1

Israel International Cyber Strategy

International Engagement for Global Resilience

July 2021

This is a product of the Israel National Cyber Directorate (INCD), in collaboration with

relevant ministries and agencies. The INCD is a directorate within the Prime Minister's

Office, and serves as Israel's primary civilian cybersecurity agency. It carries

responsibilities for both cyber defense and national cyber development programs. It

advises the Israeli government on national cybersecurity policy.

2

Table of Contents

Foreword .......................................................................................................................................... 4

National Cyber Strategy ............................................................................................................. 6

Cooperation for Global ICT Security ..................................................................................... 10

Capacity Building and Confidence Building Measures ............................................... 15

Preparing for Emerging Technologies ................................................................................. 20

Conclusion ..................................................................................................................................... 24

Annex - Legal Frameworks ...................................................................................................... 26

3

Foreword

Israel believes that an open, free and vibrant cyberspace is of central importance for

global prosperity in the 21st century. To protect these values of openness and

innovation, strong cybersecurity and international cooperation are imperatives. The

Israel International Cyber Strategy serves as a compass for Israeli international

engagement on cybersecurity. It outlines Israel's main positions on international

cybersecurity issues and serves as a platform for discussion and coordination with

partners.

Israel is an international high-tech hub and world leader in cybersecurity -

operationally, technologically and industrially. Part of Israel's success in this sphere

is its cyber ecosystem, a close-knit community with stakeholders from the national

security agencies, civilian regulators, academic research institutes, industry and

cybersecurity professionals at large. These are complemented by a domestic legal

system based on the rule of law and human rights, and an economic environment

supportive of innovation and investment.

In its cyber journey so far, Israel has been a trailblazer in a variety of fields: setting

cyber-readiness standards for critical infrastructure; establishing a national CERT

with a public hotline; deploying a trusted information sharing platform for the CISO

community; establishing seven dedicated academic research institutes to tackle

cutting edge cyber challenges; leveraging the local cyber industry to supply

innovative solutions; and successfully battle-testing cyber defenses against

persistent cyberattacks. But in the borderless world known as cyber, these domestic

efforts are not enough - robust international engagement is needed.

On the international stage, Israel has concluded cyber defense cooperation

agreements with dozens of partner nations and organizations, takes active

participation in multilateral fora and hosts prominent international cyber

conferences. It works actively to share its experience and lessons learned, with a view

to benefit allies and partners across the world. It seeks to harness its advantages in

cyber to promote global cyber resilience and cooperation based on shared values

and trust.

However, cyber risk is on the rise: offensive cyber tools are becoming more

sophisticated and available to malicious actors; the technological landscape is

becoming more interconnected and embedded in all areas of our lives; and the

cyber workforce is not growing as fast as the demand. All of these create a

challenging strategic environment for national and international cybersecurity.

Preparing for it will require vision, action and cooperation crossing organizations,

sectors – and borders.

4

State of the Cyber Nation

>500 papers published by Israel's

7 cyber research centers

~2.9 B$ private investment in cyber 2020;

>3.3 B$ in first half of 2021

~24 MoUs for international cyber

cooperation

2 decades of critical infrastructure

cyber-readiness

120 cyber classes for

school-age students

CERT in 2020: ~9000 incidents reported;

~300 alerts distributed

5

1

National Cyber Strategy

6

Cyber and National Goals

Cyber plays multiple roles in furthering national goals: technological, economic, social, national

security and international.

This holistic view of cyber reflects the central place of information and technology in 21st century

society. It anchors both Israel's domestic policy and its engagement with the international community.

NATIONAL SECURITY

International conflicts increasingly feature cyber

elements. Cyber tools provide operational and

intelligence advantages to conflicting parties,

and need to be taken into account in national

security planning.

ECONOMIC

Economically, a secure cyberspace enables

digital trust in the economy, while reducing

financial damage from cyberattacks. The Israeli

cyber industry is also an important engine of

growth in the high-tech sector.

TECHNOLOGICAL

Cybersecurity has become a key consideration in

the development of virtually any new technology,

demanding a 'security by design' mindset,

facilitated by secure standards and secure

development practices.

SOCIAL

Socially, Israel’s cyber excellence is leveraged

to transcend social groupings, expand

inclusivity and connect the periphery to the

center, including the advancement of Be’er

Sheva in the south as the ‘Cyber Capital’.

