In this commentary, the authors argue that governments, particularly the member countries of the G20, which are driving the global agenda for digital development and economic cooperation, should consider the idea of sovereign wealth funds for the cybersecurity of intellectual property (IP).
While upholding cybersecurity resilience is a whole-of-society effort, governments need to up their game when it concerns economic security. Particularly for developing nations, the ability to incorporate emerging technologies into their core economic activities is essential to longer-term economic development. A transition towards knowledge- and technology-driven economies is largely enabled by IP. These intangible assets such as industrial designs, trade secrets, and sensitive business information contribute nearly 87 percent of the market value of Standard & Poor’s 500 companies compared to only 13 percent of tangible assets.
To protect their IP and secure their proprietary knowledge, businesses and research institutes rely on safe data storage and secure and reliable Information and Communications Technology (ICT) systems. However, the surge in cybersecurity incidents during the COVID-19 pandemic demonstrated that this trust in digital public infrastructure and confidence in cyber-enabled systems is often unwarranted. This concern is even more insistent when competing states mobilise their cyber capabilities against private entities, such as companies, research labs, and universities.
In today’s contested cyber and technology environment, states are highly invested in cyber espionage for political, military as well as economic purposes. For economic espionage, sophisticated tactics and techniques are deployed against historically ‘soft targets’. Cyber-enabled intrusions affect academia, start-ups, and small-medium enterprises disproportionately as they often lack the awareness, skills, and financial resources to take effective preventive and remedial measures.
The bottom line is: Cybersecurity costs money, but ensuring the cybersecurity of valuable IP in a competitive geoeconomic environment costs even more money.
In most countries, the onus of making sure adequate steps are taken to protect IP and take cybersecurity measures lies with individual rights’ holders. They need to register patents or designs, make sure sensitive commercial information is kept confidential, initiate any investigation in alleged cases of infringement, and procure the right cybersecurity service portfolio.
It’s debatable whether this is a reasonable expectation. If we consider these producers of IP critical to a nation’s economic security and national prosperity, then there may be a role for government to offer essential packages of cybersecurity protection. In fact, stronger IP rights protections have proven to bolster the export performance of firms that benefit from legitimate transfers of technology. Thus, entities that we consider at the coalface of developing our economy’s future crown jewels can’t just be left to themselves.
The magnitude of the cybersecurity challenge in most countries warrants an instrument of some weight. Commodity-rich economies such as Norway, Saudi Arabia, and Qatar established sovereign wealth funds to spur further innovation while emerging countries such as Brazil, Russia, India, Indonesia, and China established theirs to finance major infrastructure development projects.
Countries such as Taiwan and OECD member nations like France, South Korea, and Japan have gone a step further and introduced sovereign patent funds (SPFs) in an effort to keep pace with global innovation. When certain technologies are deemed required for economic security, SPF funding allows for the acquisition of IP assets or licences from third parties; the prevention of takeovers of national patent-generating giants; or for channelling resources towards key industries in priority sectors to develop a competitive edge or address industrial chokepoints.
To address the issue of insufficient investments in cybersecurity by critical IP-producing entities, governments should consider a sovereign wealth fund mechanism for the cybersecurity of IP. This would allow governments to provide their innovation, research and development ecosystem with a cybersecurity uplift package at scale. In addition, it would create a financial incentive for governments to press other states to observe existing norms of responsible behaviour, such as not engaging in economic cyber-espionage and ensuring their ICT environment is not being misused for internationally wrongful acts.
How could a sovereign wealth cybersecurity fund for the protection of IP work?
There are already existing mechanisms for IP protection. For instance, WIPO’s various Funds-In-Trust for Intellectual Property offers technical assistance to developing and least-developed countries to enhance IP systems and capabilities. Another mechanism that was pioneered by over 20 countries including Singapore, the United Kingdom (UK), and France is the patent box tax regime. A patent box typically offers concessional tax treatment to profits generated from different types of IP (particularly patents) meeting certain eligibility criteria.
Through a cybersecurity fund of some size, governments will be in a much better place to promote the uptake of required cybersecurity standards based on national or sector-specific risk profiles; procure an accompanying national-level service portfolio that selected IP-relevant entities can access; and manage a unified secure platform for threat information-sharing. A cybersecurity portfolio for small businesses, academia, and research labs could include, for instance, premium services for routing, mail, data, application, and web security.
A dedicated fund for IP protection for all firms, however, is neither effective nor feasible. Priority beneficiaries should include producers of IP that are considered of strategic, economic, or national security value, and that are significantly dependent on high-end cybersecurity provisions.
Additional eligibility criteria to access public funding could include:
- The amount of market capitalisation of the start-up or SME;
- The expected financial and non-financial profits to be derived from them;
- The quality and value of the IP that the entity has registered or created in recent years?
The funding could be sourced from a part of governments’ separate budgets for industrial development, trade promotion, and cybersecurity. Ideally, this will amount to a fixed percentage of the annual budget or a certain percentage from existing sovereign wealth funds and public pension funds could be carved for digital security investments. An alternative is to rely on public-private partnership funding. For instance, a levy could be introduced requiring established high-tech industries and cybersecurity firms to contribute to the inclusion and promotion of local suppliers, research and development, and further workforce development.
Such cybersecurity wealth funds can be managed at the state or federal level within individual jurisdictions, but there may also be a role for international financial institutions such as the World Bank and the Asian Development Bank. Especially in jurisdictions with weaker governance, institutional and oversight capabilities, there’s inevitably a challenge to ensure large investment funds are used efficiently and for the right purposes. Parliamentary committees, audit offices, or even international financial institutions play a role in overseeing annual or six-monthly expenditure and performance monitoring reports.
It’s important to acknowledge that a sovereign wealth cybersecurity fund won’t stop malicious state and non-state actors from trying to steal IP or compromise sensitive data. However, at the moment, only a few countries can credibly claim to have a good understanding of the cybersecurity threat environment. Most economies simply lack visibility due to shortages in capabilities, skills, and funding. Coordinated, concentrated, and standardised cybersecurity investments through a sovereign wealth fund will, however, enable national governments to make a serious step forward in strengthening digital resilience and their cyber defence posture.
For the next phase of economic and technological disruption, the development and protection of assets of high intellectual property value will be essential. This is of strategic interest to advanced economies as much as it is to emerging economies. In fact, Global South economies have become integral to global supply chains, and they produce, collect, and access precious forms of IP including through joint ventures with foreign companies.
The G20 governments carry a responsibility to promote fair competition in an increasingly digitised environment. This includes setting, establishing, and resourcing effective national-level cybersecurity maturity levels. Dedicated sovereign wealth funds for the cybersecurity of intellectual property would be a concept worthwhile to explore.
Urmika Deb is a researcher and Bart Hogeveen is head of cyber capacity building at the Australian Strategic Policy Institute. They work on a project to support emerging economies in defending against cyber-enabled theft of IP for commercial purposes.
