Brad Smith of Microsoft. Free handout.

In a speech at a United Nations event in Geneva on Thursday, Brad Smith, president and chief legal officer of Microsoft Corp. sounded the alarm on cybersecurity and called for the global community, including tech companies, to come together to create a new accord that would help protect civilians and their data.

He said that much like the nations that came together at the 1949 Geneva Conventions following the Second World War to produce international law standards for the treatment of civilians in the context of war, governments and companies need to agree on principles that will keep civilians safe who are caught in the crossfire of cyberattacks.

“The world needs a new digital Geneva Convention, it needs new rules of the road,” Smith said at the Geneva Lecture Series. “What we need, we believe, is an approach that governments will adopt that says they will not attack civilians in times of peace. They will not attack hospitals, they will not attack the electrical grid, they will not attack the political processes of other countries, they will not use cyberweapons to steal the intellectual property of private companies, that they instead will work together to help each other and the private sector respond when there are cyberattacks.”

Smith, who previously pitched this idea at a conference in San Francisco, spoke extensively Thursday on the similarities between cyber warfare and conventional warfare, emphasizing that both are arms races, and involve weapons, though those weapons used by hackers might be “invisible.”

He pointed to the WannaCry ransomware attack on May 12 of this year as a big inflection point for cybersecurity. During that attack, hundreds of thousands of computers were affected in more than 150 countries, according to a report from Europol.

“Think about this,” Smith told the audience, “in the history of our planet, in the course of humanity, has there ever been a single attack by any nation that affected as many other nations simultaneously as that attack did on the 12th of May? I don't think one can find one.”

Smith said that WannaCry proves attacks often have concrete effects on people as well as machines. He pointed to an audit report from the British government that showed that in the U.K. alone, 6,912 people could not get to medical appointments or procedures on May 12 because WannaCry had taken such a toll on the networks at the country's hospitals.

The Microsoft CLO underscored the idea that tech companies have a huge role to play in protecting individuals, as “first responders,” noting that Microsoft spends $1 billion per year on security innovation. But companies, he said, also need governments and advocacy groups to act.

As for what a digital Geneva Convention might look like, Smith said the world “does not have to build off of a blank piece of paper.” He pointed to a section of the UN Charter as well as other bodies of international law, in addition to national cybersecurity policies, as potential sources of inspiration.

“This is so clearly a solution that the world needs,” Smith said of the new digital convention. “It is so clearly a solution that has so many important nuances, that requires that people from government, from the diplomatic community, and academic community, from NGOs and from private businesses address [it] together. We all have opportunities to learn from each other.”

Brad Smith of Microsoft. Free handout.

In a speech at a United Nations event in Geneva on Thursday, Brad Smith, president and chief legal officer of Microsoft Corp. sounded the alarm on cybersecurity and called for the global community, including tech companies, to come together to create a new accord that would help protect civilians and their data.

He said that much like the nations that came together at the 1949 Geneva Conventions following the Second World War to produce international law standards for the treatment of civilians in the context of war, governments and companies need to agree on principles that will keep civilians safe who are caught in the crossfire of cyberattacks.

“The world needs a new digital Geneva Convention, it needs new rules of the road,” Smith said at the Geneva Lecture Series. “What we need, we believe, is an approach that governments will adopt that says they will not attack civilians in times of peace. They will not attack hospitals, they will not attack the electrical grid, they will not attack the political processes of other countries, they will not use cyberweapons to steal the intellectual property of private companies, that they instead will work together to help each other and the private sector respond when there are cyberattacks.”

Smith, who previously pitched this idea at a conference in San Francisco, spoke extensively Thursday on the similarities between cyber warfare and conventional warfare, emphasizing that both are arms races, and involve weapons, though those weapons used by hackers might be “invisible.”

He pointed to the WannaCry ransomware attack on May 12 of this year as a big inflection point for cybersecurity. During that attack, hundreds of thousands of computers were affected in more than 150 countries, according to a report from Europol.

“Think about this,” Smith told the audience, “in the history of our planet, in the course of humanity, has there ever been a single attack by any nation that affected as many other nations simultaneously as that attack did on the 12th of May? I don't think one can find one.”

Smith said that WannaCry proves attacks often have concrete effects on people as well as machines. He pointed to an audit report from the British government that showed that in the U.K. alone, 6,912 people could not get to medical appointments or procedures on May 12 because WannaCry had taken such a toll on the networks at the country's hospitals.

The Microsoft CLO underscored the idea that tech companies have a huge role to play in protecting individuals, as “first responders,” noting that Microsoft spends $1 billion per year on security innovation. But companies, he said, also need governments and advocacy groups to act.

As for what a digital Geneva Convention might look like, Smith said the world “does not have to build off of a blank piece of paper.” He pointed to a section of the UN Charter as well as other bodies of international law, in addition to national cybersecurity policies, as potential sources of inspiration.

“This is so clearly a solution that the world needs,” Smith said of the new digital convention. “It is so clearly a solution that has so many important nuances, that requires that people from government, from the diplomatic community, and academic community, from NGOs and from private businesses address [it] together. We all have opportunities to learn from each other.”