Dealing with cyber security threats: International cooperation, ITU, and WCIT

Abstract

The cyber security situation is not as bad as most people think it is - it is worse than most people imagine it could be. Indeed the lack of security of the Internet and of the devices connected to it results in serious vulnerabilities. These vulnerabilities create risks for infrastructures that increasingly rely on the Internet, including not just communications, but also power generation and distribution, air transport, and, in the near future, road transport. It is easy and relatively inexpensive to access cyberspace and to obtain the means of conducting offensive cyber attacks. Thus it is tempting to develop offensive cyber capabilities and indeed some states are doing so - as published in their national cyber security strategies, and several states have allegedly carried out cyber attacks. At the same time, a state is bound to protect its citizens, including against cyber attacks and cyber warfare. This will become increasingly difficult, if not impossible, if current trends continue unchecked. This article argues that international agreements on improving cyber security, and limiting cyber attacks would appear to be necessary and appropriate measures. Yet key developed countries resist taking legally binding measures of that nature, see in particular the discussions and outcome of the 2012 International Telecommunication Union (ITU) World Conference on International Telecommunications (WCIT). On the contrary, some of these countries practice mass surveillance, which some consider to be a threat to citizens and to the security of states, and which some authors have even considered, figuratively, to be a form of cyber war, even if it is inappropriately justified as a means of combating terrorism. And they resist calls to end mass surveillance. This paper argues that the positions taken by key developed countries could have grave negative consequences in the future, in particular for those very countries. The time has come to take steps to prevent this, which include more discussions and engagement in various forums, including ITU.