Tue Jul 20

Calling out China for cyberattacks is risky — but a lawless digital world is even riskier

Written by Alexander Gillespie, Professor of Law, University of Waikato

Today’s multi-country condemnation of cyber-attacks ^[1] by Chinese state-sponsored agencies was a sign of increasing frustration at recent behaviour. But it also masks the real problem — international law isn’t strong or coherent enough to deal with this growing threat.

The coordinated announcement by several countries, including the US, UK, Australia and New Zealand, echoes the most recent threat assessment ^[2] from the US intelligence community: cyber threats from nation states and their surrogates will remain acute for the foreseeable future.

Joining the chorus against China may be diplomatically risky ^[3] for New Zealand and others, and China has already described the claims as “groundless and irresponsible”. But there is no doubt the problem is real.

The latest report ^[4] from New Zealand’s Government Communications Security Bureau (GCSB) recorded 353 cyber security incidents in the 12 months to the middle of 2020, compared with 339 incidents in the previous year.

Given the focus is on potentially high-impact events targeting organisations of national significance, this is likely only a small proportion of the total. But the GCSB estimated state-sponsored attacks accounted for up to 30% of incidents recorded in 2019-20.

Since that report, more serious incidents have occurred, including attacks on the stock-exchange ^[5] and Waikato hospital ^[6]. The attacks are becoming more sophisticated ^[7] and inflicting greater damage.

Globally, there are warnings that a major cyberattack could be as deadly as a weapon of mass destruction ^[8]. The need to de-escalate is urgent.

Global solutions missing

New Zealand would be relatively well-prepared to cope with domestic incidents using criminal ^[9], privacy ^[10] and even harmful digital communications ^[11] laws. But most cybercrime originates overseas, and global solutions don’t really exist.

In theory, the attacks can be divided into two types — those by criminals and those by foreign governments. In reality, the line between the two is blurred.

Dealing with foreign criminals is slightly easier than combating attacks by other governments, and Prime Minister Jacinda Ardern has recognised the need for a global effort ^[12] to fight this kind of cybercrime.

To that end, the government recently announced New Zealand was joining ^[14] the Council of Europe’s Convention on Cybercrime ^[15], a global regime signed by 66 countries ^[16] based on shared basic legal standards, mutual assistance and extradition rules.

Unfortunately, some of the countries most often suspected of allowing international cybercrime to be committed from within their borders have not signed, meaning they are not bound by its obligations.

That includes Russia, China and North Korea. Along with several other countries not known for their tolerance ^[17] of an open, free and secure ^[18] internet, they are trying to create an alternative international cybercrime regime, now entering a drafting process through the United Nations ^[19].

Cyberattacks as acts of war

Dealing with attacks by other governments (as opposed to criminals) is even harder.

Only broad principles exist, including that countries refrain from the threat or use of force ^[20] against the territorial integrity or political independence of any state, and that they should behave in a friendly ^[21] way towards one another. If one is attacked, it has an inherent right of self-defence ^[22].

Malicious state-sponsored cyber activity involving espionage, ransoms or breaches of privacy might qualify as unfriendly and in bad faith, but they are not acts of war.

However, cyberattacks directed by other governments could amount to acts of war if they cause death, serious injury or significant damage to the targeted state. Cyberattacks that meddle in foreign elections may, depending on their impact, dangerously undermine peace.

And yet, despite these extreme risks, there is no international convention governing state-based cyberattacks in the ways the Geneva Conventions ^[24] cover the rules of warfare or arms control conventions ^[25] limit weapons of mass destruction.

Vladimir Putin shaking hands with Joe Biden

Drawing a red line on cybercrime: US President Joe Biden meets Russian President Vladimir Putin in Geneva in June. GettyImages

Risks of retaliation

The latest condemnation of Chinese-linked cyberattacks notwithstanding, the problem is not going away.

At their recent meeting in Geneva, US President Joe Biden told his Russian counterpart, Vladimir Putin, the US would retaliate ^[26] against any attacks on its critical infrastructure ^[27]. A new US agency aimed at countering ransomware attacks would respond in “unseen and seen ways ^[28]”, according to the administration.

Such responses would be legal under international law if there were no alternative means of resolution or reparation, and could be argued to be necessary and proportionate.

Also, the response can be unilateral or collective, meaning the US might call on its friends and allies to help. New Zealand has said it is open to the proposition ^[29] that victim states can, in limited circumstances, request assistance from other states to apply proportionate countermeasures against someone acting in breach of international law.

A drift towards lawlessness

But only a month after Biden drew his red line with Putin, another massive ransomware attack ^[31] crippled hundreds of service providers across 17 countries ^[32], including New Zealand schools and kindergartens ^[33].

The Russian-affiliated ransomware group REvil that was probably behind the attacks mysteriously disappeared ^[34] from the internet a few weeks later.

Things are moving fast and none of it is very reassuring. In an interconnected world facing a growing threat from cyberattacks, we appear to be drifting away from order, stability and safety and towards the darkness of increasing lawlessness.

The coordinated condemnation of China by New Zealand and others has considerably upped the ante. All parties should now be seeking a rules-based international solution or the risk will only grow.