International Public and NGO Management

Home Syllabus Resources

Cyber-security and the Internet

7 November 2023

This week we are going to look at one of the four problems of the apocalypse, what is called cyber-security.  It is about the Internet and its various manifestations that provides information over systems that can affect infrastructure, peoples’ behavior, political conflict and international agreements.  It is part of the apocalypse because it is essentially borderless and cannot really be controlled by a state (although there can be some regulation).  Dealing with it needs international agreements, but there are almost none that have been reached.  It is also relatively new.  The Internet as we know it was really only functioning after the turn of the century but it has become a major part of 21^st Century life.

It is therefore a real challenge for the international public sector and its administration.

I. International regulation of communications

Communications have always been subject to international regulation, although how this has evolved is complex.  In fact, it was one of the first areas where international bodies dealt with regulation and the rule of law and it is still one of the last ones to have an agreement.

A. The beginning: mid-nineteenth century

The first two international organizations both had to do with communications.  This was the middle of the nineteenth century where there were two kinds of personal communications, the telegraph and mail.  Other forms like newspapers were state-regulated and their transfer across borders was easy to control.  The telegraph was a new technology where messages were sent electronically over wires.  For the messages to be transferable, there had to be an agreed type of language (e.g. Morse code), but more importantly there had to be an agreement on financing of the system.  Senders of messages could be charged in one country, but it would be harder to collect money from recipients. To set up a system to share revenue and ensure technological collaboration, the International Telegraphic Union (ITU) was created in 1865 to “to facilitate international connectivity in communications networks, we allocate global radio spectrum and satellite orbits, develop the technical standards that ensure networks and technologies seamlessly interconnect, and strive to improve access to ICTs to underserved communities worldwide.”

The second international organization was the Universal Postal Union (UPU) in 1874, which states

“With its 192 member countries, the UPU is the primary forum for cooperation between postal sector players. It helps to ensure a truly universal network of up-to-date products and services.

In this way, the organization fulfils an advisory, mediating and liaison role, and provides technical assistance where needed. It sets the rules for international mail exchanges and makes recommendations to stimulate growth in mail, parcel and financial services volumes and improve quality of service for customers.

The common reason for the agreements was business, especially for the postal services which are governmentally run, but also telecommunications that are also government regulated. 

The two organizations had secretariats, but absent an international agreement on how international secretariats would be managed, the secretariats were located in Switzerland with essentially Swiss staffers.  The ITU secretariat was located in Geneva, while the UPU was located in Bern.

B. Radio:  Beginnings in the early 20^th century

 In the early 20^th century the new communications technology was radio which, because it could broadcast over the air rather than through wires, was difficult for governments to control.  Additionally, the frequencies that radios used needed regulation because, otherwise, two radio stations might be on the same frequency and basically mess with each other.  Since the stations could be in different countries, allocation of frequencies had to be international.  To deal with this, the ITU took on the responsibilities and changed its name to the International Telecommunications Union and began to have an international secretariat.  The next addition was telephones, which also had to cross borders and therefore needed agreements on the technology and on the issues of payment.  This added a new dimension to the ITU work since the telephone companies in some countries were government-run, while in others they were private sector.  To deal with this the ITU established a process for bringing private companies on-board. 

By the middle of the century, television became an additional communications technology and that had to be brought on board and, finally, after the 1960’s space satellites began to provide a new method of fomenting communication that was obviously beyond national borders.

C. The Internet: Origins in the late 20^th century

The Internet is a relatively recent communication medium, having been first set up in 1970 to connect defense researchers in the United States.   Some years later, the concept of a web to manage the communication was added and has become the main means of international communication.  The method is based on converting information into packets and then sending them through various channels.  Because the packets can be sent through multiple channels and only combined at the end, regulation of content is almost impossible.  There are a number of areas where regulation challenges exist and these have become more important as the Internet has expanded and developed.

II. Issues of regulation of the Internet

In effect there are four: the technology, the addressing system, the channels used,  how content can be transferred how the content of the messages sent can be regulated.

