Promising directions of development and intensification of international cooperation in the field of international cyber security

Yanikeeva Inna Olegovna ORCID: 0000-0001-9590-5301 PhD student, Department of World Political Processes, Moscow State Institute of International Relations 142302, Moscow region, Chekhov-2 yanikeeva93@mail.ru Other publications by this author

Given the lack of trust between states and the desire of a number of countries to use their technological advantages to dominate the digital environment, it seems that in the near future it will be difficult to find a solution to the issue of adopting a binding cyber agreement on a wide range of issues of international information security (IIB). However, examples of agreements adopted in the XX century demonstrate the existence of the possibility, the potential to conclude treaties regulating the use of a particular type of weapon despite the many objections raised.

The study used the case study method to identify agreements suitable for the development of cyber agreements on such parameters, in particular, as the conclusion of an agreement, despite the existence of the problem of attribution and the high rate of technological change (the Convention on the Prohibition of the Development, Production, Stockpiling and Use of Chemical Weapons and on Their Destruction and the Convention on the prohibition of the development, production and stockpiling of bacteriological (biological) and toxin weapons and their destruction) and the conclusion of an agreement contrary to the claims that it is too early to sign an international treaty regulating actions in a particular environment until new technologies have been used for a sufficient amount of time (the Treaty on the Principles of the Activities of States in the Exploration and Use of Outer Space, including the Moon and other celestial bodies from 1967) ^[16]. From the standpoint of this method, the listed agreements represent "extreme cases", since they regulate the use of securitized technologies, and securitization is always an "extreme case" (cyber technologies are beginning to be such).

Experts note that analogies and mechanisms from the field of arms control are not quite suitable in the digital environment, because, for example, it is unclear how to verify vulnerabilities, since after their disclosure, developers will close the security gap, how to attribute the source of a cyberattack, what confidence-building measures can be, what can be a deterrent, how deter non-state actors, how to integrate new technologies, in particular artificial intelligence, into international agreements ^[7].

Confidence-building measures

One of the options for international cooperation in the field of conflict management is the development of confidence-building measures. Thus, when arms control is difficult to achieve between parties that have a large number of disagreements and there is a lack of trust, but both sides recognize the possibility of an unintended conflict, decision makers use confidence-building measures instead of creating an arms control system. However, this does not mean that the arms control system and confidence-building measures are mutually exclusive. In many cases, States conclude formal institutional arms control agreements together with informal voluntary confidence-building measures ^[8].

Confidence-building measures are aimed at demonstrating intentions among rivals, therefore, ideally, they demonstrate a desire to maintain the status quo and strengthen the sense of security between states. Since confidence-building measures are intended to indicate the purpose of military action, they do not change the overall balance of power between the adversaries. They are designed to preserve strategic stability in the context of potentially intense competition between States in the field of security.

First of all, confidence-building measures demonstrate a non-aggressive position by increasing the transparency of military operations. This can happen, for example, by inviting observers or the public to monitor a situation that could otherwise be interpreted as posing a threat to the IIB. Secondly, confidence-building measures impose restrictions on security actions, such as military exercises. Thirdly, they often act during a crisis, providing vital communication between opponents. In other words, confidence-building measures contribute to stability and detente by helping to express the intentions behind the unilateral policy and actions of the State in the field of security. Finally, confidence-building measures give predictability to the actions of a potential adversary and have an early warning function. Thus, confidence-building measures make it easier for another State to detect deviations from the established norm of behavior and, thus, allow it to take measures in advance to mitigate the damage from a surprise attack. Although confidence-building measures do not replace the role of national technical means of intelligence in assessing the capabilities and intentions of another state, they complement them by giving more complete information about the actions of the opposite side ^[19].

States have already taken steps to develop confidence-building measures in cyberspace through multilateral (NATO, SCO) and bilateral agreements (the agreement between the United States and China) in order to create mechanisms for the exchange of information about the alleged use of cyberspace by intruders, as well as for the exchange of information in a crisis. Although it is impossible to completely eliminate the incentives to distort or disguise aggressive actions in cyberspace, confidence-building measures by promoting dialogue between States are the first step towards mitigating destabilizing effects in the digital environment.

Instead of banning certain opportunities or concluding a binding agreement, States currently use mostly informal, voluntary measures to combat the fundamental factors of instability between rivals in the digital environment. Thus, it is possible to coordinate confidence-building measures in cyberspace, since the goal is to exchange information that helps States avoid conflicts, and not to actually change the military balance of power.

