“Data sovereignty” and “digital sovereignty”: Tools for protecting humanitarian principles in cyberspace

The privileges and immunities enjoyed by international humanitarian organizations are an essential means of ensuring the neutrality and independence of their humanitarian action, which is the basis for trust on the part of the communities they serve. Anything that calls into question the neutrality and independence of organizations like the ICRC threatens to undermine that trust, which in turn jeopardizes the viability of operations on the ground and access to those in need of assistance. The security and confidentiality of information given to the ICRC in confidence, for example by detainees or parties or witnesses to a conflict, is fundamental to maintaining the trust that the organization has built up over 150 years. Accordingly, how can the ICRC maintain that trust when operating in digital environments, with incidents like the SolarWinds hack demonstrating how vulnerable the IT systems that international entities use can be?

These challenges are not unique to the ICRC, of course. States, public bodies and multinational enterprises face similar challenges. Some States have responded by asserting the need for “data sovereignty” or “digital sovereignty”.Footnote ³¹ Both of these concepts imply a problematic technological dependency embedded in unwarranted or undesirable international relations, yet for the most part they are rarely defined or unpacked. And despite implying distinct types of sovereignty, these terms are often used interchangeably, without reference to how one concept might be distinguished from the other. It is therefore instructive to try to disentangle these terms.

While the notions of data sovereignty and digital sovereignty have a very different meaning from the notion of sovereignty under international law, they borrow loosely from the international law notion of the territorial sovereignty of a State: “Sovereignty in the relations between States signifies independence. Independence in regard to a portion of the globe is the right to exercise therein, to the exclusion of any other State, the functions of a State.”Footnote ³² This brings a connotation of control over the use of data and digital infrastructure. Data sovereignty would appear to indicate that a State (or an international organization) can exercise full control over the data it processes (which are not in the public domain), to the exclusion of any (other) entity. In other words, no other State may by application of law seek and obtain the data of the “data sovereign”. For the avoidance of doubt, the notion of sovereignty is used analogously, since international organizations obviously do not enjoy territorial sovereignty. Rather, an international organization may seek to leverage the privileges and immunities it enjoys, including the inviolability of its correspondence and archives and its immunity from jurisdiction, in combination with other organizational and technical measures to achieve “exclusive control” over data. As suggested elsewhere,Footnote ³³ international organizations can seek to ensure exclusive control through a combination of legal, technical and organizational measures.Footnote ³⁴

While the notion of data sovereignty helps to crystalize the challenges faced by States and international organizations in transnational environments like the contemporary Internet, it is not comprehensive enough to capture the challenges posed by supply chain attacks like SolarWinds. Put another way: even if by a combination of legal, technical and organizational measures an organization manages to establish exclusive control over the data it processes, largely addressing concerns over possible loss of control through exercise of legal process, a lack of control over its supply chain leaves it exposed to additional risks and vulnerabilities. Data sovereignty, it appears, needs to be complemented by a more nuanced strategic approach, which could be encapsulated by the notion of digital sovereignty.

Like data sovereignty, digital sovereigntyFootnote ³⁵ is difficult to define. It appears to imply a broader form of “sovereign” control that covers not just data but also the hardware and software supply chains, as mentioned above, as well as network infrastructure (cables, routers and switches) and the communications supply chain. The concept of digital sovereignty does not necessarily mean that a State or an international organization can produce or have total control over all of the above, in a “digital autarky” sense: considering the level of dependencies and interconnectedness of cyberspace today, this may well be beyond the reach of even the most powerful and sophisticated stakeholders in cyberspace who have strategically been investing huge resources precisely for this purpose.Footnote ³⁶ Indeed, the enormity of these challenges may even call into question the appropriateness of using the term “digital sovereignty” in the first place, when the most that can realistically be achieved may be “digital independence”. But just as data sovereignty is helpful in understanding challenges, vulnerabilities and international relations, digital sovereignty as a term points to the underlying fundamental objective of asserting control and exercising discretion in the choice and use of digital tools and infrastructures, pointing in other words to the importance of managing and mitigating “digital dependencies”, and over-dependencies in particular.

