Press briefing: ITU and UNDRR

New Report on the Hidden Risks of Digital System Failures

Doreen Bogdan-Martin, Secretary-General of the International Telecommunication Union (ITU), posed the question: what if our digital systems failed? She warned that there would be no streaming of the press briefing and lights would likely turn out in the room. Outside the Palais, payment systems would eventually stall; emergency calls would struggle to get through; and reliable information on what to do would become harder to access.

Such a breakdown was more probable than one might think. Digital systems had become so embedded in our lives that they were barely noticed until they failed. Failures could escalate into major crises, with the most vulnerable experiencing the worst impacts.

It was time to start preparing for critical digital risks more intentionally. Ms. Bogdan-Martin said she was today launching a report titled, "When Digital Systems Fail: The Hidden Risks of Our Digital World." In this collaborative effort by ITU, the United Nations Office for Disaster Risk Reduction (UNDRR) and Sciences Po, 12 senior experts from around the world showed how hidden digital failures translate into real world disruptions.

Far from science fiction, the report detailed real risks that had already been observed on Earth and in space, from solar storms to submarine cable disruptions. The common denominator of these unintentional disruptions was their tendency to cascade, with impacts spreading across sectors like finance, healthcare, transport, energy, and communications, often simultaneously.

The solution was not to do away with digital. Technology remained an essential driver of economic growth and innovation. However, sustained progress demanded better preparedness        to identify and map critical digital risks; to recognise unintentional disruptions as core priorities in risk management frameworks; to strengthen international standards and engage in joint scenario planning across sectors and regions; to enable communities to better absorb and recover from digital disruption; to build trust and shared situational awareness; and to translate early warnings into collective action at scale. ITU, as the UN agency for digital technologies, would continue raising awareness on critical risks so that disruptions did not result in disaster.

The report built on ITU work on submarine cable resilience with its international advisory body, which was about to conclude its work. It also built on ITU's work in the field of space sustainability, with ITU hosting its third annual forum on the subject in October, and its work on early warnings for all, together with the World Meteorological Organization, the International Federation of Red Cross and Red Crescent Societies, and UNDRR.  ITU's goal was ensuring that digital systems were built on a solid foundation of safety, resilience, and trust.

Kamal Kishore, Special Representative of the United Nations Secretary-General for Disaster Risk Reduction and Head of the United Nations Office for Disaster Risk Reduction (UNDRR), said this report was an example of how the United Nations could bring together complementary strengths and reach out to academia to convene the best possible expertise from around the world to address common issues.

The notion of "systemic risk" - that risk was not limited to one location in a sector - was something that UNDRR had been talking about for more than a decade. The report discussed systemic risk and the associated challenges that came with managing it, as well as the challenge of modelling the cascading effects of a new risk.

When it came to risks to digital systems, there were unique challenges and hidden risks, many of which were invisible. Digital interdependencies were often not fully recognised. There was an assumption that when digital systems failed, there would be analogue systems to fall back on. But those were no longer there and analogue expertise and equipment was getting outdated.

Close to 90 per cent of the impact of natural hazards were not first order impacts, but impacts with ripple effects. These affected all systems and all people, in both the Global North and the Global South. For example, when power systems went down, telecom towers started to fail after draining their backup power. When the telecom system failed, ATM machines stopped working, and people could not access their own cash, which forced small markets in far-flung areas to stop working.  Another example was natural disasters, which, depending on their location, could affect hundreds of millions of people.

The report was a page-turner that presented three very real worst-case scenarios, which led to recommendations that spanned across multiple areas, including the need to address the resilience of power systems, undersea cabling, space-based systems, satellites and data centres. UNDRR would follow up on the report's recommendations.

It was not a matter of "if" but "when" for digital disasters. This was why the world needed to start preparing for them now.

In response to questions, Ms. Bogdan-Martin said the focus of the report was on non-intentional digital disruptions rather than intentional disruptions caused by bad actors. We were not as prepared as we should be for non-malevolent threats, including natural hazards. The repot highlighted what countries, communities and the private sector could do in response. No single actor could solve this problem alone.

Ms. Bogdan-Martin said ITU was approaching its anniversary on 17 May, and the theme of the anniversary this year was "digital lifelines", a topic that was linked to the report. ITU had study groups focusing on resilience and reliability, security and science services that were looking into risks posed by space weather and solar storms.

Also responding to questions, Mr. Kishore said we were not adequately prepared for the cascading aspects of threats to the world's digital infrastructure. These risks had not been assessed fully until now. The report addressed these through three case studies, including one on a solar storm and one on extreme heat. To mitigate these risks, analogue skills and systems needed to be strengthened. We also needed to raise awareness about each person's role in responding to the risk. The report called for building of trust through a people-centred approach, he said.