According to a number of experts, the mutually recognized risk of escalation and unintended conflict in the digital environment and confidence-building measures can be useful even if multilateral efforts involving the same countries, such as Russia and the United States, fail ^[10].

Cyber weapons control system

At the initial stage, confidence-building measures in cyberspace are more suitable for use in the digital environment than a system of control over cyber weapons. However, due to the fact that confidence-building measures do not reduce distrust of the enemy and do not limit its capabilities, over time they give way to more formalized agreements on the control of cyber weapons. Thus, mutual fear of miscalculation and escalation forced the USSR and the USA to form a system of nuclear arms control. It seems that control over cyber weapons can change the incentives for the use of offensive military cyber technologies, limit the damage in the case of the use of these technologies and contribute to ensuring the stability of interstate relations even between adversaries, in particular Russia and the United States.

Due to the large number of players who have access to modern means of cyber-action, an analogy from the middle of the XX century, when several dozen countries became interested in acquiring nuclear weapons, is also appropriate in the field of IIB. However, if nuclear weapons require specialized infrastructure and a large number of people employed in production, then the availability of knowledge and means in the field of security in the digital environment, as some experts note, is more like a crossbow, with similar prospects for their restriction and prohibition ^[7].

At the same time, it is important to note that despite significant obstacles to the creation of effective control over cyber weapons, the experience of creating control systems over other types of weapons indicates that any obstacle can be overcome.

History demonstrates that official binding treaties better control the arms race, reducing the level of tension and increasing transparency of actions. The invention of new types of weapons and military technologies has led the international community to undertake efforts to control and restrict their use. For example, the Conventions on the Prohibition of the Use of Anti-personnel landmines of 1997 and cluster munitions of 2010 were adopted.

In the case of cyber weapons, the difficulty lies primarily in identifying the person responsible for the attack (attribution of cyber attacks) ^[4]. According to the theory of rationalistic cooperation, the standard response to uncertainty about behavior is the creation of detailed and binding agreements that establish clear norms of prohibition and authorize the introduction of restrictive measures against violators of norms. A mechanism for joint attribution of cyber attacks, controlled by an international body, would significantly improve the ability of States to solve problems of monitoring and enforcement in the digital environment. Although the attribution problem has been described by a number of experts as a serious stumbling block not only for effective deterrence, but also for any form of international agreement regulating cyber conflict, nevertheless, with sufficient time and resources, accurate attribution of cyber attacks is technically possible in many cases, especially when it comes to large cyber attacks on critical infrastructure, where the list of possible criminals is limited and where there are incentives to invest the necessary time and money in attributing cyber attacks ^{[2, 28]}. Also, attribution issues are not unique. For example, most precursors of chemical and bacteriological weapons have a number of domestic and industrial applications, and the problems of dual use, as well as the inability to distinguish offensive R&D programs from defensive ones, have long accompanied both the Convention on the Prohibition of the Development, Production, Accumulation and Use of Chemical Weapons and on Their Destruction, and the Convention on the Prohibition of the Development, Production and accumulation of stocks of bacteriological (biological) and toxin weapons and their destruction. However, these problems are mostly successfully solved through detailed and strictly mandatory bans, strict internal compliance and reporting requirements, international monitoring systems and high fines for fraud. So far, these measures have prevented serious violations. There is no reason to assume that such a result cannot be achieved in a digital environment.

Secondly, it seems that offensive deterrence based on retaliatory measures is impractical in cyberspace. Threats of retaliation should be largely based on the ability and will of States to respond with non-cyber means. However, assuming that a response to a cyberattack using military force would be inappropriate and counterproductive in all but the most extreme cases, the deterrent effect of such threats is likely to be limited. This leaves such a path for achieving stable cyber deterrence as deterrence based on the promise of punishment by non-violent means, such as political and economic sanctions (cyber sanctions) ^{[27, 25]}. Such deterrence mechanisms can be included, in particular, in the Russian-American agreement, as well as in an international treaty regulating the behavior of states in the digital environment.