A.    The technology

To make the Internet run, there has to be software that allows messages to be sent.  There have to be computers and servers that send and save the messages and there have to be storage methods.  The basic software to run the Internet, that can be used on computers, is largely developed by private companies like Microsoft, Google and Apple.  They have to include software that allows the messages to be sent consistently and to a large extent this has been developed by a non-governmental organization, the Internet Society.  As they note in a page on Changes in Our Work in 2021:

Here at the Internet Society, we believe that the Internet is for everyone. Our work focuses on ensuring that the Internet remains open, globally-connected, trustworthy, and secure.

In 2020, we saw the world change in ways that no one could have anticipated.  Because of this, like so many other organizations, we had to assess our current and future plans and evaluate the resources available to us. As a result, we have made some changes to our activities for the upcoming year.

Moving into 2021, we will reduce activities related to our Open Standards Everywhere (OSE) and Time Security projects.

We still deeply believe that open Internet standards and securing the Internet’s time synchronization infrastructure are critical components for building an open and trustworthy Internet. So, while OSE and Time Security will no longer be standalone projects next year, we will continue to promote and defend these concepts through our other projects, initiatives, and activities.

Our work in 2020 in both these areas has had a measurable impact and many successes, which we will document in the 2020 Impact Report that will be published in early 2021. We will continue to finish work in progress on Time Security and OSE until the end of 2020 and will share details about how the projects will be concluded.

B.    The addressing system

The second area of regulation, where there has already been some progress, is the addressing system of the Internet.  Each sender and receiver of Internet messages needs a unique address.  These are essentially numbers, but it was quickly evident.  The original addresses, started in 1980 with Internet Protocol version 4 (IPv4) were

… 32-bit numbers often expressed as 4 octets in “dotted decimal” notation (for example,192.0.2.53). Deployment of the IPv6 protocol began in 1999. IPv6 addresses are 128-bit numbers and are conventionally expressed using hexadecimal strings (for example, 2001:0db8:582:ae33::29).

Both IPv4 and IPv6 addresses are generally assigned in a hierarchical manner. Users are assigned IP addresses by Internet service providers (ISPs). ISPs obtain allocations of IP addresses from a local Internet registry (LIR) or National Internet Registry (NIR), or from their appropriate Regional Internet Registry (RIR):

Remembering a 32-bit or 128-bit number is not easy, so an alternative was developed to assign a name to each number, called a domain name.  These were organized by clusters based on the nature of the sender or recipient.  If it is commercial it is .com, if it is governmental it is .gov, if it a educational it is .edu.  It can also be a country address:  for example, Tuvalu is .tv, the United Kingdom is .uk and Venezuela is .ve.  When the Internet was new, the names were assigned by Jon Postel, a professor at the University of Southern California (USC), who managed the registry of “socket numbers” and names.  To understand that this was not a governmental organization, all you need to know is that Taiwan was given a country code, as was China.  The system, however, began to have problems when individuals and institutions began to register names that were protected by trademarks under the global intellectual property system run by WIPO.

A proposed solution to the problem was to set up roles for allocating addresses and governments began to push this toward the ITU.  In the United States, which initially supported this, was pressured by others interested in the Internet such as computer manufacturers and programmers, who feared that giving this responsibility to the ITU would give telephone companies too much power.  The compromise was to create an institution to manage the system that was non-governmental, called the Internet Corporation for Assigned Names and Numbers (ICANN).  As ICANN notes

The history of ICANN traces back to the creation and the evolution of the Internet itself.

In 1969, the first message was sent via the Arpanet, a U.S. Department of Defense network and precursor to the global Internet. Three years later, Jon Postel started to record socket numbers for the Arpanet in his notebook. His registry eventually became the Internet Assigned Numbers Authority (IANA), which manages the coordination of the Domain Name System (DNS).

