A healthy civic space is vital for an enabling business environment. In recognition of this, a growing number of private sector actors are challenging, publicly or otherwise, the deteriorating environment for civic freedoms.

However, this corporate activism is often limited and largely ad hoc. It remains confined to a small cluster of multinationals leaving potential routes for effective coordination and collaboration with other actors underexplored.

This roundtable will bring together a diverse and international group of business actors, civil society actors and foreign policy experts to exchange perspectives and experiences on how the private sector can be involved in issues around civic space. The meeting will provide an opportunity to explore the drivers of – and barriers to – corporate activism, develop a better understanding of existing initiatives, identify good practice and discuss practical strategies for the business community.

This meeting will be the first of a series of roundtables at Chatham House in support of initiatives to build broad alliances for the protection of civic space. 

Attendance at this event is by invitation only. 

PLEASE NOTE THIS EVENT IS POSTPONED UNTIL FURTHER NOTICE. 

The World Health Organization, US Department of Health and Human Services, and hospitals in Spain, France and the Czech Republic have all suffered cyberattacks during the ongoing COVID-19 crisis.

In the Czech Republic, a successful attack targeted a hospital with one of the country’s biggest COVID-19 testing laboratories, forcing its entire IT network to shut down, urgent surgical operations to be rescheduled, and patients to be moved to nearby hospitals. The attack also delayed dozens of COVID-19 test results and affected the hospital’s data transfer and storage, affecting the healthcare the hospital could provide.

In the UK, the National Health Service (NHS) is already in crisis mode, focused on providing beds and ventilators to respond to one of the largest peacetime threats ever faced. But supporting the health sector goes beyond increasing human resources and equipment capacity.

Health services ill-prepared

Cybersecurity support, both at organizational and individual level, is critical so health professionals can carry on saving lives, safely and securely. Yet this support is currently missing and the health services may be ill-prepared to deal with the aftermath of potential cyberattacks.

When the NHS was hit by the Wannacry ransomware attack in 2017 - one of the largest cyberattacks the UK has witnessed to date – it caused massive disruption, with at least 80 of the 236 trusts across England affected and thousands of appointments and operations cancelled. Fortunately, a ‘kill-switch’ activated by a cybersecurity researcher quickly brought it to a halt.

But the UK’s National Cyber Security Centre (NCSC), has been warning for some time against a cyber attack targeting national critical infrastructure sectors, including the health sector. A similar attack, known as category one (C1) attack, could cripple the UK with devastating consequences. It could happen and we should be prepared.

Although the NHS has taken measures since Wannacry to improve cybersecurity, its enormous IT networks, legacy equipment and the overlap between the operational and information technology (OT/IT) does mean mitigating current potential threats are beyond its ability.

And the threats have radically increased. More NHS staff with access to critical systems and patient health records are increasingly working remotely. The NHS has also extended its physical presence with new premises, such as the Nightingale hospital, potentially the largest temporary hospital in the world.

Radical change frequently means proper cybersecurity protocols are not put in place. Even existing cybersecurity processes had to be side-stepped because of the outbreak, such as the decision by NHS Digital to delay its annual cybersecurity audit until September. During this audit, health and care organizations submit data security and protection toolkits to regulators setting out their cybersecurity and cyber resilience levels.

The decision to delay was made to allow the NHS organizations to focus capacity on responding to COVID-19, but cybersecurity was highlighted as a high risk, and the importance of NHS and Social Care remaining resilient to cyberattacks was stressed.

The NHS is stretched to breaking point. Expecting it to be on top of its cybersecurity during these exceptionally challenging times is unrealistic, and could actually add to the existing risk.

Now is the time where new partnerships and support models should be emerging to support the NHS and help build its resilience. Now is the time where innovative public-private partnerships on cybersecurity should be formed.

Similar to the economic package from the UK chancellor and innovative thinking on ventilator production, the government should oversee a scheme calling on the large cybersecurity capacity within the private sector to step in and assist the NHS. This support can be delivered in many different ways, but it must be mobilized swiftly.

The NCSC for instance has led the formation of the Cyber Security Information Sharing Partnership (CiSP)— a joint industry and UK government initiative to exchange cyber threat information confidentially in real time with the aim of reducing the impact of cyberattacks on UK businesses.