INTERNATIONAL

Internationally, Israel’s cyber

capabilities are a source of

international interest and a

springboard for cooperation. Israel

contributes to global cyber resilience,

which in turn is important for Israel's

own cybersecurity. International

engagement in cyber, based on

shared values and mutual benefit,

contributes in turn to the realization

of the other national goals.

7

National Cyber Defense Concept

Defense National

The third layer concerns taking

steps against attackers.

Diplomatic, law enforcement,

informational, economic,

military and cyber tools may

be deployed as appropriate

against cyber adversaries who

undermine Israeli interests.

These are designed to

intercept, defend against and

deter adversaries, beyond

Israeli borders when needed, in

accordance with domestic and

international law. It is an all-of-

government effort carried out

independently and/or with

partners.

Operational Response

The second layer relates to the

responses to cyberattack. It

includes threat detection,

analysis and removal,

functional recovery, and

immunization from similar

attacks throughout the market.

The overriding concept is for

the defense operational cycle

to outpace that of the

adversary. State intervention is

undertaken in case of a

national threat and assistance

to the private sector is

governed by strict legal

requirements and utmost

discretion, for maximum trust.

arket ResilienceM

The first layer is aimed at

ensuring the civilian sector has

the independent capability to

prevent and withstand

cyberattacks. To this end, the

State regulates critical

infrastructures, provides

cybersecurity guidance to the

public, distributes national

vulnerability alerts, facilitates

cyber crisis preparation and

proactively reduces the

national ‘attack surface’. Scale

is achieved together with major

service providers, professional

associations and the insurance

industry.

Israel's national cyber defense concept is composed of three distinct layers, each executed by a different

combination of authorized agencies. The different layers have a common goal: ensuring techno-

operational advantage over adversaries in cyber. These three layers are supported by an additional

national effort to shore up the national cyber scientific and industrial ecosystem.

The three layers rest upon a scientific and industrial cyber ecosystem, comprised

of people, knowledge and facilities. These require constant investment in

academic research, industrial innovation and human capital programs. The

contribution to the three layers of cyber defense are direct and tangible – cyber

agencies benefit from a trained workforce, state of the art technologies,

networking and opportunities that the ecosystem affords. In turn, the ecosystem

benefits from people with operational experience and practical skills developed

in the agencies, as well as attendant reputational value.

The Cyber Ecosystem

8

International Cyber Strategy

Defense ConceptNational Cyber

Market Resilience

Operational Response

National Defense

Cyber Ecosystem

Global Cyber

Resilience

Cooperate for Global

ICT Security

Capacity and

Confidence Building

Legal Frameworks

Collective

Resilience Efforts

Capacity

Building

Confidence

Building

Recognize Common

Challenges

Joint R&D

Solutions

Tech

Policies

Prepare for

Emerging Tech

The national cyber defense concept is complemented by an international cyber strategy. At the

heart of Israel's international cyber strategy, is its effort to build global cyber resilience. This

goal serves not only to create partnerships abroad, but also helps improve cybersecurity at home

– when the tide rises, all boats rise. The strategy is based on three components: cyber defense

cooperation; capacity and confidence building measures; and preparing for emerging

technologies. These are informed by the applicable domestic and international legal frameworks.

Bilateral

Joint Action

Trust in

ICT Trade

International

Standards

9

2

Cooperation for Global

ICT Security

10

Common Challenges

Threat trends for the coming years include increased sophistication of malicious actors, wider

access by them to offensive cyber capabilities and continuous attempts by them to attack high

value assets. International cyber discourse requires a common understanding of these threats.

When planning national and international cyber defense, a number of considerations need to

be factored in: the spectrum of threats, areas of market failure, relative advantages and the

resources available. Israel sees the following as priority challenges, both nationally and globally:

Functional Continuity - Continuity of critical infrastructure and essential services remains

the first priority of States. Cyberattacks can disrupt continuity not only by targeting

physical control systems, but also administrative systems or core digital assets. Scaled

effects can be obtained via a single chokepoint or viral attack. This complicates common

definitions of critical infrastructure.

Public Trust - Public trust in digital processes is of paramount importance. Trust in vote-

counting systems is a primary example. Looking ahead, trust in machine decisions will

be a key factor in enabling the AI transformation. Cyber defense is focused on verifying

the authenticity of the technological processes, not the veracity of the content.

