The Rules of Cyberspace Just Got A Bit Clearer

The UN's new recommendations guiding state activity in cyberspace break new ground in three important areas.

The United Nations Group of Governmental Experts on Information Security (GGE) agreed to consensus document laying out its recommendations to guide state activity in cyberspace. Politico.com called the document a “breakthrough” because it enshrines a series of norms that the US government has been promoting. At the time the article was published, it was hard to determine whether the champagne popping was necessary given that report wasn’t made public. Late last month, the UN released the text of the 2015 GGE report.

As with many UN reports, this one is filled with recycled language from previous reports and General Assembly resolutions. The sections that speak to the threats in cyberspace, the need for confidence building measures, and the importance of capacity building are largely pilfered from the 2013 report and don’t really convey anything new. However, there are some exceptions. 

The US was successful in getting its preferred norms with respect to critical infrastructure–States should respond to requests for assistance, and refrain from cyber activity that intentionally damages or impairs critical infrastructure or computer emergency response teams–adopted by the group. On the surface, getting everyone to agree to not attack critical infrastructure is great. But it’s hard to see what additional clarification this new norm provides. 

Each state classifies critical infrastructure differently–the United States has sixteen sectors, Japan has thirteen, Canada has ten, Germany has nine–and many of these sectors are defined so broadly, that any disruptive or destructive cyber incident is likely to affect some form of critical infrastructure. For example, the North Korea incident against Sony was probably an attack against critical infrastructure, given that the US Department of Homeland Security classifies motion picture studies as part of it’s commercial facilities sector. Moreover there’s already a norm against disruptive or destructive cyber activities. It’s called Article 2(4) of the United Nations Charter, which prohibits the threat or use of force.

Despite the lack of new insight on the protection of critical infrastructure, the GGE report breaks new ground in three important areas.

First, the report explicitly references the possible applicability of the international legal principles of humanity, necessity, proportionality, and distinction, though the wording of the text makes it unclear whether the group reached consensus on whether they actually apply to state activity in cyberspace or merely noted their existence. 
The US seems to interpret it as endorsing the applicability of these principles to cyberspace, but the Chinese in particular have avoided doing so in the past. At the 2012-2013 GGE, the Chinese blocked any attempt to reference humanitarian law principles in that group’s report on the basis that endorsing their applicability would legitimize armed conflict in cyberspace. If the 2014-2015 group endorsed necessity, proportionality, and distinction, it would represent a considerable shift in China’s position.

Second, the report notes that states should substantiate public accusations of state-sponsored cyber activity, and that “the indication that an ICT activity was launched or otherwise originates from a State’s territory … may be insufficient in itself to attribute the activity to that state.” While this may seem obvious to anyone who cursorily follows the blog, the text was probably inserted at China’s request to get other states to stop accusing it of malicious cyber activity. China regularly asserts that accusing it without proof is “irresponsible and unscientific,” and may be trying to promote a norm against public attribution without strong evidence. The United States has signalled that it is willing to name and shame states that engage in destructive activity (e.g. North Korea), steal intellectual property for commercial gain (e.g. the five PLA indices), and to establish deterrence. In the future, the United States may need to provide more concrete evidence than the “trust us” approach it’s used in the past.

Third, the report recommends that states “should respond to appropriate requests for assistance by another state whose critical infrastructure is subject to malicious ICT acts.” This recommendation may seem banal, but it’s pretty significant. Many states have established national computer emergency response teams (CERTs) to act as focal points to coordinate national and international responses to cyber incidents. 

Oftentimes, one national CERTs’ request for assistance from another can go unanswered for days, allowing malicious traffic that could be terminated to go unabated. In the case of the 24/7 point-of-contact network established by the G8 to combat cybercrime, many of the national points of contact don’t even pick up the phone. Creating an expectation that requests for assistance will be answered may actually pressure some into responding. 
DefenseOne: http://bit.ly/1JPSTx6

 

« Where’s The Money in Data?
Snowden : Smartphones Can Be Remotely Controlled »

CyberSecurity Jobsite
Check Point

Directory of Suppliers

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

Tines

Tines

The Tines security automation platform helps security teams automate manual tasks, making them more effective and efficient.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Webroot

Webroot

Webroot delivers next-generation endpoint security and threat intelligence services to protect businesses and individuals around the globe.

GFI Software

GFI Software

GFI Software works with System Administrators, IT Professionals and IT Executives to ensure that their IT infrastructures are monitored, managed, secured and compliant.

Homeland Security Investigations (HSI)

Homeland Security Investigations (HSI)

Homeland Security Investigations (HSI) is a premier federal law enforcement agency within the Department of Homeland Security (DHS).

L J Kushner & Associates

L J Kushner & Associates

L.J. Kushner is a leading Information Security recruiting firm.

DQM GRC

DQM GRC

DQM GRC are one of the UK's leading providers of data governance, e-privacy and GDPR services, to commercial organisations across all industries in the UK.

PROOF

PROOF

PROOF is a Brazilian leader in cybersecurity. Our goal is to assist our Customers in managing security efficiently and in tune with business needs.

Cyber Security Jobs

Cyber Security Jobs

Cyber Security Jobs was formed to help job seekers find jobs and recruiters fill cyber security job vacancies.

Tehtris

Tehtris

TEHTRIS XDR Platform was developed to control and improve the IT security of private and public companies against advanced cyber threats such as cyber espionage or cyber sabotage activities.

IT Band Systems

IT Band Systems

IT Band Systems is an international provider of IT products and services including web server monitoring and web security consulting.

Ministry of Information and Communications (MIC) - Vietnam

Ministry of Information and Communications (MIC) - Vietnam

The Ministry of Information & Communications of Vietnam is the policy making and regulatory body in the field of information technology and national information and and communication infrastructure.

UK Cyber Security Council (UKCSC)

UK Cyber Security Council (UKCSC)

The role of The UK Cyber Security Council is to champion the cybersecurity profession across the UK, provide representation for the industry, accelerate awareness and promote excellence.

SAM Seamless Network

SAM Seamless Network

SAM Seamless Network is a cybersecurity technology platform that protects the connected home, by tackling cyber security threats at the source.

Nuance Communications

Nuance Communications

From revolutionizing the doctor-patient relationship to reinventing the way brands connect with their customers, Nuance technology helps organizations push the boundaries of what’s possible.

5S Technologies

5S Technologies

5S Technologies is a regional IT solutions and services provider based in Cary, NC and serving the Carolinas.

Archipelo

Archipelo

At Archipelo, we empower organizations with Developer Security - to increase software security and compliance throughout the development lifecycle.

Forrit

Forrit

Forrit is the secure and scalable Content Management System (CMS) built specifically for large enterprises in highly regulated sectors.