Critical Review 6

Risking Security: Policies and Paradoxes of Cyberspace Security

Ronald J. Deibert

University of Toronto

and

Rafal Rohozinski

University of Toronto

Conceptualizations of cyberspace security can be divided into two related dimensions, articulated as ‘‘risks’’: risks to the physical realm of computer and communication technologies (risks to cyberspace); and risks that arise from cyberspace and are facilitated or generated by its technologies, but do not directly target the infrastructures per se (risks through cyberspace). There is robust international consensus, growing communities of practice, and an emerging normative regime around risks to cyberspace. This is less the case when it comes to risks through cyberspace. While states do collabo- rate around some policy areas, cooperation declines as the object of risk becomes politically contestable and where national interests vary widely. These include the nature of political opposition and the right to dissent or protest, minority rights and independence movements, religious belief, cultural values, or historical claims. The contrast between the domains has led to contradictory tendencies and paradoxical outcomes.

Globalization is generating new security challenges. Modern societies confront a myriad of risks that threaten economic prosperity, undermine the safety and security of citizens, and cause significant disruption to society and politics. These risks range from empowered and militant nonstate actors to technological and human-made processes, such as environmental degradation and global warming. Risk mitigation has become a routine matter of good public policy.

Cyberspace represents a special category of risk.1 A term once found only in science fiction novels, cyberspace describes the human-made domain for action

1There are perennial debates about how to define cyberspace and distinguish it from related concepts, like the Internet. The latter is typically defined as ‘‘a worldwide network of computer networks that use the TCP ⁄ IP network protocols to facilitate data transmission and exchange.’’ Although this definition is important and at the core of the subject matter under investigation in this paper, it is primarily focused on the material infrastructure of networked devices while excluding from consideration other important non-physical elements and characteristics. In this paper, we adopt the definition of cyberspace recently put forward by the US Department of Defense. Accord- ing to the US Department of Defense’s National Strategy for Military Operations in Cyberspace (2006:3), cyberspace is as ‘‘a domain characterized by the use of electronics and the electromagnetic spectrum to store, modify, and exchange data via networked systems and associated physical infrastructures.’’ There are several benefits of this broader definition: First, it covers more than just networked computers, and includes cellular technologies, space-based systems, and other technologies that are not at first blush usually associated with the Internet. Second, the reference to cyberspace as a ‘‘domain’’ allows for inclusion of non-physical elements, such as ideas and virtual realities, which are increasingly the subject of securitization today.

� 2010 International Studies Association

International Political Sociology (2010) 4, 15–32

D ow

nloaded from https://academ

ic.oup.com /ips/article-abstract/4/1/15/1917052 by D

eP aul U

niversity user on 06 M arch 2019

that exists as a consequence of an interconnected and interdependent global communications and computing infrastructure. Cyberspace connects more than half of all humanity and is an indispensable component of political, social, eco- nomic, and military power worldwide. In strategic terms, cyberspace is accepted now as a domain equal to land, air, sea, and space.

Predictably, in the post-9/11 era, cyberspace is the focus of security concerns as states weigh the risks and benefits of omnipresent global connectivity. How- ever, cyberspace presents special security challenges, for a variety of reasons. First, and most importantly, it is a communication network that is organized transnationally and not through the institutional structures of the state system. Although states and individuals may claim sovereignty or ownership over seg- ments of cyberspace, particularly parts of its material infrastructure, or even opt out of it entirely, once in they are never fully in control. Cyberspace has emergent properties, in other words, that elude state control.

Second, and closely related, cyberspace is operated as a mix of public and private networks. Governance of cyberspace, like its architecture, is distributed, and does not take place within a singular forum or point of control (Dutton and Peltu 2007).

Even the Internet Corporation for Assigned Names and Numbers (ICANN), that is most often associated with Internet governance issues, is only narrowly concerned with domain and routing management and not with the full panoply of cyberspace governance issues (Mueller 2002). There are instead numerous sites of cyberspace governance, from spectrum allocation to copyright and intel- lectual property regulation to content filtering and cyber-crime (among many others). Each of these sites involves numerous stakeholders, including govern- ments, businesses, and civil society networks. In addition, private sector actors from multiple countries operate most of the core infrastructural components of cyberspace. What James Der Derian (2003) calls ‘‘heteropolarity’’ perhaps best characterizes the state of cyberspace governance.

Third, unlike other domains, such as the sea, land, air, or space, cyberspace is a human-made domain in constant flux based on the ingenuity and participation of users themselves. One of the core design features of cyberspace is the end-to- end principle, which allows for generative technologies to be introduced into cyberspace by end users as long as they conform to the basic protocols of inter- connectivity (Saltzer, Reed, and Clark 1984). The latter introduces not only great variation and constant innovation, but also new and unforeseen security risks (Zittrain 2007). It also creates major problems for regulation, insofar as regula- tors are always chasing a moving target. In other words, cyberspace is a domain of constant transformation and a high degree of complexity.

Fourth, cyberspace is comprised of both a material and a virtual realm—a space of things and ideas, structure and content. Theorists and observers of cyber- space often focus on one of these elements to the exclusion or diminution of the other, but both are important and interdependent. Cyberspace is indeed a ‘‘consensual hallucination’’ as Gibson (1984) famously defined it, but one that could not exist without the physical infrastructure that supports it. Attempts to control and monitor the virtual realm of cyberspace often begin with interven- tions in the physical infrastructure, at key Internet chokepoints (Deibert, Palfrey, Rohozinski, and Zittrain 2008). However, these efforts are never entirely compre- hensive; once released into cyberspace, the distributed properties of the network help ideas and information circulate, duplicate and proliferate. Even radical measures, such as disconnecting the Internet entirely as was done recently in Burma and Nepal, can only limit, but not entirely contain the flow of ideas.

In this paper, we examine processes of securing cyberspace and their wider implications. Drawing from the sociologist Ulrich Beck, we do so by first disaggre- gating cyberspace security into two related but distinct dimensions, articulated as ‘‘risks’’: risks to the physical realm of computer and communication technologies

16 Risking Security

D ow

nloaded from https://academ

ic.oup.com /ips/article-abstract/4/1/15/1917052 by D

eP aul U

niversity user on 06 M arch 2019

and their associated networks (risks to cyberspace, commonly known as critical infrastructure protection); and risks that arise from cyberspace and are facilitated or generated by its associated technologies, but do not directly target the infra- structures per se (risks through cyberspace). As we show, there is a robust interna- tional consensus, growing communities of practice, and even an emerging normative regime around critical infrastructure protection. Even in military areas, where states compete for strategic advantage and have developed doctrines for operations in cyberspace, there is, for the moment, a reluctance to employ overt computer-based attacks against other state’s national information infrastructures and a mutual deterrent norm is slowly developing, albeit in fits and starts.

This is less the case when it comes to risks through cyberspace. While states do collaborate around some policy areas where consensus and mutual interests can be found (for example, ‘‘piracy,’’ and to a lesser degree child pornography), cooperation declines as the object of risk becomes politically contestable and where national interests can vary widely. These include the nature of political opposition and the right to dissent or protest, minority rights and independence movements, religious belief, cultural values, or historical claims.

The contrast between policies around these two domains has led to contradic- tory tendencies. States seek policy coordination and regulations so as to make cyberspace a more secure, safe, and predictable environment recognizing its stra- tegic importance to economic and social development. These efforts to combat risks to the network are driven by a desire to sustain-through-security a friction- free and distributed global communications environment. At the same time, regime type and legitimacy varies greatly between states, and actions taken in response to risks through cyberspace can have the opposite effect, introducing fric- tion in the form of filtering of undesirable content, intimidation and self-censor- ship through pervasive surveillance, and even the disabling or disconnection of critical infrastructures in an attempt to neutralize the risks posed by networked political or social actors.

