The legal trail of a cyberattack
A cyberattack brings not only operational disruption but also legal duties: Georgian legislation obliges subjects of critical information systems to identify computer incidents, notify the relevant response teams, and carry out the instructions issued to them. Article 10 of the Georgian Law on Critical Information Systems and Cybersecurity regulates exactly these three pillars: studying, describing and responding to the incident; notification; and compliance with binding instructions. The administrative-liability norm of the same law attaches fines to breach of these duties. Below we examine what is required of each category of subject, whom the incident must be reported to, and what sanctions await a defaulter.
Incident identification and the network sensor
Under point 1 of Article 10, the subject of a critical information system carries out the identification of a computer incident, which includes its study, description and response. For this purpose the subject uses a network sensor, whose configuration rules are set for first- and second-category subjects by order of the head of the Operational-Technical Agency, for third-category subjects by order of the chair of the Digital Governance Agency, and for subjects in the defense sphere by order of the Minister of Defense of Georgia. The configuration rules must exclude access to the substantive content of the subject's communications. For a first-category subject's network, identification of an ongoing incident is carried out by the Operational-Technical Agency's computer incident response team and/or the subject's computer security specialist — the state and the subject act in parallel at this stage.
Notification — to whom, when and how
Identification of a computer incident is immediately notified: for first- and second-category subjects — to the Operational-Technical Agency's computer incident response team; for third-category subjects — to the Digital Governance Agency's team; and for subjects in the defense sphere — to the Cybersecurity Bureau's team. To store and protect incident information, the subject takes emergency measures where necessary. The response team studies, describes and responds to the incident, and after study submits binding instructions for execution. An instruction cannot include an obligation of access to a second- or third-category subject's network sensor, information asset, system or infrastructure — the subject's property is not left exposed through this route. The subject must respond to the instructions within a reasonable period and submit information on the measures taken to the relevant team.