The Public Core of the Internet: An international Agenda for Internet Governance

Front matter

WRR

Fae med

Dennis Broeders

Preface

Summary

1 Introduction

1.3 Setting the scene: three trends in cyberspace

1.4 Aim and structure of the book

2.1 Introduction: states and Internet governance

2.2 Setting the scene: Internet governance

2.3 Two forms of Internet governance

24 Freedom as the anchor: distributed security

2.5 Conclusion: Internet governance and extended national interests

3.1 The Internet as a global public good

3.2 Team Internet: stewards of the Internet’s core

3.3 Problems in the governance of the Internet as a global public good

3.4 Conclusion

4-1 Introduction: where national interests intersect with the Internet’s core public infrastructure

4.2 IP versus IP

43 Censorship and surveillance

44 Internet security versus national security

45 Technological sovereignty

4.6 Conclusion

Şi Introduction: Internet governance between the technical and the political

5.2 Towards a new international agenda for Internet governance

5:3 Framing the agenda

5.4 Broadening the diplomatic arena

5-5 New coalitions for the protection of the Internet’s public core

PREFACE

This book is a translation and adaptation of the Dutch report De publieke kern van het Internet (The public core of the Internet) that the Netherlands Scientific Council for Government Policy presented to Bert Koenders, the Dutch Minster for Foreign Affairs, on the 31% of March 2015. It advised the Dutch government to make cyberspace and Internet governance a serious priority for its foreign policy. The successful organisation of the Global Conference on Cyber Space in April 2015 (GCCS2015) in The Hague provided the Dutch government with an excellent stepping stone to promote its goals of a safe and open Internet through the global arena of cyber diplomacy. Dutch cyber diplomacy will be intensified in the wake of this conference, building — amongst others- on the insights and recommendations put forward in this report.

The core messages in the original report and in this book are not limited to the Netherlands however, but have a global appeal. Its main argument is that the Internet’s infrastructure and core protocols should be regarded as a global public good that is in need of protection against unwarranted interventions by states and other parties. Its main policy recommendation is that states should work towards establishing an international standard that identifies the Internet’s core protocols asa neutral zone in which governments, pursuing their national interests, are prohibited from interfering. This is a goal that is of crucial importance for all states whose societies and economies depend on the integrity and functionality of the Internet. Increasingly, that is the vast majority of states.

The original report was drawn up by a project team headed by Dennis Broeders, senior research fellow at the Council and professor of Technology and Society at Erasmus University Rotterdam. The other members of the group were Erik Schrijvers and Lisa Vermeer, both research fellows at the Council. Member of the Council Mark Bovens was also involved in the project.

While writing this report, the project group consulted numerous experts in the fields of Internet governance and cybersecurity. Their comments were extremely valuable and the Council would like to thank the interviewees for their time and effort. The Council would also like to thank Jan van den Berg, Nico van Eijk, Marieke de Goede, Erik Huizer and Corien Prins, who commented on earlier versions of the Dutch report.

Prof. André Knottnerus Chairman Netherlands Scientific Council for Government Policy

SUMMARY

The Internet’s core of key protocols and infrastructure can be considered a global public good that provides benefits to everyone in the world. Countering the growing state interference with this public core requires a new international agenda for Internet governance that departs from the notion ofa global public good.

INTERNET GOVERNANCE BETWEEN THE TECHNICAL AND THE POLITICAL Everyday life without the Internet has become unimaginable. It is inextricably interwoven with our social lives, our purchasing behaviour, our work, our relationship with the government and, increasingly, with our everyday objects, from smart meters to the cars we drive and the moveable bridges we cross en route. Fora long time, Internet governance was the exclusive domain of what is known in Internet circles as the ‘technical community’. That community laid the foundations for the social and economic interconnectedness of our physical and digital lives. Those foundations, with the Internet Protocol as their most prominent component, continue to function as the robust substructure of our digital existence. But the governance of that substructure has become controversial. The many economic and political interests, opportunities and vulnerabilities associated with the Internet have led governments to take a much greater interest in the governance of the Internet. Moreover, in terms of policymaking, the centre of gravity has shifted from what was primarily an economic approach (the Internet economy, telecommunications and networks) to an approach that focuses more on national and other forms of security: the Internet of cybercrime, vulnerable critical infrastructure, digital espionage and cyberattacks. In addition, a growing number of countries are seeking to regulate their citizens’ online behaviour, for reasons ranging from copyright protection and fighting cybercrime to censorship, surveillance and control of their own populations on and through the Internet.