This paper examines the larger implications of these seemingly paradoxical tendencies. We suggest that securing cyberspace is not a simple balkanization of the Internet or a ‘‘return of the state,’’ as some have suggested (Goldsmith and Wu 2006). Rather, it is a complex process entwining both the development of universally accepted norms and ever-expanding ‘‘rules of the game,’’ state regu- lation of issues of vital domestic, political and cultural concern, privatization of risk mitigation, and the internationalization of public policy.

Risk Society

In a globalizing world, risk mitigation has become a routine matter of politics, good public policy, and a major market segment in its own right. Politicians employ risk in lieu of ideology as a justification for policies ranging from eco- nomic and social development to national security and international aid. Risk mitigation, management, and governance are now widely studied, propagated and institutionalized techniques of governance.

The German sociologist Ulrich Beck (1992) first teased out the connections between ‘‘risks’’ and modern industrialism and globalization organized around a historical narrative of modern social development. According to Beck, European and North American life has undergone a series of historical transformations, from traditional to modern to reflexive, as a result of a variety of economic, political, and social factors. In the last and latest period coinciding with contem- porary times, individualism and human agency have become more pronounced. Educated individuals and skilled labor forces have reflected on the institutions that surround them, and have questioned their legitimacy—a development Beck famously refers to as ‘‘reflexive modernization’’ (see also Giddens 1990).

17Ronald J. Deibert and Rafal Rohozinski

D ow

nloaded from https://academ

ic.oup.com /ips/article-abstract/4/1/15/1917052 by D

eP aul U

niversity user on 06 M arch 2019

There are several elements of Beck’s risk society thesis that pertain to our anal- ysis and from which we draw inspiration. First, and most importantly, is the notion of ‘‘risk’’ itself, and the social redistribution of risks. According to Beck, the central principle of industrial society is the distribution of goods and ser- vices, while the central principle of the risk society is the distribution of ‘‘bads,’’ or risks. In general terms, risk is simply defined as the possibility of incurring loss. Analyzing how risks are distributed tells us much about the functioning and politics of particular societies. One of the more remarkable aspects of securing cyberspace is the way in which some risks are distributed by states to private actors and the consequences that flow from that redistribution.

A second element of Beck’s thesis is the artificial or constructed nature of risks. Here, our analysis both overlaps and parts ways with the Copenhagen school of securitization (Buzan, Wæver, and de Wilde 1998; Stritzel 2007). Like that school, and Beck’s risk society thesis, we take the position that risks are socially constructed. Unlike the Copenhagen school, however, we do not limit our analysis to discourses and discourse analysis, but broaden it to include non- discursive, indeed even physical structures, that shape and limit notions of secu- rity and risk. In our analysis, the technological characteristics of cyberspace itself are restrictive factors that shape the realm of the possible in ways that discourse alone cannot explain.

Third, like Beck, we place a great deal of emphasis on unintended and often paradoxical consequences of risk mitigation.2 For Beck, a central characteristic of reflexive modernization is the tendency for risk mitigation to beget further risk, and so on, until the mitigation of risk becomes the central element of poli- tics and public policy. Each risk mitigation strategy breeds new uncertainty and unpredictable consequences, which in turn require further mitigation, often undermining risk mitigation strategies in other sectors of society. As the title of our paper suggests, there is a paradox at the heart of some of the ways in which states are securing cyberspace, which leads to an insecurity of a different sort.

To understand that paradox, the two different conceptions of risks emerging from cyberspace need to be unpacked and evaluated separately: risks to cyber- space and risks through cyberspace.

Risks to Cyberspace: Critical Infrastructure Protection

As the Internet was specifically designed to be a resilient communications network, security vulnerabilities have always been a major factor with which to contend and are at the core of the network’s distributed architecture. These vul- nerabilities have become more pronounced, however, as cyberspace has grown from an experimental network, to a university-based research network, to an inte- gral part of the global political economy on which all modern societies exist (Kleinrock 2008). Cyberspace is the domain through which electronic clearances take place, irrigation systems are controlled, hospitals and educational systems interconnect, and governments and private industries of all types function. It

2Anthony Giddens (1990:153) best describes the dynamics in this regard: ‘‘Design faults and operator failure clearly fall within the category of unintended consequences, but the category includes much more. No matter how well a system is designed and no matter how efficient is the operators, the consequences of its introduction and function, in the contexts of the operation of other systems and of human activity in general, cannot be wholly pre- dicted. One reason for this is the complexity of systems and actions that make-up world society. But even if it were conceivable—as in practice it is not—that the world (human action and the physical environment) could become a single design system, unintended consequences would persist. The reason for this is the circularity social knowl- edge, which affects in the fist instance the social rather than the natural world. In conditions of modernity, the social world can never form a stable environment in terms of the input of new knowledge about its character and functioning. New knowledge (concepts, theories, findings) does not simply render the social world more transpar- ent, but alters its nature, spinning it off in novel directions.’’

18 Risking Security

D ow

nloaded from https://academ

ic.oup.com /ips/article-abstract/4/1/15/1917052 by D

eP aul U

niversity user on 06 M arch 2019

can be found aboard nuclear submarines and bicycles, watches and air traffic control systems—it is ubiquitous and pervasive, and is most acutely felt when it is absent.

The vulnerability of cyberspace to malicious or accidental disruption came to light in several high profile incidents, including the infamous 1988 Morris Worm in which a virulent program was mistakenly released on the Internet causing worldwide traffic to come to a standstill. Beginning in the 1990s, it became more common to hear scenarios involving actors targeting the Internet (and cyber- space more broadly) to bring about widespread havoc—famously coined an ‘‘electronic pearl harbor’’ by President Clinton’s National Cyber-Security Advisor, Richard Clarke (Denning 2000). Whether through cyberterrorism, or through accident, a growing recognition of all advanced societies’ increasing dependence on cyberspace has brought about ever more pronounced efforts at cyberspace securitization. Although there have been many that have been rightly skeptical of the scope of the claims made, as well as the interests served by the articulation of threats, there has been a growing consensus among advanced industrialized states around defining cyberspace as a key national asset and critical infrastruc- ture to be secured.

There are numerous policy documents, legislative and institutional initiatives, and analyses around securing critical infrastructures (Dunn Cavelty 2008; Lewis 2008). Rather than attempt to be comprehensive, our aim here is instead to highlight several crosscutting characteristics of these initiatives. A growing num- ber of states have created new institutions or re-tasked existing ones with the mandate to either oversee critical infrastructure security and ⁄ or make recom- mendations as to how the security should be undertaken. In almost all cases, a similar justification is employed pointing to society’s growing dependence on information and communication technologies, the vulnerabilities that exist in these systems, and the steps that need to be taken to secure cyberspace to keep it functioning as the infrastructure of the global political economy, either from deliberate attack or disruption through accident (Lewis 2008). The latter is the area with, not surprisingly, the greatest scope for policy divergences among states. Generally speaking, though, among advanced industrialized economies, like Canada, the United States, and the countries of Europe and parts of Asia, there is recognition of the significant role played by private actors in the consti- tution of cyberspace and the need for public-private partnerships. Many coun- tries are unwilling, or their constituencies would not tolerate, heavy-handed regulations that impose requirements on private actors from the state.

Second, and related, is that there is a particular ideological notion of cyber- space that is supported by these policies, one closely related to the functioning of global capitalism. This may seem self-evident, but it is important to under- score and scrutinize. Although discussions of Internet security are often couched in technical-functional terms, the political economy of critical infrastructure is never absent and broad values always inform security policies. The often unspo- ken logic of securing critical infrastructures is to support and sustain a friction- free communications environment in which ideas ⁄ data ⁄ purchase orders ⁄ financial transactions move freely and with as much speed as possible across borders and around the word (Deibert 2002). Disruption to critical infrastructures means, first and foremost, disruption to global capital markets.

