Confronting Reality in Cyberspace

Confronting Reality in Cyberspace:
CFR.org
Independent Task Force Report No. 80
Confronting Reality in Cyberspace: Foreign Policy for a Fragmented Internet
Updated July 2022
Download PDF

The era of the global internet is over. Washington has worked closely over the last three decades with the private sector and allies to promote a vision of a global, open, secure, and interoperable internet, but the reality of cyberspace is now starkly different. The internet is more fragmented, less free, and more dangerous. Moreover, U.S. policymakers have long assumed that the global, open internet served American strategic, economic, political, and foreign policy interests. They believed that authoritarian, closed systems would struggle to hold back the challenges, both domestic and international, that a global network would present. This has not proved to be the case.

The early advantages the United States and its allies held in cyberspace have largely disappeared. The United States is asymmetrically vulnerable because of high levels of digitization and strong protections for free speech. Adversaries have adapted more rapidly than anticipated. They have a clear vision of their goals in cyberspace, developing and implementing strategies in pursuit of their interests, and have made it more difficult for the United States to operate unchallenged in this domain.

Around the world, states of every regime type are forcing the localization of data, as well as blocking and moderating content. The United States’ early lead in internet technologies motivated many countries to promote data residency and other regulations to protect national companies. China has long blocked access to foreign websites, created trade barriers to U.S. technology companies, and given preference to domestic incumbents, which now operate across the globe. European policymakers are increasingly focused on the need for presumptive digital self-sufficiency and data privacy. Beijing and Moscow, in particular, have used the United Nations and other international organizations to promulgate a vision of cyber sovereignty centered on state control over the internet.

The international competition for power is accelerating the fragmentation of technology spheres. Policymakers in the United States and China worry about intelligence agencies introducing backdoors in software and hardware, interdicting products along the supply chain, and using both legal and extralegal means to access data held by technology firms. As a result, both countries have recently introduced new rules and measures designed to secure supply chains, exclude foreign suppliers and products, and control the flow of data.

The war between Russia and Ukraine has furthered the fracturing, with Moscow throttling American social media, including banning Facebook, Instagram, and Twitter. Apple, Cisco, Microsoft, Oracle, and others ended sales to or shut down services in Russia. Two American ISPs, Cogent and Lumen, disconnected from Russian networks.1

Internet freedom, as defined by qualitative and quantitative analyses, has been in decline for more than a decade (see figure below). The advocacy group Freedom House, which tracks internet freedom across the world, has seen sustained declines in empirical measures of internet freedom, especially in Asia and the Middle East.2 More states are launching political influence campaigns, hacking the accounts of activists and dissidents, and sometimes targeting vulnerable minority populations. A growing number of states choose to disconnect entirely from the global internet. According to the digital human rights group Access Now, at least 182 internet shutdowns across 34 countries occurred in 2021, compared with 196 cases across 25 countries in 2018.3

 

Threats in cyberspace continue to grow in both number and severity. Security has never been a feature of the internet; indeed, its original design prioritized openness and interoperability over security. Only recently have concepts such as zero trust—a framework requiring all users to be authenticated, authorized, and continuously validated for security—become widely accepted and practiced. Competitiveness in cyberspace will therefore be determined by the ability to operate effectively in an inherently insecure and compromised environment.

The majority of state-backed cyber operations remain related to espionage, but cyberattacks are also weapons of sabotage and disinformation, and the number of disruptive attacks is growing (see figure below). Russia-based hackers are alleged to be responsible for attacks on the power grid in Kyiv in 2015 and 2016, and the Russian-sponsored 2017 NotPetya attack wiped data from the computers of banks, power companies, gas stations, and government agencies, reportedly costing companies more than $10 billion worldwide.4

 

In the weeks before the Russian invasion of Ukraine, malware that can erase hard drives was found in Ukrainian government networks; hackers conducted spear-phishing campaigns against Ukraine’s defense partners; threat actors pre-positioned themselves in supply chains for future attacks on Ukraine and the North Atlantic Treaty Organization (NATO); and distributed denial of service attacks briefly rendered the websites of banks and government organizations inaccessible. Russian hackers disrupted ViaSat, a provider of broadband satellite internet services, in the early hours of the invasion, and the effects spread from Ukraine to Germany and other parts of Europe. In early April, Ukrainian defenders prevented a destructive attack on Ukraine’s power grid.5 According to research from Microsoft, six groups linked to the Russian government conducted hundreds of operations designed to degrade Ukrainian institutions and disrupt access to information and critical services. In some instances, Russia’s cyberattacks were “strongly correlated and sometimes directly timed with its kinetic military operations.”6

Cybercrime on its own has become a threat to national security. Attacks on hospitals, schools, and local governments have disrupted thousands of lives. The Conti ransomware group shut down the administrative body in Ireland charged with managing the national health-care system, disrupting critical health treatments. A ransomware attack on Colonial Pipeline by a criminal group known as Darkside resulted in the shutdown of a 5,500-mile pipeline and gas shortages on the U.S. eastern seaboard. Another group, REvil, was reportedly the sponsor of an attack on U.S. meat supplier JBS that disrupted one-fifth of the nation’s meat supply. This sharp rise in the volume and cost of ransomware incidents has had a dramatic effect on the cyber insurance markets, driving premiums up in excess of 100 percent.7

The digital battlefield is a complex space, and nonstate actors play a powerful role in cyber conflict: some state actors moonlight with criminal action; some criminals are leveraged for state goals. China, Iran, North Korea, and Russia often rely on criminals, technology firms, or other nonstate proxies to conduct attacks. During the war between Russia and Ukraine, criminal groups, hacktivists, and a group of Ukrainian citizens calling themselves the IT Army conducted distributed denial of service, ransomware, and data breach hacks in support of both sides. Hacktivists dumped Russian emails, passwords, and other sensitive data on public websites. The Ukrainian government used Twitter to share a list of Russian and Belarusian targets.8 Criminal hacking could be preparing for, or transitioning to, more destructive attacks. Therefore, a state’s willingness to manage cyber activity emanating from its territory will be a significant marker of its commitment to international efforts to secure cyberspace.

