New Problems Caused by the Cyber Realm
This video …
- gives a basic idea of how cyberattacks are conducted
- introduces the “attribution problem” in cyberspace
- shows why deterrence is problematic in the cyber realm
- explains the difference between offensive and defensive cyber operations
- introduces the concept of “hackbacks” and the problems they cause
The Cyber Kill Chain
The arms manufacturer Lockheed Martin has developed the concept of the “Cyber Kill Chain”, a model of how a cyberintrusion works.
Today, there are many variants of the “kill chain” and we present a rather consolidated version here. What is important, however, is that the cyber kill chain dictates that for any form of counter attack in the case of an attack, the defender needs prior knowledge of the attacker’s system. So even if a state has no intention of offensive cyberoperations, it has to actively look for weak spots in the computer systems of potential adversaries.
Reconnaissance and Weaponization
After careful reconnaissance of the potential victim, a “weaponized” file is created, aiming at a specific exploit. While looking harmless (e.g. .pdf, .mp4 or .jpg), the file contains malicious code.
Delivery and Exploitation
The file is delivered to the target (e.g. by a forged email) and run, thereby exploiting the preselected vulberability of the targeted system.
Privilege Escalatation
The malicious code installs a “beachhead” granting access to the system. From this beachhead, the intruder aims for privilege escalation, for example administrator instead of user rights.
Achieving Objectives
Finally, after gaining command and control the intruder can achieve his or her objective, be it data exfiltration, data destruction, data manipulation or simply switching off the system.
In a military context, for example, an intruder could place sleeping executable code in a system, reacting to specific circumstances.
Zero Day Exploits
Updates and patches will of course interrupt the kill chain, so intelligence agencies and military actors are always looking for new and unknown weak spots, so-called zero-day exploits.
There is a black market for zero day exploits which have been known to the general public. Complex cyber operations, like Stuxnet, are based on several zero-day exploits.
The Problems of Arms Control in Cyberspace
This video debates:
- why arms control is particularly difficult in the cyber realm
- what kind of agreements have been made so far
- whether soft norms or legally binding treaties should be aimed for
- whether confidence building measures could make a difference
Difficulties of Classical Arms Control in Cyberspace
What to control?
In a classical arms control agreement, participating parties exactly define what “effector” or “carrier” falls under the treaty. These terms are less clear in the cyber realm.
The Verification Problem
Solid verification is one of the important pillars of successful arms control agreements. However, how to verify complex software without being too intrusive is a problem yet to be solved. This also includes updates.
Different Classes of Actors
Traditionally, the relevant actors in arms control are nation states. Not much thought has been given to the question of how non-state actors can be included into formal arms control agreements.
The Rapid Technological Development
Even if the first problem, what to control, could be solved, the rapid technological development might render all agreements useless after a very short time.
The Attribution Problem
The attribution problem presented before makes it tricky or even impossible to identify breaches in case of attacks.
Scope
If a classical arms control agreement could be found, who should be a member? Should it only include the major cyber powers or should it be as universal as possible?
| Treaties | Norms | |
|---|---|---|
| Positives | Clearer understanding of do’s and don’ts higher authenticity of forensic material - states still main actors in more dangerous forms of cyber-incidents | easier to achieve than treaties- involvement of actors beyond the state: “norm-entrepreneurs”- relevant legal basis has to be established as a norm anyway- ignorant to verification problems |
| Negatives | harder to achieve- problematic verification- take very long to negotiate- unrealistic, at least at the moment | violations hard to attribute …- … or no credible attribution- different interpretations possible- How deep is the internalization?- frustration when violated- no punishment for non-compliance |
Assessment
- Norms seem achievable at the moment, treaties not so much.
- Who will be future norm-entrepreneurs? States? NGOs? Private Companies? Even intelligence agencies?
- Can norms be a the stepping stone towards legally binding treaties? At least when supported by (voluntary) Confidence Building Measures (CBMs)?
What Norms? Cybernorms and CBMs in the 2015 UN GGE Report
So far, the 2015 UN GGE report has been the last report unanimously accepted by all experts involved, focusing on relevant norms in the cyberrealm (see page 13 for more details on UN GGE).
