Photo: Jonathan Nackstrand/AFP/Getty Images

A person walks in a server room in Lulea, in Swedish Lapland. What can be done to prevent criminal and military cyber operations from spilling over into the functioning of the Internet’s servers, routers, satellites and cables?

There are plenty of ways to describe the Internet. It is a decentralized network of tens of thousands of networks, with neither a switch-on nor a switch-off button. It is a form of infrastructure, a series of underwater cables. But one particularly useful way of thinking about the Internet is to imagine it as a body. And as with bodies, much of the time we spend thinking about the Internet is spent thinking about what we can see: the skin.

Most Internet problems are problems that deal with the surface level, the “digital skin.” Cyber war and cybercrime, disputes over digital data trading, censorship and surveillance—all of these are not Internet problems so much as they are political problems, emerging now in a digital context.

Against this background of growing political turmoil on the surface of the Internet, it is remarkable that the spaces under the skin—the organs of the Internet, if you will—have so far been largely untouched. The global network of servers and routers works amazingly smoothly.

But that may be changing.

What can be done to prevent criminal and military cyber operations, digital trade wars and human rights violations from spilling over into the functioning of the Internet’s servers, routers, satellites and cables? What can be done to ensure that bad actors in cyberspace do not go “under the skin”?

 

The Role of Government

 

The Internet currently operates using globally available resources, which are unlimited and nonterritorial and are neither developed nor managed by governments.

In ICANN, the manager of the Domain Name System (DNS), governments have only an advisory role. The countless IP addresses are managed by five independent regional Internet registries (RIRs). There is no governmental oversight body for the RIRs. Even in standardization organizations such as the Internet Engineering Task Force, the Institute of Electrical and Electronics Engineers or the World Wide Web Consortium, governments—with some exceptions—are largely ignored.

This mechanism of enhanced cooperation among the concerned and affected stakeholders has so far given the whole Internet governance ecosystem stability, growth and robustness. Four billion Internet users and the entire global economy enjoy this arrangement every day.

But there is no guarantee that it will stay that way.

 

The Internet Is Already Under Siege

 

There have been several recent cases that raised big questions about the future health and functioning of the global Internet.

In January 2019, for example, there was an attack on DNS and Netnod’s I-Root server based in Sweden. The hitherto unknown attackers used hijacked Internet addresses from Lebanon (.lb) and the United Arab Emirates (.ue) to steal logins and other security information. With this information, an attacker can significantly disrupt email traffic and divert it in other directions. In this case, Netnod was well-protected, and the damage was limited. But a worst-case scenario could have undermined global Internet communication.

 

Could Russia Create a Parallel Internet?

 

A few months later, Russian president Vladimir Putin signed a new law aimed at creating an independent “Russian Internet.” To protect the country from possible American sanctions, Russia proposed to create its own Internet root and DNS. Then, if Russia were to be disconnected from the global Internet by its enemies, a Russian DNS could sustain Internet traffic.

How such a thing is technically designable is still unclear.

There are currently over 1,000 root servers operating in the global root server system, enabling real-time communication among the four billion Internet users around the globe. Some of these servers are in Russia. Root servers operate on the principles of neutrality and impartiality and have nothing to do with the content of the messages they forward.

But what happens when locally operating root servers are confronted with national laws that replace neutrality and impartiality with legal obligations to “Russia first”? President Putin has already offered the “Russian Root” to the other BRICS countries: Brazil, India, China and South Africa. Roughly 1.5 billion Internet users live in the five BRICS countries. Does the Internet then break down into a BRICS-Internet and an ICANN/IANA-Internet?

 

Attacks on the Infrastructure

 

Lastly, we’ve started to see the erasure of the red line that thus far separated cyberattacks from physical attacks against an enemy. After a series of cyberattacks by the Palestinian organization Hamas against elements of critical infrastructure in Israel, the Israeli air force destroyed a building in the Gaza Strip that was used as the headquarters by Hamas’ cyberhackers. Does Internet infrastructure run the risk of becoming a casualty in future global conflicts?

All of these attacks against elements of the technical public core of the Internet, as well as unintended side effects from reactive national regulations, have the potential to undermine the stability of cyberspace. So it is encouraging to see some movement on that front from certain global stakeholders.

 

Safeguarding the Internet Architecture

 

In 2017, the Global Commission on the Stability of Cyberspace proposed adopting a universal standard for the protection of the public core of the Internet. Under this standard, state and non-state actors would be prohibited from attacking the core technical components of the global Internet: the Domain Name System, IP addresses, Internet protocols, routers, servers, cables and satellites, among others.

This idea later found its way into the new EU cybersecurity directive from April 2019 and the Paris Call for Trust and Security in Cyberspace from November 2018. The Paris Call, published at the occasion of the centenary of the end of World War I, included 64 governments and 672 non-state actors—including most Silicon Valley companies.

However, the governments of China, Russia and the U.S. have not yet signed the call. Chinese Internet giants such as Alibaba, Baidu, Tencent and Huawei have also not signed.

Last year, when Paris hosted the Internet Governance Forum (IGF), France’s President Emmanuel Macron denounced digital unilateralism and demanded an innovative multilateralism for the Internet. He proposed that governments and non-state actors develop and implement policies and regulations for the global Internet jointly. This was a great plan for a long march.

 

Creating a Contract To Protect the Internet Core

 

Long marches begin with first steps. The Internet is too complex to be covered by one single negotiation process. But it does need a broad framework that offers both general stability as well as the flexibility to address individual multistakeholder arrangements for the 500-plus Internet-related public policy issues.

Where will the driving force for something like this come from? There are a number of options based on existing mechanisms such as the IGF, the London Process Conferences, or the aforementioned Paris Call. New ideas might also come from the UN High-Level Panel on Digital Cooperation, established by UN Secretary General Guterres in June 2018, or the two new UN Working Groups under the First Committee of the UN General Assembly.

Time is running out. A “wait and see” approach is growing harder to justify. A pact to protect the public core of the Internet must be the next step.

Related themes: Cybersecurity Geopolitical Conflict Infrastructure

Wolfgang Kleinwächter
Professor Emeritus for Internet Policy and Regulation at the University of Aarhus

Wolfgang Kleinwächter is emeritus professor of Internet policy and regulation at the University of Aarhus and member of the Global Commission on Stability in Cyberspace.

 

The original Brink’s article can be read HERE.