90053934

Bulletinof theAtomicScientists

IT IS 5 MINUTES TO MIDNIGHT

®

Feature

Who controls cyberspace?

Nazli Choucri and David D. Clark

AbstractUntil recently, cyberspace was considered largely a matter of low politics. But over the last decade, it has begunto shape the high politics of national security and other core concerns of national governments, as evidenced bythe Wikileaks release of US classified information and the social media-influenced Arab Spring. The field ofinternational relations has not kept pace with this emerging significance of cyberspace. As the internationalsystem and the empowered non-state groups and individuals of cyberspace shape one another, the potentialcollisions of law, policy, and the practice of governance have barely even been identified. Before the inter-national community can begin to minimize the negative consequences of those inevitable collisions, it needs tounderstand how and where cyberspace and international relations intersect and influence one another. Theauthors provide two complementary systems for analyzing those intersections and influence points.

KeywordsArab Spring, control-point analysis, cyberspace, Innocence of Muslims, international relations, Wikileaks,YouTube

When Wikileaks released hun-dreds of thousands of IraqWar logs and diplomatic

cables in 2010, a horrified US govern-ment sprang into actionÑbut the classi-fied information the government hopedto keep from public view quickly migrat-ed to overseas servers, ensuring that itwould likely never be suppressed.

After an anti-Islamic movie trailer wasposted on YouTube in 2012, the horrifiedPakistani government rushed to block itsnationÕs access to the Internet video ser-viceÑand, in the process, temporarily dis-rupted YouTube access around the world.

Toward the beginning of the Egyptianrevolution, the government of HosniMubarak tried to quell the cyber-based

aspect of the protest by turning off theInternet, but that effort did little to alterthe course of the revolt. China, however,continued to block searches for theterms ÒEgyptÓ and ÒArab Spring,Ó withat least some success.

Until recently, cyberspace was con-sidered largely a matter of low politics,the term political scientists use to denotebackground conditions and routinedecisions and processes. Over the lastdecade, though, cyberspace, with theInternet at its core, has clearly begun toshape the domain of high politicsÑthatis, the national security considerations,core institutions, and decision systemsthat are critical to national governments.Those governments have long held a

Bulletin of the Atomic Scientists69(5) 21–31

! The Author(s) 2013Reprints and permissions:

sagepub.co.uk/journalsPermissions.navDOI: 10.1177/0096340213501370

http://thebulletin.sagepub.com

monopoly on high politics and are, in turn,trying to control the future of cyberspace,with, at best, very limited success.

The field of international relations,rooted in 20th-century issues and the-ories, has not kept pace with the emer-ging significance of cyberspace; and asthe empowered non-state groups andindividuals of cyberspace and inter-national politics now simultaneouslyshape one another, the potential colli-sions of law, policy, and practice havebarely been identified. Before the inter-national community can begin to minim-ize the negative consequences of thoseinevitable collisions, it needs to under-stand how and where cyberspace andinternational relations intersect andinfluence one another, and who controlsthose intersections.

An alignment strategy

The term ÒcyberspaceÓ is not welldefined, generally. We, the authors, takeit to describe a new arena of human inter-actionÑfocused on the Internet and thehundreds of millions of computers theInternet connects, the institutions thatenable it, and the experiences it pro-videsÑthat has become a fundamentalfeature of society, creating a new realityfor almost everyone in the developedworld and a growing number in thedeveloping world. For analysis purposes,the Internet can be thought of as havingfour layers: the physical foundationsÑthe InternetÕs bricks and mortar, fromfiber-optic cables to cell towers, per-sonal computers, and servers; the logicallayer, which includes the Internet proto-cols, the World Wide Web, browsers, thedomain-naming system, websites, andsoftware that make use of the physicalfoundations; the information layer of

encoded text, photos, videos, and othermaterial that is stored, transmitted,and transformed in cyberspace; and, ofcourse, the users who shape the cyber-experience and the nature of cyberspaceitself by communicating, working withinformation, making decisions, and car-rying out plans. Detailed study of theselayers reveals that they have interestingand important substructures; for exam-ple, the logical layer includes the Internetitself (along with a sub-layer associatedwith Internet service providers, or ISPs),and the applications that run over theInternet, which are provided by a separ-ate set of players.

