In an age where digital warfare and cyber espionage have become commonplace, institutions such as libraries and museums are engaged in an asymmetric battle against well-resourced adversaries. The massive ransomware attack on the British Library last October should ring alarm bells for knowledge repositories around the world.
THE Rhysida ransomware group The attackers are believed to be behind the attack stolen user data and employee information. The attackers leaked low-resolution images of employee passports and downloaded nearly 600 GB of leaked material online. The ransom demand was for 20 bitcoins, or around $750,000 (£600,000). The attack highlights a disturbing trend: Libraries and other knowledge resources around the world are vulnerable to digital attacks that have effects that go beyond simple data loss. The loss or manipulation of the knowledge stored within these institutions could have far-reaching implications for history, culture, and even the global political landscape.
Traditionally considered physical sanctuaries of knowledge, institutions such as the British Library, the Library of Congress in the United States and the Bibliothèque nationale de France are increasingly transferring their vast collections of rare manuscripts and historical documents into digital formats for preservation and wider public access. . The reliance on technology for online activities, digital exhibitions, and interactive experiences via wireless networks has democratized access to knowledge and opened new avenues for cybercriminals to exploit vulnerabilities.
Digitalization carries greater risks
The cyber attack on the British Museum is part of a wider trend of increasing cyber threats against cultural institutions. One notable incident involved anonymous hackers accessing the personal data of donors to several hundred cultural institutions in the UK and US, including the Smithsonian Institution and the Corning Museum of Glass. This breach was carried out via a third-party cloud software company and resulted in the exposure of hundreds of people’s personal information. Additionally, the American Museum of Natural History and four major London tourist attractions, including the Tate and the Natural History Museum, have suffered cyber breaches, with millions of attacks recorded in three years.
The battle is even more unequal when state-sponsored entities equipped with sophisticated tools and resources are involved. These attackers not only pursue financial gain, but are motivated by a desire to control, manipulate, or erase historical narratives and cultural identities. In some cases, the goal is to steal intellectual property for strategic advantage.
“Public institutions, such as libraries, are rarely equipped with sufficient budget, staff, or other resources to effectively resist large, advanced attacks carried out by a variety of nation states,” says Josh Chessman, a tech evangelist and former Gartner analyst .
Guarantee cultural institutions
One of the crucial challenges these institutions face is the lack of resources, both financial and technical, to adequately defend against cyber threats. While large companies and government bodies often have significant budgets for cybersecurity, libraries and museums, despite their importance, do not have the same level of funding or expertise.
“Libraries and the like can’t afford to pay what Google can pay,” Chessman notes.
Furthermore, the open, public-service nature of these institutions makes them inherently more vulnerable. They are designed to provide access to information that may conflict with the rigorous security measures needed to protect against cyber attacks.
As museums continue to adopt new technologies, experts highlight the importance of ensuring that security measures grow and mature in line with innovation. Regularly scanning for vulnerabilities, training staff on safer remote working practices, identifying phishing scams and complying with data protection laws are crucial steps in mitigating these risks.
The responsibility for ensuring these institutions also lies with governments and other organizations. One approach could involve increased funding for cybersecurity measures, public-private partnerships to provide expertise and resources, and global cooperation to address the cross-border nature of cyber threats.