law enforcement and CI owners. However, at present CERT-IS have neither the mandate nor the resources to do so for the entire CI sector. D2.5 MEDIA AND SOCIAL MEDIA This factor explores whether cybersecurity is a common subject across mainstream media, and an issue for broad discussion on social media. Moreover, this aspect speaks about the role of media in conveying information about cybersecurity to the public, thus shaping their cybersecurity values, attitudes and online behaviour. Maturity Stage: Formative There is ad-hoc media coverage of cybersecurity, with very limited information provided and reporting on specific issues that individuals face online, such as cyber-bullying. Overall, discussions on social media about cybersecurity are also limited. Social media platforms such as YouTube, Facebook, Twitter, and international blog-hosting services are freely available and are used by a large part of the population35. The Media Commission36 is an independent administrative committee under the Ministry of Education, Science and Culture (MoESC). According to the Media Law, it carries out a supervisory function [to ensure editorial independence of media] and attends to day-to-day administrative tasks in the fields covered by the law. Review participants noted that due to potential reputational harm, incidents within the private sector are often not disclosed. According to the Crime & Safety Report (2017)37, in 2013 Iceland suffered its first serious cyber-attack when a major telecommunication carrier was hacked, and detailed personal information on hundreds of Icelanders was released on the Internet. In 2015, the servers of several small, private institutions were attacked, and hackers aligned with ISIS targeted the computer network of a private missionary organisation. In November 2015 and in January 2016, in a demonstration against Iceland’s support of commercial whaling, the websites of the Icelandic government were attacked by the hacker collective Anonymous. Traditional media and social media reported about this attack, for example Iceland Review38, Grapevine39, the Hacker News40. These incidents raised the general public awareness. However, participants noted that journalists too do not necessarily understand cybersecurity issues and might misinform the public, and perhaps create fear. 35 https://freedomhouse.org/report/freedom-net/2016/iceland http://fjolmidlanefnd.is/english/ 37 https://www.osac.gov/Pages/ContentReportDetails.aspx?cid=21376 38 http://icelandreview.com/news/2015/11/30/increasingly-dangerous-internet-attacks-iceland 39 https://grapevine.is/news/2015/12/09/vodafone-falls-prey-to-cyber-attack/ 40 http://thehackernews.com/2013/11/vodafone-iceland-hacked-and-exposed.html 36 36 | Cybersecurity Capacity Review Iceland, 2017