In this model, the InternetÕs upperlayers depend on the functions of thelower layers, but not the opposite. Thisview of the Internet is useful in locatingcyber actors and activities, highlightingsignificant technological changes, andidentifying the conditions under whichactors operate across layers or, alterna-tively, choose to concentrate their activ-ities within a layer. This way of looking atcyberspace can help track and representpatterns of dependencies and influencewithin the cyber domain.

A common way of taking stock ofstructure and process in internationalrelations, meanwhile, involves a focuson levels of analysis. Traditionally, pol-itical scientists have looked at levelsconsisting of the individual, the state(acknowledging the existence of non-state actors), and the internationalsystem (Waltz, 1959). This view isanchored in the principle of sovereignty,which distinguishes between the stateand other entities and provides the legalbasis for the modern system of inter-national relations. In recent years, afourth level has been recognized, theoverarching global system (North, 2000).

22 Bulletin of the Atomic Scientists 69(5)

By using this model, we see some not-able implications of cyberspace. Cyberaccess empowers the individual, provid-ing new and powerful ways to articulateand aggregate individual interests andmobilize them for action. The individual,therefore, begins to matter in the state-based sovereign system of internationalrelations. From a theoretical perspective,this means that the first level in inter-national relations theory is as importantas other levels of analysis, a change fromtraditional theory.

The construction of cyberspace alsochanges the traditional security calculusof the state, adding the notion of cybersecurityÑthat is, protection againstthreats to online information, espionage,sabotage, and fraud, among other thingsÑto the internal, external, and environmen-tal dangers that states have long faced(Choucri, 2012). Cyberspace has acceler-ated the formation of private interests,including transnational and multinationalnon-state actors, that become influentialentities in their own right. It has empow-ered international institutions with newtools to support communication andperformance. But it has also created a newarena of conflict and contention amongmember states, best exemplified bydiscussions at the World Conference onInformation Technology aimed at rene-gotiating the 1988 International Tele-communication Regulations, a treatycreated in a pre-Internet era whenmany telecommunications firms werestate-owned (WATTC-88, 1988).

As a fourth level of analysis of inter-national relations, the global system is arelatively new feature of world politics.Transcending and incorporating otherlevels, this level consists of the EarthÕspopulation and its global society, supportedby all the life-supporting properties of

nature. It now spans cyberspace, the mostpervasive system of interaction ever con-structedby humanscienceandengineering.

One addition is required to the levels-of-analysis model to capture a centralaspect of cyberspace. The traditionallevels comprise a state-centered model;cyberspace is, to a large extent, a creationof the private sector. Private-sectoractors do not fit neatly into the analysislevelsÑsome may be domestic, sometransnational; some are profit-making,others are not. But these actors must beincluded as a part of our model in order tooffer a realistic framework for analysis.

Combining these analyses of Internetlayers and international relations levelsreveals a wealth of relationships (seeFigure 1) that could be useful to policymakers who are managing the fractiousco-evolution of both systems.

The combined cyber internationalrelations system

At a minimum, a system that combinesfundamental analyses of internationalrelations and core features of cyberspacecan help situate a wide range of issuesand contentions spanning both domains.Several high-visibility cases illustratehow events in the cyber arena intersectwith (or permeate) the traditional levelsof international relations.

