Co-designing Pacific cybersecurity and human security

In November 2022, the tiny Pacific nation of Vanuatu was cut off from the global internet by a ransomware operation possibly perpetrated by Russian cybercriminals. For 11 days, government services were unavailable, hospitals and schools were severely affected, and Vanuatu’s 315,000 citizens struggled to access basic amenities. With Australian support, services were slowly restored, but the experience demonstrated how vulnerable small island countries are to cybersecurity incidents.

The incident showed the fundamental connection between cybersecurity, which protects digital systems from disruption and subversion, and human security, which focuses on the safety, stability and well-being of individuals and communities in their everyday lives, beyond conventional state-focused security frameworks.

Pacific Small Island Developing States (SIDS) like Vanuatu face a perilous combination of threats to human security, including shrinking fisheries, limited economic growth, rising seas, and breakdowns in social cohesion. Cybersecurity has a crucial role in addressing these issues but its conceptual and political connections with human security are underspecified and have yet to translate into regional policy and practice.

As such, a revised approach to cybersecurity and human security is necessary. Specifically, we ask how influential regional security partners like AUKUS (Australia, UK, USA) can realign their cyber statecraft with Pacific human security and cybersecurity objectives. We offer four principles to guide regional cyber statecraft, all of which contribute to a Pacific cybersecurity approach with SIDS’ human security interests at its core.

Capacity building as statecraft

Cybersecurity interventions in the Pacific focus primarily on cybersecurity capacity building (CCB). The need for CCB is not in doubt: it can help SIDS benefit from technology and promote their security and resilience. 

CCB draws upon formal frameworks for improving the cybersecurity ‘maturity’ of participating states. State-funded organisations like Australia’s Oceania Cyber Security Centre and the UK’s Global Cyber Security Capacity Centre assess partner countries’ cybersecurity maturity and propose roadmaps to enhance security measures. These well-established initiatives aim to meet the cybersecurity ambitions of both donors and recipients, with the latter retaining significant control over how they allocate resources.

For donor countries, CCB is an important tool of cyber statecraft. However, its focus on technical capacity is not sufficient to address other local digital and human security needs.

The disconnect

The Pacific Islands Forum of 16 South Pacific SIDS plus Australia and New Zealand recognises climate change as their greatest regional threat. They also assert the value of a human security approach for addressing ‘widespread and crosscutting challenges to the survival, livelihood and dignity’ of Pacific peoples and elsewhere see cybersecurity as a crucial mechanism ‘to maximise protections and opportunities for Pacific infrastructure and peoples in the digital age’. 

Forum nations cooperate on regional cybersecurity mechanisms like the Pacific Cyber Security Operational Network and the Pacific Islands Law Officers Network. They support  United Nations cybersecurity initiatives and seek accession by Pacific states to the Council of Europe Convention on Cybercrime. However, this cooperation has not translated to a comprehensive strategy with fully articulated links between cybersecurity and human security  by local and regional powers. This creates a critical gap, as cybersecurity initiatives are not formally aligned with the broader human security agenda of Pacific SIDS. 

Connecting cybersecurity and human security

The Pacific Islands Forum has repeatedly emphasised that human security threats ranging from climate change to COVID-19 are compounded by the region’s limited capacity to withstand external shocks, including cyberattacks from external actors. 

Pacific nations face unique cybersecurity challenges due to limited resources, inconsistent connectivity, and a range of external cyber threats driven by crime and geopolitics. Poor cybersecurity increases exposure to cybercrime; their position in the Pacific puts them in the crossfire of East-West competition. In this context, cybersecurity must defend against external digital threats and safeguard human security.

Vanuatu’s ransomware experience highlighted the fragility of the island’s critical infrastructure. Other countries like Palau have also been targeted. The Pacific Islands Forum itself was infiltrated by hackers in 2024. Cyber operations against SIDS assets, including these incidents, are regularly suspected to involve China, as SIDS become entangled in broader geopolitical dynamics and China seeks to counter US regional influence.

Digital technologies can help improve insecurity emanating from environmental challenges. They can play important roles in monitoring environmental indicators, enhancing economic diversification, sustaining dispersed communities, and communicating Pacific political concerns to the world. 

A human security approach to cybersecurity ‘prioritizes the individual, and views [digital] networks as part of the essential foundation for the modern exercise of human rights’. Linking human security to cybersecurity, however, requires changes in how cybersecurity is perceived and exercised. 

Incorporating human security would shift the focus of cybersecurity from the sovereign state to the rights-bearing individual. State interests should not be the main or only consideration in cybersecurity decision-making. 

Linking the two would also position cybersecurity as an enabling foundation of human security, a way of comprehending and responding to how people perceive everyday security and insecurity.

Neither a conventional state-centric approach to cybersecurity, nor a one-size-fits-all mindset, is a sustainable basis for cyber statecraft by well-resourced actors, such as the AUKUS countries, seeking to meet Pacific cybersecurity and human security needs. 

Four principles

We propose four principles for reframing cyber statecraft and furthering Pacific human security. They build on existing policy commitments and work together to raise the level of cybersecurity for SIDS nations and communities.

First, all stakeholders should adopt a human security approach that recognises its critical importance to regional stability, aligns cybersecurity policy with human security objectives, and integrates human security into Pacific statecraft.

Second, overseas powers like the AUKUS countries should collaborate with all relevant regional parties and stakeholders to explore the relationship between cybersecurity and human security, ensuring comprehensive regional arrangements that respect local social, economic, and political concerns.

Third, as far as possible, cyber statecraft should lead to the co-design of cybersecurity initiatives with the populations it intends to support. These should be appropriately adapted to local cultures and worldviews and meet the specific and unique needs of diverse and distributed Pacific communities. Such initiatives are currently rare in the region but have been shown elsewhere to enhance resilience and drive positive security outcomes.

Fourth, all countries must ensure their cyber statecraft postures and actions do not inadvertently harm Pacific human security, especially in the context of regional power dynamics and US-China strategic competition. Friendly nations should seek to protect local communities as much as they aim to counter Chinese activities in the Pacific.

Human security for strategy and stability

Supporting human security via cybersecurity is critical for the stability of the Pacific region. Our principles suggest that powers like AUKUS can develop strategically sound statecraft that is grounded in cultural sensitivity and aligned with Pacific SIDS’ aspirations. By boosting security and resilience in SIDS and prioritising regional concerns, the AUKUS coalition can further its strategic interests in the Pacific. 

The authors received funding from the Security and Defence Plus (SD+) initiative of the PLuS Alliance.