CiSP comprises organizations vetted by NCSC which go through a membership process before being able to join. These members could conduct cybersecurity assessment and penetration testing for NHS organizations, retrospectively assisting in implementing key security controls which may have been overlooked.

They can also help by making sure NHS remote access systems are fully patched and advising on sensible security systems and approved solutions. They can identify critical OT and legacy systems and advise on their security.

The NCSC should continue working with the NHS to enhance provision of public comprehensive guidance on cyber defence and response to potential attack. This would show they are on top of the situation, projecting confidence and reassurance.

It is often said in every crisis lies an opportunity. This is an opportunity for the UK government to show agility in how it deals with cyber threats and how it cooperates with the private sector in creating cyber resilience.

It is an opportunity to lead a much-needed cultural change showing cybersecurity should never be an afterthought.

Linked to the call for a global response to the Covid-19 pandemic that I, Robin Niblett and Creon Butler have outlined, the case for a specific dramatic economic policy gesture from many policymakers in large economies is prescient.

It may not be warranted from all G20 nations, although given the uncertainties, and the desire to show collective initiative, I think it should be G20 driven and inclusive.

We need some sort of income support for all our citizens, whether employees or employers. Perhaps one might call it a truly People’s QE (quantitative easing).

Against the background of the previous economic crisis from 2008, and the apparent difficulties that more traditional forms of economic stimulus have faced in trying to help their economies and their people - especially against a background of low wage growth, and both actual, and perception of rising inequality - other ideas have emerged.

Central banks printing money

Both modern monetary theory (MMT) and universal basic income (UBI) essentially owe their roots to the judgement that conventional economic policies have not been helping.

At the core of these views is the notion of giving money to people, especially lower income people, directly paid for by our central banks printing money. Until recently, I found myself having very little sympathy with these views but, as a result of COVID-19, I have changed my mind.

This crisis is extraordinary in so far as it is both a colossal demand shock and an even bigger colossal supply shock. The crisis epicentre has shifted from China - and perhaps the rest of Asia - to Europe and the United States. We cannot expect policies, however unconventional by modern times, such as the dramatic monetary steps announced by the Federal Reserve Board and others like it, to put a floor under this crisis.

We are consciously asking our people to stop going out, stop travelling, not go to their offices - in essence, curtailing all forms of normal economic life. The only ones not impacted are those who entirely work through cyberspace. But even they have to buy some forms of consumer goods such as food and, even if they order online, someone has to deliver it.

As a result, markets are, correctly, worrying about a collapse of economic activity and, with it, a collapse of companies, not just their earnings. Expansion of central bank balance sheets is not going to do anything to help that, unless it is just banks we are again worried about saving.

What is needed in current circumstances, are steps to make each of us believe with high confidence that, if we take the advice from our medical experts, especially if we self-isolate and deliberately restrict our personal incomes, then we will have this made good by our governments. In essence, we need smart, persuasive People’s QE.

Having discussed the idea with a couple of economic experts, there are considerable difficulties with moving beyond the simple concept. In the US for example, I believe the Federal Reserve is legally constrained from pursuing a direct transfer of cash to individuals or companies, and this may be true elsewhere.

But this is easily surmounted by fiscal authorities issuing a special bond, the proceeds of which could be transferred to individuals and business owners. And central banks could easily finance such bonds.

It is also the case that such a step would encroach on the perception and actuality of central bank independence, but I would be among those that argue central banks can only operate this independence if done wisely. Others will argue that, in the spirit of the equality debate, any income support should be targeted towards those on very low incomes, while higher earners or large businesses, shouldn’t be given any, or very little.

I can sympathise with such spirit, but this also ignores the centrality of this particular economic shock. All of our cafes and restaurants, and many of our airlines, and such are at genuine risk of not being able to survive, and these organisations are considerable employers of people on income.

It is also the case that time is of the essence, and we need our policymakers to act as soon as possible, otherwise the transmission mechanisms, including those about the permanent operation of our post World War 2 form of life may be challenged.

We need some kind of smart People’s QE now.

