Call Me, Maybe: New US-Russia Cybersecurity Initiatives

At the G-8 meeting in Northern Ireland, the United States and Russia made efforts to improve bilateral relations, and these efforts include new initiatives on cybersecurity that mean, according to the White House, the US and Russia “now are leading the way in extending traditional transparency and confidence-building measures to reduce the mutual danger we face from cyber threats.” These initiatives involve:

1. Deeper engagement through senior-level dialogue. Through the existing US-Russia Presidential Bilateral Commission, the two countries are establishing a new working group tasked with assessing emerging threats to information and communication technologies (ICTs) and proposing joint responses to such threats.

2. ICT confidence-building measures. The US and Russia agreed to implement new confidence-building measures (CBMs) “designed to increase transparency and reduce the possibility that a misunderstood cyber incident could create instability or a crisis in our bilateral relationship.” The CBMs seek to strengthen US-Russian relations in cyberspace, expand a shared understanding of cyber threats that appear to originate in each other’s territories, and prevent escalation of cybersecurity incidents. The CBMs adopted are:

– Links and information exchanges between the US and Russian computer emergency readiness teams (CERTs) to increase information sharing between the two countries on “technical information about malware or other malicious threats” in order to facilitate “proactive mitigation of threats.”

– Exchange of cybersecurity notifications that will permit communications and “formal inquiries about cybersecurity incidents of national concern.” Such information exchanges and inquiries will flow through the existing Nuclear Risk Reduction Center, established in 1987 between the US and the former USSR, in order to facilitate reduction of “misperception and escalation from ICT security incidents.”

– Direct cyber hotline between the White House and the Kremlin to provide a secure means to “manage a crisis situation arising from an ICT security incident.” The direct cyber hotline will be integrated into the existing Direct Secure Communication System the two countries maintain.

The White House also indicated that, in order to “create predictability and understanding in the political military environment, both the U.S. and Russian militaries have shared unclassified ICT strategies and other relevant studies with one another. These kinds of exchanges are important to ensuring that as we develop defense policy in this dynamic domain, we do so with a full understanding of one another’s perspectives.”

These steps by the US and Russia are important for cybersecurity because the two countries are applying approaches used in arms control contexts (e.g., CBMs and “hotline” communications) to cybersecurity challenges. This strategy dovetails with needs emphasized in cybersecurity policy–the need for better “situational awareness” and transparency through increased information exchange and for stronger, more effective cooperation among key countries through functional collaboration at the technical level and political interactions among high-level officials.

Although based on long-standing arms control strategies, their application to cybersecurity will develop its own features given the differences between addressing cyber threats and, say, preventing nuclear war. In arms control contexts, CBMs have, at best, a mixed record, so we should not expect “iCBMs” to be a panacea for cybersecurity problems experienced nationally or internationally. The US-Russian initiatives do not restrain, for example, cyber espionage or development of more powerful military cyber capabilities or resolve disagreements the US and Russia have over broader cyberspace issues, such as Internet governance and “Internet freedom.” But the US-Russia initiatives provide a test case for understanding whether legacy strategies from arms control, such as CBMs and hotlines, can contribute to stabilizing geo-cyber politics.

Why the WTO is not an Appropriate Venue for Addressing Economic Cyber Espionage

Using the WTO to Respond to Economic Cyber Espionage?

US policy concerns about cyber espionage continue to grow, especially traditional and economic espionage allegedly conducted by China against the US and US companies through cyber technologies. Today (February 11), the Washington Post reported on a new National Intelligence Estimate focused on a “massive cyber-espionage campaign” directed at the US private sector by China. Concerns about economic cyber espionage include deepening frustration because the options available to the US to address cyber espionage are few, and the use of the limited options, such as criminalizing economic espionage in national law, have not proved much of a deterrent before or after spies began exploiting the Internet.

In the debate about how to counteract economic cyber espionage, cybersecurity heavyweights are encouraging the US to use the World Trade Organization (WTO) and its rules on intellectual property in the Agreement on Trade-Related Intellectual Property Rights (TRIPS) to address economic cyber espionage. On February 7, 2013, Richard Clarke argued in an op-ed that “victims of Chinese economic espionage should seek to establish clear guidelines and penalties within the World Trade Organization system[.]” In a Center for Strategic and International Studies (CSIS) report released on February 8, 2013, James Lewis argued that the US should use the WTO in its strategy against Chinese economic cyber espionage (see pages 49-51 of the report).

The recent appearance of these WTO arguments by Clarke and Lewis suggests that these influential experts perceive policy traction with these proposals is possible. Indeed, the Washington Post reported in its February 11 story that the Obama administration is considering, among other options, making “complaints to the World Trade Organization.” However, the idea that the WTO can prove useful to the US in addressing economic cyber espionage is not convincing legally or politically. The US should not view the WTO and TRIPS as appropriate venues for confronting the problem of economic cyber espionage.

