Story

U.S. International Strategy for Cyberspace - Strengths and Concerns

My last blog (May 13, 2011) posed the question: Do we need a new overarching national cyberspace strategy that addresses all instruments of national power in our current context as well as in the context of a rapidly evolving cyberspace environment?

A good portion of my question was answered yesterday (May 16, 2011) by the release of the International Strategy for Cyberspace in a ceremony by Secretary of State Hillary Rodham Clinton and others.

Although the new strategy does not address all the critical international issues related to cyberspace, it is a significant and positive step forward. Here are my initial observations on its strengths as well as some remaining concerns.

Strengths

Explicit and Consistent Goal. The strategy’s goal to promote a cyberspace environment that is “open, interoperable, secure, and reliable” based on “norms of responsible behavior” provided a thread of continuity throughout the document. This was divided into three approaches for the future—diplomacy, defense, and development—and supported by seven policy priorities.

Whole of Government Approach. The strategy promulgated the need for coordinated activities that address all instruments of national power—diplomatic, information, military, and economic. To emphasize this, the announcement ceremony included secretaries of various U.S. departments (commerce, defense, homeland security, justice) with Secretary Clinton and Attorney General Holder.

Focus on Development and Diplomacy. The strategy reiterates the need to develop and maintain partnerships with other countries as well as private sector, noting that “no single institution, document, arrangement, or instrument could suffice in addressing the needs of our networked world.”

It is encouraging to see the explicit call to “actively engage the developing world” in terms of support for universal freedoms as well as access to technological advancements.

Declaratory Defense Statements. The strategy’s Basis for Norms includes the existing principle that “consistent with the United Nations Charter, states have an inherent right to self-defense that may be triggered by certain aggressive acts in cyberspace.”

The section on defense of cyberspace does not mince words, stating “when warranted, the United States will respond to hostile acts in cyberspace as we would to any other threat to our country.”

Further, the U.S. will “reserve the right to use all necessary means—diplomatic, informational, military, and economic—as appropriate and consistent with applicable international law, in order to defend our Nation, our allies, our partners, and our interests.” These words send a serious deterrent message to potential adversaries without limiting the type of response, perhaps akin to a Monroe Doctrine in Cyberspace proposed by Mary Ann Davidson during the 2009 Cyber Policy Review as a policy tool to help define U.S. national interests in cyberspace.

Concerns

Much of the International Strategy for Cyberspace is laudable, but some questions raise concerns for topics not included.

What is cyberspace? The document never explicitly defines cyberspace for purposes of the strategy discussion, and when establishing the vision for a nation, this is not a mere argument of semantics.

While not uncommon, the document further intermingles terms such as network, Internet, and global interconnection – these have significantly different meanings to English-speaking audiences; how will they translate into the language of our partners?

What about the existing efforts of other countries? This strategy is not without precedent internationally—for example, the Australian Cyber Security Strategy contains themes in concert with most of the new U.S. strategy, with only slightly more narrow content due to its security focus. What is important is that it was released on November 23, 2009, almost 18 months ago—that’s roughly one generation past in cyberspace terms.

Individuals and organizations examining the new U.S. strategy should also look for such documents outside our borders.

What is cyberspace becoming? In its final section, “Moving Forward,” the strategy acknowledges the revolutionary changes brought about by the Internet in the last 30 years.

It even notes that “technology propels society forward, accomplishing things previous generations scarcely thought possible.” Considering this, the strategy would be greatly enhanced with the addition of an eighth policy priority that focused on a continuing examination of current manifestation of cyberspace as well as its likely evolutionary paths.

This would be a holistic evaluation encompassing not only the technical content and connectivity, but also the more subtle changes in cognitive norms expressed in social, cultural, and ethical terms. Such an overarching priority would help guide and unify actions of the current seven priorities.

What is the sense of urgency and priority? It is not clear where this strategy stands amongst the complex agenda of our nation, however, it is notable that cyberspace has not yet earned inclusion as one of the White House website 22 Issues. Also, it is not clear how the actions required by this strategy will be resourced in an increasingly constrained federal budget.

In the end, this strategy can best be judged not by its contents, but by the positive outcomes in cyberspace that it compels.