Global Cybercrime: the Interplay of Politics and Law Aaron Shull INTERNET GOVERNANCE PAPERS PAPER NO
Total Page:16
File Type:pdf, Size:1020Kb
INTERNET GOVERNANCE PAPERS PAPER NO. 8 — JUNE 2014 Global Cybercrime: The Interplay of Politics and Law Aaron Shull INTERNET GOVERNANCE PAPERS PAPER NO. 8 — JUNE 2014 Global Cybercrime: The Interplay of Politics and Law Aaron Shull Copyright © 2014 by the Centre for International Governance Innovation The opinions expressed in this publication are those of the author and do not necessarily reflect the views of the Centre for International Governance Innovation or its Operating Board of Directors or International Board of Governors. This work was carried out with the support of The Centre for International Governance Innovation (CIGI), Waterloo, Ontario, Canada (www.cigionline.org). This work is licensed under a Creative Commons Attribution — Non-commercial — No Derivatives License. To view this license, visit (www.creativecommons.org/licenses/ by-nc-nd/3.0/). For re-use or distribution, please include this copyright notice. ACKNOWLEDGEMENT CIGI gratefully acknowledges the support of the Copyright Collective of Canada. CONTENTS About Organized Chaos: Reimagining the Internet Project 1 About the Author 1 Executive Summary 2 Introduction 2 Contemporary Cybercrime: Night Dragon and the US Indictments 4 The Indictments and US-China Relations 4 The Night Dragon Attacks 5 The Application of Domestic Law to International Cybercrime 5 Substantive Criminal Prohibitions 6 Prosecuting Under US Law 8 Extraterritorial Application of Domestic US Criminal Law 9 Enforcement Jurisdiction 10 Chinese Cyber Law and Strategic Interests 11 International Law 13 Conclusion 14 Works Cited 16 About CIGI 18 GLOBAL CYBERCRIME: THE INTERPLAY OF POLITICS AND LAW ABOUT ORGANIZED CHAOS: ABOUT THE AUTHOR REIMAGINING THE INTERNET Aaron Shull is a research fellow and CIGI’s counsel PROJECT and corporate secretary. An expert in global security Historically, Internet governance has been issues and international law, he contributes to research accomplished en passant. It has emerged largely from activity under CIGI’s Global Security & Politics Program the actions of computer scientists and engineers, and International Law Research Program, and advises in interaction with domestic legal and regulatory CIGI’s senior management on a range of legal issues systems. Beginning at least with the 2003–2005 Called to the Bar in 2009, Aaron has practised law for World Summit on the Information Society process, a number of organizations, focusing on international, however, there has been an explicit rule-making regulatory and environmental law. He has taught agenda at the international level. This strategic courses at the Faculty of Law, University of Ottawa and agenda is increasingly driven by a coalition of states the Norman Paterson School of International Affairs, — including Russia, China and the Arab states — that and was previously a staff editor for the Columbia is organized and has a clear, more state-controlled Journal of Transnational Law. and monetary vision for the Internet. Advanced industrial democracies and other states committed to existing multi-stakeholder mechanisms have a different view — they regard Internet governance as important, but generally lack coherent strategies for Internet governance — especially at the international level. Given the Internet’s constant evolution and its economic, political and social importance as a public good, this situation is clearly untenable. A coherent strategy is needed to ensure that difficult trade-offs between competing interests, as well as between distinct public values, are managed in a consistent, transparent and accountable manner that accurately reflects public priorities. Guided by these considerations, CIGI researchers believe they can play a constructive role in creating a strategy for states committed to multi-stakeholder models of Internet governance. In aiming to develop this strategy, the project members will consider what kind of Internet the world wants in 2020, and will lay the analytical groundwork for future Internet governance discussions, most notably the upcoming decennial review of the World Summit on the Information Society. This project was launched in 2012. The Internet Governance Paper Series will result in the publication of a book titled Organized Chaos: Reimagining the Internet in 2014. AARON SHULL 1 CIGIONLINE.ORG INTERNET GOVERNANCE PAPERS: PAPER NO. 8 EXECUTIVE SUMMARY bug exposed a good portion of secure servers to potentially nefarious infiltration, eBay was hacked Examining global cybercrime as solely a legal and security vulnerabilities at US retailer Target issue misses an important facet of the problem. compromised the credit card data of millions of Understanding the applicable legal rules, both