TOM O'CONNOR
Escalating tensions between the United States and Russia in cyberspace threaten to spark a real-life clash between the nuclear-armed powers, Moscow's top cybersecurity diplomat has told Newsweek.
At a time when Washington has regularly accused Moscow of using cyber tools—referred to in Russia as information and communication technologies (ICTs)—to pursue illicit aims, Artur Lyukmanov, who serves as both director of the Russian Foreign Ministry's International Information Security Department and special representative to President Vladimir Putin on international cooperation on information security, pointed to a "lack of hard evidence" to substantiate such allegations.
Rather, he told Newsweek, "the U.S. builds up offensive ICT-capabilities, conducts 'hunt-forward' operations against Russia" and "employs its clients abroad."
Among those Lyukmanov accused of being involved in such initiatives were the "IT Army of Ukraine" that claims to be a volunteer outfit created at the start of Russia's war in Ukraine more than a year and a half ago, and other NATO nations hosting "cyber laboratories" in Eastern Europe.
Lyukmanov cited the National Cybersecurity Strategy released in March by President Joe Biden's administration, which allowed for U.S. entities to "punish those that engage in disruptive, destructive, or destabilizing malicious cyber activity." The senior Russian official further alleged that U.S. official and corporate entities were "involved in preparations for 'cognitive warfare,'" and warned "such an escalatory path adds higher risks of confrontation."
"We want to halt further deterioration," Lyukmanov said. "A mistake in the use of ICTs may lead to a direct conflict, an all-out war, especially as that the White House is aware that Russia has all the necessary capabilities to defend itself. A devastative computer attack against our critical information infrastructure will not be left without response."
The history of U.S.-Russia relations in cyberspace has long been fraught, with each side accusing the other of engaging in covert, underhanded online tactics to pursue goals parallel to their real-world geopolitical rivalry.
Russia has been particularly active in campaigning for international cooperation on cybersecurity, having sponsored the first-ever U.N. draft resolution on the issue back in 1998 and tabling another resolution that led to the establishment of the Open-ended Working Group on ICTs two decades later in 2018. But despite rare moments of unity, such as a 2013 dialogue opened between Moscow and Washington, frictions have often overshadowed attempts at cooperation in this field.
Burgeoning mistrust between the two nations on cybersecurity first reached a peak in the 2016 U.S. presidential election, when U.S. intelligence agencies accused the Kremlin of conducting a concerted influence campaign to support the candidacy of Republican candidate Donald Trump, a charge vehemently denied by Moscow.
Russian officials would go on to deny any role in a number of high-profile cyber incidents to hit the U.S. and other countries in the succeeding years, such as the SolarWinds hack, first publicly reported in December 2020, which granted months-long unauthorized access to software used by hundreds of U.S. companies and government institutions.
Just months before news of that hack became public, Putin put forth a four-point plan to manage cybersecurity relations between Washington and Moscow.
The proposal entailed the establishment of bilateral dialogue mechanisms utilizing existing channels on nuclear risk reduction and computer readiness, jointly developing a bilateral intergovernmental agreement on preventing cyber incidents in the vein of past U.S.-Soviet maritime agreements, and assurances of non-intervention in one another's internal affairs.
And even with U.S.-Russia relations sinking to further depths as a result of the latter's war in Ukraine, Lyukmanov argued that "the right way to prevent escalation is to engage in dialogue."
"The goal is to have an international legal framework, as it is not for two or 20 countries to decide on security in the use of ICTs, which are transborder in their functions," Lyukmanov said. "A decade ago, despite the difficult geopolitical situation, Russia and the U.S., as well as other U.N. Member States managed to agree on a list of rules, norms and principles of responsible behavior in information space, though Washington initially rejected the very idea of voluntary obligations."
Now, he argued, "the next step should be making these arrangements mandatory for all countries."
In March, the same month the U.S. National Cybersecurity Strategy was issued, Russia submitted its own concept of what such a multilateral convention should look like, one of several processes and proposals on cyber diplomacy that exist under the auspices of U.N. mechanisms.
"It is an invitation to start working on a universal treaty which would provide an equal basis for cooperation between U.N. Member States and help them overcome the digital divide," Lyukmanov said.
The U.S. has also participated in the Open-ended Working Group, though Washington and a number of its European allies have preferred to handle the issue through a parallel U.N. track led by Groups of Governmental Experts, which are limited to between 15 and 25 participating member states.
Reached for comment, a U.S. State Department spokesperson told Newsweek that, "over the past decade plus, the international community has made clear that international law applies in cyberspace."
"UN member states have coalesced around a non-binding framework of responsible state behavior in cyberspace," the State Department spokesperson added, "which, among other things, supports the international rules-based order, affirms the applicability of international law to state behavior in cyberspace, and development and implementation of practical confidence building measures to help reduce the risk of conflict stemming from cyber incidents."
The State Department spokesperson pointed out that "all members of the United Nations General Assembly—including Russia—have repeatedly affirmed this framework," as articulated by the 2021 Open-ended Working Group, as well as Groups of Governmental Experts convening that same year and in previous years, specifically 2015, 2013 and 2010.
And yet the U.S. has continued to accuse Russia of both committing and enabling violations.
"Despite its affirmation of this framework, Russia has repeatedly engaged in disruptive, destructive, or otherwise destabilizing malicious cyber activity," the State Department spokesperson said. "Further, despite the United States', allies', and partners' public identification of a growing number of Russian-based cyber criminals we have seen no meaningful action by Russian authorities to curb this type of behavior or otherwise hold actors accountable."
Also reached for comment, a representative of the "IT Army of Ukraine" acknowledged the group's mission of aiming to "help Ukraine win by crippling aggressor economies and blocking vital services," but said it conducted such operations "independently."
"We have no official or unofficial relationships with the U.S., other NATO members, or any other state-sponsored entities," the "IT Army of Ukraine representative told Newsweek. "While we were founded by Mikhaylo Fedorov, the Minister of Digital Transformation of Ukraine, neither he nor the ministry plays any current role—executive or non-executive—in our activities."
Newsweek has also reached out to U.S. Cyber Command and the U.S. National Security Agency for comment.
While Moscow and Washington see eye-to-eye on little these days, Lyukmanov was confident that the U.S. would change course in the long run and seek a new path toward cooperation.
"There is little doubt that eventually common sense will prevail among other governments, including the U.S., when it comes to the need for prevention of a conflict situation with an unpredictable outcome as a result of a transborder and anonymous computer attack," Lyukmanov said. "All countries are vulnerable to threats in information space, whether they have Silicon Valley or not."
"That's the nature of data which, like water, will always find a weak spot in ICTs," he added. "Our task is to prevent such leaks from turning to stormy streams, a hurricane beyond category 5."
No comments:
Post a Comment