Comments by Mr. Artur Lyukmanov, Director of the Department of International Information Security of the MFA of Russia, Special Representative of the President of the Russian Federation for International Cooperation in the Field of Information Security, for Newsweek
International information security is a way to peace, not war
The “Russian hackers” is the usual headline of the US media when covering news on election frauds, data leakages, theft of technology or business plans, DDoS attacks, fishing, malware or ransomware incidents. No hard evidence of Russia’s alleged malicious ICT activities has ever been provided via the existing bilateral hotlines with Washington established in 2013 specifically to investigate computer attacks.
Instead the US builds up offensive ICT-capabilities, conducts «hunt-forward» operations against Russia, employs its clients abroad. Among them is the notorious “IT-army of Ukraine”. A similar purpose is served by a number of NATO “cyberlaboratories” in Eastern Europe. Moreover, the March US Cyber Strategy claims the NSA’s right to “punish” other states for wrongdoings in information space. The US Intelligence Advanced Research Projects Activity, Naval Institute, government foundations and private companies are involved in preparations for “cognitive warfare”.
Such an escalatory path adds higher risks of confrontation. Russia has voiced previously concerns about the NSA’s illegal mass surveillance program. It is prolonged every year with the extension of the FISA Section 702 and is applied beyond the US borders. The servants of this policy are big-data corporations that are no different from East Indian Companies in the way they impose their interests on the rest of the world.
We want to halt further deterioration. A mistake in the use of ICTs may lead to a direct conflict, an all-out war. Especially as that the White House is aware that Russia has all the necessary capabilities to defend itself. A devastative computer attack against our critical information infrastructure will not be left without response.
The right way to prevent escalation is to engage in dialogue. The goal is to have an international legal framework as it is not for two or twenty countries to decide on security in the use of ICTs which are transborder in their functions. A decade ago despite the difficult geopolitical situation Russia and the US, as well as other UN Member States managed to agree on a list of rules, norms and principles of responsible behavior in information space, though Washington initially rejected the very idea of voluntary obligations.
We believe the next step should be making these arrangements mandatory for all countries. In 2021 Russia and the US initiated the UNGA consensus resolution that supported the Open-ended Working Group (OEWG) on ICT security and paved the way for elaborating new binding norms. In accordance with the Group’s mandate in March 2023 Russia and a group of like-minded countries presented a concept of convention on international information security. It is an invitation to start working on a universal treaty which would provide an equal basis for cooperation between UN Member States and help them overcome the digital divide.
Such an approach, i.e. elaborating global agreement, is supported by an overwhelming majority of countries. A good evidence of that is the launch of negotiations on a convention to counter the use of ICTs for criminal purposes. Upon Russia’s initiative the relevant Ad Hoc Committee was established in 2021. The negotiations are ongoing. They are difficult, tense, but we already have tangible results on paper. The delegations agree that only states and their competent authorities should ensure protection of their citizens and societies in the global ICT domain.
There is little doubt that eventually common sense will prevail among other governments, including the US, when it comes to the need for prevention of a conflict situation with an unpredictable outcome as a result of a transborder and anonymous computer attack. All countries are vulnerable to threats in information space, whether they have Silicon Valley or not. That’s the nature of data which, like water, will always find a weak spot in ICTs. Our task is to prevent such leaks from turning to stormy streams, a hurricane beyond category 5.