IGF 2018 WS #438
Enhancing Global Cyber Supply Chain Trust

Building and maintaining cyber supply chain trust is becoming a critical issue of increasing significance for global information society governance, linking up the main stakeholders like consumer, government and industry. A shared sense of trust in Global Cyber Supply Chains is a prerequisite for nurturing a healthy Internet economy and technology development. The increasing dependence on ICT products and services and the globalization of production and provision call for building such a trust mechanism.

Firstly, ICT products and services are central to interpersonal communications, business development and operations, and government services, to name but a few key areas of dependence. Moreover, as national-level digitization efforts proliferate and cutting-edge technologies, including AI, edge & cloud computing, blockchain, big data analytics, IoT (Internet of Things) & CPS (Cyber-Physical Systems), and quantum computing, introduce new capabilities to governments, the consumers, and businesses, this dependence on ICT products and services is likely to increase in the years to come. Secondly, cyber supply chains are global in nature, being a fruit of cooperation among a globally distributed, interconnected set of organizations, people, processes, products, and services.

Trust is fundamental to a harmonized cyberspace as it is a prerequisite for the adoption of cutting-edge technologies to protect global cyber supply chain from a rising tide of cyberattacks, in which the cyber supply chain is normally considered as the weakest link. Those attacks are perpetrated both by nation states and independent cyber-criminal actors. Governments, in turn, often seek to bolster supply chain security by simply prohibiting the import of technology components and services from the target countries, rather than developing a long-term, internationally-accepted approach to supply chain security assurance. As a result, we stand at a crossroads. The nations of the world can work together to create a harmonized global supply chain trust mechanism, or they can continue to act unilaterally, undermining international cyberspace governance and technology development. Hence, the cyber supply chain trust between major manufacture countries and market regions becomes more and more critical.

Recently, the trade tensions are rising between the U.S. and its major trading partners as the American government adopts new, impact-driven policies. Considering that the US and China are major suppliers of ICT goods and services to each other and to the world, it is challenging for the consuming parties of these goods and services to come up with effective solutions to address the growing distrust without accelerating the already obvious trend of nationalistic approaches towards creating countermeasures.

Even though global supply chain is already haunted by domestic policies of both countries, their technology competition in the global arena leads to orgies of distrust between the two giants. Multinational organizations (including corporations) based in both countries, for their part, continue to contest for talents, market access and profits across geographic borders. In consequence, the state of global commerce based on the free flow of goods and services may be altered or disrupted by a dis-trusted supply chain. Growing divides in political and economic ideology stemming from national orientation may ultimately destroy the confidence in technology. Even though the U.S vis-à-vis China case is an obsolete example, it is a global and strategic issue which, eventually, may cause chaos in cyberspace.

This workshop is organized to address these issues by offering a forum for exchanging different views towards trust-building in global cyber supply chains. It looks at the policy responses of the U.S. and China, the world’s two largest economies, and concludes by proposing a set of principles and best practices that may be adopted to support policymakers and industry stakeholders as they consider how best to move forward in addressing supply chain security-related concerns.

This process will be reinforced with audience participation in the form of comments and Q&As. The participants are expected to take away the insights and lessons learned, which would contribute to addressing their own challenges and, eventually, promoting international cooperation for Internet governance. 

In the previous workshop (IGF 2017 WS 15), the panel of speakers representing government agencies, academia, and industry shared the lessons learned from multistakeholder cooperation on emergency response for the benefit of the participants in implementing their own cybersecurity policies. This workshop builds on the previous workshop to address an imminent, broader and more complex issue of enhancing global cyber supply chain trust involving national security as well as trade aspects of cybersecurity.