Cybersecurity Strategy Advice for the Trump Administration: US-Cuba Relations

As Chinese and Russian cyberattacks dominate international cybersecurity news, the development of cybersecurity norms in the western hemisphere has gone largely ignored. With recent changes in the Cuban political landscape, in particular, understanding how Cuba is (or is not) developing cybersecurity norms is important for protecting US critical infrastructure in a digital world. Cybercrime from Latin America and the Caribbean alone contributes $90 billion per year to the global cybercrime industry[1] and about 12 percent of Distributed Denial of Service (DDoS) attacks target Latin America.[2]  

The resultant insecure cyber environment is not only political disadvantageous, it also creates an unattractive economic environment in the long run. The environment is one in which companies are unable to protect the data and information of users – regardless of the attractiveness of an emerging market that developing countries such as Cuba may provide. Countries with weak cybersecurity strategies become targets for cybercrime and hubs for cybercriminals. Latin America could become a haven for cybercrime precisely because there are no broad comprehensive cybersecurity strategies for addressing cybercrime to the western hemisphere.

Working more comprehensively with the Organization of American States (OAS) to develop regional cybersecurity norms and strategies will create a more welcoming political environment to Cuba as a country and support US interests in protecting critical infrastructure as well as creating attractive conditions for investment and economic development.  

Recommendation 1: Reimagine Cuba’s role in international politics

Calling the previous strategy with Cuba a “failed approach,” the Obama administration officially reopened discussions with Cuba in 2014. The US severed diplomatic ties with the nation in 1961.[3] Over the past two years, President Obama has ordered the restoration of full diplomatic relations with Cuba, opened an embassy in Havana, removed Cuba from the list of states that sponsor terrorism, and announced that he would work with Congress to ultimately lift the trade embargo and other sanctions that have stalled the economic development of the country over the past 50 years.

Even with the embargo still in place at the time of writing, the new policies opened a pathway for US telecommunications companies to begin offering services to the island. As part of President Obama’s new strategy towards Cuba, 11 technology company CEOs accompanied him on a visit to the island nation in March 2016 — including Google, PayPal, and Airbnb — all of which have started offering services to citizens there.[4]

Additionally, the recent passing of Fidel Castro, the author and leader of Cuba’s revolution, brings up questions about what political changes if any, will take place in Cuba.[5] At the very least, Castro’s passing offers an opportunity to significantly change the narrative that characterizes the United State’s relationship with Cuba from one of adversaries to partners for economic and technological growth. Changing the narrative will be crucial to any strategy the US has in Cuba especially in terms of cybersecurity.

A trend in developing international cybersecurity norms has been to apply existing international law to cyberspace. This has largely taken the form of establishing bilateral and multilateral agreements between nation-states that generally fall along the lines of current international agreements.[6] Cuba has not been part of this development of international alliances and partnerships in any significant way for the past five decades. However, recent changes make Cuba a geographically significant international player once again. The US has been slow to partner legally with Cuba, remaining in talks, while other countries are moving quickly to establish agreements with the Caribbean country.[7] Viewing Cuba as a significant international player is critical to building a comprehensive cybersecurity strategy in the western hemisphere, if for no other reason than to deter a stronger relationship between Cuba and adversaries of the US.

There are far more incentives for Cuba to partner with China and other countries of similar cyber ideologies, than to partner with the US. China has long been an economic partner and political supporter of Cuba.[8] The US must consider Cuba an important partner in the developing cybersecurity norms and strategies and make that clear by initiating more political gestures such as encouraging Cuba’s participation in regional conferences.  

Recommendation 2: Aggressively invest in and pursue a comprehensive cybersecurity strategy broadly through the OAS

Despite being a founding member of the Organization of American States (OAS), the Cuban government was excluded from participation in 1962 following the Cuban revolution. In 2009, the exclusionary ban was lifted. However, the Cuban government refused and continues to refuse to formally participate in the organization.[9] Working to bridge this impasse, would be mutually beneficial for Cuba as well as the other states within the organization and the United States.

Recently, a report conducted by the OAS found that nearly 80 percent of the 32 members states do not have any sort of strategic cybersecurity plan.[10] The Cuban Internet environment does not appear to be any more prepared than any other Latin American or Caribbean country and could benefit from being included in the initiative to develop cybersecurity strategies within the hemisphere.

