Governments and organizations that fail to build strong cyber capabilities will be particularly vulnerable in this new era. ― Roger Spitz,
Why Now?
Sri Lanka, it would appear, is once again attempting to align itself with the exigencies of a rapidly transforming technological order. In a recent parliamentary exchange, the Digital Economy Deputy Minister, Eranga Weeraratne, indicated that the State is now moving with some urgency to formulate a comprehensive cybersecurity architecture, in light of the escalating incidence of cyber-attacks and the acknowledged inadequacy of existing legal frameworks to address such threats.
The Deputy Minister informed Parliament, in response to questions raised by New Democratic Front MP Ravi Karunanayake under Standing Order 27/2, that a proposed Cyber Security Act is presently in draft form. It is envisaged that this legislative instrument, together with a new cyber law and the establishment of a dedicated “Cyber Crimes Regulatory Authority,” will be enacted by the end of the year. The objective, as articulated, is to respond more coherently and decisively to the growing spectrum of cyber threats confronting the State.
At the core of this policy articulation is an important epistemic shift: cyber security is now explicitly recognized as implicating not merely technical infrastructure, but the very sinews of national security, economic stability, public confidence, and digital sovereignty. This is a significant departure from earlier regulatory silos, and it reflects an emerging understanding that the digital domain is no longer ancillary to governance but integral to it.
The Deputy Minister further underscored that the rapid expansion of digital public services—ranging from payment systems and identity verification processes to cloud-based infrastructures and citizen-facing platforms—has simultaneously expanded the attack surface available to malicious actors. In this sense, technological progress and vulnerability have become coextensive phenomena, each feeding into the other.
It was also acknowledged that Sri Lanka presently operates without a mandatory legal obligation requiring the reporting of cybersecurity incidents to the Sri Lanka Computer Emergency Readiness Team (SLCERT). The proposed legislative framework is expected to remedy this lacuna by instituting a coordinated national cyber resilience model, supported by regulatory oversight, procedural guidelines, and awareness mechanisms. In this evolution, one observes a discernible shift from a reactive posture to one of structured anticipation—an attempt, however belated, to govern risk in a domain defined by speed, opacity, and asymmetry.
Cyber Security and Outer Space
In an earlier essay in the Sri Lanka Guardian I addressed the outer space policy that will be adopted by Sri Lanka in the near future. Cyber security laws, when enacted in Sri Lanka, would be compelled to associate themselves with the country’s outer space policy.
By any contemporary measure of human progress and civilizational aspiration, the convergence of communications technology, satellite-based navigation systems, and space transportation represents not merely an extension of engineering capability, but a redefinition of the human condition itself. What was once confined to the speculative imagination of philosophers and science fiction writers has, within a few decades, become an operational reality embedded in the everyday functioning of States, markets, and individuals. The global navigation satellite systems that now guide aircraft across oceans, ships across straits, and mobile devices in the hands of citizens are not merely instruments of convenience; they are the invisible architecture of modern sovereignty, commerce, and security.
In parallel, space transportation—once the exclusive domain of Cold War rivalry and scientific prestige—has evolved into a commercial and increasingly democratized frontier. Private actors now enter a domain that was formerly monopolized by States, and space tourism, once dismissed as fantasy, has become a lived experience for a select but growing number of individuals. This transformation signals not only technological maturity but also a profound epistemic shift: outer space is no longer “out there” as a distant abstraction, but “in here,” intimately tied to economic systems, geopolitical competition, and legal imagination.
It is within this expanded cosmological and technological horizon that one must situate the strategic considerations of a developing State such as Sri Lanka. For Sri Lanka, geography has always been destiny, but in the twenty-first century, geography is being reinterpreted through the prism of orbital infrastructure, cyber connectivity, and digital sovereignty. The island is no longer merely a node in the Indian Ocean maritime network; it is potentially a node in a far more complex lattice of space-based communications, satellite surveillance, digital finance, and transnational data flows.
The reflections of Stephen Hawking become particularly relevant in this context, not because they belong to speculative astrophysics alone, but because they reframe human existence within an immense and probabilistic universe. His observation that, in a cosmos comprising billions of galaxies, each containing hundreds of millions of stars, it is statistically implausible that life exists only on Earth, is not merely a scientific conjecture. It is a philosophical provocation that compels humanity to rethink its technological trajectory. His further suggestion—that advanced civilizations might evolve into resource-exhausted nomads traversing planetary systems—introduces a narrative in which mobility, scarcity, and technological adaptation define existential survival.
