Fifteen years ago it would be unthinkable for cyber security to top the list of priorities at the annual US-China Security and Economic Dialogue, as it did last week. But, in the intervening years, cyber technologies and the internet have become fundamental tools for everything from running critical infrastructure such as energy grids and satellite systems, to political, economic and social interactions. Given the pace of change, it should not surprise us that we have barely started to understand how to govern this new order and manage the global internet in ways that both empower and protect us.

In response, Chatham House and Routledge (part of the Taylor & Francis Group) are launching the Journal of Cyber Policy, addressing a rapidly changing situation and connecting creative, technical and policy experts.

Informing the growing security challenges of an interconnected digital world, this new peer-reviewed journal will provide a valuable resource to decision-makers in the public and private sectors grappling with the challenges of cyber security, online privacy, surveillance and internet access. The journal will offer informed and rigorous thinking, supported by the journal’s internationally renowned editorial board.

'The Journal of Cyber Policy will empower experts with new thinking and diverse ideas delivered in a way which is practically relevant as well as academically rigorous,' Dr Patricia Lewis, research director, International Security Department at Chatham House and co-editor of the journal, said. 'It will change the game for those working on cyber issues.' 

'As the preferred publisher for think tanks around the world, we are proud to be Chatham House’s partner on this new journal, which seeks to address issues that touch upon all our lives on a daily basis,' said Leon Heward-Mills, Global Publishing Director (Journals) at Taylor & Francis Group.

The Journal of Cyber Policy launches on the evening of 2 July at a reception at Chatham House.

Asia’s political class learnt many lessons on digital governance in 2019, not all of them positive.

The prolonged protests in Hong Kong and India, led by disaffected young citizenry and enabled by social media tools, powerfully demonstrated how things could spiral out of control when the virtual and the real streets come together.

Not surprisingly, governments across the region are taking a step back. Instead of placing the citizen at the heart of digital public policy – with privacy, trust, security and inclusion as drivers of digital governance – Asian governments are focusing instead on surveillance and command and control, which contradicts the spirit of a decentralized Internet and undermines citizen’s rights.

Asia’s digital governance is fragmenting from the global norm and morphing into two platforms with remarkably similar characteristics.

One is a China-driven model aptly called the Great Firewall where surveillance of citizens is an explicit objective and any external material deemed to be subversive is kept out. A complementary model has also emerged more recently, which can best be described as China-light, which seeks to emulate the control aspects of the Great Firewall.

There are of course overlaps between emulators of the China model (this list includes Vietnam, Myanmar, Cambodia and Laos) and those pursuing China-light (Singapore, India, Indonesia, Bangladesh, Sri Lanka, the Philippines, Thailand and Malaysia). A common thread running through these two approaches, which differ only in intensity and scope, is the belief that the state is best positioned to police social media and protect the rights of citizens.

This was not how it was supposed to be. A decade ago, Asian political leaders spoke about the virtues of an open internet. Such talk has faded, and a narrowing of Asia’s digital space is taking place against a backdrop of an intensifying trade war between America and China, where regional supply chains run the risk of a decoupling into distinct Sino and American spheres, upending Asia’s durable economic model of the past few decades.

Digital fragmentation in the world’s fastest growing region, with five G20 members, will complicate efforts to build global governance and standards.

Asia’s digital landscape

Asian governments, including democratic ones, have developed an unhealthy obsession with what their citizens are up to on a daily basis. Their solution is round-the-clock monitoring in cities and towns, powered by new surveillance technologies.

Name tagging and facial recognition to track movement of citizens has become pervasive across the region, with China emerging as the preferred source of technology, knowledge, and techniques. While India’s Supreme Court has ruled that privacy is a fundamental right, translating this into concrete citizen’s protections will be difficult with the Modi government eager to emulate China’s approach.

Asian governments are also following China in requiring that their citizen’s data be housed within national borders and are rebelling against the established practice of data offshoring.

In the post-Snowden era and amidst increasing cyber risks, there are rational national security reasons for why governments may want to ring-fence customer data within national boundaries. However, Asian governments are paying little or no attention to how companies are using customer data within national boundaries, with widespread abuses going unchecked.

Global standards are still evolving and there is a strong case here for a uniform regional approach, perhaps via ASEAN or APEC, on standards governing customer privacy, payments, data collection and handling. Big tech companies and platforms operate across much of Asia and a regional approach will curb their current instinct of conducting regulatory arbitrage.

