In discussions to date about how international law applies in cyberspace, commentators have tended to focus their attention on how the rules on the use of force, or the law of armed conflict, apply to cyber activities conducted by states that give rise to physical damage, injury or death.

But in practice, the vast majority of state cyberattacks fall below this threshold. Far more common are persistent, low-level attacks that may leave no physical trace but that are capable of doing significant damage to a state’s ability to control its systems, often at serious economic cost.

Such cyber incursions might include network disruptions in the operation of another government’s websites; tampering with electoral infrastructure to change or undermine the result; or using cyber means to destabilize another state’s financial sector.

For these kinds of cyber operation, the principle of sovereignty, and the principle of non-intervention in another state’s internal affairs, are the starting point.

A UN Group of Government Experts (GGE) agreed in 2013 and 2015 that the principles in the UN Charter, including sovereignty and the prohibition on intervention in another state’s affairs, apply to states’ activities in cyberspace. The 2015 GGE also recommended eleven (non-binding) norms of responsible state behaviour in cyberspace.

However, states have not yet reached agreement on how to apply these principles. Until recently, there has also been very little knowledge of what states actually do in cyberspace, as they usually conduct cyber operations covertly and have been reluctant to put their views on record.

A new Chatham House research paper analyses the application of the principles of sovereignty and non-intervention to state cyberattacks that fall below the principle of use of force. As well as analysing the application of the law in this area, the paper also makes recommendations to governments on how they might best make progress in reaching agreement in this area.

Existing rules or new rules?

As the research paper makes clear, there is currently some debate, principally between countries in the West, about the extent to which sovereignty is a legally binding rule in the context of cyberspace and, if so, how it and the principle of non-intervention might apply in practice.

In the last few years, certain states have put on record how they consider international law to apply to states’ activities in cyberspace, namely the UK, Australia, France and the Netherlands. While there may be some differences in their approaches, which are discussed in the paper, there also remains important common ground: namely, that existing international law already provides a solid framework for regulating states’ cyber activities, as it regulates every other domain of state-to-state activity.

There is also an emerging trend for states to work together when attributing cyberattacks to hostile states, enabling them to call out malign cyber activity when it violates international law. (See, for example, the joint statements made in relation to the NotPetya cyber attack and malicious cyber activity attributed to the Russian government).

However, other countries have questioned whether existing international law as it stands is capable of regulating states’ cyber interactions and have called for ‘new legal instruments’ in this area.

This includes a proposal by the Shanghai Cooperation Organization (led by Russia and China) for an International Code of Conduct on Information Security, a draft of which was submitted to the UN in 2011 and 2015, without success. The UN has also formed a new Open-Ended Working Group (OEWG) under a resolution proposed by Russia to consider how international law applies to states’ activities in cyberspace.

The resolution establishing the OEWG, which began work earlier this year, includes the possibility of the group ‘introducing changes to the rules, norms and principles of responsible behaviour of States’ agreed in the 2013 and 2015 GGE reports. In the OEWG discussions at the UN in September, several countries claimed that a new legal instrument was needed to fill the ‘legal vacuum’ (Cuba) or ‘the gap of ungoverned areas’ (Indonesia).

It would be concerning if the hard-won consensus on the application of international law to cyberspace that has been reached at past GGEs started to unravel. In contrast to 2013 and 2015, the 2017 meeting failed to reach an agreement.

On 9 December, a renewed GGE will meet in New York, but the existence of the OEWG exploring the same issues in a separate process reflects the fact that cyber norms have become an area of geopolitical rivalry.

Aside from the application of international law, states are also adopting divergent approaches to the domestic regulation of cyberspace within their own territory. The emerging trend towards a ‘splinternet’ – i.e. between states that believe the internet should be global and open on the hand, and those that favour a ‘sovereignty and control’ model on the other  – is also likely to make discussions at the GGE more challenging.

Distinct from the international law concept of sovereignty is the notion of ‘cybersovereignty’, a term coined by China to describe the wide-ranging powers it assumes under domestic law to regulate its citizens’ access to the internet and personal data within its territory. This approach is catching on (as reflected in Russia’s recently enacted ‘Sovereign Internet Law’), with other authoritarian states likely to follow suit.

