Russky Newsweek of November 23 carried a cover story on cyber crime, pointing a very big finger at Russian hackers, working from home and abroad. It used headlines like the “Evil Cyber Empire” and the “Cold Cyber War”. At the same time, NATO is trying to understand how it should deal with cybersecurity issues. Does a cyber attack on a NATO member state invoke the Article V commitment of the mutual defence treaty?
There is no shortage of political leaders and security specialists who see the problem in just this way: their offensive threat, our defensive counter-measures. For these people, the idea of “common security” in the cyber domain does not have much appeal, especially when talking about Russia.
But a closer look at the security dilemma involved in the cyber world suggests a different approach might be worthwhile.
In classic geopolitics, the security dilemma is understood (crudely) as follows. State A increases its military power to defend against threats from State B. State B responds by building up its military power. Proponents of the security dilemma idea (the need to pay close attention to the self defeating nature of arms races) would argue that State A has thereby lessened its security by escalating to a new level of military buildup.
Does a similar security dilemma exist when it comes to cyber space or cyber warfare? The answer is “Nyet”! In cyber space, “international” relationships are fundamentally different from those that exist(ed) in classic geopolitics. “Cyberworld” is characterized by “pervasive connectivity”, according to EWI Distinguished Fellow, Dr Karl Rauscher, who has led a major EU study in the field of critical infrastructure protection.
Geopolitics was about borders and defending them. Cyber diplomacy is about managing a world that is not just borderless but a world that can function best when the connectivity becomes more pervasive. This world – so dependent on stable financial transactions and global trading – can’t function at all if cyber connectivity is comprehensively attacked. So how does NATO, a geographically defined alliance trying to redefine its relationship with Russia, understand its role in promoting cyber diplomacy and cyber peace? What place should combat exercises by ground troops of NATO or Russia have in a world of pervasive connectivity? Do NATO’s F-16 patrols and training exercises in the Baltic region have any relevance to defence against cyber attack on Estonia or NATO security at all?
What does the institutional structure and strategic profile of NATO look like if the biggest security threats to it in the next ten years are from terrorists or states with advanced cyber offensive capabilities?
One big change will be in the spying business. It will continue but its fundamental character will change. Russia will change its espionage priorities in NATO countries and the United States will change its espionage priorities in Russia. All parties will become as interested in protecting each other’s secrets as in stealing them, because those secrets are in fact increasingly becoming shared “information technologies” and shared information networks.
The Russian approach to cyber diplomacy is fundamentally rather “avant garde” and worth much closer attention. In 2000, Russia published one of the world’s first national strategies for “information security”. Without any difficulty at all, the doctrine can be read in part as a KGB dream more appropriate for a different era. But in spite of glimmers of the past, it is something very different.
The United States has now realized much of the above. A New York Times article of December 13 2009 described a “significant shift” in U.S. policy when it gave in to years of Russian overtures to begin talks in the United Nations framework on certain aspects of cyber security. This little noticed event may in twenty years come to be regarded as a historic milestone in developing global regimes for cybersecurity.
For NATO, the time has definitely arrived for it to elevate cybersecurity to the front rank of official relations with Russia from the perspective of shared interest and not simply from the perspective of threat. One avenue of work to consider which would serve this purpose would be for NATO to commit in its new security concept to developing with Russia in 2-3 years an agreed “concept” of what constitutes worldwide cyber security.