Cybercriminals are collaborating internationally and exploiting gaps between jurisdictions. Can governments keep up?
Some of them operate like multinational companies, with dedicated developers, affiliates and payment systems, said Malaysia’s National Cyber Security Agency (NACSA)’s Chief Executive, Dr Megat Zuhairy Megat Tajuddin, at the Singapore International Cyber Week (SICW) event on October 15.
Asked whether states had lost the battle against them, Australia’s National Cyber Security Coordinator’s Lieutenant General Michelle McGuinness said: “No, we haven’t lost the battle, but we won’t win it alone.”
“If you take a defeatist attitude, you are defeated,” responded Neal Jetton, INTERPOL’s Director of Cybercrime, to the same question.
Officials on the “Non-State Actors: Have States Lost the Battle?” panel called for governments to work across borders and with industry to share threat intelligence and help organisations strengthen their defenses.
Governments cannot secure cyberspace alone
While the responsibility to develop legal frameworks and build national capabilities still falls on states, they cannot act alone.
Critical infrastructure is often privately owned and operated, while valuable intelligence resides within industry.
“We are now at a moment in which private companies possess capabilities and resources that exceed that of most nation-states,” said Singapore’s Minister for Foreign Affairs Dr Vivian Balakrishnan, in his opening address.
Governments remain responsible for national security, he said, while companies increasingly develop and control technologies that shape it.
Protecting sovereignty therefore includes securing the digital systems that sustain essential services and public trust, shared Dr Tajuddin.
Cyber-attacks threaten the functioning of society: disruption to electricity can affect hospitals, while attacks on telecommunications interfere with emergency services.
“We must become better networks than the threats we face,” he added.
Balakrishnan called for governments to engage major technology companies collectively and across national boundaries, alongside their diplomatic relationships with other states.
Beyond arrests, to prevention
Matthijs van Amelsfort, Chief Executive Officer of the Netherlands’ National Cyber Security Centre stressed that cybercrime is not a problem countries can solve through arrests alone.
From his agency’s perspective, understanding how an incident happened is essential to defence.
He urged organisations to share information about attacks: “I always say we should not compete on safety,” he said. “You have to work together and share the information that you have and the events that you have.”
Identifying how attackers gained access, operated within systems, and extracted information supports detection and prevention elsewhere, even before their identity or motivation is clear.
McGuinness added that countries need to increase the hurdles for attackers to commit cybercrimes, while accepting that they will not prevent every attack.
Alongside building that resilience, governments must impose costs on perpetrators. “We need to make it harder, riskier, and less profitable,” she said.
Getting intelligence to those who need it
Differences in countries’ resources are an obstacle to combating criminal networks, said Jetton.
Some countries have substantial investigative capabilities, while others have the determination to act but lack the tools, training, and intelligence.
Cybersecurity agencies and law enforcement bodies should begin conversations with industry early and formalise those relationships, he said.
He highlighted Gateway, INTERPOL’s public-private partnership that gives member countries access to industry intelligence to support cybercrime investigations.
“The onboarding process I admit is a little bit long, but it’s worth it because a lot of these countries would not have this intelligence, would not have the ability to get this this to their hands except through INTERPOL, and it drives everything,” he added.
He also highlighted arrangements that bring financial institutions, telecommunications companies, law enforcement and judicial authorities together under one roof, citing Singapore and Thailand among countries using this approach.
Working together daily allows these organisations to contribute their different capabilities to tackling scams and cybercrime.
McGuinness stressed that relationships need to be established before an incident demands an urgent response.
“It’s about the trust that we build before the crisis, which makes us so much more impactful,” she said.
AI makes basic security more urgent
Artificial intelligence (AI) is increasing the urgency of this work, but the panelists cautioned against overlooking familiar security failures.
AI lowers barriers to entry for criminals, enables faster and more convincing impersonation, and helps attackers exploit vulnerabilities more quickly, McGuinness said.
Phishing and scams remain prominent among the threats reported to INTERPOL, said Jetton.
McGuinness called for minimum security standards for connected devices and cooperation with regional partners on labelling schemes.
“It shouldn’t be that a customer has to walk in and decide, ‘How do I be secure?’,” she said, arguing that consumers should be able to expect security in the products they buy.
On the dynamic between cyber criminals and governments, Dr Tajuddin shared: “I don’t see it (as) a battle, it’s actually a race.”
“But in this case, you don’t see the end.”
Click Here For The Original Source.
——————————————————–