Next-Gen Data Protection - Advanced analytics are vastly improving what can be

extracted from data, including for important security and law-enforcement use cases.

However, this has also spiked the sensitivity of data, whether in closed networks or open

media, especially biometrics. Data protection will need to adapt to these new conditions.

Technological Supply Chain - One of the most challenging threat vectors in cyber is via

the supply chain. One weak link in the chain, such as an under-protected IT vendor or

compromised component, could end up becoming gateways for attackers. This is a

multifaceted challenge requiring careful coordination with the private sector and the

building of international trust.

Connectivity - The Covid-19 epidemic brought with it a realization that large-scale

connectivity is crucial to national health and security. It will also underpin mass

deployment of IoT devices. Israel pays special attention to the resilience of network

connections, both via cable and the RF spectrum, including satellite services.

Cybercrime - Cybercrime is exacting an increasing cost on the global economy. The

international response requires innovative concepts of operations, integrating cyber

defense with law enforcement tools.

11

Info Sharing

Introducing common

cyber hygiene checks

into routine supply

chain management in

the private sector, can

have ripple effects on

collective cyber

security. Israel

implements a

methodology, a digital

platform and a

certification scheme for

supply chain security

compliance officers in

corporations. Cross-

border interoperability

of this scheme could

help build trust.

Supply Chain

The digital market is

increasingly moving

to service-based

models. Sometimes,

digital service

providers such as

cloud platforms and

web hosting servers,

are exploited by

malicious actors to

attack third parties.

Basic steps, such as

'Know Your Customer'

(KYC) practices by

digital service

providers, could

reduce these attack

vectors.

Digital Services

Financial incentives

are an essential driver

of security investment.

But problems in

quantifying the risk,

inadequate corporate

governance and a still

maturing cyber

insurance market have

inhibited full

leveraging of these

financial incentives.

Israel is engaged with

relevant stakeholders

as well as multilateral

forums such as the

OECD to address these

issues.

Financial Incentive

Information sharing is

at the heart of cyber

cooperation. Israel

implements a trusted

national network

(CyberNet) linking

CISOs and security

practitioners for real-

time exchange. A

similar model for

international use, with

attendant safeguards

and agreed protocols,

could help reduce

barriers to cooperation

and overcome legal

and technical

constraints.

Collective Resilience Efforts Raising cyber resilience across the board is a particularly challenging goal. Israel suggests

focusing on a number of promising directions for raising collective cyber resilience:

12

In addition to collective efforts, bilateral collaboration is an essential element of

improving global cyber resilience. Bilateral relationships enable optimization of both

parties' mutual areas of interest, the scope of efforts and resource allocation to the

collaboration. They help build the trust required in cybersecurity.

Cyber Dialog and Joint Investigations

International cooperation is critical when it comes to raising resilience and mitigating

cyber events, especially since sophisticated attackers will usually seek the weakest link.

Allied cyber defense teams share a common objective of ensuring that they are all

prepared and capable to prevent offensive cyber acts. In that sense, cyber defense is truly

a global "team sport" requiring intensive coordination.

To reach the full potential of such coordination, international defensive collaboration

should be promoted between national level organizations, based on the following

principles:

Relative advantage: Based on each side's threat landscape, experience and lessons

learned, partners share critical information on malicious tactics, techniques and

protocols they have encountered.

Early warning: Sharing cyber events and indications of compromise at early stages,

enables each party to undertake national risk analysis, detect weak signals for serious

threats and implement timely mitigation measures.

Speed: Speed is always of the essence in cyber, and it can be increased through

bilateral cooperation mechanisms. Efficient communications protocols and the

potential for joint live investigations can greatly accelerate incident management.

Technology: Trusted and secure collaboration platforms can be a force-multiplier.

Common platforms for cyber analysts can facilitate instant messaging, data sharing,

joint analysis and research, risk assessments etc.

Agreed frameworks: Tailored agreements can help set expectations, enhance trust

and create legal mechanisms to close the loop in cyber defense settings. This can be

essential to removing barriers for cooperation between agencies.

Bilateral Joint Action

CERT-IL is an operational unit, responsible for engaging with the Israeli market,

receiving alerts, developing full cyber situational awareness, and warning the market

on current attacks and upcoming risks, using a proactive approach. CERT-IL is a focal

point for sectoral SOCs and the cyber intelligence community. It operates the national

cyber hotline (dial 119) and engages with more than 90 international partners around

the world. This model brings great value to the national cyber defense, providing an

essential public service to the private sector in Israel and an address for cooperation.

