NCSC: public-private cooperation is key

It is often said that ‘polderen’ is unique to the Netherlands. Since the Second World War, through a combination of negotiations and cooperation, government, industry and unions have made consensus decisions on the road forward based on what is best for all concerned. It is believed that the consensus decision-making model may originate from the very early history of the northern and western parts of the Netherlands when (local) governments, cities, landlords and farmers worked together to contain rivers, dig canals, build and uphold dikes, create polders and win land over from the bogs and sea [3].

It is little surprise that the government has fallen back on this model to fight all things cyber – recent history has made it clear that no single actor alone can make a lasting impression on cyber perpetrators.

The first goal manifests itself in the fact that the national Computer Emergency Response Centre, Govcert.nl, has been incorporated into the NCSC. The function of Govcert.nl hasn’t changed, but will be added to. Despite the fact that, as Minister Opstelten stated at the opening, all outside government remain responsible for their own cybersecurity, the Centre will play a more central role than before. As this is a familiar function, I will not elaborate here, except to stress that in times of crisis the Centre will act as coordinating body between the different partners involved.

The second goal is about the development of knowledge and disseminating it to all partners. Two stages are foreseen at present. First, the government will intensify cooperation between the founding ministries and the relevant agencies, e.g. law enforcement agencies, AIVD (intelligence service), public prosecution and the National Forensic Institute. This will be achieved in part by embedding liaison personnel at the Centre.

Pim Takkenberg, Head of the Dutch National High Tech Crime Team, explains: ‘The liaison personnel will be present at the NCSC for one or more days a week. They will establish a connection between their respective organizations and the NCSC and will be responsible for organizing the relevant or necessary expertise from within their organizations. In this way, not only is trust developed between the cooperating agencies, but also a common language. By reaching out and connecting in “normal” times, it becomes much easier and more natural to do so in times of crisis – which could possibly lessen the impact of incidents.’

Since 2006, regular meetings have been held in the Netherlands between law enforcement and security agencies to discuss cybercrime. This form of cooperation will now be taken to a new level as the liaison personnel will play an important role in times of crisis.

In the second stage, cooperation between the Centre and industry is foreseen. If everything goes according to plan, the Information Sharing and Analysis Centres (ISACs) created around and constituted by members of vital sector groups including telecoms, financial institutions, water and energy providers, etc., will link to the NCSC to make optimal use of information and actively share knowledge. The ISACs are already a feat of public-private partnership, although they are not unique to the Netherlands. At present they are organized through CPNI.nl [6]. Relevant industry partners from a vital sector gather with government, law enforcement, AIVD and Govcert to share threats, learn from and warn each other of perceived threats, and establish best practices in a safe, non-competitive environment. By treating cybercrime and threats as topics that require a common approach, putting competition aside, solutions and security for all can be established. As the sector provides the chair, industry is the driving force behind the agenda [7].

In my opinion this is the nucleus of the initiative. If all parties concerned can find, as Takkenberg puts it, ‘a common language’, learn to work together and gain trust, the NCSC becomes the centre of expertise, excellence and esteem to which all concerned will look for guidance and coordination in times of crisis. Succeed here, and the rest will follow suit.

The NCSC has already published two reports. One describes how to recognize cybercrimes and when and how to report them [8]. The other is a report on ICT security guidelines for web applications [9]. The NCSC is already on the road to establishing itself as a centre of knowledge and advice.

Monitoring the threat level and reporting on it is the third pillar of the NCSC. The Centre aims for a broad participation, public and private, so it can collect data from divergent sources. This information is gathered at a more structural level, is more comprehensive and creates a better overview than ever before. Data can be studied, analysed, discussed, and reported to all the partners involved. The NCSC draws the analogy of laying out a puzzle: find and lay out all of the pieces in the correct order to get the complete picture. This way it ‘will make an important contribution to increasing national resilience by means of the integral approach and the unique shape of the cooperation’ [10]. The first national trend report on cybercrime and digital security in the Netherlands was prepared by Govcert and published on 12 November 2011 [11]. All relevant law enforcement and national security agencies contributed to the report for the first time.