Some argue the Internet may well be the greatest invention ever, bringing together people all over the world with a mere mouse click or touch. And the Internet has brought enormous progress in how we interact, learn, gather information and communicate with each other, nearby or at the other end of the world.

However, the unregulated innovation that made the Internet to the all-pervasive infrastructure it is today also had multiple negative effects that were ignored for too long. Very little new crime was “invited” because of the Internet, however the simplicity with which information can be distributed and user be fooled made the Internet the ideal medium for criminals to exploit victims. Obviously, state actors were quick to pick up on this too and use the Internet both as a well of free information but also as a tool to spy on other nations, or worse.

For a long time, governments have identified specific parts of the economy as “vital” or “critical”, indicating special importance of these services for society and the economy. The distinction “vital” means close cooperation between the government and the vital organizations. Typically, the vital services included infrastructure, power and transport companies and telecom. Relatively recently, Internet and communication infrastructures were also earmarked as vital. In The Netherlands, AMS-IX became part of vital services in 2017 and has been working with the Dutch government keeping The Netherlands connected and safe.

In these times of change (or are we living in changing times) uncertainty is increasing and threats are rising. Specifically threats by state actors are increasing, putting additional pressure on keeping vital services up and running. Different countries take different approaches to protecting their vital infrastructure. In The Netherlands it is based on Public-Private-Cooperation and joint responsibilities. With the advent of new European law and regulation, like NIS2, CSA, DSA, etc. the discussion on how to implement the new rules also leads to discussions on how to protect vital infrastructure going forward. Should government do more or leave it to the private organizations, should there be more oversight and if so, how. How do organizations share critical information like threat intelligence and vulnerabilities without exposing vulnerabilities to nefarious parties.