Balancing Interests: A Path Towards an International Convention for Cyber Weapons Arms Control

Introduction

A fundamental principal and international relations and international law is that nation states will not agree to an international convention unless it is in their interest. In the pressing issue of the arms race in cyber weapons, we need to think about a balancing of interest between various countries, large and small, powerful, and not so powerful.

Different Nation States Have Different Interests

Let's think first about the cyber superpowers. What are their interests? First of all, like any superpower, there is an interest in maintaining the power that already has been acquired. This would mean that in order to agree to a cyber weapons convention nothing, absolutely nothing, in the convention could be interpreted as reducing the relative cyber power of the nation state.

Second, we have a class of middle level cyber powers these countries or nation states have a reasonable computer and telecommunications industry, and are advanced in use of information technology. They are developed countries, but are not superpowers. Their interest is in having stability in the international system.

Next, in this simplified model of the international system, we have the cyber non-powers. These are nation states that do not have significant innovation or activity in the world of cyber. But like all nation states, they are heavily dependent upon cyber for their economies and their communication systems. What is their interest?

The interest of the weaker cyber powers is to be protected in case they are attacked from their adversaries. This means, for example, that if they are attacked by cyber then these weaker powers should have some type of security guarantee that would ensure the international community would promptly take the necessary actions for their protection.

In summary, the cyber superpowers have an interest in maintaining their power and are interested in a treaty only if it does not interfere with this objective. The medium level powers are interested in global stability so that they can have effectively functioning economies and societies. The cyber weaker powers are interested in some type of security guarantee so that if they come under attack in the realm of cyber, then the international community would be prepared to help them out.

Interests of the Private Sector

The success or the effectiveness of an international convention for arms control can be very dependent upon the corporation of the private sector. Let's look at two examples and see a contrast.

Chemical Weapons Convention :

In the negotiations for the adoption of the chemical weapons convention the role of the worlds chemical industry was paramount. It was necessary to get cooperation between various industries in this sector, so that the secretariat of the organization could monitor flows of material and also obtain and interact with expertise as needed. In addition, the private sector needed to agree that it would not participate or cooperate in activities that could lead to the development of chemical weapons. Perhaps we can consider it to be a miracle of diplomacy, comma, but indeed it was possible to get cooperation from the various major chemical industries around the world. As a result, the chemical weapons convention created a set of arrangements for monitoring and control of these dangerous weapons of mass destruction.

Biological Weapons Convention :

In the negotiations for the biological weapons convention, it was not repeat not possible to get cooperation from the biotech industry. Why? There were concerns expressed about the importance of intellectual property in this particular industry. There was a fear on the part of industry that any type of inspection or data collection by outside experts would inevitably lead to the leak of confidential information that was protected either by patent or more likely by the nature of being trade secrets. This resistance ultimately resulted in a complete failure and obtaining this cooperation.

What is the result? In general, it is a reasonable assessment that the overall set of arrangements for the control of biological weapons is considerably weaker than the parallel system for controlling the proliferation of chemical weapons.

Implications :

What can we conclude from this situation? There is a simple lesson here. The lesson is that without the corporation of the private sector in an industry that is highly dependent upon the private sector any convention or system of arrangements for control of weapons will not be effective or will fail completely if there is opposition (or passive lack of support) from the private sector.

Of course it is possible for governments to strong-arm the private sector. But the arguments for doing so would be weakened if the private sector (or in many cases the stat-owned sector) could make the argument that by giving into these demands their overall competitive position would be weakened, vis-à-vis, their counterparts based in other nation states. And of course, depending on the country to a certain extent, there is a significant amount of political power that may be exercised by the private sector or by large commercial interest that are closely allied with or partially owned by the government. As a result, we can conclude that it would be better to have cooperation and agreement with the private sector.

Bringing In the Private Sector :

There is really only one way to make sure there is robust corporation from the private sector. Money. Whatever is done in the control of the global cyber weapons arms race must present a substantial commercial opportunity for those companies that are closely involved in this sector. Here, the enterprises concerned foremost are in the cyber security industry. If the cyber security industry is vehemently opposed to such a convention, then likely it will never be agreed to. But if they can see a substantial possibility for commercial gain, then they likely will be interested. The question is what would be the basis of such incentives?

Conclusion

What could be the incentives to the world's cybersecurity industry?

We will examine that in the next blog entry.