Cyberspace
Cyberspace, or "the notional environment in which communication over computer networks occurs", is frequently discussed as the next global commons that the international community will need to govern, in much the same way it has for outer space and the oceans.
Quicktabs: Keywords
Submarine cables and pipelines are vulnerable assets in the global commons.182 Their protection from undersea attack is a real prescriptive and enforcement challenge because of our extreme reliance on this critical infrastructure; its multi-jurisdictional span beyond territorial seas; the availability of precise locational coordinates; the opaque environment below the waterline; and the accessibility to commercial-grade vehicles that can exploit this environment and inflict disproportionate harm.
The opaque environment and the accessibility to UUVs set this challenge apart from challenges above the water's surface to flagged vessels and platforms. As with cyber threats, this necessitates an effective deterrence policy to compensate for an inability to pinpoint suspected culprits. Not only do legal shortcomings in jurisdiction and security enforcement float above the surface, but arguably more sinister shortcomings lurk below. These threats also require an even more delicate balance between disclosure and secrecy, and between freedom ofnavigation and reasonable restraints for collective security.
In the end, whatever vigor is applied towards cyber security, and whatever balance is struck for internet freedoms should be matched by securing the very cables that transport this life-blood of commerce. Likewise, investment in energy independence should correspond to the security of the very arteries that enable and spur offshore energy exploration.
The Internet poses legal challenges similar to those encountered in maintaining order in the use of the world's oceans. UNCLOS, which imposes law and order in the seas, entered into force based on "the notion that all problems of ocean space are closely related and needed to be addressed as a whole."" Similarly, the Internet is shared globally and the consequences of actions taken by an Internet user in one jurisdiction can be borne globally. As a result, the legal challenges posed by cyberaggression are similar in many respects to the problems posed by piracy and other criminal activity on the high seas. UNCLOS specifically addresses piracy by defining conduct that constitutes piracy178 and describing the duties of all nations with respect to combating piracy.179 For example, UNCLOS balances the territorial jurisdiction of nations with the concept of universal jurisdiction. Article 105 provides that "[o]n the high seas, or in any other place outside the jurisdiction of any State, every State may seize a pirate ship or aircraft" and that "[t]he courts of the State which carried out the seizure may decide upon the penalties to be imposed."180 Moreover, if a vessel engaged in piracy is captured in international waters by a nation that does not have criminal law that applies beyond their territorial borders, other nations that do have such criminal law may prosecute the pirates based on universal jurisdiction.181
If members of the international community were able to develop a convention structured after UNCLOS, mandating international cooperation on cybersecurity and applying universal jurisdiction to acts of cyberaggression, the benefits would be palpable. One such benefit would be an opportunity to create a U.N. agency comparable to the International Maritime Organization (IMO) 210 whose purpose would be to ensure the safety and security of the Internet.
The IMO was created pursuant to the adoption of the Convention on the International Maritime Organization,211 which entered into force in 1958. The purpose of the IMO as stated in Article 1(a) of the Convention is to facilitate cooperation among governments in order to ensure that the "highest practicable standards in matters concerning maritime safety" are in place. The IMO also maintains detailed records of all incidents of piracy,213 which supports the IMO's policy recommendations and efforts to develop new law when the need arises.214 One such legal instrument is Resolution A.738(18), which was intended to facilitate States' duties to cooperate in the repression of piracy under Article 100 of UNCLOS.215 Generally, Resolution A.738(18) encouraged intergovernmental cooperation in all aspects of piracy prevention and solidified the IMO's antipiracy strategy. The IMO's "strategy consist[s] of compilation and distribution of periodical statistical reports, piracy seminars and field assessment missions to regions affected by piracy and the preparation of a code of practice for the investigation and prosecution of the crime of piracy."216
An agency similar in function to the IMO dedicated to tracking incidents of cyberaggression and fostering cooperation between member nations would help to consolidate the international effort to monitor and deter cyberaggression. Moreover, such an agency would help to legitimize the international legal regime that created it, and would provide sound policy rooted in empirical evidence.