While ensuring data sovereignty would already be a major success for any international humanitarian organization, because it would enable a response to most of the digital challenges identified so far, the recent SolarWinds hack highlights that this analysis should perhaps be taken one step further. International humanitarian organizations ought to give attention to their digital sovereignty too.

It is argued that carefully analyzing the application of the notion of digital sovereignty to the work of humanitarian organizations may provide these organizations with security assets that are linked to, and exist because of, their unique status, and that can be relied on in addition to and beyond what technical security measures alone can offer. In the humanitarian sector, the reaction to cyber attacks such as the SolarWinds hack is often defeatist: if the most renowned government agencies and security companies cannot protect themselves from cyber attacks and surveillance, is it even worth it for a humanitarian organization to try to protect itself? Another common reaction is to lean even more on cyber security “professionals”, tech giants and “hyperscalers” equipped with very significant resources and skilled workforces. Both reactions, however, fail to take into account the fact that security is not an absolute concept and that it depends on the vulnerabilities, threats, assets and opportunities of each organization.

The SolarWinds hack has shown us that even the best-resourced, tech-giant-backed security teams, such as those of some of the companies that relied on SolarWinds, can fail in protecting their customers, and that, precisely because they serve so many customers, it does not matter who the target is: every organization using affected cloud services becomes vulnerable, and a potential victim of the attack – and that includes humanitarian organizations. Yet, some humanitarian organizations have specific “security enablers” that other organizations do not have. For instance, the security enablers of the ICRC include the recognition of a specific mandate under international law to pursue its exclusively humanitarian mission, and the trust and acceptance generated by its principles of neutrality, impartiality and independence, as well as operating modalities based on (among others) confidentiality and bilateral confidential dialogue. The ICRC is used to leveraging these principles and operating modalities for its own security in the physical world, and like other international humanitarian organizations, it needs to transpose this way of working to the cyber world.Footnote ³⁷

Ensuring the security of humanitarian actors in cyberspace

For over 150 years, the ICRC has been operating in conflict areas that are increasingly fragmented, polarized, volatile and difficult to read, where technical innovation has often brought important challenges. The ICRC has therefore been keenly aware of the vulnerable situation it is in. Specific security rules consider that in some places, walking down the street or in a market could be too dangerous; staff could get abducted or sometimes even killed simply because they are foreigners and/or they work for a humanitarian organization. In those cases, security rules provide for movement restrictions, and staff are not allowed to leave the compound of the organization unless specific security measures are in place. It is also possible that vehicles of the organization, moving in order to deploy and run its activities, may hit an improvised explosive device or be attacked, possibly by accident. Therefore, security rules provide for restrictions of movement along specifically greenlighted routes, notifying all the parties to the conflict or actors involved in a situation of violence about the anticipated movement in the area, and marking the organization's vehicles very visibly with emblems and flags in order for them to be recognized from afar.

This approach also relies on the assumption that a very important protective asset that humanitarians working amid conflict and violence can have and rely on is the trust and acceptance of warring parties, local authorities and populations.

The notion that the security of humanitarian staff is linked to trust and perceptions of neutrality, impartiality and independence is indeed one of the pillars of security for organizations like the ICRC. Acceptance is a key pillar of security that highlights the need to be politically, operationally and culturally accepted as a neutral, impartial and humanitarian actor by all relevant stakeholders – it is an essential operational modality that contributes to access and security. Specific security rules are therefore in place to ensure that humanitarian workers demonstrate at all times the humanity, neutrality, impartiality and independence that may grant them the trust and acceptance (or at least tolerance) of all relevant stakeholders.