Linked to the call for a global response to the Covid-19 pandemic that I, Robin Niblett and Creon Butler have outlined, the case for a specific dramatic economic policy gesture from many policymakers in large economies is prescient.

It may not be warranted from all G20 nations, although given the uncertainties, and the desire to show collective initiative, I think it should be G20 driven and inclusive.

We need some sort of income support for all our citizens, whether employees or employers. Perhaps one might call it a truly People’s QE (quantitative easing).

Against the background of the previous economic crisis from 2008, and the apparent difficulties that more traditional forms of economic stimulus have faced in trying to help their economies and their people - especially against a background of low wage growth, and both actual, and perception of rising inequality - other ideas have emerged.

Central banks printing money

Both modern monetary theory (MMT) and universal basic income (UBI) essentially owe their roots to the judgement that conventional economic policies have not been helping.

At the core of these views is the notion of giving money to people, especially lower income people, directly paid for by our central banks printing money. Until recently, I found myself having very little sympathy with these views but, as a result of COVID-19, I have changed my mind.

This crisis is extraordinary in so far as it is both a colossal demand shock and an even bigger colossal supply shock. The crisis epicentre has shifted from China - and perhaps the rest of Asia - to Europe and the United States. We cannot expect policies, however unconventional by modern times, such as the dramatic monetary steps announced by the Federal Reserve Board and others like it, to put a floor under this crisis.

We are consciously asking our people to stop going out, stop travelling, not go to their offices - in essence, curtailing all forms of normal economic life. The only ones not impacted are those who entirely work through cyberspace. But even they have to buy some forms of consumer goods such as food and, even if they order online, someone has to deliver it.

As a result, markets are, correctly, worrying about a collapse of economic activity and, with it, a collapse of companies, not just their earnings. Expansion of central bank balance sheets is not going to do anything to help that, unless it is just banks we are again worried about saving.

What is needed in current circumstances, are steps to make each of us believe with high confidence that, if we take the advice from our medical experts, especially if we self-isolate and deliberately restrict our personal incomes, then we will have this made good by our governments. In essence, we need smart, persuasive People’s QE.

Having discussed the idea with a couple of economic experts, there are considerable difficulties with moving beyond the simple concept. In the US for example, I believe the Federal Reserve is legally constrained from pursuing a direct transfer of cash to individuals or companies, and this may be true elsewhere.

But this is easily surmounted by fiscal authorities issuing a special bond, the proceeds of which could be transferred to individuals and business owners. And central banks could easily finance such bonds.

It is also the case that such a step would encroach on the perception and actuality of central bank independence, but I would be among those that argue central banks can only operate this independence if done wisely. Others will argue that, in the spirit of the equality debate, any income support should be targeted towards those on very low incomes, while higher earners or large businesses, shouldn’t be given any, or very little.

I can sympathise with such spirit, but this also ignores the centrality of this particular economic shock. All of our cafes and restaurants, and many of our airlines, and such are at genuine risk of not being able to survive, and these organisations are considerable employers of people on income.

It is also the case that time is of the essence, and we need our policymakers to act as soon as possible, otherwise the transmission mechanisms, including those about the permanent operation of our post World War 2 form of life may be challenged.

We need some kind of smart People’s QE now.

The World Health Organization, US Department of Health and Human Services, and hospitals in Spain, France and the Czech Republic have all suffered cyberattacks during the ongoing COVID-19 crisis.

In the Czech Republic, a successful attack targeted a hospital with one of the country’s biggest COVID-19 testing laboratories, forcing its entire IT network to shut down, urgent surgical operations to be rescheduled, and patients to be moved to nearby hospitals. The attack also delayed dozens of COVID-19 test results and affected the hospital’s data transfer and storage, affecting the healthcare the hospital could provide.

In the UK, the National Health Service (NHS) is already in crisis mode, focused on providing beds and ventilators to respond to one of the largest peacetime threats ever faced. But supporting the health sector goes beyond increasing human resources and equipment capacity.

Health services ill-prepared

Cybersecurity support, both at organizational and individual level, is critical so health professionals can carry on saving lives, safely and securely. Yet this support is currently missing and the health services may be ill-prepared to deal with the aftermath of potential cyberattacks.