Attempts by national states to ‘fence off’ their own national area of cyberspace, and their increased role in its governance, may have repercussions for the Internet’s backbone infrastructure. The Internet was developed to operate internationally, without regard for the user’s status or nationality — an underlying principle that benefits all users. It is mainly the Internet’s public core, consisting of infrastructure, protocols and standards, that routes data so that it reaches all four corners of the globe. If these protocols and standards fail or become corrupted, the performance and integrity of the entire Internet is put at risk. The Internet is ‘broken’ if we can no longer assume that the data we send will arrive, that we can locate the sites we are searching for, and that those sites will be accessible. Recently, however, a growing number of states have tampered with the Internet’s core infrastructure in order to further their own national interests.

In this regard, Internet governance is at a crossroads: the Internet has become so important that states are no longer willing or able to regard it with the same ‘benign neglect’ that long set the tone for most countries. At the same time, however, states do have national interests that go beyond the governance of the Internet asa collective infrastructure. It is imperative for the future of Internet governance to determine which part of the Internet should regarded as a global public good — and thus safeguarded from improper interference — and which part should be seen as the legitimate domain of national states, where they can stake a claim and take up their role without harming the infrastructure of the Internet itself.

THE INTERNET'S CORE AS A GLOBAL PUBLIC GOOD

This study therefore argues that the backbone of the Internet must be regarded asa global public good. As such, it should be protected against the interventions of states that are acting only in their own national interest, thereby damaging that global public good and eroding public confidence in the Internet. Global public goods provide benefits to everyone in the world, benefits that can be gained or preserved only by taking specific action and by cooperating. The means and methods for providing a global public good may differ from one case to the next and can be undertaken by private or public parties, or combinations of the two. This can be said to apply to the Internet both as a network and as an infrastructure.

These benefits derive largely from the Internet’s core protocols, including the TCP/IP Protocol Suite, numerous standards, the Domain Name System (DNs), and routing protocols. Asa global public good, the Internet only works properly if its underlying values — universality, interoperability and accessibility — are guaranteed and if it facilitates the main objectives of data security, i.e. confidentiality, integrity and availability. It is vital that we — the users — can rely on the most fundamental Internet protocols functioning properly: those protocols underpin the digital fabric of our social and economic life. Our confidence in the integrity and continuity of all we have built on the public core of the Internet — our digital existence — thus very much depends on those underlying protocols. Although national states will inevitably want to ‘create an Internet in their own image’, we must find ways to continue guaranteeing the overall integrity and functionality of the public core of the Internet.

FROM GOVERNANCE OF THE INTERNET TO GOVERNANCE USING THE INTERNET

To highlight the problem we can differentiate between two forms of Internet governance. The first is governance of the Internet’s infrastructure, i.e. the governance of the core infrastructure and protocols of the Internet. It is this public core that drives the Internet’s development. The collective infrastructure takes precedence in this form of governance. The second form is governance using the Internet’s infrastructure. In this case, the Internet becomes a tool in the battle to control

SUMMARY 11 online content and behaviour. The issues vary from protecting copyright and intellectual property to government censorship and surveillance of citizens. Increasingly, governments view the infrastructure and main protocols of the Internet itself as a legitimate means to achieve their policy ends. Whereas Internet governance used to mean governance of the Internet — with the technical management and performance of its infrastructure being the top priority — the trend today is increasingly towards governance using the Internet. Such interventions can undermine the integrity and functionality of the Internet and, in turn, undermine the digital lives that we have built on top of it.

