Government resilience in the digital age

Adopt a digital-first approach to critical public services and registries

Key recommendations:

→ Identify which services and registries are critical for the long-term continuity of both the state and the nation in various state of emergency scenarios.

→ Implement a policy that requires the digital transformation of public services deemed vital for the state’s long-term continuity.

→ Adopt a policy that prioritizes the development of digital-first services and assets, ensuring compliance with established security standards and requirements.

Transition to remote-first and remote-enabled public sector jobs

Adopting a digital-first approach to public service delivery will help to free up human resources as services become more efficient, automatic, or proactive but there will still be a need for public servants to ensure that systems remain operational and secure. For public servants working with critical services, during a time of crisis it is even more important that they can do their job. However, it is also likely that they too will be impacted during a crisis or state of emergency and their ability to operate from a physical office may not be possible.

The solution is to enable public sector workers connected to the operation of critical services the ability to work fully remotely. There are three primary considerations to consider when adopting a remote-first approach to the public sector workforce:

1. The transition of work to secure digital channels.

2. Ensure the internal systems, software and infrastructure are universally available and accessible remotely.

3. The establishment of new, remotefriendly digital internal decision-making, leadership, processes, and audit trails.

These changes are hard to do but are also a key component of ensuring the long-term resilience of the digital state.

Usually, digitalizing a service or its infrastructure is the easiest part of the solution. Instead,

Often organizations rely on paper or some key assets that can only be accessed locally, limiting opportunities for change and remote operations.

To overcome this challenge, it is possible to develop a model that differentiates between “remote-first” and “remote-enabled” jobs in the public sector. Remote-first jobs are those where it would be mandatory to be capable of working long-term remotely, with all organizational processes and systems supporting this. Remote-enabled jobs are those that could be required to work remotely under specific constraints, such as having flexibility toward the equipment needs and physical workplace.

It is not enough to have remote workforce policies or strategies in place, but these changes must be followed. By enabling remote operations of the digital state defacto, it will help to build resilience in the event of a disruptive crisis. This readiness can be further increased by running crisis exercises. These exercises involve creating a controlled environment for simulating the conditions of a crisis, testing whether the developed remote working operations operate as anticipated.

Key recommendations:

→ Identify public authorities and positions related to critical services for the continuity of the state and develop a categorization for jobs that should be remote-first or remote-enabled.

→ Identify infrastructure and systems not accessible from a remote-first perspective.

→ Establish a long-term IT and organizational strategy to shift to remote-first and remoteenabled jobs.

→ Create an independent unit responsible for assessing organizational barriers to the remotefirst transition and running annual or quarterly exercises that test an organization’s ability to operate under remote working conditions.

Secure digital public infrastructure and services

In the digital age, the notion of conflict has changed. Cyberattacks are a daily occurrence and an unavoidable part of the world’s new digital reality. As states continue to digitalize, it is essential that cyber security and the protection of digital infrastructure is made a priority. Estonia has been on both sides of this new reality. In 2007, Estonia suffered one of the first national scale cyberattacks in the world. As a result, Estonia implemented new laws and regulations, developed standards, and devoted large amounts of resources into improving their cyber defense capabilities. In the years that have passed, Estonia has managed to successfully defend against numerous massive cyberattacks without significant disruption to its digital society. In most cases, Estonian residents do not even know such events have taken place.

However, this threat will always be present. As much of a state’s critical infrastructure has become digital – even physical infrastructure, such as power plants or hospitals – cyber defense must be a national priority. Over the past decades, it has become increasingly clear that while it is possible to build walls around systems, and strongly defend them, if an attacker is significantly resourced and motivated, they will find a way to infiltrate their target’s systems.

Investments in cybersecurity cannot be made post-factum they must be implemented from inception.

Ultimately, the long-term best practice is to develop a set of principles for the digital state that (when complied with) significantly increase the cost and time for an attack to be successful. Additionally, as threats are constantly evolving, the countermeasures must too. Digital states must assess and leverage modern solutions and tools to actively monitor, analyze, and respond to cyber incidents, including the use of cloud-based threat intelligence, machine learning, and artificial intelligence for pattern recognition. Gathered threat intelligence must be shared real-time through collaborative platforms across the state and internationally by like-minded nations to enhance its ability to respond and coordinate effectively.

