Cyber Conflicts: Current Issues in Internet Governance

And one of the issues in cyber warfare is that the Internet has been designed to support the hackers and not the protectors. And it has anonymity, and it has the power of misdirection, so the attribution of attacks becomes very challenging.



And the second issue that we have is, what are the rules that govern warfare? Do the existing international laws apply to it? For instance, we have the international humanitarian law which is used in terms of armed conflict. Now does that apply to the Internet? And if it does, what does it mean?

And if an attack is coming from China, is it really the Chinese sitting in China launching the attack or somebody else, or is somebody else misdirecting the attack? And there's the question of spillover of cyber attacks. What is a spillover of cyber attack? A spillover is that in case an attack is launched and somebody else launches a retaliatory attack without really knowing where the origin was, that can cause a problem. Let's take the instance of the North Korean attack, where the perception is that North Korea attacked or did the Sony hack. Now nobody knows for sure. We don't have credible evidence which is public yet. So that's the issue I'm talking about in attribution of the attacks. Now people can launch attacks, misdirect attacks, and the attribution is not clear. There was a report which came out recently that someone had done linguistic analysis which points to the attacks being launched by Russia. But again, there is no convincing evidence of that. So given this difficulty, it is very, very hard to really understand where the attacks are coming from, what laws apply to it, and there is no evidence in case of whether we want to retaliatory attack. And there are other issues associated with cyber attacks. The one is the issue of intellectual property.

And if you look at the intellectual property, the Internet has allowed media to be distributed across the globe. There are websites world over which basically contain information or media content, and the question is which jurisdiction do they lie on?

The World Trade Organization TRIPS, the Trade-Related Aspects of Intellectual Property Rights, defined a common set of international rules for members to respect intellectual property rights amongst members. In the modern era, the Internet has allowed for these rights of intellectual property holders to be violated at quite literally the speed of light. Piracy of software and other intellectual works has existed on the Internet since the early days of the Usenet, a series of news groups that can considered the modern precursor to the modern web forums.
 

ICANN and other multi-stakeholder entities have resisted, in the large part, the demands of state actors to grant greater control over Internet infrastructure for the purposes of mitigating intellectual property violations.

But this has not stopped state actors from passing a variety of laws. These can vary from country to country to combat the theft and sharing of intellectual properties such as music, movies, books, and software.

And there's a patchwork of laws relating to intellectual property that have led to several things.


The first is balkanization. One of the main issues in balkanization is that countries are trying to create their own Internet to protect their own national interests. For instance, a lot of countries feel that the openness of the Internet is not conducive to the societal values or to the norms in the society. If you look at what is happening in China, China has basically created a censorship regime on the Internet.

And by using technical means and laws, they're basically able to control content on their own Internet. Several other countries want to do exactly the same thing. And there are countries which want access to all of the communication that is going on the Internet to be able to fight terrorism better. So given that there is a lot of discord on how the Internet should be run, how much freedom there should be on the Internet, there's a great fear of balkanization where everybody creates their own personal Internet and the global Internet breaks up. That's from the basic challenges we face.

Especially in the light of the Edward Snowden revelation regarding mass surveillance of the Internet by the NSA, several countries, notably Brazil and Germany, they are proposing creating nationalized services as alternative to multinational products such as electronic mail. That would be routed only through their countries instead of going through the global Internet. And obviously China has had this long-standing weird firewall that is monitored by the Chinese government in order to restrict access to information on issues and historical events such as the Tiananmen Square massacre.

Many G-77 nations, the Group of 77 nations, tend to desire greater control over the Internet in their country, either as a reaction to the so-called social media revolutions like the Arab Spring, which are probably be seen as having used online social networks to organize, or due to protectionist tendencies with the state-run or public-sector telecommunications networks. There are legal and jurisdictional issues, and one of the most important emerging issues in Internet governance is the application of law to actions carried out on the Internet. Which is the governing authority? Can we bring them to international court? Given the competing patchwork of jurisdiction and legal authority, and the vast geographical distances, along with evidence which can rapidly evaporate, it is very hard to question people on the Internet. Who should prosecute the crimes on the Internet and differing national standards for speech are raised here. Consider the issue of an American citizen in the US posting comments on a British website about a public figure. US and UK law have very different levels of protection for certain types of speech, and China has even more different values. Whose law has supremacy in this situation? Consider, for example, where a criminal enterprise involving a small conspiracy of individuals in Russia uses malicious software to attack computers in the US and make them send spam email around the world. So cooperation is required between US and Russian authorities to prosecute this individual, but often the officials are corrupt and police block any sort of joint venture. And these processes have typically been very slow due to mutual distrust through years and years of Cold War. So the future of the Internet and the globalization of the ICANN and the resolve of the state actors to have more control, that has put ICANN in a difficult situation. ICANN is linked to the desires of the US government and in the wake of the Snowden revelations, ICANN issued a Montevideo statement that outlines four major points. The important global coherence in Internet operations, effort to address Internet governance challenges, globalizing ICANN and functions, and the transition to IPv6. It remains to be seen what model a truly globalized ICANN will follow. Will it be beholden to state actors in a multilateral top-down model where ICANN is ultimately accountable to the states? Or will it be a bottom-up transformation where the institution answers to Internet users and suppliers through direct accountability? So the challenges are great. We have a long road ahead of us.