This principled approach is further reinforced by a risk management-based security system that provides practical guidance for field staff as it navigates the acceptance–rejection sliding scale on a daily basis. This includes making sure that humanitarian personnel do not become “collateral damage” to an attack. For example, the ICRC would generally not locate an office within, or in proximity to, a military base. Nor would, in principle, an ICRC office or ICRC staff be protected by military personnel of one of the two parties to a conflict or actors in a situation of violence, as this would negatively affect its perception as a neutral and impartial humanitarian actor. It is for instance a common practice that humanitarian vehicles in transit must drive at a safe distance from military convoys.

While a parallel between the physical world and cyberspace is not straightforward and may be imperfect, there are reasons to consider that a similar approach – even if more technically challenging – could be transposed to cyberspace. By depending too much on the technology solutions, systems and networks that are increasingly recognized as compromising digital sovereignty, a humanitarian organization runs the risk of going against the logic of the security rules and principles mentioned above.

While it may be stretching things to suggest that the use of or dependence on these tools calls into question a humanitarian organization's neutrality, impartiality and independence, and in turn has an impact on its acceptance (or tolerance) and its security, it is simply a fact that the use of and dependence on these tools makes a humanitarian organization vulnerable to attacks aimed at the great powers that rely on them – just as a humanitarian organization could be the victim of a rocket attack on a military base if it had its office physically located within the base.

It may be that the “classic” humanitarian approach to security as set out above is not fully suitable for the digital sphere. But the above analysis does highlight that alternative approaches need to be looked for and considered, whether these may lead to already available tools and solutions or, more likely, to new tools that need to be designed and built.

Risk mitigation tools from within the supply chain

There are several avenues being explored and worked on that can be useful as risk mitigation tools in this area. These avenues make sense for all organizations and are not of exclusive relevance for impartial humanitarian organizations, but they are ones that an organization of this type, having identified the supply chain as a particularly delicate area, may wish to consider as a priority.

The first one is based on the notion that, even if each digital component on its own cannot be fully trusted, it is possible to build trustworthy and resilient systems out of untrustworthy components. As security researcher Bruce Schneier has explained:

In other words, minimize trust to maximize trustworthiness.Footnote ⁴² “Zero trust” is an approach that goes in this direction. The National Institute of Standards and Technology (NIST) refers to the notion of “zero trust” as “a collection of concepts and ideas designed to minimize uncertainty in enforcing accurate, least privilege per-request access decisions in information systems and services in the face of a network viewed as compromised”.Footnote ⁴³ The main principles and technologies behind zero-trust security involve an assumption that an attacker could be both within and outside of the network, and that users within a network should not be assumed to be trusted. They include least-privilege access, microsegmentation, multi-factor authentication, and strict controls on device access.Footnote ⁴⁴

Many new technologies like distributed ledgers,Footnote ⁴⁵ homomorphic encryptionFootnote ⁴⁶ and confidential computingFootnote ⁴⁷ are designed to work under this assumption of a hostile environment. While their application would be very useful in enabling trust in an untrusted environment, some of these technologies are not yet mature enough to be fully deployed, and they are still being explored in research and development mode. It is therefore important to invest in partnerships to further leverage these advances in technology, such as the partnerships that the ICRC recently launched with the Swiss Federal Institutes of Technology in LausanneFootnote ⁴⁸ and Zurich.Footnote ⁴⁹

In addition, establishing security standards for hardware and software can contribute to mitigating risks linked to supply chains. In its early days, aviation was also a sector that involved high risks; little or no governance was in place to guarantee the safety of aircraft, and passengers flew at their own risk.Footnote ⁵⁰ Today, the aviation industry is subject to extensive quality norms and testing requirements, and aircraft manufacturers are held accountable for defects found in the aircraft. Similarly, investing in the creation of minimum security standards for hardware and software, and holding suppliers accountable for violations of these standards, could go a long way in mitigating supply chain security risks.