When the NHS was hit by the Wannacry ransomware attack in 2017 - one of the largest cyberattacks the UK has witnessed to date – it caused massive disruption, with at least 80 of the 236 trusts across England affected and thousands of appointments and operations cancelled. Fortunately, a ‘kill-switch’ activated by a cybersecurity researcher quickly brought it to a halt.

But the UK’s National Cyber Security Centre (NCSC), has been warning for some time against a cyber attack targeting national critical infrastructure sectors, including the health sector. A similar attack, known as category one (C1) attack, could cripple the UK with devastating consequences. It could happen and we should be prepared.

Although the NHS has taken measures since Wannacry to improve cybersecurity, its enormous IT networks, legacy equipment and the overlap between the operational and information technology (OT/IT) does mean mitigating current potential threats are beyond its ability.

And the threats have radically increased. More NHS staff with access to critical systems and patient health records are increasingly working remotely. The NHS has also extended its physical presence with new premises, such as the Nightingale hospital, potentially the largest temporary hospital in the world.

Radical change frequently means proper cybersecurity protocols are not put in place. Even existing cybersecurity processes had to be side-stepped because of the outbreak, such as the decision by NHS Digital to delay its annual cybersecurity audit until September. During this audit, health and care organizations submit data security and protection toolkits to regulators setting out their cybersecurity and cyber resilience levels.

The decision to delay was made to allow the NHS organizations to focus capacity on responding to COVID-19, but cybersecurity was highlighted as a high risk, and the importance of NHS and Social Care remaining resilient to cyberattacks was stressed.

The NHS is stretched to breaking point. Expecting it to be on top of its cybersecurity during these exceptionally challenging times is unrealistic, and could actually add to the existing risk.

Now is the time where new partnerships and support models should be emerging to support the NHS and help build its resilience. Now is the time where innovative public-private partnerships on cybersecurity should be formed.

Similar to the economic package from the UK chancellor and innovative thinking on ventilator production, the government should oversee a scheme calling on the large cybersecurity capacity within the private sector to step in and assist the NHS. This support can be delivered in many different ways, but it must be mobilized swiftly.

The NCSC for instance has led the formation of the Cyber Security Information Sharing Partnership (CiSP)— a joint industry and UK government initiative to exchange cyber threat information confidentially in real time with the aim of reducing the impact of cyberattacks on UK businesses.

CiSP comprises organizations vetted by NCSC which go through a membership process before being able to join. These members could conduct cybersecurity assessment and penetration testing for NHS organizations, retrospectively assisting in implementing key security controls which may have been overlooked.

They can also help by making sure NHS remote access systems are fully patched and advising on sensible security systems and approved solutions. They can identify critical OT and legacy systems and advise on their security.

The NCSC should continue working with the NHS to enhance provision of public comprehensive guidance on cyber defence and response to potential attack. This would show they are on top of the situation, projecting confidence and reassurance.

It is often said in every crisis lies an opportunity. This is an opportunity for the UK government to show agility in how it deals with cyber threats and how it cooperates with the private sector in creating cyber resilience.

It is an opportunity to lead a much-needed cultural change showing cybersecurity should never be an afterthought.

A healthy civic space is vital for an enabling business environment. In recognition of this, a growing number of private sector actors are challenging, publicly or otherwise, the deteriorating environment for civic freedoms.

However, this corporate activism is often limited and largely ad hoc. It remains confined to a small cluster of multinationals leaving potential routes for effective coordination and collaboration with other actors underexplored.

This roundtable will bring together a diverse and international group of business actors, civil society actors and foreign policy experts to exchange perspectives and experiences on how the private sector can be involved in issues around civic space. The meeting will provide an opportunity to explore the drivers of – and barriers to – corporate activism, develop a better understanding of existing initiatives, identify good practice and discuss practical strategies for the business community.

This meeting will be the first of a series of roundtables at Chatham House in support of initiatives to build broad alliances for the protection of civic space. 

Attendance at this event is by invitation only. 

PLEASE NOTE THIS EVENT IS POSTPONED UNTIL FURTHER NOTICE.