Executive Summary

❖ Cybersecurity has become an emerging issue for Southeast Asian countries including Cambodia.

❖ For Cambodia, cyberattacks have relatively less impact on its military, but they have huge impact on the country’s banking system, database of private and public institutions, and the dissemination of false information.

❖ Though lagging behind other countries when it comes to cybersecurity, Cambodia has been intensifying its efforts in combating cyberattacks in the country through strengthening local and international mechanisms.

Introduction

With the rapid growth and diffusion of Information and Communications Technology (ICT), the world is becoming digitally connected. The digital communication is extremely fast comparable to the speed of light. The prospects of digital economy are real and promising. In 2002, the Royal Government of Cambodia launched an ICT-oriented policy reform when it introduced an ambitious e-Government project, including the Government Administration Information System (GAIS) and several other cyber systems for banking, customs and transportation. The ICT or digital technology has arguably played more critical roles in generating growth and transparency for the kingdom’s private and public sectors. Despite its significant roles, the ICT has also brought with it some negative impacts particularly the growing threats from cyberwarfare. While the threats from cyberattacks are universal, cyberwarfare has apparently gained momentum in Cambodia. Although cyberattacks have less impact on the Cambodia’s military, they have huge impact on the country’s e-banking system, public and private databases and the credibility of media as a reliable public source of information, all of which can potentially affect Cambodia’s national security and stability.

What is Cyberwarfare?

Cyberwarfare could be easily understood as the use of computer technology to disrupt the online activities of a state, organisations or individuals, especially the deliberate attacking of information systems for strategic or military purposes. The cyber-attackers use various methods to alter computer codes, logic or data, resulting in a data breach or system failure. This is an emerging threat that transcends borders and has the potential to cause untold damage, both financially and socially with more than 90 percent of Asia-Pacific businesses having been the victims of cyberattacks. 

General Situation of Cyberwarfare in Cambodia

Today, Southeast Asian countries including Cambodia are lagging behind other more developed countries when it comes to cybersecurity – the protection of computers, servers, mobile devices, electronic systems, networks and data from malicious attacks or cyberattacks. Cyberwarfare has been recognised as an emerging issue in Cambodia. Therefore, the country needs to do more to enhance its cybersecurity capability to protect its citizens and national interests against the threat.

Cambodia has not yet had in place a strong protection mechanism or institution to protect users and companies against cyberwarfare, leading to an increase in cyberattacks in the country. According to Kaspersky Lab, in 2018 alone, Cambodia witnessed 4,590,076 online cyberattacks that affected 30.5 percent of internet users, an increase of 2,835,938 compared with the attacks in 2017. Even the Facebook Page of Cambodian Prime Minister Hun Sen was also hacked in February 2019. Arguably, cyberwarfare has already taken root in the kingdom although its existence is not yet widely known among the public. As a result, experts fear that government institutions, businesses and individuals are not well prepared to deal with the impact of cyberwarfare because their awareness of it is still limited. Besides, despite its rapid growth, Cambodia’s Information Technology (IT) sector has not yet ready to embrace this new challenge, as the country has not developed sufficient human resources to support its IT businesses. The kingdom is still lacking resourceful ICT experts in cybersecurity, resulting in an increase in cyberattacks in the country.

It is also worth mentioning that the increase in cyberattacks in Cambodia has occurred at a time when cyberattacks in Southeast Asian region has also increased. Countries in the region have been trying to catch up with the Western world in the area of IT industry. Countries like Singapore, Malaysia, Indonesia and Thailand have hugely invested in this sector with an emphasis on digital infrastructure expected to play a major role in promoting economic growth in the countries. Therefore, the region’s increase in IT makes it more prone to cyberattacks than ever before. Hence, Cambodia is no exception. It is exposed to more cyber threats as an increasing number of its citizens spend more time online than ever before shopping, banking, communicating, working, managing finance and socialising. This can be a major issue for the region in general and for Cambodia in particular, as they have not had good preparation and effective governance to handle the issue.

Impacts of Cyberwarfare on Cambodia

Cyberwarfare has relatively less impact on the Cambodia’s military. Experts in the military tend to discuss cyberwarfare by referring to the capabilities of the digitalised information system operated to block or destroy Military Command and Control (C2). Cyberwarfare is practical only if C2 system is computer-based. However, the Cambodia’s military still use conventional military hardware or old equipment from the Cold War era. Because Cambodia’s C2 system is not computer-based, cyberwarfare is less harmful to the Cambodia’s military. The threats from cyberwarfare; however, are not simply confined to the military. They affect other sectors such as banking system, database and the dissemination of false information, all of which directly affect Cambodia’s national security.

