ON GEOPOLITICS
Cyber Diplomacy Arrives at Another Fork in the Road
undefined and Senior Global Analyst
Matthew Bey
Senior Global Analyst, Stratfor
14 MIN READSep 2, 2021 | 16:56 GMT
(Shutterstock)
My colleague recently wrote that ransomware has so far undoubtedly been the “defining cyber threat” of 2021. I agree with that assessment, given the onslaught of major ransomware attacks we’ve seen this year. But it’s also important to note that there’s been meaningful progress in U.N. negotiations on cyberspace — much to the surprise of many observers, including myself.
In March, the Russia-backed Open-Ended Working Group (OEWG) reached a cybersecurity agreement reaffirming 11 non-binding norms for state-sponsored cyber activity. And then two months later, the U.S.-backed Group of Governmental Experts (GGE) followed suit. Merely reaffirming those norms, which were first established in 2015, may seem like only modest progress. The agreements, however, not only come after the GGE failed to reach a similar deal in 2017, but in the wake of several high-profile cyberattacks — including the SolarWinds, Microsoft Exchange and Colonial Pipeline hacks.
That said, fundamental differences in opinions and priorities between countries remain on what kind of cyber activities should be regulated and how. The diplomatic path forward for future rounds of international negotiations is also unclear, with the United States wanting to enforce current U.N. agreements as Russia proposes more. Thus, despite the progress seen so far this year, the chances of the world not only agreeing, but adhering, to a single set of ground rules are slim at best — with a future of fragmented internet policies still the most likely outcome.
The Core of the Cyber Divide: Sovereignty vs. Privacy
Russia, China and the United States have long had opposing views on cyberspace. From Russia’s perspective, most information technologies (including software and hardware) have been developed by the United States and its allies, giving Washington and Moscow’s other rivals in the West a clear advantage in cyber capabilities. For this reason, Russia — along with fellow U.S. adversaries like China, Cuba and Iran — wants to use cyber arms control and negotiations as a way to limit what the United States and its allies can do. And these concerns have only been hardened in recent years following Edward Snowden’s revelations about the U.S. National Security Agency’s reach, as well as the United States and Israel’s successful deployment of the Stuxnet worm against Iran’s nuclear program.
Russia has wanted to prioritize negotiations around what it has recently come to define as the “national security” of its “information sphere,” as outlined in its 2016 Information Security Doctrine. Compared with the West, Russia — along with China and other like-minded countries — take a more expansive view on cyber threats that also includes stopping the spread of dangerous information, in addition to preventing traditional malware or other attacks on networks and infrastructure. Through this viewpoint, these countries want to strengthen state control and oversight over information in cyberspace, particularly as it relates to issues like opposition groups, non-governmental organizations and other threats that could use the interconnected digital world as a tool against the state. Today, that position is embodied by China’s Great Firewall, Iran’s National Information Network and Russia’s Runet.
On the other hand, the United States and other liberal democracies believe individual rights and freedom of expression should be protected in the cyber world — rejecting Russia, Iran and China’s broader view.
Moreover, the United States has argued that any cyberspace negotiations focused on limiting online behavior or arms control were redundant, given the existing international law on cyber warfare and the application of the U.N. charter. Washington has stressed that the focus of such international talks should instead be on countries working together to root out the threats outlined in the 2004 Budapest Convention on Cybercrime, a treaty that has largely been only ratified by Western countries.
Over the last 15 years, the United States has become increasingly concerned about the digital realm becoming a Wild West for criminal activity. NATO’s increasing focus on cyber activity and the 2009 creation of U.S. Cyber Command also reflects Washington’s fears about the cyber domain becoming more integrated into its adversaries’ military strategies, which attacks by Russia, China and Iran on U.S. critical infrastructure, along with China’s cyber industrial espionage, have only underscored. To address these concerns, the United States has sought to focus international talks on establishing “norms” for state-sponsored cyber activity that, even if non-binding, would help provide a blueprint to judge perceived transgressions by Russia and China.
U.N. Cyber Negotiations: A Brief History
Russia has consistently tried to lead international negotiations on cybersecurity. Since 1998, Moscow has introduced a resolution each year at the United Nations on “developments in the field of information and telecommunications in the context of international security.” In 2001, Russia proposed the creation of a Group of Governmental Experts (GGE) panel to evaluate and discuss threats to information security. And in 2004, the first GGE was created, including experts from 15 countries, with Russia chairing the group. The first GGE panel failed to reach the consensus needed for an agreement on global cyber rules. But the three subsequent meetings held between 2009 and 2015 each adopted a report by consensus, with the 2015 GGE panel notably establishing the first-ever non-binding cyber norms.