ICANN was founded in 1998 and grew out of a U.S. Government commitment to transfer the policy and technical management of the DNS to a non-profit corporation based in the U.S. with global participation. The IANA Stewardship Transition was completed in October 2016 thanks to the work and dedication of the Internet community worldwide.

To learn more about ICANN’s history, check out the interviews, interactive timelines, and other resources under the thematic tracks on the site.

Over time, ICANN, which is officially a not-for-profit corporation in California, has become more “international organization-like”.

C.    The channels

The Internet depends on physical channels to send messages.  In some cases they are like (or are) copper wire telephone lines.  But these have a limited capacity to move messages, especially when many messages are being transmitted.  New physical wires made up of optical fiber cables which can handle larger amounts of information.  These cables also have permitted transmission over oceans.  In addition, satellites can provide a means of sending information as can wireless methods, although these are somewhat less secure. 

As the amount of information on the Internet increases, especially via video and similar methods like Zoom and Google Chat, the capacity of channels to carry information has become more important, with an emphasis on the concept of broadband.  This is specified to an extent in Goal 9 of the Sustainable Development Goals (SDGs) in one target: “9.c Significantly increase access to information and communications technology and strive to provide universal and affordable access to the Internet in least developed countries by 2020.”

How to do this is still an issue under discussion, often under the term “broadband”.

D.    Content

A final area of concern has to do with the content that is run over the Internet.  By being essentially borderless and almost impossible to block, the Internet has a major contradiction to address.  On the one hand, the Internet provides information to masses of people that should be protected as part of international human rights norms favoring freedom of expression.  At the same time, the Internet provides an opportunity for false information to be provided leading to civil unrest.  There is also the possibility of what is called cyber warfare, where the Internet can be used to attack infrastructure (like power production) that uses the Internet for management.

This contradiction can only be resolved if there is agreement on what constitutes free speech and what should be regulated both by countries from which the messages initiate and those that receive them.  The issue became important enough that the then new Secretary-General, Antonio Guterres, organized a High Level Panel on Digital Cooperation co-chaired by Melinda Gates of the Bill and Melinda Gates Foundation and Jack Ma of the Alibaba Corporation.  One of the members was Vinton Cerf, one of the original founders of the Internet.  The Panel made extensive recommendations that were addressed in the Secretary-General’s Roadmap for Digital Cooperation.  Another recommendation was to create the post of Secretary-General’s Envoy on Technology, which is still in the process of being created.  The issues related to human rights and the Internet is beginning to be taken up by the Council on Human Rights which in July 2021 adopted a resolution on human rights and the Internet.

III. The Internet Governance Forum

One of the main current places where these discussions are being held, created as a result of the World Summit on the Information Society that finished in Tunis in 2005, is the Internet Governance Forum.   The IGF was a compromise between competing actors in the Internet, including governments, international organizations, the private sector, civil society and academia.  Its secretariat is provided by the UN Department of Economic and Social Affairs, and the IGF, which meets annually, reports formally to the Economic and Social Council via the Commission on Science and Technology which is serviced by UNCTAD.

The original basis for the IGF was that there was a problem with defining responsibility for overseeing the Internet during the negotiations for the World Summit on the Information Society (WSIS), particularly in terms of ensuring that no single state could dominate.^[1]  In the process, the International Telecommunications Union (ITU) which had originally organized the WSIS was supplemented by the UN’s Department of Economic and Social Affairs (DESA).  As part of a compromise at the Tunis conference, the IGF was set up to be a platform for actors to discuss issues concerning      the evolution, use and governance of the Internet, based on a multi-stakeholder model, but without a formal decision-making method.  Its mandate was set out in paragraph 72 of Tunis Agenda for the Information Society^[2] and was very broad, covering almost all aspects of the Internet.  For many of its fifteen years of existence, it was the only established body to focus on these specific issues, although it formally reported to the Commission on Science and Technology for Development and through that to the Economic and Social Council (ECOSOC) and then to the General Assembly through its Second Committee.