The importance of non-state actors

In parallel with regional and UN discussions on how international law applies, a number of initiatives by non-state actors have also sought to establish voluntary principles about responsible state behaviour in cyberspace.

The Global Commission on the Stability of Cyberspace, a multi-stakeholder body that has proposed principles, norms and recommendations to guide responsible behaviour by all parties in cyberspace, recently published its final report. The Cybersecurity Tech Accord  aims to promote collaboration between tech companies on stability and resilience in cyberspace. President Macron’s ‘Paris Call for Trust and Security in Cyberspace’ has to date received the backing of 67 states, 139 international and civil society organizations, and 358 private-sector organizations.

It remains to be seen in the long term whether the parallel processes at the UN will work constructively together or be competitive. But notwithstanding the challenging geopolitical backdrop, the UN GGE meeting next week at the least offers states the opportunity to consolidate and build on the results of past meetings; to increase knowledge and discussion about how international law might apply; and to encourage more states to put their own views of these issues on the record.

This workshop is the second in a series in the 'Implementing the Commonwealth Cybersecurity Agenda' project. The workshop aims to provide a multi-stakeholder pan-Commonwealth platform to discuss how to take the implementation of the 'Commonwealth Cyber Declaration' forward with a focus on the second pillar of the declaration – building the foundations of an effective national cybersecurity response with eight action points. 

As such, the workshop gathers different project implementers under the UK Foreign and Commonwealth Office’s Cyber Programme, in addition to other key relevant stakeholders from the global level, to explore ongoing initiatives which aim to deliver one or more of pillar two’s action points.

The workshop addresses issues from a global perspective and a Commonwealth perspective and will include presentations from selected partners from different Commonwealth countries.

Summary

• The application of ‘security by design’ in nuclear new builds could provide operators with the opportunity to establish a robust and resilient security architecture at the beginning of a nuclear power plant’s life cycle. This will enhance the protection of the plant and reduce the need for costly security improvements during its operating life.
• Security by design cannot fully protect a nuclear power plant from rapidly evolving cyberattacks, which expose previously unsuspected or unknown vulnerabilities.
• Careful design of security systems and architecture can – and should – achieve levels of protection that exceed current norms and expectations. However, the sourcing of components from a global supply chain means that the integrity of even the most skilfully designed security regime cannot be guaranteed without exhaustive checks of its components.
• Security by design may well include a requirement for a technical support organization to conduct quality assurance of cyber defences and practices, and this regime should be endorsed by a facility’s executive board and continued at regular intervals after the new build facility has been commissioned.
• Given the years it takes to design, plan and build a new nuclear power plant, it is important to recognize that from the point of ‘design freeze’ onwards, the operator will be building in vulnerabilities, as technology continues to evolve rapidly while construction fails to keep pace with it. Security by design cannot be a panacea, but it is an important factor in the establishment of a robust nuclear security – and cybersecurity – culture.

This roundtable is part of a series under the project, 'Implementing the Commonwealth Cybersecurity Agenda', funded by the UK Foreign and Commonwealth Office (FCO). The roundtable aims to provide a multi-stakeholder, pan-Commonwealth platform to discuss how to implement the Commonwealth Cyber Declaration with a focus on its third pillar 'To promote stability in cyberspace through international cooperation'.

In particular, the roundtable focuses on points 3 and 4 of the third pillar which revolve around the commitment to promote frameworks for stability in cyberspace including the applicability of international law, agreed voluntary norms of responsible state behaviour and the development and implementation of confidence-building measures consistent with the 2015 report of the UNGGE. 

The workshop also focuses on the commitment to advance discussions on how existing international law, including the Charter of the United Nations and applicable international humanitarian law, applies in cyberspace.

The roundtable addresses the issue of global cyber governance from a Commonwealth perspective and will also include a discussion around the way forward, the needed capacity of the different Commonwealth countries and the cooperation between its members for better cyber governance.

Participants include UNGGE members from Commonwealth countries in addition to representatives to the UN Open-Ended Working Group from African countries as well as members from academia, civil society and industry.

