{"id":3887,"date":"2018-06-20T00:00:00","date_gmt":"2018-06-20T10:18:08","guid":{"rendered":"https:\/\/staging.voelkerrechtsblog.org\/articles\/disentangling-the-cyber-security-debate\/"},"modified":"2020-12-09T13:11:11","modified_gmt":"2020-12-09T12:11:11","slug":"disentangling-the-cyber-security-debate","status":"publish","type":"post","link":"https:\/\/voelkerrechtsblog.org\/de\/disentangling-the-cyber-security-debate\/","title":{"rendered":"Disentangling the cyber security debate"},"content":{"rendered":"

In his insightful LJIL article<\/a> Kubo Ma\u010d\u00e1k discusses the under-developed state of international cyber security law. He assesses that the absence of cyber security law-making has created a power vacuum that has been filled by non-state actor initiatives, such as the Tallinn Manual<\/a>. He calls on states that now is the time to reclaim their central role in international lawmaking, in the short-term by articulating their opinio iuris more clearly, in the mid-term by overcoming their treaty aversion, and in the long-term by moving towards the adoption of a multilateral cyber security treaty.<\/p>\n

While I fully agree with Ma\u010d\u00e1k\u2019s central argument for more state engagement I would like to highlight a problem that states seem well-advised to address in their future engagement with international law in cyberspace.<\/p>\n

The need to distinguish between technical cyber security risks<\/em> and content-based information security risks<\/em><\/strong><\/u><\/p>\n

States seem well-advised to distinguish more clearly between technical cyber security<\/em> and content-based<\/em> information security risks<\/em>. I submit that with regard to technical cyber security the three-step development Ma\u010d\u00e1k points at is both feasible and desirable; that however with regard to content-based information security risks<\/em> a multilateral treaty is hardly feasible and might even have severe downsides.<\/p>\n

First type of risk: Technical cyber security risks<\/strong><\/p>\n

Technical cyber<\/em> security risks are risks for the confidentiality, availability and integrity (CIA) of information and communications technology (ICT). This category of cyber incidents typically involves deleting, altering or revealing data saved on ICT and is characterised by breaking into an ICT system, for example through hacking, phishing or inserting malware \u2013 for such security risks ICT is the actual target. Already the violation of the CIA of ICT realizes the intended serious adverse consequence. Such serious consequence can range from disabling an electrical grid through violating the integrity of the ICT (e.g. the Black Energy<\/a> attack in 2015), to temporarily or permanently hindering the availability of information or data on the ICT (e.g. the ransomware \u2018Wanna Cry\u2019<\/a> attack in 2017, or the Distributed Denial of Service attack on Estonia 2007<\/a>) or to violate the confidentiality of the ICT (e.g. DNC hack<\/a> in 2016).<\/p>\n

Second type of risk: Content-based information security risks<\/strong><\/h4>\n

By contrast, content-based information security<\/em> risks are security risks which are facilitated or amplified by cyber tools but for which ICT is not <\/em>the actual target, Examples are disinformation (dissemination of \u2018fake news\u2018, employment of \u2018social bots\u2019, e.g. in the US presidential election or the Brexit referendum in 2016) or incitement to terrorism (e.g. on social media). For such security risks the target is ultimately human intelligence, the CIA of ICT remains fully intact. The serious adverse consequence materializes through the successful impact on human intelligence but is independent from the CIA of ICT.<\/p>\n

Indiscriminate discussion of content-based information security and technical cyber security risks<\/strong><\/h4>\n

Although both security risk are evidently substantially different both risks are often used synonymously in the international legal discourse and in public media \u2013 see here<\/span><\/a> and here<\/span><\/a>, adding to a general sentiment of cyber insecurity<\/em> as the new normal<\/span><\/a>. The distinction is rarely explicitly made \u2013 notable exceptions can be found here<\/span><\/a> and here<\/span><\/a>. This synonymous discussion of both risks is problematic for substantial legal progress for several reasons.<\/p>\n

Contestation exacerbated<\/strong><\/h4>\n

Most importantly, it risks hindering international consensus-building on cyber security norms by entangling the more consensual area of technical cyber security risks <\/em>with the highly politicised and contentious area of content-based information security risks.<\/em><\/p>\n