The report states:
norms reflect the international community’s expectations, set standards for responsible State behaviour and allow the international community to assess the activities and intentions of States”
United Nations A/70/174, p.7
According to the 2015 UN GGE report, states behaving responsibly should:
- not allow “their territory to be used for internationally wrongful acts using ICTs” (p.8)
- “not conduct or support ICT activity that … intentionally damages critical infrastructure” (p.2)
- respect human rights on the internet and the right to privacy in the digital age (p.8)
- “increase stability and security in the use of ICTs” and prevent harmful practices (p.7)
- “consider all relevant information” in case of ICT incidents (p.7)
- “consider how best to cooperate to exchange information” (p.8)
- “prosecute terrorist and criminal use of ICTs” (p.8)
- “take appropriate measures to protect their critical infrastructure” (p.8)
- respond to “requests for assistance” by other states (p.8)
- “encourage responsible reporting of ICT vulnerabilities and share remedies” (p.8)
The 2015 report also contains recommendations for voluntary confidence building measures:
- identification of “points of contact” for cases of “serious ITC incidents” (p.9)
- development “of and support for bilateral, regional, subregional and multilateral consultations” (p.9)
- “Encouraging …. transparency at the bilateral, subregional, regional and multilateral levels” (p.9)
- provision of “national views of categories of infrastructure that they consider critical and national efforts to protect them” (p.9)
- additional “confidence-building measures that would strengthen cooperation on a bilateral, subregional, regional and multilateral basis” (p.9)
New Actors, New Interests, New Stakeholders?
Traditionally, norms regulating the field of information and telecommunications have been set by state actors. First initiatives were, for example, brought forward by Russia before the turn of the Millenium.
More recently, however, new actors have joined the field, for a variety of reasons. In a recent and widely cited publication by Illina Georgieva, the author argues that
security and intelligence agencies have become major actors in the cybersecurity landscape
Georgieva 2020: 33
Just with their actions, these agencies are setting norms for appropriate, or at least accepted behavior, for the international community, sometimes in conflict with other, more formal normative regulations.
Other actors which have become more active, and a cause for debate, have been private companies. Case in point is the so-called “Paris Call for Trust and Security in cyberspace”, a cybersecurity agreement promoted by, amongst others, Microsoft, Facebook or Google. The call features 9 essential principles.
According to a Microsoft blog, the support for the call “demonstrated a widespread, global, multi-stakeholder consensus about acceptable behavior in cyberspace.” In contrast to these private companies, the US government refrained from endorsing the document.
It is obvious, however, that companies did not push the call for altruistic reasons, but because cyber incidents are a threat to their core business models.
Given their interest and often enormous resources, we will see the shift from lobbying their national governments to actually promoting an agreement together with foreign governments probably more often in the future.
Cyber-Related Agreements Throughout the Years
After a slow start in the 90s and early 2000s, international agreements between states regarding cyberspace have become more common in the last decade. These agreements have often been at the regional (or alliance) level with recent efforts to establish international norms across the entire international community. In most cases, the agreements simply reaffirm the position that international law should apply in cyberspace. The establishment and enforcement of cyber norms are still in the making. This timeline presents an overview of the various cyber-related agreements from the last two decades.
References
- Osula, Anna-Maria /Rõigas, Henry (2016): Introduction, in: Osula, Anna-Maria /Rõigas, Henry (eds), International Cyber Norms: Legal, Policy & Industry Perspectives, Tallinn: NATO CCD COE Publications, 11-22. View PDF
- Van Horenbeeck, Maarten (2018): “Cybersecurity Culture, Norms and Values: Background paper to the IGF Best Practices Forum on Cybersecurity.” Internet Governance Forum 2018. View PDF
Data compiled by Jessica Draper
- December 22, 1992
International Telecommunication Union
The Constitution and Convention of the International Telecommunication Union was the founding document of the International Telecommunication Union with the aim of “facilitating peaceful relations, international cooperation among peoples and economic and social development by means of efficient telecommunication services.”
A provision of this treaty includes the International Telecommunications Regulations, first established in 1988, which outlines various principles related to the development and operation of telecommunication services. However, regulations referring to the malicious use of such services between states are not addressed.
