In a world rapidly moving towards digitalization, the Pacific Islands are no exception. However, with this transition comes the growing need for cybersecurity, as recent events have shown us. The government of Palau and the Pacific Islands Forum Secretariat have both been victims of cyberattacks, with the perpetrators believed to be criminal groups tied to the Chinese government. This exposes the fragility of the region’s digital infrastructure and emphasizes the importance for Pacific nations, especially Tuvalu, to prioritize the protection of their digital resources.
The 2023 Lagatoi Declaration underlines the importance of digital infrastructure in delivering digital services and the development of the ICT sector in the Pacific. Tuvalu, with its ambitious goal of becoming the world’s first digital nation, is particularly at risk. The country plans to store sensitive information online as a means of safeguarding its governance, identity, and culture.
Given the vast amount of sensitive data to be stored in Digital Tuvalu, it is suggested that the Falepili Union be revised to mandate Australia to strengthen Tuvalu’s cyber defense and respond to any cyberattacks against Tuvalu using its rapid cyber assistance teams.
The Pacific Security Outlook Report for 2023-2024 by the PIF highlighted various challenges to cybersecurity development in the region, including limited operational capacity, inadequate infrastructure, and inconsistent budgets. It also pointed out the high success rate of cyberattacks in the Pacific, largely due to the easy availability of tools and services for conducting such attacks and a generally low level of cyber threat awareness across the region.
China has recognized these vulnerabilities and has been exploiting them increasingly. The PIF Secretariat was the target of a cyberattack in February 2024, aimed at accessing sensitive information about its operations and communications with member states. In response, Australia sent a team of cyber specialists to Fiji to assist the PIF in addressing the breach and strengthening its defences.
With Tuvalu’s highest point above sea level at just 4.5 meters, it is predicted to be one of the first nations in the world to be submerged due to climate change. Consequently, Tuvalu has announced plans to construct a digital version of itself, becoming the first nation to explore a digital existence as the impacts of climate change threaten its survival.
Tuvalu’s decision to digitize its nation is bold and innovative, but it also puts the small island state in a vulnerable position. As a diplomatic ally of Taiwan, Tuvalu faces increased risks of cyberattacks, particularly from China. If China were to hack Tuvalu’s digital nation, the consequences could be severe, affecting its national security, governance, and cultural preservation.
To protect itself from cyberattacks, Tuvalu launched its National Information and Communications Technology Policy in October 2023. This policy includes a focus on cybersecurity, with plans to pass new cyber laws, strengthen legal frameworks, form a cyber task force, and implement cybersecurity awareness programs.
Despite this, Tuvalu’s limited financial resources mean it would likely not be able to handle an attack on its digital infrastructure and therefore requires international assistance. The Falepili Union, signed in November 2023 and entered into force in August 2024, commits Australia to provide assistance to Tuvalu in response to military aggression against Tuvalu. However, cyberattacks do not fall under the United Nations’ definition of aggression.
Going forward, the Falepili Union needs to be amended to obligate Australia to actively support the development of Tuvalu’s cyber defense capabilities and ensure a response to cyberattacks targeting Tuvalu utilizing its rapid cyber assistance teams.
The digital transformation of Tuvalu is a progressive response to the existential threats posed by climate change, but it also introduces significant cybersecurity risks. The increasing vulnerability of smaller nations, like Tuvalu, to cyberattacks is a pressing concern. The rising geopolitical tensions, particularly involving China and its cyber capabilities, underscore the need for robust cybersecurity measures.
Despite Tuvalu’s efforts to strengthen its defenses, including the development of a national cybersecurity policy, the country remains ill-equipped to manage a cyberattack on its own. It is vital to amend the Falepili Union to ensure Australia’s commitment to both protecting against and responding to cyberattacks targeting Tuvalu. Protecting Tuvalu’s digital assets is not just a matter of national security but also a critical part of safeguarding the integrity of its future as a digital and sovereign nation.
