The Case for Cooperation in Cyberspace

In this exchange, Peter Maurer and Brad Smith discuss how digital technologies can help respond to humanitarian crisis and how international law can help safeguard cyberspace.In a world where authoritarian countries use cyber weapons to undermine the world’s democracies and human rights, it’s imperative that the international community work together to share information and best practices for the common defense

Brad Smith, President, Microsoft Corp.: Hi, Peter. It’s great to speak with you. The International Committee of the Red Cross (ICRC) has an important mission to protect vulnerable people amid armed conflict, a role that has evolved over the years alongside changes in armed conflict. Today, the world is digitalizing. What does this mean for the work of international humanitarian organizations?

Peter Maurer, President, International Committee of the Red Cross: Technology is an increasingly important facilitator of aid for people in crisis situations, for example through telehealth services, platforms to keep families connected, or mobile money to buy basic goods.

We also need to ensure people’s privacy and protect personal data. Ultimately, for people in vulnerable situations it can be a question of life or death if their personal information ends up in the wrong hands. Our hope is by engaging with states, the tech industry and hackers, we can find new, human-centered solutions that better protect people and meet their humanitarian needs.

Peter:  In your new book, “Tools and Weapons,” you and Carol Ann Browne discuss the dual-use potential of digital technology to both help and harm. How does Microsoft think about its role in creating a new space of human interaction and the new cyber risks that come with it?

Brad: We think about it a lot. The internet has transformed our world with incredible speed. Whole industries now exist strictly online, and in less than 20 years we have gone from households having maybe one family computer to now any number of internet-connected devices. Your refrigerator may well be doing your shopping now!

As a result, our industry has to take greater responsibility. To address rising threats, Microsoft will be investing more than $20 billion over just the next five years to enhance the security of our products and services. Beyond the efforts of any one company though, the increasing importance of cyberspace also means we need to work together more to address new kinds of threats.

Brad: Digital transformation has the potential to transform societies, lift people out of poverty and help us respond to humanitarian crises. But it also raises new threats. What do you observe in this respect?

Peter: While physical warfare remains the main cause of humanitarian needs, there is no doubt conflicts are digitalizing and militaries are spending large amounts of money on developing cyber capabilities.

In war zones, where services are already struggling, cyberattacks on critical infrastructure — disrupting water and electricity supply, or the operation of hospitals — are likely to cost even more lives. We have also seen how disinformation and hate speech, in particular on social media platforms, can accelerate violence and discrimination with potentially serious humanitarian consequences.

Peter: I might put a similar question back to you, Brad. You are closer to understanding the opportunities and challenges afforded by modern technologies. What do you think needs to be done to address the harm of cyber conflict?

Brad: First of all, things that are off-limits to attack in the physical world — water supplies, power plants, health care — absolutely need to be protected online. The same goes for human rights. These need to be as sacred online as they are in the physical world. But this is obviously easier said than done.

Cyberspace differs from other domains. It exists instantaneously across borders and is largely operated by private organizations. There are recent concerns about certain types of threats, such as ransomware and attacks on the ICT (information and communication technologies) supply chains. But we need to recognize that a year from now we might be talking about different methods employed by threat actors. So while we can and should leverage existing (international) frameworks (for responsible behavior in cyberspace), we will need new approaches that allow for the speed of technology evolution, include nontraditional actors and address areas that have not necessarily needed attention in the physical world.

Brad: There seems to now be broad agreement that solutions for the regulation of cyberspace must be international. As a guardian of international humanitarian law, what is your advice on how to successfully approach the regulation of such a complex field?

Peter: Having worked in international diplomacy for many years, my first advice is: let’s build on what we have. International humanitarian law — the Geneva Conventions and their Additional Protocols — is a battle-proof set of rules that impose essential limits during warfare — cyber or kinetic. What is prohibited to attack offline must also be off-limits online.

It is also true that cyber operations pose new challenges to the application of existing rules and might require new solutions. For example, in physical conflicts everyone agrees that it is prohibited to attack civilian objects. A key question here is whether this protection extends to data, such as governance or company data. Because if it does not, the manipulation or deletion of this data will pose risks for societies and individuals.

Brad: Perhaps a final question, when looking at the international geopolitical environment, what gives you hope that the international community can succeed in finding the necessary solutions?

Peter: At the multilateral level, cyber diplomacy seems to be working: States — including the big powers — have succeeded in finding consensus on some of the most acute risks in cyberspace as well as international law and norms applicable to state behavior. These encouraging steps must be built on.

I am also hopeful that the active involvement of other parts of society — the tech industry, civil society, academia — will help to shape debates and find solutions. Especially in cyberspace, I am convinced that we need to join expertise. For example, at the ICRC I recently launched a Global Advisory Board, of which Microsoft is a member, to pool multidisciplinary expertise to inform our strategies in this rapidly evolving field.

Brad: Peter, Thank you so much for helping to frame the discussion for this publication, and for your leadership in upholding international humanitarian law and protecting people around the world from digital threats.