In addition to external threats, countries must also secure the digital state from internal threats. Data integrity must be made a priority so that not even the people guarding or maintaining data for the state are able to change it without a trace being left. The Estonian government started using technologies such as blockchain to assure critical registries cannot be tampered with [22].

Getting this ecosystem right, with cybersecurity at the forefront, will require a digital state to build up its national and institutional cyber capabilities. By creating a community of collaboration between regulators, service providers, research organizations, universities, and companies it is possible to help develop this expertise.

Key recommendations:

→ Mandate nationwide adherence to cybersecurity standards and industry best practices while considering nation-wide risk scenarios and enforcing minimum security measures accordingly.

→ Assign a security and criticality classification to information systems and map the crossdependencies of those systems. Prioritize the continuity of the systems with highest impact.

→ Consolidate the monitoring and analysis of cyber incidents to a centralized body for government wide situational awarenesses and rapid mitigation and response of the incidents.

→ Ensure that there is a sustainable and continuous budget for investment in cybersecurity to reduce the risk in the fast-paced threat environment. Our recommendation is to spend at least 10% of IT-budget to cybersecurity.

→ Enhance national and institutional capabilities in the domain of cybersecurity. Strengthen collaboration with research institutions and reliable partners to continually refine and update protective standards, thereby effectively addressing emerging and future threats.

→ Appoint an organization that is responsible for cybersecurity within the country with executive power for all abovementioned points.

Ensure widespread affordable access and redundancy to connectivity

Any loss of connectivity during a crisis implies that people are effectively cut off from the state and its services. In today’s digital age, access to the internet is as crucial for people as access to basic infrastructure and amenities.

Several countries – such as Finland and Estonia – have implemented policies that declare connectivity as a basic infrastructure need (or even as a human right) and having declared it a national priority to provide every citizen with broadband access. These countries also show good correlation between connectivity and general level of digitalization.

Connectivity must, therefore, be both widespread and resilient, resistant to tampering and adversarial interference. States must aim to improve access and coverage to the internet across their territory and, where possible, create free public access points such as in schools, libraries, and other key locations.

Countries can create incentives, subsidies, tax exceptions, license-free breaks, etc., for new telecommunications companies entering the local market to increase competition.

With widespread and affordable broadband, states can even consider providing a limited free 4G/5G option that can only be utilized to access select services (news, public services, etc.), with the rationale of shifting costs from helpdesks and front offices to digital services.

Building redundancy in connectivity is critical to assure resilience in crisis situations. During times of conflict, the infrastructure of the internet itself may be called into question, and undersea cables are vulnerable to sabotage and destruction. States must consider this and invest, where possible, into new and emerging communication technologies. For example, this may include adopting satellite communication programs that help overcome disruptions to traditional internet connectivity methods.

To further increase resilience during crises, interoperability should be forced to network providers through regulation. Cross-border interoperability further enhances resilience. The state would assure the required agreements between the telecommunication providers. This approach has been best exemplified by Ukraine. Shortly days after the Russian invasion began in Ukraine in 2022, the country’s three main cellular operators activated a free roaming service between their respective networks [23]. If a user’s mobile network signal becomes unavailable, they are advised to try one of the other two providers.

Key recommendations:

Establish a government function (e.g. National Connectivity Board) with direct mandate for:

→ Assure that affordable connectivity options exist for everybody. Consider having connectivity as a form of “human right”.

→ Conduct risk analysis on existing national connectivity options and introduce strategic diversification of connectivity types.

→ Exercise national digital infrastructure continuity in reduced connectivity scenarios. Implement rigorous testing protocols to ensure that critical systems remain operational during network disruptions.

→ Lower the cost of connectivity either through subsidies and incentives for new telecommunication providers or through direct benefits to end-users.

→ Create interoperability between telecommunication providers.

Build redundancy to digital public infrastructure

The extent to which modern societies rely on digital registries and public digital infrastructure is enormous. Most government databases are digital and, in the case of nations such as Estonia, so are almost all public services. Destruction or hostile control of just a few key critical registries or infrastructure facilities hosting them could send a government into turmoil.

A key weakness of digital states is that, fundamentally, their digital data and assets are based on territory in the physical world. If the location of these data are known then this location can be damaged or destroyed and if backups are not available this could deny a state the ability to provide critical services. Imagining a severe scenario, the resulting crisis could even damage the perceived legitimacy of the state itself. Additionally, in the case that key digital registries fall into the hands of an adversary, they could severely disrupt the state’s data assets by deleting individuals or companies from registers, changing property rights, or altering the state’s finances.