- November 23, 2001
Budapest Convention on Cybercrime
The Budapest Convention on Cybercrime, originating out of the Council of Europe, was the first international treaty to address crimes committed via computer networks, “dealing particularly with infringements of copyright, computer-related fraud, child pornography and violations of network security.” Its main objective was to pursue a common criminal policy aimed at the protection of society against cybercrime. Sixty-four states have ratified the treaty, including the United States. Russia opposes it on grounds of sovereignty.
- June 16, 2009
Shanghai Cooperation Organization, Yekaterinburg Agreement
This “Agreement between the Governments of the Member States of the Shanghai Cooperation Organization on Cooperation in the Field of International Information Security” (Source) addressed the need among SCO members (China, Russia, Kazakhstan, Kyrgyzstan, Tajikistan, and Uzbekistan) to cooperate in curbing the development of cyber weapons and attacks. Defining concepts such as “information security” and “information war,” it is the first international agreement to acknowledge and address issues of cyber warfare between states.
This agreement further formed the basis of the “Code of Conduct for Information Security” submitted to the UN in both 2011 and 2015, but it has not been put to a vote (Osula and Rõigas 2016).
- December 14, 2012
International Telecommunication Regulations (ITRs)
The Final Acts of the World Conference on International Telecommunications is a renegotiation of the 1988 ITRs. The International Telecommunications Union said the document would help countries coordinate efforts against spam and increase the development and availability of serivces around the world. However, the question of state governance over the development of the internet’s technical infrastructure was hotly debated. As a result, only 89 states signed the treaty, excluding many Western democracies such as the US, Canada, the UK, and Australia (BBC, 2012).
- June 17, 2013
Bilateral Agreement Between the US and Russia
This bilateral agreement between the US and Russia aimed to “[extend] traditional transparency and confidence-building measures to reduce the mutual danger” both states face from cyber threats. In this effort, it created a working group that assesses emerging cyber threats and proposes joint measures to address them, as well as a hotline to share information regarding these matters.
- June 24, 2013
UN Group of Government Experts (2013)
The 2013 Group of Governmental Experts on Developments in the Field of Information and Telecommunications the Context of International Security included 15 countries agreeing that international law, such as the UN Charter, is the main source for regulating offensive state behaviour in cyberspace. In seeking to establish norms derived from international law, the document stated, “although the work of the international community to address this challenge to international peace and security is at an early stage, a number of measures concerning norms, rules and principles for responsible State behaviour can be identified for further consideration.”
- December 3, 2013
OSCE Confidence-Building Measures
Member states of the OSCE agreed to confidence-building measures aimed at reducing the risk of conflict stemming from the use of information and communication technologies (ICTs). Largely focused on information sharing, these measures sought to “enhance interstate co-operation, transparency, predictability, and stability, and to reduce the risks of misperception, escalation, and conflict that may stem from the use of ICTs.”
- July 17, 2014
The 6th BRICS Summit: Fortaleza Declaration
As part of the Fortaleza Declaration at the 6th BRICS Summit, Brazil, Russia, India, China, and South Africa agreed to “explore cooperation on combating cybercrimes” as well as to “recommit to the negotiation of a universal legally binding instrument in that field.”
- September 5, 2014
NATO Wales Summit Declaration
In their Wales Summit Declaration, NATO member states endorsed an “Enhanced Cyber Defence Policy” that reaffirms a cyber defense responsibility of the alliance and “recognises that international law, including international humanitarian law and the UN Charter, applies in cyberspace.” The declaration also established cyber defense as “part of NATO’s core task of collective defence.”
- February 11, 2015
Council of the European Union on Cyber Diplomacy
In the Council Conclusions on Cyber Diplomacy, European Union member states are encouraged to work towards a global understanding of “how to apply existing international law in cyberspace and to the development of norms for responsible state behaviour in cyberspace.” States are further encouraged to “strongly uphold the principles regarding State responsibility for internationally wrongful acts and to take the initiatives necessary…to ensure that they are fully respected and enforced in cyberspace.”
While it reitereates the position that existing international law is applicable in cyberspace, it also discusses internet governance, promotion and protection of human rights in cyberspace, and other capacity-building and engagement topics.
