E-Business
In Absence of Rules, Cyber Terrorists Attack Nations
The systematic crash of the computer systems of banks and TV broadcasters in South Korea — reportedly the result of an attack that was widely speculated to have been launched by North Korea — raises questions about what international laws, if any, govern the new and unexplored area of cyberwarfare.
“The answer is there’s nothing and there’s everything,” said Michael Schmitt, professor and chairman of the international law department at the U.S. Naval War College.
Schmitt, who was asked by the NATO Co-operative Cyber Defence Centre of Excellence to look into these issues, chaired a three-year project that brought together 20 academics and practitioners from around the world.
CBC, the leading Canadian media reported that the culmination of their efforts was the recently published Tallinn Manual on the International Law Applicable to Cyber Warfare.
“If you’re looking for cyber specific law, a law that says ‘a cyberattack that causes these consequences in an armed attack to which you can respond,’ you will find nothing,” he said. “But it was our unanimous consensus among the group of experts that the existing international law applies to cyberspace and to cyberweapons.”
This means that, as international law permits a country to defend itself and retaliate if attacked by conventional weapons, a country that is the victim of a cyberattack that causes damage or death, may also retaliate, either through cyberwarfare or conventional weapons.
“Hack into a control system of a dam and release waters downstream. Those waters are going to cause significant damage, physical damage, people will drown. In my mind that’s clearly an armed attack,” Schmitt said.
“And if someone did that to Canada, you could resort to force, not only cyber but armed force to defend yourself.”
Other examples of cyberwarfare that are grounds for retaliation by force could include hacking into a water treatment plant and causing chemicals to flow into the water, thereby poisoning the population, hacking into air traffic control systems and causing planes to crash, or hacking into a hospital and changing people’s blood type, causing harm to patients
But the attack on South Korea, if in fact North Korea was responsible, is different, Schmitt said.
The attack is certainly a violation of South Korea’s sovereignty and a violation of international law, he said, but not grounds for the use of force in response.
“We would call that a below the threshold operation that certainly would permit a response from South Korea but the response could not include armed force,” Schmitt said.
The retaliatory options for South Korea would include countermeasures. These are actions that can be taken by the aggrieved state that would normally be unlawful under international law but are considered acceptable because the aggressor state violated international law first.
“If state A attacks state B’s banking system, state B may then respond proportionally against state A’s banking system to compel state A to knock it off,” Schmitt said.
His group also looked at issues surrounding cyberattacks on civilians. Under international law and the principle of distinction, when on the battlefield, operations may only be directed against military objects and combatants and not civilians.
“We asked the question ‘when is a cyber operation a forbidden attack?’ There are all sorts of things you can do in cyberspace against civilians during an armed conflict that doesn’t physically harm them and doesn’t injure them,” he said. For example, erasing personal data or messing with their banking records.
“What we said is that this is a very hard question. Not unanimous, but the majority said that an attack, in the law of war, means you physically harm someone, you break something, you cause physical damage or you interfere in the functionality of an object such that it needs to be actually repaired.”
Ashley Deeks, an associate professor at the University of Virginia School of Law and an expert in international law, said many of the scenarios are case by case.
“Even in the kinetic world, there is no real definition of what an armed attack is,” she said, adding that states look to past practices.
For example, the Stuxnet computer virus, reportedly launched by the U.S. that attacked and destroyed hundreds of centrifuges at the Natanz uranium enrichment facility in Iran, raised these issues.
“I guess I would just characterize it as the closest thing we’ve seen to a cyber action that produces real world effects, not dissimilar from what a kinetic attack would do. But I’m not prepared to say it was an armed attack.”
That’s why a lot of people are starting to devote a lot of attention to cyberwarfare and trying to sort out where the lines are, Deeks said.
“There are a lot of question marks. If you took out a banking system, and it caused massive instability in the country … that could be construed as an armed attack by some states. But it’s really an open question,” she said.
“There would be other states that say, ‘No, unless people die, things blow up, not an armed attack. We want to set a high threshold.’ Others say, ‘That ‘s crazy. You want to start deterring these things. You want to call lower level things armed attacks.”
However, Schmitt said he believes all these thresholds will evolve over the next decade.
“I anticipate that we’ll see a lot of thresholds coming down that will allow states to respond more vibrantly to cyber attacks that might not be possible under the law as we found it.”
Kashifu Inuwa CCIE, the Director General, National Information Technology Development Agency (NITDA), has reiterated the critical role of innovation in driving Nigeria’s sustainable development, economic diversification, and global competitiveness.
Inuwa made this remark while delivering a keynote address at the 8th Annual Research Fair and Exhibition of Nasarawa State University, Keffi (NSUK), where he called on academia, industry leaders, and policymakers to embrace disruptive transformational innovation as a tool for addressing the nation’s challenges and unlocking its immense potential.
