Lawfare contributor, Jack Goldsmith published the following commentary, yesterday, in regards to his thoughts on the recent indictment against 12 officers of the GRU who used cybercrimes in a targeted attempt to influence the 2016 American election, and based on President Trump’s responses to questions of blame during yesterday’s summit with Vladimir Putin, in Helsinki.
To summarize briefly (though, I suggest that you read his full text to ensure that I am not misrepresenting his statements), he points out that it is not incorrect to blame the US as well. The United States is and has been one of the most prolific interventionists in foreign politics, for several generations now.
Now, I don’t believe that Mr. Goldsmith is saying this in quite the same way as Donald Trump - whose motives I question, deeply - rather I believe that he is endorsing the idea that national security relies on establishing global legal frameworks, norms, and commitments that preserve the nation state from outside interference. Fundamentally, hardening the United States to outside attack is nearly impossible - certainly not on the timeframe of just a couple of years - and too much of our infrastructure and economy rely on the smooth functioning of our computer networks. Establishing these norms is necessary for self-defense and that will require admitting that we have been in the wrong, through our actions, if we are to see any sort of widespread adoption and acceptance by the rest of the global community. And, realistically, it is extremely hypocritical to do otherwise and we only invite further attacks by failing to do so.
Strategically, I see the merit of Mr. Goldsmith’s argument. And if he had principally addressed the subject in those terms, as I have in my summation, I would have no issue. I’m not sure that it’s the right or only strategy, but it is a promising option.
But I think he glosses over the subject of international law and moral relativity too quickly in his overview and risks running into dangerous waters.
An argument I have made in the past, on the subject of Anarchism, is that we do live in an Anarchist’s perfect world where everyone is free to do as they want and be who they are, etc. There is no law that compels you to do anything nor structure built to keep you down. We’re all just individuals, co-operating together on top of the Earth’s crust.
But, in our lawless state, we discovered that there was more freedom to be had by pushing back on those who were unwilling to fairly interact with others. This meant, often, electing some lawgiver to police and enforce certain rules of behavior. The Anarchist’s world looks like our world, because as free beings with choice, we discovered that there was a better way.
So what does the lawgiver look like? He makes uses force, threats, and subterfuge to impose his will on the subjects of his attention. He will confine them, he will beat them, and he may even kill them. And those are all, exactly, the sorts of things that a bad actor is liable to have done to others and that we are trying to stop. But we accept that, because it’s necessary for the rest of society - the good actors - to be able to live in peace.
The strategy that Mr. Goldsmith proposes could be compared to guns.
We cannot, practically, defend against guns. There’s no chance that we are going to be able to convince everyone to wear a Kevlar vest everywhere they go, every moment of the day. And so, he would suggest, we should get rid of guns. Except, we wouldn’t be getting rid of the guns - or, in this case computers and computer networks - we would just be agreeing to not use them. We’ll all have them, strapped right there on our hip, we just won’t use them. Nope.
Fundamentally, this argument ignores two issues:
- The bad actor.
- We already have these norms.
The US spies, for example, on Germany. We read their emails. They probably read ours. Everyone is fine with this. There is an established norm, and everyone’s fine with it.
We don’t interfere with the internal politics of Germany, however. They are a good actor. There’s no merit. They don’t interfere with ours, either. This is all good.
Iran, on the other hand, finances terrorists. We interfere with their politics because we are imposing law on them.
The US was never, officially, nominated the lawgiver of the planet. But there’s no question that it is. It is accepted and approved by everyone except bad actors that the lawgiver use intimidation, force, confinement, etc. to impose the will of all of the good actors. And that is what the US (usually) does.
Trying to establish the global commitment that Mr. Goldsmith suggests is effectively just saying that no one can be the lawgiver. We all are just going to stop spying or interfering with anyone anywhere. And while yes, that should be the way that everything is, the reality is that won’t be the way that everything is.
Russia is the threat that it is, on the global stage, at least in part because of its position on the UN security council. They can unilaterally veto many actions that could be taken to prevent them from misbehavior. And that restricts the ability of the rest of the world to act against Russia, while it fails to stop Russia from doing something like invading the Crimea. We had no option to veto them, while they can veto a UN task force that would fight them off.
Committing to a global standard that the US will not use cyberattacks on bad actors would just amount to the same thing. We would be constrained while Russia, North Korea, and Iran would not.
The current global standard where we agree to not use active measures against good actors, but that the use of all of the same measures and tactics of a bad actor are available and ready to prevent and respond to misbehavior, is a better standard. It may not be official or recognized in any document, but I suspect that it would be nigh impossible to establish a global norm that enshrined the right to police action - free of security council veto - and without that right, any agreement we entered into would simply make the current situation worse.