Third, there is a delicate matter of balancing the security requirements of criti- cal infrastructure protection with national security imperatives, and in particular the collection of intelligence. In many states, the main agency charged with criti- cal infrastructure protection is also the central agency charged with signals intel- ligence and actionable electronic information (Bronk 2008). In part, this is a vestige of the critical assurance role played by these agencies for governments’ communications and increasingly for businesses. Both the Communications

19Ronald J. Deibert and Rafal Rohozinski

D ow

nloaded from https://academ

ic.oup.com /ips/article-abstract/4/1/15/1917052 by D

eP aul U

niversity user on 06 M arch 2019

Security Establishment Canada (CSEC) and National Security Agency (NSA) pro- vide due diligence for government encryption standards, for example, a role that has continued and in fact broadened to include private actors.

Although prima facie this may seem appropriate, the risk distribution creates a significant tension for a variety of reasons. First, many of these organizations operate in secrecy and with limited public accountability, and have both a track record and putative interest in having covert access to private communications. Since much of the operation of critical infrastructures is in private hands, it cre- ates a tension between the interests of national security agencies and private actors and raises major privacy concerns, particularly as many of the companies themselves are constituted as multi-national or transnational joint ventures. Second, and as will be explained in more detail below, the effort to secure cyberspace by these agencies has been used to justify a massive expansion of surveillance powers, and even in some cases an alteration to the very framework of that which is to be protected.3

Third, although national critical infrastructure initiatives are the most common, there is a slow but steady internationalization of critical infrastructure protection initiatives, policy coordination, and legislation. These include initia- tives at the regional, inter-state, and global levels. The G8, APEC, CoE, the OECD, NATO, and the ITU (IMPACT) all have cyber-security initiatives of some sort (Hosein 2008; ITU 2008). There is also sub-state policy coordination among critical infrastructure bodies, in particular the Computer Emergency Response Teams (CERTs) that have been set up in countries around the world, through the mechanism of the Forum of Incident Response and Security Teams (FIRST). These initiatives are noteworthy for a variety of reasons. First, they suggest a growing international consensus and norm around the importance of securing critical infrastructures along the lines of the principles outlined earlier. Second, they represent a nascent ‘‘internationalization’’ of public policy, particularly in areas of early warning, notification, harmonization of law enforcement, data retention, and best security practices (although that has yet to be fully realized, as will be explained below). Third, the mix of private and public actors involved in these initiatives gives them an embeddedness (and thus stickiness) in state-society relations and across multiple jurisdictions. Fourth, and most importantly, they represent a growing recognition of the mutual interdependence generated by cyberspace. Although protection of national assets is obviously first priority among states worldwide, there is also acknowledgment that cyberspace cannot truly be secured single-handedly and that the definition of ‘‘national assets’’ itself is problematic for this very reason.

The emerging norm around securing critical infrastructures, and the recogni- tion of mutual interdependence of cyberspace, can be seen most clearly in the limits that shape states’ offensive operations in cyberspace. A growing number of states have developed or are exploring doctrines around offensive operations in cyberspace. These doctrines are a legacy of a variety of factors: the ‘‘revolution in military affairs,’’ a greater understanding of the vulnerabilities of cyberspace and ways to exploit those vulnerabilities, the natural imperatives of defense orga- nizations whose mandate is to pursue military technologies to their fullest limits, and also a growing recognition of, and need to counteract, the risks through cyberspace that are described in more detail below. However, the limits to these actions are also widely acknowledged and a variety of legal and technical factors prohibit offensive operations (Kelsey 2008). For example, during the 2003

3Here we see starkly an illustration of how risk mitigation and distribution begets further risk, in this case to pri- vacy. One example of this is the recent exploration at a UN working group, supported by both the Chinese and US national security agencies, for an end to anonymity online through an infrastructural alteration to cyberspace to allow for Internet Protocol (IP) trace-backing (McCullagh 2008).

20 Risking Security

D ow

nloaded from https://academ

ic.oup.com /ips/article-abstract/4/1/15/1917052 by D

eP aul U

niversity user on 06 M arch 2019

invasion of Iraq, the full range of offensive computer network attack capabilities was constrained by both legal restrictions and the fears of a cascading effect on European financial institutions.4

Certainly there are many gaps in critical infrastructure protection, and legitimate questions that are raised about the ways in which critical infra- structure protection policies are conceived and implemented. Short-sighted and wrong-headed solutions to cyberspace security are plentiful and well documented by researchers, and many of the institutions created to secure risks to cyberspace are inadequately resourced, improperly designed, and lack mechanisms to share information across borders. However, in spite of these gaps and questions, a growing ‘‘community of practice’’ is emerging in the area of critical infrastructure protection that is spreading internationally (Adler 2005). This community of practice includes a large cross section of states and private sector actors that shares a common vision of that which is to be secured and why.

Risks Through Cyberspace: Dealing with Dark and Resistance Nets5

Cyberspace, in particular the Internet, has made networking between like- minded individuals and groups possible on a global scale and has contributed to a massive explosion of civic networks. Powerful, easy-to-use search technologies, media of self-expression, like blogs, and communicative systems make it easy to form virtual communities, connect causes, and organize political activities. Global civic networks have consistently been the earliest adopters of Internet technolo- gies for their collective activities, and oftentimes have been at the forefront of innovative uses of new media, like SMS, VoIP, Facebook, Twitter, and blogs. The medium’s constitutive architecture—distributed, decentralized, and relatively cheap and easy to employ—‘‘fits’’ with the organizational and political ‘‘logic’’ of global civic networks (Naughton 2001). Local causes seek and find moral and financial support on a global basis and consequently, local politics can now play to a global audience.

But the technological explosion of civil society has not emerged without unin- tended and even negative consequences, particularly for nondemocratic, authoritarian, and competitive authoritarian states (Way and Levitzsky 2002). Cyberspace has enabled new, nimble and distributed challenges to these regimes, manifest in vigorous, mobilized opposition movements, protests, and in some cases, even revolutionary challenges to political authority. In many countries, cyberspace presents the only medium of expression not rigidly or traditionally controlled by the state. Activists in even the most tightly controlled societies, like Uzbekistan, Burma, Iran, China, Vietnam, Belarus, Tunisia, and Vietnam, are able to find links across borders and mobilize support for their cause through the medium of cyberspace. For these regimes, these movements represent a new, fluid, and very formidable security risk. We call these risks through cyberspace that challenge nondemocratic, authoritarian, and competitive authoritarian regimes, resistance networks.

4One rather perverse outcome of these constraints is that they may create an incentive for states to offload or outsource offensive computer operations to third parties or criminal organizations and thus allow for plausible deniability. For example, in several recent instances involving DDoS computer network attacks on adversaries of the Russian state, there was unverified, but circumstantially compelling evidence connecting criminal organizations involved in the attacks with Russian security forces. It is noteworthy that China’s doctrine of enlisting the people, and nationalist fervor, in offensive computer network attacks is compatible with such an incentive structure. Such offloading and outsourcing allow states plausible deniability although capitalizing on some of the limited outcomes of offensive computer network operations, examples of which are picked up in more detail in subsequent sections of this article.

5The following section draws from Deibert and Rohozinski (2008).

21Ronald J. Deibert and Rafal Rohozinski

D ow

nloaded from https://academ

ic.oup.com /ips/article-abstract/4/1/15/1917052 by D

eP aul U

niversity user on 06 M arch 2019

Even among democratic states, the explosion of civic networks has presented serious challenges, though of a slightly different nature. Just as progressive and social justice groups have made use of the Internet to advance global norms, so too have a wide variety of militant groups, extremists, criminal orga- nizations, and terrorists to serve more ulterior purposes. Cyberspace has facili- tated their activities in much the same way as it has for more benign civil society networks that often get more attention, but the aims of these groups are often criminal, covert, and sometimes violent. We call these risks through the network dark nets, of which there are two different sorts (Deibert and Rohozinski 2008).