THREATS TO GOVERNANCE OF THE INTERNET INFRASTRUCTURE Governance of the Internet’s public core — i.e. governance of the Internet — is entrusted to a number of organisations that are collectively known as the ‘technical community’. Although that governance is mostly in good hands, pressure is building on it from several quarters. Political and economic interests — sometimes combined with new technologies — are challenging the collective character of the network.

e Economic interests — for example copyright protection and revenue models for data transport — are putting pressure on policymakers to abolish or, conversely, offer legislative protection to net neutrality, previously the Internet’s default setting.

e The transition of the ‘IANA function’, which includes the stewardship and maintenance of registries of unique Internet names and numbers. There is mounting pressure to remove oversight of IANA from the us’s sphere of influence, for reasons of international political legitimacy. The debate on this transition may result in more politicised management of the Domain Name System, which in turn may have repercussions for the ability to find and locate sites and users. Most countries would benefit from IANA functions that are as ‘agnostic’ as possible, especially when it comes to the administrative tasks

e Another challenge is the rise of the national security mindset in cyberspace. The technical approach of the CERTs (with a focus on ‘keeping the network healthy’) and their international alliances is at odds with the approach of national security actors, such as intelligence agencies and military cyber commands. It is important to prevent these approaches becoming confused and/or mixed, because national security conflicts with the collective interest of the network’s overall security.

THREATS RESULTING FROM GOVERNANCE USING THE INTERNET INFRASTRUCTURE

The need for worldwide consensus on the importance of a properly functioning public core of the Internet seems obvious because it is these protocols that guarantee the reliability of the global Internet. However, recent international trends in policymaking and legislation governing the protection of copyright, defence and national security, intelligence and espionage, and various forms of censorship,

show no signs of such a consensus. If anything, they show the contrary.

Some states see DNS, routing protocols, Internet standards, the manipulation and

building of backdoors into software and hardware and the stockpiling of vulnera-

bilities in software, hardware and protocols (so called ‘zero-day vulnerabilities’) as ideal instruments for national policies focused on monitoring, influencing and blocking the conduct of people, groups and companies. The negative impact of such interventions is borne by the collective, however, and impairs the Internet’s core values and operation. Illustrations of this trend include:

e Various forms of Internet censorship and surveillance that use key Internet protocols as well as enlisting the ‘services’ of Internet intermediaries such as Internet Service Providers (ISPs) to block and trace content and users.

e The online activities of military cyber commands, intelligence and security services which undermine the proper functioning of the public core of the Internet. By corrupting Internet standards and protocols, by building backdoors into commercial hardware and software and by stockpiling zero-day vulnerabilities, these actors effectively damage the collective Internet infrastructure and make it less secure.

e Legislation to protect copyright and intellectual property that permits the use of vital Internet protocols to regulate and block content. ‘Side-effects’ of such legislation include the collateral blocking of content and users (‘overblocking’), damage to the DNS and intermediary censorship through IsPs.

e Some forms of Internet nationalism and data nationalism — in which states seek to fence offa national or regional part of the Internet — which require interventions in routing protocols. In extreme forms this could lead to splintering of the Internet.

TOWARDS AN INTERNATIONAL AGENDA FOR INTERNET GOVERNANCE The international political landscape of Internet governance is also changing rapidly. The next billion (or billions) of users will go online in emerging economies that may have a different cultural and political outlook on cyberspace from the still dominant ‘Western’ view. In addition, many countries will have upgraded their technical cyber capacity considerably within a few years, giving a much larger group of states capacities that are currently reserved for only a few superpowers. What is cutting edge today will be much more commonplace in five years’ time. If in that same timeframe the idea takes hold that national states are at liberty to decide whether or not to intervene in the Internet’s main protocols to secure their own interests, the impact on the Internet as a public good is likely to be very damaging. For this reason there is no time to lose in securing the public core of the Internet.

SUMMARY 13

THE INTERNET'S PUBLIC CORE SHOULD BE AN INTERNATIONAL NEUTRAL

ZONE

Given these developments, it should be an internationally shared priority to work

towards establishing an international standard that identifies the main protocols of

the Internet as a neutral zone in which governments are prohibited from interfering for the sake of their national interests. This should be considered an extended national interest, i.e. a specific area where national interests and global issues coincide for all states that have a vital interest in keeping the Internet infrastructure operational and trustworthy. With the continuing spread of the Internet and ongoing digitisation, that is increasingly a universal concern.

e Inorder to protect the Internet as a global public good there is a need to establish and disseminate an international standard stipulating that the Internet’s public core — its main protocols and infrastructure, which are a global public good — must be safeguarded against intervention by governments.