Another key avenue in the mitigation of digital supply chain risks is the removal of strong supplier dependencies. In terms of digital sovereignty, vendor lock-in without the possibility of moving from one vendor to another – for example, because of product incompatibilities, lack of interoperability or portability, or because there may be no alternative in the market – is a major concern. Such dependencies bear various risks: if the vendor goes out of business, it can no longer provide support for its products or patches to address discovered vulnerabilities. Also, the vendor can suddenly change its policies and pricing to the detriment of the customer, or even stop delivering its products and services as a form of digital sanction.

To address the risks linked with vendor dependencies of this type, free and open-source alternatives can be considered. An interesting initiative in this respect was the MALT Project at the European Organization for Nuclear Research (CERN),Footnote ⁵¹ which was aimed at implementing a strategy to seek “open software solutions and products with simple exit strategies and low switching costs”. Free and open-source software (FOSS)Footnote ⁵² can be seen as a method for mitigating dependencies; it is usually developed through the collaboration of an open community, and can be publicly reviewed and modified, and used for any purpose.Footnote ⁵³ However, it should be noted that FOSS comes with its own supply chain risks, and under the cover of improvements, malicious contributors can propose changes that leave a backdoor in the software,Footnote ⁵⁴ as mentioned above with reference to Birsan's study. Moreover, the amount of support and security that can be provided for FOSS often depends on the size and expertise of the contributing open-source community.

A complementary concept to open hardware and open-source software is open standards. Open standards are standards that do not prohibit the creation of conforming open-source implementations.Footnote ⁵⁵ Open standards in turn give open-source implementations the guidance and interface specifications needed to be portable and interoperable.Footnote ⁵⁶ Even beyond FOSS, open standards can prevent vendor lock-in, simply because they are not proprietary and can be used by other vendors as well.Footnote ⁵⁷ The Internet Engineering Task Force (IEFT),Footnote ⁵⁸ with the help of other organizations, produces and maintains many open standards in so-called Requests for Comments (RFCs). RFCs are a series of documents that contain technical and organizational notes about the Internet; some of them become standards.

When open standards or open-source alternatives to proprietary solutions are not available or not satisfactory, diversifying the digital supply chain can reduce the impact of vendor dependence and improve overall supply chain resilience.Footnote ⁵⁹

The ICRC and “cyber crossfire”

The risk of “cyber crossfire” for a neutral, impartial and independent humanitarian organization like the ICRC, within the global competition between the great powers, has been mentioned above. In the area of supply chain attacks, it involves the risk of an organization becoming a victim of collateral damage, or having its systems exposed to attacks targeted at a different entity, due to its reliance on the same digital supply chain as that of the target of the operation. In the physical world, the ICRC would not open an office close to a military installation because military installations are obvious (and under certain conditions lawful) targets for enemy forces in armed conflicts. In the same vein, in the digital world, risk assessment for digital procurement should consider the risk of suppliers, or a particular piece of software or hardware, being targeted because they are used by other customers, who may be (lawful or unlawful) targets of cyber operations. This may be an element to militate for a more “independent” supply chain, or a supply chain that has less dependencies and therefore provides its users with more “sovereignty”.

On the other hand, suppliers who serve other customers, including customers active in regulated business sectors or business sectors involving sensitive information handling, or who handle critical infrastructure, such as suppliers offering public cloud services, may be more likely to have very high security measures in place – even if the SolarWinds hack proved that this is far from a straightforward assumption.Footnote ⁶⁰ Ultimately, therefore, the choice of supplier and supply chain for an impartial humanitarian organization may need to take into account, in addition to all the elements listed in the section above, a trade-off between the benefit of enjoying the alleged higher security standards of “industrial” suppliers and the risk of cyber crossfire.