The most well known of the dark nets are armed social movements, which can represent a multiplicity of local causes, but whose ability to share tactics, con- tacts, and at times, drink from the same ideological well, make them appear as a unified global network. In the post-9/11 era, Al Qaeda and the Jihad movements represent the most visible manifestation of this kind of armed social movement. However, they are by no means the first and only networks of this kind. Many of the ‘‘new wars’’ (as Mary Kaldor calls them) that occurred during the 1990s were fought essentially as transnational civil wars where participants pursued both gue- rilla and conventional warfare against government and rival groups (Kaldor 1999). In conflicts that included Sri Lanka, Somalia, former Yugoslavia, West Africa and Chechnya, ‘‘new wars’’ demonstrated that armed social movements are capable of challenging and at times defeating state actors without the need of state-based patrons or backers.

More importantly, this new generation of armed social actors has also increas- ingly embraced cyberspace (Rohozinski 2004). They recognize the capacity afforded by cyberspace to ‘‘effect’’ both their supporters and opponents. Signi- ficantly, it was these groups, rather than militaries of the First World War, that were the first to leverage cyberspace as means to wage information operations redefining the main battlefield away from the military and towards the political sphere (Weimann 2006b). Beginning with the first Chechen war, the video taping of attacks on the Russian military became more important than the military significance of the attacks themselves. When shown to supporters, as well as the Russian public (via rebroadcast in Russian television, and later on the In- ternet) their shock value was enough to convey the impression that the Russian military was being defeated. Similar tactics were adopted and further refined by Hezbollah in its resistance against Israeli occupation of Southern Lebanon prior to their withdrawal in 2001, and again in the 2006 summer war. Attacks were documented and produced in the form of music videos, that were both broad- cast across Hezbollah’s terrestrial TV station, (al Manar) as well as made available for download from a website, the movement established as part of its strategic communications and information warfare strategy (Pahlavi 2007; Wehrey 2002).

These video shorts proved highly effective, and have since undergone several significant evolutions, paralleling the spread and popularity of such on-line resources as YouTube and Twitter that are used by ‘‘civil’’ networks. They are now one of the key instruments used by these movements to attract interest in their causes and are a significant feature of the more than 4,500+ active jihad websites, chat rooms, and forums (Weimann 2006a; Kimmage 2008). As the resources necessary for producing multimedia technologies continue to fall, and access to inexpensive digital cameras and computers increases, the threshold and number of video and other multimedia products in circulation has grown expo- nentially, while the age of the producers has declined. During the early months of the second Intifada, for example, several of the more compelling PowerPoint slides circulating on the Internet depicting the brutality of the Israeli reoccupa- tion of the West bank were produced by a 14-year-old living in a refugee camp in Lebanon.

22 Risking Security

D ow

nloaded from https://academ

ic.oup.com /ips/article-abstract/4/1/15/1917052 by D

eP aul U

niversity user on 06 M arch 2019

In addition to changing the nature of the conflicts, cyberspace has also served to change the nature of the movements themselves. They have elimi- nated the need for strict command and control, especially for smaller and more marginal movements who can now claim legitimacy for their actions by ‘‘virtually’’ piggy-backing on the perceived effectiveness and success of others. It also gives the impression of a unity and scale among groups that in reality, simply does not exist. As a result, much as the discourse of human rights and other universal issues provides an intellectual center that binds many civil networks together, the depictions, forums, and shared virtual spaces of resis- tance, wrapped in religious undertones, provide a means for smaller, more local struggles to identify with and benefit from a broader ideological pool that serves to demonstrate that resistance is not only possible, but positively effective (Kohlmann 2008).

Cyberspace is only one domain used by armed social movements in the pursuit of their cause, but it is certainly the one that, because of its largely unregulated character and relative freedom of access, causes the greatest concern for states under threat from such actors. It is seen, at least in part, as the sea in which global militants find sanctuary of the kind that Mao postulated in his classical treatise on people’s war. The difficulty, then as it is now, is how to effectively separate the insurgents from the people, or armed social movements from cyber- space, in a manner that does not destroy the latter. In this study again the unintended and paradoxical consequences or risk mitigation strategies becomes apparent.

Transnational criminal networks are a second form of dark nets. These actors, who can be large or small, local or transnational, exploit the relative anonymity offered by cyberspace as well as the absence of harmonized national laws defining cybercrime, to circumvent or avoid prosecution. Cyber- crime is typically broken down into two distinct realms: old crimes, such as fraud, child pornography, and theft (including digital ‘‘piracy’’), which have been adapted to the new possibilities offered by the emergence of the e-econ- omy (Brenner 2001); and new crimes that are unique to cyberspace, such as phishing attacks, spam, or the use of malware, cyber-espionage, and distrib- uted denial-of-service attacks (DDoS), which would not have emerged without it (Brenner 2005; Wall 2005). In both cases, jurisdictions with poorly function- ing or nonexistent laws are used to hide otherwise criminal activities out of the reach of authorities in jurisdictions where they are clearly criminalized (Wall 2007). What Michael Froomkin (1997) characterized as ‘‘regulatory arbi- trage’’ allows cybercriminals to exploit the lowest state denominators as safe harbors, electronically moving to lax jurisdictions when the net tightens or laws are progressively harmonized.

Globally, the incidence of cybercrime is reported to be increasing in both developed and developing economies. In Russia, for example, acknowledged as a source of some of the most imaginative forms of cybercrime, incidences reportedly grew by almost 300% between 2003 and 2006. Yet, accurate compar- ative statistics makes measuring global cybercrime difficult. For example, in the United States—an economy where the economic losses caused by cybercrime were cited by one Treasury Board official as exceeding $105 billion—only in 2006 did the Department of Justice belatedly begin the process of establishing a baseline for measuring cybercrime. In part, the absence of reliable statistics belies the difficulty faced by local police and justice institutions when faced with having to police activities that may not be defined or considered criminal in their jurisdiction (or against which they have few tools). Indeed, the very concept of jurisdiction itself is confused in cyberspace. Brenner and Koops (2004:3) elaborate:

23Ronald J. Deibert and Rafal Rohozinski

D ow

nloaded from https://academ

ic.oup.com /ips/article-abstract/4/1/15/1917052 by D

eP aul U

niversity user on 06 M arch 2019

Acts on the Internet that are legal in the state where they are initiated may be illegal in other states, even though the act is not particularly targeted at that single state. Jurisdiction conflicts abound, both negative (no state claims jurisdic- tion) and positive (several states claim jurisdiction at the same time). Above all, it is unclear just what constitutes jurisdiction: is it the place of the act, the coun- try of residence of the perpetrator, the location of the effect, or the nationality of the owner of the computer that is under attack? Or all of these at once?

Securing Risks Through Cyberspace

The state responses to risks through the network are much more diverse, com- petitive, and characterized by self-help policies than are risks to the network, where an emerging norm and growing international cooperation can be dis- cerned. Even in areas where one might anticipate international coopera- tion—control of child pornography, for example—the primary responses have been nationally based. In other areas, such as dealing with extremists, militants, and anti-regime resistance networks, perceptions of threats and national interests vary too widely for there to be any meaningful policy coordination and national controls predominate. Indeed, in certain cases, states support, illicitly or other- wise, the dark and resistance nets that pose challenges to other states as part of inter-state competition. Self-help policies also tend to predominate because the policy instruments deployed—filtering, surveillance, and information warfare attacks—tend to be highly secretive, lack transparency and accountability and fall within the realm of national security and military strategy. Significantly, some of the policies taken to secure risks through cyberspace are having the paradoxical outcome of undermining the very object of security in the risks to cyberspace domain.