Thirdly, there are widespread concerns related to the speed of technological change, and therefore, any cyber-conspiracy will quickly become obsolete. This objection is also exaggerated, since almost all arms control systems face problems of unpredictable technological progress. Most international arms control agreements provide for periodic review conferences that allow the terms of the agreements to be updated. For example, the States parties to the Biological Weapons Convention have held more than seven review conferences since the Convention entered into force in 1975, most of which focus on strengthening verification and review of the Convention, taking into account new scientific and technological developments. No international agreement will be perfect, and any agreement reached in the digital environment will probably require subsequent revision to adapt to technological changes. However, given that the agreement will focus on banning certain actions, such as, for example, the first use of cyber weapons or the use of cyber weapons against civilian targets, rather than a complete ban on development or possession, the problem of adapting to technological changes may be less serious than critics claim. The Hague Conventions of 1899 and 1907, which prohibit the use of poisons and asphyxiating gases, protect the rights of civilians and the wounded during war, and the Geneva Conventions of 1949, which regulate the conduct of armed conflict, have largely stood the test of time, despite developments in the field of weapons technology.

Another objection is that it is too early to conclude an international treaty regulating cyber warfare. According to a number of experts, historically, treaties regulating new weapons technologies were often concluded only after the technologies had been used for some time ^[31]. Examples are Conventions prohibiting the use of anti-personnel landmines and cluster munitions. The reason, according to experts, is that States usually do not dare to limit the use of weapons that can give them an advantage on the battlefield until they have acquired sufficient experience to assess all the risks and advantages ^[31]. Thus, in their opinion, a binding cyber agreement can be concluded only after states become better acquainted with new cyber technologies ^[31]. Nevertheless, the essence of arms control agreements is not only to consolidate the current State practice. Historically, States have often been much more ambitious, as evidenced by the adoption of the Outer Space Treaty in 1967, which prohibits States from deploying weapons of mass destruction in outer space and represents a far-sighted deal between States aimed at preventing threats to humanity made possible by new technologies. A similar visionary agreement is required for the digital environment.

Another argument against cyber-agreement is aimed at its formal nature. International arms control agreements can take many forms. Some existing agreements are as specific and binding as possible, while others are "gentlemen's agreements" without centralized monitoring, verification or compliance with the provisions of the agreement. A number of experts insist on a soft approach based on consensus and best practices, which, in their opinion, has a better chance of success than attempts to conclude a formal agreement ^{[23, 24, 33]}.For some experts, the attractiveness of the approach based on "soft" law is due to the fact that cyber conflict is new, cyber technologies are developing too quickly for the possible conclusion of a binding international cyber agreement ^{[14, 26]}. Other scientists argue that the cybersphere is characterized by conflicts of interest and fragmented power, which makes a formal agreement unattainable ^{[14, 24, 32, 34]}. In their opinion, these conditions favor decentralized cooperation based on flexible, non-binding norms, rather than a formal centralized approach. ^{[14, 24, 32, 34]}. It seems that if we start with informal, voluntary rules, it will be easier to convince the resisting states, in particular the United States, to conclude a legally binding agreement afterwards, since over time, when interests become clearer, the rules may be tightened ^{[13, 14, 20]}.

Cyberweapons are widely available and easy to hide. The experience of arms control systems regulating the use of weapons with similar qualities, for example, chemical and biological weapons, suggests the high value of establishing strict and unambiguous rules against their use. Due to the fact that they are widely and cheaply available, it is extremely important that the use of chemical and biological weapons be considered completely prohibited, the same is the case with cyber weapons. In an environment characterized by great uncertainty about the power positions of potential adversaries, States should be able to be sure that cyber attacks will meet strong international condemnation and lead to serious sanctions. To do this, an official binding cyber agreement is required, in which the rules will be spelled out and responsibility for violating the norms will be established.

It seems that intelligence sharing and a joint attribution mechanism can become an important point of agreement for many States, as well as access to technical assistance and funding to improve national cyber defense. It is also possible to include in the agreement a clause on the creation of additional incentives for participation, such as joint response to cyber threats. For example, a cyber agreement may oblige States to provide assistance to other parties if they have been subjected to a serious cyber attack. The agreement may also include a clause on media responsibility.

Although it is impossible to completely eliminate incentives to distort or disguise aggressive actions in cyberspace, confidence-building measures that promote dialogue between States are the first step towards mitigating destabilizing effects in the cybersphere. Over the past few years, a number of states, in particular, Russia and the United States, have concluded bilateral agreements on the establishment of a hotline to protect against misunderstandings resulting from cyber operations in a crisis. In October 2016, it was first used when US President Barack Obama contacted the Russian side in connection with hacker attacks carried out against US political institutions on the eve of the American presidential election, in which Russian hackers were accused ^[29]. Thanks to this, open conflict was avoided, which demonstrated the high importance of the ability to prevent incidents in the digital environment and to have communication channels between states.