The 2016-17 GGE, however, failed to build on the last meeting’s success and, for the first time in nearly a decade, ended without a consensus statement. The United States and the West wanted to explicitly state that International Humanitarian Law (which covers international law during armed conflicts) applies to cyberspace. But Cuba, Iran, China and Russia rejected this position, with Havana specifically arguing such an application would normalize cyber warfare. Looming questions around Russia’s alleged interference in the 2016 U.S. election, along with then-U.S.President Donald Trump’s abrasive stance toward China, also made the GGE process more politically difficult.
Parallel Talks Yield Unexpected Progress
Despite the failure of the 2016-17 GGE, however, the United States and Russia still had strategic interests in cyberspace that made diplomatic talks attractive. In 2018, Russia sponsored a U.N. resolution to replace the GGE with a new Open-Ended Working Group (OEWG). The OEWG would still operate on consensus, but unlike the GGE, would be open to all members of the United Nations.
The United States and its allies also participated in the OEWG, but were skeptical of Russia’s intent — namely, whether Moscow was using the new working as a vehicle to gain support for its own alternative to the Western-backed cybercrime guidelines in the Budapest Convention. These fears then seemed to be confirmed after Russia, in quick succession, proposed a new five-year successor OEWG (which started work in May 2021), updated its National Security Strategy (names information security a priority for the first time), and unveiled a draft treaty on international cybercrime in July.
The United States and other Western countries also expressed concerns that Russia would use the open access offered by the OEWG to get more countries interested in its version of information security in order to eventually adopt a different set of norms or expanded set of norms than those established by the 2015 GGE. But these fears did not materialize in the OEWG’s March 2021 consensus report. China, in fact, backed reaffirming the 2015 GGE norms, effectively eradicating any chance that Russia may have had in changing them. This, along with some language alluding to China’s concerns about supply chain reviews, was enough to reach a consensus that enshrined many of the GGE’s findings. While the OEWG agreement did not yield significant breakthroughs in terms of scope, it marked the first time a working group open to all U.N. member states resulted in a consensus report on cyber norms.
Amid concerns about the direction of the Russia-backed OEWG, the United States sponsored a resolution to create a new 25-member GGE in order to keep the smaller working group intact. The group met earlier this year and produced a consensus report that details exactly what is expected of countries to fulfill each of the norms established in the 2015 GGE report. U.S. negotiators described the 2021 GGE report, which also includes examples of what qualifies as critical infrastructure, as an effective guidebook on how to apply and interpret the cyber norms, with the understanding that no new rules needed to be created.
The report also explicitly states that International Humanitarian Law applies cyberspace (Cuba, the 2017 GGE member vetoing the inclusion, was not a member of the 2021 GGE). The inclusion of this may limit some of the development of potential cyber weapons due to the impact on civilians, though it is unclear to what degree that application of International Humanitarian Law will be respected. China and Russia are concerned about the fact that most of their critical infrastructure is operated by state-owned enterprises and the West's is operated by private companies, opening up questions as to what a “civilian” is in the context of war with a huge cyber component.
The GGE report does not, however, go into high detail around how to assess attribution cyberattacks — a major demand of Russia and China. Both Moscow and Beijing have criticized Western governments for accusing them of being behind cyberattacks without always providing substantial evidence (Western intelligence agencies frequently have detailed evidence on attribution, but avoid sharing it publicly for fear of exposing their sources and techniques). The United States and its allies, meanwhile, argue that Russia and China exploit the gray area around attribution to gain plausible deniability around attacks.
Enforcing vs. Expanding Cyber Rules
Differences in priorities between the West — led by the United States — and China and Russia over what to do next in international negotiations over cyberspace also appear to be widening.
The West’s Position
It seems the GGE process has run its course, with the West now signaling it wants to shift the conversation on how to apply norms, and not what they should be. The United States, in particular, wants to use the 11 norms established in 2015 to press China and Russia. During his meeting with Russian President Vladimir Putin in June, U.S. President Joe Biden focused largely on Russian cyber activity, including the SolarWinds supply chain hack, as well as Russia’s alleged harboring of ransomware gangs behind the 2021 Colonial Pipeline and JBS hacks. In July, the United States and its allies also publicly named and shamed China for its cyber activity, with China’s state-sponsored cyber industrial espionage campaigns being one of the key focuses.
In October 2020, France, Egypt and over 40 other primarily Western countries proposed launching a Programme of Action (PoA) to establish “a permanent U.N. forum to consider the use of ICTs [information and communication technologies] by States in the context of international security.” Although the United States was not a sponsor, presumably the focus of the new U.N. body and dialogue would focus more on enforcement, as opposed to advancing rules and standards.
