The imminent digital disruption in the Middle East will present opportunities and benefits, whilst also generating new economic, political, and cybersecurity risks for the region.
Middle Eastern countries are approaching a digital disruption. Recognizing the unsustainability of national economies underwritten by commodities like oil, many Middle Eastern nations are beginning to prioritize the development of high-skilled, service-oriented private sectors. Central to this development is the increasing application of digital technologies centered around networking, computing and storage.
The Middle East already exhibits robust digital penetration. For its population, the region stands above the world average in terms of Internet users—driven by the UAE, Qatar, and Bahrain, where smartphone penetration is over 100 percent. Much of the Middle East’s Internet usage growth is due to social media. Regional social media use grew by nearly 50 percent in the past year, even accounting for growth in conflict zones like Syria, Yemen and Sudan. According to McKinsey & Co., cross-border data flows between the Middle East and the rest of the world have also increased 150-fold in the past decade.
McKinsey’s Digitization Index indicates that the Middle East has yet to satisfy the full potential of digital penetration, especially in business and in government. Digital inputs in Middle Eastern economies only account on average for 4.1 percent of regional GDP, making up 8.4 percent of the region’s digital potential.
Governments in the Middle East clearly aim to maximize their digital economic output. National economic transformation programs drawn out in countries like Saudi Arabia, Qatar, Egypt and the UAE call for the expansion of smart cities, e-commerce, and automation-driven industry. Gartner estimates that Middle East governments will spend $11.6 billion on IT products and services in 2017.
While the Middle East’s digitization trend offers numerous opportunities for its public and private sectors, it also poses risks and challenges for the region’s growth, governance and security.
Digital growth: towards a knowledge economy
For Middle Eastern nations aspiring to transition toward knowledge-based, service-oriented economies, accelerating digitization makes sense. E-commerce is one proven digital growth area that will likely expand in the short to medium term. Internet retail only represents 2 percent of total retail in the region, and the success of Souq as the ‘Amazon of the Middle East’ makes this digital market uniquely attractive. E-commerce can even provide employment opportunities for entrepreneurial women and disenfranchised youth who are often excluded from the traditional Middle East workforce.
Digital ‘as-a-service’ applications may also become dominant. Cloud-computing, Internet-enabled devices and 3D printing can automate business tasks as well as large-scale industry operations. This is particularly relevant for the Middle East’s energy and construction sectors, where around 40 percent of tasks could be automated. They can also affect the bourgeoning banking sectors in Bahrain, Qatar and Jordan, where digital applications can automate payments, data processing and customer interactions. These prospects have already led global IT players like SAP, IBM, Oracle and Amazon AWS to enter the Gulf market. McKinsey estimates that the resulting digital productivity gains can improve companies’ bottom lines by over 50 percent over five years, which could ultimately augment the Middle East’s economic growth by accelerating its diversification away from oil and gas.
Yet there are challenges to digitization. While regional consumer demand for digital applications is robust, IT investment is still dependent on the revenue and business confidence associated with high oil prices. This is particularly prevalent in the Gulf, where decreased oil prices over the past year have deterred the public and private sectors from devoting resources to IT projects that may only have long-run payoff. The result can make the short-term pace of regional digitization uncertain.
Adding to this uncertainty is the composition of the Middle East business climate. Unlike the United States or East Asia, the Middle East lacks the venture capital funding necessary to bring IT start-ups to sufficient scale and profitability. The region also contains numerous state-affiliated or family-run businesses with concentrated ownership and complete equity share, which may discourage local entrepreneurs from establishing companies that digitally challenge an industry’s culture and operations.
There are also political obstacles. Governments in the Middle East tend to distrust third parties with their data, which has minimized the use of digital solutions that rely on third-party cloud computing and storage. Since governments are often majority investors in private businesses in the region, their distrust has extended to the private sector. The Middle East also has varying laws and regulations regarding data privacy and sharing—sometimes even within the same country, depending on the existence of free trade zones, industry-specific geographic areas, or local autonomies. This can create compliance risks for both the users and the suppliers of digital applications as they operate intra- or inter-regionally—particularly with the European Union and its own unique body of data law.
A dominant issue is digitization’s effect on Middle East labor. Regional unemployment is 54 percent, and youth unemployment is nearly 30 percent. The region also possesses a high millennial population, and nearly 100 million young people are expected to enter the workforce by 2020. All this is compounded by a shortage in digital talent: Cisco calculates that the Middle East was short 100,000 skilled IT networking staff in 2015, up 50 percent from 2012.
