Research Volume Five Global Commission on Internet Governance Cyber Security in a Volatile World Research Volume Five Global Commission on Internet Governance Cyber Security in a Volatile World Published by the Centre for International Governance Innovation and the Royal Institute of International Affairs The copyright in respect of each chapter is noted at the beginning of each chapter. The opinions expressed in this publication are those of the authors and do not necessarily reflect the views of the Centre for International Governance Innovation or its Board of Directors. This work was carried out with the aid of a grant from the International Development Research Centre (IDRC), Ottawa, Canada. The views expressed herein do not necessarily represent those of IDRC or its Board of Governors. This work is licensed under a Creative Commons Attribution — Non-commercial — No Derivatives License. To view this licence, visit (www.creativecommons.org/licenses/ by-nc-nd/3.0/). For re-use or distribution, please include this copyright notice. Centre for International Governance Innovation, CIGI and the CIGI globe are registered trademarks. 67 Erb Street West 10 St James’s Square Waterloo, Ontario N2L 6C2 London, England SW1Y 4LE Canada United Kingdom tel +1 519 885 2444 fax +1 519 885 5450 tel +44 (0)20 7957 5700 fax +44 (0)20 7957 5710 www.cigionline.org www.chathamhouse.org TABLE OF CONTENTS About the Global Commission on Internet Governance . .iv . Preface . v Carl Bildt Introduction: Security as a Precursor to Internet Freedom and Commerce . .1 . Laura DeNardis Chapter One: Global Cyberspace Is Safer than You Think: Real Trends in Cybercrime . .5 . Eric Jardine Chapter Two: The Impact of the Dark Web on Internet Governance and Cyber Security . 29. Michael Chertoff and Tobby Simon Chapter Three: The Dark Web Dilemma: Tor, Anonymity and Online Policing . .37 . Eric Jardine Chapter Four: The Tor Dark Net . .51 . Gareth Owen and Nick Savage Chapter Five: Connected Choices: How the Internet Is Challenging Sovereign Decisions . 63. Melissa E. Hathaway Chapter Six: Increasing Internet Connectivity While Combatting Cybercrime: Ghana as a Case Study . .77 . Caroline Baylon and Albert Antwi-Boasiako Chapter Seven: Critical Infrastructure and the Internet of Things . 93. Tobby Simon Chapter Eight: Combatting Cyber Threats: CSIRTs and Fostering International Cooperation on Cyber Security . 105. Samantha Bradshaw Chapter Nine: Toward a Social Compact for Digital Privacy and Security . 121 Statement by the Global Commission on Internet Governance About CIGI. 133 About Chatham House . 133. CIGI Masthead . 133 ABOUT THE GLOBAL COMMISSION ON INTERNET GOVERNANCE The Global Commission on Internet Governance was established in January 2014 to articulate and advance a strategic vision for the future of Internet governance. The two-year project conducted and supported independent research on Internet-related dimensions of global public policy, culminating in an official commission report — One Internet, published in June 2016 — that articulated concrete policy recommendations for the future of Internet governance. These recommendations address concerns about the stability, interoperability, security and resilience of the Internet ecosystem. Launched by two independent global think tanks, the Centre for International Governance Innovation (CIGI) and Chatham House, the Global Commission on Internet Governance will help educate the wider public on the most effective ways to promote Internet access, while simultaneously championing the principles of freedom of expression and the free flow of ideas over the Internet. The Global Commission on Internet Governance focuses on four key themes: • enhancing governance legitimacy — including regulatory approaches and standards; • stimulating economic innovation and growth — including critical Internet resources, infrastructure and competition policy; • ensuring human rights online — including establishing the principle of technological neutrality for human rights, privacy and free expression; and • avoiding systemic risk — including establishing norms regarding state conduct, cybercrime cooperation and non- proliferation, confidence-building measures and disarmament issues. The goal of the Global Commission on Internet Governance is two-fold. First, it will encourage globally inclusive public discussions on the future of Internet governance. Second, through its comprehensive policy-oriented report, and the subsequent promotion of this final report, the Global Commission on Internet Governance will communicate its findings with senior stakeholders at key Internet governance events. www.ourinternet.org iv • CENTRE FOR INTERNATIONAL GOVERNANCE INNOVATION • CHATHAM HOUSE PREFACE When I and my colleagues