Bled Strategic Times Official Gazette of the Bled Strategic Forum 10 – 11 September 2018 bledstrategicforum.org P bledstrategicforum N Bled Strategic Forum Bled Strategic Forum BledStrategicForum @BledStratForum, #BSF @BledStratForum [email protected] Content Security begins with trust by Thomas Greminger 3 An emotionally intelligent society by Katja Geršak 4 Towards inclusive growth – an easy goal to set, a complex path to plot by Christian Ketels 5 NATO: resilience, deterrence and defence in cyberspace by Antonio Missiroli 6 Cyberspace as a new battleground by Dobran Božič, Igor Kotnik, Marko Grobelnik, Gregor Lisjak 7 ICC: too important to falter by Fatou Bensouda 10 On the way to the rule of law in the international community by Ernest Petrič 12 Building bridges, making history by Nikola Dimitrov 14 Diplomacy in a new disguise? by Antje Herrberg 15 Tackling cyber threats It is Time to Bridge Real danger facing Europe comes from within together the Divide by Shada Islam 16 The cyber challenges arising from EU: not the only game in “We should use the overwhelming town anymore? our highly – digitalised society are global consensus on the impor- by Tobias Flessenkemper 17 here to stay. We can tackle them tance of fair and sustainable de- The global race for AI supremacy on the EU level, here is how velopment for all in order to en- by Reva Goujon 18 / By Sir Julian King, European Commissioner for the hance global cooperation, mutual From disruptive to enabling Security Union support and wide-ranging trust” by Iskren Krusteff 21 his year’s Bled Strategic Forum is all about “bridging the di- Thinking the Unthinkable vide” – focusing on the things we have in common rather / By Karl Erjavec, Host of the Bled Strategic Forum, than what divides us, something especially important in a by Nik Gowing 22 T Deputy Prime Minister and Minister of Foreign Affairs of world which feels increasingly fraught and divided. And nowhere is the Republic of Slovenia Post Iran nuclear deal this aim more apt than in the field of cybersecurity. by Abdulaziz Sager 24 That’s because the highly-digitised world we live in not only offers lobalisation, travel and the digital and communication revo- Addressing radicalization a myriad of opportunities, but also throws up new kinds of threats. lution are bringing us closer together. They provide us with and violent extremism Cyber means can be used for financial gain or for political motives, G tools and opportunities to see something different, to meet by Jelka Klemenc, Rajko Kozmelj 25 by terrorists, criminals or state actors. They are easy to perpetrate the unknown, to understand the unusual. and can be unprecedented in their reach, devastating in their effec- Yet, every day, the divide between citizens, societies and nations EU – Western Balkans: tiveness and extremely difficult to trace or attribute. They are unlike seems to be growing wider and deeper. In a world, which should be so close and so far away other security challenges we face; not only because both the threat like an open book to all of us, we still prefer to cling to our own per- by Ivana Boštjančič Pulko 26 surface and attack vectors are largely privately owned but also be- ceptions, prejudices and fears. Too easily, we forget about the values, Making a move cause of the sheer scale of the societal, geo-political and economic principles and aspirations that we all share, and which are the back- by András Rácz 27 consequences if we fail to act. bone of our common peaceful, prosperous and sustainable future. Faced with this multi-faceted challenge, we need to take action Bled Strategic Forum 2018 will thus attempt to shed light on some Direction: decentralization on two fronts: tackling classic cyber threats to systems and data; and of the topics that seem to divide us. We will talk about the challenges, by William Entriken 28 closing down the space for broader cyber-enabled threats, like fake and present different perspectives and concerns, and then proceed to Trace the origin of your yogurt news, which seek to manipulate behaviour. think about how to find constructive and consensual ways forward. by Tomaž Levak, Žiga Drev, For the first challenge, the Commission last year brought forward Branimir Rakić 29 a comprehensive package of proposals to reinforce our cybersecurity Continued on page 9 based around the three pillars of resilience, deterrence and defence. A disconnect in the age of digital A need for greater cyber resilience by Matthew Jacobs, Ingrid Omahna 30 We urgently need to become more resilient. We need to make ourselves harder to attack, and be quicker to respond through both Bled Strategic Times Official Gazette of the Bled Strategic Forum structural and behavioural measures. Issue date: 10 September 2018 We are in the process of creating a genuine EU Cybersecurity Publisher: Ministry of Foreign Affairs of the Republic of Agency to help set standards and coordinate the response to large Slovenia, Prešernova cesta 25, 1000 