October 2018 The Digital Deciders How a group of often overlooked countries could hold the keys to the future of the global internet Robert Morgus, Jocelyn Woolbright, & Justin Sherman Last edited on October 22, 2018 at 9:24 a.m. EDT Acknowledgments We would like to thank Jason Healey, Trey Herr, Pavlina Ittleson, Adam Segal, and Ian Wallace for their thoughtful comments on earlier drafts, as well as all those who participated in our research survey. In addition, we owe a special debt of gratitude to Loren Risenfeld, Ellie Budzinski, and Maria Elkin, without whom’s help the data we collected would be far less useful. Finally, Tim Maurer, now of Carnegie Endowment for International Peace, was instrumental in the formulation of the ideas behind this report. This paper was produced as part of the Florida International University - New America Cybersecurity Capacity Building Partnership (C2B Partnership). newamerica.org/cybersecurity-initiative/reports/digital-deciders/ 2 About the Author(s) and local level, within the U.S. government and industry, and internationally. Robert Morgus is a senior policy analyst with New America’s Cybersecurity Initiative and International Security program and the deputy director of the FIU- New America C2B Partnership. Jocelyn Woolbright was an intern with New America’s Cybersecurity Initiative and is a recent graduate of Florida International University. Justin Sherman was an intern with New America’s Cybersecurity Initiative and a student at Duke University. About New America We are dedicated to renewing America by continuing the quest to realize our nation’s highest ideals, honestly confronting the challenges caused by rapid technological and social change, and seizing the opportunities those changes create. About Cybersecurity Initiative The goal of New America’s Cybersecurity Initiative is to bring the key attributes of New America’s ethos to the cybersecurity policy conversation. In doing so, the Initiative provides a look at issues from fresh perspectives, an emphasis on cross-disciplinary collaboration, a commitment to quality research and events, and dedication to diversity in all its guises. The Initiative seeks to address issues others can’t or don’t and create impact at scale. About FIU-New America C2B Partnership The Cybersecurity Capacity Building (C2B) Partnership is a partnership between Florida International University and New America designed to develop knowledge and policies aimed at building the cybersecurity capacity in the workforce, at the state newamerica.org/cybersecurity-initiative/reports/digital-deciders/ 3 Contents Introduction 5 Internet Governance and Today’s Context 8 Two Poles and Three Clusters 11 Sovereign and Controlled 13 Global and Open (albeit without consensus on how) 16 The Digital Deciders 18 Understanding the Clusters Through Data 20 Analyzing the Clusters 22 Sovereign and Controlled 13 Global and Open 24 The Digital Deciders 18 Conclusion 39 newamerica.org/cybersecurity-initiative/reports/digital-deciders/ 4 Introduction Which futures [for the internet] seem to be more likely today? ... [C]ountless experts made gloomy projections for the next five years. Cyber risks will continue to rise significantly in the near future. Technological and process innovation might help some organizations, but overall there is little on the immediate horizon that suggests that cyberattacks will become less common. With the massive profusion of recent tension between major military powers, the trend is perhaps more towards a Clockwork Orange or Leviathan Internet.1 - Jason Healey and Barry Hughes In 2015, Jason Healey and Barry Hughes created a model to project the impact that different versions of a future internet would have, principally focused on the economy. In their paper analyzing the model, Healey and Hughes describe a number of alternate futures. Among them were the Base Case—which continued general trends of the time resulting in an internet that is mostly global and open— and the Clockwork Orange and Leviathan internets—whose main features were fragmentation and national borders.2 Today, this global and open model is under pressure, and we risk drifting towards an internet that we do not want—a Clockwork Orange or Leviathan. Amidst a massive global dialogue about cyber norms—who should not attack what and how—we are losing sight of the forest in favor of individual trees. Though important, the grand prize here is not an agreement about not attacking hospitals or financial institutions. Rather, the prize is the norm that the internet should be a place that is global and open to the free flow of content, not narrowly sovereign and closed. The ultimate trajectory of this process will depend just as much, if not more, on domestic developments around the world as sweeping debates at international forums. Put simply, what countries do nationally will have an international impact, while