistently emphasized that both international and domestic law applies in offensive cyber operations.

Cybercrime is also a huge issue in the region. With the rise of ‘crime as a service’, the technical sophistication needed to be a cybercriminal is lower than ever. The rewards are high and the chances of arrest are low. As countries in the region become better connected to the internet, rising levels of cybercrime threaten to undermine progress on economic development enabled by the internet. But government regulation and law enforcement make a difference. Tonga is a shining example—it became the first Pacific island to accede to the Budapest Convention on Cybercrime, a treaty that enables a cross-border approach to tackling cybercrime.

Uren notes that in a third worrying development, many countries use cybersecurity laws to impose or strengthen information control and censorship. Of the twenty-five countries covered in our report, just four—Australia, Japan, the Philippines and the United States—are classified as having a free internet.

Overall, cyber maturity improved across all countries in the region: governance, law enforcement and international engagement are stronger, and the internet is available to more people. But progress is uneven. The countries that lead in cyber maturity—the US, Australia, Japan, Singapore and South Korea—continue to pull away from less developed countries that struggle to invest in cybersecurity and telecommunications in the face of more pressing economic and human development concerns.

“The spread of the internet provides huge development opportunities, but it also comes with its fair share of challenges,” Uren concludes. “Australia and other developed countries in the region must directly address the challenges of dangerous state behavior, the spread of cybercrime, and a constrained and censored internet, by promoting our vision of a free, open and secure internet that will benefit all economies in the region.”