Proposed activity VII (also referred to as CBM#4): Awareness raising

Background: Using the WannaCry ransomware campaign298 as an example, the concept paper emphasized the importance of cooperation at bilateral, regional, and international levels to effectively respond to ICT security incidents. Attribution challenges make this cooperation particularly critical, as uncertainty can heighten the risk of misperception and escalation. This measure therefore focuses on strengthening cooperation and coordination in research among ARF participating states in raising awareness, sharing information, and ensuring timely and appropriate responses to ICT-related incidents.299 It contributes to the priority area “Awareness Building and Exchange of Best Practices.”

Practice: China first introduced this measure in 2018 through a concept paper, later joined by Cambodia and Singapore. Cooperation was envisioned through cross-border workshops bringing together diplomats, policymakers, law enforcement, technical experts, and academics, as well as tailored public-awareness campaigns adapted to each state’s social, economic, and cultural context. Participating states were encouraged to exchange expertise among relevant agencies and provide technical training to less-developed ARF members. In parallel, voluntary information sharing was to be facilitated through designated PoCs, common categories and formats for data exchange, and potentially an ARF information-sharing platform to identify needs, circulate lessons learned, and support long-term cooperation.300 This approach links closely to the PoC Directory described under activity X and also overlaps with activity V of the ARF Work Plan, which highlights the importance of joint research.

To date, measures regarding this activity were implemented, but not widely. One workshop was held in Malaysia in 2020, attended by 45 participants from 15 ARF participating states. Discussions covered ICT incident response, awareness raising, best practices, and international cooperation.301

• ARF members agreed to promote awareness and cooperation on ICT incident response through workshops, exchanges of expertise, and discussions on international cooperation and best practices.