There is a genuine problem in Asia, as elsewhere in the world, with the proliferation of fake news and extremism. But instead of addressing the source of this problem, governments are clamping down by generously expanding the definition of fake news (Singapore) or by shutting down the internet altogether (India, Sri Lanka, and China being serial offenders).

As disseminators of news of all stripes, including the fake variant, the big tech firms have a primary responsibility in policing their platforms. However, the regulatory capacity of many Asian governments to monitor this is weak and in crisis situations, governments prefer to shut the pipes altogether.

Digitalization of course is not all about surveillance and holds the promise of driving inclusion. There is considerable hype within Asia on the promise of fintech as an enabler of this inclusion.

Hong Kong and Singapore are licensing new digital banks, India’s UPI (unified payments interface) is reducing friction in domestic payments and China’s BAT companies (Baidu, Alibaba, Tencent) are disrupting traditional commerce and payments, and seeking to expand in the region.

However, there is an elite focus in many of these initiatives, with the target market being the region’s rising middle class rather than those at the bottom of the income ladder. Making fintech work for all will require micro-initiatives with the support of NGOs, local governments and small enterprises, with the objective of digitalizing microfinance.

Here developing Asia will again benefit from learning from each other and in building regional approaches. India’s Aadhar for example, with appropriate security safeguards, is a model for Asia in terms of building digital identity.

Given differing regional and national objectives, it is difficult to imagine a global accord for digital governance any time soon. However, by signing on to the Regional Comprehensive Economic Partnership (RCEP) and the Comprehensive and Progressive Agreement for Transpacific Partnership (CPTPP, the successor to the TPP), Asia has consistently demonstrated its leadership in trade and regional governance.

This is why the region needs to come together to ensure that the promise and potential of digitalization flows evenly and equitably to the region, with the region’s 3.8 billion citizens at the heart, rather than at the margins of sensible public policy.

Internet shutdowns in Asia have become frequent and persistent, an ominous sign of shrinking public space for debate and discourse. The shutdowns have become an irresistible option for governments of all stripes and ideological affiliations. Democratic India, Sri Lanka, Indonesia and the Philippines are prodigious offenders. So are Asia’s more repressive regimes, notably China.

In their defence, governments have offered real and imagined threats to national security as reasons for shutting down the pipes. It is useful to examine these claims as well as to objectively frame the issue. Are internet shutdowns in Asia legitimate and can be defended and explained as threats to national security? Or should we take a broader approach where international law, norms, values, rights and indeed economic stability could be invoked to curb this invidious practice?

Let’s start with the shutdown in Kashmir, where Indian authorities clamped down on internet access for a straight 165 days, described by rights group Access Now as the ‘longest shutdown ever in a democracy’. The Kashmir Chamber of Commerce and Industry estimates that the shutdown had huge economic costs, estimated at over £1.9 billion.

The economic cost of the continuing surveillance and shutdown in China’s Xinjiang province is likely to be higher. But India is a democracy and could be a role model, which is why the recent assertion of Communications and Information Technology Minister Ravishankar Prasad is worrying. He asserted in Parliament that the Indian citizen’s right to the internet was not a fundamental right. ‘While right of internet is important, security of the country is equally important…Can we deny (that) the internet is abused by terrorists…?’.

The minister’s primary defence of the shutdown – that the internet was being abused by terrorists and others to foment unrest – has some merit. Our starting point therefore is that big tech platforms should be doing a significantly better job in monitoring content and in removing material designed to provoke violence and hatred. This is the original sin and Asian governments are right to worry about messaging platforms, for example, becoming preferred channels for venom and hate speech.

To date, the big tech firms have made the right noises about monitoring and moderating content, but they have not gone far enough, providing governments with the excuse to routinely shut down access. To be blunt, self-regulation of the platforms is not working and tougher global regulation, enforcement and sanctions, possibly via the G20, would help.

At the same time, better policing of the platforms will not resolve the issue entirely because governments regard internet shutdowns as a useful way to restrict human rights and to consolidate political control and surveillance over citizens. The international community – including nation-states, NGOs and the private sector – needs to come together and embrace two overarching principles:

First, digital access is a fundamental human right and integrated into global declarations and norms.

Second, to protect fragmentation and Balkanization of the internet, the digital pipes which carry data across national boundaries should be embedded into international law as being part of the global commons (just like oceans are under maritime law). This would raise the bar on countries which frequently restrict digital access to their citizens.

