And I say, all right, foreign head of state,
because it seems that he's doing such interesting work that we could not just find pause where he is run owns
percentage and if nothing else we're demonstrating that we're not justifying very strong specialist and policy.
Well very, very well established professors speaking really like they are.
It's also important to have new blood, new ideas, fresh thinking about subjects, about this particular subject of cybersecurity.
And this what may or may not be an age of privateering vessels,
especially as opposed to this very day foreign is doing this inside cybersecurity, which we began in 2013.
He has been suspended all this time looking at national transnational actors in the
cybersecurity world and its impact upon international affairs and international politics.
We were discussing that over lunch earlier. He has an undergraduate degree in law and international affairs University of CENTCOM and holds a
master's in international relations from the Graduate Institute of International Studies in Geneva,
Florida. Who is you? Apply for jobs? No problem.
Thank you very much for coming. It's a pleasure to see so many familiar faces here and I welcome you all.
This talk is part of a project.
This talk represents an argument that is part of a project that I developed in my first year at the Centre for Cybersecurity,
and I will develop the argument further into the dphil. So I'll be particularly interested in your comments and feedback in a way to take this,
what kind of implications the argument might have and how we might refine it.
The argument will also be published as part of the launch of a new Cyber Security
or Cyber Studies Working Paper series at the DPR here in Oxford and tomorrow.
So if you're interested in it, look at it, look at the site tomorrow.
So let me start. Cybersecurity, cyber security is a classic problem with our passports.
Threats propagating through the transnational and globally interconnected cyberspace are difficult to manage with conventional state instruments.
While as Joe Nye frames it, states are struggling to understand and define their interests in the cyber domain.
The Academy still grapples with interpreting and modelling this actor rich and seemingly chaotic security environment.
The use of historical analogies can hinder or help this analytical task with profound implications for policy.
So an analogy always carries with it. Practical implications about contents causes expectations, norms and strategic choices.
In addition, recent scholarship highlighted the constitutive purpose of analogies in the policy making process,
and this highlights how a problem space can be constituted by the use of analogy for policymakers.
In short, the choice of analogies shapes the way scholars and practitioners perceive problems.
Thus, we should think carefully about what analogies we use.
I've seen an analogy to policy mechanism used in for framing the problems of cyber security.
Specifically, security analysts and policymakers who work during the Cold War have been quick to you to make use
of the Cold War strategic concepts such as classical deterrence and portent to the cyber realm.
This can raise severe problems as it leads back to state centric assumptions that hindered interpretations of new forms of state.
The non-traditional agency characterising the cyber phenomenon.
So the analysis of cybersecurity requires more appropriate historical analogies.
Instead of focusing on these state centric analogies.
I look at challenges arising from the murkiness of state and non-state distinctions in the age of privateering.
And I develop this historic and a historical analogy to capture problems of the state action in a historically largely ungoverned security space,
namely the sea. I examine the actors involved with various degrees of state involvement in the ungoverned seas a previous centuries.
Specifically, I look at navies, mercantile companies, pirates and privateers.
And lessons from them are drawn for the analysis of contemporary problems of cyber insecurity.
The argument that I make can be seen in the context of a broader stream of research connecting to the new wars,
literature and the new medievalism literature, but also the literature on private authority and the privatisation of security.
Thereby I problematise the non-state menace of non-state actors.
Quoting from the introduction of an edited book on non-state armed groups by Keefe, Crouse and Jennifer Milligan.
They said many so-called non-state armed groups are also deeply entangled with state power and state agents in complex ways.
Thus, the label non-state represents a barrier to understanding their multiple roles and functions.
So I am I am to break up this barrier by introducing more nuanced conceptual understandings between state and non-state actors.
I am sorry. That was a big quick. Let me see whether the computer can handle it.
There we go. I will continue by outlining the history of both profiteering and cyber security.
Obviously, very brief. Secondly, I will compare the two themes by identifying similarities and dissimilarities in the roles of state actors,
semi-state actors and criminal actors. And third, I will discuss the limitations of the Privateering analogy as a conceptual benchmark,
as well as using this analogy to make policy decisions on cyber security.
So let me go into the brief history. What is the private sphere and when did it come into existence?
Privateer can be a ship or a person engaged in Privateering.