The starting point should be to place the drafting of such a standard on the international political agenda, something that will entail making governments around the world aware of the collective and national importance of this neutral zone. Given the enormous differences between countries in terms of Internet access, overall digitisation and technological capacity, this will require a serious diplomatic and political effort. This standard could be disseminated through relevant UN forums as well as though regional organisations such as the Council of Europe, the OECD, the OSCE, ASEAN and the AU. This strategy would lay the foundations for what could eventually expand into a broader regime.

THE NEED TO DISENTANGLE INTERNET SECURITY AND NATIONAL

SECURITY

The emphasis on national security comes at the expense of a broader range of

views on security and the Internet. Defining and disentangling different views on

security may in fact improve the security of the Internet as an infrastructure.

e Itis therefore vital to advocate at international level that a clear differentiation be made between Internet security (security of the Internet infrastructure) and national security (security through the Internet) and to disentangle the parties responsible for each.

It is of paramount importance to delineate the various forms of security in relation to the Internet. At one end of the spectrum there is the notion of Internet security, i.e. ensuring that the network itself is secure and operational. At the other end, there is the notion of national security, with the focus on the state and the Internet being regarded simultaneously as a source of threat and as a potential policy tool.

It is important to separate the technology-driven strategy of the CERTs, which involves a public health-type approach to overall network security, from the logic of national security, which places national interests above those of the network.

THE NEED TO BUILD NEW COALITIONS IN CYBERSPACE

Given the international demographic and political shifts in cyberspace, it is time to open, broaden and expand the arena for cyber diplomacy. There is a need to involve states that are still building their technical and political cyber capacities fully in the debates about Internet governance. Secondly, there is a strong case to be made for targeting the large, Internet-based companies as explicit subjects of cyber diplomacy, as well as a need to think through and regulate what the role and position of intermediary organisations on the Internet — such as Internet Service Providers (Isps) —is and should be. Lastly, states need to make more productive use of the expertise of NGOs and other private stakeholders, especially in thinking through the effects of national and foreign policies on the technical operation of the Internet asa whole.

1.1

Today’s Internet is a fortuitous accident. It came into being through a combination of an initial lack of commercial interests, government benign neglect, military requirements for survivability and resilience, and computer engineers building open systems that worked simply and easily. Battles over its future are going on right now: in legislatures around the world, in international organizations like the ITU, and in Internet organizations like the IGF.

Bruce Schneier (2013: 13)

Introduction

Everyday life without the Internet has become unimaginable. Everything — the economy, our social lives, our infrastructure and public life in general — ties into and branches out from it. And it will become even more important in the decades ahead as the ‘Internet of Things’, cloud computing and mobile data technology gather momentum and new applications come along that we cannot envisage yet. All this means that our social, public and economic lives will depend increasingly on an infrastructure that spans the globe and is, in essence, non-territorial.

That infrastructure — the software and protocols underpinning the Internet — was built by private parties and an international technical community; except for substantial investments in the Internet’s early development, governments have mainly been involved indirectly.

Most people are unacquainted with and uninterested in the deep layers that determine how the network operates, just as they are unfamiliar with the workings of their car engine. They don’t really care how their car works, as long as it does. They leave the rest to the experts. For a long time, the same was true of the Internet. It began life as ARPANET, a small network of American universities and the us Department of Defense, and was known only among the true pioneers, who maintained, modified and expanded the network themselves. As the Internet grew, and especially after the 1991 launch of the World Wide Web (www), which made it possible to access information simply by ‘surfing’ between websites,

it became increasingly important to our everyday lives. At the same time, the Internet’s ‘engine’ and physical infrastructure faded more and more from the view of everyday users.