13

Cybersecurity methodologies and best practices need constant update due to the

changing nature of technology and threats. This knowhow is developed constantly, all

over the world. Sharing of methodologies and best practices can speed the development

and implementation of up-to-date cybersecurity measures. Current areas of focus

include:

Organizational cybersecurity

Supply chain

OT/IOT

Aviation, maritime and automotive systems

Cloud migration

Crisis management and incident response

Israel believes in unity of efforts when it comes to cyber. This concept has many facets –

organizational structure, operational command and control, legal authorities, national

capacity building programs, engagement with the market and joint work with all

government offices and sectors. Creating this unity is a difficult endeavor and Israel

shares its lessons learned with other countries interested in advancing this model.

Israel also shares its experience in developing innovation ecosystems. The Be'er Sheva

ecosystem is a prime example. It combines government (CERT-IL), academia (Be'er Sheva

University cyber research center), private sector (from MNC to start-ups) and military

(IDF) collaboration, where those organizations are co-located in a Cyber-Park, sharing

knowledge, manpower and innovation culture. This model has many advantages –

inclusion, knowledge development, workforce development and leveraging public

assets.

Sharing Methodologies

14

3

Capacity Building and

Confidence Building

Measures

15

Developing countries on the other side of the ‘digital divide’ seek to leapfrog their digital

economies, and do so securely. 'Capacity Building' in this context is the family of efforts

conducted to empower partner countries so they can achieve this objective. Specifically,

capacity building is an important measure in building trust, promoting a stable and

resilient global cyberspace and facilitating continued human prosperity and progress in

the information age.

Israel's efforts in cybersecurity capacity building are numerous and diverse, touching

upon a wide scope of issues: building institutions and legal frameworks, formulating

strategies and policies, training decision makers and professionals, laying down technical

infrastructure, building operational cores, raising public awareness and creating

mechanisms to cultivate academic and industrial excellence and innovation.

Israel's capacity building activities are aimed at improving global resilience on a

politically neutral basis, thus adopting a constructive and cooperative approach, while

encouraging cybersecurity innovation. Israel views capacity building as part of its foreign

policy, cyber defense concept and its general international development program. Its

capacity building effort is based upon an "impact first" approach, based on the

following principles:

Cybersecurity is an urgent issue. Currently, the growth of risk far outpaces

defensive capacity building. The global community needs to do more, faster.

Capacity building efforts must be geared towards achieving a dramatic change

to the country's cybersecurity posture. Resources needs to be allocated with a

"leapfrog-oriented" mentality aimed at impacting at scale.

Sporadic, overlapping efforts are counterproductive. Coordination and focus

are essential to achieving the common goals.

While promoting policies, legal frameworks and institutions is important,

precedence should be given to core operational capacities, both technical and

human. The top-down and bottom-up approaches can be pursued in tandem.

But core operational capacities need less adjustment to the unique circumstances

of each country and have the potential for a more immediate and significant

impact.

True impact requires cybersecurity expertise together with viable and sustainable

development processes and financial models. Unmediated cooperation

between cybersecurity agencies and development bodies (banks, agencies and

fora) is necessary.

Cybersecurity should not be treated only as a silo/vertical capacity building issue,

but also as a horizontal issue, which must be dealt with in any sort of digital

capacity building - for example, when designing a power-grid reform, a new

transportation infrastructure or when working on the stability of a financial

system.

Capacity Building

16

In the last 5 years Israel has:

Helped create and participated in a capacity building fund with the Inter-

American Development Bank for the benefit of Latin American countries.

Helped create and participated in a capacity building fund with the World Bank

for the benefit of African Countries.

Assisted additional cybersecurity efforts in the World Bank's Digital Development

Partnership fund.

Invested in a research project to promote better development methodologies

and practices in the field of cybersecurity.

Worked with the Israeli industry to create consortia with the ability to tackle

country-scale capacity building challenges.

Conducted dozens of bilateral capacity building missions: study tours, expert

missions, training sessions, emergency technical assistance, gap analysis and

more, some of which matured into full-scale national capacity building programs.

Participated actively in international organizations promoting the capacity

building agenda, among them the GFCE and WEF.