The IGF was created as one of the first UN bodies that was designed to be multi-stakeholder by involving, in addition to governments, civil society, the private sector and the technical community.  The IGF was not set up as an intergovernmental body, but rather an institution set up to advise the Secretary-General, so that constraints on participation could be bypassed.  This reflected the fact that the Internet was not run by governments, but by a more diverse set of stakeholders.  The first issues that were discussed in the IGFs were domain names and issues relating to the engineering of the Internet, both of which were largely the responsibility, in practice, of non-state actors.  The need for multi-stakeholder participation at the international level to deal with major transborder issues was found in a number of other areas, including climate change and pandemics, where while governments were responsible for organizing international action, solutions required at both national and international levels active participation of other stakeholders, a bottom-up approach that needed to inform the top-down approach of government agreements.

In the international system set up by the UN Charter, governments are in charge, but they can allow non-governmental organizations (NGOs) to participate, using formal methods of recognition.  At WSIS it was obvious that many of the stakeholders, like businesses and technical communities, were not represented by the standard NGOs and the normal intergovernmental methods of discussion would limit interaction.  For that reason, the IGF was set up as an entity to be created and convened      by the UN Secretary-General.  It was also intended to be funded by extra-budgetary support from voluntary donors            including the private sector, civil society and technical organizations like ICANN and the Internet Society as well as governments.  A small IGF Secretariat was created, in Geneva, that initially reported to the Office of the Secretary-General, but after the first several IGFs, the Secretariat was moved to be part of the Department of Economic and Social Affairs (DESA).  In order to connect the IGF with the intergovernmental system, the Economic and Social Council decided in 2006^[3] that it would report to the UN Commission on Science and Technology for Development, a subsidiary body of the Economic and Social Council.  The resolution noted the convening of the first IGF by the Secretary-General, but did not specify how the IGF was to report.

 

The Commission on Science and Technology for Development is supported       by UNCTAD as the secretariat in Geneva and for many years has basically divided its work into two categories: Progress made in the implementation of and follow-up to the outcomes of the World Summit on the Information Society at the regional and international levels, and Science and technology for development.  For each subject, the Commission agrees on a draft resolution that is sent to ECOSOC and then becomes the basis for a General Assembly resolution on information and communications technologies for sustainable development that is considered by the Second Committee of the General Assembly.  Material on the IGF is presented to the Commission as part of its work, and each resolution has both a section on internet governance and on the IGF.  Over the period from 2011, there was a Working Group on Improvements to the Internet Governance Forum that was established under the Commission that presented a report in 2012.^[4]  The recommendations of that Group are considered to still be valid, as noted in the draft resolution adopted by the Commission at its session in 2020 where it: “71. Recalls General Assembly resolution 70/125 , in which the Assembly called upon the Commission on Science and Technology for Development, within its regular reporting, to give due consideration to fulfilment of the recommendations contained in the report of the Working Group on Improvements to the Internet Governance Forum of the Commission;”^[5]

 

Subsequent to the creation of IGF, a number of other bodies have been created.  One is the Broadband Commission for Digital Development, a joint ITU/UNESCO initiative started in 2010 to “to bridge the digital divide and bring the goal of universal broadband connectivity to the forefront of policy discussions.”  Another is the WSIS Forum, “co-organized by ITU, UNESCO, UNDP and UNCTAD, in close collaboration with all WSIS Action Line Facilitators/Co-Facilitators, has proven to be an efficient mechanism for coordination of multi- stakeholder implementation activities, information exchange, creation of knowledge, sharing of best practices and continues to provide assistance in developing multi-stakeholder and public/private partnerships to advance development goals.”^[6]  A third is the United Nations Group on the Information Society (UNGIS), an interagency coordination mechanism under the United Nations System Chief Executives Board (CEB) that was established in 2006  “to develop extensive collaboration and partnerships among the CEB members in order to contribute to the achievement of the WSIS objectives, to help to maintain ICT-related issues as well as science and technology at the top of the UN Agenda and finally to mainstream ICT for Development issues in the mandate of CEB members.”^[7]  All of these bodies are largely led by the ITU, although for the UNGIS the chair rotates between UNDP, UNESCO, ITU and UNCTAD.

