National Cyberstrategy (NCS) In the world of cybercrime, specialist lines of business develop in which organised groups operate based on a division of labour. Due to intense competition, the pressure for innovation among criminal actors is high, which is why attackers are constantly developing or acquiring new methods and becoming increasingly professional. Accordingly, a further increase in the frequency and specialisation of criminal activities in cyberspace is to be expected. Cyberespionage: In cyberespionage, cyberattacks are used to gain unauthorised access to information or to monitor the activities of victims for political, military or economic purposes. After successfully breaching networks, attackers often try to remain undetected for as long as possible. Complex and persistent attacks, known as advanced persistent threats (APTs), are typical of such activities. Cyberespionage is often carried out by state actors, but also by semi-state or non-state actors. The attackers focus on companies as well as governmental, social and international institutions. The Swiss economy is one of the most innovative in the world, and many international companies have their headquarters or important data centres here. Switzerland is also home to many international organisations and frequently hosts international negotiations and conferences. This makes it an attractive target for cyberespionage. The impact can vary greatly depending on the type and volume of data the attackers gain access to. However, for SMEs that are heavily dependent on their ability to innovate, it can quickly take on proportions that pose an existential threat. The impact is usually not immediately apparent, since political and economic disadvantages arise only when the attackers make use of the knowledge they have acquired. Moreover, collateral damage often occurs in the aftermath of such operations as cybercriminals make secondary use of the attack vectors. With the rise in geopolitical tensions, cyberespionage is also gaining in importance. The threat is further exacerbated by the fact that governments are exerting influence on manufacturers of ICT products. This increases the likelihood of security vulnerabilities being left in products deliberately. As the supply chains for ICT products are very complex and Switzerland is highly dependent on foreign manufacturers, adequately addressing this threat is a major challenge. Cybersabotage: Cybersabotage refers to the activity of using cyberattacks to manipulate, disrupt or destroy the reliable and error-free functioning of ICT; depending on the type of sabotage and the target attacked, this may also have physical effects. The motivation for such attacks can vary considerably. They may be carried out by lone perpetrators, motivated by ideological convictions or personal frustration for example, or they may be used by state actors to achieve political or military goals. The aim in each case is to demonstrate power and to intimidate, with the intention of destabilising an organisation or even society as a whole. While various major acts of sabotage have been observed internationally, including against countries' energy supplies, none have so far taken place in Switzerland. However, with the rise in geopolitical tensions, Switzerland too is more likely to be affected. The potential damage is very great. Cybersubversion: Cybersubversion is when state, state-affiliated or politically motivated actors use cyberattacks specifically to undermine the political system of another country. Such attacks target, for example, the workings of democratic processes, political institutions and organisations of high public interest. In this way, the attackers try to undermine trust in the state, often combining these attacks with disinformation campaigns. Cyberoperations in armed conflicts: The use of regular and irregular means in armed conflicts is now common practice. Cyberoperations are particularly suitable for this because they are difficult to attribute conclusively, cost comparatively little, can be employed over any distance without any physical presence, and can have an impact even without any direct connection to military operations. The considerable investments made by many states in protecting and actively defending themselves against cyberthreats underscore the importance of cybermeans in armed conflicts. Accordingly, the importance of targeted cyberoperations for power-political purposes is expected to increase further. In order to prevent such activities, Switzerland must 5