Depleted Trust in the Cyber Commons

Policymakers increasingly recognize the need for agreements to regulate cyber behaviors at the international level. In 2010, the United Nations Group of Governmental Experts on Developments in the Field of Infor­ mation and Telecommunications in the Context of International Secu­ rity recommended “dialogue among States to discuss norms pertaining to State use of ICTs [information and communications technology], to reduce collective risk and protect critical national and international in­ frastructure.”1 Since then, the United States, Russia, China, and several other cyber powers have proposed norms for discussion, and in November 2011, the United Kingdom convened an intergovernmental conference to discuss cyber “rules of the road.”2 These activities are a positive change from the first decade of this century, when the United States and Russia could not agree on what should be discussed and the one existing inter­ national agreement for cyberspace—the Budapest Convention on Cyber­ crime—gained little traction. Nevertheless, the search for agreement has a long way to go. Homeland Security secretary Janet Napolitano noted in summer 2011 that efforts for “a comprehensive international frame­ work” to govern cyber behaviors are still at “a nascent stage.”3 That search may well be disappointing. Council on Foreign Relations fellows Adam Segal and Matthew Waxman caution that “the idea of ultimately negotiat­ ing a worldwide, comprehensive cybersecurity treaty is a pipe dream.” In their views, differences in ideologies and strategic priorities will keep the United States, Russia, and China from reaching meaningful agreements: “With the United States and European democracies at one end and China