Usually it's referred to as a privately owned vessel that operates against an enemy
with the license or commission of the government at times of war and the pirate.
The privateer differs from the pirate with regard to the authority of the state.
The use of privateers was established state practice between roughly the 13th century and the 19th century.
It ended with an international agreement abolishing the practice of Privateering in 1856.
Clearly our expert in Privateering would say that it continued, the practice continue,
but the agreement basically abolished the international practice of it.
Now, earliest references in England date back to King Henry, the third, who ordered men of the coastal towns to,
quote, commit every possible injury to the French at sea, unquote, and share half of the profits with the king.
Privateering can be differentiated from the practice of reprisal during peace times.
Letters of Marque could be issued to merchants that sought redress against harms they suffered from foreigners at sea.
This would allow the merchant to attack other ships of that nation until he finds something equal to the value of his loss.
As merchant shipping increased state exploitation day to in times of war, privateers were used to disrupt shipping and gain income.
Privateering was often sponsored by private capital.
Famously, the Elizabethan sea dogs engaged to engage the Spanish in the new world, raising large sums of money for themselves and for the crown.
However, this did not come without problems. Take the famous privateer Sir Walter Raleigh.
He was knighted for his services to the court.
However, he did not stop looting after the peace treaty between England and Spain and was therefore executed by the Order of James the first.
So this is a case in point of how privateers actually step outside the interests of a state.
The longer the wars lasted, the more privateering was professionalised and institutionalised.
At the end of wars, privateers were either integrated into Navy or became pirates.
Now we can see how the line between a privateer and a pirate will be blood.
The French started to invest in privateers or corsairs in the late 17th century.
They provided an ideal weapon against the English who rely more on foreign trade.
Let's look at piracy.
Piracy proved to be problematic for England, as English pirates did not refrain from attacking ships of local rulers in English colonies.
This happened in India, for example, where the mogul demanded to be protected from English speaking pirates by the English East India Company.
In turn, the company was also attacked by English speaking pirates.
The company demanded protection from the Royal Navy. This only caused the pirates to move to the Bahamas.
But it is an episode that will come back to later. And during the 18th and early 19th century,
the British state reacted against pirates by offering incentives to the pirates implementing
a legal reform in the colonies who were sometimes complicit in the prior trade,
and sending the Royal Navy to destroy the pirate home bases. After a period of decline of English privateering.
It research in the 18th century, Britain adopted a policy that encouraged privateers to attack neutral ships trading with French colonial goods.
However, by the end of the 18th century, it was mostly the U.S. and France that employed privateers against Britain.
Privateering had evolved into a weapon of the weak against the strong.
Although it was invented by the strong states of Europe, whose naval power was partially an outgrowth of privateering.
Privateering was abolished by the Congress of Paris in 1856 in a political deal as a demand of the British,
who in return committed to protect neutral trade and whoever is interested in this really read.
Dr. John Limited spoke on the abolition of Privateering, who excellently covered this.
And of course, this whole history would not be complete without highlighting the concurrent
development of the nation state and the institution of national sovereignty.
Sovereignty on the high seas will be linked to a state's capacity to control,
and the absence of sovereignty is one of the preconditions for the presence of actors that I discuss.
So let me turn to cyberspace. Relatively brief history of cyberspace.
Growing out of the defence and academically funded network,
it was really the commercialisation and the advances of personal computing that gave rise to the growth of cyberspace.
Early design choices did not prioritise confidentiality concerns.
Rather, they focussed on the ability to connect and on packet delivery.
Different actors have shaped the norms associated with cyberspace.
The early proponents focussed on an open, unregulated network, but with the expansion of the network,
states started to realise the vulnerabilities of the relatively unchecked interconnectivity with the rest of the world,
alongside an increase of a technically literate user base.
Attacks also rose. At first, computer emergency response teams were formed.
For example, the Carnegie Mellon University site in 1998 was one of the first,
and they were formed to respond to the technical challenges of a growing number of threats.
Deserts started cooperating internationally by sharing data.
However, whilst performing the same basic function, the diversity of national political systems and practices led to challenges regarding cooperation.
So states have reacted to the security challenges from cyberspace in different ways.
The United States military has evolved its policy of information warfare from the early 1990s into a fully operational cyber command structure.