While such reflections may appear remote from the immediate policy concerns of a small State, they in fact reinforce a central strategic insight: technological advancement does not occur in isolation from existential risk. The same systems that enable global connectivity also introduce systemic vulnerabilities. The same satellites that guide navigation also expose States to surveillance and disruption. The same digital infrastructures that facilitate commerce also create vectors for cyber intrusion.
It is in this duality that Sri Lanka’s strategic challenge must be understood. The island’s economic progress is increasingly dependent upon digital infrastructure, foreign direct investment in technology sectors, and integration into global information systems. Yet this integration is not neutral. It is accompanied by exposure to cyber threats, data exploitation, and asymmetric forms of interference that do not respect territorial sovereignty in the traditional sense.
The experience of advanced economies demonstrates that cyber insecurity is not a peripheral issue but a central national security concern. The early incidents involving the systems of National Aeronautics and Space Administration, where denial-of-service attacks disrupted network functionality, serve as historical markers in the evolution of cyber conflict. These events demonstrated that even highly sophisticated technological infrastructures are vulnerable to relatively low-cost interventions. Similarly, penetrations of unclassified networks within defense establishments illustrated the permeability of digital borders and the fragility of informational sovereignty.
For Sri Lanka, the implications are profound. As the country accelerates its digital transformation—through e-governance platforms, digital identity systems, fintech ecosystems, and cloud-based public services—it simultaneously expands its attack surface. The economic benefits of digitization are therefore inseparable from the security risks it introduces. This dialectic between opportunity and vulnerability must be addressed not through reactive regulation alone, but through an integrated national strategy that aligns economic policy, defense doctrine, and technological governance.
At the heart of such a strategy lies the recognition that cyber security is no longer a technical sub-domain but a structural component of economic sovereignty. The integrity of financial systems, the reliability of public administration, and the credibility of digital markets depend upon the assurance that data flows are protected, resilient, and legally governed. Without such assurance, investor confidence deteriorates, public trust erodes, and the state’s capacity to participate in global digital markets is diminished.
It is therefore imperative that Sri Lanka conceptualize cyber security not as an administrative function but as a strategic national asset. This requires institutional architecture that transcends traditional ministerial silos. A coordinated cyber resilience framework must integrate intelligence services, telecommunications regulators, financial oversight bodies, and defense establishments into a coherent operational matrix. The establishment of a central authority for cyber regulation, incident response, and compliance monitoring is not merely desirable; it is essential to the preservation of digital sovereignty.
Yet institutional design alone is insufficient. The economic dimension of cyber strategy must also be addressed. Sri Lanka’s aspiration for economic progress increasingly depends on its ability to position itself as a regional hub for digital services, data processing, and knowledge-based industries. This requires not only infrastructure investment but also regulatory predictability, legal harmonization with international standards, and trust in the country’s digital ecosystem.
In this regard, space-based technologies also assume indirect but significant relevance. Satellite communications underpin global financial systems, logistics networks, and disaster management frameworks. For an island State exposed to climate variability and maritime vulnerabilities, access to reliable satellite data is not a luxury but a necessity. The integration of satellite-derived information into agricultural planning, coastal surveillance, and urban development can materially enhance economic resilience.
Moreover, the emergence of aerospace transportation technologies—where atmospheric flight merges with orbital mechanics—suggests a future in which distance is compressed to near insignificance. A journey that once required intercontinental flight durations of over fifteen hours may, in theoretical constructs, be reduced to a matter of hours or less. While such technologies remain in developmental stages, their conceptual existence underscores a broader truth: the economics of distance is being fundamentally rewritten.
For Sri Lanka, situated at a strategic maritime crossroads, this transformation carries both opportunity and risk. The opportunity lies in becoming a logistical and technological node in emerging transport and communications architectures. The risk lies in marginalization if the State fails to integrate itself into these evolving systems. In a world where mobility is increasingly orbital and digital, insularity becomes a liability unless compensated by strategic connectivity.
However, the expansion of technological capability also generates corresponding security anxieties. Cyber-terrorism, as an evolving modality of conflict, is particularly destabilizing because it operates without physical presence, often without attribution, and at minimal cost. It is precisely this asymmetry that makes it attractive to non-state actors and, in some cases, state-aligned proxies. The ability to disrupt critical infrastructure—whether in aviation systems, financial networks, or satellite communications—represents a form of coercive power that bypasses traditional military deterrence.