It’s unlikely that Russia or China will ever fully scale back such activities. But since both are included in the cyber norms established, the United States hopes to at least use the rules as a benchmark to judge the behavior of Russian and Chinese cyber officials/entities, as well as justify potential retaliatory sanctions and/or legal action. Washington also hopes that offering more clarity on how it will respond to attacks will help at least keep Russian and Chinese cyber activity in check, even if it can’t prevent attacks altogether.
Russia and China’s Position
Meanwhile, China, Russia and other more authoritarian governments are far more concerned about how cyberspace is used in their countries and furthering their concepts of digital sovereignty. Russia appears interested in using the new five-year OEWG as a vehicle to do so, banking on nationalist data and internet sovereignty trends in countries like Brazil, India, Saudi Arabia, Turkey and the United Arab Emirates. In doing so, Moscow is seeking to bring these typically more Western-aligned countries closer to its view on information security concerns. Russia also hopes that further diffusing the physical infrastructure underpinning the global cyberspace (i.e. servers, networks, cables) could eventually help reduce Western hegemony by compartmentalizing the internet as well.
The aforementioned cybercrime treaty that Russia proposed in July may also find some support among other governments with similar sovereignty-focused approaches to the internet policy. The proposed treaty would expand upon the EU-backed Budapest Convention by increasing the number of cybercrimes from 9 to 23. Western officials have voiced concerns that the broader list of offensives — which include unauthorized access to personal data and extremism — could grant repressive regimes more power and more ways to manage dissent, public opinion and control information flows in their countries.
The new terrorism-related crimes added to the treaty, in particular, could immediately enable authoritarian governments to designate dissidents who share critical content as terrorists — a label Ethiopia’s govern
ment, for example, has used to justify its offensive against the Tigray People’s Liberation Front.
Russia’s draft treaty also criminalizes the creation and use of digital data intended to “mislead” the user, which governments could use to crack down on critical media coverage by labeling such content “ake news or disinformation.
In addition, the treaty’s section on extradition explicitly says that none of the 23 cybercrimes would be political crimes — meaning that they would not fall be subject to the carve-outs for political crimes in current extradition treaties.
The United States and the West are concerned that Russia’s ultimate intent is to replace that Budapest Convention. But what’s more realistic is that Moscow’s treaty garners support from a select handful of like-minded states, with Russia’s fellow Shanghai Cooperation Organization members (China, Kazakhstan, Kyrgyzstan, Tajikistan and Uzbekistan) among the most likely to do so. But even if only a small number of countries end up adopting it, the new cybercrime treaty nonetheless adds the litany of alternatives to Western frameworks that Russia and China have been backing, and would also put clearer regulations in place fragmenting the internet.
Disagreements on Data
Data transfer and privacy is one area where there is little room for substantial agreement between Europe, the United States and China. The United States and the European Union may eventually reopen bilateral negotiations on a new data transfer framework between them after the European Court of Justice struck down the EU-U.S. Privacy Shield Framework in 2020 over concerns about lax U.S. privacy rules and government intelligence agencies' access to personal and corporate information. But while the United States may make some reforms, it's unlikely to completely scale back some of the government’s access to information, making any hypothetical new deal potentially being struck down again.
China’s growing state oversight of data, meanwhile, makes collaboration on privacy and other data-related issues even more difficult. A number of new laws and regulations introduced in China over the last year have – including the Personal Information Protection Law and Data Security Law – focus on restricting companies’ ability to send Chinese data overseas. Beijing also has yet to introduce measures that would significantly reduce its own access to data.
A Fragmented Future
The chasm between the world’s four dominant cyber powers — the United States, Europe, Russia and China — on how cyberspace should be managed internationally and what types of behavior countries should engage in (and avoid) is only likely to widen — accelerating the fragmentation of the internet, online services, data transfer rules and cyber policies. This portends higher risks for Western companies trying to operate in countries that are increasingly able — both from a technical and diplomatic perspective — to expand control over the internet.
Such fragmentation would also make it more difficult for Western tech giants like Google, Twitter, Facebook and Amazon to be truly global by forcing them to focus their activities in Europe and North America where regulations are more consistent. This would, in turn, give an edge to alternative tech companies from Russia, China and elsewhere that are more willing to work in environments with stricter regulations. The absence of strict rules on government access to information in China may also give some of its state-backed companies more freedom to reap the benefits of emerging data processing technologies, like artificial intelligence, compared to their Western counterparts that will have to heed far more stringent requirements on privacy, equality and non-bias on algorithms.