1. Banking system

Raiding accounts of bank customers and stealing money in their credit cards have long been the common threats posed by cybercriminals. However, those threats to financial and banking sector are becoming more dangerous and evolving from targeting individuals to national and global banking system. As Symantec Corporation, a US-based software company with its headquarter in California, wrote in its 2018 Internet Security Threats, “With each passing year, not only has the sheer volume of threats increased, but the threat landscape has become more diverse, with attackers working harder to discover new avenues of attack and cover their tracks while doing so.” Financial sector has become one of the most vulnerable targets of attacks. According to IBM X-Force Research in 2017, the financial service sector accounted for 65 per cent of the total cyberattacks across all industries for which it provided security services.ii Cybercriminals become more ambitious and target banks rather than their customers.

2016 marked a year of ‘extraordinary attacks’ vindicating that the threats of cyberwarfare against financial and banking sector at national and global level are real. On February 4, 2016, a group of hackers successfully hacked the computer system of Bangladesh’s Central Bank and stole no less than $81 million. iii The hackers could have used malwares to deliver infected e- mails to collect passwords and usernames. According to the investigation report released on May 24, 2018 by Al Jazeera, there is “considerable evidence the hackers used the bank’s credentials to access ‘SWIFT’, the international messaging system used to send money around the world”. The hackers generated 35 fund transfer requests from Bangladesh’s account with the Federal Reserve Bank in New York. iv Four out of the 35 were successful. The money was transferred to RCBC, a bank in the Philippines, and continued to casinos before its disappearing.

The case of Bangladesh marks the biggest bank robbery by cyber criminals in modern time and may have an implication for Cambodia’s banking system. Even though there has not been any reported cyberattack against the National Bank of Cambodia (NBC), it does not necessarily mean the NBC is free from any future attack. Like other developing countries in the region, the trend of e-banking in Cambodia is on the rise. Payment, fund transfer and other financial transactions are becoming internet based. Yet, how secure its e-banking system is remains questionable.

Cyber threats are sophisticated and more dangerous. Today best security mechanisms might become outdated tomorrow. As the World Bank warned in its 2018 Report of Financial Sector’s Cybersecurity: Regulation and Supervision, “Attacks on cyberspace, that is, the space between interconnected computers, are increasing in sophistication, frequency, and persistence, [and] cyber risks are growing more dangerous and diverse, threatening to disrupt our interconnected global financial systems and the institutions that operate and support those systems.”v With this regard, what happened to Bangladesh’s Central Bank might also happen to Cambodia.

2. Database of private and public institutions

In addition to the banking system, Cambodia’s private and public database systems are also in imminent danger to cyberattacks. Cybercriminals currently use a technique called Distributed- Denial of Service (DDoS) attacks to steal or destroy all the information or take down the government websites. vi On February 13, 2017, for instance, the National Election Committee (NEC) reported a group of hackers tried in vain to hack the NEC’s voter lists on its website. The main objective of the hackers, according to the NEC’s press release, was “to change the data of the voter lists, which [the] NEC posted on its website for the information to voters.”Cybercriminals target not only state institutions, but also key pubic figures, whose messages are influential to the public and society. Politicians and senior government officials, of course, are the key targets of cyberattacks. The high-profiled case of cyberattack against government officials in Cambodia was clearly seen when the Facebook Page of Prime Minister Hun Sen was hacked in late February 2019. The hackers started spreading false information about political issues on the Prime Minister’s Facebook Page causing confusion to the public. Even though the Cambodian government managed to re-gain access of the Facebook page from the hackers and reported no loss of data, the incident manifests the potential risks of cyberattacks to national security, which should not be underestimated.

Cambodia is one of the most vulnerable countries in the Asia-Pacific region to cyberattacks. The majority of its private and public sectors store their database in computers with unsecured protection software. According to Keshav Dhakad, Assistant General Counsel and Regional Director of Digital Crimes Unit of Microsoft Asia, “Eight out of ten computers [in Cambodia] do not have any protection whatsoever because they are on non-genuine systems.”viii Without protection software, the database system is vulnerable to malicious software (malware) threats. Cambodia, according to Microsoft Asia’s Malware Infection Index 2016, ix ranked number seven on a list of top markets in the Asia Pacific under threats from malware. The Cambodian government has made some efforts to deal with the issues. More, however, need to be done.

3. Dissemination of false information

False information dissemination is by no means a new phenomenon to society. In fact, false information has existed since the ancient time. Deception, according to Sun Tzu’s Art of War, is one of the key principles to fight and win wars. Spreading false information is, of course, central to victory. Even in modern societies, lie, leak, rumour, and fabricated news including corruption scandal circulations are quite common. Politicians lie during election campaign by offering unfulfilled promises; International corporations lure customers into buying products they do not necessarily need by running attractive commercial advertisements. Not all of these are necessarily true.

However, in the digital age, these forms of polluted information are becoming critically dangerous, triggering a climate of uncertainty and posing long-term negative impacts on national security and social stability. On July 22, 2019, for instance, the Wall Street Journal reported that the Cambodian government singed a secret agreement with China that would allow China to establish a naval base at Ream Naval Base for 30 years. Cambodia’s Ministry of National Defence called the news report ‘fake’ and allowed journalists to access Ream Naval Base to prove that the alleged agreement is groundless. x While nothing was found at the site related to the alleged base agreement, the news report has generated strategic uncertainty and misperception affecting Cambodia’s diplomatic relations with the U.S. and other countries in the region particularly Vietnam and Thailand. The issue of dis-information has obviously posed an imminent threat to Cambodia’s national security and stability.​the region particularly Vietnam and Thailand. The issue of dis-information has obviously posed an imminent threat to Cambodia’s national security and stability.