Implementation

PROGRESS

("Promoting Global Cyber Resilience for Sectors and Society")

As part of the effort to promote an impact-oriented capacity building agenda,

Tel-Aviv University, supported by INCD, is developing the PROGRESS

framework, a novel paradigm designed to both evaluate the current cyber

maturity of a critical sector (eg. energy, finance) and to offer a practical path

forward: in regulatory development, workforce training, technological

mitigation, institutional reform and more. The framework is generic but easily

suited to the specific national and sectoral circumstances. It is designed to

bridge the gap between two other types of cyber maturity evaluation schemes

in use today: those which employ a macro-level state-wide perspective, and

those which employ micro-level organizational analysis. It is hoped that

PROGRESS will enrich the toolbox available to decision makers wishing to

allocate their capacity building resources on cyber resilience in critical sectors.

17

Developing effective international understanding requires an infrastructure of trust. In

addition to extensive bilateral information sharing, Israel supports the important work

done by the OSCE in confidence building measures, which serves as an example of a

positive regional initiative that has resonated with other regional organizations

worldwide. Israel, as a Mediterranean Partner, actively contributes its experience and

efforts in this framework. Moreover, Israel, is a founding member of the Global Forum on

Cyber Expertise (GFCE), and is an active partner in developing CBM's and capacity-

building initiatives on cyber security related issues in the GFCE framework.

Israel's Participation in Diplomatic Multilateral Cybersecurity Fora

Israel attaches great importance to the multilateral efforts to promote security and

stability in cyberspace. Israel's international engagement seeks to ensure that the

development and use of cyberspace are in line with shared values, good governance and

a commitment to maintaining a peaceful and stable international environment.

Israel was a member of the UN Group of Governmental Experts on advancing responsible

State behavior in cyberspace in the context of international security (GGE) - the first GGE

in 2009 and the fourth GGE in 2015. It is an active participant in the UN Open-Ended

Working Group on developments in the field of information and telecommunications in

the context of international security (OEWG). Israel's priorities for the GGE and the OEWG

are to: develop recommendations on how to better coordinate and target cyber capacity

building; find additional ways to conduct CBMs; and generate practical guidance on how

to implement the recommendations of previous GGE reports.

The 2015 GGE report included a chapter on cyber norms. These were drafted by

consensus as voluntary, non-binding standards, which do not alter rights or obligations

of States under international law. The GGE 2015 norms may be useful in indicating the

general expectations of the international community, but since their endorsement by the

United Nations General Assembly, they have been routinely flouted by malicious actors.

This suggests that norm development is not a panacea.

A Practical, Bottom-Up Approach

Rather than focus on formulating new norms, Israel is supportive of a more cautious,

incremental and bottom-up approach, focused on the actual, practical needs of

cybersecurity agencies, CERTs and the broader cybersecurity community. There is a need

to remove barriers to cybersecurity cooperation, on such concrete issues as privacy

guarantees for information sharing and legal protections for security researchers making

responsible disclosures. Facilitating cybersecurity cooperation by making relevant

governing legal rules among States more interoperable, could be useful for States and

the private sector alike, and it could serve as an added source of confidence.

Global Internet Governance

Israel supports the multi-stakeholder model of global internet governance, as the most

appropriate model to ensure an open, global and secure cyberspace. In that regard, Israel

is an active participant in Internet Governance Forum sessions, and follows closely

developments at ICANN, IETF and similar bodies.

Confidence Building

18

Israel is a party to several bilateral and multilateral treaties in the fields of trade and

investment protection. Such treaties have been instrumental in developing the global

economy and fostering innovation. Similar to the physical world, in the digital sphere,

there is an ongoing effort towards the reduction of barriers in order to enable cross-

border trade in digital goods and services, alongside a trend to facilitate cross-border

data flows in order to foster global economic development.

These efforts are hampered by a growing security-driven international trust deficit. The

more dependent society becomes on cyber-physical systems and massive data traffic,

the higher the stakes become for cybersecurity. As global economic integration expands

in parallel, States in certain cases seek to manage the attendant risks by adopting

exceptional measures, such as source code reviews, data localization requirements and

foreign investment oversight.

Israel, together with many of its likeminded partners, seeks a balanced approach between

these competing needs. Israel has a national export control system, which incorporates

widely accepted international standards in its legislation. In 2019, the Israeli cabinet

adopted a decision on Foreign Investment Review, which allowed for "defense, foreign

relations and cyber" considerations to be represented to Israeli regulators before

licensing foreign companies to carry out national infrastructure projects. This is in

addition to mandatory cyber guidance given to critical infrastructure operators by law,

some of which are foreign entities or deploy foreign systems. These steps are aimed at

mitigating long term cyber risks, without detracting from free trade obligations and while

maximizing economic benefits.