For this reason, several governments have sought to establish a Plan B to prepare for a potentially catastrophic scenario where public data necessary for the state’s continuity and legitimacy can neither be tampered with nor destroyed in any circumstance.

One well-known solution for this is the Estonian Data Embassy [24], where key government registries and digital assets are backed up and stored on the territory of another sovereign country. In the case of a catastrophe, the data stored in the Data Embassy can be utilized to restore the legitimate state of governance and assure that tampering has not occurred. When initially conceptualized, this strategy was logical. There were fewer systems, the dependencies were manageable, and the amount of data was significantly lower. More importantly, however, the perception of threat was short-term. It was assumed that a crisis would last a short time – days, weeks, or months perhaps, but not years. It is now clear that this thinking was optimistic.

Today, digital systems are highly interconnected and complex, and any longterm solution would need to be capable of not only backing up data and systems to a sovereign territory but also operating them from there (or at least from other locations in the country).

This solution would allow for the duplication of a sovereign cloud onto foreign territory and, if necessary, allow for a foreign digital state to operate its digital services from it.

The war in Ukraine has highlighted the practical need for such a solution. When Kyiv was partially encircled in 2022, it became evident that Ukraine would face a dire situation if it lost access to is key digital registries. Following the Estonian Data Embassy model, efforts were made to break out of the capital and move entire data centres into friendly countries for safekeeping and backup operations [25]. Soon, large cloud providers also followed, and by today it can be said that Ukraine’s digital continuity is assured by NATO countries and companies operating in NATO territories.

This transition toward building a resilient and dynamic cloud environment will not be an easy task. States should start by prioritizing the transition to local or international clouds for critical public services and infrastructure first. This change will require broad legislative and regulatory support, from removing obstacles in the existing legislation to creating capabilities, particularly in terms of international cooperation.

Key recommendations:

→ Establish national information system standards that mandates critical public services and infrastructure to become cloud-compatible over a specific time span. The standard shall establish mandatory requirements for all government system procurements and internal developments.

→ Assess the existing critical public services and infrastructure to identify gaps blocking the transition.

→ Work with multinational partners and regulators on assuring control and trust over cloud services.

→ Establish a national body (such as National Cloud Governance Centre) which would act as a single point of resource for cloud infrastructure, managing the market research, risk management, procurement, adoption, interoperability and minimum-security requirements for the entire government and providing incentives for all authorities for the transition.

Manage third-party risk while preserving technological innovation

As the digital world is both globalizing and consolidating, third-party risk management is becoming a strategically critical capability. As much of the world’s technology stack relies on third-party components, a compromise to any part of the supply or dependency chain can cause significant damage. Only by assuring the safety and compliance of the entire chain in its depth, could the results be deemed safe. One recent example of a successful supply chain attack was the compromise of SolarWinds, significantly impacting the national security of the United States [26].

Managing third-party risk is hard, and it will get harder. It will require states to be able to make strategic choices about the software and hardware they procure and also develop the capability to have a constant awareness of the current state of the digital global supply chain. While the security and compliance of a limited number of hardware and software products can be assessed to be safe, assuring compliance for all public digital services and infrastructure development and its dependencies in full risk depth is likely too much for any regulator.

Depending on a state and its position toward the global community, they might address these challenges differently. For example, a weighted-risk approach could be chosen where a risk-tolerant strategy could be followed, dependent on the criticality of the subject service. This approach would ensure that critical systems would receive proportionately higher compliance requirements, whereas non-critical systems could either be audited at a lower level or require only voluntary compliance.

However, not all risks can be fully mitigated. Most states are dependent on foreign technologies that have little or no alternatives. The Global Positioning System (GPS) is one example of a cornerstone technology for many modern services with limited competition and low adoption of these alternatives. While larger states may be able to develop their own operating systems, they will almost always rely on thirdparty components, and even then, it would almost certainly not be a cost-effective use of resources. Instead, regulators are now working to develop long-term SLAs that force compliance with domestic requirements.

