欧洲地中海研究委员会-远大期望：确定跨地中海网络安全议程（英）-2021.7_85页_5mb

Summary of GREAT EXPECTATIONS: DEFINING A TRANS-MEDITERRANEAN CYBERSECURITY AGENDA

Core Content

This policy study, GREAT EXPECTATIONS: DEFINING A TRANS-MEDITERRANEAN CYBERSECURITY AGENDA, explores the evolving cybersecurity landscape in the Middle East and North Africa (MENA) region and the potential for enhanced cooperation between the European Union (EU) and the MENA countries. The document outlines key challenges and opportunities in the context of digital transformation, cybercrime, and the promotion of a stable and secure cyberspace.

The study is part of the EuroMeSCo network, a platform for policy-oriented research on Euro-Mediterranean cooperation. It is co-funded by the EU and the European Institute of the Mediterranean (IEMed), and involves five Joint Study Groups focusing on different aspects of cybersecurity.

Main Viewpoints

1. EU-MENA Cybersecurity Cooperation: A Dual Challenge

• The EU seeks to enhance cybersecurity cooperation with the MENA region, but this is complicated by the region's fragile political and social environments.
• There is a tension between the EU's desire for closer collaboration and the need to avoid undermining human rights and democratic processes in some MENA countries.
• Cyber resilience is a key objective, but it often conflicts with state interests, particularly in the context of digital and democratic transitions.

2. Cybercrime as a Threat to Economic and Social Stability

• Cybercrime poses a significant threat to the digital economy and overall stability in the MENA region.
• The region is increasingly exposed to new forms of cybercrime, including hacking, phishing, and cyberespionage.
• Cybercrime is not only a cross-border challenge but also has a direct impact on trust in digital systems and economic development.

3. Digital Economy Potential and Cybersecurity Risks

• The MENA region has the potential to become a digital economy powerhouse due to its population, youth, and strategic location.
• However, the lack of cybersecurity infrastructure and awareness makes it highly vulnerable to cyberattacks.
• The region's reliance on volatile income sources (e.g., oil, tourism) and weak governance structures exacerbates the risks.

4. Role of International Law and Norms

• The EU has been promoting norms of responsible state behavior in cyberspace and the application of international law.
• However, engagement with MENA countries on these issues is limited, and many MENA nations are not actively participating in international cybersecurity discussions.

5. Non-State Actors and Cyber Resilience

• Non-state actors, including civil society and the private sector, play a critical role in strengthening cyber resilience.
• Despite this, MENA countries have been reluctant to engage in multistakeholder cooperation and have limited access to the policy-making process.

Key Information

Regional Cybersecurity Landscape

• The MENA region is highly vulnerable to cybercrime, with 6% more attacks than the rest of the world.
• Countries like Israel, Kuwait, Qatar, Saudi Arabia, and the UAE have high levels of Internet penetration and digital connectivity.
• Cybercrime in the region includes a range of activities, such as:
  • Hacking and defacement of websites
  • Phishing and financial fraud
  • Cyberespionage and state-sponsored attacks
  • Child pornography and intellectual property theft

Examples of Cybercrime in the Region

• The Shamoon cyberespionage campaign, attributed to Iran, targeted Saudi Aramco in 2012.
• The Dark Caracal campaign, originating from a Lebanese intelligence agency, targeted thousands of individuals across 21 countries.
• The Tunisian Fallaga Team is an example of hacktivist activity, defacing numerous websites globally.
• The Moroccan Islamic Union-Mail was identified as a terrorist organization using ICT for cyberattacks.

Policy Recommendations

Policies

• Enhance cyber hygiene and awareness through campaigns, exercises, and competitions.
• Promote international cooperation on cybercrime, especially through the Budapest Convention and UN frameworks.
• Define cyber resilience that aligns with EU values while considering the trade-offs between regime and societal resilience.
• Ensure cyber capacity-building does not lead to increased surveillance or censorship.
• Develop region-specific confidence-building measures (CBMs) to create a demilitarised cyber-zone.

Cooperation Mechanisms

• Improve data collection to better assess and address cybercrime risks.
• Encourage inclusive participation of the private sector and civil society in cyber policy formulation and monitoring.
• Strengthen regional cooperation through existing networks and institutions.
• Foster collaboration with countries that are hesitant about international cybersecurity norms.

Conclusion

The study highlights the need for a balanced and strategic approach to cybersecurity cooperation between the EU and the MENA region. While there are opportunities for collaboration, especially in the fight against cybercrime, the region's political and social dynamics pose significant challenges. The EU must navigate these complexities carefully, ensuring that its engagement supports the development of a secure, open, and rights-based digital environment in the Mediterranean.

Annex and Additional Insights

• The Annex by Adel Abdel-Sadek provides further details on digitalisation and cyber resilience, focusing on the role of non-state actors.
• The Introduction by Patryk Pawlak outlines the EU's strategic interest in promoting cybersecurity and digital resilience in the region.
• The Digital Economy and Cybercrime chapter by Alexandra Marion Youmna Laban explores the link between economic development and cybersecurity challenges, emphasizing the need for improved governance and cooperation.

References

• GSMA (2019): Mobile Internet connectivity in the MENA region.
• HRW (1999): The Internet in the Middle East and North Africa: a cautious start.
• World Bank (2014): Broadband networks in the Middle East and North Africa: key facts.
• EU Cyber Direct (2020): Definition and impact of cybercrime.
• UNODC (2020): Cybercrime exploitation during the COVID-19 crisis.
• CIVIPOL & Euromed Police IV (2017): Cybercrime trends and case studies in the MENA region.