The recent cyberattacks on Estonia, Georgia, and Iran demonstrate the shortcomings of both international criminal law governing cybercrime and he absence of international law addressing cyberterrorism and cyberwarfare. In a world where internet commerce is increasingly important to the growth of the global economy, nations cannot afford to shape cybersecurity law unilaterally in furtherance of provincial interests at the expense of a concerted international effort to develop uniform cybersecurity law. As the economic futures of nations become ever more intertwined, international consensus on issues like cyberaggression is essential to global security and economic well-being.
Analogizing cyberthreats to the concerns that spawned cooperation in developing international maritime law is a useful starting point for analyzing and developing an international response that is necessary to meaningfully address global cybersecurity. Without an international agreement that defines the spectrum of cyberaggression, provides for some form of universal jurisdiction over perpetrators, and establishes an international organization focused on cybersecurity policy, the threat to international security posed by cyberaggression will continue to grow. To that end, the mere existence of an international cybercrime tribunal would go a long way toward encouraging cooperation on the development of international norms relating to cybercrime, while allowing nations to retain some level of autonomy in the development and enforcement of domestic cybersecurity policy.
Although international maritime law has not established an international tribunal to prosecute acts of piracy, some experts believe that creating such a tribunal would provide a long-term solution to combating piracy.217 Employing an international tribunal with respect to acts of cyberaggression would ensure that offenses are not treated differently across jurisdictional lines. At the very least, the existence of an international tribunal with universal jurisdiction over acts of cyberaggression would deter such acts and provide a venue for prosecution where nations otherwise often refuse to prosecute such acts. As with piracy, it may be difficult to compel nations to prosecute acts of cyberaggression in the absence of an international tribunal, where the concept of universal jurisdiction confers a right but does not impose an obligation to prosecute such crimes.218 It has been suggested that "while every state should retain the right to redress piracy, the United Nations could create an ad hoc tribunal to have the obligationto redress piracy."219 As has been suggested for handling the prosecution of piracy under UNCLOS, an international agreement addressing acts of cyberaggression could allow nations to retain the right to redress cybercrime, while creating an international tribunal that has an obligation to prosecute cybercrime. This type of tribunal would help to preserve national autonomy, while providing nations and private actors with an international forum for redressing their grievances. Since cybercrime, like piracy, has a large impact on private actors who are often the victims of these types of crimes, allowing private actors to pursue justice via access to an international tribunal would encourage nations to bring domestic policies in line with international standards.220 The availability of an international cybercrime tribunal could also lessen nationalistic resistance to international standards by empowering private actors with the ability to seek international redress for economic injury inflicted by acts of cybercrime.
A sound policy that balances international freedoms in Cyberspace with legitimate concerns about national security may be achieved by applying the navigational regimes of the UNCLOS III to the medium of Cyberspace. Fairly applied, such global Cyberspace policies could, borrowing from the language of the Convention,
- be an important contribution to the maintenance of peace, justice, and progress;
- resolve problems of Cyberspace;
- provide due regard for the sovereignty of all States;
- facilitate international communication;
- promote peaceful uses of Cyberspace and the equitable and efficient
- utilization of its resources;
- aid the study, protection, and preservation of the Cyberspace environment;
- contribute to the realization of a just and equitable economic order which takes into account the interests and needs of mankind as a whole and, in particular, the special interests and needs of developing countries;
- establish international Cyberspace as beyond the limits of national jurisdiction, as a common heritage of mankind, the exploration and exploitation of which shall be carried out for the benefit of mankind as a whole irrespective of the geographical location of States.
From the foregoing it is suggested that if the underlying purposes of the UNCLOS III were applied to the Cyberspace medium, it would have a desirable effect on international development of Cyberspace. A test of the usefulness of this analogy in preserving national sovereignty is how well two important access rights under the UNCLOS III, "innocent passage"4 and "transit passage,"5
might be applied to military operations in Cyberspace.