The assessment of digital supply chain risks, therefore, starts by identifying the potential threats and threat actors that apply specifically to each individual organization, and by analyzing the available mitigating measures in respect of each of those threats and threat actors. Threat actors range from unskilled actors who take advantage of well-known, unpatched software vulnerabilities through ready-to-use exploitation tools,Footnote ⁶¹ to States and State-sponsored groups with access to zero-day exploits,Footnote ⁶² the ability to interfere with products of vendors under their jurisdictionFootnote ⁶³ and even the resources to combine cyber tools with human intelligence.Footnote ⁶⁴

In analyzing how to address risks arising from each of these threat actors, it may be established, for example, that the impartial humanitarian organization in question is not specifically on the radar of “script kiddies”, and the organization, vis-à-vis those actors, is in neither a better nor a worse position than any company trying to protect itself from them. Yet the more limited capabilities of these threat actors may mean that the risks represented by them may be adequately addressed with state-of-the-art cyber hygiene, whether in an “industrial” and allegedly more secure supply chain or in a more “independent” or “sovereign” supply chain. On the other hand, as far as more capable threat vectors such as State or State-sponsored attackers are concerned, it may not be possible to effectively defend an organization from attacks originating from them if they really invest resources into developing an attack.

The ICRC can, however, leverage a number of unique protection assets that other organizations do not have, such as public international law relating to international organizations,Footnote ⁶⁵ international humanitarian law,Footnote ⁶⁶ and – beyond what is provided under international humanitarian law in times of armed conflict – the respect by all States for the neutrality, impartiality and independence of the organization and the respect for the solely humanitarian nature of its work, as enshrined, for example, in Article 2 of the Statutes of the International Red Cross and Red Crescent Movement.Footnote ⁶⁷ The ICRC can thus leverage its widespread acceptance and the protection it enjoys under the provisions mentioned above, also in the digital world; however, there are two essential preconditions for this.

The first precondition, just as would be the case outside the cyber paradigm, is the fact that a humanitarian organization needs to be capable of credibly anticipating, detecting (ideally preventing) and, very importantly, understanding who is responsible for possible adverse cyber operations likely to affect the organization. The challenges around attribution are many, and very significant.Footnote ⁶⁸ In public discourse, attribution of cyber operations is often associated with public attribution by States, accompanied, in many cases, by State responses such as sanctions and indictments. There are several reasons why States use public attribution as a key part of an integrated national security policy response.Footnote ⁶⁹ This State-specific angle is outside of the scope of this article and is analyzed in detail elsewhere.Footnote ⁷⁰ What matters, in the framework of the present analysis, is not so much attribution as such, but the capacity for an organization to identify the likely source of an adverse cyber operation, as a necessary condition to enable the organization to continue its bilateral confidential dialogue with its interlocutorsFootnote ⁷¹ – simply put, to allow the organization to know who to talk to. From the angle of an actor that may be considering directing an operation against a humanitarian organization, this is also likely to have a deterrent effect, since that actor will know that the operation will not go undetected. Beyond identification of the origin of a cyber operation as an enabler of bilateral confidential dialogue, public attribution by States concerning an operation affecting the ICRC can also have a significant deterrent effect, as it can put the spotlight of the international community on conduct that would likely attract significant stigma, and that may in some circumstances amount to a violation of international law. In other words, and again, the basis for the security approach outlined above is based on deterrence deriving from the fact that if a hack is attempted, it will not go undetected, and the perpetrator will be identified.

The second precondition is the capacity to carry out in cyberspace the same extensive work of prevention, dissemination and dialogue with weapons bearers that the ICRC leverages in the physical world in order to build trust and acceptance, and ensure access. This, in turn, requires a clear mapping of the different types of weapons bearers operating in this space, and an understanding of their drivers, objectives, motives and control structures (or lack thereof).Footnote ⁷² From this standpoint, a risk mitigation plan would clearly include the development of technical and organizational solutions for ensuring that digital assets belonging to an impartial humanitarian organization, or otherwise used to deliver humanitarian assistance, could be clearly marked and identified as protected.Footnote ⁷³