But this was both this was done both as a quest for information dominance in warfare,
but also because the interconnectivity of critical infrastructures post new risks to national security.
Clearly, it was also done as a sort of budgetary inter-agency process where the military wanted a piece of the cake.
Similarly, most advanced industrialised states have tossed their defence and intelligence
agencies with a large role in implementing their cyber security strategies,
growing out of the capabilities of the traditional signals intelligence.
Many states have teams working on how to exploit cyberspace for their own interests.
So the use of private actors by states is of particular interest to me.
And this leads me to Heart of the talk, where I've developed a framework of how I'm going to compare the two domains.
First, going to go through state actors preparing many cyber armies, intelligence and intelligence agencies,
police forces and contractors then go through the same state actors with marketing companies and privateers and
technology champions and patriotic hackers and some cyber criminal elements on the on the cyberspace side.
And then criminal actors with pirates and cyber organised crime.
So let me start with the state actors. Well, states first used to make heavy use of privateers.
By the end of the 16th century, states with ambitions for naval influence needed professional navies.
Spain, England, the Netherlands. All invested in state owned naval capabilities early on.
Whereas other powers continued to rely heavily on a combination of privateering and renting warships from other powers, for example, France.
Public recruitment rendered privateering more regulated.
For example, in order to prevent competition for personnel.
So the war for talent. A quota of professional sailors for privateering ships was introduced so that not all the sailors go on the privateer boat.
Whilst Privateering continued to be an auxiliary method to grieve in enemy's waterways,
but professional navies were able to perform more complicated and resource intensive tasks, such as establishing blockades on enemy's ports in cyber.
Various efforts for public recruitment are on the way.
Since the 2000s many states have invested in cyber defence, intelligence and policing capabilities.
There are different ways in which cyber capacities are developed.
Some states invest in governmental capabilities, refraining from relying heavily on third party support.
However,
there is a range of cybersecurity contractor services that offer anything from intelligence to surveillance to offensive operational capabilities.
The spectrum covers defence, intelligence and policing tasks.
States can use these services to jumpstart their own technical capabilities in operating in the cyber realm,
expensive manpower developing so-called zero day exploits is outsourced to companies who act as middlemen buying and selling exploits.
A zero day exploit is a is an exploit,
a piece of code that can take advantage of a system or take advantage of a vulnerability that has not been disclosed to anybody else.
So you basically get a one free go at the system. Let me switch to the semi-state actors.
Mercantile companies perform semi-state functions interested in unregulated profit making.
They operated with state consent, assuming sovereign like functions abroad.
The right to raise an army and to declare war illustrates this point clearly.
That's a quote from Kenneth Thompson.
At the heart of these practices was the state building process to attain wealth and power promised by overseas expansion.
States empowered non-state actors to exercise violence, end quote.
The companies operate their own foreign policies, make deals with other companies or state or went to war with them,
sometimes against the interests of their home states.
The companies also use the association with the state to stabilise their operations base and seek protection.
For example, we heard before that when the East India Company was under pirate attack, they sought protection from the Royal Navy.
However, the mercantile companies were also used as a source of revenue and power.
For a long time, these companies ruled vast territories and it is important to highlight the political economy aspect of it.
So in a mercantilist economy, the political and the economy economic were not functionally differentiated.
So the term mercantile reflects the symbiotic alliance between the state and
commercial interests in pursuit of power and wealth at the expense of other states.
Arguably, there is no modern day equivalent of the mercantile company.
The closest analogies that one can make all the technology champions and telecommunication providers,
they hold large market and informational power in between countries.
And I've given you some selections of what I think of when I think about mercantile companies.
Know some are in the United States so Apple Microsoft Google the AT&T of these world or while away in China or Deutsche Telekom in Germany.
There are plenty of examples to draw from. Sorry.
So. So in the case of the US companies,
the link with the state was made apparent by the Snowden disclosures regarding the National Security Agency's activities.
The most prominent example is a US government program codenamed Prison,
in which the government compelled several telecommunication providers to cooperate with them so as to facilitate data collection among the US persons.
The exact nature of voluntarily shared data between private corporations and state agencies is a question of further research.
Similar relationships exist elsewhere. Reports in the press are.