With regard to technical cyber security risks <\/em>recent state practice shows that states gradually realize their commonly shared interests in stepping up cyber resilience and increasing cooperation, for example with regard to protecting ICT-dependent critical infrastructure, to preventing and mitigating international botnet operations or to cooperating in cases of internationally spreading cyber incidents, such as WannaCry). States have increasingly concluded bilateral Memoranda of Understanding (MoU) on technical cyber security risks<\/em>, notably also sidelining the two blocks of the alleged \u2018digital divide\u2019<\/a>, such as the US-China Memorandum of Understanding of 2015<\/a>. India is systematically building a worldwide net<\/a> of bilateral agreements to increase ICT resilience and cooperation, and also other countries, such as Singapore, follow suit (see here<\/a> and here<\/a>). The European Union Directive on Security of Network and Information Systems (NIS) tackles technical cyber security risks<\/em> by establishing a network of computer security incident response teams (CSIRT) and a cooperation group for strategic cooperation. The protection of CIA of ICT is also one of the core purposes of the Draft Convention on Cooperation in Combating Information Crimes<\/a> proposed by Russia in 2018 (Art. 1 [b]).<\/p>\n

By contrast, it is highly contested between states how to address content-based information security risks<\/em>. Regulation of content-based information security risks <\/em>touches upon content control and hence upon highly divergent and politicised stances on Internet governance, human rights and the concept of information sovereignty.<\/em> While the concept of sovereignty is recognized in cyberspace its exact contours and implications for Internet governance are far from a shared understanding. Multi-lateral, multi-stakeholder and hybrid \u2018in-between\u2019 approaches to Internet governance deviate significantly as to the extent of content limitation by states. Despite partial convergent tendencies<\/a> it is almost certain that substantial disagreement on Internet governance and its political implications will remain in the future. Tellingly, even where international consensus exists on which content-based security risks<\/em> need to be counteracted \u2013 for example with regard to child pornography or certain forms of hate speech \u2013 there is disagreement on how to counteract these content-based security risks<\/em>; the Budapest Convention of the Council of Europe on Cybercrime<\/a> of 2001 for example requires state to state requests for assistance or the consent of the concerned private party to access stored computer data (Art. 31 [1], 32 [b]); by contrast, the Draft Convention on Cooperation in Combating Information Crimes<\/a> of 2018 would allow data gathering suo motu <\/em>without prior request to another state party or the consent of the concerned private party (Art. 44).<\/p>\n

It seems hence rather futile to expect substantial consensus-building on information security<\/em> risks in the international sphere.<\/p>\n

Risks for right to freedom of expression and information<\/strong><\/h4>\n

Moreover, moving quickly towards a new multilateral treaty that includes content-based information security risks<\/em> might plausibly have detrimental effects on the right to freedom of information and freedom of expression online. Under human rights law restrictions of the rights under Art. 19 ICCPR must be sufficiently clear, accessible and predictable<\/a>.<\/p>\n

Presently, it seems hard to envision a new multilateral treaty for cyberspace that could satisfy this requirement. An open-ended clause akin to the proposed draft code of conduct for information security introduced by Russia and China in the UN General Assembly in 2011<\/a> (and an updated version in 2015<\/a>) with states vowing to \u2018<\/em>curb the dissemination of information that incites terrorism, secessionism or extremism or that undermines other countries\u2019 political, economic and social stability, as well as their spiritual and cultural environment\u2019<\/em> would fall short of being sufficiently clear, accessible and predictable. Notably, the concern of insufficient clarity, accessibility and predictability has also been raised<\/a> against the German network enforcement act of 2017<\/a>, aimed to tackle hate speech and \u2018fake news\u2019. As international legal scholars currently discuss election meddling through disinformation as a prohibited intervention under Art. 2 (7) UN Charter (see here<\/a> and here<\/a>) clear legal criteria to ascertain the intervention threshold have not yet evolved.<\/p>\n

These examples show that it is extremely difficult to strike a fine balance between the right to freedom of information and expression and the security need to limit content disseminated via ICT. A broad one-size-fits-all restriction clause in a new multilateral information security treaty could plausibly grant a carte blanche<\/em> for surveillance and content control to authoritarian states.<\/p>\n

With respect to human rights it seems hence more promising to slightly deviate from the three-step development Ma\u010d\u00e1k points at and to adopt a more tailored and evolutionary approach with regard to information security risks<\/em> and to, inter alia, strengthen \u2018soft\u2019 parametres, such as transparency, media and information literacy and self-regulation of private intermediaries (see the High Level Expert Group<\/a> on Fake News and Online Disinformation of March 2018 for the European Commission calling for a \u2018self-regulatory approach based on a clearly defined multi-stakeholder engagement process\u2019), and simultaneously clarify the application of already existing mutlilateral treaties, such as the ICCPR, to content-related risks in cyberspace.<\/p>\n