Ljubljana, Slovenia, and Centre for European Perspective, Grajska cesta 1, scale incidents, building on the base of the existing EU Network and 1234 Loka pri Mengšu, Slovenia Information Security Agency (ENISA). Editor-in-Chief: Katja Geršak Design: David Fartek The Agency will take on a crisis response function in response to DTP and Prepress: Premedia, Andrej Juvan major cyberattacks and based on a pre-agreed ‘Blueprint’. It will also Printing: Grafične ideje, Alenka Potočnik Circulation: 2000 copies be responsible for establishing and running an EU-wide cybersecu- rity standards and certification framework - the EU Cybersecurity Act - to ensure that products and services meet the highest standards of cybersecurity. www.bledstrategicforum.org Continued on page 2 websites and IP addresses including encour- behind disinformation. It will also promote aging the uptake of the new protocol (IPv6) greater transparency around sponsored con- as it allows the allocation of a single user per tent – marking it clearly as such, and stating IP address, bringing clear benefits including who has paid for it. to cybersecurity investigations. To successfully tackle disinformation, we need to call it out – for example, we set up the East Strategic Communication Task Force in the European External Action Ser- vice to strengthen quality media in the re- gion and to improve our capacity to respond to Russian disinformation. Since its establishment in 2015, East Stratcom has catalogued over 4,000 exam- ples of disinformation, including for exam- Europe faces a "cyber security skills gap" currently estimated to reach 350,000 people by 2022. ple 31 disinformation narratives around the chemical attack in Salisbury and 57 around the downing of flight MH17. We also need to consider the issue of disinformation in the context of upcoming We also need to step up cooperation and elections such as the European elections next the sharing of expertise and reinforce the May. cyber forensics and detection capabilities of Across the EU, there are many initiatives Europol’s EC3 to boost forensic capabilities. at national level focused in particular on And we have taken steps to increase law possible interference in upcoming elections. enforcement access to electronic evidence, There is also strong transatlantic coopera- including when it is hosted in a different tion on this issue, which is discussed in the country. In April, we set out proposals to EU/US security and cyber dialogues and in provide law enforcement and judicial au- the context of Transatlantic Commission on thorities with new tools to obtain cross-bor- Election Integrity. der e-evidence – such as emails, texts or We now need to ramp up this work and WhatsApp messages – for the investigation ensure that public authorities as well as oth- and prosecution of crimes, including terror- er actors – both public and private – are as ism and cybercrime. prepared as possible. In the EU, that means It will oversee the full implementation by 2022. Having this skills base is central to The measures include the ability for establishing plans at national level to guard of the Directive on Security of Network and effective resilience. So cyber must be main- Member States to directly compel service against cyberattacks and election interfer- Information Systems, the NIS Directive, by streamed and prioritised in education and providers in another jurisdiction to provide ence. Member States including extending it be- training curricula. data through the creation of a European Pro- To this end, we need every Member yond the existing critical sectors, starting We also need to invest in research to stay duction Order. State to comprehensively assess the threat to with public administrations and making sure ahead of those looking to attack us. their democratic processes and institutions, that national Computer Security Incident We already have a cybersecurity pub- Tackling the growing threat of whether from more traditional cyberattacks Response Teams (CSIRTS) have the resourc- lic-private partnership in place with EU re- disinformation or from the manipulation of information. es they need. search funds which will trigger 1.8 billion But beyond these more traditional kinds They should have a national action plan and In addition, it is critical to promote “secu- euros in investment by 2020. of cyber attack, we are now facing a much a task force bringing together representatives rity by design”, or we will inadvertently cre- This is a good start but we need to com- broader set of cyber threats. We are seeing from all relevant authorities – cybersecurity, ate a potentially calamitous situation where plement and continue that work. We need to the increased use of cyber means to spread intelligence, law enforcement, electoral com- connected devices have little or no security make sure the EU retains and develops es- propaganda and disinformation, and to in- missions and the private sector – with the protection built into them.