The G7 summit meeting hosted by Japan May 26-27 2016 issued a document entitled “G7 Principles and Actions on Cyber”. The text contains strong commitments in the field of human rights, but it also highlights the challenge of achieving international cooperation on cyber security against a backdrop of deteriorating geopolitical relations between leading cyber and military powers. In this crucial realm of international cyber security, which acts as an enabler for much of the socio-economic benefits to be derived from the Internet, the pronouncements from the G7 summit are not all that reassuring.
In the first instance, the goal of a peaceful cyberspace is conspicuous by its absence from the statement. The G7 will promote security and stability in cyberspace, but there is no apparent aspiration to keep cyberspace a realm of peace rather than war. The statement speaks of taking “decisive and robust measures in close cooperation against malicious use of cyberspace both by states and non-state actors”, but these measures are not elaborated on and there is something in the language tone here that suggests they will not be of a diplomatic nature.
The G7 appear to be laying the ground for undertaking military responses to cyber operations they deem hostile by affirming that “cyber activities could amount to the use of force or an armed attack within the meaning of the UN Charter”. It is indeed suffering “an armed attack” that entitles a state under Article 51 of the UN Charter to exercise the right of self-defence, thus the framing of such an eventuality in this fashion is fraught with serious politico-military consequences. How and by whom such a determination as to the severity of a cyber attack is made is left unaddressed in the G7 statement and there is clearly wide scope for unilateral (and potentially dangerous) interpretation and action in this regard.
The G7 offer up the goal of developing a “strategic framework of international cyber stability”. Active cooperation for conflict prevention does not figure in this schema. This framework is to consist of the applicability of international law to state behavior in cyberspace, the promotion of voluntary norms of responsible state behavior during peacetime and the development and implementation of practical cyber confidence building measures (CBM) between states. On the surface these steps seem constructive, but a closer examination reveals some areas of concern.
The 2015 report of the UN Group of Governmental Experts (GGE) on international cyber security that the G7 statement welcomes, recommended some specific CBMs of a restraining nature that would be an important contribution to maintaining a benign operating environment in cyberspace. These recommended measures included a prohibition on targeting via cyber operations critical infrastructure for public use and a similar ban on targeting (or implicating in cyber attacks abroad) the cyber security incident response teams that states have established to help ensure domestic cyber security.
The GGE recommendations did not however carry the caveat “during peacetime” that the G7 statement introduces. Shouldn’t states be trying to establish enduring protection for at least a part of the civilian sector? Has the international community resigned itself to a cyber space that will be purely a “target rich environment” once some state decides to go on the war path, however that is to be understood in the digital era? No one has assigned to the G7 the right to make such decisions on behalf of the wider world. Rather it underlines the necessity for the G7 and others to engage in the hard work of diplomacy to help develop a set of rules for responsible state action that is not skewered in favor of worse case scenarios and holds forth a prospect for international cyber security cooperation. Working towards a goal of cyber peace instead of cyber war would certainly be the first option of the vast majority of the world’s “netizens” if they were given the chance to vote.
In conclusion, it is worth bearing in mind some remarks that one of the G7 participants, US President Barack Obama made during a brief visit to another Japanese city after the summit ended. In his speech at Hiroshima’s Peace Memorial Park, President Obama recalled that the Second World War which ended in such tragedy for the inhabitants of that city “…grew out of the same base instinct for domination or conquest that had caused conflicts among the simplest tribes, an old pattern amplified by new capabilities and without new constraints.” Cyberspace represents potent new capabilities; it is time to develop some constraints to counter the base instincts for domination and preserve the peace.
The full text of the ICT4Peace Foundation commentary is here.
The full text of “G7 Principles and Actions on Cyber” you can find here.
An overview of the ICT4Peace Activities in the field of Rights and Security in the Cyberspace you find here.