The Blogs: A Global Cyber Alliance Is Needed.

The State of Cyber and the need for a global alliance

Artificial intelligence is lowering the cost of attack and expanding the possibilities of defence. Five principles should govern a world in which digital harm crosses borders faster than accountability.

A passenger crosses a border carrying a passport. A bank transferring money across jurisdictions faces financial controls. States are expected to police what passes through their territory, cooperate against organised crime and answer for failures that endanger others.

Yet a criminal can reach across continents, impersonate an executive, empty an account or paralyse a hospital while investigators struggle to establish which authority should act. The internet connects our economies more effectively than our institutions connect their responsibilities.

Recent World Economic Forum contributions illuminate both sides of this problem. Its March 2026 article on AI-enabled fraud describes deception becoming faster, cheaper and more scalable. A separate contribution by Global Cyber Alliance’s Philip Reitinger argues for collective investment in the nonprofits underpinning internet security. Together, they point towards a larger political question: who is responsible when interconnected societies become interconnected victims? [1][2]

The existing Global Cyber Alliance is a nonprofit, not a supranational regulator with sanctioning powers. The proposal here goes further: an intergovernmental compact combining minimum obligations, practical assistance, independent assessment and proportionate penalties for deliberate noncompliance.

The border analogy has limits. Packets are not passengers, and universal identification of internet users would endanger privacy. What we should borrow is the principle of reciprocal responsibility. Participation in a shared system brings obligations towards everyone who depends upon it. Something similar to an INTERPOL for cybersecurity – where Cyber actors and “cells” are proactively hunted – and shut. Not waiting for something to go wrong.

1. Make state responsibility explicit, measurable and enforceable

Every participating state should maintain an operational national incident-response capability, preserve electronic evidence lawfully, answer urgent international requests, investigate credible allegations and act against criminal infrastructure within its jurisdiction. It should supervise financial intermediaries that facilitate laundering and protect researchers who responsibly report vulnerabilities.

These should be proposed treaty obligations, not a misleading assertion that international law already imposes one universally accepted cyber-policing standard. Nor should a government automatically be blamed because an attack passed through a server on its territory. Compromised infrastructure, criminal residence and state direction are different facts.

An alliance must distinguish inability, negligence, deliberate protection and direct sponsorship. A resource-poor country seeking assistance deserves investment. A government repeatedly shielding identified criminal operators deserves consequences. A state directing attacks against civilian services presents a more serious security problem still.

We would not be starting from nothing. The Budapest Convention already supports a round-the-clock cooperation network for cybercrime and electronic evidence. The United Nations Convention against Cybercrime opened for signature in 2025. An alliance should connect and strengthen existing mechanisms rather than create another institution whose primary output is conferences. [3][4]

Its governing agreement should establish an independent technical secretariat, regional representation and an assessment process insulated from any single power. Public reports should measure response times, cooperation with evidence requests, remediation and disruption of repeat offenders. Raw arrest totals would encourage theatrical enforcement and wrongful prosecution.

Members should also accept scrutiny of their own conduct. A compact that punishes weak states while overlooking powerful sponsors of destructive operations would advertise hypocrisy. Civilian hospitals, water systems and emergency services need explicit protection, with incidents investigated according to the same evidential standards regardless of the accused country’s alliances.

Membership would offer benefits: training, shared intelligence, emergency assistance and recognised assurance standards for sensitive procurement. Those benefits create an incentive to cooperate before punishment becomes necessary. Smaller states should have a meaningful voice in setting those standards, rather than simply receiving requirements written by larger economies. Sovereignty should mean accepting responsibility for harmful activity a state can reasonably address, not claiming immunity from questions about it.

2. Map criminal ecosystems without criminalising populations

Where are the hotspots? A useful baseline is the 2024 World Cybercrime Index, built from assessments by 92 experts. It ranked Russia first, followed by Ukraine, China, the United States, Nigeria and Romania; North Korea, Britain, Brazil and India completed the top ten. This is an expert assessment of criminal activity, not a live 2026 census or proof of government complicity. [5]

That qualification matters. National rankings can obscure more than they reveal. A country can host skilled offenders, major victims, legitimate security researchers and effective investigators simultaneously. A hosting location may tell us where a rented server sits rather than where the offender lives.

Southeast Asia illustrates a different concentration. UNODC has documented scam compounds in Cambodia, Myanmar and Laos, connecting online fraud with organised crime and underground finance. INTERPOL’s March 2026 assessment describes scam centres spreading worldwide and involving large numbers of people trafficked into forced criminality. Some people behind fraudulent messages are themselves captives. [6][7]

Africa also requires regional precision. INTERPOL’s August 2026 assessment identifies mobile-money fraud and infrastructure-targeted ransomware in East Africa, and widespread business-email compromise and romance scams in Central and West Africa. These are patterns of criminal activity and victimisation, not characteristics of entire populations. [8]

State-linked theft must be considered separately. The FBI attributed the approximately $1.5 billion theft from Bybit in February 2025 to North Korea. Such operations complicate any comforting division between ordinary financial crime and national security. [9]

The practical response is to map networks: recruiters, access brokers, hosting providers, payment accounts, laundering services, corrupt protectors and beneficiaries. Follow how these components cooperate. An offender may recruit in one country, exploit infrastructure in another and cash out through several more.