The Internet has become a major economic hub. And the more important it becomes, the more concerned that countries get and the more they're striving to get control. Cyber warfare is a reality today. We have seen what happened in the Russia-Georgia conflict, the Russia-Estonia conflict. We have seen what happened with the Stuxnet and Flame viruses, when cyber physical systems were attacked. This is just the beginning, and there are more and more conflicts to come on the Internet. And Internet governance can go a long way in building trust. We just need to find the right model. Thank you.

Cyber Conflicts: Importance of Internet Governance

So why is Internet governance so important? And that the Internet governance has kept growing in importance as the stakes have risen.

And the internet is growing at a very, very rapid pace. And this rapid expansion and the growth of the internet is causing major concerns about internet governance, because countries want more control of that, they don't want somebody else to take the lead on that. All right, now let's try to see why there is so much interest in internet governance and what is at stake. So the most important thing is that people don't want other countries controlling their internet, because they fear that in the case of a conflict, somebody else can basically control their internet. And some of the recent conflicts have actually demonstrated how Internet can be used, or can be disrupted in other countries in addition to the kinetic warfare.


So several attacks happened on the Internet, which were pretty high profile, between the US, between the conflict between Russia and Estonia and then Russia and Georgia. In the Middle East, there was conflicts been the Palestinians and the Hamas folks, and the Israelis. So all of that have happened.

But in 2013, the game changed quite a bit. And that followed Edward Snowden's revelation about widespread and pervasive monitoring of internet traffic by the US National Security Agency. And this touched off a global response that continues to reshape the debate over who should control the internet policy.

And since 2003 there have been roughly three major groupings of actors with stakes in Internet governance and politics.


These groups are the national sovereignty group, a civil society group, and a private sector group.

A national sovereignty group oriented approach favored by both developing countries, and the BRIC, which is Brazil, Russia, India, and China group minus India. These actors are generally members of the group of 77, whose roots spring from the non aligned political actors in the Cold War. They are generally critical of the US global hegemony and believe that the current institutions are US government puppets. And this group would rather prefer that Internet governance be under the purview of intergovernmental agencies, such as the United Nations.

They feel that putting it under the United Nations will give more control, or at least more security to these organizations. And some are heavily authoritarian, and favor restriction on Internet usage. A lot of countries, for instance, don't want a free Internet. They want to censor Internet.

And many of them are also characterized by a strong state run telecom monopolies who would like more control than a multi stakeholder model approach. Which is the current model of Internet governance, is favored by the civil society and private sectors in general. The private sector group contains the current affairs governance institutions, and multinational Internet and telecommunication companies, such as Google and AT&T. Some governments are also on board with these private sector companies, such as the US, Japan, and most of the European countries.

The civil society group includes organizations that promote Internet freedom, privacy, and users' rights. And this can also include ideologically motivated technical groups inside the nations that might otherwise make a national sovereignty approach.

These people appeal to their nation for a more liberal outlook on Internet governance issues.

These two approaches were contrasted during the initial formation of ICANN. Contextually in the mid 1990s, there was little legitimate policy making authority regarding the coordination of the Internet. When the U.S. government began to assert itself,

by virtue of its historical genesis of the internet through ARPANET, the Department of Commerce issued a white paper suggesting a private sector organization step forward to assume responsibilities for DNS.

And participants in the process can mean global meetings in order to debate and design an institution that would meet this criteria. But it failed to achieve consensus and was supplanted by a private deal between Jon Postel, from Network Solutions, which is the operator of the authoritative root zone server, and the dotcom dome server, and the Department of Commerce.

And the early designs of ICANN excluded governments from serving or participating in decision making, to the chagrin of non US governments, because they wanted to be a part of the United States. In the early 2000s, the US and the ICANN were directly challenged by developing nations along with the European Union and the World Summit on Internet information society.

In contrast, civil society groups embraced the multi stake holder model, seeking an opportunity to advance their policy without constraints of governmental treaties and agendas.

While ICANN and the multi stake holder model merged into one piece from this conference, the voice of state actors became even louder in the organization.

And generally the conflict between the state and non-state actors in ICANN, can be distilled to issue with these two groups having difficulty participating in the forum, where both have a relatively equal footing. The standards for accountability inclusion representation are very different between a state and non-state actor.

What that conference led to was the Internet Governance Forum, which is a multi task holder meeting which happens around the world, which discusses issues related to governance, and that are non binding in fashion.

