A framework to promote responsible behavior in cyberspace has been endorsed by 193 countries around the world, but implementation remains a challenge.
Michelle Markoff, acting deputy assistant secretary for international cyber security at the US State Department’s Bureau of Cyberspace and Digital Policy, while acknowledging the key role her office played in creating the framework, said it aligns with the US vision of an open, interoperable and secure, reliable Internet and stable cyberspace environment.
“The focus of my unit in the new bureau is to improve international security in cyberspace. One of the key parts of our work is to shape the international environment in such a way as to reduce the prospects for conflict and war and to try to increase stability in cyberspace. The goal is to reduce risks from cyber threats, both from state actors and from malicious cyber activity that may be sponsored by states,” Markoff said at a briefing with reporters from around the world.
Although all 193 states are members of the United Nations, which also participated in the development of the framework, not all act in accordance with its provisions.
“There are states that provide voice support and act in a way that contradicts it,” Markoff said.
The Framework for Responsible Behavior in Cyberspace, which was released in May 2021, consists of three frameworks. These include affirming the applicability of international law to state conduct in cyberspace, the same rules that govern kinetic warfare. The second element is confidence-building measures, which are a form of cooperative agreement designed to ensure rapid communication and clear transparency in terms of intent through the publication of doctrine and strategies. The final element is an additional set of norms that creates a standard of behavior to which all states must adhere in peacetime.
Markoff believes the US has come up with a better approach to get countries to fall in line. When a state actor steps out of line, the US can rally countries that support the structure to take action against the misbehaving state. Thus, countries can call out “bad behavior” in cyberspace, thereby sending a strong signal to the offending state that such behavior is not acceptable.
This is behind recent calls by a coalition of states for countries such as Russia to change their bad behavior in cyberspace. For example, in February 2020, the UK, Georgia and the US accused Russian military intelligence of being responsible for significant cyber attacks against Georgia. In July 2022, the EU also accused pro-Russian hackers of “malicious cyber activities affecting international peace, security and stability”.