Enhancing the Cyberdiplomacy Arsenal
Tara Maller is a research fellow in the National Security Studies Program at the New America Foundation. Her current areas of focus include sanctions, diplomacy, intelligence, cybersecurity, terrorism and women in security. Previously, she worked at BrightWire Inc., a NY-based startup, where she served as the managing editor and managing director of Operations, Americas. In 2011, she received her Ph.D. in political science at MIT, where her dissertation focused on information collection, diplomacy and sanctions. During this time, she was an affiliate of MIT’s Security Studies Program and she served as research fellow in the International Security Program at the Belfer Center for Science & International Affairs at Harvard’s Kennedy School of Government. Previously, Maller worked as a military analyst at the Central Intelligence Agency, focusing on the Iraq insurgency. She has published articles in The Washington Quarterly, Studies in Conflict and Terrorism and PS: Political Science and Politics. She has also written for foreignpolicy.com, CNN.com and The Huffington Post and has appeared on CNN’s Erin Burnett OutFront and Bloomberg’s Bottom Line. She graduated with a B.A. in government from Dartmouth College and received a M.A. in international relations from the University of Chicago. You can follow her on Twitter at @TaraMaller.
This working paper was written for the conference on “China-US Cooperation & Disagreement Management with a Vision of a New Type of Relations.” The conference was hosted by the China Institute of International Studies and took place August 18-25, 2013 in Changchun and Beijing. The paper was presented as part of a panel on cybersecurity.
A few months ago, the Syrian Electronic Army hacked an AP Twitter account and posted a tweet that read, “Breaking: Two Explosions in the White House and Barack Obama is injured.” It was quickly remedied with the AP locking down the site and individuals indicating this was not true, but the tweet had a short-term impact on the market with the Dow dropping more than 140 points in response to the initial tweet (and then rebounding). Early this month, the same group took over the blog account of a British journalist with a message stating, “Nuclear strikes on Syria: the genie is already out of the bottle.” While these attacks did not cause physical damage to infrastructure or loss of life, these examples illustrate how easily the cyber realm allows non-state actors and individuals to employ an asymmetric tactic to pose potential economic or military harm to larger countries like both the United States and China. This can be done through various types of attacks including ones that put out false information, steal information or deny and disrupt services. While both the US and China have bilateral grievances and legitimate disagreements with each other in the cyber domain, cybersecurity is an issue that goes beyond the US and China. Both countries ought to be able to work together to recognize that they share a mutual interest in cooperating on cybersecurity because a variety of actors in the international system can pose a threat to the prosperity and well-being of both countries over the longer-term.
The purpose of this conference working paper is to emphasize the importance of diplomacy in the realm of cybersecurity, point out some of the obstacles to diplomatic progress and suggest some ways to start moving forward on the cyberdiplomacy agenda.
While we’ve seen cybersecurity rise to the top of the United States’ foreign policy agenda, we haven’t yet seen the full-fledged diplomatic effort that is needed to address associated issues; nor have we seen concrete results. Nevertheless, we can identify promising signs that both the US and China are ramping up efforts to engage in dialogue on these issues. Just this week, Christopher Painter, the US State Department Coordinator for Cyber Issues, acknowledged the depth of cooperation on the issue by saying, “I know I’ve been to China more than any other country since I’ve taken this job.” In June, China’s Ministry of Foreign Affairs announced it had set up a cyber affairs office “to coordinate deal diplomatic activities related to cyber affairs.”
To date, we’ve seen some incremental steps that are promising, but more can be done to overcome barriers to cyberdiplomacy and enhance the cyberdiplomacy arsenal. Both the US and China play critical roles in ensuring that a diplomatic strategy lies at the core of joint US-Sino efforts to resolve cybersecurity issues. Both countries must work together to establish concrete frameworks, mechanisms and communication channels for working through these difficult and complex cyber issues.