Speaking on the theme, “Disruptive Transformational Innovation; Shaping the Future,” Inuwa commended NSUK for organising an event that aligns with Nigeria’s pursuit of growth through knowledge-driven solutions.
Inuwa who was represented by the Deputy Director, eGovernment and Digital Economy Development Department, Engr Ya’u Garba, applauded the university’s increasing focus on transformation, noting that such initiatives reflect an understanding of the need for impactful innovations to address real-world issues.
Inuwa emphasised that while inventions remain a cornerstone of academic inquiry, their significance lies in their ability to move beyond theoretical exploration to become practical innovations. These innovations, he explained, have the power to reshape industries, tackle societal challenges, and accelerate national progress.
He urged institutions to prioritise creativity and bold thinking, ensuring that research outputs translate into tangible benefits for society.
Explaining the concept of disruptive transformational innovation, Inuwa described it as a profound force capable of altering established systems, processes, and products in ways that redefine societal functions. Unlike incremental innovations, which focus on improving existing frameworks, disruptive innovations introduce entirely new paradigms, addressing challenges in groundbreaking and previously unimaginable ways.
He cited historical examples such as the Printing Press, the Steam Engine, and Electricity, which have significantly transformed human existence and set the foundation for modern development.
Inuwa pointed out that Nigeria’s abundant human and natural resources present a unique opportunity to harness innovation for sustainable development. He called for a collaborative approach involving academia, industries, and government to build an environment that nurtures creativity, supports bold investments, and encourages inclusive growth. Such an ecosystem, he said, is vital for fostering homegrown innovations that can propel Nigeria to the forefront of global technological and economic advancements.
He further highlighted NITDA’s dedication to fostering innovation through various initiatives, including the National Adopted Village for Smart Agriculture (NAVSA) to digitally transform the agricultural sector, the National Blockchain Adoption Strategy to enhance digital trust and transparency, and the National Artificial Intelligence Strategy aimed at building a robust AI ecosystem in the country, among other impactful projects, which are part of the Federal Government broader strategy to position Nigeria as a leader in the global knowledge economy.
Inuwa also urged NSUK to deepen its commitment to innovation by establishing hubs that support facility-led startups, fostering collaborations with industry stakeholders, and equipping students with essential technological skills. He noted that such efforts would not only empower the university community but also contribute significantly to national development.
Inuwa expressed confidence in Nigeria’s ability to not only adopt global innovations but also create groundbreaking solutions that could influence the trajectory of Africa and the world.
He called on all stakeholders in the country to embrace the transformative power of innovation in order to drive sustainable development, economic diversification, and global relevance.
Nigerian Data Protection Commission (NDPC) and National Insurance Commission (NAICOM) have signed a Memorandum of Understanding (MoU) to protect data pilfering in the insurance industry.
The agreement was finalised on Friday and aims to address critical concerns around data privacy and ensure that the insurance sector complies with global best practices in data management.
Some of the objectives of a MoU include training and capacity building to enhance awareness and skills in data protection, setting up specialized clinics to address data protection concerns and provide guidance; conducting compliance activities by regularly, monitoring and enforcing compliance with data protection regulations and educating insurance companies on the importance of data protection and the benefits of adhering to best practices.
Mr Olusegun Ayo Omosehin, commissioner for Insurance/ chief executive officer, NAICOM, said, “The collaboration marks a significant milestone in safeguarding the personal data of insurance policyholders and promoting trust in the insurance sector”.
To ensure the effective implementation of the Memorandum of Understanding (MoU), an Implementation Committee will be established.
This committee will comprise representatives from the 2 agencies, as well as other key industry associations, including the Nigerian Insurers Association (NIA) and the Nigerian Council of Registered Insurance Brokers (NCRIB).
The committee’s primary responsibility will be to monitor progress, provide guidance, and facilitate collaboration among stakeholders to guarantee the successful execution of the MoU.
Officials from both NAICOM and NDPC have expressed confidence in the partnership’s potential to strengthen data privacy frameworks within the insurance sector.
They noted that the initiative would boost public confidence, enhance compliance, and position the sector for greater innovation and credibility.
This collaboration is expected to pave the way for a more secure and trustworthy insurance landscape in Nigeria, ensuring the protection of personal data while fostering the industry’s growth.
Nigeria Data Protection Commission (NDPC) will start prosecuting data privacy offenders from the beginning of 2025, according to Babatunde Bamigboye, head of the Legal Enforcement and Regulation Department of the commission.
This move is part of its efforts to enforce regulations and promote responsible data handling in Nigeria.
Bamigboye, disclosed this during a one-day cybersecurity awareness campaign with the theme “Utilising AI-Powered Services for Proactive Cybersecurity” in Abuja.
The event was organised by SOPHOS UK in collaboration with SPOKES Network and Net-Trix Solutions to foster networking with industry experts on how AI is shaping the future of cybersecurity.
Bamigboye explained that, due to the significant implications of data privacy breaches in Nigeria, the commission has embarked on awareness programmes to educate individuals on their data protection rights and inform data processors and controllers of their obligations.