As countries move towards the fifth generation of mobile broadband, 5G, the United States has been loudly calling out Huawei as a security threat. It has employed alarmist rhetoric and threatened to limit trade and intelligence sharing with close allies that use Huawei in their 5G infrastructure.

While some countries such as Australia have adopted a hard line against Huawei, others like the UK have been more circumspect, arguing that the risks of using the firm’s technology can be mitigated without forgoing the benefits.

So, who is right, and why have these close allies taken such different approaches?

The risks

Long-standing concerns relating to Huawei are plausible. There are credible allegations that it has benefitted from stolen intellectual property, and that it could not thrive without a close relationship with the Chinese state.

Huawei hotly denies allegations that users are at risk of its technology being used for state espionage, and says it would resist any order to share information with the Chinese government. But there are questions over whether it could really resist China’s stringent domestic legislation, which compels companies to share data with the government. And given China’s track record of using cyberattacks to conduct intellectual property theft, there may be added risks of embedding a Chinese provider into critical communications infrastructure.

In addition, China’s rise as a global technological superpower has been boosted by the flow of financial capital through government subsidies, venture and private equity, which reveal murky boundaries between the state and private sector for domestic darlings. Meanwhile, the Belt and Road initiative has seen generous investment by China in technology infrastructure across Africa, South America and Asia.

There’s no such thing as a free lunch or a free network – as Sri Lanka discovered when China assumed shares in a strategic port in return for debt forgiveness; or Mexico when a 1% interest loan for its 4G network came on the condition that 80% of the funding was spent with Huawei.

Aside from intelligence and geopolitical concerns, the quality of Huawei’s products represents a significant cyber risk, one that has received less attention than it deserves.

On top of that, 5G by itself will significantly increase the threat landscape from a cybersecurity perspective. The network layer will be more intelligent and adaptable through the use of software and cloud services. The number of network antennae will increase by a factor of 20, and many will be poorly secured ‘things’; there is no need for a backdoor if you have any number of ‘bug doors’.

Finally, the US is threatening to limit intelligence sharing with its closest allies if they adopt Huawei. So why would any country even consider using Huawei in their 5G infrastructure?

Different situations

The truth is that not every country is free to manoeuvre; 5G technology will sit on top of existing mobile infrastructure.

Australia and the US can afford to take a hard line: their national infrastructure has been largely Huawei-free since 2012. However, the Chinese firm is deeply embedded in other countries’ existing structures – for example, in the UK, Huawei has provided telecommunications infrastructure since 2005. Even if the UK decided tomorrow to ditch Huawei, it cannot just rip up existing 4G infrastructure. To do so would cost a fortune, risk years of delay in the adoption of 5G and limit competition in 5G provisioning.

As a result, the UK has adopted a pragmatic approach resulting from years of oversight and analysis of Huawei equipment, during which it has never found evidence of malicious Chinese state cyber activity through Huawei.

At the heart of this process is the Huawei Cyber Security Evaluation Centre, which was founded in 2010 as a confidence-building measure. Originally criticized for ‘effectively policing itself’, as it was run and staffed entirely by Huawei, the governance has now been strengthened, with the National Cyber Security Centre chairing its oversight board.

The board’s 2019 report makes grim reading, highlighting ‘serious and system defects in Huawei’s software engineering and cyber security competence’. But it does not accuse the company of serving as a platform for state-sponsored surveillance.

Similar evidence-based policy approaches are emerging in other countries like Norway and Italy. They offer flexibility for governments, for example by limiting access to some contract competition through legitimate and transparent means, such as security reviews during procurement. The approaches also raise security concerns (both national and cyber) to a primary issue when awarding contracts – something that was not always done in the past, when price was the key driver.

The UK is also stressing the need to manage risk and increase vendor diversity in the ecosystem to avoid single points of failure. A further approach that is beginning to emerge is to draw a line between network ‘core’ and ‘periphery’ components, excluding some providers from the more sensitive ‘core’. The limited rollouts of 5G in the UK so far have adopted multi-provider strategies, and only one has reportedly not included Huawei kit.

