<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div>Diego - </div><div><br></div><div> A very insightful article... It is important to note the wide range of activities</div><div> that might been categorized as "cyber crime", and hence the corresponding </div><div> wide range of potential views on improving the potential for enforcement </div><div> against non-state actors - for example, online theft of intellectual property</div><div> (e.g movies, music), brand infringement, certain types of hate speech, </div><div> political speech inciting unrest, and sharing of misappropriated documents</div><div> could all be deemed "cyber crimes" by one government, but might not</div><div> necessarily align with the expectations of others, or the expectations of </div><div> various segments of the Internet community regarding what constitutes </div><div> a "cyber crime"...</div><div><br></div><div> One of the most difficult challenges we collectively face is how to establish </div><div> a framework which allows for improvement in the safety and security of the </div><div> Internet, without incidentally impacting the flexibility to differing norms and </div><div> beliefs inherent in the system today.</div><div><br></div><div>FYI,</div><div>/John</div><div><br></div><div>Disclaimer: My views alone. No intention to commit a "cyber-crime" through </div><div> publication of this email, although reality may vary by jurisdiction. </div><div><br></div><div><br></div><div><div>On Sep 9, 2013, at 10:44 PM, Diego Rafael Canabarro <<a href="mailto:diegocanabarro@gmail.com">diegocanabarro@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div dir="ltr"><h1 style="font-weight: 400; font-size: 42px; font-family: Georgia, 'Times New Roman', Times, serif; line-height: 42px; margin-top: 0px; ">The Mouse Click that Roared</h1><p style="margin:10px 0px">
<font face="Georgia, Times New Roman, Times, serif" size="3"><span style="line-height:24px"><a href="http://www.project-syndicate.org/print/addressing-the-cyber-security-challenge-by-joseph-s--nye">http://www.project-syndicate.org/print/addressing-the-cyber-security-challenge-by-joseph-s--nye</a></span></font><br>
</p><p style="margin: 10px 0px; font-family: Georgia, 'Times New Roman', Times, serif; font-size: 16px; line-height: 24px; ">09 September 2013</p><p style="margin: 10px 0px; font-family: Georgia, 'Times New Roman', Times, serif; font-size: 16px; line-height: 24px; ">
CAMBRIDGE – Until recently, cyber security has primarily interested computer geeks and cloak-and-dagger types. The Internet’s creators, part of a small, enclosed community, were very comfortable with an open system in which security was not a primary concern. But, with some three billion or so users on the Web nowadays, that very openness has become a serious vulnerability; indeed, it is endangering the vast economic opportunities that the Internet has opened for the world.</p><p style="margin: 10px 0px; font-family: Georgia, 'Times New Roman', Times, serif; font-size: 16px; line-height: 24px; ">A “cyber attack” can take any number of forms, including simple probes, defacement of Web sites, denial-of-service attacks, espionage, and destruction of data. And the term “cyber war,” though best defined as any hostile action in cyberspace that amplifies or is equivalent to major physical violence, remains equally protean, reflecting definitions of “war” that range from armed conflict to any concerted effort to solve a problem (for example, “war on poverty”).</p><p style="margin: 10px 0px; font-family: Georgia, 'Times New Roman', Times, serif; font-size: 16px; line-height: 24px; ">Cyber war and cyber espionage are largely associated with states, while cyber crime and cyber terrorism are mostly associated with non-state actors. The highest costs currently stem from espionage and crime; but, over the next decade or so, cyber war and cyber terrorism may become greater threats than they are today. Moreover, as alliances and tactics evolve, the categories may increasingly overlap. Terrorists might buy malware from criminals, and governments might find it useful to hide behind both.</p><p style="margin: 10px 0px; font-family: Georgia, 'Times New Roman', Times, serif; font-size: 16px; line-height: 24px; ">Some people argue that deterrence does not work in cyberspace, owing to the difficulties of attribution. But that is facile: inadequate attribution affects inter-state deterrence as well, yet it still operates. Even when the source of an attack can be successfully disguised under a “false flag,” governments may find themselves sufficiently enmeshed in symmetrically interdependent relationships such that a major attack would be counterproductive. China, for example, would lose from an attack that severely damaged the American economy, and <em>vice versa</em>.</p><p style="margin: 10px 0px; font-family: Georgia, 'Times New Roman', Times, serif; font-size: 16px; line-height: 24px; ">An unknown attacker may also be deterred by cyber-security measures. If firewalls are strong, or redundancy and resilience allow quick recovery, or the prospect of a self-enforcing response (“an electric fence”) seems possible, an attack becomes less attractive.