IGF 2017 Reporting Template

Session Title:                      WS #228 Supply Chain Governance and Security for IoT Resilience
 

- Date:                                      8 December 2021               
- Time:                                     11:15am-12:45
- Session Organizers:         Madeline Carr, Pablo Hinojosa, Duncan Hollis, Louise Marie Hurel

- Moderator:                           Madeline Carr
- Online Moderator:            Duncan Hollis            
- Rapporteur:                         Pablo Hinojosa

- List of Speakers and their institutional affiliations:   (in order of participation)

• Madeline Carr, Professor of Global Politics and Cybersecurity, University College London
• Louise Marie Hurel, PhD Researcher, London School of Economics
• Jennifer Tisdale, Senior Principle, GRIMM
• Mitra Mirhassani, Co-Director, SHIELD Automotive Cybersecurity Centre of Excellence, University of Windsor
• Duncan B. Hollis, Laura H. Carnell Professor of Law, Temple University
• Rebecca Crootof, Assistant Professor of Law, University of Richmond
• Tim Davy, Cyber Security Specialist, Munich RE
• Pablo Hinojosa, Strategic Engagement Director, APNIC
• Peter Davies, Technical Director Security Concepts, Thales UK and Chair, Security Workstream, Automotive Electronic Systems Innovation Network (AESIN)
• Ine Steenmans, Lecturer in Futures, Analysis and Policy, University College London

- Key Issues raised (1 sentence per issue):                

• As in past IGF sessions, this roundtable is an effort to improve dialogue between the policy, technical and internet governance communities.
• This year, we involved the insurance sector which has not previously been represented at the IGF.
• We always choose one specific issue around which we can gather and exchange views in an effort to better understand diverse perspectives on a contentious topic.
• This roundtable was an effort to better understand the wide range of implications of supply chain governance and security in the complex, safety critical IoT systems that are increasingly being connected to existing Internet infrastructure.
• We also acknowledged that Internet governance has proven to be remarkably flexible and adaptive, and we asked for views on the extent to which this may provide lessons for governing other complex systems and ecosystems.
• We chose connected autonomous vehicles (CAVs) as the focus for the roundtable because it represents a sufficiently complex, high value example that is close to implementation.
• One of the key issues raised was that CAVs introduce a new dimension of cybersecurity from those we have focused on in the past – physical security – with the real potential for harmful consequences for failures, including loss of life.
• This led to discussion of lines of responsibility, the assignment of risk, liability, and accountability – which stakeholders are / can be / should be responsible for ensuring that internet infrastructure is governed in such a way as to accommodate new uses?
• A key question emerged as to whether the Internet we have now is the Internet we will need in the future.
• One of the clear messages to emerge was the need for an expanded group of stakeholders to join in Internet governance deliberations including those in the automotive sector, the insurance sector, and hardware manufacturers.
• At the same time, there was recognition from within the automotive sector of the benefits of further engagement with internet governance models in approaching questions of CAV security
• There was a presentation on the extensive vulnerabilities in this supply chain and the real challenges around identifying, detecting, and reducing them.
• From a legal and insurance perspective, there was a view that these challenges with governing and securing systems are leading to humans in the loop being constructed as ‘liability sponges’.

- If there were presentations during the session, please provide a 1-paragraph summary for each presentation:                 

n/a
- Please describe the Discussions that took place during the workshop session (3 paragraphs):     

• Existing problems, standards, regulations and coordinating initiatives were outlined by sector and legal participants. But the acknowledgement that we face a ‘governance gap’ in this context led to a discussion about what other accountability structures might incentivize the change needed to ensure we are able to fully implement CAVs and other similar systems with Internet architecture in a safe, secure manner.
• Much of the discussion incorporated conflicts between existing approaches to governing cybersecurity and expectations of consumer protection that shape the CAVs ecosystem. One stakeholder’s ‘fix’ can be another’s ‘problem’. For example, it was pointed out that while information sharing is often suggested as a remedy to cybersecurity challenges, competition law precludes that. In addition, it is very unclear what would constitute ‘evidence’ in a court of law in case of automotive accidents resulting from Internet governance issues.

- Please describe any Participant suggestions regarding the way forward/ potential next steps /key takeaways (3 paragraphs):    

• There was a consistent plea for nimble, proactive policy intervention – all participants agreed that in the absence of market drivers for addressing this, other mechanisms are required. However, doing so across (or even within) jurisdictions is extremely complicated and problematic. Reflecting innovation in public policy, Dr Steenmans recommended the IGF may be a useful forum for actively and collectively reconsidering how the problem is defined, how this challenge can be conceptualised in a sufficiently long timeframe, and how the interests and perspectives of the wide range of stakeholders can be better integrated and reconciled or aligned.
• Professor Hollis observed that there was a strong tradition of mapping in Internet governance – on both technical and policy issues. He recommended that future steps for this group could usefully include an examination of how to take this same model into the automotive / autonomous systems regime complex and think about boundaries and intersections of different sources of standards, guidance, and regulation, (both informal and formal) to see where there were overlaps and gaps in terms of governing the Internet for safety critical, cyber-physical systems.
• The supply chain of connected autonomous vehicles is a hugely complex arena and one that we can only begin to explore through this workshop. Essentially, we urgently need to think creatively about how to link systems like this to an Internet that was not designed to accommodate them. The insurance sector will continue to be an important source of expertise and insight into this problem. Better integrating this sector into the IGF will help with risk analysis and evaluation. The observation was made that if the insurance sector struggles to find a market in CAVs, then governments may have to provide a backstop of cover and this will be an area that the IGF will be well placed to contribute.

 Gender Reporting

- Estimate the overall number of the participants present at the session:

Around 40 pax.

- Estimate the overall number of women present at the session:

25 pax.

- To what extent did the session discuss gender equality and/or women’s empowerment? 

The list of speakers was diverse in terms of gender, stakeholder group and geographic representation.

- If the session addressed issues related to gender equality and/or women’s empowerment, please provide a brief summary of the discussion:

The list of speakers was diverse in terms of gender, stakeholder group and geographic representation.