In addition, private companies are creating spyware that enables states that cannot create their own cyber capabilities to conduct high-end cyberattacks. Countries can thus not only conduct nation-state- level attacks, but also—if their commitment to the rule of law is weak—target journalists, activists, dissidents, and opposition politicians. An Israeli company, NSO Group Technologies, created malware known as Pegasus that illustrates the multiple uses of these capabilities. Pegasus was reportedly used by law enforcement agencies to capture drug lords, thwart terrorist plots, and fight organized crime. It was allegedly also deployed against civil rights activists in the United Arab Emirates, journalists in Hungary and Poland, and politicians in India and Spain.9

Much of the response to these threats has justifiably focused on domestic policy and improving the defense and resilience of government and private-sector networks. Since the Bill Clinton administration, policymakers and legislators have attempted to improve information sharing between the public and private sectors, define authorities and build cyber capacity in the federal government, and raise security standards in critical infrastructure networks. The Cyberspace Solarium Commission, established by the 2019 National Defense Authorization Act (NDAA), offered more than eighty recommendations as part of a strategy of “layered cyber deterrence.” Twenty-five of the commission’s recommendations have been codified into law, including the establishment of a Senate-confirmed national cyber director within the Executive Office of the President.10 In March 2022, President Joe Biden signed legislation mandating critical infrastructure owners to report within seventy-two hours if they were hacked or within twenty-four hours if they made a ransomware payment.11

Less attention has been paid to rethinking a vision of U.S. foreign policy for cyberspace that contends with a fragmented, insecure internet and its accelerating weaponization. The United States has tried to set the rules of the road using a combination of international norms, “naming and shaming,” indictments, and sanctions. Despite agreement at the United Nations on some of the norms of responsible state behavior, these efforts have so far had little influence on Chinese, Iranian, North Korean, or Russian cyber operations. Deterrence of cyberattacks below the threshold of use of force or armed attack— most attacks—has failed. As a result, the United States has adopted a doctrine of persistent engagement and forward defense, based on disrupting attackers before they reach U.S. networks.

The increased instability of cyberspace presents a grave challenge. Compared with its adversaries, the United States stands largely alone, the most connected society but with the most vulnerable data. Washington needs a comprehensive digital, cyber, and foreign policy strategy that confronts the reality of the end of the global internet. Moving slowly will result in not only the continued deterioration of U.S. security and economic interests but also a failure to capture fully the benefits of the next wave of digital innovation.

The United States is at an inflection point: the risks in cyberspace are growing, and incumbent strategies are not working. A cyber policy grounded in reality has three pillars.

First, Washington should consolidate a coalition of allies and friends around a vision of the internet that preserves—to the greatest degree possible—a trusted, protected international communication platform. This would not be an alliance of democracies, but rather a digital architecture that promotes the trusted flow of data and transparent international standards. The United States should work with allies and partners to develop international rules and agreements governing how the public and private sectors collect, use, protect, store, and share data. Washington should promote regional digital trade negotiations and adopt a shared policy on digital privacy that is interoperable with Europe’s GDPR. This coalition of trusted states should build an international cybercrime center, support capacity development in developing economies, and cooperate on technological innovation in sectors critical to offensive and defensive cyber operations.

Second, the United States should balance more targeted diplomatic and economic pressure on adversaries, as well as more disruptive cyber operations, with clear statements about self-imposed restraint on specific types of targets agreed to among U.S. allies. Such statements would include limitations on destructive and disruptive attacks on state financial and electoral systems, as well as negotiations with Beijing and Moscow on the threats to strategic stability caused by cyberattacks on NC3 systems. By limiting the risk of misperception and miscalculation among nuclear powers, these restraints are in the United States’ interest because they would reduce the likelihood of catastrophic outcomes. The United States and its partners should also develop coalition-wide practices for disclosing vulnerabilities and applying pressure on states that deliberately provide cybercriminal safe havens.

Third, the United States needs to get its domestic house in order. Digital competition is essential to future strategic and economic interests and should be prioritized in national security strategies. Intelligence agencies should be tasked for cybersecurity risks, and the dangers in domestic cyberspace diminished by incentivizing ISPs to identify and reduce malicious activities occurring on or through their infrastructure. Washington should promote the flow of cybersecurity talent among coalition partners and develop the expertise needed to conduct U.S. cyber foreign policy.

The United States needs to move urgently on cyber and digital competition. Failing to act will significantly harm U.S. security and economic interests in the future.

Full list of endnotes
Up next
Findings
This site uses cookies to improve your user experience. By continuing to browse this site you accept the use of cookies as explained in our Privacy Policy.
Accept Decline