As a leading tech producer and exporter, Israel sees great importance in strengthening

international trust in technology supply chains, and thinks this is attainable with partner

nations through secure development practices, robust security provisions in technology

standards, information sharing, consultations and ad-hoc arrangements where

appropriate. In addition, policies aimed at diversifying tech markets will serve both

economic interests and risk management.

Fostering Trust in ICT Trade

19

5

Preparing for

Emerging Technologies

20

R&D

Emerging technologies

should be tested for

vulnerabilities and attack

vectors, often in dedicated

labs. Technical safety and

security standards need to be

accelerated to influence the

development stages. Specific

R&D efforts are required for

mitigations and defensive

solutions ahead of

widespread deployment.

These are public-private

efforts requiring international

investment and coordination.

Tech Policy

Cooperation Since emerging technologies

arise in parallel around the

world, often by cross-border

teams of developers, there is a

need for coordination among

states regarding their security

policies. Ensuring diversified

and interoperable suppliers

can spread risks. Information

sharing and joint development

programs can help build trust.

Meanwhile capacity building

can improve equal access to

emerging technology without

compromising on security.

Cyber is not a discreet technological field, but rather a permanent feature of almost all digital

technologies. In the coming decade, it is anticipated that the digital landscape will undergo wide-

scale transformation. Mass migration of digital assets to the cloud is expected to improve services,

while concentrating those assets in the hands of a few providers. Upgrade to 5G telecommunications

together with broad deployment of IoT devices, will underpin smart cities, connected transportation,

digital health and more. AI systems will support decisions and enable autonomy in an expanding

number of contexts. Together these demand security foresight and cyber readiness:

Technology and Innovation

Emerging technologies need

to be fostered in a supportive

regulatory and policy

environment, that refrains

from stifling innovation. At

the same time, it should

encourage resilience and

safety across the

technological lifecycle. This

requires establishing the right

incentives for all

stakeholders. Uncertainties

should be managed, through

regulatory sandboxes, among

other tools.

21

AI is a transformative technology, with capabilities in object classification, statistical

prediction, anomaly discovery, content generation and optimization in complex systems.

It will require stewardship to ensure AI trustworthiness and security across broad use-

cases. In support of securing AI, Israel is investing in programs for resilient, explainable

and privacy-preserving features. Israel is engaged internationally on the issue and took

part in drafting the OECD principles and recommendations for AI. It sees the following

risks as requiring international attention:

Adversarial threats against AI systems can distort processes and outputs, resulting in dangerous situations. Technologically, Israel is researching security and verification mechanisms for AI systems. On the regulatory level, public consultations are gathering insights from field experience. Security incentivization and liability regimes are being explored in critical use cases such as autonomous vehicles. Internationally, Israel engages with standards bodies to synchronize with emerging security metrics.

Training data was often created before its machine learning uses were understood, and is sometimes drawn from unsuspecting sources. This raises privacy and security concerns, such as the potential to micro-target individuals in unprecedented ways. Biometrics are especially sensitive - Israel's biometric database for secure ID is heavily protected and governed by law. Work is being done to inform secure data collection and training for AI. Privacy attacks are being researched. Technical solutions for anonymization are being explored.

The powerful capabilities of AI are a force for good, but they also have potential malicious uses. For example, every element of the cyber "kill chain" is ripe for upgrade with AI. Autonomous vulnerability search, "deepfake" content for social engineering and malware obfuscation are but a few examples that have already been demonstrated. Israel is researching these attack vectors and developing updated cybersecurity concepts for the AI era. International discourse will need to address some of these phenomena as well.

Secure AI

Data

Protection

Malicious

Use

System

Resilience

22

5G Telecoms - Israel completed its first frequency auction for

5G and is working to ensure 5G security with robust cyber

standards in telecommunications licenses, and with security

solutions from both the telecoms and cyber industries.

Internationally, Israel supports the Prague process for

coordinating international 5G security principles. It also

supports international efforts for open radio networks,

diversifying suppliers and spreading risk.