The one risk through cyberspace where there is significant policy coordination is cybercrime, and in particular dealing with theft of intellectual property and fraud, although even here the coordination is limited mostly to industrialized countries. The most far-reaching is the Council of Europe’s Cybercrime Conven- tion, signed and ratified by 15 states, and signed but not yet ratified by a further 28 in Europe and elsewhere (Weber 2003). Among other things, the convention harmonizes policies around dealing with crimes in cyberspace, including those relating to data retention and information sharing for law enforcement and intelligence. Outside of the convention’s regime, however, national policies and, most importantly, state capacities differ widely, allowing criminal organizations to triage among jurisdictions and find safe harbor within corrupt and failed states or where legal enforcement of existing laws is lax. Criminal networks, therefore, are able to continue to multiply and expand into new regions and activities. Russian hackers are implicated with identity theft and credit card fraud in the United States and Europe. Nigerian gangs have become omnipresent in a variety of scams and wire fraud, whereas Chinese, Iranian, Malaysian, Thai, Peruvian and Israeli networks preside over a global distribution network of pirated DVDs and software (USTR 2008).

Filtering, Surveillance, and Information Attacks

Several self-help and competitive strategies are employed by states to deal with risks through cyberspace, introducing friction and disruption to cyberspace. The starkest example is Internet filtering. Once thought impossible in cyber- space, Internet content filtering is now a widespread global practice. Solid com- parative research around Internet filtering practices is generally lacking. A notable exception is the research of the OpenNet Initiative (ONI), which has

24 Risking Security

D ow

nloaded from https://academ

ic.oup.com /ips/article-abstract/4/1/15/1917052 by D

eP aul U

niversity user on 06 M arch 2019

documented the growth in scope, scale and sophistication of Internet filtering practices since 2002 (Deibert et al. 2008, 2010).6 Whereas in the early 2000s, there were only a handful of states blocking access to information, the latest research of the ONI has documented more than 40 countries. Filtering technolo- gies are installed at key Internet chokepoints, and work by preventing requests for URLs, IPs, or domain names of banned content from being carried through (Villeneuve 2006). Although methods vary widely, most states implement Inter- net filtering practices by imposing upon Internet service providers (ISPs) respon- sibility for blocking access to a pre-determined list of websites, IP addresses, and services, while others impose nationwide uniform controls at international gate- ways. Other filtering systems can be implemented at more local levels, such as Internet cafes. The countries that are described by the ONI as ‘‘pervasive’’ filter- ers of Internet content—China, Burma, Vietnam, Thailand, Iran, Syria, Saudi Arabia, UAE, Bahrain, Uzbekistan, Turkmenistan, Ethiopia—routinely block access to the websites, forums, and blogs of political opposition, human rights, independence, minority rights, alternative faiths, and cultural groups. Almost all of them do so without public accountability or transparency.

As the scope, scale, and sophistication of Internet censorship and surveillance has increased, so too has the market for the technologies employed for such ends. ONI research has empirically verified the use of a range of commercial technologies used in national filtering regimes around the world. For example, the ONI has documented the use of a product called Smartfilter, made by the US company Secure Computing Inc., in the filtering systems of Kuwait, Oman, Saudi Arabia, Tunisia, the United Arab Emirates, and Iran. The US-produced Netcache is often used in conjunction with filtering products like Smartfilter and is employed in Iran; the US product Websense was used in Iran, and is now used by Yemen; the US product Fortinet is employed in Burma; Cisco routers filter at the backbone level in China; and Singapore uses the US product Surfcontrol.

There are issues of accountability and transparency having to do with the pro- prietary nature of these commercial filtering technologies. Filtering software works by having lists of categorized websites and keywords that can be activated by customers, and which are updated typically through online connections to databases operated by the companies. The companies themselves treat the lists as intellectual property and normally do not disclose what sites are included and ⁄ or how they are categorized. Although some companies, like Secure Computing, allow tests of their filtering software online, none of the companies openly discloses the contents of their lists to public scrutiny. The lack of openness, although understandable from a commercial perspective, has signi- ficant public policy implications when commercial filtering software is used at a national level to filter access to information on public networks, as happens in numerous countries around the world today.

There are related questions around the involvement of search engines and other Internet service companies that collude with governments that violate

6The authors are two of four founders and principal investigators. The other two are John Palfrey and Jonathan Zittrain. The ONI’s methodology combines technical and contextual research. Two lists of websites are checked in each of the countries tested: a global list (constant for each country) and a local list (different for each country). The global list is composed of internationally relevant websites with provocative or objectionable content in English. The local lists are designed individually for each country to unearth unique filtering and blocking behavior. In countries where Internet censorship has been reported, the local lists also include those sites that were alleged to have been blocked. These lists, however, are not meant to be exhaustive. The actual tests are run from within each country using specially designed software. Where appropriate, the tests are run from different locations to capture the differences in blocking behavior across ISPs and across multiple days and weeks to control for normal connec- tivity problems. The completion of the initial accessibility testing is just the first step in our evaluation process. Additional diagnostic work is performed to separate normal connectivity errors from intentional tampering. There are a number of technical alternatives for filtering the Internet, some of which are relatively easy to discover. Others are difficult to detect and require extensive diagnostic work to confirm.

25Ronald J. Deibert and Rafal Rohozinski

D ow

nloaded from https://academ

ic.oup.com /ips/article-abstract/4/1/15/1917052 by D

eP aul U

niversity user on 06 M arch 2019

human rights. In order to gain a toehold in such jurisdictions, companies have been required to filter access to information on search engines, or comply with ‘‘local laws’’ that contain none of the safeguards around due process and privacy that are typically found in liberal democratic regimes (Maclay 2010). In one of the most egregious cases, the American Internet company Yahoo! turned over email records to the Chinese government leading to the arrest of three people, Jiang Lijun, Shi Tao, and Li Zhi. In testimony before the US Congress, Yahoo! said that they had no choice but to comply with the request, that ‘‘Yahoo! China was legally obligated to comply with the requirements of Chinese law enforce- ment… or face the possibility of ‘‘criminal charges, including imprisonment. Ultimately, US Companies in China face a choice: comply with Chinese law, or leave.’’7 These cases illustrate the ways in which the distribution of risk mitiga- tion strategies to private actors can create serious accountability gaps, and ulti- mately pervert the very service being delivered. Ironically, the best and brightest of Silicon Valley, once heralded by their own advertisements as ‘‘wiring the world’’ and ‘‘connecting individuals,’’ are here being asked to do precisely the opposite.

Internet filtering is a practice spreading not only among authoritarian and democratically challenged states, it is one that is becoming increasingly wide- spread among industrialized democratic states as well, in particular as a response to the dark nets of online child pornography. This issue is especially puzzling for the propensity of self-help in spite of widespread condemnation and available mechanisms for international coordination (Villeneuve 2010). Around the world, children are sexually abused with the images and videos of that abuse uploaded and circulated in cyberspace—a practice that is nearly universally illegal. Although international policy coordination mechanisms have been created through the Council of Europe, and through such voluntary arrangements as IN- HOPE, the primary tool states are using to deal with online child pornography is by nationally based filtering schemes, typically carried out by private ISPs and national police and civilian agencies. Countries that have implemented filtering technology solutions for access to child pornography include Australia (in progress), Norway (September 2004), Germany (February 2005), Sweden (May 2005), Denmark (October 2005), Canada (November 2006), Switzerland (January 2007), Italy (January 2007), the Netherlands (September 2007), and Finland (January 2008).

