Critical Swiss infrastructure ‘must report cyberattacks’

Attacks on key Swiss infratructure targets are in the rise. Keystone / Ritchie B. Tongo

The Swiss government wants to impose a mandatory duty to report cyberattacks on the operators of critical Swiss infrastructures, such as airports and energy grids.

Parliament has been asked to amend the Information Security Act to help the National Cybersecurity Centre (NCSC) perform its work.

“The general public, authorities and companies are exposed to the risk of cyberattacks on a daily basis. There is currently no overall picture of what attacks have taken place where,” the government stated on Friday.

“Mandatory reporting will provide the NCSC with a clearer picture of the cyberattacks that have occurred in Switzerland and the modus operandi of the attackers. This will allow the threat situation to be assessed more accurately, and the operators of critical infrastructures can be warned at an early stage.”

Switzerland is subjected to an increasingly large volume of cyberattacks, most of which are detected and neutralised.

Swissport, the world’s largest airport ground services and cargo handling company, was targeted by ransomware hackers in February. Swiss Federal Railways was hacked the previous month, while several towns, cities and universities have also been targeted.

More alarmingly, Swiss defence contractor Ruag was hacked in 2014 but the attack was not spotted for two years.

The NCSC was created in 2019 to coordinate the country’s cyber defences and as a central reporting office for attacks.

The government now plans to move the NCSC from the finance ministry to the defence ministry and upgrade it to a full federal agency.