This raises a fundamental question of international law and order. The United Nations, through its foundational charter, recognizes the maintenance of international peace and security as its primary purpose. The relevant provisions emphasize collective measures for the prevention of threats to peace and the suppression of acts of aggression. Within this normative framework, cyber operations that disrupt critical national or transnational systems may be conceptualized as threats to peace, even if they do not conform to classical definitions of armed attack.
In this sense, cyber insecurity challenges the epistemological boundaries of international law. It forces a reconsideration of what constitutes aggression, what constitutes sovereignty, and what constitutes responsibility in a digitally interconnected world. For Sri Lanka, participation in this evolving legal discourse is not optional. It is a necessity if the country is to safeguard its interests within multilateral frameworks and ensure that its vulnerabilities are recognized within global governance structures.
Application
A coherent national strategy must therefore operate at three interrelated levels. At the domestic level, it must establish robust cyber legal frameworks, institutional coordination mechanisms, and public awareness programs that cultivate digital literacy and resilience. At the regional level, it must engage with neighboring States to develop cooperative security arrangements, information-sharing protocols, and joint response mechanisms to cyber incidents. At the international level, it must actively participate in norm-setting processes that define the legal boundaries of cyber conduct, space utilization, and digital sovereignty.
Economic progress in Sri Lanka will increasingly depend upon its ability to navigate this triadic structure of governance. Investment in digital infrastructure must be matched by investment in security infrastructure. Expansion of e-commerce must be accompanied by expansion of regulatory oversight. Integration into global data networks must be balanced by safeguards for national informational autonomy.
Ultimately, the challenge is not merely technological but philosophical. It concerns the manner in which a small State situates itself within an expanding universe of technological possibility and geopolitical uncertainty. The reflections of Hawking remind us that humanity itself is a species in motion, potentially destined for expansion beyond its planetary origin. Yet before such cosmic horizons can be meaningfully engaged, States must first secure their terrestrial foundations.
For Sri Lanka, the path forward lies in recognizing that space, cyberspace, and economic space are no longer distinct domains. They are interwoven dimensions of a single strategic environment. To ignore this integration is to risk strategic obsolescence. To embrace it is to position the country within the emerging architecture of twenty-first-century power, where sovereignty is defined not only by territory, but by connectivity, resilience, and technological intelligence.
In this evolving order, security and development are not competing objectives but mutually constitutive imperatives. The future of Sri Lanka will depend upon its capacity to transform vulnerability into resilience, and resilience into opportunity.
My Take
My take is that Sri Lanka now stands at a rather unusual inflection point in its post-independence trajectory, where three historically separate domains—economic development, national security, and technological modernization—have converged into a single continuum of strategic necessity. In earlier eras, these spheres could be treated as discrete policy compartments: economic policy belonged to ministries of finance and planning; security was the province of defence establishments; and technology was often relegated to the margins of administrative attention. That conceptual luxury is no longer available. The contemporary State is increasingly required to think in integrated terms, where the failure of one domain immediately transmits risk into the others with exponential effect.
In this sense, Sri Lanka’s current policy inclination towards space policy, cyber legislation, and digital economy expansion is not merely administrative coincidence. It is, whether consciously articulated or not, an acknowledgement that sovereignty in the twenty-first century is mediated through invisible infrastructures. These infrastructures are not limited to roads, ports, or airports, but extend into orbital systems, data architectures, and algorithmic governance frameworks that condition the movement of capital, information, and strategic influence. The State that does not inhabit these domains meaningfully does not disappear, but it becomes structurally dependent upon those that do.
What is particularly significant is that Sri Lanka’s engagement with these domains is occurring at a time when the global system itself is in a state of technological flux. Space is no longer the exclusive domain of superpower rivalry; it is increasingly commercialized, privatized, and fragmented. Cyber space is no longer a neutral communication environment; it has become a contested theatre of influence, disruption, and asymmetric coercion. Digital economies are no longer supplementary to “real economies”; they are the very substrate upon which financial, commercial, and administrative activity is now constructed. It follows, therefore, that policy responses must be calibrated not to a static model of international relations, but to a fluid and continuously mutating technological ecosystem.
