In a World of Cyber Threats, the Push for Cyber Peace is Growing

I am the acting director of the Ostrom Workshop at Indiana University that includes the Cyber Peace Working Group, one of several academic groups also working to protect the Internet and its users.

Although it’s too soon to say anything certain about long-term results, there are some early indications of success, including the outcome of a Paris meeting in November 2018. More than 60 nations – though not the United States – signed the Paris Call for Trust and Security in Cyberspace, along with more than 130 companies and 90 universities and nonprofit organizations. The document is a broad statement of principles that focus on improving “cyber hygiene,” along with “the security of digital products and services” and the “integrity of the internet,” among other topics. It doesn’t legally bind its participants to do anything, but does lay out some basic points of agreement that could, in time, be codified into laws or other enforceable standards.

Its critics question whether it is too early to establish global commitments given that core issues of sovereignty over the internet remain unresolved. Nevertheless, the Paris Call has helped shape the conversation around the scope and meaning of cyber peace.

Another international effort began in the aftermath of the March 2019 mass shooting at two mosques in Christchurch, New Zealand. The governments of 18 nations – along with more than a dozen well-known technology firms like Google and Facebook – adopted the Christchurch Call to Eliminate Terrorist and Violent Extremist Content Online.

This effort has led many of the companies involved to change their policies governing hate speech and disinformation on their platforms. For example, YouTube, owned by Google parent company Alphabet, announced a new hate speech policy prohibiting content “alleging that a group is superior in order to justify discrimination, segregation or exclusion based on qualities like age, gender, race, caste, religion, sexual orientation or veteran status.” The Christchurch Call has also helped widen the discussion about cyber peace to include thorny questions about democracy, such as how to balance freedom of speech with limits on extremist content.

A Digital Geneva Convention?
A key element remains the need to protect civilians from harm in a future cyber conflict, such as attacks on the electricity grid, dams and other systems that affect daily life for much of the world.

One idea is to fashion an agreement along the lines of the Geneva Conventions, which with their predecessors have sought to protect innocent lives in military conflict for more than a century. An international treaty along the lines of the Outer Space Treaty, Antarctic Treaty or the U.N. Convention on the Law of the Seamay beuseful.

There is not yet a grand “Treaty for Cyberspace,” though. The relevant international agreement with the highest number of ratifications so far is the 2004 Council of Europe Convention on Cybercrime, also called the Budapest Convention, which guides international prosecution and extradition of cyber criminals. The U.N. has severalgroups working on aspects of international cybersecurity.

But as with potential solutions to climate change, there’s not a lot of political energy being put into the efforts.

Scott Shackelford is Associate Professor of Business Law and Ethics; Director, Ostrom Workshop Program on Cybersecurity and Internet Governance; Cybersecurity Program Chair, IU-Bloomington, Indiana University. This article is published courtesy of The Conversation.