 

Over the period since the IGF was created, the importance of the Internet and its role have increased.  This has included the COVID-19 pandemic, but also cybercrime and cyber-security issues as well as regulation of social media that use Internet platforms.  In the cases of cyber-security and cyber-crime there are ad hoc committees of the General Assembly meeting in 2021 to consider whether to adopt international conventions.  In the case of cyber-security there is a Group of Governmental Experts on Advancing responsible State behaviour in cyberspace in the context of international security that had its fourth session in May 2021.^[8]  This body is managed by the UN Office for Disarmament Affairs.  The open-ended ad hoc intergovernmental committee of experts, representative of all regions, to elaborate a comprehensive international convention on countering the use of information and communications technologies for criminal purposes held its organizational session in May 2021 and is managed by the UN Office on Drugs and Crime.^[9]

 

The importance and complexity of internet issues led the Secretary-     General of the United Nations to create a High-level Panel on Digital Cooperation in 2018 to^[10]

 

“advance proposals to strengthen cooperation in the digital space among Governments, the private sector, civil society, international organisations, academia, the technical community and other relevant stakeholders.  The Panel was tasked with raising awareness about the transformative impact of digital technologies across society and the economy, and contributing to the broader public debate on how to ensure a safe and inclusive digital future for all, taking into account relevant human rights norms.

 

Co-chaired by Melinda Gates and Jack Ma, the panel presented its report, The Age of Digital Interdependence, on 10 June 2019.  One of its three sections was on Mechanisms for Global Digital Cooperation which include three possible areas of improvement.  The first of these was “the proposed Internet Governance Forum Plus, or IGF Plus, would build on the existing IGF which was established by the World Summit on Information Society (Tunis, 2005). The IGF is currently the main global space convened by the UN for addressing internet governance and digital policy issues. The IGF Plus concept would provide additional multi-stakeholder and multilateral legitimacy by being open to all stakeholders and by being institutionally anchored in the UN system.”^[11]

 

Following on this, the Secretary-General produced a report in May 2020 on implementation of the recommendations of the Panel.^[12]  In its section on digital cooperation it stated:

 

93. While discussions on the different digital architecture models proposed by the Panel are ongoing among stakeholders, the following ideas have emerged with a view to making the Internet Governance Forum more responsive and relevant to current digital issues. These include:

 

(a)    Creating a strategic and empowered multi-stakeholder high-level body, building on the experience of the existing multi-stakeholder advisory group, which would address urgent issues, coordinate follow-up action on Forum discussions and relay proposed policy approaches and recommendations from the Forum to the appropriate normative and decision-making forums;

(b)    Having a more focused agenda for the Forum based on a limited number of strategic policy issues;

(c)    Establishing a high-level segment and ministerial or parliamentarian tracks, ensuring more actionable outcomes;

(d)    Forging stronger links among the global Forum and its regional, national, subregional and youth initiatives;

(e)    Better integrating programme and intersessional policy development work to support other priority areas outlined in the present report;

(f)     Addressing the long-term sustainability of the Forum and the resources necessary for increased participation, through an innovative and viable fundraising strategy, as promoted by the round table;

(g)    Enhancing the visibility of the Forum, including through a stronger corporate identity and improved reporting to other United Nations entities.

 

This was referenced in the most recent General Assembly resolution on information (A/RES/75/202 of 20 December 2020).

