Three ideas for avoiding hysterical coverage of cyber attacks

In three weeks, Europe has discovered it has a front line inside a cold store. Since 11 October, remote controls for refrigeration systems have been tampered with across half the continent, with a second wave between 1 and 2 November reaching as far as Sicily and Tuscany. Then came dozens of false bomb alerts on European flights. Finally, the ‘bounty’ placed by NoName057(16) on the personal data of eighteen ‘enemies of Russia’, including Antonio Tajani, the Rome public prosecutor and the head of the Postal Police. The first priority is not to lose one’s head. In September, the National Cybersecurity Agency recorded 485 incidents, 57 per cent more than in August. It sounds like the apocalypse, but part of the increase stems from the reporting obligations under the NIS2 Directive, which have broadened the state’s field of vision.

The thermometer is new, but the fever is only partly so. Panic is the product that the attackers are selling: an email costing zero euros sends two fighter jets soaring into the sky, whilst a screaming headline multiplies the effect. But underestimating the threat is not an option either: in September, a ransomware attack shut down a hospital site. Then there’s the bill. The Agency operates on approximately 137 million in regular funding. The fund for the National Strategy has been reduced from 150 to 135 million a year; the maintenance fund has fallen to 66. Guaranteed resources for cyber security in 2027 will be just over 400 million, compared with defence spending of over 40 billion. Meanwhile, politicians are at loggerheads over SAFE, the European defence loan programme. A ceiling of 14.9 billion had been approved for Italy, with more favourable terms than standard sovereign bond issues and maturities of up to forty-five years. The government has reduced the request to just over eight billion. Yet the categories eligible for funding include critical infrastructure, cyber security and artificial intelligence.

This gives rise to three priorities. The first is awareness, which costs little and yields great returns. The Agency’s bulletin on the cold chain is a list of common-sense measures: remove control interfaces from the internet, separate industrial networks from office networks, protect remote access with multi-factor authentication, and replace end-of-life equipment. In the Sicilian cases, the common factor was direct access to the IP addresses of the refrigerators. Changing a factory default password does not require a billion: what is needed is someone who feels responsible for it. NIS2 assigns this responsibility to senior management.

The second priority is political. Cybersecurity is an indivisible public good, just like border defence: it either protects everyone or it protects no one. Bipartisan solidarity with Tajani is a good start; the next step is a stable agreement amongst the republican forces, starting with the cyber defence bill, without infighting between ministries. Those who attack aim to sow division: a united Parliament is the most cost-effective deterrent there is.

The third point concerns resources. Attackers are already using artificial intelligence to automate reconnaissance and phishing; to forgo this would be tantamount to unilateral disarmament. The best course of action is to utilise the full allocation of Safe funds available, earmarking a portion for cyber defence. In the meantime, the vouchers from the Ministry of Enterprise – 150 million for SMEs and the self-employed – should also be directed towards the security of connected systems. And the state should only purchase equipment that complies with the Cyber Resilience Act: it is public demand that regulates supply, at virtually no cost. Hackers rely on two things: fear and division. Unlike funds for cyber security, Italy has plenty of both. It is high time we started cutting back on those.