UN Cyber Warfare Talks Collapse

Thirteen years of negotiations at the United Nations aimed at restricting cyber-warfare collapsed in June, it has just emerged, due to an acrimonious dispute that pitted Russia, China and Cuba against western countries.

The split among legal and military experts at the UN, along old cold war lines, has reinforced distrust at a time of mounting diplomatic tension over cyber-attacks, such as the 2016 hacking of the US Democratic National Committee’s (DNC) computers. 

That break-in was allegedly coordinated by Russian intelligence and intended to assist Donald Trump’s presidential campaign.

Negotiations aimed at forging an international legal framework governing cybersecurity began in 2004. Experts from 25 countries, including the UK and all the other members of the UN security council, participated in the discussions.
But in June, diplomats at the UN abandoned any hope of making further progress, amid a row centred on the right of self-defence in the face of cyber-attacks.

At previous sessions, officials accepted that the principles of international law should apply to cyber-space, including the UN charter itself. Article 51 of the charter states that nothing shall “impair the right of individual or collective self-defence” in the face of an armed attack. 

The Cuban representative, Miguel Rodríguez, told the final meeting of negotiators that recognising self-defence rights in cyber-space would lead to militarisation of cyberspace and “legitimise … unilateral punitive force actions, including the application of sanctions and even military action by states claiming to be victims” of hacking attacks. 
Without naming Russia or China, Michele Markoff, who led the US delegation to the UN’s Group of Governmental Experts (GGE), released a statement in the aftermath of the collapse of negotiations attacking “those who are unwilling to affirm the applicability of these international legal rules and principles”. 

Such countries “believe their states are free to act in or through cyberspace to achieve their political ends with no limits or constraints on their actions”, Markoff said. “That is a dangerous and unsupportable view.”

Speaking at a cyber-security conference in Israel after the breakdown of the UN process, a senior Russian official, Oleg Khramov, blamed western countries for the impasse. “Talks about the need to adopt rules of behaviour in the information space remained mere talk. We all were thrown years back,” he said.

Mike Schmitt, professor of international law at Exeter University and a former US air force lawyer, has been monitoring the UN GGE discussions. He said he feared a calculated decision has been made by Moscow and Beijing that the west has more to lose if there is no guaranteed right to retaliate against cyber-attacks.
“Perhaps [Russia, China and Cuba] … want to avoid the perception that ‘the west’ gets to dictate the rules of the game for cyber-space,” he wrote on the Just Security blog. 
“Or perhaps the answer is legal-operational in the sense that they want to deprive the west of a legal justification for responding to hostile cyber operations that they themselves launch.”

Part of the dispute was over the difficulty of establishing who is responsible for a foreign cyber-attack. Proving whether hackers had state backing is extremely difficult, particularly for countries that do not possess adequate technological resources. 

The legal row over cyber-warfare echoes international concerns over the deployment of drones. Both technologies permit the application of force by remote control, effectively lowering the threshold for future conflicts.

Schmitt, who is also the editor of the Tallinn Manual on International Law Applicable to Cyber Warfare, said: “From the western perspective, Russia and China are the two countries they are most concerned about. I’m comfortable with the US intelligence conclusion that the Russians [were responsible for hacking into the DNC].
“There are a number of states that like legal ambiguity because it gives them flexibility. They can operate without risking any collective [punishment] for being a lawbreaker … It may not be in their national interest to clarify the law. There are no more sessions planned for the GGE but there are discussions about what to do next.”

The UK foreign office said: “Existing international law applies in cyberspace as it does in other domains. The UN GGE’s inability to agree a consensus in June does not undo previous work. The government is committed to maintaining a free, open, peaceful and secure cyber-space.”

Guardian

You Might Also Read:

Nation State Hacking Has A Big Commercial Impact:

Cyberwars Between Nations Are Difficult to Prove:

Can the United Nations Improve Cybersecurity?:

Mass Surveillance: Cuba Filters Text Messages:


 

 

 

« Tech Giants Put Big Data To Work
Driverless Truck Fleet Gets UK Trial »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

ZenGRC

ZenGRC

ZenGRC (formerly Reciprocity) is a leader in the GRC SaaS landscape, offering robust and intuitive products designed to make compliance straightforward and efficient.

Directory of Cyber Security Suppliers

Directory of Cyber Security Suppliers

Our Supplier Directory lists 7,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

TÜV SÜD Academy UK

TÜV SÜD Academy UK

TÜV SÜD offers expert-led cybersecurity training to help organisations safeguard their operations and data.

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

CSO

CSO

CSO serves enterprise security decision-makers and users with the critical information they need to stay ahead of evolving threats and defend against criminal cyberattacks.

Acuity RM Group

Acuity RM Group

Acuity RM Group helps businesses worldwide effectively manage, prioritize and report on their risks to inform strategic and tactical decision-making and build long-term resilience.

Cyber Security Austria (CSA)

Cyber Security Austria (CSA)

Cyber Security Austria (CSA) is an independent non-profit association with the aim to address security issues in the area of IT/cyber security of critical/strategic infrastructures in Austria.

LinkShadow

LinkShadow

LinkShadow is a next-generation cybersecurity solution that provides unparalleled detection of even the most sophisticated threats.

Deepwatch

Deepwatch

The Deepwatch Platform helps organizations reduce risk through early and precise threat detection and remediation.

MassMutual Ventures

MassMutual Ventures

Mass Mutual ventures backs companies building category-defining businesses in markets including enterprise software, digital health, cybersecurity, and fintech.

TM One

TM One

TM One is the enterprise and public sector business solutions arm of Telekom Malaysia Berhad (TM) Group.

DataNumen

DataNumen

The fundamental mission of DataNumen is to recover as much data from inadvertent data disasters as possible.

boxxe

boxxe

boxxe create flexible IT infrastructures, collaborative global workspaces and data clarity, all underpinned by world-leading security.

Digital Identification & Authentication Council of Canada (DIACC)

Digital Identification & Authentication Council of Canada (DIACC)

DIACC is a non-profit coalition of public and private sector leaders committed to developing a Canadian framework for digital identification and authentication.

ADL Consulting

ADL Consulting

ADL Consulting provide information security-related consultancy and training support to businesses across the UK. Our services include ISO27001, GDPR, Cyber Essentials and training.

TopSOC Information Security

TopSOC Information Security

TopSOC Information Security provide a wide range of security consultation, implementation and training services.

Bugbank

Bugbank

Bugbank (aka Vulnerability Bank) is a leading SaaS platform for internet security services in China.

Lucidum

Lucidum

The Lucidum platform helps you assess risk and mitigate vulnerabilities by finding and correlating data from your security tech stack.

MicroAge

MicroAge

Powered by five decades of experience, lasting partnerships, client relationships, and the values that guide us daily, MicroAge is here to help you secure, accelerate, and transform your business.

Cythera

Cythera

Cythera is an Australian cyber security company with in-house cyber security professionals providing world-class cyber protection to medium to large companies all over Australia.