- May 8, 2015
Bilateral Agreement Between China and Russia
China and Russia “signed a memorandum not to launch hacking attacks against each other and condemned efforts to destabilize internal politics via the Internet” (New York Times, 2015). While “perhaps 70 percent” of the agreement had been borrowed from the previous agreement under the Shanghai Cooperation Organization, this agreement added “language protecting internal sovereignty in cyberspace.”
- July 22, 2015
UN Group of Government Experts (2015)
As a second iteration of the original 2013 GGE report, this 2015 report from the Group of Governmental Experts on Developments in the Field of Information and Telecommunications in the Context of International Security sought to “outline additional points of agreement and to further develop the content of the 2013 report” (Osula and Rõigas 2016). The report expands the discussion of norms and recommends that states “cooperate to prevent harmful ICT practices and should not knowingly allow their territory to be used for internationally wrongful acts using ICT.” States such as the United States, Russia, and China were included in this report.
- September 26, 2015
Bilateral Agreement Between the US and China
The US and China agreed to cooperate on matters of cybercrime investigations. Both states also support the GGE reports on norms of behavior and other crucial issues for international security in cyberspace. In addition, the agreement created a hotline for direct communication of information requests regarding malicious cyber activity.
- November 16, 2015
G20 Leaders’ Antalya Communiqué
In their Antalya Summit Communiqué, G20 members welcomed the 2015 GGE report affirming that international law, in particular the UN Charter, is applicable to state conduct in cyberspace. They also committed themselves to the view that all states should abide by norms of responsibile behavior and should “promote security, stability, and economic ties with other nations” within cyberspace.
- November 21, 2017
Call to Protect the Public Core of the Internet
As a multistakeholder commission, the Global Commission on the Stability of Cyberspace (GCSC) urged all stakeholders within government, industry, technical and civil society to adhere to the following norm proposal:
“Without prejudice to their rights and obligations, state and non-state actors should not conduct or knowingly allow activity that intentionally and substantially damages the general availability or integrity of the public core of the Internet, and therefore the stability of cyberspace.”
Here, “public core” refers to packet routing and forwarding, naming and numbering systems, the cryptographic mechanisms of security and identity, and physical transmission media.
- April 28, 2018
ASEAN Leaders' Statement on Cyber Security Cooperation
At the 32nd Association of Southeast Asian Nations Summit, ASEAN leaders addressed in a statement the threats existing in cyberspace and reaffirmed the position that international law applies in the cyber environment. The statement acknowloedged that “the promotion of international voluntary cyber norms of responsible State behaviour is important for cultivating trust and confidence and the eventual development of a rules-based cyberspace.” ASEAN member states agreed to improve coordination of cybersecurity policy development and capacity building initiatives towards this end.
- May 28, 2018
Call to Protect the Electoral Infrastructure
The GCSC proposed another norm regarding electoral infrastructure: “State and non-state actors should not pursue, support or allow cyber operations intended to disrupt the technical infrastructure essential to elections, referenda or plebiscites.”
- November 2018
GCSC Norm Package
The Global Commissition on the Stability of Cyberspace further introduced a “norm package” of additional norms that state and non-state actors should abide by. These norms include:
- Norm to Avoid Tampering
- Norm Against Commandeering of ICT Devices into Botnets
- Norm for States to Create a Vulnerability Equities Process
- Norm to Reduce and Mitigate Significant Vulnerabilities
- Norm on Basic Cyber Hygiene as Foundational Defense
- Norm Against Offensive Cyber Operations by Non-State Actors
- December 11, 2018
Paris Call for Trust and Security in Cyberspace
With support of 67 States, 139 international and civil society organizations, and 358 entities of the private sector, the Paris Call reaffirms that “international law, including the United Nations Charter in its entirety, international humanitarian law and customary international law is applicable to the use of information and communication technologies (ICT) by States.” The delcaration also condemns the use of malicious cyber activities in peacetime and welcomes the protection of critical infrastructure that are vulnerable to such activities. Further, it supports cooperation to prevent malicious cyber activity (including undermining electoral processes, theft of information for providing competitive advantages, etc.) and encourages the strengthening of defence and security against such actions.
The US, China, and Russia did not sign the declaration. However, American technology corporations such as Microsoft, Facebook, Google, IBM, and HP all endorsed the agreement.