Governments across the Gulf and Levant are already taking steps to promote and fund technical education with the hope of alleviating both youth unemployment and the digital talent shortage over the medium- to long-term. Yet digitization may also introduce short-term risks to the regional labor market. Workers could be displaced from completely automatable positions, and jobs in which only some components could be automated may see wage reductions. These effects may especially impact the Gulf’s energy and construction sectors, which contain several workers from non-Gulf Arab countries who send remittances back home. All this could hurt remittance-reliant nations like Jordan and Egypt, create new regional worker migration patterns, and increase regional demand for additional government subsidies and assistance. Should Middle East businesses and governments fail to provide adequate skills-training and safety nets to these affected workers, digitization’s labor effects may generate another source of public anxiety and unrest in an already tumultuous region.
Digital governance: transforming the public sector
Public sector digitization presents valuable opportunities for the Middle East. Many nations are pursuing digital ‘smart government’ initiatives to improve government IT infrastructure and talent as well as offer public services through digital means. McKinsey states that only six percent of Middle East countries possess elements of digital smart governments, led by the UAE with its Smart Dubai and Smart Abu Dhabi programs to develop smart city infrastructure and deliver public services electronically. Other countries share those aspirations: Saudi Arabia aims to raise its UN E-Government Index to among the top five nations by 2030, and Jordan, Oman, Qatar and Bahrain all have similar goals to restructure government institutions through electronic services.
The benefits of smart Middle East governments are clear. Many governments in the region are strained by fluctuating energy prices, compounded by their limited tax revenue and growing public demand for subsidies. Corruption, fraud and waste are also common, further exhausting public funds. Digitization may alleviate these issues. Using digital payments could ensure both internal and external government financial transfers are correct and easily auditable. Employing software to automate government human resources operations, as well as developing mobile applications to deliver social services and public information to citizens, could minimize government personnel and overhead costs. Accessibility of information and services may even improve citizens’ satisfaction and civic mindedness vis-à-vis governments, improving political stability over the long-term.
These benefits can also extend transnationally, especially when the region must shoulder immense numbers of refugees fleeing conflict in Syria and Iraq. Jordan, Lebanon, and Egypt have borne the brunt of the refugee crisis, and their financial insecurity and reliance on foreign aid makes supporting refugees alongside their own citizens difficult. Digital services can accordingly magnify the impact of refugee aid. Digital payments allow refugees to receive monetary assistance with dignity while enabling aid providers to limit fraud and theft. Access to mobile phones and social media platforms also enable refugees to maintain contact with each other, improving safety in refugee camps where violence and sexual abuse is likely. Moreover, telemedicine and online education can cheaply ensure refugees are healthy and developing advanced skills to re-enter the Middle East workforce.
In the long-term, digitizing public infrastructure may be necessary. The World Bank predicts that by 2050 the population in the Arabic-speaking world will double and urbanization will reach 70 percent. Gulf countries are already 80 percent urbanized, and increased population growth will place pressure on regional transportation, energy and water resources. Harnessing big data as well as internetworked roads, vehicles, energy grids and water distribution networks will be increasingly vital to move people and resources efficiently. The UAE and Qatar have already begun to partner with firms like GE, Huawei, and Cisco to develop smart electric grids, city lighting, and public transportation that operate dynamically according to usage rates. Dubai is even partnering with Chinese firm Ehang to launch autonomous, 4G LTE-connected flying taxis by July 2017.
Dubai’s autonomous taxis
Digitizing the public sector in the Middle East does carry risks. Maximizing digital efficiencies in government— particularly among family-run nations — may obviate clientele practices whereby citizens from politically relevant factions are given public sector jobs, even if those jobs are unnecessary. This may even fall disproportionately on younger citizens who are often guaranteed government employment. Digitally restructuring government accordingly may create political anxiety in the short-term as displaced public sector workers — and the political networks surrounding them — adapt to the new environment.
Another source of political risk stems from many Middle East governments’ relationship to the Internet. In a post-Arab Spring political environment, governments have become increasingly preoccupied with security and control over information — especially when it’s online. In many countries, surveillance and censorship of websites and online services increased after the social media-catalyzed uprisings swept the region in 2011. This trend has also encouraged governments to restrict access to and sharing of otherwise public data for fear it may be used against them. The 2013 Snowden revelations fueled this further, enabling Middle Eastern nations to join global calls for data localization policies to restrict certain information from leaving their borders.