</p><p style="margin: 10px 0px; font-family: Georgia, 'Times New Roman', Times, serif; font-size: 16px; line-height: 24px; ">While accurate attribution of the ultimate source of a cyber attack is sometimes difficult, the determination does not have to be airtight. To the extent that false flags are imperfect and rumors of the source of an attack are widely deemed credible (though not legally probative), reputational damage to an attacker’s soft power may contribute to deterrence.</p><p style="margin: 10px 0px; font-family: Georgia, 'Times New Roman', Times, serif; font-size: 16px; line-height: 24px; ">Finally, a reputation for offensive capability and a declared policy that keeps open the means of retaliation can help to reinforce deterrence. Of course, non-state actors are harder to deter, so improved defenses such as pre-emption and human intelligence become important in such cases. But, among states, even nuclear deterrence was more complex than it first looked, and that is doubly true of deterrence in the cyber domain.</p><p style="margin: 10px 0px; font-family: Georgia, 'Times New Roman', Times, serif; font-size: 16px; line-height: 24px; ">Given its global nature, the Internet requires a degree of international cooperation to be able to function. Some people call for the cyber equivalent of formal arms-control treaties. But differences in cultural norms and the difficulty of verification would make such treaties hard to negotiate or implement. At the same time, it is important to pursue international efforts to develop rules of the road that can limit conflict. The most promising areas for international cooperation today most likely concern problems posed for states by third parties such as criminals and terrorists.</p><p style="margin: 10px 0px; font-family: Georgia, 'Times New Roman', Times, serif; font-size: 16px; line-height: 24px; ">Russia and China have sought to establish a treaty establishing broad international oversight of the Internet and “information security,” which would prohibit deception and embedding malicious code or circuitry that could be activated in the event of war. But the US has argued that arms-control measures banning offensive capabilities could weaken defenses against attacks and would be impossible to verify or enforce.</p><p style="margin: 10px 0px; font-family: Georgia, 'Times New Roman', Times, serif; font-size: 16px; line-height: 24px; ">Likewise, in terms of political values, the US has resisted agreements that could legitimize authoritarian governments’ censorship of the Internet – for example, by the “great firewall of China.” Moreover, cultural differences impede any broad agreements on regulating online content.</p><p style="margin: 10px 0px; font-family: Georgia, 'Times New Roman', Times, serif; font-size: 16px; line-height: 24px; ">Nonetheless, it may be possible to identify behaviors like cyber crime that are illegal in many domestic jurisdictions. Trying to limit all intrusions would be impossible, but one could start with cyber crime and cyber terrorism involving non-state parties. Here, major states would have an interest in limiting damage by agreeing to cooperate on forensics and controls.</p><p style="margin: 10px 0px; font-family: Georgia, 'Times New Roman', Times, serif; font-size: 16px; line-height: 24px; ">The transnational cyber domain poses new questions about the meaning of national security. Some of the most important responses must be national and unilateral, focused on hygiene, redundancy, and resilience. It is likely, however, that major governments will soon discover that the insecurity created by non-state cyber actors will require closer cooperation among governments.</p>
<div><br></div>-- <br>Diego R. Canabarro<div><font face="arial, helvetica, sans-serif"><span style="vertical-align:top;text-align:left"><a href="http://lattes.cnpq.br/4980585945314597" target="_blank">http://lattes.cnpq.br/4980585945314597</a></span> </font><br>
<br>--<br>diego.canabarro [at] <a href="http://ufrgs.br/" target="_blank">ufrgs.br</a></div><div>diego [at] <a href="http://pubpol.umass.edu/" target="_blank">pubpol.umass.edu</a><br>MSN: diegocanabarro [at] <a href="http://gmail.com/" target="_blank">gmail.com</a><br>
Skype: diegocanabarro<br>Cell # +55-51-9244-3425 (Brasil) / +1-413-362-0133 (USA)<br>--<br></div>
</div>
____________________________________________________________<br>You received this message as a subscriber on the list:<br> <a href="mailto:governance@lists.igcaucus.org">governance@lists.igcaucus.org</a><br>To be removed from the list, visit:<br> <a href="http://www.igcaucus.org/unsubscribing">http://www.igcaucus.org/unsubscribing</a><br><br>For all other list information and functions, see:<br> <a href="http://lists.igcaucus.org/info/governance">http://lists.igcaucus.org/info/governance</a><br>To edit your profile and to find the IGC's charter, see:<br> <a href="http://www.igcaucus.org/">http://www.igcaucus.org/</a><br><br>Translate this email: <a href="http://translate.google.com/translate_t">http://translate.google.com/translate_t</a><br></blockquote></div><br></body></html>