Securing Iceland's digital future: A call for political action

Iceland, the land of ice and fire, is a country of contrasts and rare challenges that foster interesting internet policy perspectives. Iceland has one of the world’s oldest parliaments, strong democratic values and is a global leader in eGovernance, cyber-democracy, and ICT. With a large N-Atlantic jurisdiction and a small population of nearly 400,000 inhabitants, Icelandic authorities shoulder the responsibility of protecting its communication infrastructure which, in addition to a developed IT industry, includes popular global hosting services and a massive amount of passing aerospace and oceanic traffic. However, as Iceland currently relies on four main cables for connection to the global internet and communication systems, it is uncomfortably vulnerable to threats in a globalised world marked by escalating cyber-conflicts and creative criminality.

Communication weaknesses

For over a decade 97% of Icelanders have been daily internet users with slightly fewer seeking daily online news (Statistics Iceland, n.d.; “97% Landsmanna Nota Netið”, 2011). Interestingly, Iceland’s privately owned news portals have assumed a greater role in digital crisis communication than the state broadcast company RÚV, the only news-outlet to be formally defined as critical infrastructure (“RÚV”, 2024). Recent attacks on mbl.is have revealed the need to view major news outlets as critical infrastructure and define the digital security of a free press as one of the cornerstones of democracy (Einarsdóttir, 2024; Másson, 2024).

The execution of RÚV’s online-communication policy matches poorly with its official mandate (Fjölmiðlanefnd, 2023), especially concerning services for non-natives who are largely left out of the national news-cycle and public discourse. Currently RÚV prioritises traditional broadcast and cultural obligations, while treating its online presence like a secondary content outlet instead of a primary service concerning national security. This approach poses a serious threat to Iceland’s internal security when accurate information needs to reach the whole population swiftly. Equally concerning is RÚV’s reluctance to respond to criticisms regarding their accessibility policy, information structure, and digital interfaces (Ríkisútvarpið, 2022).

Experience from Covid-19 and the war in Ukraine show that Iceland’s relatively large population of 62,000 immigrants is vulnerable to targeted misinformation and digital polarisation. Growing online extremism indicates a wide range of issues that require diverse approaches beyond traditional technical views of cybersecurity (Swann, 2024). The University of Iceland has yet to embrace the goals set forth in Iceland’s Internet Security Policy (Ministry of Higher Education, Science and Innovation, 2022a) and put focus on academic research on issues relating to information security and digital social-sciences. The University of Iceland needs to shape up its approach to digital social sciences and systematically strengthen its international exchange-study programs to enable students of diverse scientific bacgrounds to seek this critical knowledge abroad while local offerings are being developed.

Over-reliance on foreign allies

International cooperation has had a fundamentally positive influence on Icelandic internet governance and law, most significantly through ratifications of EU mandates such as the GDPR and Digital Services Act. The EEA has supported Iceland’s vital participation in cyberspace, but foreign help and influences have also allowed Icelanders to neglect their own role in shouldering its own cyber-defences. Iceland is currently being bombarded with technical and psychological cyberattacks and the nation finds itself at a junction where decisive government action is needed (Arnardóttir, 2023).

The problem is historical and lies in Icelandic culture; since joining Norway in 1262 Iceland has mostly outsourced its defences (Þorsteinson & Jónsson, 1991) and as a principled army-free nation there is general public disdain for foreign or domestic military presence and organisation (Valur Ingimundarson, 1999). Iceland gained independence from Denmark in 1944 while under US occupation and was hard-pressed to become a founding member of NATO to secure allied dominance over the N-Atlantic. The US military brought Iceland much-needed infrastructure, including roads, airports, and means of modern communication (Hálfdanarson & Kristjánsson, 1993). NATO membership is critical to Iceland’s security but has enabled the nation to neglect its own defence responsibilities. When the US army presence ended in 2006 Iceland was forced to shoulder more of its defence expenses and lean towards Europe for support, yet discussions about its own security commitments never entered the public debate. NATO protection has allowed many Icelanders to hold the extraordinarily naïve position to oppose army-equivalent defence agencies – an utterly unsustainable stance as Iceland is increasingly targeted on par with other NATO nations in the 5th battlespace.

Rethinking Iceland’s national security

Recently Iceland has been under an onslaught of progressively disruptive and costly cyberattacks that demand a change in security culture and defences. Ransom-attacks increasingly threaten businesses, media, and government agencies while the public is exceedingly targeted with phishing and scams (Arnardóttir, 2023). Recent advances in AI linguistics are essential tools to preserve the Icelandic language and support all resident’s full participation in cyberspace, but as AI opens Icelandic society to non-native speakers, it also makes the public vulnerable to sophisticated and costly scams. While current cybersecurity policy is making strides in the right direction it is critical that Icelandic politicians dare take a public stance to redefine Iceland’s national security and formulate a defence strategy that prioritises digital communication and critical infrastructure, recognizing that Iceland’s threats and challenges are different from our allies who are physically closer to foreign adversaries. (Reykfjörð Gylfadóttir, 2024; Ministry of Higher Education, Science and Innovation, 2022b; Ministry of Higher Education, Science and Innovation, 2023)

The stigma of an “Icelandic army” needs to be eradicated to support local talent and civic agencies that are currently pleading for increased attention, support and resources. With notable exceptions such as the Minister of Higher Education, Science and Innovation, politicians have yet to realise the gravity of the situation and are hesitant to engage in public defence discussions. Much needed work has been conducted within key agencies such as the Electronic Communications Office and particularly the Ministry of Higher Education, Science and Innovation – but that’s simply not enough. With internet policy and cybersecurity spread across agencies under at least four ministries, it is essential to foster internal, external, and international cooperation and give the current minister of MHESI a mandate to lead a change in Iceland’s internet policy. Legal and institutional barriers need to be removed to enable private and public entities to enact efficient national cyber-defences and the public must be engaged in this discussion. One of those barriers is lack of legal mandates for the authorities to monitor – within reason – traffic aimed at critical infrastructure. Taking lessons from the Nordics, EU and NATO allies, the Icelandic parliament must spearhead public security reforms as part of the nation’s eGovernment strategy and better empower its skilled and willing workforce in defending Iceland.