The workshop took a solution-oriented approach to cyber-attacks on the healthcare sector since the start of the pandemic. The sharp increase in the number of cyber incidents against hospitals, research labs, vaccination centers, as documented in the Cyber Incident Tracer,  has resulted in serious disruption to the provision of healthcare, causing direct harms to our individual and collective well-being. The panelists reflected on possible responses to address this crisis, from the perspective of the stakeholder group they were representing. 

Healthcare sector perspective (Brazil)

Based on the case of Brazil and the state of public healthcare, inequality is an important topic to address.

There has been a change in mentality and cybersecurity is now approached at the systemic level and it is important for the entire healthcare sector.

Technical part, as well as human operation, are essential. There is a need to develop digital operations strategies based on cyber security and also on training people on properly use these technologies.

What options are on the table in Brazil?

1. Healthcare sector as a whole is not organized to propose collective solutions
2. Issues at the individual level at hospitals and companies are being discussed, it is however deficiency at this moment to not have an articulated action so that healthcare sector is more protected 
3. If we are going to manage the network and groups of discussions to organize collective action, regulations are not enough, there is a need for a culture of inner preservation and communication technology operators need to be aware of data protection.

Private sector perspective (global):

Since the start of the pandemic we’ve learned just how vulnerable the healthcare sector is to cyberattacks.

Healthcare protection is a national issue and it is difficult to address at a global scale, since all countries are different and approach it differently. This is why it is important to see how different regions address this issue. Regardless, healthcare protection should not be about how much money you can put into it.

How to ensure effective efforts:

1. Find practical solutions and start with small steps
2. Bring more attention to the global level on how cyber norms need to be addressed, how we can protect the ICT supply chain in working within the UN structure
3. Find the right partners to deliver results

Private sector can and is currently bringing together policy makers, NGOs, and legal experts to discuss how the healthcare sector can be better protected by applying international law

and what the gaps are.   Initiatives like the Oxford Process, Paris Call etc. help to raise awareness on actions that need to be taken on cyber security

4. Consider how AI for health can empower different organizations to address the challenges in global health (working with researchers)

Government perspective

Currently there are 3 major areas where we are falling short:

1. There is a lack of concrete support for the implementation of commitments already made at the UN level (need to mobilize political will; create an inclusive platform at the UN level to have more crossover debates with industry, civil society and technical experts, etc.)
2. Inability to recognize fully the applicability of international law in cyberspace (need to have a conversation about specific cases and what we need to implement international law in reality)
3. Bridging digital gaps in developing countries and cyber capacity building (digitalization to go hand-in-hand with cyber resilience; in the UN system, think about how to add cyber security and cyber resilience component to the existing projects so that we are not digitalizing and creating new vulnerabilities)

What the government (and diplomats in particular) can do:

1. Build bridges
2. Empower the right voices, for example by emphasizing the victim perspective
3. Bring the right people to the room (need to have technical specialists, people from industry to debate these issues and come to solutions together)
4. Further discuss standards in cyberspace, for example security by design (these discussions are ongoing and sensitive).

Civil society perspective

2 things missing in the current efforts:

1. Access to healthcare is a fundamental human right. Motivation to protect healthcare should therefore be looked at from this perspective (understanding the human impact on the individuals in the attacks on healthcare, because it is an important motivator for the collective action and thinking about accountability; understand how these issues impact individuals and try to measure and understand it
2. Making the collective protection of healthcare a priority (collective action also means starting with the political attribution of attacks on healthcare). There is a need for governments, industry and law enforcement to work together; need to elevate the attacks to the level where other national security issues are put.

What civil society can do:

1. Bring perspectives of the victims to the discussion, share it with policy makers so that they can make informed decisions about how these things impact individuals
2. Reach out to other civil society organizations around the world and help them to be part of this conversation
3. Work on concerted diplomacy and bring together law enforcement, industry, and civil society into these conversations
4. Foster a concrete and actionable conversation at the global level (understand what is the concrete goal to achieve and what are actionable recommendations)

The multistakeholder actors in this workshop agree that the healthcare sector is extremely vulnerable and it will continue to be attacked despite many efforts by government, private sector, and civil society. The best way to tackle this problem is collectively, as all actors can learn from each other about the best approaches to better secure the healthcare sector.