Conclusion and outlook<\/strong><\/h4>\n

At the present stage one can only hypothesize which direction the future international discourse on international law and cyberspace will take. It is uncertain to what extent states will pick up non-state actor initiatives, such as the rules of the Tallinn Manual \u2013 a recent case study<\/a> draws a rather skeptical interim conclusion. Also the forum for future global discussion is uncertain – after the failure of the UN GGE 2017 to conclude on a report the continuation of the UN GGE remains an option, but also an open-ended working group, a cyber committee of the General Assembly or the creation of an inclusive body for interaction of both state and non-state actors within the OECD have been discussed (see here<\/a> and here<\/a>).<\/p>\n

Yet, regardless of the forum the example of the UK Attorney General statement of 23 May<\/a> shows states\u2019 engagement with international law and cyberspace will rather increase than decrease; more states begin to realize that – just like Ma\u010d\u00e1k had argued \u2013 it is in their self-interest to articulate their cyber opinio iuris. To what extent states will distinguish more clearly between technical cyber security risks <\/em>and content-based information security risks <\/em>remains to be seen (see here<\/a>) \u2013 however, and this is the main argument here, they would be well-advised to do so.<\/p>\n

 <\/p>\n

Leonhard Kreuzer is a PhD candidate at the Free University Berlin and a Research Fellow at the Max Planck Institute for Comparative Public Law and International Law, Heidelberg, Germany.<\/em><\/p>\n

This post continues our cooperation with the Leiden Journal of International Law (LJIL). It is a reply to Kubo Ma\u010d\u00e1k’s<\/em><\/i> article\u00a0<\/em>\u2018From Cyber Norms to Cyber Rules: Re-engaging States as Law-makers<\/em>\u2019\u00a0(2017) 30 LJIL 877-899.<\/em><\/p>\n

 <\/p>\n

Cite as: Leonhard Kreuzer, \u2018Disentangling the Cyber Security Debate\u2019, V\u00f6lkerrechtsblog<\/em>, 20 June 2018, doi:\u00a010.17176\/20180620-183041-1<\/a>.<\/p><\/blockquote>\n","protected":false},"excerpt":{"rendered":"

In his insightful LJIL article Kubo Ma\u010d\u00e1k discusses the under-developed state of international cyber security law. He assesses that the absence of cyber security law-making has created a power vacuum that has been filled by non-state actor initiatives, such as the Tallinn Manual. He calls on states that now is the time to reclaim their […]<\/p>\n","protected":false},"author":5,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[6639],"tags":[],"authors":[4936],"article-categories":[6000],"doi":[],"class_list":["post-3887","post","type-post","status-publish","format-standard","hentry","category-uncategorized","authors-leonhard-kreuzer","article-categories-article"],"acf":{"subline":""},"meta_box":{"doi":""},"_links":{"self":[{"href":"https:\/\/voelkerrechtsblog.org\/de\/wp-json\/wp\/v2\/posts\/3887","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/voelkerrechtsblog.org\/de\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/voelkerrechtsblog.org\/de\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/voelkerrechtsblog.org\/de\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/voelkerrechtsblog.org\/de\/wp-json\/wp\/v2\/comments?post=3887"}],"version-history":[{"count":0,"href":"https:\/\/voelkerrechtsblog.org\/de\/wp-json\/wp\/v2\/posts\/3887\/revisions"}],"wp:attachment":[{"href":"https:\/\/voelkerrechtsblog.org\/de\/wp-json\/wp\/v2\/media?parent=3887"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/voelkerrechtsblog.org\/de\/wp-json\/wp\/v2\/categories?post=3887"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/voelkerrechtsblog.org\/de\/wp-json\/wp\/v2\/tags?post=3887"},{"taxonomy":"authors","embeddable":true,"href":"https:\/\/voelkerrechtsblog.org\/de\/wp-json\/wp\/v2\/authors?post=3887"},{"taxonomy":"article-categories","embeddable":true,"href":"https:\/\/voelkerrechtsblog.org\/de\/wp-json\/wp\/v2\/article-categories?post=3887"},{"taxonomy":"doi","embeddable":true,"href":"https:\/\/voelkerrechtsblog.org\/de\/wp-json\/wp\/v2\/doi?post=3887"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}