While we have not yet seen a cyber attack lead to a military conflict, nor have we seen a cyber attack carried out as an act of war or in the form of a deadly terrorist attack, these remain serious and real threats to both countries. In the interconnected and globally interdependent world we live in, a large-scale cyber attack on either the United States or China – whether it be economic or kinetic in nature – would have ripple effects felt beyond the borders of both countries. The US and China share incentives to cooperate to secure cyberspace even if they have bilateral disagreements about the norms governing their own cyber activities. Having said that, the divergent viewpoints between the United States and China on matters related to economic espionage and intellectually property need to be directly addressed on a continual basis and need to be taken seriously or they have the potential to heighten tensions between the two nations and undermine progress and cooperation in other foreign policy areas. However, patience is definitely needed by both sides, as diplomacy should not be expected to resolve all differences between the United States and China overnight.
My doctoral dissertation focused on the role of US diplomacy in the context of US sanctions episodes, so I come to this discussion as someone who has studied the value of diplomacy in the context of a wide range of difficult and complex issues. Many of these lessons from my work can be taken and applied to the challenges of cybersecurity. In this paper, I’ll set forth some of the challenges to cyberdiplomacy and suggest some mechanisms for overcoming these challenges. I’ll also address some concrete measures the US and China could take going forward in the realm of cyberdiplomacy.
Prioritizing the Cybersecurity Threat
Clearly, cybersecurity has become one of the primary areas of focus on the US national security agenda. In the March 2013 Intelligence Community’s Worldwide Threat assessment, the Director of National Intelligence, James Clapper, recently named the cyber threat as the number one threat to the United States. In a speech this fall, then U.S. Secretary of Defense Leon Panetta warned of the potential for a “cyber Pearl Harbor.” The possibility of a large-scale cyberattack on American soil with physical ramifications and loss of American lives is a real one. According to U.S. military officials, cyberattacks on critical U.S. infrastructure have increased 17-fold from 2007 to 2009. In 2011 alone, cyberattacks increased 40%. In the 2013 defense budget, cybersecurity is one of the few areas of defense spending projected to increase. The United States is concerned about cyber threats from a broad landscape of international actors – both state and non-state. According to a recent July 2013 report by the Congressional Research Service (CRS), “National Security Advisor Tom Donilon said in a speech on March 11 that concerns about cyber threats, not ordinary cyber crime or hacking, moved to the forefront of the agenda with China (up to the level of the President)…” The CRS report also notes that President Obama raised the issue of cyber threats as a “shared challenge” with President XI Jinping in a call on March 14, 2013.
In response to the growing concerns over the cyber threat, the U.S. Department of Homeland Security (DHS) and other Washington, D.C. professional organizations and universities have ramped up recruiting and hiring for cybersecurity jobs and educational programs. The Cyber Command at the Pentagon has also fortified its workforce and resources. Earlier this year, the Washington Post cited the dramatic growth of the US Cyber Command from 900-4000. However, we have not seen the same degree of proliferation of offices and roles dealing with cyber at the State Department. There is the Office of the Coordinator for Cyber issues and others who deal with internet-related topics at the State Department. In his Foreign Policy piece on this issue, Tim Maurer notes that, “the number of diplomats clearly pales in comparison to the number of warriors at Cybercom and other arms of the Pentagon, to say nothing of the cybersecurity elements at the Department of Homeland Security.” In June, China’s Ministry of Foreign Affairs announced it has set up a cyber affairs office “to coordinate deal diplomatic activities related to cyber affairs.” Globally, other countries also need to start ramping up the attention and focus on cyber-related issues. In a recent interview just last week with Christopher Painter, US State Department’s Coordinator for Cyber issues, he notes that, “There are probably now 10 counterparts to me around the world, which is a good thing because that elevates the discussion and policy issue, and grounds it in the reality that it’s not just this technical issue, it’s a policy area.” While these are all steps in the right direction, more needs to be done in the realm of cyberdiplomacy.
Obstacles to Diplomatic Progress on the Cyber Front
There are a number of challenges and obstacles to cyberdiplomacy – some of which are specific to cyber issues and others which generally plague diplomatic efforts on complex areas of disagreement.