The nature of Internet policy in the Middle East accordingly threatens public sector digitization. In many cases governments and public authorities will have to adopt digital solutions built and operated by private companies. While international IT companies have already entered the Middle East market, governments’ fear of outsourcing closely-held data may inhibit full-scale digitization. On the other hand, the culture of widespread government surveillance and censorship may deter local IT companies from forming, or even discourage global IT companies from meeting their investment potential.
This is especially the case with Middle East open data policies. While the UAE and Bahrain have made significant efforts as part of their e-government and smart city initiatives to share non-confidential public data, they still mirror nearly all Middle Eastern countries’ positions in the bottom half of global open-data rankings. Inability to access and share data regarding government and city infrastructure can inhibit public sector digital innovations from proliferating. It can also raise the financial costs to government digital applications and risk public dissatisfaction should those applications fail to operate successfully.
Digital security: The weakest link
The principal risk to expanding digital applications in the Middle East is the insecurity of those applications themselves. Increasing regional digitization will enable and correspond with developing cyber threats.
Cyber power is already on display in the Middle East, in many cases corresponding to the region’s geopolitical realities. State and non-state actors ranging from Iran to ISIS have accordingly utilized cyber power within and across the region against various targets to acquire intelligence, signal capabilities, project influence, or frighten populations. Over the past year, the region’s public and private financial, energy, healthcare, defense and aviation sectors have all been targeted by cyber means. The Middle East has experienced the global surge in ransomware, of which Saudi Arabia is the most impacted country. Sophisticated cyber operations like Shamoon 2.0 and StoneDrill have also appeared, utilizing spear phishing tactics to deploy malware aimed at destroying or rendering computer systems unusable.
The consequences of inadequate cybersecurity are profound. Short-circuiting digital applications through cybered means will offer state and non-state adversaries more targets to asymmetrically weaken Middle East governments and commerce. The risks are higher among Gulf countries aggressively adopting smart city infrastructure and Internet-enabled industrial systems. Many smart devices do not include inherent security protocols, prevent installation of third-party security software, and often allow unauthenticated communication with other devices.
More common will be offensive cyber activities targeting companies’ routine operations. Middle East firms adopting automated IT services will be doing so in an already perilous cyber environment. PWC states that regional businesses suffered larger losses than other regions in the world in 2016 due to cyber incidents. These losses can harm a company financially, reputationally, or even strategically. For example, companies suffering from cyber power may deter greater foreign investment in their industry sector.
Strategic losses are also significant to the Middle East given the region’s high global rate of mergers and acquisitions (M&A) activities in real estate and banking, as well as industrial and consumer products. M&A activities often generate sensitive communications, secret financial disclosures, and large capital expenditures—all which make them prime cyber targets for companies or criminals seeking a market edge or short-term profit. M&A-involved companies with direct or presumed political ties also may be targeted by state-affiliated or politically-motivated actors. All this could upset M&A activities and create a chilling effect for similar endeavors in the region.
While investment in cybersecurity is increasing, there are still insufficient cybersecurity strategies and frameworks to combat the growing cyber risks to Middle East digitization. Cultivating cybersecurity awareness among companies is difficult, as many do not perceive cyber threats as priorities until after their systems have been compromised. Cyber threat intelligence-sharing is also minimal, due to companies’ fear of unilaterally exposing their IT weaknesses to competitors. Middle East governments are beginning to create cybersecurity agencies at the national level, but their robust surveillance presence, use of cyber power against journalists and private entities, and unwillingness to share government data with the private sector, further breeds distrust among companies to cooperate with government on cybersecurity. This tends to make responding to regional cyber threats slow and ad hoc.
While laws related to cybersecurity are being gradually implemented, many of them are vague and ineffective. Cybersecurity laws have often been implemented to tackle internal threats and uphold religious and moral tenets without strong procedures to deter and mitigate cyber breaches. Data privacy laws generally force companies to form their own in-house privacy rules and guidelines while failing to define the rights and privileges of companies and their customers after a breach occurs. In Saudi Arabia’s Shari’a-based system there is no legal entity to notify when breaches occur, leaving Saudi courts to litigate cases based on general Shari’a principles. Moreover, national legal frameworks are not harmonized across the region, making them unusable against transnational cyber threats.
It is clear that the Middle East’s digital disruption will produce new opportunities and benefits for the region. Yet the extent to which the public and private sectors can withstand digitization’s economic, political and cybersecurity risks will accordingly determine the degree to which it can cash in on those prospects going forward.
