IGF 2020 WS #350 Attributing attacks: political, technical & legal dimensions

Information

Session

Thematic Track:

Topic(s):

Capacity Development
Cyberattacks
Cybersecurity Best Practices

Organizer 1: Private Sector, Western European and Others Group (WEOG)
Organizer 2: Intergovernmental Organization, Intergovernmental Organization

Speaker 1: Johanna Weaver, Government, Asia-Pacific Group
Speaker 2: John Scott-Railton, Civil Society, Western European and Others Group (WEOG)
Speaker 3: Camille François, Private Sector, Western European and Others Group (WEOG)
Speaker 4: Serge Droz, Technical Community, Western European and Others Group (WEOG)
Speaker 5: Jens Monrad, Private Sector, Western European and Others Group (WEOG)

Format:

Panel - Auditorium - 90 Min

Description:

This session will seek to moderate a discussion among those from the technical, policy and legal communities that have a role to play in establishing and coordinating attribution claims following sophisticated cyberattacks. It will focus, in particular, on what essential elements should be included in all public attribution statements to lend them credibility and reinforce a rules-based international order online. The session will provide opportunity to hear from expert speakers from each of these communities about the role they play in establishing responsibility for cyberattacks, and the relationships they need or rely on within other stakeholder groups to coordinate attributions. The session will then leverage the experiences of others in the room to identify ways to further streamline and improve attribution efforts in their accuracy, credibility, coordination and speed. Agenda: • 5 minutes – Opening remarks from moderator setting the stage for the discussion, highlighting the current state of affairs as it relates to the attribution of sophisticated cyberattacks to governments and other actors, and letting those in attendance know that a substantial amount of time will be saved for questions in the later portion of the session. • 25 minutes – Opening remarks from panelists, sharing their perspectives on the major opportunities and challenges in achieving respective technical, legal and political thresholds in attributing cyberattacks. • 30 minutes – Moderator asks pointed questions to respective speakers about how they are currently working with other stakeholders in attribution efforts, what thresholds should be for making attributions, and what information should be included in such public statements to make them credible. • 30 minutes – Those attending the session, in the room and remotely, will be welcomed to ask direct questions of the speakers and share differing perspectives related to the different dimensions of attribution, and what they believe thresholds should be for making attribution statements.

Issues:

As the frequency and sophistication of cyberattacks, particularly those led by nation-states, have escalated in recent years, there have been increasing efforts to promote accountability through public attributions. This can prove challenging, however, as attacks in cyberspace often do not have a physical impact and tracing back responsibility can require sophisticated technological capabilities and other sources of intelligence. These sources of information often must be kept secret and are generally spread across government agencies and even different sectors. Moreover, to avoid unilateral finger-pointing and a “my word against yours” dynamic, it is generally preferable to have attribution statements made in coordination with other nations, requiring new relationships and lines of dialogue be formed across governments. As a result of these challenges, government-led attributions of nation-state cyberattacks remain infrequent, and when they are issued it is generally well-after the attack itself has taken place – especially when the attribution needs to be coordinated with other governments. Nevertheless, attribution remains one of the most promising tools of statecraft in a limited toolbox of response options when it comes to cyber conflict. This session will hope to illustrate how these challenges are viewed by different stakeholders, and how they might be overcome through efforts like data-sharing, standardization, greater transparency and other diplomatic engagements across stakeholder groups.

Policy Question(s):

Cybersecurity policy, standards and norms i) What should be included as essential elements in all public attributions of cyberattacks by governments, from a legal, technical and political perspective? ii)What relationships need to exist between stakeholder groups such that comprehensive and reliable attributions of cyberattacks can be made? iii) Do we need new international structures or institutions to play a role in attributing cyberattacks, or should such efforts be led by states on an ad-hoc basis?

Expected Outcomes:

The session will hope to build greater consensus among those in attendance on two topics: (i) the essential elements that should be included at minimum in all public attribution statements, and (ii) how different stakeholders should be included in the process of attributing cyberattacks. Such consensus will hopefully help advance discussions in international forums about how best to establish and interpret attribution claims – including within the United Nations Group of Governmental Experts on Advancing responsible State behaviour in cyberspace in the context of international security, which will be entering its final deliberations in 2021.

Relevance to Internet Governance: Credible attribution of cyberattacks is a cornerstone of establishing a rules-based international order online, as the enforcement of expectations for responsible behavior by States and other actors requires first that violations can be readily and reliably identified. The process of attributing such attacks creates roles and responsibilities for government, industry and civil society alike, and requires collaboration between these groups.

Relevance to Theme: The escalation of conflict in cyberspace, resulting in increasing numbers of sophisticated cyberattacks, threatens to undermine trust and confidence in the public Internet that people and societies around the world rely on. A driving factor in these trends is a perceived impunity on the part of attackers, due to the challenges in making timely and credible attributions following such attacks. Improving the coordination between governments, as well as other stakeholders, to make attribution claims more regular, transparent and authoritative will be an important step in promoting more responsible behavior and engendering greater trust in the online world.

Discussion Facilitation:

The moderators will work to ensure that the discussion at the outset of the session highlights the current state of play in the issue space and then prompt speakers to actively engage with and respond to one another. Moderators will also keep the timing of the discussion on track to allow for a half hour of audience questions at the end of the session, which they will make attendees aware of at the outset to promote thoughtful questions and comments in response to speakers. The onsite and online moderators will work together to make sure audience questions are taken from a diverse collection of session attendees, both on site and online.

Online Participation:

Usage of IGF Official Tool.

SDGs:

GOAL 9: Industry, Innovation and Infrastructure
GOAL 16: Peace, Justice and Strong Institutions
GOAL 17: Partnerships for the Goals