- Introduction of mandatory reporting of cyber attacks would improve the database, raise awareness and increase deterrence against cyber criminals.
- Federal Council to review models by summer 2019; reporting obligation must be administratively justifiable and offer positive incentives and support
Interpellation Paganini (18.3562): Cybercrime. MELANI Mandatory reporting
Submitted text
Cybercrime is becoming an ever greater problem for private individuals and especially for companies. According to the latest figures 88 percent of companies fall victim to cyber attacks every year. The voluntary reporting option to MELANI, the Federal Reporting and Analysis Center for Information Assurance, is not used by many victims: A company does not want to admit that it has been the victim of a cyberattack for fear of possible damage to its reputation; the attack was not considered important enough; or the company is even urged by the attacker not to report the attack under threat of further damage. Failure to report, however, can become a problem for cybercrime response. It underestimates the scope of the problem – not only the number of attacks, but also the prevalence of certain attack methods.
The Introduction of mandatory reporting, at least for companies, would not only lead to the collection of sufficient data in the cyber risk area. It would also make it possible to strengthen awareness among the population and companies and exert a certain deterrent effect on cyber criminals. The Federal Council wants to explore the possibility of a reporting obligation as part of the National Strategy for the Protection of Switzerland against Cyber Risks (NCS) 2018 – 2022 review. I would ask the Federal Council to answer the following questions:
1. by when will the option of mandatory reporting of cyber attacks be examined? In what framework will it present the results of this examination and take the decision to introduce the reporting obligation or not?
2. to what extent does it take the negative effects of increased bureaucracy for companies into account when considering a reporting obligation?
3. Have there been any data protection concerns from companies or even data leaks from reported attacks in the past with the voluntary reporting requirement?
4. if no reporting obligation is introduced, is he already thinking about how the incentives for companies to report cyber attacks could be increased?
5. to what extent does today’s sparse data hinder improvements in cybersecurity?
Statement of the Federal Council of 29.8.18
The Federal Council shares the view that a reporting obligation for cyber attacks of all kinds can increase awareness of the risks and thus strengthen Switzerland’s protection against cyber risks. However, experience from abroad shows that a reporting obligation only has the desired effect if the Effort for the reporting companies justifiable is and when a Message with positive incentives is connected. The Federal Council answers the questions as follows:
1. Following the adoption of the National Strategy for the Protection of Switzerland against Cyber Risks for 2018 – 2022, clarifications on the introduction of a reporting obligation have begun. The aim is to, to develop basic principles by the summer of 2019which enable a decision in principle to be taken on the introduction of a reporting obligation. Parliament is given the opportunity to make a decision within the framework of the fulfillment of the Po. 17.3475 Graf-Litscher reported.
2 The Federal Council is aware that a certain administrative burden for companies cannot be avoided if a reporting obligation is introduced. It takes this into account when weighing up the advantages and disadvantages of a reporting obligation and when examining various models for its possible implementation.
3. there is no evidence that the reporting of attacks at MELANI has ever been affected by a data leak. Whether data protection concerns lead to no reporting can not be said with certainty. However, MELANI has been able to build a relationship of trust with and among the companies participating in its network. A survey in 2015 among the members of MELANI’s closed customer circle, which Operators of critical infrastructures reserved, confirmed this. These companies also have a “non-disclosure” agreement with MELANI which regulates the handling of shared information.
4. experience shows that the strongest incentives for reporting an incident are the Offer of assistance in coping with of the incident, the possibility of anonymized information exchange with other affected parties if required, and access to the network of national and international security experts. These incentives work very well in the existing model with a limited group of participants. MELANI is working on models that should make it possible to maintain these strengths even with an expanded clientele.
5 Thanks to the reports from the closed customer base and MELANI’s national and international network, the data situation is sufficient today for a solid and up-to-date assessment of the situation in the cyber area. More data would allow more precise analyses and it can be assumed that a reporting obligation would increase the sensitivity to cyber risks.