Wikileaks: Release and reaction

In 2010, Wikileaks, which styles itself as anonprofit media organization, releasedhundreds of thousands of highly sensi-tive, classified US government docu-ments. The release of the Iraq War logsand State Department diplomatic cableswas an issue residing at the informationlayer of the Internet architecture. In

Choucri and Clark 23

terms of international relations analysis,it might initially be seen as a state issue,because the documents originally be-longed to the US government. However,it was in fact an international issue; theWikileaks founder and spokesman,Julian Assange, lived overseas. It hasbeen speculated, but not confirmed,that the US government influenced thedomestic provider of the Wikileaksdomain name (wikileaks.com) to disableit. In response, Wikileaks registereda variant of the name in Switzerland.Wikileaks was also attacked at the phys-ical level when the company hosting theWikileaks website terminated its hostingagreement. In response, the dataset wasmoved overseas and various advocateshosted copies across the globe, more orless assuring that the information couldnever be suppressed.

Pakistan and the YouTube problem

In 2012, in response to the release of theanti-Islamic film trailer known as

Innocence of Muslims on the Internet,the Pakistani government made anattempt to block domestic access toYouTube. The move was typical of vari-ous nation-specific attempts to blockcitizen access to content that is deemedoffensive, disruptive, or illegal. In thiscase, however, there was a global twistto the story: Pakistan instructed itsdomestic Internet service provider(ISP) to take action against YouTube;but ISPs have no control over YouTube,which is owned by Google, and what itposts. So the Pakistan ISP took theapproach of injecting a false routingassertion into the local region of theInternet, redirecting digital informationpackets being sent to the YouTube Inter-net protocol address to a local site, whichwould inform the viewer that YouTubeaccess was blocked. Due to a technicalerror, this redirection command leakedout of Pakistan and disrupted access toYouTube in various parts of the globe. Aworldwide effort by ISPs was required toÒfence offÓ PakistanÕs disruption. The

Figure 1. The four-column matrix to the left of the gray vertical bar shows some of the relationships

involved in the combined system of cyber international relations. The two columns to the right of the gray bar

reflect the activities of private-sector entities, both for-profit and non-profit, within the layers of cyberspace.


response was not a traditional inter-national action, then, but a large-scale,voluntary, global, non-state action.

Spam: Less is more

SpamÑthat is, unsolicited e-mailÑarises at the application and informationlayers of cyberspace analysis. Manycompanies and research groups havehelped combat spam, but a significant,effective response has arisen at an insti-tutional, global, non-state level, viaan organization called the SpamhausProject, which collects lists of sitesknown to produce spammers and passesthe lists on to e-mail operators, who thenhave the option of blocking e-mail fromthose sites. Spamhaus is lightweight (per-forming only this function, it has very fewassets), and it can easily position itself injurisdictions that are unsympathetic tolawsuits from enraged spammers.

Social media and the Arab Spring

The Arab Spring resistance movementsbegan in Tunisia, and Egypt (and subse-quently other Arab states) also haduprisings that changed the normalcourse of politics through the concentra-tion and expansion of activities ofhumans (that is, at the people layer ofInternet analysis). Users leveraged theirInternet connection via Facebook andother online services to mobilizepolitical protest and create a relativelynonviolent but dramatic and effectivedemand for internal political change. InTunisia, secular politics prevailed initi-ally; in Egypt, the popular vote yielded anIslamist president, but one year later, amassive mobilization demanded hisresignation, and the Egyptian armyremoved him from office. In terms of

international relations, these events andother attempts in other countries might,on first inspection, have remained at theindividual level of analysis, but they hada powerful impact on the state level.These events also created spillovereffects from one country to another,and to the international system. Interms of Internet analysis, Egypt triedbriefly and ineffectively to quell thecyber-based aspect of the protest byturning off the Internet at the physicallayer; at the information layer, halfwayaround the world, China blockedresponses to politically sensitive searchterms related to the uprising; and at thesocietal layer, the phenomenon is nolonger just a cyber event, but a real-lifeevent in the Egyptian streets and in theseats of that countryÕs government.

