Over the weekend, something extraordinary happened. A working group within the United Nations, comprising all 193 of its member states, adopted a consensus report on norms for responsible state behavior in cyberspace. The report itself represents fairly limited progress, in terms of its contents, although there are some shiny objects for the cyber nerds like me who have been following this process closely. What is most significant is that there is consensus among all U.N. member states in a field that has been wrought with division and contention, especially for the past five years.
Most surprisingly, this process originated from a controversial Russian proposal. Russia has been pushing for the U.N. to have a significant role in the governance of technology for decades, and has been a vocal proponent of the need for an internationally binding cyber treaty. This sounds attractive until you think it through. After all, there’s no doubt that the current state of affairs is untenable and cannot persist. States—notably Russia—seem to be using and abusing cyberspace to wreak havoc on other states, apparently without consequences. There is, of course, a huge body of relevant international law, but not every state agrees on how international law applies to cyberspace. The new report by the U.N.’s Open-Ended Working Group notes that there is still a lack of consensus on this key issue.
The U.S. and its allies are not keen on a cyber treaty. Their position is that there is already a legally binding framework to guide states on how to manage conflict—in international law—and that it covers online as well as offline activities. Therefore, there is no need to make an exception for cyberspace. “The fear is that it’s like a house of cards,” Dennis Broeders of the University of Leiden, a leading scholar on the U.N. cyber processes, tells me. “If we say that some aspects of cyberspace are so special that we need a new treaty, there is an opening to say, ‘So maybe international law does not apply in its entirety in cyberspace after all?’”