When navigating Cyberspace international straits, users behave much like ships and aircraft engaged in transit passage: they proceed without delay, in the normal mode of continuous and expeditious transit, and refrain from any threat or use of force against the national Cyberspace through which their communication is routed. The nature of telecommunications means Cyber Forces transit Cyberspace almost instantaneously and without delay except as limited by system bandwidth during periods of peak demand. The high speed of transmission is valuable to the commander as well as the State through which the Cyber Force is transmitted. The combination of speed and volume of Internet traffic means most States have limited capability to intercept and monitor Cyberspace communications. This limited ability to intercept and monitor traffic through Cyberspace is important to maintaining the neutrality of states that are mere intermediaries in information warfare, as in our opening scenario, because the transited State is unlikely to be aware of the transmission.
In summary, transit passage provides the commander two major advantages over innocent passage: forces may transit in their normal mode of operation42 and bordering States may not suspend the right of transit passage through international straits. When applied to Cyberspace the proscription against suspending transit passage is a strong argument for applying the UNCLOS III by analogy to Cyberspace. While governments, corporations and private organizations may choose to suspend access to their internal Cyberspace for various reasons, as global economies become more dependent on the international telecommunications infrastructure it is unlikely that States could or would entirely close national Cyberspace. Even if a State tried to close national Cyberspace it would have little effect on the ability to transfer CNA packets through international Cyberspace because if intermediate routers are not available the packet will be automatically rerouted. Finally, if a belligerent State, like State A in the opening scenario, were to specifically route a CNA through the Cyberspace of a neutral intermediate state that act alone would be insufficient to violate the neutrality of the transited State if the Cyberspace transit passage analogy is used.
Of course, China’s withdrawal from the convention would weaken the reputation and authority of the tribunal and international law in general. It would also give notice that China is not to be trifled with — that it will not “be taken advantage” of by small Asian countries — some still influenced by their former colonial masters.
Unfortunately there is a long political history of world powers using, not complying with, or making new international law to further and protect their interests. Prime among these has been the U.S. Its refusal to join the 1982 Law of the Sea Treaty and the International Criminal Court, its withdrawal from the ICJ case, and its “invasions,” cyber and drone attacks, and interference in the internal affairs of other countries have certainly set a bad precedent.
The U.S. and its Asian allies need to be careful lest they push China into actually being what they fear most — a rogue country that uses might rather than right in its international relations.
Let us hope that China considers the costs of withdrawing from the treaty greater than the benefits.
The same is likely to true of the Internet – an immeasurably important engine of American technological and commercial competitiveness and, increasingly, a key component of U.S. national security. Other countries have already demanded global Internet regulation. For example, in March 2005, China’s ambassador to the United Nations called for international management of the Internet. Seven months later, the UN hosted a conference at which many delegates insisted on an end to this country’s exclusive control over the assignment of web addresses and e-mail accounts, in favor of having such roles performed by one or more UN agencies.
The problems with such an arrangement are obvious. The Washington Post pointed out that any such agencies would inevitably be caught between free societies that want low barriers to Internet access, and countries such as China and Saudi Arabia, that insist on limiting access. The Post went on to observe: “These clashes of vision would probably make multilateral regulation inefficiently political.” As it happens, the same is true of LOST – and would certainly apply with devastating effect to the Internet if LOST becomes the template for multilateral management of the ether’s “international commons.”
The Internet poses legal challenges similar to those encountered in maintaining order in the use of the world's oceans. UNCLOS, which imposes law and order in the seas, entered into force based on "the notion that all problems of ocean space are closely related and needed to be addressed as a whole."" Similarly, the Internet is shared globally and the consequences of actions taken by an Internet user in one jurisdiction can be borne globally.
- Legal challenges posed by cybercrime similar to those posed by maritime piracy
- International community should follow example set by UNCLOS and establish governing regime to combat cybercrime
- A cybercrime treaty that established universal jurisdiction over crimes and an international tribunal could help deter cybercrimes
- Creating an international tribunal for cybercrime based on UNCLOS model would help deter and resolve cybercrime
- UNCLOS navigational freedom provisions provides good model for regulating cyberspace
- UNCLOS provisions on transit passage provide good model for international agreements governing military activity in cyberspace