Based on a combined assessment, a fewpreliminary conclusions about cyberinternational relations can be drawn:

. The lower layers of the Internetarchitecture are more amenable tostate regulation, since they are moreÒphysical.Ó The activities that takeplace there also tend to be capitalintensive and thus associatedwith large, established actors. Thehigher layers are often populatedby smaller, private actors that canmore easily escape governmentalregulation and enforcement.

. An issue that naturally arises at onelayer (e.g., the information layer) is,to date, most effectively dealt withat that layer. Attempts to deal withproblems by imposing controls atanother layer often fail. Efforts tocontrol Wikileaks by disabling itsname in the Domain Name Systemor turning off the entire Internet toblock access to social networking


sites such as Facebook and Twitterproved largely ineffective.

. Recent political events show howaggregated activities at the indivi-dual level and the user layer affectthe state level, creating threats tostability that, in turn, lead the stateto attempt to control cyber access.

. Non-state actors can be both globaland small. Many of the importantnon-state global actors seem to bepositioned at the higher layers of theInternet architectureÑthey are moreconcerned with people and informa-tion than with fibers and packettransport. But this is not always thecase: For example, some features ofthe physical layer, notably underseacable, are managed in large part bymultinational, non-state actors.

. Non-state international organiza-tions, sometimes poorly institutio-nalized, have shown the nimble andflexible character necessary to dealeffectively with cyber issues. Theseentities can position themselves ascompetitors to government-relatedinternational institutions as theproper venue for oversight and gov-ernance of cyberspace.

The system provides mainly a staticmodel for thinking about how actors andactions can be positioned and evaluated incyber international relations. In principle,all actors and all cyber functions can bepositioned within this framework. Buthow do actors interact, with what means,and to what political or other effect?

Power and influence: The controlpoints

Control-point analysis complements andextends the levels-and-layers system

explained above, exploring power andinfluence dynamics among the actors inthe cyber and international relationsrealms. For example, the actors thatactually manage and operate regions ofthe Internetare Internet service providers.Within their regions, they exerciseultimate control of the completion ofconnections: If they do not forward thedigital information packets that makeInternet transfers work, the operationfails. Other aspects of the Internet experi-ence are controlled by other actorsÑthosewho develop operating systems, buildbrowsers, make web content, and so on.

Governments can pass laws, and actorsaround the periphery of cyberspace cancompete for power, but in the end, ifthese actions are to have any conse-quence, they must change the characterof cyberspace itself in some way. Other-wise, they are not material, as is illustratedin a closer look, via control-point analysis,at Internet management in the UnitedStates and China.

Distributed control of the Internet: A USexample

Surrounding those with direct controlover the Internet is a larger set of actorsthat attempt to exercise control, usuallyindirectly. For the purposes of our ana-lysis, we will look at four types of actorsas they deal with the Internet in theUnited States: the ISPs themselves; thefederalgovernment;private-sectorcopy-right holders, who are very concernedwith control of infringing copies of con-tent; and Google, a powerful actor withmany dimensions of influence overcyberspace (see Figure 2).

In general, few governments exercisedirect control over cyberspace. They canexert great influence by their ability to


influence other actors, using regulation,legislation, investment, and standards.The actors representing the interests ofcopyright holders also cannot exercisedirect control over cyberspaceÑtheymust work indirectly through otheractors, in particular the ISPs. They havelobbied the government to pass lawsÑin particular the Digital MillenniumCopyright Act (DMCA) in the UnitedStatesÑto give them the authority to influ-ence what ISPs and content hosting sitesmust do.

Google is a powerful, private-sectoractor whose business is primarily cen-tered on the Internet. Google has takena wide range of actions, both direct andindirect, to use points of control to influ-ence the character of the Internet. It hasdeveloped a new operating system formobile devices, Android, has developeda browser called Chrome, and providesYouTube, one of the most popularsites on the Web. It has its own contentdelivery network with global reach anddirect connection to many consumer-facing ISPs.

