U.S., Russia jockey to shape new global cyber norms

The United States and Russia are competing to steer a process to develop international cyber norms at the United Nations.

On Nov. 8, the UN’s Committee on Disarmament and International Security approved dueling draft proposals by the U.S. and Russia to establish working groups that would be responsible for developing global rules of the road for behavior in cyberspace.

The U.S. proposal endorses two previous reports on international cyber norms and calls for the UN Secretary General to establish a working group in 2019 staffed by experts with “equitable geographic distribution” around the world. The group would be empowered to continue studying existing and potential information and communications technology threats. The proposal also emphasizes the role that regional bodies like the European Union, African Union and others can play in the discussion, along with private-sector companies, academia and civil service organizations.

The Russian proposal also calls for the establishment of a working group in 2019 to develop voluntary and non-binding rules, norms and principles for nation-state cyber activities as well as “possible cooperative measures” between nations on information security.

There are several passages in the Russian proposal that may raise eyebrows among U.S. policymakers, however. One section reaffirms “the right and duty of States to combat, within their constitutional prerogatives, the dissemination of false or distorted news, which can be interpreted as interference in the internal affairs of others States.” The proposal also states that nations have a duty to “abstain from any defamatory campaign, vilification or hostile propaganda for the purpose of intervening or interfering in the internal affairs of other States” and avoid embedding malware or other cybersecurity vulnerabilities in critical infrastructure technology or global supply chain.

The U.S. is widely believed to have worked with Israel to develop and deploy the Stuxnet malware that set back Iran’s nuclear program in 2009-10. And U.S. intelligence agencies concluded that Russia was behind digital efforts to influence the 2016 elections in ways that would certainly qualify as “interfering in the internal affairs” of the United States.

According to a release put out by the United Nations, representatives from both countries cast doubt on the effectiveness of the other’s proposal. In a series of testy exchanges, the United States representative claimed the Russian document “imposes a list of unacceptable norms and language that is broadly unacceptable to many states” while Russia’s representative said the U.S. version were crafted primarily to serve the narrow interest of Western countries, waste resources and “take the international community backwards.”

Other nations weighed in as well. A representative from Iran, which voted in favor of the Russian proposal and against the U.S. version, said the United States “does not take into account the current reality of cyberspace security,” and accused the U.S. and allies like Israel of conducting numerous cyber attacks on Iranian critical infrastructure. China’s representative mused about whether nations who voted in favor of the U.S. version would be fast tracked to get seats on the working group. Meanwhile, representatives from Australia, Canada and other nations claimed the Russian proposal cherry picks and distorts previous U.N. research and findings on cyberspace norms.

“Kind of a mess and reflective of greater tensions more generally but hopefully something sane can be worked out and hopefully there is a better opportunity for other stakeholder input,” Chris Painter, the State Department’s former cyber coordinator, said on Twitter.

National security and intelligence officials in the U.S., meanwhile, have spent the past two years accusing Moscow of playing a leading role in the degradation of global cyberspace norms, pointing to malicious hacks and disinformation campaigns targeting Ukraine and other parts of the world in addition to the U.S.

Those accusations have been accompanied by increasing calls from current and former U.S. officials to impose diplomatic, economic and other consequences on nation states that target the critical infrastructure or interfere in the electoral processes of other nations through the use of online disinformation and propaganda. As the Trump administration and Congress have worked to heed those calls, Russia has frequently found itself the target of sanctions and criminal indictments.

The U.S. proposal has 36 co-sponsor nations, including many traditional European and international allies like the UK, Germany, France, Spain, Japan and Israel. The Russian proposal has the backing of 30 other nations, including China, Iran, North Korea and Pakistan. According to a release by the United Nations, 139 nations voted to adopt the U.S. draft proposal, 11 against and 19 abstained from voting. Meanwhile, 109 countries voted in favor of the Russian proposal, 45 against and 16 abstained.