{
"authors": [
"Tim Maurer",
"Steven Nyikos"
],
"type": "legacyinthemedia",
"centerAffiliationAll": "dc",
"centers": [
"Carnegie Endowment for International Peace"
],
"collections": [
"Cyber and Digital Policy"
],
"englishNewsletterAll": "ctw",
"nonEnglishNewsletterAll": "",
"primaryCenter": "Carnegie Endowment for International Peace",
"programAffiliation": "TIA",
"programs": [
"Technology and International Affairs"
],
"projects": [
"Protecting Financial Stability"
],
"regions": [
"Iran"
],
"topics": [
"Economy",
"Security",
"Technology"
]
}
Source: Getty
Cyberattacks to manipulate the integrity of financial data pose a distinct set of systemic risks.
Source: R Street
The February 2016 theft of $81 million from Bangladesh’s central bank, which recent reports suggest may have been perpetrated by agents of North Korea, demonstrated the scale of risk that malicious hackers pose to financial institutions.
Cyberattacks to manipulate the integrity of financial data pose a distinct set of systemic risks. While a cyberattack on an electrical grid, for example, will be mostly limited to a single country’s territory or its immediate neighbors, the effects of an attack on the financial system are not bound by geography. Such attacks could lead to bankruptcies that, in turn, send shock waves throughout the global system.
The G-20 finance ministers and central bank governors recognized the threat in a March 18 communiqué:
The malicious use of Information and Communication Technologies (ICT) could disrupt financial services crucial to both national and international financial systems, undermine security and confidence and endanger financial stability.
Now the G20 heads of state have an opportunity to take further action. A new white paper by the Carnegie Endowment for International Peace proposes the G-20 heads of state explicitly commit not to undermine the integrity of financial institutions’ data—whether in peacetime or during war—or allow their nationals to do so, and to cooperate with the international community when such attacks do occur.
Most states already demonstrate restraint when it comes to cyberattacks that could compromise the integrity of financial institutions’ data. By making such restraint explicit, they could:
The agreement proposed in the Carnegie white paper would commit states not to conduct or knowingly support any activity that intentionally manipulates the integrity of financial institutions’ data and algorithms, wherever they are stored or when in transit. It also binds states, to the extent permitted by law, to respond to requests by other states to assist in halting cyberattacks that target financial institutions’ data and algorithms and that either pass through or emanate from the state in question.
Elements of the proposed agreement are mutually reinforcing. The commitment by states to provide assistance and information, upon request, shifts the burden of attribution from the victim of attack to states that have professed interest in helping to respond to and ultimately prevent such attacks. Linking an agreement on state restraint with expectations for the private sector to implement due-diligence standards addresses potential moral-hazard problems.
The agreement would build on existing international law and on recent international efforts to develop rules for cyberspace. These include the 2015 report of the U.N. Group of Governmental Experts, which proclaimed:
States must not use proxies to commit internationally wrongful acts using ICTs, and should seek to ensure that their territory is not used by non-State actors to commit such acts.
The G-20 heads of state could advance this norm powerfully, building on the finance ministers’ statement, by articulating it formally when they meet in July.
Of course, in the 21st century, a few states that are relatively cut off from the global economy, and nonstate actors who may or may not be affiliated with them, could conduct cyberattacks against financial institutions. But states that endorse the norm explicitly would be more united and would have a clear basis to demand potential retaliatory action against violators—be they states, terrorists or cybercriminals.
Former Senior Fellow, Technology and International Affairs Program
Dr. Tim Maurer was a senior fellow in Carnegie’s Technology and International Affairs program.
Steven Nyikos
Former Nonresident Research Analyst, Cyber Initiative
Carnegie does not take institutional positions on public policy issues; the views represented herein are those of the author(s) and do not necessarily reflect the views of Carnegie, its staff, or its trustees.
China’s banking crisis in the 2000s was resolved by transferring the costs to households through financial repression—a decision that recapitalized the banks while exacerbating the structural imbalances that continue to shape the Chinese economy today.
Michael Pettis
Chinese biotech companies have been on the receiving end of U.S. economic coercion. Yet their responses have differed significantly because firm and state interests are not uniformly aligned. For Washington, treating all Chinese tech firms the same, irrespective of their actual interests, risks pushing them farther into Beijing’s corner.
Xue Gong
China’s latest energy plan explicitly calls for integrating data centers into the electricity system, particularly connecting them to green energy. It appears Beijing wants to use compute as a source of domestic demand to absorb renewables excess capacity.
Damien Ma
Across Asia, China is better positioned to withstand energy shocks from the fallout of the Iran war. Its abundant coal capacity can ensure stability in the near term. Yet at the same time, the country’s energy transition away from coal will make it even less vulnerable during the next shock.
Damien Ma
In the latest Five-Year Plan, the Chinese president cements the shift to an innovation-driven economy over a consumption-driven one.
Damien Ma