Cyber War and Peace
Information and communication technologies have become a central part of everyday life for most of the world’s population. They affect even the most underdeveloped and remote areas of the planet and have become a key factor driving development, innovation and economic growth.
But this is just the beginning of a fundamental transformation. In the coming years, new technologies, such as the “Internet of things,” 3-D printing, and autonomous vehicles will revolutionise businesses operations, regulatory regimes, and even social conventions.
These technologies generate enormous benefits, but they are also risky, owing to the ease of accessing data and using it for criminal purposes. Cyber-attacks are already vastly increasing in number, sophistication, magnitude, and impact. As the world becomes more interdependent and hyper-connected, there is growing concern about the vulnerability of the Internet, an infrastructure on which nearly all economic activities – including trade, energy provision, and the entire financial system – have come to depend.
Cyber-attacks take place in a medium, cyberspace, where offensive actions have an advantage over defensive ones. Indeed, most of cyberspace’s infrastructure was designed to ensure its interoperability and openness, often at the expense of security, which tends to limit usability.
Attacks are usually asymmetric; the barriers to cyberspace are inconsequential and governments have struggled to enforce the rule of law online. Attackers with limited resources are able to cause disruptions that have far greater impact than similar actions in the physical world. Indeed, the damage from a cyber-attack is by nature transnational, capable of rapidly cascading to a global level.
In a medium that does not map onto political borders, it is impossible to manage risks successfully from just one jurisdiction. In economic terms, cybercrime is already comparable in size to drug trafficking, and it is highly internationalized. But we have yet to develop fully a global governance regime. Various initiatives have attempted to facilitate the international management of cyberspace, but none has had more than limited success.
The Global Conference on Cyberspace (GCCS), recently hosted by the Netherlands, is an example of this. Representatives from governments, the private sector, civil society, and the technical community met in The Hague to foster a multi-stakeholder approach to cyberspace governance and public-private cooperation.
The approach embodied by the GCCS combines a traditional regime – in which sovereign states are the main players – with another, more modern approach, in which all of the agents concerned participate. This more open, multi-stakeholder model mirrors the traditional technical management of the Internet, which has proven to be very effective in maintaining the resilience of cyberspace. It is based on bottom-up consensus, fosters a collective sense of management, and stresses the promotion of trust and international cooperation.
The effectiveness of approaches like this one is limited by the fact that the three largest cyberspace powers – the United States, China, and Russia – have not agreed on a common treaty to harmonize national laws or facilitate cooperation. Nor do they cooperate on the issue through other institutions, with the exception of the G-20 and the United Nations. Recent cases of cyber espionage have generated growing mistrust even among traditional allies like Germany and the US. In the interest of defending their sovereignty, states could begin to interfere in the technical governance that has proved so efficient.
Indeed, the danger of international conflict has worsened in the past few months, eroding whatever trust existed between the powers. Cyberspace risks becoming a battleground, on which governments, non-state actors, and the private sector all clash. The recent attack by jihadis on France’s channel TV5 and the alleged hack of Sony by North Korea may be forerunners of what is to come.
Companies and civil society alike have roles to play in ensuring that the governance of cyberspace remains open, inclusive, and sufficiently flexible to adapt itself to changing risks and challenges. The existing approach to technical management must be preserved, even as other innovative proposals are explored. Ideas that could contribute to better governance include a G-20 (states) + 20 (relevant non-governmental players) Cyber Council for Stability and an early warning and coordination system based on the World Health Organization’s approach to epidemics.
Responding to twenty-first-century threats with twentieth-century tools is a bad idea. By 2020, two-thirds of the global population will be online. The world needs a fluid and frank dialogue among states, the private sector, and civil society in order to guarantee the security of cyberspace.
The international community has put in place minimal codes that regulate areas like health and nuclear weapons proliferation. There is no reason why we cannot do the same in cyberspace. We all have a common interest in preserving its openness and global character; doing so will require that we set aside narrow national interests in the interest of guaranteeing collective progress.
