I promise that this is going to be my last post in what has turned into “Digital Security Week” here at humanitarian.info. A lot of my thoughts on this have been brewing since the the cyber-assault on Estonia last year, which at least had the positive effect of bringing the issue to a much wider audience than ever before.

This is the flip-side of e-governance - increased government reliance on the internet creates more opportunities for abuse. However Estonia has learnt from its experiences, with the result that it’s now a far more difficult target for cyber-attacks, as well as successfully prosecuting at least one of the perpetrators.

Although the attack has not been tied to any specific institutions, suspicions that the Russian government may have been involved have persisted, which raises a critical question, posed at its simplest by a BBC report on digital Estonia:

As a member of NATO, a military attack on Estonia would be treated as an attack on all NATO states. So, how about a cyber-attack that cripples its information infra-structure for weeks?

If the Kosovo war were to happen today, I have no doubt that NATO and the UN would be subject to similar attacks, whether organised by another government or not. I wrote yesterday about the experience of the Save Darfur campaign, and with the recent unrest in Tibet, a number of Tibetan NGOs are reporting malicious emails with attachments that target client side vulnerabilities.

At the moment, most of our organisations are not vulnerable in the same way that Estonia was - I doubt most people working in the field would even notice if their organisation’s website went down. (Advocacy organisations who rely on the web for their organisational presence are far more exposed.) However our servers can still be overwhelmed, leading to the failure of key finance, admin, communication and logistics functions; and we grow more dependent on the internet for these functions every day.

The best time to address these issues is now - before they become problems. The humanitarian community needs to make sure that digital security receives the same attention as physical security, addressing skill gaps in our staffing at headquarters and the field, and making sure that our technology adoption prioritises security as a critical factor.

We haven’t even begun to discuss more basic aspects of digital security, such as encrypted communications or secure storage. Maybe Digital Security Week should turn into Digital Security Month…

Hat tip on the Tibet story: NGO Security.