States now take a keen interest in the Internet. Whereas fifteen years ago, newspapers tended to report on the Internet’s economic potential — with the ‘dot.com bubble’ in around 2000 asa glitch in the rise of the www — today’s Internet features in virtually every aspect of public and political life. Politicians recognise that it has become one of the pillars of the economy and intrinsic to people’s social and professional lives. They also recognise that cybercrime is on the increase; they observe that all our critical infrastructures are in fact linked to the Internet; they

1.2 realise that Google, Apple and Facebook know more about their citizens than they do, and exploit that information; and they see how the military and intelligence communities are becoming increasingly active and intrusive online. With the Internet taking centre stage and at the root of so many opportunities and threats, a growing number of authorities have become interested in its deeper layers and how they are governed.

Asa global infrastructure, however, the Internet is at odds with a world in which states do their utmost to secure their national interests online. While it is certainly not the case that national policy has no impact on the Internet — or rather, on the parties that shape, maintain and use the Internet — the international nature of the Web often makes it very difficult for states to secure their national interests.

There is also little international cooperation — let alone international political consensus — on the issue of the Internet’s governance. That does not mean that the Internet is ungoverned, of course. On the contrary, over the past thirty years it has been managed, developed and expanded by a network — which arose more or less from the bottom up — of private parties, NGOs, academics and also authorities, in what is known as a multistakeholder system (see e.g. Goldsmith and Wu 2008; Mueller 2010; Deibert 2013; DeNardis 2014). However, states are now demanding a bigger role for themselves, putting enormous pressure on the bottom-up nature of this system. There is no consensus among states, nor among the other stakeholders, on the choices that need to be made concerning the future of Internet governance, even though some of those choices may have huge implications for the way the Internet itself operates.

This book aims to outline an international policy agenda for Internet governance that makes some of those necessary choices. It proceeds from the need to strike the right balance between guaranteeing and protecting the Internet infrastructure as a global public good on the one hand, and integrating the Internet as a normal part of international and diplomatic relations on the other.

The fact that states are claiming a greater role for themselves in Internet governance is no surprise, given that the Internet has become a vital component of their economies and societies. The laissez-faire attitude long taken by most countries is now considered by many to be imprudent and inappropriate. That does not mean that every state has a clear notion of what the Internet is and how it can best be regulated. In fact, opinions are very much divided on matters such as freedom of speech, fighting cybercrime and the protection of intellectual property rights. Such matters are part and parcel of both national policymaking traditions and international diplomatic relations between states. The fact that some of these issues are online manifestations of old problems does not necessarily alter them,

2.1 but it does mean taking a very different approach at times, and seeking a very different form of international cooperation. This book aims to contribute to an international governance agenda that focuses on the Internet’s deep technological layers and software protocols. It does not address directly such vital issues as online freedom of speech or the mass surveillance of personal data as separate issues, but instead considers them when state policies use the deeper layers of the Internet and in doing so pose a threat to its integrity and its operational functionality. The reliability of the Internet — both technically and in terms of ‘trust’ — depends on how its ‘public core’ operates. If the Internet fails, is unreliable, then it is unreliable for every Internet user around the world. And although some states will inevitably want to ‘create the Internet in their own image’, there is a need to find ways to continue guaranteeing the general operability of its core.

