Session 3: The Nexus between CBRN Security and Cyber Security

15th Republic of Korea-United Nations Joint Conference on Disarmament and Non-proliferation Issues Session 3: The Nexus between CBRN Security and Cyber Security [Introductory Remarks] Mr KIM Won-soo High Representative for Disarmament Affairs United Nations Jeju 17 November 2016 Thank you for the kind introduction. I also note that we have one less panellists, but since we are cutting half an hour from our allotted time, our panel will try to finish this in time so we can go to dinner. We are already at less than two hours, so let us do our best. First I would like to just recapitulate three brief points. The first point is about the rising concern about CBRN attack, and also the nexus between CBRN security and cyber security. We have seen an increasing number of reports. Non-State actors have been trying to get access to CBRN material. Even in 2014, the laptop – ISIS laptop seized in Syria – contained a nineteen-page document trying to get hold of biological weapons programs. Also we have seen two reports coming out of Africa this year – one from Kenya, the other from Morocco – about terrorist groups again trying to access biological weapons programs. These attempts have been received with a lot of alarm, although still these reports are not confirmed with any credible intelligence further. But we have to take it seriously before it becomes too late. On cyber, we are increasingly alarmed by the terrorists trying to hack CBRN programs and use those materials for possible attacks. That is the recurring theme of the Nuclear Security Summit process which was wrapped up in Washington last spring. The scenario-based exercise for the leaders showed all these three elements together: the CBRN material stolen by the terrorist cells using cyber-attacks. The last image we have seen in Washington was that if Caesium, radiological material, is stolen by terrorists and then used for an attack, using drones in urban areas, the affected area would be at least two to three kilometres. If it is sarin, chemical, then the affected area will become at least two-fold. But if it is anthrax, biological, it will become maybe ten times higher. This leads to my second point, which is the very serious gap we have in institutional investments we have made in the biological area. On chemical, we have OPCW. On radiological and nuclear, we have IAEA. On biological, we have zero. The only investigation mechanism we have on biological attack, if it happens, is SecretaryGeneral's mechanism to investigate. That mechanism is run by my office. But I can tell you that I don't have even a single dedicated staff. All I have is the roster of experts we have trained. I have around fifty experts on the roster and even I don't know - if an attack happens today, I don't know how long it will take if we try to activate an investigation team, drawing from that roster. Because one lesson we learned from the joint investigation exercise on Syrian chemical weapons file was that, although OPCW has a roster, we have a roster and we made phone 1 calls to those on the roster and they say "Oh, I have to talk to my wife. I have to talk to my government". And it took two months. But if a biological attack happens today, we don't have even, I think, two days. We would have to deploy immediately. But all I have is the roster. So there is a serious gap in the biological area and we have to really seriously think about how we can bridge that glaring gap. My third point is: 1540 Nuclear Security Summit process is very important exercises, but their main purposes are prevention. We have to also think very seriously about what to do if prevention fails. If a man-made attack, along using Ebola virus, and put it in the suicide bomber's body and then make the suicide bomber travel to a country, then that person will not be detected until symptoms came out, so maybe not for two to three weeks. And then that suicide bomber can visit emergency centres of the hospitals and then through hospitals it will be disseminated. If that kind of crisis happens, then how will the international community react? If that attack happens in very weak States, which do not have capacity to respond, then very likely the United Nations will be asked to intervene as we did when the Ebola crisis erupted in West Africa. But still we don't have that response system anywhere in international institutions. So those are the three points I would like to make before our panellists present their cases.