Managing the risks to cyber security and national security will become more complex in a 5G environment. In global supply chains, bans based on the nationality of the provider offer little assurance. For countries that have already committed to Huawei in the past, and who may not wish to be drawn into an outright trade war with China, these moderate approaches offer a potential way forward.

In April 2018, the Commonwealth Heads of Government Meeting (CHOGM), held in London, saw the creation and the adoption of the Commonwealth Cyber Declaration. The declaration outlines the framework for a concerted effort to advance cybersecurity practices to promote a safe and prosperous cyberspace for Commonwealth citizens, businesses and societies. 

The conference will aim to provide an overview on the progress made on cybersecurity in the Commonwealth since the declaration was announced in 2018. In addition, it will examine future challenges and potential solutions going forward.

This conference is part of the International Security Programme's project on Implementing the Commonwealth Cybersecurity Agenda and will convene a range of senior Commonwealth representatives as well as a selection of civil society and industry stakeholders. This project aims to develop a pan-Commonwealth platform to take the Commonwealth Cyber Declaration forward by means of a holistic, inclusive and representative approach.

Please see below meeting summaries from previous events on Cybersecurity in the Commonwealth:  

• A cyberspace that supports economic and social rights online (London)
• Build the foundations of an effective national cybersecurity response (Barbados)
• Promote stability in cyberspace through international cooperation (Addis Ababa)

Attendance at this event is by invitation only. 

Cyber security is a vital part of the national and international strategic infrastructure and weapons systems. The increasing cyber capabilities of countries such as China, Russia and North Korea put the North Atlantic Treaty Organization’s (NATO’s) nuclear systems - capabilities that include nuclear command, control and communication, weapons systems and early warning systems - in danger.

There is an urgent need to study and address cyber challenges to nuclear assets within NATO and in key NATO countries. Greater awareness of the potential threats and vulnerabilities is key to improving preparedness and mitigating the risks of a cyber-attack on NATO nuclear weapons systems.

Chatham House produces research responding to the need for information on enhancing cybersecurity for command, control and communications. This project constitutes the beginning of the second phase of the Cyber Security of Nuclear Weapons Systems: Threats, Vulnerabilities and Consequences, a report published in January 2018 in partnership with the Stanley Foundation.

The project responds to the need both for more public information on cyber risks in NATO’s nuclear mission, and to provide policy-driven research to shape and inform nuclear policy within NATO member states and the Nuclear Planning Group.

This project is supported by the Ploughshares Fund and the Stanley Foundation.

Understanding the complexity and the wickedness of the situation allows analysts and strategic planners to approach these complex and intractable issues in new and transformative ways – with a better chance of coping or succeeding and reducing the divisions between experts.

Using complexity theory, a complex adaptive system representing the international system and its interaction with the environment can be represented through an interactive visualization tool that will aid thought processes and policy decision-making. 

Until recently, analysts did not have the tools to be able to create models that could represent the complexity of the international system and the role that nuclear weapons play. Now that these tools are available, analysts should use them to enable decision-makers to gain insights into the range of possible outcomes from a set of possible actions.

This programme builds on work by Chatham House on cyber security and artificial intelligence (AI) in the nuclear/strategic realms.

In order to approach nuclear weapons as wicked problems in a complex adaptive system from different and sometimes competing perspectives, the programme of work involves the wider community of specialists who do not agree on what constitutes the problems of nuclear weapons nor on what are the desired solutions.

Different theories of deterrence, restraint and disarmament are tested. The initiative is international and inclusive, paying attention to gender, age and other aspects of diversity, and the network of MacArthur Grantees are given the opportunity to participate in the research, including in the writing of research papers, so that the complexity modelling can be tested against a wide range of approaches and hypotheses.

In addition, a Senior Reference Group will work alongside the programme, challenging its outcome and findings, and evaluating and guiding the direction of the research.

This project is supported by the MacArthur Foundation.

At this webinar, part of the Chatham House MENA Programme Online Event Series, experts will explore how the coronavirus pandemic is impacting the economy, state-society relations and healthcare throughout the Middle East and North Africa. How are governments handling this crisis and what measures have they put in place to stop the spread of the virus? Why are some governments withholding information about the number of cases? What has the response from the public been so far? How is this affecting the region and how does it compare to the global picture?

