The 2015 GGE Report: Breaking New Ground, Ever So Slowly

Alex Grigsby is the assistant director for the Digital and Cyberspace Policy program at the Council on Foreign Relations.

As Politico noted in June, the United Nations Group of Governmental Experts on Information Security (GGE) agreed to consensus document laying out its recommendations to guide state activity in cyberspace. Politico called the document a "breakthrough" because it enshrines a series of norms that the U.S. government has been promoting. At the time the article was published, it was hard to determine whether the champagne-popping was necessary given that report wasn’t made public. Late last month, the UN released the text of the 2015 GGE report.

As with many UN reports, this one is filled with recycled language from previous reports and General Assembly resolutions. The sections that speak to the threats in cyberspace, the need for confidence building measures, and the importance of capacity building are largely pilfered from the 2013 report and don’t really convey anything new. However, there are some exceptions. The U.S. was successful in getting its preferred norms with respect to critical infrastructure--States should respond to requests for assistance, and refrain from cyber activity that intentionally damages or impairs critical infrastructure or computer emergency response teams--adopted by the group. On the surface, getting everyone to agree to not attack critical infrastructure is great. But it’s hard to see what additional clarification this new norm provides. Each state classifies critical infrastructure differently--the United States has sixteen sectors, Japan has thirteen, Canada has ten, Germany has nine--and many of these sectors are defined so broadly, that any disruptive or destructive cyber incident is likely to affect some form of critical infrastructure. For example, the North Korea incident against Sony was probably an attack against critical infrastructure, given that the U.S. Department of Homeland Security classifies motion picture studies as part of it’s commercial facilities sector. Moreover, as David recently pointed out, there’s already a norm against disruptive or destructive cyber activities. It’s called Article 2(4) of the United Nations Charter, which prohibits the threat or use of force.

Despite the lack of new insight on the protection of critical infrastructure, the GGE report breaks new ground in three important areas. First, the report explicitly references the possible applicability of the international legal principles of humanity, necessity, proportionality, and distinction, though the wording of the text makes it unclear whether the group reached consensus on whether they actually apply to state activity in cyberspace or merely noted their existence. The U.S. seems to interpret it as endorsing the applicability of these principles to cyberspace, but the Chinese in particular have avoided doing so in the past. At the 2012-2013 GGE, the Chinese blocked any attempt to reference humanitarian law principles in that group’s report on the basis that endorsing their applicability would legitimize armed conflict in cyberspace. If the 2014-2015 group endorsed necessity, proportionality, and distinction, it would represent a considerable shift in China’s position.

Second, the report notes that states should substantiate public accusations of state-sponsored cyber activity, and that "the indication that an ICT activity was launched or otherwise originates from a State’s territory ... may be insufficient in itself to attribute the activity to that state." The text was inserted at the last minute at Russia’s request, and it’s unclear why. China, not Russia, is generally the most vocal about the need for evidence when publicly attributing malicious cyber activity, regularly asserting that accusations without proof is "irresponsible and unscientific," In any case, Russia may be trying to promote a norm against public attribution without strong evidence. The United States has signalled that it is willing to name and shame states that engage in destructive activity (e.g. North Korea), steal intellectual property for commercial gain (e.g. the five PLA indictees), and to establish deterrence. In the future, the United States may need to provide more concrete evidence than the "trust us" approach it’s used in the past.

Third, the report recommends that states "should respond to appropriate requests for assistance by another state whose critical infrastructure is subject to malicious ICT acts." This recommendation may seem banal, but it’s pretty significant. Many states have established national computer emergency response teams (CERTs) to act as focal points to coordinate national and international responses to cyber incidents. Oftentimes, one national CERTs’ request for assistance from another can go unanswered for days, allowing malicious traffic that could be terminated to go unabated. In the case of the 24/7 point-of-contact network established by the G8 to combat cybercrime, many of the national points of contact don’t even pick up the phone. Creating an expectation that requests for assistance will be answered may actually pressure some into responding. With any luck (and prayers from Duncan Hollis), the expectation could even turn into an obligation to provide assistance, much like the duty to render assistance under the law of the sea.

Are these developments a breakthrough? Not really. Like any diplomatic endeavor, each side will be able to claim that it won. The United States and its allies will trumpet it as a win for their preferred norms. Russia, and to a lesser extent China, will be able to claim that the norms in the report are a step towards the establishment of new international law as Russian GGE expert Andrey Krutskikh did three weeks ago. Nevertheless, there are some nuggets in the GGE report that represent small but genuinely important steps that clarify what states should and shouldn’t do in cyberspace.

Correction: This post was updated to reflect the fact that Russia, not China, inserted language in the GGE report that a state should substantiate accusations of state-sponsored cyber activity.