I have been documenting the same for France and the United Kingdom.
But this is just what is public knowledge. I'm sure it would exist elsewhere as well.
The relationships between these states and the companies are usually kept secret.
States profit from the globalised market dominating nature of these commercial enterprises in the
identity sector by gaining access to information and consequently to another vector of power.
Another resemblance with mercantile companies is shared when companies are able to levy state resources for their own defence abroad.
So one example was provided by Google's actions in 2009 and 2010.
In China, when Google faced allegedly Chinese governmental intrusions, the American state officials became involved very quickly.
Just like the British East India Company called on the Royal Navy.
Google reached out both to the US State Department and the NSA for help.
A third resemblance of the multinational city companies and mercantile companies emerges from their interaction with different state actors.
So on the one hand, multinational companies have a commercial incentive to offer to offer their
intelligence collection capabilities to more than just their home government.
On the other hand, in the interest of selling their services to foreign governments,
companies have to convince governmental buyers of the security of their product.
And from these dual objectives. Incentives arise that are different from the home states objectives.
Also, the legal domicile of the company exposes it directly to the legal risks of the respective country.
However, due to the global operations of the company, it may be influenced by any state that has sufficient leverage over the companies undertakings.
And again, the interaction between these different objectives. This is an important area of further research.
It's something that I can't give definitive judgements. So let's move to the privateers.
Moving from the mercantile companies. The most prominent semi-state actors were the privateers.
There were private individuals, for example,
merchants that use private equipment at their own risk to fulfil the mercantilist state sponsored goal of attacking enemy commerce.
In return, they profited from the booty. The state benefited from this undertaking.
Twofold. On the one hand, it was a way of disrupting enemy commerce and consequently for the own merchants to profit.
On the other hand, it provided a good source of income in cyber.
There is a similar development, but we need to differentiate between the political and the economic privateers.
Although not restricted to countries at war,
attacks against companies are regularly attributed to patriotic hackers working in the political and economic interest of a country.
Patriotic hackers have been active in many highly visible cases.
Political cases ranged from Russian hackers attacking Estonian 27 to Chinese and US hackers attacking each other in 99 and 2001,
and Muslim and Israeli hackers hacking themselves each other ongoing.
There is a closer economic and political alignment of interests between hackers and government.
On the one hand,
there are hackers who form part of a governmental effort to raise cyber capacity instead of recruiting personnel for governmental positions.
The government relies on the support of private personnel in several countries.
So here I'm thinking of the cyber militias that several countries have raised.
On the other hand, recent reports have indicated a shift of groups formerly known to be engaged in political attacks toward more economic targets,
focusing on economic espionage and intellectual property theft.
The use and encouragement of private talent for economic wealth transfer is the real modern version of Privateering.
So let's look at the case of Russia in the case of Russia.
Allegations have been made about the close alignment of Russian and Eastern European cybercrime networks with Russian state interests.
The influence and direction of criminal activity is multilayered.
An example is the discretionary enforcement based on the targets that the criminals select.
Another is the way cyber criminals become active in the Russian political efforts.
Clearly, the use of non-state actors by governments is an argument, a possibility.
Empirical evidence is usually incomplete and open to interpretation.
Tacit support can usually be inferred by the absence of cooperation between governments in the presence of a mutual legal assistance treaty.
For example, when Estonia was attacked by patriotic hackers from Russian IP addresses,
the Mutual Legal Assistance Treaty should have led to responsible state behaviour as expected by international law,
meaning forensic evidence being exchanged. That did not happen.
That's also why I've given you a picture of the Nazi movement, the youth movement,
that these attacks were attributed to the patriotic youth movement in Russia in the case of China.
The Chinese hacker scene is also engaged in attacks against commerce.
Chinese hackers and their alignment with governmental interests are well documented.
Chinese hackers have also been used by the Chinese government to deny governmental involvement in attacks emanating from the network space.
So the Chinese government would say they are the biggest, the biggest victim of cyber crime, which to a certain degree is also true.
So the criminal element also gives you a plausible deniability aspect.
So to conclude, companies, hacker groups and some cyber criminals engage at their own risk to fulfil state
sponsored goals against the interests of other commercial and non-commercial entities.
