The alarming spread of the global COVID-19 pandemic—now infecting nearly 19 million and claiming more than 700,000 lives worldwide—has made it increasingly urgent to define international law protections for the health care sector against malicious cyber operations.
In May 2020, malicious cyberattacks on organizations at the frontline of the response to the COVID-19 pandemic—including the World Health Organization, medical providers, research institutes, pharmaceutical manufacturers, hospitals and hospital networks—triggered a two-day virtual workshop at the University of Oxford. That workshop—co-sponsored by the Oxford Institute for Ethics, Law and Armed Conflict (ELAC) at the Blavatnik School of Government, Microsoft, and the Government of Japan—yielded the first Oxford Statement on the International Law Protections against Cyber Operations Targeting the Health-Care Sector. More than 130 international lawyers from across the globe (including some of the field’s most experienced and accomplished figures) have become signatories to this Statement. It articulated a short list of consensus protections that apply under existing international law to cyber operations targeting the healthcare sector. Its announcement sparked discussion at a May 2020 Arria-Formula meeting of the U.N. Security Council on Cyber Stability, Conflict Prevention and Capacity Building.
As the pandemic continues to unfold, vaccine research has emerged as a new, critical vulnerability. Last month, the United Kingdom, the United States (US) and Canada issued a joint advisory accusing Russian intelligence services of targeting COVID-19 vaccine development “with the intention of stealing information and intellectual property.” A few days after, the US Department of Justice unsealed an indictment accusing individuals linked to China’s Ministry of State Security of hacking entities working on COVID-19 treatments, tests, and vaccines. International law must protect this research from external interference to ensure that a safe, effective and universally available vaccine can reach afflicted, needy populations in the near future.
This urgency led Oxford’s ELAC to host a second virtual workshop on July 31, 2020, again co-sponsored with Microsoft and the Government of Japan, to hear from vaccine researchers and information security experts about the special challenges of protecting vaccine research from cyber-intrusion. Those experts explained that cyberattacks or intrusions into ongoing Phase III clinical trial research, for example, could corrupt or tamper with the relevant data needed to establish a vaccine candidate’s efficacy, leading to the trial’s failure, and the loss of time and lives in the fight against COVID-19.
The workshop clarified both the cyber protections needed by vaccine research, and how international law applies to the protection of the development, testing, manufacture, and distribution of a COVID-19 vaccine. That discussion has now led to The Second Oxford Statement on International Law Protections of the Healthcare Sector During Covid-19: Safeguarding Vaccine Research.
Once again, the aim of the Second Oxford Statement is not to cover all applicable principles of international law but, rather, to articulate a short list of consensus protections that apply under existing international law to malicious cyber operations targeting vital vaccines. The Oxford Statement was opened, and remains open, for signature by international law scholars, with hopes that it will spur discussion and clarification of the international legal framework in this area. It is part of an ongoing “Oxford Process”, which aims to articulate points of consensus on international legal rules with respect to urgent global problems, ranging from cyberattacks on the healthcare sector to election security.
Global crises create unique opportunities for international lawmaking. There is no better moment to make explicit and unambiguous—in real and virtual space, in times of war and peace—that when a global pandemic rages, international law must protect the means to ending it. Why does international law exist, if not to save innocent people from needless death?