at the Centre for International Governance Innovation and Chatham House envisioned and launched the Global Commission on Internet Governance (GCIG) in 2014, we were determined to approach the work ahead strictly on the strength of evidence-based research. To make this possible, we commissioned nearly 50 research papers, which are now published online. We believe that this body of work represents the largest set of research materials on Internet governance to be currently available from any one source. We also believe that these materials, while they were essential to the GCIG’s discussions over these past months, will also be invaluable to policy development for many years to come. The GCIG was fortunate to have Professor Laura DeNardis as its director of research, who, along with Eric Jardine and Samantha Bradshaw at CIGI, collaborated on identifying and commissioning authors, arranging for peer review and guiding the papers through the publication process. Questions about the governance of the Internet will be with us long into the future. The papers now collected in these volumes aim to be forward looking and to have continuing relevance as the issues they examine evolve. Nothing would please me and my fellow Commissioners more than to receive comments and suggestions from other experts in the field whose own research has been stimulated by these volumes. The chapters you are about to read were written for non-expert netizens as well as for subject experts. To all of you, the message I bring from all of us involved with the GCIG is simple — be engaged. If we fail to engage with these key governance questions, we risk a future for our Internet that is disturbingly distant from the one we want. Carl Bildt Chair, GCIG November 2016 CARL BILDT • v INTRODUCTION: SECURITY AS A PRECURSOR TO INTERNET FREEDOM AND COMMERCE INTRODUCTION: SECURITY AS A PRECURSOR TO INTERNET FREEDOM AND COMMERCE Laura DeNardis Copyright © 2017 by Laura DeNardis LAURA DENARDIS • 1 RESEARCH VOLUME FIVE: CYBER SECURITY IN A VOLATILE WORLD INTRODUCTION Turkey, the United Kingdom and the United States.1 The 2017 poll indicated that a majority of global respondents Security as a Precursor to Internet Freedom were more concerned about their online privacy relative and Commerce to the previous year, and that the top concern among those worried about their privacy was cybercrime (82 The global digital economy, democracy and the public percent), followed by Internet companies (74 percent) and sphere now completely depend upon the stability and governments (65 percent) (see Table 1). security of cyberspace. Encryption technologies are This concern is perhaps explainable by respondents’ necessary to protect data privacy, authenticate websites awareness of high-profile consumer-data breaches of major and secure online transactions. Security problems such retail, financial and insurance companies, but also their as consumer data breaches and denial-of-service attacks recognition of government surveillance of citizens and disrupt the digital economy and the public sphere. They also corporate data-gathering practices that collect and share can have chilling effects on speech and online behaviour. personal information to support business models based on As everyday physical objects from cars to home appliances targeted online advertising. increasingly become Internet-connected, human safety in the real world also depends upon cyber security. Trust This research volume sets out to quantitatively and in digital infrastructure is now necessary for the capacity qualitatively examine the state of global cyber security and to communicate, access knowledge, use one’s banking address what can be done differently to improve security, system, drive a car and buy products through an online stability and trust online. Even in the midst of rising public commerce site such as Amazon. Democracy also depends awareness and concern about cyber security breaches and upon cyber security, considering the stunning admission by digital crime, research scholar Eric Jardine quantitatively United States intelligence agencies about Russia’s influence examines, in Global Cyberspace Is Safer than You Think: Real campaign, probing of voter rolls and hacking of Democratic Trends in Cybercrime (2015a), the question of the actual National Committee emails during the 2016 presidential trends in cybercrime. He argues that the level of security campaign. Cyber security is one of the great human rights in cyberspace is, in reality, far better than depictions of the issues of our time. level of security. Cybercrime statistics are usually depicted in absolute numbers and present year-over-year statistics Cyber security is not only an issue for “Internet users” but that fail to normalize numbers