Instead of banning certain opportunities or concluding an agreement, States currently use mostly informal, voluntary measures to combat the fundamental factors of instability between cyber partners, ensuring crisis management in the digital environment. 

Coordination of confidence-building measures between Russia and the United States in cyberspace is generally possible, since their goal is to exchange information that helps states avoid conflicts, and not to actually change the military balance of forces. At the initial stage, confidence-building measures in cyberspace are more suitable for use in the digital environment than a system of control over cyber weapons. The efforts of Russia and the United States to develop measures in cyberspace are important because they represent the first step towards ensuring stability and transparency in an area characterized by secrecy and uncertainty.

It seems that it is better to restrain the race of cyber weapons by carefully developed binding international agreements, establishing rules of conduct. Thus, during the Cold War, strategic nuclear deterrence based on the principle of guaranteed mutual destruction and an arms control system leveled the risk of nuclear conflict. However, currently, deterrence is carried out in the digital environment mainly through the threat of retaliation.  

If properly developed, a Russian-American agreement to regulate cyber conflicts could slow down the race for cyber weapons and, at the same time, strengthen the defensive and deterrent potential of states.

Negotiations on the Russian-American cyber agreement will be fraught with difficulties, given the difference in the interests of Russia and the United States. However, most objections to an internationally binding cyber agreement, including concerns about rapid technological change, fail on closer examination.

In the 1950s and 1960s, Russian and American leaders were visionary enough to see that they could use their superiority in nuclear technology to shape international rules regarding nuclear arms control. By promising restraint and offering to share civilian nuclear technologies, they managed to convince other States to accept the norms of the international nuclear hierarchy and thereby prevent an uncontrolled global arms race.

Currently, the main obstacle on the way to international cyber agreement can only be the opposition of the United States, whose desire to use the current strategic advantages in the cyber sphere makes it refuse to conclude a cyber agreement with Russia. Many experts believe that the hostility of the United States to mandatory international rules in the digital environment is largely due to their technological superiority, which provides a strong incentive to maintain maximum freedom of action in this area. ^{[9, 12, 17, 21, 30]}. The US would not want to give up its ability to use current tactical advantages. Being one of the strongest cyberpowers, American leaders may fear that by adopting binding international restrictions on conducting cyber warfare, they will allow other countries to catch up with them faster ^[35]. It seems necessary to convince American politicians of the need to change their course, be far-sighted and continue active negotiations on the conclusion of a Russian-American cyber agreement, thereby creating a system of control over cyber weapons, as well as on the conclusion of an international binding cyber agreement.

When the Russian-American agreement is signed, an international treaty created in accordance with similar principles and goals set out in the agreement would actually offer other States a wide range of incentives to sign it. Thus, intelligence sharing and a joint attribution mechanism can become an important point of agreement for many States, as well as access to technical assistance and funding to improve national cyber defense. It is also advisable to include in the agreement a clause on the creation of additional incentives for participation, such as joint response to cyber threats. For example, a cyber agreement may oblige States to provide assistance to other parties if they have been subjected to a serious cyber attack.

Summing up, it is important to note that as the world becomes increasingly dependent on ICT, the conclusion of an international cyber agreement has become one of the most important political issues of our time. Due to the fact that the digital environment is becoming an arena of confrontation and potential conflicts between states, norms, both formal and informal, are the preferred regulatory course for achieving stability and security in cyberspace. For Russia and the United States, the promotion of cyber norms is a way to create predictability and prevent hostile cyber attacks ^[22]. From the very beginning, the United States has consistently sought to resist the creation of restrictions on American cyber capabilities. However, 2021 demonstrated a change in the trend ^{[5, 6]}. According to A. Krutskikh, humanity will be on the threshold of a global cyber war if countries fail to find a way to jointly combat cyber threats in time. Realizing this, in 2021, Russia and the United States began consultations on security issues in the digital environment, and also proposed a draft joint resolution on responsible behavior of states in cyberspace at the UN, which demonstrates the intention of Russia and the United States to jointly counter cyber threats.

Thus, the scientific novelty of the study is to conduct a comprehensive analysis of the possibilities of concluding a cyber agreement and creating a system of control over cyber weapons, given that this is an important element of global strategic stability.