But sometimes the profit motive is for the state and the hacker groups are really different than in privateering.
In cyber, states may profit indirectly by gaining capabilities of criminal hacker groups in return for tolerating cybercriminal activity.
Whereas, in the case of Privateering states directly encouraged to profit generating activity.
So that leads me to look at the criminal actors.
Priorities proved to be difficult to control because they would often resort to piracy, attacking not only enemies but also neutral ships.
This led to acts of reprisal against commerce, which increased the need for protection and raised insurance rates for merchants.
Some pirates rejected their home states and formed pirate communities centred around their profession.
Some states chose to pay off the pirates so that they would attack the state's enemies.
Pirates sold their goods in pirate markets, which provided cheap colonial goods to merchants.
And in this way, states could avoid that, could avoid being injured, profited from the pirates.
Pirates became a problem when their actions were attributed to the country of origin.
In the case of Britain, this meant that other states would associate the actions to the East India Company,
which in turn requested the Royal Navy's protection.
It was clear that a state would have to take control of private acts in its own territorial waters.
However, on the high seas, that's different. The solution to piracy is on the high seas came in treating all pirates a stateless.
However, this was only viable once states could define piracy.
And in order to define piracy, a clear distinction from state sponsored and state sanctioned violence had to be made.
This, in turn, was only possible after the the legitimation of Privateering.
So as professional navies developed and privateering was rendered more regulated.
The differentiation between piracy and Privateering became more formalised.
In cyberspace, the criminal market has matured to the point that most parts of the criminal business process can be bought as a service.
The products and services are marketed with testing possibilities, bulk order discounts and customer service and support.
Information communication technologies have made this type of marketing easier because vendors can hide behind anonymous profiles.
In addition, there is a market for cyber quality crimes.
Targeted hacking as a service service can be bought in advance,
so accounts and intellectual property of a particular organisation and intellectual
property sometimes can also be bought as a side product of an attack.
The collusion of some criminal organisations with the state as described before makes this activity potentially more feasible.
Take the example of the market for zero day vulnerabilities, which is highly professionalised.
This is due in part to the low legal risk of selling such vulnerabilities.
It's a grey market, and in part it is due to the financially potent buyers, the public and private intelligence agencies and militaries.
There are some regional specialisations in cybercriminal underground markets.
Latin America is mostly known for banking malware. Russian the Russian speaking on the ground, focuses on attacking financial institutions,
but has also a large malware community with relatively high technical abilities.
The Chinese have a large hacker community focusing on SIM card scams,
online gaming fraud and intellectual property theft and in West Africa is best known for upfront payment scams, but also fraudsters.
There are some reports that fraudsters are leveraging the information left in electronic waste exported to the region.
So there was a case where the Department of Defence exported some electronic waste, some hard drives to West Africa.
And some young some young person actually realised that one could still retrieve information from the hard drive,
which makes it an interesting business for selling the information to both the cybercriminal economy and pirate bases.
Bring substantial revenue to a country. The country of IT profits both in terms of financial and informational inflow.
And some states may have an interest in harbouring cybercrime, especially when states are able to steer the target selection of cyber criminals.
In addition,
states that would like to have a plausible deniability and to hide behind a hacker group are dependent on the existence of cybercriminals.
Unlike in the age of piracy today, states don't have to fear reprisals against their companies,
but corporations will nevertheless have a strong interest in protecting their informational assets from theft.
So at this stage, we have to think about this a little bit.
At this stage, it is unclear with what measures corporations will protect their assets.
And on ships, merchants would have armed their vessels.
So I'm asking, will the same be true for cyber?
The analogy has made apparent that a clear distinction between state sponsored and state tolerated cyber
attacks has to be made in order for an international regime against cybercrime to form the Budapest.
Conventional cybercrime and its 50 signatories provide a good starting point for an international regime on cybercrime.
However, police cooperation with the rest of the world remains limited.
The UNODC,
in its 2013 report to which Professor Ian Brown contributed that was a report on cybercrime diplomatically pointed out the various shortcomings.
And I would conclude as long as the use of cyber criminals against other states and corporations remains a policy option,
an international regime against cybercrime cannot be expected.
So let me come to the two way. Where to you?
The limitations of this analogy with analogies, it's always the case that there are some parts of the analogy that don't fit.