we often focus on the international governance, the internet as it affects people is the internet in countries. In parallel to domestic developments, countries will continue to do what they have done for decades and seek legitimacy and cover via international agreement and norms. newamerica.org/cybersecurity-initiative/reports/digital-deciders/ 5 The prize is the norm that the internet should be a place that is global and open to the free flow of content, not narrowly sovereign and closed. In the debate over internet governance, three clusters of states have emerged. On one end of the spectrum sit a number of countries—spearheaded by the likes of Russia and China—that advocate for greater sovereign control over as series of interconnected but nationally distinct internets. On the other end of the spectrum sits a cluster of states that advocate for an open, global internet. Traditionally, both sides have argued for a global norm that fits their own national interest and that which they view to be in the interest of the rest of the world. The third cluster of states is what we refer to as the Digital Deciders—a group of states undecided or unconcerned about the best trajectory for the internet. If we want to build our version of the internet—one where the internet is free, open, and global and sovereign internets are an anomaly—we will need to do a better job of building our coalition more broadly. The fear that a country will not be able to manage the looming LikeWars3 is one of the factors most likely to push individual states away from an open and global internet. As we alluded to in The Idealized Internet vs. Internet Realities, one of the biggest challenges for proponents of a global and open internet will be developing a model to manage security—both likewars and cybersecurity—while maintaining openness.4 This paper and the accompanying data tools are a means for diplomats to analyze these Digital Deciders in the pursuit of a better international strategy for cyberspace. The different rankings and data sets in this paper can shed light on things like who to prioritize for engagement and how to engage different countries. At the end of the day, the purest and openest model may not be the one to offer for emulation. As Healey and Hughes note: Deciding how to steer between alternate futures to guide policy often results in a very basic problem of political philosophy worthy of Hobbes, Locke, and Rousseau: Is it better to avoid the worst cyber futures or to aim for the best? Of course, we want the best cyberspace for ourselves and our children, but when humanity has aimed for heaven, then missed, we have often wound up in hell.5 newamerica.org/cybersecurity-initiative/reports/digital-deciders/ 6 Being able to clamp down on hate speech, for example, may be in the best interest of a country and its people. It may be necessary, even desirable, to compromise some absolute freedoms in order to maintain security. This paper proceeds as follows. In the next section, we provide a background and context for this broad debate. In the third section, we describe the three clusters of states that have emerged. In the following section, we provide a data tool to explore those clusters and the states in them in greater detail. We finish by providing our own light analysis of the data and what it means for policymakers. newamerica.org/cybersecurity-initiative/reports/digital-deciders/ 7 Internet Governance and Today’s Context Internet governance is the simplest, most direct, and inclusive label for the ongoing set of disputes and deliberations over how the Internet is coordinated, managed, and shaped to reflect policies.6 - Milton Mueller In April 2014, New America conducted a study on swing states in internet governance.7 Using the informal vote at the World Conference on International Telecommunications as a barometer, we identified two camps—one in favor of a multistakeholder governance model and the other favoring state control over the internet and the baggage that comes with it. In between these two camps was a group of potential swing states. Using a series of qualitative and quantitative metrics, we identified what we believed to be the top 30 most influential swing states in internet governance. At the time of that publication, the world was still trying to make sense of new internet realities. But a lot has changed since early 2014. Specifically, three trends have come to the forefront, each of which have impacted the state of internet governance around the globe: 1. Shifts in the broader political context and an uptick in the emphasis on sovereignty, on the internet and other aspects of international politics; 2. An increase in awareness of online disinformation, the awareness being something of a novelty in Western Europe and the Americas; 3. The IANA transition, which transferred administrative oversight of core internet functions out of the U.S.