This also changes intervention. Rescuing trafficked workers, prosecuting organisers, disrupting laundering and helping providers remove malicious infrastructure are complementary actions. Closing one compound while leaving its owners, accounts and recruitment networks untouched merely encourages relocation. Success means reducing the ecosystem’s ability to regenerate, not moving its address.

3. Model the attacker’s decisions, not a mythical hacker personality.

Cybersecurity often imagines a solitary technical genius confronting a firewall. A more useful model asks what an adversary wants, what resources they possess, which route is cheapest, how long they can wait and what consequences they expect.

For profit-driven crime, a simple heuristic is: expected reward, multiplied by the chance of success, minus effort and expected punishment. This is a planning aid, not a validated psychological equation. State operators may instead maximise intelligence, coercive leverage or future disruption. Some offenders seek status; others act under coercion.

Social engineering attacks the organisation’s decision processes. Urgency discourages checking. Apparent authority makes refusal uncomfortable. Familiarity lowers suspicion. A helpful employee becomes the route around a carefully configured technical barrier. AI can improve language, personalise messages and imitate voices, making superficial authenticity checks less dependable.

The defence is to redesign decisions: independently verify unusual requests, require separate approval for consequential transfers and prevent a persuasive conversation from overriding account-recovery controls. Training should support employees with workable procedures rather than instructing them to distrust everything while meeting impossible deadlines.

Cheap exploitation follows another logic. Why discover an unknown vulnerability when exposed systems remain unpatched or credentials are already stolen? In the 2024 Change Healthcare attack, Andrew Witty’s congressional testimony described compromised credentials used against a remote-access portal without multifactor authentication. Ransomware followed nine days later. One missing control helped enable disruption across a vital healthcare intermediary. [10]

Long-term access follows a different clock. A vulnerability is a potential entrance; persistence is an attacker retaining access after entry. Neither necessarily involves a dramatic new piece of malware. Legitimate administrative tools and compromised identities can conceal hostile activity among ordinary operations.

In its 2024 Volt Typhoon advisory, CISA and partners reported access maintained within some victim environments for at least five years, assessing the campaign as preparation for possible disruption of critical infrastructure. That is the logic of strategic optionality: access today becomes leverage tomorrow. [11]

Defenders should therefore map plausible paths from entry to consequence, then test the barriers between them. Which identity can reach which system? Can one supplier’s compromise spread? Would abnormal administration be noticed? Can access be revoked completely? These questions turn adversary modelling into concrete defensive priorities.

4. Use AI to improve defence, and measure the improvement

AI changes the economics of both sides. Attackers can reduce the labour involved in reconnaissance, persuasive messaging and aspects of vulnerability research. Defenders can use it to analyse code, correlate alerts, explain suspicious behaviour and assist investigations. The relevant question is which side converts assistance into dependable operational advantage.

Britain’s National Cyber Security Centre assesses that AI will make elements of intrusion more efficient and increase threats, while also helping developers and system owners secure systems. Its warning is particularly significant for organisations unable to keep pace: technological progress can widen the defensive gap rather than close it. [12]

There is practical evidence of defensive potential. The researchers behind ATLANTIS, the winning system in DARPA’s 2025 AI Cyber Challenge, describe combining language models with established program-analysis techniques to discover and repair vulnerabilities. That combination matters: AI contributes to an engineering process whose outputs can be tested. A competition result is promising evidence, not proof that autonomous security works everywhere. [13]

An alliance should fund access to these capabilities for hospitals, municipalities, smaller businesses and essential open-source projects. Shared protective services and trained regional response teams could distribute benefits beyond wealthy enterprises. The WEF contribution on collective investment makes the underlying point: underfunded organisations support security that many others take for granted. [2]

However, a security agent with extensive privileges can itself become a dangerous point of failure. Untrusted material can attempt to manipulate its instructions. A mistaken response can interrupt operations. Defensive AI needs constrained permissions, auditable actions, tested rollback and human approval where consequences are substantial.

Measure outcomes rather than product purchases: time to detect and contain a genuine intrusion, time to remediate exposed vulnerabilities, false-alarm burden and verified restoration time. Compare performance before and after deployment. A dashboard claiming thousands of blocked threats does not show whether the organisation can survive the attack that succeeds.