Transportation - Israel has national initiatives for aviation,

maritime and smart automotive cybersecurity. These involve

multi-stakeholder arrangements, with OEMs, operators,

cybersecurity industry, regulators, standards bodies, trade

organizations and partner nations. Israel aims through these

initiatives to raise international cyber standards and

accelerate security solutions in this global sector.

Medi-Sec - The Covid-19 pandemic revealed the critical

vulnerability of health systems to cyberattack. As

bioinformatics, e-health and medical IoT become ubiquitous,

cyber risk increases. Israel's world contribution to both

medicine and cyber have paved the way for unique

collaborations aimed at securing the technological landscape

of the health sector.

Fin-Sec - As the financial sector is transformed by a growing

stream of fintech innovations, there is a parallel need to

develop innovative security solutions and standards. Israel's

Fin-Sec Arena brings international financial service providers

and local developers together to facilitate this process, to the

benefit of the global financial system.

Computing Infrastructure - Cloud security is a growing

international concern, as public and private bodies entrust

digital assets to global vendors. Israel's national cloud project

will be secured under the shared-responsibility model. The

national quantum initiative will further augment national

computing capabilities. It will be accompanied by efforts for

post-quantum cryptography, another global concern.

PNT - Positioning, navigation and timing services underpin

such varied functions as network synchronization, smart

agriculture, high frequency trading and transportation.

Multiple global GNSS services are freely available, but easily

interfered with. Israel seeks to ensure continuous and trusted

PNT services, while sharing solutions with partners.

Select Focus Areas

23

6

Conclusion

24

By placing global resilience at the heart of its international cyber strategy, Israel is

recognizing that national and international cybersecurity are intrinsically linked. Yet

achieving this goal requires a multi-pronged effort, combining technological, policy

and diplomatic disciplines. Israel stands ready to leverage its own experience and

expertise, as well as to learn from that of our partners, in order to move forward on

this pressing international need.

To be successful, Israel believes in a practical, bottom-up approach, to help with the

real problems of cyber defenders. Cybersecurity cooperation must become more

actionable, capacity building more impactful and tech policy more concrete. In a

global and interconnected economy, our ability to become more secure depends

on our ability to work together across nations and political divides. Based on shared

values and common understandings, Israel prioritizes ways to facilitate international

cooperation for promoting and implementing cybersecurity policies.

This document summarizes some of Israel's main positions in the international

cybersecurity discourse. It demonstrates Israel's firm commitment to the core shared

values of an open, free and resilient international cyberspace, as key enablers of

global prosperity. These basic values will continue to guide Israel's policies in

navigating the complex challenges going forward.

25

Annex

International Legal

Frameworks

26

Applying International Law Israel considers that international law is applicable to cyberspace. Israeli

officials have consistently expressed this position over the years, including the

Minister of Justice in 2016, as well as the diplomatic representatives to the United

Nations Governmental Group of Experts (UNGGE) and the Open Ended Working

Group (OEWG), as well as in other fora. In December 2020, Israel's Deputy Attorney

General for International Law reaffirmed this position and laid out in more detail

some key aspects of Israel’s approach regarding the application of international

law to cyberspace1, some of which will be highlighted below.

Traditional rules of international law, which mainly evolved in a bricks-and-mortar

world, and often in domain-specific contexts, do not always lend themselves to

application in the cyber domain, which has certain distinctive characteristics. For

example, data travels globally across networks and infrastructure located in

multiple jurisdictions, transcending national borders and lacking meaningful

physical manifestations. Moreover, cyber infrastructure is, to a large extent,

privately-owned and decentralized, both at the domestic and international levels.

The cyber domain is also highly dynamic, with technological developments and

innovation advancing at a rapid pace.

When considering the applicability of specific rules of international law to

cyberspace, it is important to be mindful of such distinctive features, and to carry

out a meticulous examination of the rules at play and the context in which these

rules emerged.

1 Roy Schöndorf Israel’s Perspective on Key Legal and Practical Issues Concerning the Application of International Law to Cyber Operations 97 INT’L L. STUD. 395 (2021).

