► To bolster cyber security in one’s nation, cooperation among countries is essential to a greater extent, due to the transnational characteristic of cyberspace.

► Governments now prefer to facilitate ‘development cooperation’ as a new method for pursuing cyber capacity building at the global level. Linking cyber security and development cooperation may seem unfamiliar because these two sub-sectors have different objectives and traditions, one coming from defense policies and the other from development policies. As the number of supply chain attacks has increased, coming from third countries with weak ICT infrastructure and security capabilities, some ‘upstream’ countries have started implementing ODA projects aimed at the promotion of cyber capabilities building (CCB) in developing countries.

► South Korea should take further actions to promote CCB as it is a beneficial tool to reduce cyber risks and foster cyber partnerships with like-minded countries in the global South.

A New Demand for International Cooperation to Counter Cyber Threats

The global community is now facing a growing number of cyber threats. To counter the threats, each government tends to respond to cyber risks in its own way. Unlike typical cyber-attacks that normally require bilateral measures and responses, ‘cyber-attacks through a third country’ are something far less manageable and preventable for individual countries. With such roundabout attacks increasing, the risks and resulting damages are more likely to spread from countries with inadequate cyber infrastructure to others that share networks. To bolster cyber security in one’s nation, cooperation among countries is essential to a greater extent, due to the transnational characteristic of cyberspace.

The management of cyber risks through international cooperation is an emerging norm. An EU report (2021),[1] titled “Cyber Capacity Building: Global Trends and Scenarios,” highlights that cyber power countries and international organizations are fast recognizing the importance and necessity of collective-global responses. Governments now prefer to facilitate ‘development cooperation’ as a new method for pursuing cyber capacity building at the global level, as stated in the document. Development cooperation refers to a government’s overseas activities for economic and social welfare in developing countries. These activities are funded by ODA (official development assistance), which are public funds. Forging a connection between cyber security and development cooperation is a relatively new concept, and the methods used to do so vary from country to country.

When Cyber Security Meets Development Cooperation

Linking cyber security and development cooperation may seem unfamiliar because these two sub-sectors have different objectives and traditions, one coming from defense policies and the other from development policies. As the number of supply chain attacks has increased, coming from third countries with weak ICT infrastructure and security capabilities, some ‘upstream’ countries have started implementing ODA projects aimed at the promotion of cyber capabilities building (CCB) in developing countries. Even for development policy practitioners in donor governments, CCB is a new agenda that stands apart from other related concepts and ensuing interventions that have been implemented under the label of ‘digital or ICT development.’ Upon its substantial emergence in the 2010s, CCB has incorporated a range of activities (from human resource development, institutional reform, and to organizational adaptation) essential for building a ‘safe, secure, and open’ cyberspace.

The recent increase in the number and scale of these CCB projects may indicate a deliberate strategic choice made by cyber powers today. For the cyber security sector, CCB represents a broadening of their interests and activities that usually concentrated on home-based concerns and responses. CCB-focused ODA projects would be more accessible for partner countries. This is because CCB implementors may be able to take advantage of the trust, networks, and infrastructure that have already been developed by development cooperation actors in nearly all governments in the developing world. Since the impact of CCB projects goes beyond improving cyber security environments and capacities in partner countries, they could address shared interests between donors and recipients.  

Nevertheless, the internal process of how the CCB initiative plays out in a donor-cyber power country could present a significant challenge. More specifically, there are complex and political processes involved in determining the CCB agenda is integrated, prioritized, and implemented within a government’s defense and foreign policy frameworks. It also matters which part of the government is responsible for defining, leading, and managing the initiative. This means that pursuing CCB is not an easy task for its providers, primarily because of its nascency as well as hybridized nature. In that sense, South Korea is a latecomer in this emerging field, despite its national cyber competence and the advanced donorship. For the South Korean government, a major challenge lies with CCB is to establish a good connection between cyber security and development cooperation across various levels of policymaking and implementation.

Case of the U.K.

Among others, the United Kingdom (U.K.) is the case where the link between cyber security and development cooperation appears relatively well defined. Having a strong cyber presence but facing great cyber risks, the nation has come to understand the importance of international cooperation in enhancing cyber security.

Lessons for South Korea

First, it is necessary to lay a legal-institutional foundation for promoting CCB at the strategic and policy levels. Second, in order to ensure a successful integration and strategization of CCB into the national security papers, a suitable governance must be established to foster the connections and collaborations across the sub-sectors of diplomacy, defense, and development, specifically including that between cyber security and development cooperation. Third, selecting a group of countries that are strategically important for South Korea’s cyber security cooperation could also be helpful. Fourth, in addition to bilateral CCB cooperation, South Korea will be able to take the lead in promoting the CCB agenda on a regional level through various schemes of triangular cooperation or multilateral cooperation. Fifth, South Korea should develop a specific evaluation methodology to determine the need for projects and prioritize resource allocation.