The many components of cybersecurity: When we speak of cybersecurity one of the problems is that it encompasses a diverse set of areas that probably ought to be broken out into four categories as they require different types of discussions, norms and solutions. 1) cyberwarfare 2) economic espionage 3) cybercrime 4) cyber terrorism. The US and China have a vested interest in addressing the cyber landscape across all of these dimensions – in terms of bilateral relations and in dealing with the threat posed to both states from non-state actors (such as terrorist organizations and criminal groups).
The scope of the problem in terms of areas of vulnerability and perpetrators: Cybersecurity issues truly permeate through all aspects of our societies. From the individual user’s computer to electrical infrastructure to nuclear facilities, the vulnerable targets are vast, as are the potential perpetrators. Different areas of the cyber realm may require different solutions. Whether dealing with infrastructure targets or business computers or nuclear facilities, there may need to be different solutions to making sure these targets remain safe and that the international community understands the norms and penalties associated with different types of attacks on different types of targets. In addition, both state and non-state actors can carry out cyber attacks, so diplomatic efforts must address both of these areas.
The confusion over applying security paradigms: When dealing with cyber in the state to state realm, do traditional security paradigms and structures apply to the realm of cyber or is it something new in the context of international conflict? There seems to be confusion as to what international law applies with regard to concepts like deterrence or laws of war. The field is not nearly as mature as other areas of conflict, so diplomatic efforts are taking place outside an existing governing structure.
Mutual suspicions and tensions taint diplomatic processes: In addition, political leaders may face more general barriers to strong diplomatic outreach with regard to complex areas where tensions may be high or there maybe be areas of disagreement – China/US cybersecurity is no exception. Unfortunately, when mutual suspicions and hostilities are present, leaders tend to resist diplomatic outreach and it makes cooperation more difficult. It might also be more difficult to find In the United States, historically, we’ve seen US leaders criticized for wanting to adopt policies predicated on strong diplomatic engagement with adversaries or states with which we have disagreements. In Anatomy of Mistrust, Deborah Larson argues that mutual mistrust may actually create self-fulfilling prophecies between states and failures in cooperation. She argues that officials who fear and distrust one another are likely to take actions which essentially fuel more fear and distrust, which works to perpetuate a cycle by worsening the dynamic that already existed at the outset.
Political pressures and challenges to diplomacy: In general, political leaders may also worry about appearing weak to domestic or international audiences if they make diplomatic overtures or express a willingness to negotiate with certain actors or states. These concerns can be even more salient if they are thinking about reversing their position. In other words, leaders may worry that their previous strategies will be perceived as failures if they modify their positions and they may also fear losing credibility.
Diplomacy Matters
Diplomacy is not just symbolic. It provides a window into both sides’ decision-making processes and motivations – and increases trust between the parties involved. Increased diplomatic interaction also helps clarify the nature of the demands and resolve ambiguity or misperceptions that exist. All of this is necessary in the context of cybersecurity disagreements between the United States and China.
The United States and China both have legitimate concerns and grievances. However, these issues can only be resolved by maintaining open lines of communication and making a strong and concerted effort to cooperate on this very difficult issue and work to institutionalize this cooperation both bilaterally and multilaterally.
My dissertation research focused on the value of diplomatic engagement – not cybersecurity – but many of the overarching lessons regarding the concrete value of diplomacy can be applied to the cyber realm. In fact, my research looked specifically at diplomacy in the context of US sanctions across a wide range of difficult issue areas. So, these were all cases with their own sets of tensions as punitive policies were in place. In my research, I looked at more than 100 episodes in which the US imposed sanctions on other countries. When controlling for other variables, simply increasing the economic costs imposed on the target state did not lead to desired outcomes.
Diplomacy was critical to progress and diplomatic disengagement hindered efforts to attain desired outcomes. For example, in the most extreme cases, when the US completely disengaged with a country and closed its embassy in a targeted country, for instance, the rate of failure in attaining desired outcomes rose to 73 percent from 42 percent.
The Atlantic Council’s expert on cybersecurity, Jason Healey, writes in a recent article, “The cyber age has barely begun. But already cyberspace is so dangerous, and with so few norms, it has been called the new Wild West. Its future is still a jump ball, however, and there is no way of knowing how sensitive that future could be to the wrong decisions today.”
