In May 2015, Russia and China signed a “nonaggression pact” in cyberspace. They agreed not to target each other with cyber attacks and promote the idea of sovereignty in cyberspace. China and Russia are now seeking to eliminate virtual private network services (VPN’s) from their respective internet space. Russian President Vladimir Putin recently signed a restrictive law banning VPN’s, and China, seeking to build a “great firewall,” has forced Apple to remove VPN’s from its Chinese iOS AppStore.
Furthermore, China’s new cybersecurity law requires network operators to reveal both identities of users as well as their technical capabilities. Some Western technology companies have agreed to provide Russia’s intelligence service, the FSB, with their source code as a requirement for access to the Russian market.
Russia and China have sought to commit other BRICS [Brazil, Russia, India, China, South Africa] nations to their concept of cyber sovereignty, which would eliminate anonymity over the internet. Neither China nor Russia trusts its own citizens’ freedom of expression and access to the world via the internet. Circumvention of this increasingly restrictive cyberspace entails significant risk of discovery given Russian and Chinese sophisticated monitoring technical tools.
With the 2018 Russian presidential election in sight, Putin likely took the preemptive measure of restricting internet access to degrade opposition efforts to mobilize, including with internet-enabled leaderless protests of the sort that were so prevalent in 2011 and 2012. Based on experiences dealing with Hong Kong street protests and popular disturbances in Tibet during the Beijing Olympics, China is likewise concerned about the internet being used as a medium to produce unrest.
There has long been a tension between international humanitarian law and the individual state’s territorial integrity. International law implies a duty not to intervene in the internal affairs of sovereign states, but exceptions are made for human rights violations.
While seeking to impose cyber sovereignty in its own internet space, Russia and China have also been nefarious users of cyberspace. Russia has allegedly hacked into U.S. and European election campaigns to conduct influence operations. China allegedly hacked into the Office of Personnel Management (OPM) to steal U.S. government employee data and into U.S. defense contractors to pilfer military secrets. Combining cyber with land, air, and sea attacks, Russia mounted the first ever hybrid war against Georgia in 2008. NATO members and other potential enemies of China and Russia must consider the extent to which their critical infrastructure and financial systems are vulnerable to asymmetric cyber warfare.
Former President of Estonia Toomas Hendrik Ilves, who has argued eloquently for a transparent internet that enables free expression and commerce, embodies the antithesis of the Russian and Chinese cyber sovereignty ethos. For Estonia, the alleged Russian 2007 distributed denial of service (DDoS) attacks were a short-term curse, which enlightened Estonian leadership and transformed into a long-term blessing. Estonia became a leader in cybersecurity and now hosts the NATO Cooperative Cyber Defense Center of Excellence.
Cybersecurity is based on trust, accountability, and integrity of data. At the heart of the debate is whether cyberspace will enable free movement of people and ideas across national boundaries while serving as a commercial force multiplier, or instead, become a hostile battleground, where nefarious state and non-state actors mount attacks that target the integrity of global cyberspace while seeking domestically to restrict their citizens’ freedom of expression.
China and Russia are seeking to limit the free flow of ideas, which decimated past totalitarian regimes like the Soviet Union. Will internet restrictions designed for political repression severely damage China’s global ability to compete economically? Will Chinese and Russian citizens stay one step ahead of their government big brother watchers with technology for secure internet communication with the outside world, including liberal thinking that so threatens China’s and Russia’s regime security?
The U.S. and its allies, who seek to apply the same liberties their citizens enjoy domestically to global cyberspace, are arguably already engaged in low intensity cyber war with nefarious state and non-state actors like China and Russia. Having weaponized sophisticated cyber capabilities as an asymmetric tool targeted against the U.S. and its allies with an eye towards leveling the diplomatic, economic, military, and intelligence playing field, Russia and China do not need to launch the cataclysmic attack against our infrastructure, of which they are capable, in order to represent an existential threat to U.S. national security.