 

At the end of the 75^th General Assembly, the Secretary-General presented Our Common Agenda, a proposal for the future of the United Nations and its system.  In its paragraph 93, it states:[13]

 

93. It is time to protect the online space and strengthen its governance. I would urge the Internet Governance Forum to adapt, innovate and reform to support effective governance of the digital commons and keep pace with rapid, real- world developments. Furthermore, building on the recommendations of the road map for digital cooperation (see A/74/821), the United Nations, Governments, the private sector and civil society could come together as a multi-stakeholder digital technology track in preparation for a Summit of the Future to agree on a Global Digital Compact. This would outline shared principles for an open, free and secure digital future for all. Complex digital issues that could be addressed may include: reaffirming the fundamental commitment to connecting the unconnected; avoiding fragmentation of the Internet; providing people with options as to how their data is used; application of human rights online; and promoting a trustworthy Internet by introducing accountability criteria for discrimination and misleading content. More broadly, the Compact could also promote regulation of artificial intelligence to ensure that this is aligned with shared global values.

This is reflected in the annual report on progress implementing WSIS sent to the Commission in May 2021, one part of the report stated that “A Multi-stakeholder Advisory Group working group on IGF strengthening and strategy is reviewing the improvements proposed in the Road Map.”^[14]  The working group has been meeting since June 2020 and has had extensive virtual discussions.^[15]  It has made a number of suggestions for areas to be developed during 2021.^[16]

One of the recommendations of the High Level Panel was the creation of a post of Envoy on Technology that “     could identify over-the-horizon concerns that need improved cooperation or governance; provide light-touch coordination of multi-stakeholder actors to address shared concerns; reinforce principles and norms developed in forums with relevant mandates; and work with UN member states, civil society and businesses to support compliance with agreed norms.”^[17]  In the roadmap, the Secretary-General noted that he would appoint an Envoy on Technology, “whose role will be to advise the senior leadership of the United Nations on key trends in technology, so as to guide the strategic approach taken by the Organization on such issues. The Envoy will also serve as an advocate and focal point for digital cooperation – so that Member States, the technology industry civil society and other stakeholders will have a first port of call for the broader United Nations system.”  The relationship of the Envoy with IGF is still being developed since Internet governance is not listed in its current ongoing work.  The current officer-in-charge of the Office of the Envoy is Assistant Secretary-General for Policy Coordination and Inter-Agency Affairs of DESA, on an acting basis.

Since its inception, the IGF has been directly managed by a Secretariat unit located in Geneva, but which, since 2007 reports to DESA through its Division for Public Institutions and Digital Government, and specifically its Digital Government Branch.  The practical management organization leadership, including programme and schedule of the annual meeting and other issues, is through the Multi-Stakeholder Advisory Board (MAG).  According to its terms of reference, the MAG was to be comprised of approximately 50 members but the total number of MAG members is subject to change from year-to-year and is now 40.  The members are from governments, the private sector, media, civil society, and the technical community. Additionally, former host countries have a standing seat on the MAG. Proportionally the MAG is approximately 33% governments in the 2017-2021 period and the rest of positions is divided more or less equally between civil society, technical community and the private sector. The proportions vary slightly from year to year. Representatives of intergovernmental organisations      are invited to attend and contribute to the meetings and work of the MAG.

The major activities of the IGF process are its annual meeting, intersessional work and growing capacity development activities, which involve extensive consultations, meetings and on-line activities that involve the MAG, the Secretariat and individual organizations or groups of organizations.  It also has involved national and regional IGFs.  After the global meetings, the results are communicated to inter-governmental bodies led by the Commission as well as to meeting participants and other parts of the network.  Since 2017, the IGF Secretariat has prepared “messages” that describe the main discussions held during the annual meetings. Other IGF outcomes include the chair’s summary, outputs of the parliamentary track (launched in 2019)     , and outputs of best practice forums;      some Dynamic coalitions also      produce ‘outputs’.

The work of the IGF was evaluated in 2021, but the report has not yet been issued.  This will be discussed in class.

IV. Internet treaty negotiations

As noted in the IGF section, there are now at least two possible treaties being negotiated.   The first is one on cybersecurity, in the First Committee of the General Assembly.  This was reflected in discussions there in October 2021.

A second treaty, on cybercrime, has now started a negotiation process in the Third Committee of the General Assembly, based on a resolution adopted in May 2021.

 

©2021. John R. Mathiason. All Rights Reserved.

Last modified: October 27, 2022