A GLOBAL INFRASTRUCTURE AND NATIONAL INTERESTS

Some authors believe that Internet governance has reached a crossroads in which two worlds are set to clash: the global and non-territorial world of the Internet versus the world of national states, with territorial sovereignty as the organising principle of international relations. Sovereignty and the Internet appear to be irreconcilable concepts. The Internet itself is not restricted by national borders and the Transmission Control Protocol/Internet Protocol (TCP/IP) has been set up to ensure that packets of information basically always arrive at the right destination. Or, as John Gilmore put it: ‘The net interprets censorship as damage and routes around it’ (quoted in Maher 2013). At the same time, however, states are increasingly trying to control the global Internet, subject it to national policies and/or regulate it internationally. Some do so to control their own people, some to defend their economic interests, and some to enforce their sovereignty by military means. It is clear that states are increasingly inclined to draw borders in cyberspace and introduce the concept of territorial sovereignty to the Internet. Just as the Wild West was gradually absorbed and tamed by the USA, so some commentators maintain that states will do the same to the ‘anarchist Internet’. Others refer to the rise ofa ‘Westphalian model’ on the Internet. This is a reference to the Peace of Westphalia, signed in 1648, in which the concept of sovereign states became the legitimate organising principle for international relations. Here, it is used to indicate that states wish to claim sovereignty on the global Internet. Demchak and Dombrowksi (2011; 2013: 33) warn that a cyber-Westphalian doctrine cannot emerge without ending in conflict: “The process of establishing cyber borders and thus states’ sovereignty will be non-linear, dangerous and lengthy’. It is a process that fits in with a broader trend towards renationalisation, where a belief in the advantages of economic and cultural globalisation —- which long set the standard and which produced many benefits — is set off against national interests. For example, acting under the banner of economic security, states are considering the relationship between international investment, transnational take-overs and geopolitical trends on the one hand, while simultaneously protecting their own industries and critical infrastructures. How can countries that are deeply integrated into the global economy navigate a course between naivety and paranoia (NCTV 2014)? Even with respect to the global Internet, states must weigh their national interests against the international net. The three quotes that follow illustrate how much the role of states and opinions about that role have changed in recent years.

‘We reject: kings, presidents and voting. We believe in: rough consensus and running code’

In 1992, this is how David Clark, a professor at MIT and an Internet pioneer, described how the ‘Internet community’ tackled what is now known as ‘Internet governance’ (quoted in Goldsmith and Wu 2008: 24). It rejected democratic decision-making on how the network should develop, nor did it accept top-down political authority. Rough consensus between the engineers and other stakeholders, who regarded the Internet mainly as a technological challenge, was sufficient. In their eyes, it was essentially a non-political network that through technological breakthroughs and a growing mass of users gradually turned into a global ‘network of networks’. Although the Internet certainly had government to thank for its early development — in particular the government of the United States —- most countries for a long time regarded it as scarcely needing governance, or even considered it uncontrollable to a certain extent.

‘Good luck! That’s sort of like trying to nail Jell-O to the wall’

Six years later, Us President Bill Clinton was still convinced that the Internet was ungovernable. His statement came in 1998 after attempts by China to control and spy on the Internet, and more specifically on Chinese Internet users (quoted in Goldsmith and Wu 2008: 90). Widely regarded as one of the first censorship and surveillance projects targeting the Internet and Internet users, it introduced the expression ‘Great Firewall of China’ to the modern language. We are now several generations of Internet surveillance further and the technology used to detect and monitor users has become ever more refined (Deibert et al. 2008; 2010; 2011).

Or, as Tim Wu (2010: 309) puts it: ‘The Jello was, somehow, nailed to the wall’. The Internet is no longer the sanctuary it used to be for anonymous users. Businesses and government authorities monitor the behaviour of Internet users closely. Businesses do so because data about users’ online behaviour can be turned into profit in various ways; the authorities do so because they believe that such data hold the key to increased security and tighter control of the population.

Of course, different countries have different ideas about what security entails. Dutch, Iranian, American, and Russian concepts of security and freedom contrast starkly, both on the Internet and in the ‘real’ world. Unlike his predecessor Clinton, US President Barack Obama has long abandoned the notion that the Internet is uncontrollable. The revelations about the global surveillance practices of the

2.2

National Security Agency (NSA) have intensified the debate about the future of the Internet (Greenwald 2014). For a well-funded organisation like the NSA, at any rate, the opportunities appear to be unlimited.

‘The Internet is a CIA project’

So claimed Russia’s President Vladimir Putin in April 2014 during a media forum in St Petersburg,' one of many signs that the concept of the Internet as a global, apolitical network is waning. Or, put better, that politicians do not accept it as such. Politicians are making an ever-stronger case for the need to control the Internet. Yet another development, which many see as worrisome, is the militarisation of the Internet, with a growing list of countries regarding it as the fifth domain of warfare (after land, sea, air and space) and rapidly building up military cyber capacity and cyber intelligence services (see e.g. Singer and Friedman 2014; Guitton 2013; Deibert 2013; Dunn Cavelty 2013). That brings the Internet into the realm of high politics, i.e. the domain of national and international security. And once it has landed there, states are unlikely to go back to viewing it with benign neglect.