customers. At the same time that private companies domestically and internationally, is important. struggle to address the severity of these intrusions, However, major state actors are using concerted many governments are left in a difficult position. efforts to engage in nefarious cyber activities with Seen as the natural bulwark against criminal activity, the intention of advancing their economic and the government is charged with the responsibility for geostrategic interests. This attempt to advance a interdicting illicit enterprise. However, cybercrime is narrow set of economic interests through cybercrime an international phenomenon and national laws do and economic cyber espionage holds to the potential not typically extend past the border. What is lacking to erode the trust in the digital economy that has been is a coordinated international response that matches a necessary condition for the success of the Internet the gravity of circumstance. as an economic engine for innovation and growth. By pursuing these efforts, states are prioritizing The coordination necessary at the international level short-term interests over long-term stability and is unlikely to be forthcoming in the near future. a responsibly governed, safe and secure Internet While there is an international convention aimed platform. This paper explores the recent unsealing at combatting cybercrime, the treaty has been of a 31-count indictment against five Chinese criticized for being regional in nature as opposed to government officials and a significant cyber breach, truly global, and for being an ineffective mechanism perpetrated by Chinese actors against Western oil, because of its failure to attract the adherence of a energy and petrochemical companies. The paper number of the largest and most powerful states concludes by noting that increased cooperation (Marion 2010). As the authors of other papers in among governments is necessary, but unlikely to this series have made clear in their contributions, occur as long as the discourse surrounding cybercrime there is a tremendous amount of uncertainty in the remains so heavily politicized and securitized. If Internet governance policy space. Ronald J. Deibert governments coalesced around the notion of trying noted the need for coordination at multiple levels to prevent the long-term degradation of trust in the with a wide variety of stakeholders. James A. Lewis online economy, they may profitably advance the recognized the need for different roles among the dialogue away from mutual suspicion and toward multi-stakeholder community with an explicit mutual cooperation. role for government. Keeping in line with these authors, this paper argues that global cybercrime INTRODUCTION is an area of Internet governance that calls out for Global cybercrime has become a modern economic increased cooperation among and between states plague. It has decimated corporations, increased and transnational stakeholders. The problem is transaction costs, undermined trust in electronic that effectively interdicting acts of international commerce and exposed the sensitive personal data cybercrime is not simply a legal challenge; it is an of millions of Internet users. Hardly a day goes by inherently political one as well. without a front-page story addressing some new vulnerability. Earlier this year, the “Heartbleed” AARON SHULL 2 CIGIONLINE.ORG GLOBAL CYBERCRIME: THE INTERPLAY OF POLITICS AND LAW This paper is an attempt to analyze, from domestic and this should not be taken to mean that the concerns set international perspectives the stark legal challenges out are unique to the relationship between these two created by the ever-intensifying glut of cybercrime governments. Rather, the reality is that cybercrime is committed across national borders. The point here truly global, touching governments, companies and is not to be alarmist about the increase in crime individuals all around the world. The relationship committed over the Internet, or about the amount between the United States and China is simply one of money, intellectual property or confidential example that can be used to demonstrate the legal, information being stolen. Rather, the purpose is to political and technical challenges implicated in this show, from a legal perspective, just how difficult it is policy arena. to successfully bring an international cybercriminal The second part of this paper will provide additional to justice, while shedding some additional light on background on the recent indictment of various the interplay between global politics and law in this Chinese officials by the US Attorney General and the area of Internet governance. Night Dragon attack. In this context, the third part In order to accomplish this, these systemic tensions focuses on the specific legal problems faced when will be