To this end, he announced that beginning next year, the commission would prosecute any data controllers or processors found in breach of the law.
“At this moment, we have investigated quite a number of cases, and in terms of prosecution—as you know, as a lawyer, this means going to court—but we haven’t taken any matters to court yet.
“This is the formative stage; we understand the implications for the country as a whole. And usually, when you talk about prosecution, it also involves some criminal activities. So, at this moment, our focus has been on creating awareness.
“But from next year, we will step up enforcement in this area. What we have done so far is to take remedial actions against certain data controllers and processors who defaulted under the Act,” he noted.
He assured investors that Nigeria’s cyberspace is secure for digital transactions.
“Nigerian cyberspace is safe; otherwise, we wouldn’t be experiencing the smooth flow of digital transactions in Nigeria. It is safe but not without threats, and we are doing our best as a country to combat these threats.”
Christopher Odutola, a sales engineer at SOPHOS UK, noted in his presentation that 100% cybersecurity cannot be guaranteed, hence the need for proactive measures.
“A lot of people will come to you and say, ‘We can give you 99.9% or 100% cybersecurity.’ It’s not true.
“Nobody can provide 100% security anywhere in the world. What they can do, as I mentioned earlier, is reduce the risk for you. However, determining the extent of risk reduction is difficult.
“It’s impossible to eliminate 100% of risks anywhere in the world. What we provide is what we call a cybersecurity breach protection warranty. This warranty covers incidents such as data breaches or ransomware attacks. For instance, if you lose your files while we manage your SOC as a service, we will reimburse up to one million dollars in response costs.”
Odutola further stressed the importance of organisations reducing cyber threat risks to secure cyberspace.
“There are risks to businesses, risks from downtime, attackers, scammers, and the rest, trying to infiltrate networks.
“The risk is always high. As cybersecurity professionals, we are doing as much as possible to reduce these risks.
“The various security controls we implement—antivirus software, firewalls, email security, cloud security, network security, and others—are aimed at reducing risks. We must focus on minimising risks. For instance, we currently see risks originating from third-party suppliers and vendors.”
According to him, “We have a process called risk assessment, which helps to evaluate vendors to ensure they do not introduce risks into our environment. This is why these security controls are crucial.
“We have them in place. It’s equally important to involve senior management in the discussion, as this is often where the gap lies. Unfortunately, cybersecurity is often perceived as a cost centre.”
Harrison Oloye, chief executive officer (CEO) of Net-Trix Solutions, said the event aimed to raise awareness about cyber threats and equip users to manage potential attacks.
“What we did, as Net-Trix Solutions Limited in conjunction with Spokes Network, is to create awareness and educate the public and private sectors on how to use Artificial Intelligence (AI) to combat cyber threats.”
Speaking further on achievements in creating awareness, he said: “As part of our Corporate Social Responsibility (CSR), we educate and train as many people as possible on the dangers of cyber threats and cyber-related crimes.”
Ms. Sifon Ufot, head of Business at SPOKES Network, emphasised the need to take proactive measures against cyber threats.
“We need to stay cyber-safe because hackers working behind the scenes are not joking—they work 24/7. For us, staying proactive is essential. With the help of AI, we can stay proactive; it provides information beforehand and even prevents some attacks from reaching us.”
NCC, CBN to Resolve Telecoms, Banks’ USSD Debt Issue
First Women Radio Virtual Assistant Makes a Debut in Nigeria
9mobile CEO Highlights Key Solutions for Securing Electronic Money Transfers in Africa
NITDA DG Harps on the Role of Innovation in Nigeria’s Sustainable Development
PalmPay Reaffirms Commitment to Ensuring a Safe Financial Ecosystem @ Anti-Fraud Walk
First Bank Proposes New Name after Upgrading Banking Platforms
Edo State Launches Data Centre in Benin
Echefu Launches LUFT TV, another Pay TV after Failed TSTV Project
Nigeria Makes List of Top 10 Countries with Highest Cases of Internet Scams
UBA, Mastercard Launch Special Debit Card for 75th Anniversary
E-Financial3 days agoEFCC Says Nigerian Banks are Notorious Conduits of Financial Crimes
Telecom3 days agoNASENI Retreat Focuses on Aligning Development Institutes’ Goals
News3 days agoTEDxPAU 2024: Exploring New Possibilities and Shaping Tomorrow
E-Business3 days agoData Commission, NAICOM Partner to Safeguard Data in Insurance Industry
Uncategorized3 days agoNIMC Introduces Paid National ID Card Amid Low Revenue
E-Financial3 days agoN159m Up for Grabs in Fidelity Bank’s GAIM 6 Promo
Telecom21 hours agoNCC, CBN to Resolve Telecoms, Banks’ USSD Debt Issue
Telecom21 hours agoProf. Adewale Obadare Shares Key Insights on Breaking into Cybersecurity