Public-Private Partnerships in the Cyber Domain

0.jpg

Eugene Kaspersky has played down the alleged links between Kaspersky and the Kremlin

Whether the USA and Google, China and Huawei or Russia and Kaspersky, it is clear that many technology firms are closely aligned with a particular state. States work closely with technology firms for a number of reasons. Technology firms often possess more advanced expertise, infrastructure and access given their global outreach. Yet these public-private partnerships have interesting implications going forward - both for technology firms and states.

A technology firm's clientele often reflect the foreign policy stance of their home government. For example, many of the US cyber security firms work closely with the US government and other likeminded Western states whilst unlikely to work with states that pose a threat to the US. Of course, not all technology and cyber security firms correlate so closely with their state of origin: A recent data breach of Milan-based Hacking Team shows that they have been perfectly willing to deal with a number of states with questionable human rights records, selling spyware and intelligence gathering software to government agencies in Ethiopia, Bahrain, Egypt, Kazakhstan, Morocco, Sudan Russia, Saudi Arabia, Azerbaijan and Turkey. 

As states cooperate more closely with their state of origin (and like-minded states), it will foster mistrust amongst more distant states. Even just the perception of such a relationship is enough to create mistrust. For example, Iran accused German technology firm Siemens of colluding with the US and Israel in creating the Stuxnet virus that sabotaged an Iranian nuclear centrifuge that used Siemens software. Kaspersky is another interesting example - although respected within the cyber security community, it's perceived relationship with the Kremlin alienates some in the West.
 
These relationships with a state (or at least perceptions of them) have the potential to negatively affect a firm's business. For example, suspicions over Huawei's relationship with China has meant that Australia barred the telecommunication giant from bidding on its national broadband network and a US congressional report recommended Huawei be excluded altogether from sensitive US systems.

This sense of mistrust towards cyber security and technology firms believed to be aligned with a particular state has serious implications for globalisation. The main concern is that states will become increasingly sceptical of interacting with foreign-based firms and become more inward looking, instead seeking domestic solutions. Although there is already evidence of this trend, it is a concern going forward given the benefits globalisation brings. States that refuse to deal with foreign-based firms are bad news for consumers as technology products and services become less innovative and domestic firms are rewarded despite better options being available. In many respects this trend has already begun to take shape and looks unlikely to reverse. For example, China has worked hard to create viable alternatives to Western technology firms; having established these alternatives, China is unlikely to work closely with Western technology firms regardless of their stance in the future. There has been a lot of discussion on the decentralisation of the Internet where states increasingly work in small clusters with close allies. However, perhaps politically sensitive public-private partnerships pose bigger questions for globalisation in the cyber domain.

China has established a number of equivalents to Western firms such as Baidu, a search engine used in place of Google. 
Of course, states may decide to increasingly distance themselves with specific states. Firms want to maximise sales and that involves catering to as large a market as possible. The Information and Technology Foundation estimating that the NSA revelations will cost US technology firms up to $35 billion in lost revenue.

Yet for many of these firms, the state remains a valuable client that represents significant, business and revenue. This highlights a tension that currently exists: firms are incentivised to publicly distance themselves from states yet want to retain their business. 

Perhaps one solution for technology firms that is to perform 'separation theatre' - where efforts are made to create a public perception that firms are distancing themselves from a state whilst maintaining close relations behind closed doors. This process is arguably occurring at the moment. For example, although firms such as Google and Apple have worked hard to distance themselves from the US government since the Snowden leaks, the measures implemented have arguably only a limited effect. For example, whilst Apple now encrypts devices by default, there are a number of ways intelligence agencies such as the NSA can potentially still access data.

Crucially, private sector firms are going to be faced with real ethical and foreign policy decisions in the cyber domain. The relationship a cyber security or technology firm has with particular states will have consequences for both their future clientele and globalisation more broadly. Meanwhile, with an absence of regulation in many areas of the cyber domain, firms are faced with ethical decisions regarding the states they sell their products and services to. Whilst many states are acting with restraint, other firms are acting more recklessly. Hacking Team's recently exposed clientele reveals the limitations of regulation that currently exist in this space. The UN arms embargo prevents firms selling weapons to states with questionable human rights records. However, when Hacking Team's business relationship with Sudan was questioned by the UN, Hacking Team argued that its spying tools do not count as weapons so do not fall under such an embargo.

The Internet is undeniably a vehicle for globalisation. Email, social media and e-commerce all make the world smaller than ever before. Yet, when it comes to public-private partnerships, states appear increasingly inward looking. 

Jamie Collier

Jamie Collier is a DPhil Candidate in Cyber Security at Oxford's Centre for Doctoral Training in Cyber Security.

 

« United Hackers Given a Million Free Air Miles
Finland – Prolific Hacker Arrested & Sentenced »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

European Internet Forum (EIF)

European Internet Forum (EIF)

EIF’s mission is to help provide European political leadership for the political, economic and social challenges of the worldwide digital transformation.

Irish Reporting & Information Security Service (IRISS)

Irish Reporting & Information Security Service (IRISS)

IRISS-CERT is Ireland's first CSIRT (Computer Security Incident Response Team) to provide services to all users within Ireland.

Information Security Media Group (ISMG)

Information Security Media Group (ISMG)

Information Security Media Group is the world’s largest media organization devoted solely to information security and risk management.

CircleCI

CircleCI

CircleCI’s platform allows developers to rapidly release code (for web and mobile apps) they trust by automating the build, test, and deploy process.

IT2Trust

IT2Trust

IT2Trust is one of Scandinavia’s leading value-added distributors of business-critical IT solutions within IT security and networking.

AppSec Labs

AppSec Labs

AppSec Labs specialise in application security. Our mission is to raise awareness in the software development world to the importance of integrating software security across the development lifecycle.

Zettaset

Zettaset

Zettaset’s XCrypt Data Encryption Platform delivers proven protection for Object, Relational/SQL, NoSQL, and Hadoop data stores…in the cloud and on-premises.

Cord3

Cord3

Cord3 delivers data protection, even from trusted administrators – or hackers posing as administrators – with high privilege.

PizzlySoft

PizzlySoft

PizzlySoft is a global company that is seeking convergence of network and security / software and hardware. We put our value on creating the best security.

Defscope

Defscope

Defscope is an Azerbaijani company entirely focused on cybersecurity offering training, security consulting, and other professional services.

Cyrebro

Cyrebro

CYREBRO is your online cybersecurity central command managed SOC that integrates all your security events with strategic monitoring, proactive threat intelligence, and rapid incident response.

Liberman Networks

Liberman Networks

Liberman Networks is an IT solutions provider company that provides security, management, monitoring, BDR and cloud solutions.

Valeo Nertworks

Valeo Nertworks

Valeo Nertworks is a full-service Managed Security Service Provider (MSSP). We partner with organizations to remove the burden of technology so that they can focus on growing their business.

WinMagic

WinMagic

At WinMagic, we’re dedicated to making authentication and encryption solutions that protect data without causing user friction so that everyone can work freely and securely.

Doherty Associates

Doherty Associates

Drawing on our deep industry knowledge and business insight, Doherty deliver intelligent IT solutions and services that help people work more securely, more productively and more creatively.

Boldend

Boldend

Boldend offers leading-edge offensive and defensive cybersecurity solutions that empower government and commercial organizations to stay resilient in an evolving threat landscape.