As more Cubans come online, there have been no accompanying initiatives to improve the Internet literacy of the population or provide institutional structures for protecting users or the critical infrastructure of the country itself. This is the norm across the Latin American region. Latin American citizens remain unaware and unconcerned within a threat landscape that includes “new techniques and malware that allow attackers to target industrial control systems (ICS), which are critical for the smooth operations of essential services like utilities, banks, and water-purification plants.”[11]

Some OAS member states have developed Computer Security Incident Response Teams (CSIRT) in an effort to begin to respond to incidents of cybercrime. However, most lack the technical expertise and knowledge to be able to implement these policies and effectively use these teams.[12] 

The US should strongly encourage political strategies in addition to economic development in Cuba as well as broadly throughout the region, such as continued development of CSIRTs, broad ratification in Latin America and the Caribbean of documents like the Budapest Convention on Cybercrime and the Comprehensive Inter-American Cybersecurity Strategy. Additionally, the US should work with OAS to aid in the development of legal responses to cybercrime and law enforcement as well as protection. If the US can push the development of regional norms throughout the hemisphere that advocate information sharing and international norms, the Cuban government may be attracted to this sort of development in addition to economic investment.

Recommendation 3: Appeal to Cuba’s highly literate young adult population

Cuba has an incredibly literate population with a literacy rate of 99.7%[13], which may explain what’s being called a Cuban tech revolution[14]. To maneuver around Internet restrictions, Cubans have created their own informal (and illegal) access points. Strategies include establishing local networks to exchange information, physically exchanging information via USB flash drives and data discs, building their own antennas, using illegal dial-up connections, and developing blogs on foreign platforms.

However, even private citizens who can establish their own Internet connection by their own means, are not allowed to do so by the government. Part of the deal that led to a pathway for lifting the US embargo against Cuba was the release of Alan Gross, who had been held for over five years on charges that he distributed illegal communications technology to Cubans.[15] Although, Gross’s release may signify Cuba’s softening of its Internet and communications policy, the continuous detention and imprisonment of the bloggers and journalists as well as the suspected governmental hacking of politically critical sites within the country signal the government’s commitment to censorship and limiting political speech.

Other highly literate and repressive countries such as China, Russia, and Iran participate in the digital revolution, while the government continues to prioritize maintaining a sense of control over the populace. As previously mentioned, countries like China, Russia, Iran are setting precedents in cyberspace that counter the US’s interests. For example, “Iran represents a qualitatively different cyber actor…They’re not stealing our intellectual property en masse like China, or using cyberspace as a black market like the Russians do…what Iran does use cyber for, including elevating its retaliatory capabilities abroad, makes it a serious threat.”[16] Given Cuba’s highly literate population and the fact that Cuba is still very early in its cyber development, it is a possibility that the Cuban government will push this sort of development, creating a threat for the US. However, because Cuba is so early in its cyber development, the environment could be friendly to the US. The US could appeal to the young adult population, providing them opportunities and incentives to inspire a cooperative and friendly relationship. Such action would create a more stable and secure digital future for both Cuba and the US.

Therefore, the US should export the specialized knowledge and expertise needed to implement cybersecurity policies and institutions. This can be done by providing opportunities to the young adult population of Cubans to further gain knowledge, expertise, and awareness of digital dangers. An initial investment in sharing information and knowledge can result in a return in the form of a Cuba more invested and interested in Internet norms that advocate openness of the internet balanced with private citizen use. This will, in turn, shape the attitude of the market in which these products exist and influence the ways in which these governments interact with the internet and view cybersecurity strategies.

Endnotes

1. Net Losses: Estimating the Global Cost of Cybercrime. (2014).  
2. Safeguarding the Internet: Level 3 Botnet Research Report. (2015).
3. Charting a New Course on Cuba. (2014). The White House.
4. Gatesman, R. (2 June 2016). Cuba works to join the global economy, and IT sees a golden opportunity. Computer World.
5. Ibid.
6. Bennett, C. (24 May2015). Countries pick sides in global fight for the Internet. TheHill.
7. Acosta, N. & Marsh, S. (24 Sept 2016). China, Cuba agree to deepen ties during PM Li’s Havana visit. Reuters. 
8. Lee, C. and Schwartz, F. (2016). “US Competes with China for Influence in Cuba.” The Wall Street Journal. March 18.
9. Cuba Will Not Return to the OAS. (24 January 2014). Havana Times.org. 
10. Cybersecurity: Are We Ready in Latin America and the Caribbean?. (2016). 
11. Trend Micro (2016). The State of Cybersecurity in Latin America. TrendLabs Security Intelligence Blog. TrendLabs Security Intelligence Blog. 
12. Ibid.
13. Adult literacy rate, population 15+ years, both sexes (%) | Data. (2016). Data.worldbank.org. 
14. Heft, M. (1 July 2015).  No Internet? No Problem. Forbes.com.
15. Davis, J. (17 Dec 2014). Alan P. Gross Gains the Freedom From Cuba He Thought Would Never Come. Nytimes.com.
16. Shafa, E. (20 Aug 2014). Iran’s Emergence as a Cyber Power. Strategicstudiesinstitute.army.mil.