One can see differences in intent andcapabilities in these different actors.While content providers generally focuson regulating content, Google seeks toincrease the diversity and choice in theecosystem, to ensure that customershave many ways to reach its servicesÑGoogle recently purchased MotorolaMobility in part to gain patents relevantto mobile communications, for exam-pleÑand in the process to expand itsbusiness and increase profits.

Centralized control: The Chineseapproach

In China, the state controls almost everydecision point in the overall process of

the Internet structure and its key institu-tional underpinnings, as well as anydepartures from sanctioned productsor processes. China has constructed acomplex socio-technical framework todetect unacceptable content and man-date its removal or modification. Itrequires that all ISPs, including mobilehotspots, obtain permits and registertheir users. China regularly blocksprotocols such as virtual private net-works (VPNs) and more sophisticatedsoftware such as The Onion Router(TOR) that seek to bypass governmentcontrol of Internet access. Chinainstructs its ISPs to control routes, espe-cially at their borders, block access tocertain applications (e.g., Facebook,Google, and Twitter), block access tospecific websites, block circumventionprotocols, and use deep packet inspec-tion to look for specific keywords in digi-tal information packets on the Internet; ifdisallowed keywords are found, ChineseISPs are required to terminate the userÕsInternet interaction (see Figure 3).

Combining control-point analysiswith cyber international relations canhelp visualize how some attempts toinfluence cyberspace are or are not suc-cessful. For example, attempts to censorcontent on the Web are normally domes-tic in scope, because the laws that definethe rules that govern content hostingsites and rights holders are usually spe-cific to a country. That is to say, rightsholders may have many points of controlrelating to the Internet in the UnitedStates, as indicated in Figure 2; however,in China, those same rights holders havelittle if any influence. Overall, rightsholders have had to fight more or less acountry-by-country campaign to protecttheir property from piracy, greatly redu-cing the effectiveness of their efforts.


The co-evolution of internationaland cyber relations

Returning to the dilemma introduced atthe beginning of this piece: The in-creased interconnection of cyber andother aspects of international relationswill continue to shape their co-evolutionalong a trajectory that tends towardeven greater interconnectedness. Sev-eral defining features of world politicswill affect this continued co-evolution.

The first such parameter relates to sov-ereignty and jurisdiction: Traditionally,

jurisdiction is inherent in sovereigntyand understood in physical and geo-graphical terms (with the usual excep-tions of diplomatic and extraterritorialarrangements). Jurisdictional disputes ofa geographical nature can be addressedby the relevant states, or through someadjudication process. At the very least,there are some established processes.

Jurisdictional boundaries are weak incyberspace, yet many notable cyber situ-ationsÑsuch as contention over regula-tion of the domain name system, spam,and various criminal activitiesÑinvolve

Figure 2. A control-point analysis shows how some US actors try to exercise control over the Internet for

different reasons, and in different ways.


jurisdiction issues that have beenaddressed largely on an ad hoc basis. Ifthere is international law for cyberspace,it is still in the making. One analystargues that there is a Òsimple choiceÓbetween Ò[m]ore global law and a lessglobal internetÓ (Khol, 2007: 253).

A second parameter relates to theautonomy and power of the privatesector and non-state actors. While inter-national relations theory and policy rec-ognize the importance of non-stateactors, in no arena are they as dominantas in the cyber domain. These non-state

actors are the essential and fundamentalsystem organizers and managers ofcyberspace. Recall that it was the mostpowerful nation, the United States, thatdelegated to the private sector the oper-ational management of the Internet.Early on, this sovereign decision set therule of the playing field. None of this wasthe result of international deliberation orinternational decision.

This autonomy and power of the pri-vate sector all but assures that the statesystem anchored in sovereign authoritywill make every effort to redress or to

Figure 3. Control-point analysis illustrates how the Chinese government (shown in blue) attempts to

control the Internet.


ÒrectifyÓ a seeming anomaly in inter-national relations by reasserting the dom-inance of state sovereignty over cybermatters.

