French President Emmanuel Macron on Monday announced a grand accord signed by more than 50 nations and 250 organizations aimed at making the internet a safer place by putting limits on cyberwarfare.
But one key ally was missing from Macron’s new “arms control” for the internet age: The United States of America. Indeed, the U.S. joined a list of renegade countries with which it's typically at odds: Russia, China, North Korea, and Iran, all of whom have active cyberwarfare campaigns in operation.
The White House has been largely mum on its decision to keep America’s name off the accord, but former government officials and cyber experts say a lack of leadership, an "America First" foreign policy that shies away from multilateral agreements, and a fear of limiting its own offensive cyber capabilities are likely drivers behind the move.
Either way, the decision doesn't look so great at first blush.
“A good rule of thumb on any issue is that it is a bad look when Russia, North Korea, and Iran are with you, but most of the rest of the world is not,” Peter Singer, an expert in 21st century warfare, told VICE News.
The Paris Call for Security and Trust in Cyberspace is just the latest in a string of efforts to create a multilateral, comprehensive set of regulations for how countries conduct operations in cyberspace.
The document sets out nine goals ranging from thwarting foreign actors from interfering with elections to preventing attacks on critical infrastructure and working to stop private companies from “hacking back.”
It also calls on signatories to stop “malicious cyber activities in peacetime, notably the ones threatening or resulting in significant, indiscriminate or systemic harm to individuals” — which Iran, Russia and China have all been accused of.
But Macron’s Paris Call, for now anyway, is only aspirational rather than a binding set of regulations forcing countries to limit their operations in cyberspace, which makes the U.S.’s lack of support all the more baffling, said experts.
“Purely as a diplomatic move, it puts us in very bad company,” Michael Carpenter, who previously served on the National Security Council as director for Russia under the Obama administration, added.
So why didn’t the U.S. sign on? Well, no one's really sure.
The State Department told VICE News that the U.S. is “not in a position to endorse” the paper, but when asked why that was the case, it failed to give an answer.
“We continue to support many of the overarching policies put forth in the Paris Call. We certainly welcome like-minded momentum on these issues. We understand several governments and stakeholders have endorsed the document and some may continue to do so,” a spokesperson said.
The decision not to sign the document this week may not be down to major differences of opinion, but because the White House simply didn’t get around to addressing it.
“It's not clear that they won't eventually sign,” Paul Triolo, who spent 25 years working in the U.S. government dealing with cybersecurity issues, told VICE News. “There is a lot of turmoil in the U.S. cyber–policymaking community. It could just be a bureaucratic churn issue.”
“There is a lot of turmoil in the U.S. cyber–policymaking community. It could just be a bureaucratic churn issue.”
With the departure of Rob Joyce as White House cybersecurity coordinator in May, the administration has been accused of being rudderless when it comes to cybersecurity policy, with lawmakers on both sides of the aisle raising concerns that lack of leadership has left the U.S. vulnerable to attack.
Despite the apparent lack of leadership, Trump’s administration has pushed ahead with a bold, new cyber strategy. The policy rolls back Obama-era limitations and hands intelligence agencies greater freedom to conduct offensive cyberattacks against adversaries.
A report by the Daily Beast earlier this month claims the Pentagon had prepared an offensive cyberattack against Russia if they interfered with the midterm elections.
Some experts chalked up the rejection of Macron's deal to Trump and National Security Adviser John Bolton’s America First approach to all foreign policy initiatives.
“This is yet another damaging consequence from the Bolton-Trump philosophy of foreign policy,” Nate Jones, a former official at the National Security Council, told VICE News. “They are highly skeptical of multilateral efforts to solve problems, particularly where those efforts could potentially constrain our freedom of action in the future.”
Singer agreed, and warned that it puts the U.S. on the outside looking in when it comes to deciding how a global cybersecurity policy is shaped and trying to limit the influence of Russia, China, and Iran.
“The problem is that so many threats to US security simply can't be solved in that way,” Singer said. “Whether it is cybersecurity or environmental or nuclear nonproliferation issues, they are multilateral and multilayered.”
“This is yet another damaging consequence from the Bolton-Trump philosophy of foreign policy.”
In the end, whether or not the U.S. signs the Paris Call is not really going to have any major impact on how nation-state cyberoperations are conducted, because, while its goals are admirable, signing up does not limit any country’s offensive cyber capabilities.
“The language in the document is so vague that it's meaningless,” Jake Williams, a former member of the NSA's hacking unit, told VICE News.
Triolo agreed: “There is nothing binding here. There are no teeth to this.”
But security expert Mikko Hypponen pointed out that while there may be nothing binding here, these negotiations have to start somewhere. “Points to France for trying. We’re not going to get to anywhere if we don’t even try. We will be needing rules and laws for this new domain. And that’s what cyberspace is: a new domain for conflict and war. Just like land, sea, air and space. Now cyberspace.”
Cover image: U.S President Donald Trump, second left, watches French President Emmanuel Macron putting his hand on German Chancellor Angela Merkel's knee during ceremonies at the Arc de Triomphe Sunday, Nov. 11, 2018 in Paris. (AP)