A Network Approach to Cyber Capacity Building

Earlier this year I had the chance to join a group of experts from across the Asia-Pacific to explore the future of digital government. The workshop was organized as a part of UNDESA’s outreach to inform the 2020 UN E-Government Survey and was designed to look at the specific challenges faced by Least Developed Countries (LDCs), Small Island Developing States (SIDS), Landlocked Developing Countries (LLDCs). While the initiative primarily highlighted cyber capacity building by, for, and around digital government, the diverse make-up of the group represented a welcome step towards the UN Secretariat’s increased commitment to a more multistakeholder approach to their work. The discussions centered on several familiar topic areas, mirroring many of the discussion across the GFCE Working Groups, including skill building, policy and strategy development, and cybersecurity capacity building.

Despite our role as the Regional Internet Registry (RIR), APNIC is not necessarily the most intuitive place to go looking for someone to speak on cutting edge technology. Our roots lay with a man named Jon and his paper notebook while the next generation in IP addresses, IPv6, is a good 20-plus years old. That said, it is the very characteristics that have maintained the continued relevance of the logical layer of the Internet that provide key lessons to foster a sustainable approach to the adoption of these very technologies.

Despite advances in transmission technology or the roll out of applications with ever increasing features and functions, the logical layer of the Internet remains a foundational element through which AI, IoT, blockchain, big data analytics, and the like will all interact. For this reason, to sustainably deploy these technologies within an organization, throughout the government, or across an economy it is important to focus on fostering an enabling environment as adaptable and resilient as the network on which they run. That is to embrace the very attributes or principles that have fostered this success, whether it is end-to-end interconnectivity, technological neutrality, permissionless innovation, interoperability, multistakeholder collaboration, and more.

APNIC has long worked across the 56 economies of the Asia-Pacific, working with the community to share good practice, deliver training, and provide technical assistance. Through our capacity building efforts we have learned first-hand the importance of fostering the technical and multistakeholder community networks that are not only positioned to deploy the technologies and solutions of today but have the maturity and adaptability to grow to address the challenges and capture the opportunities of the future.

In Incheon, the discussions around this type of work in the LDCs, SIDs, and LLDCs often highlighted the challenges of limited resources, whether in terms of capital, expertise, human resources, skills, or the like. With a strong sensitivity to these restraints, in our experience, a network approach paired with quick wins can have a compounding impact that lays the foundations to respond to the changing technology, needs, and capacity.

The Technical Network 

Tending to the technical network is an often-neglected component in cyber capacity building. The laying of infrastructure such as submarine cables and the development of new applications for fintech, e-gov, and the like, address important layers in digital development and certainly provide the sought after ribbon cutting and human interface elements. However their utility is often stymied by a lack of attention given to the network itself.

One example of how modest but impactful efforts in this space can bolster an economy’s Internet ecosystem can be seen with Internet Exchange Points (IXPs). A neutral IXP helps to keep local traffic local, reducing latency and loads on international transit. This can help to not only improve the resilience and user experience across an economy, but also has the potential to lower costs through savings on transit. This impact can be further compounded through the hosting of content caches and root servers, often attracted to IXPs as they provide strong benefits including the scale often lacking in networks serving smaller economies. 

This is particularly important when looking at LDCs, SIDs, and LLDCs, who often face clear geographic challenges and have populations where cost is of particular importance. For example, not long ago, when observing traffic passed between network operators in Mongolia packets often needed to travel through interconnections in Hong Kong when lucky or as far off as Seattle in some cases. In the Pacific, users in Port Moresby or Port Vila often find their traffic incurring hefty transit costs as they travel through Sydney before being passed between local operators. In Bhutan, until the January launch of btIX, of the roughly 28% of local traffic pointed towards Facebook content, much would need to access caches in Singapore as the in-country cache was limited to one network. The same benefits can be seen at recently launched IXPs in Papua New Guinea and Fiji.

While they may not be the most exciting portions of the Internet stack, addressing the technical networks is the foundation that optimizes the use of physical infrastructure and supports the utility of applications. For an IXP, the benefits of neutral peering is clear and in most cases all it really takes is a single switch to get things started.

The Community Network

A vibrant Internet community on-the-ground represents a critical component to sustained development, growth, and use of the Internet, services, and policy. From a technical perspective, Network Operator Groups (NOGs), represent a strong focal point for locally-driven and mutually reinforcing impact.

NOGs are bottom-up, community driven groups with a strong technical core that bring together operational practitioners to share good practice and experiences, troubleshoot shared network challenges, host training, and generally talk shop. With training and content shared from and across the local community, they represent a focal point for skills building and self-perpetuate a strong, capable local community. Even in a commercially competitive environment, at the network engineer level, there are clear, recognized benefits from these types of interactions which have motivated the proliferation of NOGs across the region, with MNNOG joining the ranks this September.

The Applied Network

Strong technical and community networks often have little to do with government and more often than not flourish most independently. For government, the key is that these networks build a stronger digital environment and economy-wide capacity. In turn, this is something that government can tap into.

To do so, governments need to move beyond simple consultation, and into a more habitual and collaborative relationship with the multistakeholder community. This will allow policymakers to utilize the expertise and leverage the collective resources of the entire Internet community to build better informed policy and more importantly achieve more impactful results.

Recent efforts across the Pacific epitomize the potential benefits of applying a collaborative network approach. In Tonga, which launched their national incident response team in 2016, the process was inclusive of private sector, civil society, across government, and of other stakeholders from the outset. This early buy-in provided immediate impacts, including the donation of equipment and space from local service providers, and continues to pay dividends in the operations and growth of CERT Tonga to this day. The same flow-on impact can be seen in the multistakeholder approach adopted by Papua New Guinea for the establishment of an IXP, which built the necessary cross-community trust to help enable the establishment of PNG CERT shortly thereafter or in Vanuatu where strong community buy-in and cross-government collaboration is helping CERT VU to quickly ramp up its activities.

Lessons from the Network

Cyber capacity building can benefit from an approach that focuses on the long term health of the ecosystem rather than siloed, individual, and time constrained efforts. When driven by the community simple solutions with compounding impacts like a neutral-IXP or NOG, while they may not provide the flashiest pictures or react to external KPIs, can represent the key building blocks to long term health of the wider ecosystem and serve as an enabler for other efforts to have a more meaningful and sustainable impact. 

Fostering the technical network may not be the most exciting component of cyber capacity building, however for undersea cables, e-gov applications, and other initiatives to be fully utilized a strong foundation network is key. 

A strong self-teaching, self-perpetuating, and self-reinforcing community network can help to nurture a rich and informed Internet ecosystem organically.

And while government does not always lead or need to be in the middle, they often hold unique levers of influence that can work to foster an enabling environment and can play a catalytic or supportive role.

This approach is embodied in the GFCE’s own multistakeholder and collaborative design. Taking good practice as developed in the GFCE Working Groups, adapting it to the local context with an eye towards long term sustainability, and leveraging the capacity and expertise from those across the local and global community can help the Forum achieve its aim of more informed, complementary, and impactful cyber capacity building

After all, a network approach is the formula that fostered the information superhighway, next generation networks, the 4th Industrial revolution, and will be the foundation for frontier technologies or the next bit of jargon to frame the future of digital development.

This post first appeared on  Klée Aiken Blog

Leave a Reply

Your email address will not be published. Required fields are marked *