In my view, Sri Lanka’s most immediate challenge is not the absence of ambition but the risk of fragmented ambition. The articulation of a space policy on one hand and cyber legislation on the other is commendable, but if these initiatives evolve in institutional isolation, they risk becoming symbolic rather than strategic. The deeper requirement is coherence: a unified conceptual framework in which space-based infrastructure, cyber governance, and digital economic development are treated as interdependent components of a single national architecture of resilience and growth.
It is here that one must be cautious about the tendency of developing States to adopt what may be described as “legislative mimicry”—the rapid importation of legal and policy instruments from advanced jurisdictions without the accompanying institutional maturity or enforcement capacity. Cyber laws, for instance, are not self-executing instruments. Their effectiveness depends on technical expertise, inter-agency coordination, judicial literacy in digital matters, and a culture of compliance that extends beyond formal prohibition. Similarly, space policy without indigenous capability development risks becoming aspirational rhetoric rather than operational strategy.
At the same time, it would be analytically incorrect to assume that small States are destined to remain passive recipients of technological order. On the contrary, the history of international aviation law and telecommunications regulation demonstrates that norm entrepreneurship is not exclusively the privilege of great powers. States that are strategically positioned—geographically or diplomatically—can exert disproportionate influence in shaping regulatory regimes, provided they engage early and consistently. Sri Lanka’s geographical position in the Indian Ocean gives it a latent advantage in maritime surveillance, satellite data reception, and regional connectivity frameworks, but this advantage must be translated into institutional presence.
The more profound issue, however, is conceptual. The modern State must reconceptualize security not as the absence of physical threat but as the assurance of systemic continuity. A cyber intrusion that disrupts financial transactions, a satellite malfunction that impairs navigation systems, or a data breach that undermines public trust in digital identity systems—all of these constitute disruptions of sovereignty in forms that classical security doctrine does not fully capture. In this expanded definition, security becomes indistinguishable from economic stability and technological reliability.
This is why I have consistently argued, in various contexts, that law and technology can no longer be treated as parallel tracks. They are now interwoven strands of the same normative fabric. International law, in particular, is undergoing a slow but irreversible transformation as it attempts to grapple with domains that were not envisaged at the time of its foundational architecture. Concepts such as territorial jurisdiction, state responsibility, and use of force are being stretched to accommodate phenomena that are non-territorial, non-linear, and often non-attributable.
Sri Lanka’s engagement with these developments must therefore be both defensive and proactive. Defensive, in the sense of protecting its critical infrastructure and ensuring legal preparedness for cyber incidents. Proactive, in the sense of participating in the shaping of emerging norms governing cyberspace, space traffic management, and digital trade regimes. Absence from these discussions does not preserve neutrality; it merely guarantees marginality.
Economically, the implications are equally significant. Digital transformation is often discussed in terms of efficiency gains and service delivery improvements, but its deeper effect is structural: it alters the very composition of economic value. Data becomes a resource, connectivity becomes capital, and algorithmic optimization becomes a determinant of productivity. For Sri Lanka, this means that traditional growth models based solely on physical infrastructure expansion and labour-intensive industries will be insufficient. The future economy will be increasingly defined by the country’s ability to generate, process, and secure data within trusted ecosystems.
In this regard, cybersecurity is not a cost centre; it is an enabler of economic credibility. Investors, both domestic and foreign, will increasingly evaluate jurisdictions not only on tax regimes or labour availability but on the integrity of their digital environments. A State that cannot guarantee the security of digital transactions cannot fully participate in global digital commerce, regardless of its physical infrastructure.
One must also not overlook the geopolitical dimension. The Indian Ocean is re-emerging as a contested strategic space, not merely in naval terms but in terms of data routes, satellite coverage, and digital corridors. Sri Lanka’s position within this space confers both opportunity and exposure. The opportunity lies in becoming a trusted intermediary node in regional digital and logistical networks. The exposure lies in becoming a potential vector for transnational cyber or informational conflict if adequate safeguards are not established.
Ultimately, my reflection is that Sri Lanka must resist the temptation to view these developments as discrete policy challenges to be addressed sequentially. They are simultaneous pressures requiring simultaneous responses. The future State is not one that reacts to crises in isolation, but one that constructs resilience as a permanent condition of governance.
If there is a single conceptual thread that unites space exploration, cyber security, and digital economy policy, it is the question of trust—trust in systems, trust in institutions, and trust in the continuity of governance in an environment of accelerating technological change. The State that can institutionalize trust at scale will not merely survive the disruptions of the twenty-first century; it will shape their direction.