To counter the risk of limiting innovation, a risk-tolerant fallback strategy should be utilized. For example, AI tools are mostly cloud-based and incorporating them into a digital state’s operations could potentially create a “black box” dependency. However, following a risk-tolerant approach, instead of banning the external dependency from the service, it could instead be introduced as a switchable feature, which could be turned off at any point. This might downgrade the service experience for the end-user, but it would ultimately not cause the service to fail entirely in case of interruptions with dependencies.

Key recommendations:

→ Establish a nationwide risk management policy to manage third-party risks. This policy shall establish rules on which systems can or cannot use what kind of proprietary technologies and if a more comprehensive system must be capable of operating in an emergency mode also independently of said technologies. These rules shall be minimal enough to be practical, implementable, and easily auditable.

→ Enforce the policy and rules for third-party risk management of most common technology and security standards through a central authority. This central authority shall build the capability to monitor and react to changes in the supply chain and find optimal cost-to-risk ratio alternatives.

→ Establish an audit authority for critical public services and infrastructure to comply with the established policy.

→ Exercise the resilience to third-party risks while testing and auditing relevant aspects in the policy.

→ Work with multinational regulators to manage third-party risk globally and share the knowledge with partners in like-minded nations.

Create institutional capacity for developing government resilience

Government resilience and plans for the continuity of the state are broad concepts, involving in some ways most if not all functions of the government. Considering scalability, each government function or service should be responsible for their own resilience, creating a de-centralized approach to resilience. This encompasses both specific plans and changes, but also broader increase in the maturity across several disciplines required for the operation of digital services. A recommended approach is to appoint a dedicated advisor in government organizations to develop resilience plans and coordinate with other government bodies and private sector partners.

However, to mitigate the risks of cascading failures, and managing the practical reality of coordinating with large number government authorities, an additional top-down approach is recommended. To see a wholeof- government policy through execution, typically requires creation of a vertical that has necessary executive power and long-term commitment.

For that end,

That unit should be well-placed in the government power structure to be effective in execution, for example under the State Secretary Office or a similar centralized function.

The unit would be responsible for:

1. Owning end-to-end crisis plans across all government.

2. Analysing cross-dependencies for cascade failures and eliminating them.

3. Running government resilience exercises and auditing government organizations for their resilience.

4. Building crisis management competence.

5. Executing crisis management coordination during a crisis with vertical power structure.

6. Policy analysis and coordinating necessary regulative changes.
   
   

Example of a government resilience exercise.

→ In an example scenario of a State Announcements Service, all employees are forced to work remotely. The building is sealed off and powered down, simulating a severe crisis scenario. At the same time, an artificial peak of service load is created, simulating people who are now accessing the service due to the nature of the crisis. To make matters both worse and realistic, the service is also under an extreme cyberattack, further denying access. In an ideal but also achievable outcome, there are minimal to no service interruptions for the citizen.

 The future of resilient digital states

The future resilient digital state utilizes the digital domain to ensure its continuity. It is fully digitalized and demonstrates geographical location independence for its core digital services. How a specific state achieves this goal will depend on their respective context but will certainly involve positioning at least part of their core digital infrastructure outside of their territorial border. It also places significant demands on the state’s capabilities, as ensuring digital operations requires a level of maturity and coordination likely higher than currently exists.

The above recommendations are offered from the perspective of developing increasingly resilient digital states. However, these recommendations should not only be viewed from a lens of helping states overcome crises. Instead, they can also be understood as an acknowledgement of the future trajectory that the world is facing. Emerging digital technologies are reshaping our world and the way that we exist within it, states are not immune from this change. Failing to digitalize, states will not be able to effectively manage the growing number and complexity of crises they will face in the years ahead. As digital and emerging technologies like AI continue to reshape our world, states must also show their willingness to adapt.

Key to this adaptation will be a state’s ability to integrate digital technology into their understanding of the state itself. There is also substantial opportunity for the international community to update the way in which they think about emergent digital states. What might it look like if a state loses sovereignty over its territory due to conflict, or if its territory disappears due to a natural disaster or another crisis? What would it mean if a state was able to maintain its public services, national identity, and democratic system of government via virtual means? These digital states represent a potential future where governance, culture, and community are not necessarily defined only by the territory where an individual is born but by their participation and contribution in the digital realm as well.

This is not an abstract thought experiment, but a call to action to the international community to take this issue seriously. These are issues that the world will have to confront in the near term as some states are already on track to watch their physical territory disappear due to rising sea levels. This is just one example, but there are many more and they are likely to continue to occur in the years ahead.