A third parameter of world cyber-politics pertains to the norms and princi-plesÑthe code of conductÑfor an inte-grated international system. Alreadysome interest is noticeable in variousparts of the international system in devel-oping shared norms for behavior incyberspace. The formal deliberations atthe World Conference on InternationalTelecommunications in December 2012reflected the dominant as well as thelesser contentions over norms and prin-ciples. Many conflicts between suppor-ters of a distributed Internet controlsystem and those who favor concentratedcontrol arose and were debated; ulti-mately, there was no consensus, so thedebates will continue in the coming years.

All of this bears on the future of cyber-space. We see today several examples inwhich the state system is trying tomodify the Internet to better align itwith traditional interests of the state,whether these are a more accountablenetwork (to prevent and deter unaccept-able behavior), a less accountablenetwork (to empower activists and dis-sidents), a network with better tools toregulate access to select content (toremove destabilizing speech or materialthat infringes copyright), or a networkthat is universally available, easier touse, and an unfettered platform forinnovation and commerce.

The alignment of layers of the Internetand levels of international relationshelps reveal critical features of structureand process that relate to control ofcyberspace and to anticipate potentialchanges in the structure of the Internet,and in the nature of the international

system. Control-point analysisÑa methodfor identifying who controls what, when,and howÑis useful also for comparing dif-ferent cyber-policy postures in inter-national relations and their attendantinstruments of influence and control.Only two cases are described in this art-icle, which thus may underestimate thediversity of control possibilities.

Clearly, neither the Internet nor thestructure of the international systemwill remain unchanged. The co-evolutiondilemma forces us, the authors, to exploreand anticipate potential futuresÑinconceptual, empirical, and perhaps evenstrategic terms, and frame policy andpractice on viable principles.

The different actors that strive to influ-ence the character of cyberspace have dif-ferent tools at their disposal and differentaccess to the various control points of thecyber arena. In this respect, what we see isÒasymmetric contentionÓ over the future.Actions at different levels and layersinteract: Our framework is a way to mapout these actions and better understandtheir interactions, and the different ex-pectations for success for these variousactors over time.

FundingThis work is funded by the Office of Naval Researchunder award number N000140910597. Any opinions,findings and conclusions, or recommendationsexpressed in this publication are those of the authorsand do not necessarily reflect the views of the Officeof Naval Research.

References

Choucri N (2012) Cyberpolitics in International Rela-tions. Cambridge, MA: MIT Press.

Khol U (2007) Jurisdiction and the Internet: RegulatoryCompetence over Online Activity. Cambridge:Cambridge University Press.

North RC (2000) War, Peace, Survival: GlobalPolitics and Conceptual Synthesis. Boulder, CO:Westview.


Waltz KN (1959) Man, the State and War. New York:Columbia University Press.

WATTC-88 (1988) Final acts of the World Adminis-trative Telegraph and Telephone Conference,Melbourne, Australia. Available at: www.itu.int/dms_pub/itu-s/oth/02/01/S02010000214002PDFE.pdf.

Author biographies

Nazli Choucri is a professor of political sci-ence at MIT. Her research focuses on thesources and consequences of international con-flict and violence. Her most recent book isCyberpolitics in International Relations (MIT

Press, 2012). She is the architect and directorof the Global System for Sustainable Develop-ment, a multilingual knowledge system on themultidimensionality of sustainability.

David D. Clark is a senior research scientist atthe MIT Computer Science and Artificial Intel-ligence Laboratory. Since the mid-1970s, he hasbeen leading the development of the Internet,acting as its chief protocol architect from 1981to 1989. His current research looks at redefin-ition of the architectural underpinnings of theInternet, and the relation of that architecture toeconomic, societal, and policy considerations.


Copyright of Bulletin of the Atomic Scientists is the property of Bulletin of the AtomicScientists and its content may not be copied or emailed to multiple sites or posted to a listservwithout the copyright holder's express written permission. However, users may print,download, or email articles for individual use.

Documents

90053934