Blocking access to child pornography through filtering is not the only one available to deal with online child pornography. An alternative method is to locate the source of the information (where it is hosted), issue a take-down notice to the provider, and arrest and prosecute those who post or circulate the information, if possible.8 However, this alternative tactic is less often employed, and in fact has been actually decreasing ever since national filtering schemes have begun to spread. This has led to the rather curious situation in which coun- tries filter child pornography hosted in countries that are party to the Cybercri- me Convention or the INHOPE notification system, rather than sharing information about such images and requesting the offending information be removed. As Nart Villeneuve reports, ‘‘in one particularly awkward case, a Dutch blogger found that the Dutch National Police were adding domestically hosted child pornography sites to their blocklist rather than taking legal action against the owners’’ (Villeneuve 2010:70).

7Testimony of Michael Callahan, Senior Vice President and General Counsel, Yahoo! Inc., before the Subcom- mittees on Africa, Global Human Rights and International Operations, and Asia and the Pacific, February 15, 2006. Recently, several major Internet services companies have entered into a self-regulation pact called the Global Network Initiative (GNI). The effectiveness of such self-regulation is untested and still questionable.

8Interestingly, this is the very same strategy often employed with considerable effectiveness to deal with copy- right violations online.

26 Risking Security

D ow

nloaded from https://academ

ic.oup.com /ips/article-abstract/4/1/15/1917052 by D

eP aul U

niversity user on 06 M arch 2019

Why the reliance on self-help when it comes to child pornography? There appear to be several reasons. First, there is a growing legitimization of Internet filtering solutions, based on their growing use in national, private, and some public contexts, such as schools and libraries. In spite of the fact that these tech- nologies are widely prone to error, they provide a simple and easy panacea for a serious problem and can be delegated by governments to private actors and sold to uninformed public audiences as a viable solution. Credible opposition to such schemes is rare, given the hot-button nature of the topic and fear of guilt by association. Second, although there are mechanisms in place for international policy coordination and information sharing, as mentioned above many residual roadblocks stand in the way of law enforcement coordination across borders. Police tend to work in national jurisdictions, and seek convictions in their own territorial spaces, first and foremost. The incentives to facilitate take-down notices that result in convictions in other territorial jurisdictions are relatively low. The incentives drop even further for countries outside of the so-called Atlantic Alliance (Canada, United States, United Kingdom, New Zealand, and some European countries), where police cooperation is virtually non-existent.

The ONI’s research suggests filtering is a fast-moving and evolving trend, particularly among authoritarian and competitive authoritarian regimes. First generation filtering relies on passive means where lists of banned websites are loaded into routers such that requests to the servers hosting those websites were denied. These classic methods, used by countries such as China, Iran, and Saudi Arabia, are relatively unsophisticated and easy to defeat. Moreover, they are also difficult to hide. As ONI testing reveals, it is relatively easy to determine what content is being filtered, and by whom. As a result, countries engaging in first generation filtering have been quickly targeted by advocacy groups and labeled as ‘‘pariahs.’’ It is therefore hardly surprising that first generation methods are being supplanted by ‘‘second’’ and ‘‘third generation’’ strategies designed to be more stealthy, dynamic, and often ‘‘offensive’’ in nature (Deibert et al. 2010).

Evidence gathered by ONI points to several emerging trends that characterize these next-generation filtering strategies. First, this new generation of blocking is applied temporarily, to coincide with particular events when a certain type of information has greatest value (or potential for disruption). This is particularly true during elections or protests, when interest in media reporting and political communications is heightened, and where the consequences of an electoral loss or awareness of a mass gathering may have major repercussions. In several cases—the February 2005 election in Kyrgyzstan (which led to the toppling of President Askar Akayev in the ‘‘Tulip revolution’’), the 2006 presidential elections in Belarus, the 2007 demonstrations Burma (the so-called Saffron Revolution), and the 2008 protests in Tibet—ONI documented this type of ‘‘just-in-time’’ blocking against key opposition media and political sites. Second, the methods used in second generation blocking are different. In the Kyrgyzstan and Belarus cases, for example, filtering of access to sites and services was achieved through offensive means, by attacking web servers hosting information with DDoS attacks, which flooded the servers with requests rendering them unable to respond (as opposed to passive interception and blocking of requests for web sites and service). In the Kyrgyz case, these attacks were accompanied by an ultimatum to the ISP hosting the websites, demanding that they be removed. In the case of Belarus, DDoS attacks were accompanied by other tactics, such as intro- ducing deliberate errors in domain name servers (which are necessary for finding servers on the Internet), and thus temporarily shutting down all Internet access in Minsk. These second-generation techniques are not restricted to technologically sophisticated states. During 2007, Ethiopia, Uganda, and Cambodia shut down access to SMS services during politically sensitive times, presumably in recognition that these technologies offer a means for opposition movements to mobilize.

27Ronald J. Deibert and Rafal Rohozinski

D ow

nloaded from https://academ

ic.oup.com /ips/article-abstract/4/1/15/1917052 by D

eP aul U

niversity user on 06 M arch 2019

Next-generation control strategies, such as just-in-time blocking, can include an even more pernicious example of self-help policies to deal with risks through the network: covert or semi-covert support of dark and resistance net- works. China, Russia, Burma, Iran, Belarus (among others) have been accused of supporting criminal organization and third parties to denigrate resistance networks, although determining the exact involvement of the government in each case is difficult. For example, China’s adversaries—the US government, Tibetan groups, the Falun Gong, pro-democracy groups—have all experienced increasingly sophisticated information warfare attacks, including distributed denial-of-service (DDoS) attacks, the use of Trojan horses and viruses, cyber- espionage, and targeted malware. Using forensic investigative techniques, researchers have been able to trace back some of these attacks and espionage networks to control servers in mainland China, the most famous of which being the ‘‘GhostNet’’ system (Information Warfare Monitor 2009). However, determining whether the Chinese government itself is responsible for the attacks has not been possible given the ease by which such attacks can be launched through anonymous means or launched by private actors for com- mercial or illicit gain. It is instructive to note in this respect that part of China’s explicit information warfare strategy is to enlist the ‘‘people’s’’ support, and there is a very vibrant nationalist-patriotic hacker community in China that erupts in defense of the Chinese regime whenever domestic political incidents arise. Likewise, several recent conflicts involving adversaries of Russia have experienced massive DoS attacks, including Estonia and Georgia. However, researchers have not been able to conclusively determine whether the Russian government is the source of the attacks, whether the attacks were contracted out to criminal organizations, or whether they originate from patriotic hackers, or some combination. We might infer that such outsourcing to private actors may in fact become more common because of the attractions of plausible deni- ability it affords to the regimes involved.

The risks posed by both dark and resistance networks have contributed to a massive expansion of electronic surveillance among all countries, a significant portion of it carried out through extra-legal means and ⁄ or downloaded to private companies. The attacks of 9/11 were a definite watershed in this regard. Following upon revelations that the hijackers employed cyberspace as an organi- zational domain to carry out the attacks, there was widespread support for more enhanced monitoring powers for law enforcement and intelligence. The United States quickly adopted wide-ranging legislation, in the form of the PATRIOT Act, which expanded the scope for electronic surveillance. Numerous countries around the world then passed legislation similar to the United States PATRIOT Act, requiring lawful access provisions for law enforcement to be undertaken by private ISPs.

Some non-democratic countries have used the excuse of the war on terror and followed the normative lead of the United States to legitimize their surveillance of opposition and minority. In several countries, notably Egypt, a combination of surveillance and selective prosecution is used to effectively curtail bloggers, and specific minority groups (especially the gay and lesbian community). In 2008, Russia expanded the powers previously established by SORM-II, which obliged ISPs to purchase and install equipment that would permit local FSB offices to monitor the Internet activity of specific users. The new legislation makes it possi- ble to monitor all Internet traffic and personal usage without specific warrants. The legislation effectively brings into the open covert powers that were previ- ously assigned to FAPSI, with the twist of transferring to the entire ISPs the costs. In many countries, Internet cafes are monitored by secret police both physically and through remote surveillance technologies. The measures present a clear warning to anyone seeking the anonymity of cyberspace to voice political

28 Risking Security

D ow

nloaded from https://academ

ic.oup.com /ips/article-abstract/4/1/15/1917052 by D

eP aul U

niversity user on 06 M arch 2019

criticism or express alternative lifestyles: you can be found, and you can be prosecuted.