Read the rest of this entry »

Becoming Binary Amidst Multipolarity: Internet Governance, Cybersecurity, and the Controversial Conclusion of the World Conference on International Telecommunications in December 2012

Arms control experts know that national security policies are embedded in larger concerns about the balance of power in international relations. The contentious outcome of the World Conference on International Telecommunications (WCIT) in Dubai in December 2012 demonstrates that cybersecurity is similarly tethered to geo-political competition over power and influence. The WCIT ended in acrimony because of disagreements on issues fundamental to the Internet’s place in national and international politics. These disagreements reflect deep differences among states on Internet and cyberspace governance–differences that produce incompatible notions of cybersecurity and a difficult environment in which to pursue international cooperation on this security problem.

The UN’s International Telecommunication Union (ITU) convened the WCIT to negotiate changes to the International Telecommunication Regulations (ITRs), a treaty adopted by ITU member states in 1988 to foster more effective cooperation on provision of international telecommunication services (e.g., telegraph and telephone). Since 1988, the global emergence of the Internet has revolutionized international telecommunications, making the ITRs essentially irrelevant to issues raised by the Internet’s astonishing growth and profound economic and political implications. The initiatives and processes that produced the global Internet took place outside the ITU and other intergovernmental institutions in “multi-stakeholder” forums, such as the Internet Engineering Task Force (IETF) and the Internet Corporation for Assigned Names and Numbers (ICANN).

Since at least the early 2000s, a number of countries, including China, Russia, and many developing nations, have expressed concerns about these multi-stakeholder processes and have sought to increase the role of governments, intergovernmental institutions, and international law in such governance. An important element in this challenge has been the perception that the status quo gives the United States a dominant position not justified in the context of a global Internet. The United States and its like-minded allies opposed efforts in ITU forums, such as the World Summit on the Information Society (2003-2005), to move from multi-stakeholder approaches to more intergovernmental influence and control.

The WCIT became the latest diplomatic venue for this clash of interests and ideas. Although the ITU Secretary-General repeatedly said that the WCIT would not be about Internet governance, ITU members proposed changes to the ITRs that put Internet governance, whether narrowly or broadly conceived, on the negotiating table. These proposals fueled arguments that the WCIT constituted a threat to a free and open Internet. The WCIT opened in a highly politicized environment and was not able to achieve sufficient compromises to produce consensus. In the end, 88 countries–including many African states, Brazil, China, Iran, and Russia–signed the revised ITRs, and 55 nations–including the United States and members of the European Union (EU)–did not sign the revised treaty. (For more legal analysis of the revised ITRs, see my American Society of International Law Insight on the WCIT and the revised ITRs.)

The United States was the most prominent opponent of the revised ITRs, and its opposition centered on Internet-related issues, namely expanding the scope of the ITRs to reach providers of Internet services, adding provisions on network and information security and on spam to the revised regulations, and attaching a non-binding resolution addressing Internet governance. For the United States, the revised ITRs threatened the multi-stakeholder approach and opened possibilities for countries to use the revised regulations to justify censorship in cyberspace, disrupt innovation, and harm the economic potential the Internet supports.

Looking more specifically at cybersecurity, the WCIT and its outcome did not create controversies in this policy space because problems have existed for years concerning how to improve cooperation on this issue. In brief, countries have disagreed about what “cybersecurity” or, as other countries prefer, “information security,” means. In addition, distrust among countries has increased, national moves to strengthen cyber defenses and capabilities have heightened worries, and high-profile incidents of cyber attacks, especially Stuxnet, have deepened anxieties. International cooperation has developed more in regional contexts than at the multilateral level, as illustrated by the Shanghai Cooperation Organization’s agreement on information security, NATO’s development of a cyber defense policy, and the EU’s recent announcement of its cybersecurity strategy.

However, the WCIT worsens the already questionable prospects for multilateral cooperation on cybersecurity for the foreseeable future. The two sides of the Internet governance debate hardened and entrenched their respective positions through the WCIT and the revised ITRs. China, Russia, and other supporters of the revised ITRs will, in all likelihood, use the ITU and the revised ITRs to press their ideas and interests on Internet issues, including what they perceive as security threats in this realm. The United States has announced that it will continue to oppose changes to Internet governance attempted through the ITU and the WCIT and will move to strengthen its cyber diplomacy through leveraging its allies in Europe (e.g., the EU and NATO) and intensifying bilateral cooperation with other countries, especially on cybersecurity.

This binary context of opposing factions adversely affects more than hopes for internationally agreed controls on cyber weapons (to the extent such hopes have survived to this point in time); it also challenges the role of Internet-relevant norms–binding and non-binding–in an international political environment that is experiencing confrontation and contestation about the Internet and cyberspace. Revelations subsequent to the WCIT’s conclusion–including allegations of Chinese hacking of major US newspapers and reporting on scaled-up US military cyber capabilities and secret “rules of engagement” for US cyber operations–have deepened the sense that power politics in cyberspace has entered a new and potentially more dangerous phase.