| As President Biden prepares to go toe-to-toe with Vladimir Putin at a summit in Switzerland this week, the United States and its allies are facing a test over whether they will hold Russia accountable for continually violating rules of good behavior in cyberspace. Russia has readily agreed to many of those rules, including that nations shouldn't hack each other's critical infrastructure and shouldn't harbor cyber criminals in their territory, as Ellen Nakashima and I report. But it has violated those rules just as readily. And the United States and its allies haven't imposed sufficient consequences to change Russia's bad behavior. "It certainly seems that states want others to behave well in cyberspace, and there are some key states that just aren't. So you have to do something about it," Michele Markoff, the State Department's acting coordinator for cyber issues, told us.  Russian President Vladimir Putin speaks at the Grand Kremlin Palace on Saturday. (Yevgeny Odinokov, Sputnik, Kremlin Pool Photo via AP) | Markoff was the U.S. delegate to a United Nations group of governmental experts that drafted a suite of voluntary "norms" last month laying out what nations should and shouldn't do in cyberspace. The agreement essentially reaffirmed and expanded a set of commitments first made in 2015. Russia endorsed those norms along with the United States and 23 other nations. But it has shown no intention of actually abiding by them. Specifically, the norms should bar Russia from allowing ransomware gangs to operate on its territory. And it should compel Russian law enforcement to extradite the criminals who lock up victims' computers and demand payment to unlock them so they can face trial in the United States and elsewhere. But Russia has allowed those gangs to conduct their operations with impunity — including the DarkSide gang, which locked up computers at Colonial Pipeline last month, causing gas shortages in the southeastern United States. It's widely believed those gangs are allowed to operate in Russia provided they don't attack Russian victims, as Isabelle Khurshudyan and Loveday Morris report. Pressed on the issue, Putin has played dumb. "I do hope that people would realize that there hasn't been any malicious Russian activity whatsoever," he said at a recent economic forum in St. Petersburg. He also mused that Russia might hand over cyber criminals who operate on its territory if the United States would do the same. Biden said he's "open" to such a deal, but national security adviser Jake Sullivan clarified that only meant that the United States already abides by international agreements about extraditing hackers. | Bloomberg News's Jennifer Jacobs: |  | | | Indeed, the United States is a signatory to 2001 international agreement known as the Budapest Convention that requires nations to investigate cybercrimes on their territories and to extradite hackers. Russia is not. U.S. officials have sought to play down expectations of any progress in the Biden-Putin talks. They've noted that U.S.-Russia relations are at a low point and Sullivan warned not to expect a "light-switch moment" at the meeting. Analysts say there's little hope of Russia changing its behavior unless it is consistently punished for violating cyber norms. Sanctions imposed by the United States and Europe haven't done the trick. The Justice Department also has indicted numerous Russian hackers but with little expectation that they'll ever see a U.S. courtroom. Other options include more significant and joint economic punishment from the United States and its allies or some form of digital retaliation. "Unless you hold these countries accountable, having nonbinding norms doesn't fundamentally change our security situation," said Dmitri Alperovitch, a cybersecurity expert and executive chairman of the Silverado Policy Accelerator think tank. "These norms have moral force, and if a country signs up to them, there's a political commitment and an expectation that they'll be observed. And other countries should hold them accountable when they're not," said Christopher Painter, who was the State Department's top cyber official in the Obama administration.  President Biden arrives at Melsbroek Military Airport near Brussels for two days of summits with leaders from the NATO military alliance and the European Union. (Brendan Smiaklowski/AFP/Getty Images) | U.S. officials and analysts, however, say there's great value in the U.N. norms even if Russia isn't eager to abide by them. They make it easier for countries that do abide by the norms to band together to punish those that don't, for example. A key agreement from the Group of Seven meetings in England this weekend involved working collectively to combat ransomware. "The international community — both governments and private sector actors — must work together to ensure that critical infrastructure is resilient against this threat, that malicious cyber activity is investigated and prosecuted, that we bolster our collective cyber defenses, and that states address the criminal activity taking place within their borders," the group agreed, according to a White House fact sheet. The norms also make it more likely that nations that are just developing their cyber capabilities will follow the model set by the United States and its allies rather than the Russian model. "The goal is to build consensus among developing countries like Brazil and Indonesia so that they will support actions against violators," said James Lewis, a cyber policy expert at the Center for Strategic and International Studies who was an adviser to the U.N. group. "The norms don't talk about how to hold countries accountable," Lewis said. "That's the next step." | Share The Cybersecurity 202 |  |  |  | | | 
Email 
No comments:
Post a Comment