Since much of cyberspace flows through private networks, state surveillance measures target and often force the cooperation of businesses, especially those operating in national jurisdictions. For example, in the United States a whistle- blower revealed that the Bush administration had authorized extra-legal wiretaps on the US-based Internet exchange points of Tier 1 ISPs, including AT&T and Verizon, in order to monitor traffic passing through those hubs. Another exam- ple is a recent report that uncovered a major surveillance system on the Chinese version of the popular Internet telephone software, Skype (Villeneuve 2009). The full-text chat messages of TOM-Skype users, along with Skype users who communicated with TOM-Skype users, were regularly scanned for sensitive keywords, and if present, the resulting data were uploaded and stored on servers in China, ostensibly to be passed to Chinese security services. The captured messages contained specific keywords relating to sensitive political topics such as Taiwan independence, the Falun Gong, and political opposition to the Communist Party of China. This one case was revealed because of a combination of dogged detective work and sloppy information security on the part of TOM-Skype; presumably, though, many other targeted surveillance attacks on Internet services exist through covert channels.

Although far from exhaustive, the previous section highlights some of the ways in which states are attempting to secure against risks through cyberspace. Of par- ticular note is the extent to which self-help policies predominate, transparency and accountability are rare, risk mitigation includes outsourcing to third parties and illicit networks, and competition is often fierce. In attempting to neutralize risks through cyberspace, states are turning to filtering, blocking, surveillance, and information warfare tactics. These tendencies point to an increasingly com- petitive cyberspace commons where states, individuals, civil society and dark and resistance nets jostle for agency and advantage, often at the expense of cyber- space itself.

The Paradoxes of Risking Security

Securing cyberspace has become one of the major global policy areas of the 21st century. Although a growing literature has emerged about cyberspace security, very little of it covers the full range of risks and responses or the implications of the politics surrounding it. In this paper, we have untangled and analyzed two different risks associated with cyberspace security: risks to cyberspace, and risks through cyberspace. Although often confused, the two are distinct, not least of which in terms of levels of international cooperation and state policies, but even more so in terms of the way they can work at cross-purposes.

In the former area, risks to cyberspace, a growing international norm has emerged that sees cyberspace as vital to economics, government, society, and cul- ture. Policies have focused on securing systems that support a friction-free global communications environment in which commerce can flourish, data can be exchanged without corruption, and infrastructures can operate without signifi- cant downtime or disruption. The norm may in fact be leading to some of the most significant (though rarely acknowledged by Internet governance experts) institutions of international Internet governance through a wide variety of regio- nal and international regimes and sub-state communities of practice. At the same time, there are clearly some gaps in areas of international notification, including in those involving child pornography and cyber-espionage.

Risks through the network involve much wider divergence among states, an emphasis on national policies and self-help, and most significantly policies whose outcome are having the opposite effect of those associated with risks to

29Ronald J. Deibert and Rafal Rohozinski

D ow

nloaded from https://academ

ic.oup.com /ips/article-abstract/4/1/15/1917052 by D

eP aul U

niversity user on 06 M arch 2019

cyberspace. Ironically, in other words, security policies in response to risks through cyberspace are creating insecurities around cyberspace itself. The responses to the two ‘‘risks’’ operate at cross-purposes. The aim of ‘‘risks to’’ is to secure a friction-free, distributed and resilient global communications net- work. The aim of ‘‘risks through,’’ on the other hand, is to introduce friction and disruption through filtering, surveillance, and computer network attacks. Whether and how these two risk domains will co-exist into the future, and what implications will follow for international security, are areas worthy of further investigation.

Securing cyberspace has definitely entailed a ‘‘return of the state’’ but not in ways that suggest a return to the traditional Westphalian paradigm of state sover- eignty. First, efforts aimed at combating risks to the network are supporting a worldwide, interconnected domain of communications that, in turn, is facilitat- ing a rapid expansion of transnational non-state actor activities. Second, many of the policies described above entail devolution of responsibilities and authority to private actors. This includes the imposition of surveillance, mining, and data retention responsibilities to ISPs and other cyberspace service companies (search engines, cellular phone operators) in both democratic and nondemocratic envi- ronments. Privatization of a different sort is also implicated in the outsourcing of computer network attacks to illicit networks and criminal organizations. Privatization of security has become an area of active investigation among some theorists lately; this analysis suggests privatization of intelligence and computer network attacks should be added to that area. Lastly, the efforts taken to combat cybercrime, to harmonize laws across state jurisdictions, and to facilitate interna- tional policing and intelligence can be seen as an internationalization of the state, albeit among a core group of industrialized states.

Together these trends suggest that the paradoxes of securing cyberspace will ensure the continuation of a complex and multifaceted domain, one that defies simple and extreme characterizations. Cyberspace will continue to be tugged in heteropolar directions: from the ingenuity of end users who develop technolo- gies that have system-wide effects; from states who intervene to try to shape, limit and disable adversarial sources of information; from major commercial providers centralizing information and communication in ‘‘cloud’’ computing systems; to anonymous tunneled networks hardened by advanced encryption technologies. This domain, like others before it, is an object of geopolitical contestation that at once shapes and constrains the nature of that contestation. Unlike sea, land, air and space, though, it is a domain entirely created, sustained and ultimately transformed by ongoing human interaction and competition.

References

Adler, Emmanuel. (2005) Communitarian International Relations: The Epistemic Foundations of Interna- tional Relations. London: Routledge.

Beck, Ulrich. (1992) Risk Society: Towards a New Modernity, translated by Mark Ritter. London: Sage. Brenner, Susan W. (2001) Is There Such a Thing as Virtual Crime? California Criminal Law Review

4(1): 105–111. Brenner, Susan W. (2005) Distributed Security: Moving Away from Reactive Law Enforcement. Inter-

national Journal of Communications Law & Policy 9: 1–43. Brenner, Susan W., and Bert-Jaap Koops. (2004) Approaches to Cybercrime Jurisdiction. Journal of

High Technology Law 4(1): 3–44. Bronk, Christopher. (2008) Webtapping: Securing the Internet to Save Us from Transnational

Terror? First Monday 13(11). Buzan, Barry, Ole Waever, and Jaap de Wilde. (1998) Security: A New Framework of Analysis.

Boulder, CO: Lynne Rienner.

30 Risking Security

D ow

nloaded from https://academ

ic.oup.com /ips/article-abstract/4/1/15/1917052 by D

eP aul U

niversity user on 06 M arch 2019

Deibert, Ronald J. (2002) Circuits of Power: Security in the Internet Environment. In Information Technologies and Global Politics: The Changing Scope of Power and Governance, edited by James N. Rosenau and J. P. Singh. Albany: State University of New York.

Deibert, Ronald J., and Rafal Rohozinski. (2008) Good for Liberty, Bad for Security? Global Civil Society and the Securitization of the Internet. In Access Denied: The Practice and Policy of Global Internet Filtering, edited by Ronald J. Deibert, John Palfrey, Rafal Rohozinski and Jonathan Zittrain. Cambridge, MA: MIT Press.

Deibert, Ronald J., John Palfrey, Rafal Rohozinski, and Jonathan Zittrain, Eds. (2008) Access Denied: The Practice and Policy of Global Internet Filtering. Cambridge, MA: MIT Press.

Deibert, Ronald J., John Palfrey, Rafal Rohozinski, and Jonathan Zittrain, Eds. (2010) Access Controlled: The Shaping of Power, Rights, and Rule in Cyberspace. Cambridge, MA: MIT Press.