Both the US and China need to work to attain mutually agreed upon norms and rules governing the cyber realm. As with the traditional realm of war –without a set of international norms and structure in place, misperception may become increasingly likely with unintended escalation and negative outcomes for both sides. We can see the classic security dilemma at work in the realm of cyber – particularly since offensive and defensive measures can at times be indistinguishable from one another.
However, if the US and China don’t take strong diplomatic measures now to sort out disagreements and cooperate, we risk cybersecurity conflict becoming more and more entrenched over time – making it increasingly difficult to engage in diplomacy or engage one another to resolve differences, establish norms and work together. In addition, we run the risk of cyber attacks or cybersecurity disagreements polluting US-Sino relations in other areas or, in a worst-case scenario, unintentionally catalyzing conflict.
General Recommendations for Overcoming Diplomatic Barriers
In light of the previous barriers discussed, there are a number of recommendations that may help ameliorate barriers to diplomacy and help leaders opt for diplomatic engagement.
Emphasize that diplomacy does mean equal concessions, but it a process of communication, learning and even expressing disapproval: Diplomacy is a mechanism of communication between states. It does not need to convey an attitude of acceptance or approval of another state’s behavior. In fact, diplomacy can be used to convey harsh messages of condemnation, criticism, and even articulate threats to another state. Opponents of diplomacy often frame diplomatic endeavors as signals of acceptance of the other side, so framing diplomatic engagement as a way to apply positive and negative pressures can help overcome this limited view of diplomacy.
Engage in both public and private diplomacy: Concerns about reputation or credibility can be ameliorated by starting talks in private. While public displays of diplomacy, like the recent summit in California are critical, behind-the-scenes talks allow diplomatic foundations to be put in place. The US and China should be engaging in both forms of diplomacy on cybersecurity.
Highlight the many advantages of diplomacy beyond just attaining political outcomes: Diplomacy can yield a number of advantages beyond immediate attainment of desired outcomes Diplomatic negotiations can work to transform the nature of relationships between parties, build trust and lead to personal relationships between leaders in both states. There can be spillover effects into other areas and on other issues beyond cybersecurity.
Emphasize that diplomatic progress in one area, such as cybersecurity, can impact positive outcomes in other realms of foreign policy for both countries: Diplomacy can serve as a way to link a broad set of issues together and negotiate differences across these issues areas. Working to resolve differences in cybersecurity can also assist US-China relations and help with progress in other areas that serve both states’ interests.
Breaking down the cyber issues: Given that the areas of agreement and disagreement in the cyber realm span across different types of activities, it makes sense to try to work on these areas separately and establish frameworks, norms and international law treating these areas separately. In other words, breaking down the cyber issue into dimensions mentioned earlier (cyber-terrorism, cybercrime, economic espionage, cyberwar) and dealing with these as separate issues might make it easier to make progress faster on areas of agreement.
Start with small victories: Related to the point above, start with areas of cyber that the US and Chinese agree on and then address some of the more difficult areas of disagreement. Sometimes small mutual victories can work to help in fostering cooperation in later negotiations.
Moving Forward on Cyberdiplomacy
Both the US and China ought to embrace a strong push for cyberdiplomacy and work together to create a comprehensive international framework or treaty. A parallel effort should include the ongoing diplomatic meetings that have started –and continued high-level meetings on this issue.
While ideally an official agreement or framework will be put in place over time, the US and China ought to work on confidence-building measures and communicating redlines. The Strategic and Economic Dialogue meetings and the new Cyber Working Group, which first met on July 8 will be key to these efforts. In July, both sides agreed to talk more about the norms governing cyber activities and Defense Secretary Hagel emphasized the importance of US-Chinese cooperation.
Ramp up on cyber diplomats: The US should devote more resources to the diplomatic side of the cyber equation, namely at the State Department. The China-US Strategic Security Dialogue, State’s Cyber Coordinator and the newly announced Chinese cyber affairs office are all positive steps in the right direction. Both President Obama and Secretary Kerry ought to be having frequent meetings with Chinese leadership on cyber issues and other areas of importance to US-Sino relations. In his Foreign Policy piece Maurer suggests “Let’s start by growing our cyber diplomatic effort by at least a factor of five.”
