Data Disaster – A new threat for sovereignty

The 2022 ransomware attacks on Costa Rica had a profound impact on the functioning of its government. From compromised ministries and economic setbacks to a healthcare crisis and the declaration of a state of emergency, the government faced multifaceted challenges. During the last 20 years governments around the world have started to deliver more and more services digitally using the internet and various digital platforms. When considered in tandem with the frequent occurrence of destructive cyber incidents that have caused crippling affect to various public sector organizations, and which increasingly target critical infrastructures and key state resources, an unsettling reality is revealed, one in which nations are becoming extremely vulnerable to hostile cyber incidents and attacks. In this article we introduce and coin a new type of disaster definition, a “data disaster”. A data disaster is the result of a cyber-attack affecting national-level data that can lead to a market failure, the ruling government inability to rule or govern, compromised national sovereignty, and even to social or civil unrest. In this paper we refer to such a situation as ‘Denial-of-Governance’. Given the potential impact of a Data Disaster on a nation's security, stability, and sovereignty, we argue that such a potential event requires a specific and comprehensive legal and institutional framework that would enable and empower the state and its relevant actors to deal with such events effectively and efficiently. We also suggest some possible elements of such a framework, such as clear definitions, criteria, and processes for declaring, managing, and terminating a Data Disaster.