The Marks & Spencer incident makes that distinction tangible. In May 2025, the company estimated an approximately £300 million impact on operating profit before mitigation, insurance and trading actions. This was an estimate, not a final universal measure of loss. Its significance is that cyber disruption reaches sales, operations and customers. [14]

Recent attacks teach complementary lessons: Change Healthcare exposes the importance of basic access controls; Bybit demonstrates the financial scale of state-linked theft; Volt Typhoon highlights patient persistence; M&S shows the commercial consequences of interrupted operations. No single product addresses all four. Defence requires prevention, detection, containment and recovery together.

5. Make noncompliance costly while protecting an open internet

A governing alliance without consequences would become another voluntary pledge. Countries that knowingly shelter serious offenders or repeatedly refuse substantiated cooperation requests should face a graduated response.

First should come a documented finding, an opportunity to answer and a funded remediation plan where capacity is the problem. Persistent obstruction should trigger public designation and closer scrutiny of implicated service providers. Proven complicity could justify targeted asset freezes, travel restrictions on responsible officials and procurement exclusions for enabling entities.

Participating states would implement these measures through their own lawful authorities under agreed rules. The alliance would not acquire magical jurisdiction over nonmembers. Its influence would come from coordinated market access, financial controls, evidence sharing and the value of membership. That limitation makes broad participation and consistent standards essential.

Restrictions should target responsible actors and services, with clear conditions for removal. Blanket internet disconnection could harm ordinary people, isolate researchers and strengthen domestic censorship. Punishment that destroys the very openness being defended would be a strategic failure.

Attribution must be disciplined. An internet address alone cannot establish state responsibility. Independent review should examine technical evidence alongside financial, organisational and investigative findings, distinguish confidence levels and allow meaningful challenge. Sensitive intelligence may need protected review, but secret accusation should not become an unanswerable verdict.

Financial controls offer a useful design lesson: make it harder to convert criminal proceeds into usable wealth. Banks, exchanges and payment providers should coordinate lawful freezing and recovery processes across borders. INTERPOL’s 2026 fraud assessment highlights its international stop-payment mechanism and a task force targeting the connections between scam centres, cybercrime and trafficking. Cooperation can interrupt the business model. [7]

The compact must also protect encryption, legitimate anonymity, journalism and good-faith security research. Extradition and evidence requests require safeguards against political persecution. Cybercrime cannot become an elastic label for criticism of a government. An alliance earns legitimacy by protecting people from both criminal intrusion and abusive enforcement.

Above all, members must resist the temptation to excuse useful offenders. If a criminal group is tolerated because it targets rivals, its infrastructure and expertise remain available for wider harm. Selective enforcement rewards the ecosystem everyone else is being asked to dismantle.

Implementation could begin with a coalition willing to publish comparable assessments, fund common capabilities and accept reciprocal inspections of agreed safeguards. An initial programme should prioritise hospitals, water, payments and emergency communications, where interruption rapidly becomes human harm. Annual reviews should report what changed: faster assistance, fewer repeat enablers, stronger restoration capacity and more assets returned to victims. Countries outside the coalition should retain routes to cooperate and join. The objective is to expand dependable protection, not establish permanent digital blocs. A credible alliance must make compliance achievable, demonstrate its benefits and reserve punishment for conduct that warrants it.

The world does not need a checkpoint at every digital doorway. It needs institutions capable of making responsibility travel as readily as connectivity. Borders, passports and financial controls express an imperfect but necessary understanding: shared systems require shared obligations.

Cybersecurity now demands the same political seriousness. AI will make attacks cheaper and can make defence stronger. Whether society benefits will depend on standards, investment and consequences. A global cyber alliance should make those responsibilities concrete: protect your systems, cooperate with others, confront offenders and answer for deliberate failure.

Sources

1. World Economic Forum, How AI is fuelling global cyber fraud and what to do about it, 31 March 2026.

2. Philip Reitinger, World Economic Forum, How collective investment can level cyber resilience for all, 2026.

3. Council of Europe, 24/7 Network established under the Convention on Cybercrime.

4. United Nations Treaty Collection, United Nations Convention against Cybercrime.

5. University of Oxford, World-first Cybercrime Index ranks countries by cybercrime threat level, 10 April 2024.

6. UNODC, Transnational Organized Crime and the Convergence of Cyber-Enabled Fraud, Underground Banking and Technological Innovation in Southeast Asia, 2024.

7. INTERPOL, Global financial fraud threat assessment announcement, 16 March 2026.

8. INTERPOL, African Cyberthreat Assessment Report 2026 announcement, 3 August 2026.

9. FBI, North Korea responsible for $1.5 billion Bybit hack, February 2025.

10. Andrew Witty, Testimony before the US House Energy and Commerce Committee, 1 May 2024.

11. CISA and partners, PRC state-sponsored actors compromise and maintain persistent access to US critical infrastructure, February 2024.