DRAFT – shared with the participants of the ICT4Peace Workshop on Existing and future norms on international ICT infrastructure and data integrity PERSPECTIVES on Responsible Behavior in State Uses of ICTs ICT4Peace Foundation 2017 DRAFT – shared with the participants of the ICT4Peace Workshop on Existing and future norms on international ICT infrastructure and data integrity FOREWORD The ICT4Peace Foundation stands for an open, neutral and inclusive promotion of a peaceful cyberspace through international negotiations with governments, companies and non-state actors, in particular on norms and confidence building measures and capacity building. Our roots in the UN World Summit on the Information Society in 2003 placed upon us the task of carefully considering all different viewpoints, arguments and proposals and to promote a broad societal acceptance of standards of responsible behavior in uses of ICTs. With the support of the Dutch Government, Microsoft and the Cyber Policy Institute, in 2014 ICT4Peace launched a process to promote and support the international cyber norms dialogue. This publication contains a collection of papers developed during this process. We offer the ‘Perspectives on Responsible Behavior in State Uses of ICTs’ as a collaborative contribution to the international community, hoping to enrich and inform further discussion of the theme. Sincerely, Dr. Daniel Stauffacher Founder and President, ICT4Peace Foundation DRAFT – shared with the participants of the ICT4Peace Workshop on Existing and future norms on international ICT infrastructure and data integrity FOREWORD It seems that in the cyber community everybody is talking about norms. The roots of this global discourse lie in fast development of information and communication technologies (ICTs). Since the early steps to create information societies in the late 1990s and early 2000s, we have heard the voices of civil society groups, business community, regional and international organizations, and the States. Cyber Policy Institute (CPI) would like to hear more. We want to contribute to an open and inclusive dialogue on responsible State behaviour in the context of ICTs. We want to promote systematic studies of norms and State practice that bypasses disciplinary, administrative and national boundaries. We seek to achieve a dialogue that acknowledges our individual differences as strengths rather than weaknesses. We seek to enhance constructive dialogue that moves mountains. CPI shares the ICT for Peace Foundation’s view that information and communication technologies are first and foremost tools of peace and development. It was the Leitmotiv of the Conference on State Practice and Future of International Law in Cyberspace we organized for the Estonian Ministry of Foreign Affairs in 2016. I hope that views from this Conference trigger fruitful dialogue where arguments and claims are shaped by shared convictions and mutual understanding. Sincerely Mika Kerttunen Director, Cyber Policy Institute TABLE OF CONTENTS Key Problems of Application of International Law to ICT environment Streltsov Comprehensive Normative Approach to Cyber Complexity Tikk Patterns of Behaviour: States in, through, and about Cyberspace Kerttunen Commentary to Paragraph 13 of the 2015 UN GGE Report Streltsov Application of International Law to Cyber Security: National Views Korzak Subversion: Normative Considerations Adamson Great Expectations: Multi-stakeholder Approach and International Cybersecurity Kerttunen Stability and Cyberspace Kerttunen & Tikk National Cyber Security Strategies: Commitment for Development Tikk & Kerttunen Address to the Participants of the Conference on State Practice and Future of International Law in Cyberspace Kaljurand DRAFT – shared with the participants of the ICT4Peace Workshop on Existing and future norms on international ICT infrastructure and data integrity KEY PROBLEMS OF APPLICATION OF INTERNATIONAL LAW TO ICT ENVIRONMENT KEYNOTE AT THE CONFERENCE ON STATE PRACTICE AND DEVELOPMENT OF INTERNATIONAL LAW TALLINN, ESTONIA MAY 5-6, 2016 Anatoly Streltsov Dear hosts of the conference! Dear participants! Ladies and gentlemen! I truly appreciate the opportunity to make a speech at such a high-level conference and talk about our point of view of the key problems arising from the application of international law to the ICT environment. This issue appears of great interest, and it has been pointed out in the Reports of the 2010, 2013 and 2015 UN Group of Government Experts. I would like to raise a few questions and offer answers that reflect our way of thinking about these issues. 1. Do the established principles and norms apply to ICT? I think that the established principles and norms apply to ICT, because of three main reasons. First. In modern conditions it is almost impossible and inexpedient to create a new branch of international law. It is not possible because the world is so changeable today and it is unreal to achieve an agreement on such complicated issue. It is inexpedient because everything new that we create will be based on existing principles and norms of international law. DRAFT – shared with the participants of the ICT4Peace Workshop on Existing and future norms on international ICT infrastructure and data integrity Second. We think that the established principles and norms of international law may be used in state practice. They have stood the test of time and reflect a certain consensus of the states concerning regulation of international relations. The states have a great experience of applying them to real causes related to maintenance of international peace and security. Third. The great challenge in this application is that there is a prominent possibility of mistake in assessment of situation, considering the misuse of ICTs for military and political purposes and attribution of the actors responsible for this activity. Such mistake may provoke international conflict and as a consequence – a threat for international peace and security. We prefer the approach of the adaptation of international law to a new field of application. It is intended to reduce the possibility of this situation. Adaptation requires interpretation of some terms from the sources of international law and development of harmonious judicial principals and procedures for fulfilment of correspondent actions. I think that such approach could help us to get the necessary effect, but also will reduce duration and cost of the task. 2. What is the environment of ICT from the standpoint of international law? In my opinion, the environment of ICT is a legal fiction, which consists in the fact that ICT environment is considered as a part of the territory of the state. This allows us to extend the concept of "sovereignty" to the ICT environment. It should be understood that the ICT environment includes two components – the cyberspace and the media sphere. Here we limit ourselves to cyberspace. The main differences of cyberspace from the other components of territory are as follows. - Cyberspace is created and exists through the efforts of people. Its creation caused the emergence of new objects of international relations (for example, an incident in the cyberspace, information system). - Objects of international relations, legal facts that determine the dynamics of changing the legal relationships and their subjects have a virtual character that is in large part invisible. This greatly limits our ability to use the witnesses and the means of objective control during investigation of incidents in cyberspace. - Cyberspace as an object that is covered by sovereignty of the state and is characterized by such aspects as inclusion in the global cyberspace and the safety of its use. They are the analogues for such properties as territorial integrity and political independence. From this point of view, a disruption of national inclusion in global cyberspace, as well as violation of the safety of its use, are similar to violation of territorial integrity and political independence. 3. What is the problem in application of "sovereignty" concept to cyberspace? It is necessary to note several aspects. DRAFT – shared with the participants of the ICT4Peace Workshop on Existing and future norms on international ICT infrastructure and data integrity First. Lack of territorial constraints of sovereignty limits the implementation of certain rules and principles of international law. For example, documentation of state border violations as a means of exercising territorial authority, as well as assurance of compliance with international obligations in the sovereign territory. Second. There are some deficiencies in the international legal regulation. Primarily it concerns the legal relations in the field of sustainability and safe use of the DNS system. Some states, for historical reasons, believe that this system falls within their jurisdiction, but there are no international obligations to ensure the stable functioning of and safe use of the system for the benefit of the entire international community. The lack of international regulation in this area limits the sovereignty of states in cyberspace. Third. The lack of legal guarantees for the respect of human rights of citizens outside the national territory (for example, privacy, the right of authorship). As you know, states are obliged to respect these rights, but when for technical reasons data leaves national territory, the implementation of international commitments becomes physically impossible. This applies to personal data, the