While digital tools have brought new opportunities to enhance health and well-being, they have also created new health security risks, such as cyber-attacks on health care and disinformation. To provide a clearer understanding of these risks and to reduce their likelihood and severity, WHO produced two reports, in collaboration with INTERPOL, the United Nations Office on Drugs and Crime (UNODC), the UN Office of Counter-terrorism, the UN International Computing Centre (UNICC), the UN Interregional Crime and Justice Research Institute, and the CyberPeace Institute.
Published on 26 January 2024, the two reports identify ways to strengthen health security through operational solutions.
The first report, Examining the threat of cyber-attack on health care during the COVID-19 pandemic highlights the far-reaching real-life impacts of cyber-attacks on health care. During the COVID-19 pandemic, health information technology (IT) infrastructure was increasingly targeted by cyber-attacks, at times hindering hospitals from delivering timely care when it was needed most. To restore IT systems and retrieve stolen data, health care facilities paid substantial ransoms. These attacks prompted law enforcement agencies to issue warnings about the threat of cyber-attacks to the health sector.
"Cybercrime in all its forms is evolving and growing. The COVID-19 pandemic made this visible," said Glen Prichard, Chief of Cybercrime and Anti-Money Laundering section at UNODC. "The report highlights how vulnerable patient safety is to cyberattacks, and how much work we all have ahead to secure lives."
Health systems globally have turned to digital solutions to enhance the clinical quality and the cost-efficiency of their services. This has created digital dependence, which has advanced, sometimes without careful consideration of new risks and appropriate investment in cyber-security. Sensitive information held by health services, coupled with inadequate security, makes health care infrastructure a prime target for cyber-criminals.
"This report is a wake-up call," said Sameer Chauhan, Director, UNICC. "As the primary provider of shared cybersecurity services to the UN system, UNICC stands on the frontlines protecting our UN family against sophisticated cyber-attacks. We welcome WHO's suggestion for Member States to bolster cybersecurity in the health care sector by leveraging shared cybersecurity capabilities, similar to UNICC's shared threat intelligence and cybersecurity resources for the UN system. We stand ready and eager to guide them in this regard."
To address the growing digital risk to health care, it is important to enhance cyber-maturity. Cybersecurity maturity is an organization's level of readiness to defend itself and its digital assets against cyber-attacks. This involves investing in people, processes and technology, including through cyber-awareness training and development of incident response plans to be rehearsed by staff in anticipation of a cyber-attack. It is critical to increase communication and collaboration with law enforcement agencies (e.g., police, INTERPOL), governmental agencies (e.g., cyber-security agency, public health institute, national agency for the safety of medicines and health products, nuclear safety agency), private sector and non-governmental organizations; these entities can provide alerts and warnings about ongoing cyber-attacks.
The second report, Understanding disinformation in the context of public health emergencies: the case of COVID-19, reflects on different approaches to counter disinformation. Disinformation, unlike misinformation, is created with malicious intent to sow discord, disharmony, and mistrust in targets such as government agencies, scientific experts, public health agencies, private sector, and law enforcement. In other words, disinformation is a weaponization of information.
Understanding infectious disease disinformation history and its intersection with public health over time is crucial to formulate effective solutions to counter disinformation. The report examines different types of pandemic disinformation over time, and how perpetrators exploit the audience's cognitive mechanism. As part of a broader and long-term ideological or political agenda, or for economic gain, some disinformation messages are professionally crafted and proliferated, requiring WHO and public health partners to be equipped with multi-faceted approaches to counter these threats.
The report proposes a range of tactics to counter disinformation:
- raising awareness of disinformation and information manipulation;
- promoting critical thinking;
- promoting digital, health and scientific literacy programmes;
- promoting trusted sources of information and voices of authority;
- supporting fact-checking activities which include the use of fact-checking technologies and human fact-checkers;
- working with relevant stakeholders, such as the security sector, social media providers, law enforcement, cyber agencies, NGOs, and international organizations to tackle this new threat; and
- identifying drivers of (mis)trust in populations, and how those drivers are exploited to create disinformation campaigns. These drivers can inform long term solutions to guard against disinformation. When encountering new information, everyone should ask themselves:
- Is this content reliable?
- Who is the author?
- What is the source of the claims?
- Is the information outlet reliable?
- How do I feel about this piece of information?
The reports justify the critical need to build multisectoral alliances that can harness the benefits of new technologies for improved health and well-being while facing constantly emerging threats.