Let me start with one that actually I think it fits better than other people think.
The Cost of entry. Joe Nye makes the argument that on the sea these days for having an aircraft carrier group,
there are only a limited amount of players that can afford this.
I would agree with him, but I would say he picks the wrong century.
So going back to the 16th century, you had fishermen engaged in Privateering to the point that the English state actually
had to regulate a minimum vessel size so as not everybody to practice privateering.
So I would say the cost of entry might be different in different centuries and at different stages of the development of the realm.
What about the number of state actors or actors in general?
I concur. I think that on the sea, the numbers of actors that you count with are the numbers of actors that have access to the sea.
Coming from a landlocked country, I can empathise with that.
In cyber, everybody's your neighbour. It's very different.
So you have a multiplicity of actors. What about geography?
Geography on the sea. Hugely important strategic sea lanes in which if you control them, you gain a lot of leverage in cyber.
Geography still matters, but comparatively less so.
So it still matters, as we've seen from the Snowden disclosures, that the way that traffic is routed is important.
If you have a lot of traffic going through your country and you can control it, it gives you potential leverage.
But you can circumvent that. You can you can deal with that much more flexibly as an actor.
What about attribution? Attribution is a problem both then and now.
So then attribution. You would have to think about whether the flag matches the papers that were produced on the ship.
And then you would have to think whether you would have to check whether the crew matches the papers that they produced.
Well. That would be a relatively difficult undertaking if you were in the middle of the high
seas and you don't have a national register and you don't have an international register.
It would be a bit difficult.
Attribution in cyber definitely a problem, relatively stimulating process in how would you attribute the biggest difference?
And that's where I think we really have to pay attention to what that changes is that in private hearing you actually have access to the person.
So the person that risks his life attacking you, you have direct interaction with him.
Whereas in cyber you can operate from a relatively stable operation space where you might not fear the reprisal on your body.
What about allegiance to the state? So I've said that mercantile companies in the realm of mercantile companies, it doesn't quite fit the analogy.
Well, I think one way that it doesn't fit is with respect to the allegiance to the state.
So an East India company, it was deeply entangled with the British state,
whereas a Google we can make an argument that as a global multinational corporations, its allegiances to different states might be more complicated.
I think this is something to explore. And then lastly, cyberspace has an artificial topography.
We can't change the sea very much, but we can change the cyberspace.
We can change its underlying infrastructure.
So in the long run, rebuilding some of the protocols with security features in mind is a theoretical possibility.
That's definitely a very different. So let me conclude.
I've given you three conclusions here. So firstly,
the actors present in cybersecurity with regard to the proximity to the state
resemble the actors present in naval warfare in the 16th and 17th century.
Secondly, the militarisation of cyberspace resembles the situation in the 16th century,
when some states transitioned from relying on privateers to professional navies enabled warfare.
This transition crowded out the interest in the use of non-state actors to some degree.
State cyber capacity is in the infancy of this process.
Militarisation could have positive consequences for a regime in terms of cyber crime,
which is counterintuitive because some people argue militarisation of cyber is a completely bad thing to do.
It could actually be accompanied by a decreasing interest in the use of non-state actors.
However, just as France opted for a prolonged period using gas to cool or using their corsairs.
The decreasing interest in the use of non-state actors is not a guarantee.
Thirdly, the analysis of how the regime against Privateering has come about has shown that it can be traced
back to unintended consequences of state sponsored and state tolerated non-state violence,
coupled with a growth of commercial opportunities for sailors.
Similarly, in the cyber world, one might expect unintended consequences to increase over time.
Whether states will be able to coordinate their behaviour to control these unintended
consequences whilst preserving the positive effects of cyberspace is an open question.
And finally, it is unlikely that there will be a regime regulating the use of non-state actors any time soon.
Existing for cooperation will continue to exist and are likely to be expanded as cybercrime becomes an increasing problem for all states.
The scope for cooperation will increase, and the scope for collusion between state and non-state actors is likely to decrease.
However, states are likely to continue to rely on their large technology champions to provide information and access.
So it remains to be seen whether the Snowden disclosures will have a long term economic impact on U.S. technology firms.
If so, we might expect industry to be an actor, significant actor working against this process.
And that's it.