The Internet governance forum, or the IGF, which has no power to implement changes based on discussion. It is merely an anchor for various groups who have interest in the current system and the preemption against other groups, which are claiming to represent the Internet and governance over the Internet.

And due to the lack of power in the IGF, many regional or state run organizations have created forums to discuss and implement Internet policy.

Intergovernmental agencies, such as the United Nations, failed to buy in to the IGF. Due to fear that it would erode their relevance in the international system.

Now, in 2010 these alternative forums have become more popular and spying even more alternative challenge. Such as freedom online, normative cyberspace, WCID, WSIS, and the ITU. Or state and non-state actors to discuss Internet governance.

The proliferation of these events points to an insecurity of state actors who feel that they lack control over Internet policy.

And this has been worsened since the revelations which came from Edward Snowden. The current issues of Internet governance are multi fold. First of all is cyber warfare. Now what's happening is a lot of the countries have cyber warfare as a strategic leverage in terms in armed conflict. And they have doctrines in their armed forces which are declaring cyber warfare to be a major element in their warfare. Apart from the land, sea, air, and space, cyber warfare comes next for them.

And what cyber warfare is, basically, ability of a country to attack another country.

And these attacks may be leveraged against physical infrastructure, like electricity, water, power, military or civil, are main structures. A typical goal of one country is to inflict how much damage as possible into another country. And in the case of cyber warfare, that is exactly the same as the idea. We have so much dependence on the Internet

that we will be able to inflict a lot of damage by disrupting supply. We can disrupt communication in air traffic control, governmental private institutions, or other targets in the military. Their attacks may not be carried out directly by a state, but affiliated proxy groups. And typically most of the states that don't directly attack, but they have cultivated these groups which are basically individual hacker groups which are doing a lot of this work.

Cyber Conflicts: Internet Governance

Internet is fairly static, and it's standardized in that anybody can start their own Internet, it's autonomous, we can all run the Internet. There is one factor however which requires a lot of governance and that is the Internet addressing scheme and The Domain Name System. So what happens in the internet addresses? We have a limited number of internet addresses that need to be allocated around the globe to everybody. And secondly, we have associated with internet names, domain names which are alphanumeric names that are easy to remember and they need to be mapped onto each other. So both of these are global entities. We have one single directory which is governed across the globe. And that's where a lot of the governance is required and this is managed by an organization called ICANN. Now the question is what is ICANN? ICANN is a not for profit, public benefit organization which was started in 1998. It operates the Internet's domain name system. It also coordinates allocation and assignment of the unique identifiers on the Internet, that is the IP addresses. It accredits the high level domain names. Registrars and help facilitate the volunteers who are dedicated to keeping the internet secure, stable and interoperable.

ICANN promotes competition in the domain name space and helps develop the internet policy.

Before ICANN came along, we had its predecessor the job of administering the domain system was performed by one individual, his name was John Postel. Was a computer science researcher at a University of Southern California and he had been in involvement in the creation of the ARPANET, which was a predecessor to the modern Internet.

Now he acted under the authority of the Internet, a signed, members authority founded again a decade ago in 1988. This was a group contractually obligated to the US Department of Defense to manage allocation of IP addresses and the domain name system.

 

But as the internet grew, the growth of the internet let the U.S Department of Commerce to publish a paper which seeks establishing a private organization to take over the duties of managing and assigning internet addresses, and this was partly because of its growth and partly because of international pressure.

It also wanted to bring the global community into the process by establishing a board of directors from around the world.

And ICANN was formed consequently in 1998, and assigned the primary policy responsibility to two existing organizations. That is the address support policy, which is the regional internet registry, an organization that manages the allocation and registration of internet numbers or IP addresses in each region of the globe. And second was the policies of support policy which was I.E.T.F. Internet Engineering Task Force. This is an organization that develops and promotes voluntary internet standards such as the T.C.P.I.P. And I.C.A.N.N. can reserve the policy formation regarding the domain name support to itself in 1999.

The IANA was brought into ICANN and still acts as the manager for the root zone of the global Domain Name System.

Since its formation ICANN has maintained partnership for the U.S. Department of Commerce regarding the management of the internet domains' name systems. While I can operate fairly independently of the Department of Commerce, in 2006 a memorandum of understanding was signed between the two organizations that grants the US Department of Farmers unilateral oversight over some ICANN operations and this is a contentious issue.

  

While ICANN is a global organization with open governance, a key component of the internet remains, controlled by the US government and that come from the legacy of the ARPANET. The US Department of Commerce retains under control over the authoritative DNS roots on which is the master list of authoritative domain name servers.

These 13 servers are the master list of all registered domain names. The reason other countries are concerned about this is because the fear that in case of a conflict, if the US controls the domain name servers or the root zone, they may be able to disrupt the Internet service or to twist it in its own favor so that Internet works for the US and it fails for everybody else.

And earlier plans to move the authoritative root zone, controlled directly to ICANN was scrapped in 2005.