Peace and Security in Cyberspace Must Top International Agenda

The 76^th session of the United Nations General Assembly comes at a moment of dramatic change, not only in the international system but in basic conceptions of security. The COVID-19 pandemic showed how an invisible virus can cause massive human suffering and global dislocation. It also accelerated the shift of the world economy into the digital domain, as millions of people around the world grew more dependent on the internet for work, communication, commerce and even healthcare. As our reliance on technology has increased, so has our vulnerability to malicious cyber activities.

A series of spectacular attacks and intrusions over the past 18 months has grabbed international headlines, captured the public imagination, and spurred new calls for action to secure cyberspace. From the shutdown of major health systems to the targeting of gas pipelines and other critical infrastructure, there is no longer any doubt that cyberattacks can inflict catastrophic damage and trigger a wider and more devastating military conflict. Whether we can avoid that outcome will be one of the great tests of the international system in the 21st century.

Having served in government during the 1990s, I bore direct witness to the revolutionary impact of information technology on international affairs. I was the first Secretary of State to have my own website and to conduct a bilateral meeting online. In the years that followed my government service, I visited Silicon Valley and spoke often of the democratizing power of the internet. But I also saw how the promises of digital technology brought new perils.

From the shutdown of major health systems to the targeting of gas pipelines and other critical infrastructure, there is no longer any doubt that cyberattacks can inflict catastrophic damage and trigger a wider and more devastating military conflict.

A turning point for me was the 2007 cyberattack that Russia launched on Estonia amid a dispute over the removal of a Soviet-era statue. Although crude by today’s standards, the Russian distributed denial of service (DDoS) attacks took many Estonian websites offline —  a searing event for a country that prided itself on embracing the digital economy and e-government services.

In the years that followed, state and non-state actors — led by Russia and China — developed far more sophisticated tools to inflict harm in cyberspace, whether through the destruction of physical infrastructure, the deliberate spread of misinformation, or the theft of intellectual property. Governments and intergovernmental organizations have struggled to respond. In 2010, I chaired a group of experts that advised the NATO Secretary General on a new strategic concept. One of the questions we debated was whether a cyberattack could be considered an attack on the alliance under Article 5 of the North Atlantic Treaty. Despite the example of Estonia, an alliance member, we could not come to a clear consensus — in part because of the difficulties in assigning attribution to cyberattacks.

There has been more progress outside of traditional governmental processes thanks to a concerted push by responsible leaders from civil society and the private sector who recognize the growing urgency of the problem. The 2018 Paris Call for Trust and Security in Cyberspace has seen nearly 80 countries and hundreds of organizations and companies agree upon a set of guidelines for maintaining peace and security in cyberspace. A group of international law experts from six continents, convened under the auspices of Oxford University, has also done extraordinary work to show how cyberattacks on important aspects of daily life, such as the health care sector, hospitals, vaccine research, electoral processes, and information operations are illegal under international law. Both the Paris Call Community and the Oxford Process demonstrate the power and importance of a multistakeholder approach to cybersecurity. One of the distinguishing characteristics of cyberspace, as compared with other operating domains, is that the infrastructure is largely owned and operated by private companies. The destructive tools are not exclusively under the control of governments. An arms control agreement between the United States and Soviet Union could credibly claim to reduce the risk of nuclear war. An international agreement aimed at reducing the risk of cyber conflict would need to involve many more actors from government, civil society and the private sector. Yet progress will only come if governments do their part and if the world’s democracies, especially the United States, demonstrate leadership. With billions of lives and livelihoods on the line, peace and security in cyberspace must be at the top of the international agenda.