RUSSIA’S WORRISOME PUSH TO CONTROL CYBERSPACE
WASHINGTON — Russia’s cybermeddling in the 2016 U.S. presidential election has been accompanied by what U.S. and European experts describe as a worrisome Kremlin campaign to rewrite the rules for global cyberspace.
A draft of a Russian proposal for a new “United Nations Convention on Cooperation in Combating Information Crimes” was recently shown to me by a security expert who obtained a copy.
The 54-page document includes 72 proposed articles, covering collection of internet traffic by authorities, “codes of conduct” for cyberspace and “joint investigation” of malicious activity. The language sounds bureaucratic and harmless, but experts say that if adopted, it would allow Russia to squeeze cyberspace even more.
The Kremlin’s proposed convention would enhance the ability of Russia and other authoritarian nations to control communication within their countries, and to gain access to communications in other countries, according to several leading U.S. cyberexperts.
They described the latest draft as part of Moscow’s push over the past decade to shape the legal architecture of what Russian strategists like to call the “information space.”
Russia’s bid to rewrite global rules through the U.N. was matched by a personal pitch on cybercooperation in July from President Vladimir Putin to President Trump at the G-20 summit in Hamburg. Putin “vehemently denied” to Trump that Russia had interfered in the U.S. election, Trump said in a tweet. Trump then floated a mystifying proposal: “Putin & I discussed forming an impenetrable Cyber Security unit so that election hacking, & many other negative things, will be guarded and safe.”
Trump’s suggestion that America join Russia in cyberdefense provoked an uproar in the U.S. One Twitter commentator wrote: “This is like the FBI asking the Mafia to form an anti-crime unit together.”
The White House quickly backtracked after Trump’s tweet. Homeland security adviser Tom Bossert told reporters on July 14: “I don’t believe that the U.S. and Russia have come to that point yet in cyberspace. And until we do, we wouldn’t have the conversation about partnership.”
Many U.S. cyberexperts share Bossert’s view that although any formal treaty or partnership with Moscow now is unwise, quiet confidence-building discussions might be useful. Those could include military-to-military or technical contacts to explore how to avoid catastrophic cyberevents that might cripple strategic systems or pose systemic risk.
U.S. and Russian officials had maintained such a dialogue to explore norms for the internet, but so far it has been a dead end. The Russians were led by Andrey Krutskikh, a foreign ministry official who is Putin’s cyberadviser; and on the U.S. side, by Christopher Painter, who was White House cyberchief under President Obama and then cybercoordinator at the State Department, a post he’s leaving soon.
Those contacts are sensible, but they have withered as U.S.-Russia relations have deteriorated.
The Russians, meanwhile, continue their campaign to regulate cyberspace on their terms, by mobilizing allies to support their alternative to the Budapest convention.
Russia got some global support for its rules-making effort at a September gathering in Xiamen, China, of the so-called BRICS countries: Brazil, Russia, India, China and South Africa.
In their formal declaration, the countries “recognize the need for a universal regulatory binding instrument on combatting the criminal use of ICTs [information and communications technologies] under the U.N. auspices.” The countries “acknowledge the initiative” of Russia in seeking such a binding pact.
If the events of the past year have taught us anything, it’s that Russia views information as a decisive political weapon and wants to control this potential battlespace. The global regulatory side of this contest gets little attention, but it could help determine whether open information flows survive in the age of the autocrats.