The event will be held on the record.

In early March, global oil prices fell sharply, hitting lows of under $30 a barrel. Two factors explain this collapse: firstly the decrease in global demand for oil as a result of the COVID-19 pandemic and, secondly, the breakdown in OPEC-Russian relations and the subsequent Saudi-Russian price war which has seen both countries move to flood the market with cheap oil.
 
Against this backdrop, the panellists will reflect on the challenges currently facing OPEC as well as the oil industry as a whole. How are OPEC countries affected by the ever-evolving Covid-19 pandemic? What are the underlying causes behind the Saudi-Russian price war? Is the conflict likely to be resolved soon? And what are the implications of these challenges for the oil industry?

This event is part of a fortnightly series of 'Business in Focus' webinars reflecting on the impact of COVID-19 on areas of particular professional interest for our corporate members and giving circles.

Not a corporate member? Find out more.

Ever since independence, the Moroccan monarchy has used political parties to legitimize the country’s authoritarian political process and structure, and to absorb social and political anger. The palace puts successive governments and other elected institutions, such as local and regional councils, at the frontline of public blame, and replaces them once they fail this function.

In a recent article, MENA Programme Associate Fellow, Mohammed Masbah, examines how the Moroccan monarchy has used this strategy with the ruling Justice and Development Party (PJD) so that the palace remains the centre of political power, while the PJD – and other political parties before it– takes responsibility for coping with the mounting socio-economic crisis.

In this webinar, part of the Chatham House project on The Future of the State in the Middle East and North Africa, the article’s author will discuss the risks this approach presents for the long-term stability of Morocco and what reforms are needed to increase citizens’ dwindling confidence in the political process.

You can express your interest in attending by following this link. You will receive a Zoom confirmation email should your registration be successful.

The event will be livestreamed on the MENA Programme Facebook page.

Climate and environmental issues have largely been marginalized in discussions about the Middle East and North Africa region and yet are critical to peace and security. In this webinar, experts will explore mounting pressures including those related to water (reduced, less reliable and more polluted sources), extreme temperatures, air pollution, land degradation and sea-level rise. Panelists will discuss the potential impact of worsening environmental conditions and what the region's governments can do to protect the health and livelihoods of their peoples.

This webinar is part of the Chatham House MENA Programme's Online Event Series and will be held on the record.

Yemen suffered from the excessive control of the central government prior to the current conflict. Federalism has been put forward by many Yemeni political parties since the National Dialogue Conference (NDC) as the supposed magic cure for this significant problem. Today, Yemen is more fragmented than ever, its state central institutions have been scattered and lack leadership and the state has lost most of its sovereignty. The prevailing narrative that decentralization through federalism is Yemen’s inevitable path post-conflict often fails to acknowledge that there are prerequisites for effective local governance, beyond political will.  

In a recent article, Osamah Al Rawhani addressed how the weakness of central state institutions is the key challenge to proceeding with federalism in Yemen and highlighted prerequisites and contextual factors that need to be addressed before reforming the structure of the state. He argued that the viability of decentralization relies on the presence of a functioning, representative central government that is capable of devolving power but also able to keep the state from further fragmentation. 

In this webinar, part of the Chatham House project on The Future of the State in the Middle East and North Africa, the article’s author will discuss recent developments in Yemen, where shifting frontlines and regional divisions are fragmenting the country in new ways. The speaker will explore alternative approaches to pursue the path of federalism that recognize the current realities and the critical need for strong central institutions. He will also survey the internal and external factors that must be considered to rebuild a stable state in Yemen.

You can express your interest in attending by following this link. You will receive a Zoom confirmation email should your registration be successful. Alternatively, you can watch the event live on the MENA Programme Facebook page.

This webinar, part of the MENA Programme Webinar Series, will examine the trajectory of political and security dynamics in the Gulf in view of the ongoing rift within the Gulf Cooperation Council (GCC), the death of Sultan Qaboos in Oman, the escalation of tensions between Iran and the United States, and the COVID-19 crisis.