Denning, Dorothy E. (2000) Activism, Hacktivism, and Cyberterrorism: The Internet as a Tool for Influencing Foreign Policy. Computer Security Journal 16(3): 15–35.

Der Derian, James. (2003) The Question of Information Technology in International Relations. Millennium: Journal of International Studies 32(3): 441–456.

Dunn Cavelty, Myriam. (2008) Cyber-Security and Threat Politics: US Efforts to Secure the Information Age. London: Routledge.

Dutton, William H., and Malcom Peltu. (2007) The Emerging Internet Governance Mosaic: Connecting the Pieces. Information Polity 12(1–2): 63–81.

Froomkin, Michael. (1997) The Internet as a Source of Regulatory Arbitrage. In Borders in Cyberspace, edited by Brian Kahin and Charles Nesson. Cambridge, MA: MIT Press.

Gibson, William. (1984) Neuromancer. New York: Ace Books. Giddens, Anthony. (1990) The Consequences of Modernity. Stanford, CA: Stanford University Press. Goldsmith, Jack L., and Tim Wu. (2006) Who Controls the Internet? Illusions of a Borderless World.

Oxford: Oxford University Press. Hosein, Ian. (2008) Creating Conventions: Technology Policy and International Cooperation

in Criminal Matters. In Governing Global Electronic Networks, edited by William J. Drake and Ernest J. Wilson III. Cambridge, MA: MIT Press.

Information Warfare Monitor. (2009) Tracking Ghostnet: Investigating a Cyber Espionage Net- work. Available at http://www.scribd.com/doc/13731776/Tracking-GhostNet-Investigating-a- Cyber-Espionage-Network. (Accessed October 29, 2009)

International Telecommunications Union (ITU). (2008) ITU Global Cybersecurity Agenda (CGA) High-Level Experts Group (HLEG) Global Strategic Report. International Telecommuni- cations Union. Available at http://www.itu.int/cybersecurity/gca (Accessed: January 3, 2010).

Kaldor, Mary. (1999) New and Old Wars: Organised Violence in a Global Era. Cambridge, MA: Polity Press.

Kelsey, Jeffrey T.G. (2008) Hacking into International Humanitarian Law: The Principles of Dis- tinction and Neutrality in the Age of Cyber Warfare. Michigan Law Review 106(7): 1428–1450.

Kimmage, Daniel. (2008) The Al-Qaeda Media Nexus. Washington, DC: Radio Free Europe. Available at http://docs.rferl.org/en-US/AQ_Media_Nexus.pdf. (Accessed October 28, 2009)

Kleinrock, Leonard. (2008) History of the Internet and Its Flexible Future. IEE Wireless Communica- tions 15(1): 8–18.

Kohlmann, Evan F. (2008) Homegrown Terrorists: Theory and Cases in the War on Terror’s Newest Front. The Annals of the American Academy of Political and Social Science 618(1): 95–109.

Lewis, James. (2008) Securing Cyberspace for the 44th Presidency: A Report of the CSIS Commission on Cyber- security for the 44th Presidency. Washington, DC: Center for Strategic and International Studies.

Maclay, Colin. (2010) Protecting Privacy and Expression Online: Can the Global Network Initiative Embrace the Character of the Net? In Access Controlled: The Shaping of Power, Rights, and Rule in Cyberspace, edited by Ronald. J. Deibert, John G. Palfrey, Rafal Rohozinski, and Jonathan Zittrain. Cambridge, MA: MIT Press.

McCullagh, Declan. (2008) U.N. Agency Eyes Curbs on Internet Anonymity. CNET. Available at http://news.cnet.com/8301-13578_3-10040152-38.html. (Accessed October 28, 2009).

Mueller, Milton L. (2002) Ruling the Root: Internet Governance and the Taming of Cyberspace. Cambridge, MA: MIT Press.

Naughton, John. (2001) Contested Space: The Internet and Global Civil Society. In Global Civil Society, edited by Helmut Anheier, Marlies Glasius, and Mary Kaldor. London: Sage.

Office of the United States Trade Representative. (2008) 2008 Special 301 Report. Available at http://www.ustr.gov/assets/Document_Library/Reports_publications/2008/2008_Special_ 301_Report/asset_upload_file553_14869.pdf. (Accessed October 28, 2009).

31Ronald J. Deibert and Rafal Rohozinski

D ow

nloaded from https://academ

ic.oup.com /ips/article-abstract/4/1/15/1917052 by D

eP aul U

niversity user on 06 M arch 2019

Pahlavi, Pierre. (2007) The 33 Day War: An Example of Psychological Warfare in the Information Age. Canadian Army Journal 10(1): 12–24.

Rohozinski, Rafal. (2004) Bullets to Bytes: Reflections on ICTs and Local Conflict. In Bombs and Bandwidth: The Emerging Relationship Between Information Technology and Security, edited by Robert Latham. New York: Free Press.

Saltzer, Jerome H., David P. Reed, and David D. Clark. (1984) End-to-End Arguments in System Design. Transactions on Computer Systems 2(4): 277–288.

Stritzel, Holger. (2007) Toward a Theory of Securitization: Copenhagen and Beyond. European Journal of International Studies 13(3): 357–383.

United States Department of Defense. (2006) The National Military Strategy for Cyberspace Operations. Available at http://www.dod.mil/pubs/foi/ojcs/07-F-2105doc1.pdf. (Accessed October 28, 2009)

Villeneuve, Nart. (2006) The Filtering Matrix: Integrated Mechanisms of Information Control and the Demarcation of Borders in Cyberspace. First Monday 11(1–2) Available at http://firstmonday. org/htbin/cgiwrap/bin/ojs/index.php/fm/article/view/1307/122. (Accessed October 28, 2009)

Villeneuve, Nart. (2009) Breaching Trust: An Analysis of Surveillance and Security Practices on China’s TOM-Skype Platform. Information Warfare Monitor ⁄ ONI-Asia. Available at http:// www.nartv.org/mirror/breachingtrust.pdf. (Accessed October 28, 2009)

Villeneuve, Nart. (2010) Barriers to Cooperation: An Analysis of the Origins of International Efforts to Protect Children Online. In Access Controlled: The Shaping of Power, Rights, and Rule in Cyberspace, edited by Ronald J. Deibert, John Palfrey, Rafal Rohozinski and Jonathan Zittrain. Cambridge, MA: MIT Press.

Wall, David S. (2005) Digital Realism and the Governance of Spam as Cybercrime. European Journal on Criminal Policy and Research 10(4): 309–335.

Wall, David S. (2007) Policing Cybercrimes: Situating the Public Police in Networks of Security within Cyberspace. Police Practice & Research 8(2): 183–205.

Way, Lucan, and Steven Levitzsky. (2002) The Rise of Competitive Authoritarianism. Journal of Democracy 13(2): 51–65.

Weber, Amalie M. (2003) The Council of Europe’s Convention on Cybercrime. Berkeley Technology Law Journal 18(1): 425–446.

Wehrey, Fredrick M. (2002) A Clash of Wills: Hizballah’s Psychological Campaign Against Israel in South Lebanon. Small Wars and Insurgencies 12(3): 53–74.

Weimann, Gabriel. (2006a) Virtual Disputes: The Use of the Internet for Terrorist Debates. Studies in Conflict and Terrorism 29(7): 623–639.

Weimann, Gabriel. (2006b) Terror on the Internet: The New Arena, The New Challenges. Washington, DC: The United States Institute of Peace.

Zittrain, Jonathan. (2007) The Future of the Internet and How to Stop It. New Haven, CT: Yale Univer- sity Press.

32 Risking Security

D ow

nloaded from https://academ

ic.oup.com /ips/article-abstract/4/1/15/1917052 by D

eP aul U

niversity user on 06 M arch 2019