Increase high-level cyber summits: Diplomatic summits and high-level meetings between leaders, like the recent meeting between both countries leaders at the Sunnylands Estate in California are critical and should be continued. Personal relationships are important. Larger summits, conferences and exchanges, such as this conference, are important for promoting a shared vision and for understanding the zones of disagreement.
Increase track two cyberdiplomacy efforts: In addition, track two diplomacy efforts like this conference are critical. Academics, journalists and researchers conversing and brainstorming about ways to find areas of agreement in the cyber domain are helpful in trying to find new and innovative paths that may not be on policymakers’ agendas. For example, the Center for Strategic and International Studies has been helping to organize bilateral talks with key Chinese leaders.
Create cyber milestones: The US and China should work to develop cyber milestones. This could take the form of symbolic goals or a timeline for certain small steps to be accomplished. Look historically to how norms developed around chemical, biological and nuclear weapons and determine if shared norms could create pillars for a new cyber weapons convention or cybercrime convention.
**Define which current laws are applicable to cyber realm and define areas where international cooperation may be required to create new frameworks:**In the Chris Painter interview mentioned earlier, he notes that the UN Group of Government Experts (which includes both the US and China), are issuing a final report that notes that existing international law included in frameworks like the UN Charter and the Law of Armed Conflict apply to the cyberspace domain. However, while existing frameworks may be applicable in some areas, there is definitely a need for additional new frameworks to govern cyberspace.
Establish a cyber hotline: The US and China should establish a cyber hotline like the one that was recently established between the US and Russia in June. This type of communication channel is valuable particularly in the event of any sort of cyber crisis between states.
Joint study on impact of attacks: In a 2012 paper by Greg Austen and Franz Stefan-Gady and published by the East West Institute, the authors propose that a joint study be carried out by the United States and China. The study would examine the “interdependence of their respective critical information infrastructure in terms of likely economic effects of criminal attacks with strategic impacts.” Joint studies looking at the impact of various types of cyber attacks are useful in highlighting the shared consequences and also help foster greater communication, cooperation and transparency between the US and China.
Make red lines clear: Both the US and China need to make red lines clear by clearly articulating its responses if certain lines are crossed and the types of penalties being considered in response to certain types of attacks with regard to non-state actors and states.
Devote significant time and resources to working through disagreements relating to intellectual property/economic espionage: Disagreements over intellectual property/economic espionage are at the heart of US-China differences of opinion in the realm of cyberspace. While hopefully both sides can be brought closer together in terms of their position on these issues, this will undoubtedly take time. This will most likely be the most difficult issue area on the cyberdiplomacy agenda. The East West Institute report suggests establishing a legal foundation to allow both countries to share information and work on joint assessments pertaining to intellectual property-related cases. It may also be worthwhile to try to separate this particular issue out from the other cybersecurity issues on the cyberdiplomacy agenda through separate working groups or officials specifically dedicated to bilateral discussions on these types of attacks. This may help prevent the issues of deepest disagreement from undermining progress being made on other aspects of cybersecurity.
Conclusion
While this paper emphasizes the important role of diplomacy in the realm of cybersecurity, the progress made via diplomacy must be carefully tracked and gauged over time. It is in the best interest of both China and the United States to find areas of agreement on these complex issues or the interests of both nations will be undermined in the long run. If the US, China and other countries can’t work together to govern cyberspace, we are going to see private companies start taking matters into their own hands by attacking back while individual countries start adopting punitive policies like sanctions to address such attacks. We will also see a rapid deterioration in relations between countries due to these attacks and spillover effects into other foreign policy areas of cooperation. This is not in the best interest of either the United States or China – and so both countries should devote significant time and resources to enhancing the cyberdiplomacy arsenal. Back in 2011, Henry Kissinger and Jon Huntsman called for a US-China cyber détente and that is exactly what both countries need to work on attaining right now.