Speakers will explore the orientation of the GCC under a new Secretary-General and the prospects for mediation between Qatar and its neighbours, the future of Omani domestic and foreign policy under Sultan Haitham bin Tariq Al Said, eventual transitions to new leadership in Bahrain and Kuwait, and whether the impact of COVID-19 may help replace the confrontation within the GCC with closer coordination among its six member states.

The webinar will be livestreamed on the MENA Programme Facebook page.

As new cases of COVID-19 continue to surge, countries around the world struggle to mitigate the public health and economic effects of the virus. It is becoming increasingly clear that an effective pandemic response requires a whole-of-government, whole-of-society approach. In the Arab world, where health systems are already strained by armed conflicts and displaced populations, a whole-of-society response to the pandemic is particularly critical as countries have become increasingly dependent on non-state actors, notably the private sector, for healthcare provision and any response that includes the state alone may not be sufficient to address the pandemic.

In a recent article, Fadi El-Jardali, argued that while the pandemic will have grave health and economic consequences for years to come, it brings with it a valuable opportunity to re-envision the role of state and non-state actors in strengthening health systems. The article addressed the need for increased collaboration between state and non-state actors, and the rethinking of existing cooperation models to provide quality healthcare services for all.  

In this webinar, part of the Chatham House project on the future of the state in the Middle East and North Africa, Dr El-Jardali will discuss how state and non-state actors can collaborate more effectively to address the shortcomings of national health care systems amidst the pandemic and beyond. The article’s author will share insights on the different capacities available in Arab societies that governments can draw upon to ensure that Universal Health Coverage, equity considerations and social justice are at the core of health systems.

You can express your interest in attending by following this link. You will receive a Zoom confirmation email should your registration be successful. Alternatively, you can watch the event live on the MENA Programme Facebook page.

In Syria, uncertainty about the safety of the ceasefire agreed between Russia and Turkey last month is inhibiting 1 million people who have been displaced since December 2019 from returning home.

The looming COVID-19 global health crisis threatens to further devastate those most vulnerable as the conditions in northwest Syria’s refugee camps make it hard to practice common social distancing guidelines. Added to this, the medical infrastructure in the region has been decimated after years of bombings which has disabled over 70 health facilities since April 2019.

This webinar highlights the potentially catastrophic risks of a coronavirus outbreak in Idlib and displacement camps in northwest Syria by speaking with medical and civil society actors working in the region. How are doctors and local humanitarian organizations scaling up their medical and prevention response to the COVID-19 outbreak?

What key supplies such as ventilators, testing kits and critical sanitary equipment are still lacking? And how can the international community step in to help mitigate the potentially devastating consequences of an outbreak in these refugee camps?

This event is run in collaboration with The Syria Campaign, a human rights organization working with Syrian civil society to raise the voices of those struggling for democracy, and support frontline activists and humanitarians.

The webinar will be livestreamed on the MENA Programme Facebook page.

Egypt and the Gulf Arab region have long been important poles of political, military, economic and cultural power and influence in the Middle East. A recently published Chatham House paper examines the strategic and economic relationship between Egypt and the Gulf, focusing in particular on the period since Abdel-Fattah el-Sisi came to power in Egypt. Author David Butter offers a detailed evaluation of these economic relationships, in the broader context of a strategic alliance that, since 2013, has been informed by a common commitment between Egypt and the UAE in particular to keep in check the Muslim Brotherhood and its regional state supporters, primarily Turkey and Qatar.

In this webinar, the author will discuss the paper’s main argument, namely, that the degree of Egypt’s dependence on Gulf countries has fluctuated, and that by 2019, Egypt’s direct financial dependence on the Gulf was significantly reduced by comparison with the initial three years of the Sisi era, although other economic linkages such as investment, trade, remittances and tourism remained strong, with potential for growth. The speaker will also discuss the impact of the global crisis caused by the COVID-19 pandemic on Egypt’s and Gulf countries’ economies and will explore the implications for the relationship between Egypt and the Gulf.

This webinar is part of the Chatham House Middle East and North Africa Programme's Online Event Series. The event will be held on the record.