International infosec rules delivered to make nations and non-state actors behave themselves online
- Reference: 1605512542
- News link: https://www.theregister.co.uk/2020/11/16/gcsc_final_report/
- Source link:
The GCSC exists because its founders and stakeholders believe the internet has become essential to life but is not safeguarded by the kind of conventions or norms that, in a conventional kinetic conflict, make it plain that bombing schools or hospitals is barbaric.
The organisation is pragmatic enough to believe that some nations will never sign up to such norms because they don't want restraints on their ability to conduct offensive online operations. But GCSC leaders also feel that if the organisation can create norms and have them adopted by nations and multilateral bodies, it will become possible to paint those who use the Net as a weapon as acting outside acceptable standards of behaviour.
Diplomats, 'Net greybeards work to disarm USA, China and Russia's cyber-weapons [1]READ MORE
That mission took an important step forward last week with the release of the Commission's final report that outlines those norms.
The proposed norms are:
State and non-state actors should neither conduct nor knowingly allow activity that intentionally and substantially damages the general availability or integrity of the public core of the Internet, and therefore the stability of cyberspace.
State and non-state actors must not pursue, support or allow cyber operations intended to disrupt the technical infrastructure essential to elections, referenda or plebiscites.
State and non-state actors should not tamper with products and services in development and production, nor allow them to be tampered with, if doing so may substantially impair the stability of cyberspace
State and non-state actors should not commandeer the general public's ICT resources for use as botnets or for similar purposes.
States should create procedurally transparent frameworks to assess whether and when to disclose not publicly known vulnerabilities or flaws they are aware of in information systems and technologies. The default presumption should be in favor of disclosure.
Developers and producers of products and services on which the stability of cyberspace depends should (1) prioritize security and stability, (2) take reasonable steps to ensure that their products or services are free from significant vulnerabilities, and (3) take measures to timely mitigate vulnerabilities that are later discovered and to be transparent about their process. All actors have a duty to share information on vulnerabilities in order to help prevent or mitigate malicious cyber activity.
States should enact appropriate measures, including laws and regulations, to ensure basic cyber hygiene.
Non-state actors should not engage in offensive cyber operations and state actors should prevent such activities and respond if they occur.
The report describes its emergence as "both an end and a beginning."
"The Commission has fulfilled its mandate," the document says. "For the members and supporters of the GCSC, however, as well as all those who support its goals, the hard work required to implement these principles, norms, and recommendations is just beginning."
The work will be hard because the United Nations has already floated its own [2]norms , and because the GCSC's effort goes further by seeking to involve and influence the behaviour of non-state actors.
"Multistakeholder engagement is called for in many international agreements, yet it remains contentious," the report says. "Some continue to believe that ensuring international security and stability is almost exclusively the responsibility of states. In practice, however, the cyber battlefield (i.e., cyberspace) is designed, deployed, and operated primarily by non-state actors, and we believe their participation is necessary to ensure the stability of cyberspace. Moreover, their participation is inevitable, as non-state actors often are the first to respond to – and even to attribute – cyber attacks."
Attempts to define international infosec rules of the road bogged down by endless talkshops, warn diplomats [3]READ MORE
With its norms now completed, the GCSC will work to have them widely adopted, and recommended a "standing multistakeholder engagement mechanism be established to address stability issues, one where states, the private sector (including the technical community), and civil society are adequately involved and consulted." ®
Get our [4]Tech Resources
[1] https://www.theregister.com/2018/03/22/global_commission_on_the_stability_of_cyberspace/
[2] https://cyberstability.org/report/#appendix-a-norms-adopted-by-the-un-gge-54see-united-nations-general-assembly--report-of-the-group-of-governmental-experts-on-developments-in-the-field-of-information-and-telecommunications-in-the-context-of-international-security,-a/70/174-(22-july-2015),-https://undocsorg/a/70/174.
[3] https://www.theregister.com/2020/01/31/un_cyber_norms_chaos_fic_2020/
[4] https://whitepapers.theregister.com/
Re: "Commission"?
Near as I can tell they are yet another group of do-gooders, out to protect us all from ourselves because they know what's best for all of humanity.
Read their proposed norms ... Sounds like something a "modern" "progressive" school might draw up to keep forms 4RW and 4DC from constantly feuding over whatever 4th year kids have been feuding over since the year dot ...
"a final report that outlines its vision"
The final report? Really? THE final report!
THE FINAL REPORT!!!!
We can all sleep ever so soundly now, the FINAL REPORT has been delivered!
Beers all around!
Possible but unlikely to be effective
" it will become possible to paint those who use the Net as a weapon as acting outside acceptable standards of behaviour "
Labelling any nation as "naughty" has never so far reduced its desire for supremacy or its propensity for harmful action to that end. Initiatives of this kind are understandable, but, sadly, not very likely to succeed.
Re: Possible but unlikely to be effective
A lovely dream, but I can't see the NSA or GCHQ signing up to this, and I can't see this "commission"calling them out for it either.
Jumping Off the Fence into the Thick of IT .......
Whenever one can equate and accept cyberspace policies as new electromagnetic spectrum strategies, and non state actors as a private commercial sector with master pilot and/or pirate type enterprises on active operations, one does need to be genuinely creative and radically inclusive* rather than exclusive and wannabe elitist in order to gain or remain relevant in any novel field of almighty endeavour ...... but it will never be because it was agreed to by any committee.
And you can bet your shirt on the fact that the Pentagon realises that. for it not as if they are not so advised in publications, is it. However, what they might actually effectively do with that dump/pump/sort of information/intelligence is most probably best imagined, whenever effective, a closely guarded, admirable secret ....... :-) as is the way of the likes of a military defence business operation based anywhere.
GrahamC [2011021430] ....... commenting on [1]https://www.nationaldefensemagazine.org/articles/2020/10/29/pentagon-unveils-new-electromagnetic-spectrum-strategy
Re: Pentagon Unveils New Electromagnetic Spectrum Strategy
"Some U.S. officials have expressed concerns about opening up portions of the electromagnetic spectrum used by the Defense Department to commercial companies on the grounds that it could potentially interfere with military systems and operations."
It is certainly guaranteed to do at least that, but the DoD has no choice other than to engage with the private commercial sector, and pirate enterprises too, if they wish to remain anywhere near the leading edge of future developments with any sort of meaningful impact being made available to them, for such is the dynamic virile nature of the beast they need to husband and harness nowadays.
Indeed, there was a recent time whenever such appeared to be in vogue in No 10 and the Cabinet Office and with Tory toffs but quite what eventually subsequently happened there to that initiative inviting " Weirdos and misfits with odd skills ... Unusual software developers ..... Great project managers ..... deep experts on TV and digital and if you’ve done something weird, this may be the place for you, super-talented weirdos is somewhat unclear :-) ...... and if currently scuppered, rather than being armed and deployed, must surely be classed as yet another resounding epic fail.
And one would then be duty bound to ask ...... Is there something in the water at Downing Street that renders such madness and mayhem in conflict with CHAOS ....... Clouds Hosting Advanced Operating Systems?
[1] https://www.nationaldefensemagazine.org/articles/2020/10/29/pentagon-unveils-new-electromagnetic-spectrum-strategy
"Commission"?
That's all very well, but who exactly are these people? They call themselves a "Commission" - who commissioned them, specifically? Who is going to champion these standards?