Cambodia’s Prevention of Cyberwarfare

Though Cambodia lags behind other countries in tackling cybersecurity threats, it has initiatives and has developed action plans to respond to the threats. Over the years, the Working Group of the Council of Ministers has drafted a cybercrime legislation aimed at establishing a national Anti-Cybercrime Committee to investigate cybersecurity-related risks. In addition, local agencies like IdeaLink Consulting, a consulting firm in Cambodia, has partnered up with Molla Technology from Malaysia to provide digital banking security solutions to several banks such as ACLEDA Bank, Vattanac Bank, Hattha Kaksekar Limited Microfinance Institution and Phillip Bank, as those banks are becoming more aware of the issues and trying to find solutions to adverse the threat.

A plethora of cybersecurity conferences have been organised in Cambodia in recent years in an effort to raise Cambodian people’s awareness of cyber threats. Cambodia hosted the Cyber Security Asia Conference in November 2019 to provide insights into local and regional trends in cyberwarfare and cybersecurity. Such activities demonstrate the full commitment of the Royal Government of Cambodia in strengthening national cybersecurity as well as in safeguarding the kingdom from cyberattacks. The government has also issued the ICT Master Plan 2020 in order to enhance the kingdom’s capacity to deal with cybercrime and to develop cybersecurity measures across the board. The implementation of the Master Plan is pretty a daunting task that requires businesses, institutions and governmental agencies in Cambodia to work together to address the common threats.

More Local and Regional Efforts to Tackle the Threats

Arguably, Cambodia should and could do more to intensify her efforts in combatting cyberattacks in the country. The Royal Government of Cambodia needs to invest more in fundamental security solutions that could provide cybersecurity framework and standards to prevent cyberattacksin the future. These include the provision of training and capacity building to Cambodian people with a focus on upgrading high quality ICT infrastructure and enhancing skilled talents that can combat cyber intrusions. In doing so, Cambodia will be able to enhance its cybersecurity defence against future cyberattacks.

Furthermore, Cambodia should seek to deepen cooperation with other countries at regional and international levels in order to combat cyber threats. For instance, the ASEAN cybersecurity capacity building efforts announced during the Singapore Cybersecurity Week 2016 may serve not only as a platform for dialogues on confidence building measures, but also as a forum to contribute to international cybersecurity norms that could enhance local, regional and global security. xii Superpowers like the US, Russia and China respectively have vowed to assist​​ Cambodia and ASEAN as a whole in promoting security cooperation and combating
cybercrime. In this case, Cambodia should consolidate and push for such great opportunities
in order to enhance her capacity, coordination and capabilities to deal with this new challenge
of cyberwarfare.

It is also worth mentioning that cybersecurity is not just the sole responsibility of a government. All individuals particularly internet users should also do more to respond to the threats. Indeed, they could protect themselves through several ways such as enabling stronger authentication and passwords for their major email addresses, social media and financial accounts. Also, the users should ensure that the security software, operating system, and web browsers are clean and up to date in order to prevent any possible intrusion by unknown attackers. The passwords of their social media accounts as well as of the Wi-Fi networks should also be updated regularly, especially when the users suspect that their security is compromised. In addition, when sharing their online information, internet users should limit the amount of personal information that they share online and use privacy settings to avoid sharing information widely. These measures should be taken into due consideration by internet users in Cambodia, where online activities and connectivity have been considerably on the rise. Cybercriminals often target careless individuals and businesses who have contacted each other through various networks and exchanged critical information via digital platforms.

Conclusion

In summary, as Cambodia’s economy continues to grow at a fast pace and more financial institutions are expanding their business activities on the digital platforms, it is time for the kingdom to strengthen the country’s IT security in order to protect valuable data from being stolen by hackers. In other words, the growth of the information and internet-based technologies is not going to slowdown in the future. Hence, it is critical for Cambodia to take a holistic, concerted and multi-stakeholder approach to combat cybercrime and threats in order to transform Cambodia into a strong digital country by 2030. That is to say, to combat the cyberwarfare, the Royal Government of Cambodia needs to develop policies that can effectively enforce the national legal system on cybersecurity and that can push for other potential regional and global cooperation, particularly within ASEAN, so as to promote cybersecurity in the country and in the region. Companies need to rethink their long-entrenched approaches to cybersecurity. Individuals should also play more important rolesthan ever before in contributing to the tackling of cyberthreats by developing rigorous cyber habits as mentioned above. In short, all actors in Cambodia have to work together to minimise the risks posed by cyberwarfare.

The opinions expressed are the author’s own and do not reflect the views of the Asian Vision Institute.