Social Sciences | Research points out perspectives and challenges to promote safety in the digital era
*By: Carolina Paz Comerlatto
*First published: April 18th, 2024
*Picture: Marcelo Pires/JU
Phishing, malware, ransomware, denial of service.There are many terms for this common threat in Brazil: the multiple types of attacks that can happen on the Internet. In the Age of Information, many companies and institutions have their operations at constant risk, and people can have their personal information leaked. With the quick evolution of technologies, cybernetic invasions have also changed – nowadays, these types of attacks are not only common but harmful, and dangerously improved.
Given the worsening of such risks, Daniele Verza Marcon has developed a master’s thesis, under the supervision of PPGD at the Federal University of Rio Grande do Sul (UFRGS), exploring the area of insurances for cyberattacks, a new modality of service that has been surfacing in Brazil. For example, between January and September of 2022, 123 million of reais circulated because of this market, an increase of 75% compared to the same period of the previous year. Daniele, supervised by professor Fabiano Menke, sought to build an overview on safety in the digital world, both from business and personal perspectives. Due to the lack of Brazilian bibliography focused on this topic, the researcher’s goal was to conduct research that would serve as a first step towards more consolidated studies.
Initial Perspectives
Information leaking and other types of attacks can violate NDA agreements, copyright protected information and can even make essential services – like healthcare, transportation, and energy supply – unviable. Daniele affirms that “losses resulted from a security incident can easily cost millions of dollars, and the damage, specifically related to the leak of irreplaceable personal data, can torment the victims for the rest of their lives.”
One of the most important perspectives brought in the study is that technology has deeply modified the way data is collected, analyzed, and stored. Now, attacks that used to be directed only to a singular target can escalate just as easily as a connection of systems or the flux of data. Daniele explains that “the defense is trickier than the attack. In order to have a safe system, it is necessary to pay attention to all the assets, and the hacker only needs access to one of them”
Demands for a new market
In Brazil, this reality has opened paths for the creation of legislations that approach the notification of data protection and security incidents, like the Protection of Personal Data General Law (Lei Geral de Proteção de Dados Pessoais – LGPD ) made public in 2018. Unlike other countries, like the United States, Brazil has a large scope of laws to protect the natural person. Beyond LGPD, the Civil Code (Código Civil) itself and the Consumer Protection Code (Código de Proteção e Defesa do Consumidor) prescribe indemnity in cases of data leak.
That allows victims of cyberattacks to know their data has been compromised and to take action to avoid bigger damage, like identity theft. On the other hand, these measures also significantly increase the costs for corporations, like indemnity payments and fines demanded by public authorities. With that in mind, insurance for cybernetic incidents originated as a specific market to cover damage suffered by organizations or third parties.
Contractual Discrepancies
To better understand this context, the researcher analyzed five contracts from insurance companies that offer this kind of service in Brazil. Taking data collected by Private Insurance Superintendence (Superintendência de Seguros Privados – SUSEP), Daniele looked for situations the insurance did and did not cover. As she explains, the contracts analyzed were very distinct from each other, which is a downside when it comes to choose the right service.
She explains: “The big challenge lies in the lack of a pattern regarding the contractual clauses, what results in asymmetric policies.” According to her, even the two most basic concepts around this kind of service – computer systems and cyberattacks – are not a consensus between the companies. In this case, whether someone is hiring this service or offering it, it is hard to understand what assistance is exactly being offered. Because of this, new problems can surface, like legal disputes between insurance companies and their clients.
Possible resolutions
To the researcher, this is a reverse effect that needs to be avoided. She states that “It is not reasonable to resolve all disputes by means of lawsuits – it is imperative to focus on what matters, and that is the security”. Following this train of thought, Daniele explains that insurance is just another instrument, among many others, that can be implemented to ensure safe data use for citizens and corporations alike. “Sometimes, it would just require the adoption of very simple solutions, like free software, but not every company realizes that.”
Among so much instability, Daniele believes that it is necessary to build a front for education about cybersecurity: “the governments need to know that cybersecurity is a public policy, not just a concern for the natural person or for the legal person (corporations, companies)”. And such important knowledge – like what is cybernetic risk, how it affects people’s lives, what are the main threats, and how to protect against them – should not be available only to a singular portion of the population.
As stated in this work, the main issue is that cybernetic risks are extremely volatile and evolve at the same pace as technology. Mitigated threats get quickly replaced by others, and solutions to reduce the damage can be easily circumvented by new tactics developed by invaders. The researcher believes her research study is an important part in raising awareness on the matter and finding new solutions for such problems. She concludes “The core objective is to find a direction: this is the general scenario, let’s start here.”
*Daniele Verza Marcon ‘s thesis is partially available at Lume – Repositório Digital da UFRGS. Part of it is under embargo for publication in a scientific journal which requires the text to be unpublished.
Translated into English by Artur Vasquez de Mello, undergraduate student enrolled in the course “Supervised Translation Training II (English)” of the Undergraduate Program in Language and Literature, under the supervision and translation revision of Professor Elizamari R. Becker (P.h.D.) – IL/UFRGS.