Does Russia Want a Cyber Agreement? Who’s Listening?

A recent interview of Russian President Vladimir Putin revealed insight into his – and by extension – Russia’s views concerning cyber attacks, and really the cyber domain, as a whole.  Made at a joint press briefing with France’s president, when asked about alleged interference in the 2016 U.S. presidential election, Putin remarked: “Action always causes reaction” and that “If one does not want to get a reaction he does not like, rules for actions need to be set.”  Putin pointed out that in the early days of nuclear weapons, governments had found a way to negotiate guidelines on their use, an effort that should be replicated in today’s political climate.  While not necessarily as catastrophic as nuclear weapons, the potential impact is similar in that the disruption and/or destruction of interconnected information technology can potentially impact millions of people.  The implication is certainly clear: an international understanding needs to be done sooner rather than later.

These public pronouncements of the Russian president are noteworthy as they provide insight into not only how Russia views the activities that transpire in cyberspace but express a potential avenue of engagement for world leaders to approach Russia on these issues.  Cyber norms and discussions of how states have been ongoing in international forums.  The preferred U.S. approach – via the United Nations Group of Experts in the Field of Information and Telecommunications in the Context of International Security (GGE) – notably stalled in June 2017, calling into question if this Western-preferred approach to establishing norms will succeed under this umbrella.

Putin’s remarks come at a time when increased attention has fallen on alleged Russian hacking, as well as other governments as well.  For example, despite being on the precipice of an historic peace agreement with North Korea, the Hermit Kingdom is suspected of still carrying out cyber attacks against South Korea.  Other nations as well are believed to be developing or sponsoring cyber espionage activity.  Two of them – Lebanon and the Netherlands – are not the typical governments associated with cyber spying, and yet there is some indication that they are doing exactly that. Putin’s intimation is evident – the longer an international understanding on what is acceptable for how states operate in cyberspace is delayed, the more governments will acquire the capability, and the more such activities will muddy the waters.

It’s not like Russia, or China for that matter, hasn’t raised its own approaches toward this effort. Twice both governments spearheaded bringing their “code of conduct” proposals before the United Nations, only to be pushed back by Western states.  With the UN GGE efforts stalled, and the “code of conduct” languishing in the throes of the U.N., states are essentially advocating for the status quo as an acceptable reality.  This is odd, given that many governments cite the national security dangers of cyberspace, as they are impacted by both criminal and state-backed activities.  Kicking a cyber agreement down the road doesn’t make much sense in a dynamic landscape that continues to favor hostile behavior.  Critics can argue that attribution has gotten better, but it has not proven a deterrent by any means.  Spying will always remain a state prerogative, regardless of how any agreement is worded.

Keeping the status quo remains beneficial for those states most active in conducting hostile cyber operations intent on spying, stealing, or on those rare occasions, attacking with intent to damage target networks.  Governments can point to activity it has determined to be the responsibility of an adversary without providing enough evidence to convince an objective audience of culpability.  The longer there are no established “rules of engagement” that can be broken, the longer states can operate without fear of incurring any substantial consequence.  While a victim state can claim objection to being on the receiving end of these activities, the offending state can embrace justification of pursuing their national security interests.  And one thing is clear: all states act to preserve their own national interests.

Let’s hope that world leaders listen to what Putin has said.  He wants to find some agreement on state behavior in cyberspace.  A solution will likely have to be built on confidence building measures and mutual consensus.  Perhaps its time to get the major players at the same table to hammer out their positions, and then push the message down, rather than continue to spin wheels in forums in which lasting traction has proven elusive.

This is a guest post by Emilio Iasiello