27

Sovereignty

Sovereignty is a foundational concept in international law and international relations. In

recent years, a debate has emerged as to its legal implications, with one view advocating

that there is a general legal obligation under international law to respect another State's

sovereignty, and another view holding that sovereignty is merely a general principle from

which legal obligations emerge such as the prohibition on use of force and the

prohibition to intervene in another country's internal affairs. It is Israel’s view that in

international law there is a firmly-entrenched legal rule with regard to respecting the

territorial sovereignty of other States. However, the application of this rule in the cyber

domain raises questions and challenges. In practice, cyber activity in the exercise of State

functions often implicates infrastructure physically located in other States, without such

activity being deemed by any party a violation of territorial sovereignty. In addition,

States' legitimate interests in the protection of data and networks of its citizens and

companies hosted abroad, e.g. in cloud computing, should also be borne in mind.

Non-intervention

The prohibition on intervention in other States’ internal affairs has been typically taken

to mean that a State cannot take actions to coerce another State into taking a course of

action, or refraining therefrom, in matters pertaining to the latter's core internal affairs.

This rule has usually been applied in the context of military intervention and support to

armed groups seeking the overthrow of the regime in another State, entailing a high

threshold of application. In the cyber context, manipulation of election results or

interfering with a State’s ability to hold an election could also likely be considered a

violation of this rule.

Due diligence

In the 2015 Report of the UNGGE, due diligence is mentioned as a voluntary, non-

binding norm of responsible State behavior, providing that States should not allow their

territory to be used for the commission of international wrongful acts. The application of

due diligence to cyberspace presents practical and legal challenges. For example,

"shutting down" service providers' traffic could harm freedom of expression. In light of

current state practice and opinio juris, it has not crystallized into a customary rule.

State responsibility

The international law of State responsibility is generally applicable to the cyber domain,

determining whether States are responsible for internationally wrongful acts in this

domain. Attribution of acts to States in the cyber domain in order to determine State

responsibility is mainly a factual matter. There is no international legal obligation to

disclose information forming the basis of an attribution of a particular act in cyberspace.

While in some cases States might find it useful to publish such details, it may not always

be desirable or possible to do so, for reasons such as national security or foreign

relations. A State's decision whether to provide details and to whom, remains its exclusive

discretion. The rules regulating countermeasures are also relevant to cyberspace. There

is no absolute duty to notify the responsible State in advance of a countermeasure. Such

a requirement would often undermine the effectiveness of a countermeasure, render it

obsolete or compromise other interests of the State undertaking the countermeasure.

28

Use of force

Israel considers that the Charter of the United Nations, including the prohibition set out

in Article 2(4) of the Charter on the “threat or use of force” in international relations, is

applicable in the cyber domain. A cyber operation can amount to use of force if it is

expected to cause physical damage, injury or death, which would establish the use of

force if caused by kinetic means. Moreover, an action taken in accordance with a State's

inherent right of self-defense, enshrined in Article 51 of the Charter, against an armed

attack conducted through cyber means, may be carried out by either cyber or kinetic

means.

The law of armed conflict

The law of armed conflict (LOAC) and its fundamental principles generally apply to cyber

operations conducted in the context of an armed conflict. Israel views that only an act

expected to cause death or injury to persons or physical damage to objects beyond de-

minimis, may constitute an “attack” within the meaning of this term under LOAC. The

LOAC rules on targeting relating to distinction, precautions and proportionality apply

only to cyber operations qualifying as "attacks" under LOAC. Military operations not

constituting “attacks” are subject to general obligations under LOAC that do not depend

on whether the act is an attack or not.

Cybercrime

Israel is a party to the Budapest Convention and cooperates with States across the globe

in prosecuting criminal actors. Israel also supports, and is taking part in, negotiations for

a protocol on law enforcement access to data on the cloud. It is imperative to achieve

better understandings of the interplay between law enforcement and extraterritorial

jurisdiction. State practice indicates that there are different approaches on this matter,

and greater clarity is required. In addition, particular attention needs to be afforded to

the protection of government data stored by third-party cloud providers. In Israel's view,

such data is not – and should not be made – subject to access requests by law

enforcement authorities of other States.

Furthermore, Israeli law enforcement agencies, aware of the "going dark" phenomenon,

are considering different approaches to address it. To that end, Israel views international

cooperation in this field as important.

Human rights

New technologies present constantly evolving opportunities and dilemmas, including in

the field of human rights. As with other concepts of international law, our common

understanding of how human rights law applies may entail adjustments to the digital

context. In that regard, Israel is a party to seven international human rights conventions.

States' applicable obligations under these conventions remain relevant also in the cyber

domain, in particular in striving to protect key rights such as freedom of speech and

privacy.

29

30