Sensible though these recommendations might seem, it is obvious that many Asian governments would be loath to sign up to global declarations which would limit their policy options at home. There is an economic dimension to internet shutdowns, as the Kashmir case makes clear, which could be addressed by naming and shaming, just as the OECD’s Financial Action Task Force does for countries falling foul of money laundering regulations. Recommendations include:

• Digital access should be included in the UN’s Human Development Index.
• The World Bank’s closely followed Doing Business Index (DBI) should score countries favourably based on their commitment to offering unimpeded access to the internet. China and India watch the DBI rankings very closely and will be forced to pursue a more liberal approach if their rankings fall precipitously.
• Since internet shutdowns have a clear economic cost, particularly in payments and financial services, the International Monetary Fund (IMF) should make an annual determination of member countries (as part of its surveillance mandate) of the impact of shutdowns on economic activity and financial stability.

Finally, all Asian governments have declared a public commitment to drive financial inclusion by providing digital access and identity to the poor and vulnerable. This mandate is at odds with frequent internet disruptions. A small vendor in Kashmir, Xinjiang or elsewhere in the region has limited or no recourse when the pipes are shut down. Central banks in the region need to step in by offering some level of protection, just like deposit insurance coverage.

It is clear that many of these recommendations would be rejected outright by many Asian governments. They regard internet shutdowns as part of their policy toolkit to deal with external and internal threats to national security. In pursuing such a rigid approach, governments are wilfully curbing their citizens’ space for debate and ignoring a much broader issue of rights to digital access.

Armed with a hammer, it is tempting for governments to regard the internet as a nail. The international community and citizens’ groups have an obligation to make such hammering very expensive.

Summary

• Machine learning (ML)-driven personalization is fast expanding from social media to the wider information space, encompassing legacy media, multinational conglomerates and digital-native publishers: however, this is happening within a regulatory and oversight vacuum that needs to be addressed as a matter of urgency.
• Mass-scale adoption of personalization in communication has serious implications for human rights, societal resilience and political security. Data protection, privacy and wrongful discrimination, as well as freedom of opinion and of expression, are some of the areas impacted by this technological transformation.
• Artificial intelligence (AI) and its ML subset are novel technologies that demand novel ways of approaching oversight, monitoring and analysis. Policymakers, regulators, media professionals and engineers need to be able to conceptualize issues in an interdisciplinary way that is appropriate for sociotechnical systems.
• Funding needs to be allocated to research into human–computer interaction in information environments, data infrastructure, technology market trends, and the broader impact of ML systems within the communication sector.
• Although global, high-level ethical frameworks for AI are welcome, they are no substitute for domain- and context-specific codes of ethics. Legacy media and digital-native publishers need to overhaul their editorial codes to make them fit for purpose in a digital ecosystem transformed by ML. Journalistic principles need to be reformulated and refined in the current informational context in order to efficiently inform the ML models built for personalized communication.
• Codes of ethics will not by themselves be enough, so current regulatory and legislative frameworks as they relate to media need to be reassessed. Media regulators need to develop their in-house capacity for thorough research and monitoring into ML systems, and – when appropriate –proportionate sanctions for actors found to be employing such systems towards malign ends. Collaboration with data protection authorities, competition authorities and national electoral commissions is paramount for preserving the integrity of elections and of a political discourse grounded on democratic principles.
• Upskilling senior managers and editorial teams is fundamental if media professionals are to be able to engage meaningfully and effectively with data scientists and AI engineers.

Most research on social media as a tool for public diplomacy focuses on its use by recognized international actors to advance their national interest and reputation, deliver foreign policy objectives or promote their global interests. This article highlights the need for paying more attention to non-state diplomacy in conflict situations outside the western world. We examine how rebel groups use new media to enhance their communications, and what the motivations behind this are. Our public diplomacy perspective helps convey the scope of rebel communications with external actors and provides insights for policy-makers seeking to ascertain the nature, intentions and capacities of myriad rebel groups. Our focus is on the Sahel region, where numerous such groups vying for international attention and support make use of multiple social media channels. We analyse two groups in Mali: the MNLA, a Tuareg secessionist group; and Ansar Dine, a Salafist insurgency with ties to Al-Qaeda in the Islamic Maghreb. Our qualitative analysis of Ansar Dine and MNLA communications on several digital platforms helps identify these African rebel groups' international and local framing activities. Rebel groups use public diplomacy nimbly and pragmatically. The digital age has fundamentally changed which stakeholders such groups can reach, and we suggest that social media increase the power they are able to carve out for themselves on the international stage.