The Foreign Service Journal, June 2018

THE FOREIGN SERVICE JOURNAL | JUNE 2018 29 While all of this represents significant progress toward achieving global cyber stability, there is much more to be done, and the head winds are stiff. The 2016 UN GGE ended in a stalemate, with some authoritarian regimes aggressively promoting their own vision of cyberspace that restricts openness, while some regimes are resisting necessary efforts to assess exactly how international law applies to cyberspace. There is an urgent need to build a broader consensus among countries on norms of behavior; much work is required to implement such norms; and, in addition, there will be signifi- cant effort ahead to further articulate how interna- tional law applies to cyberspace. Deterrence . The United States has made signifi- cant progress in building an international consen- sus on what constitutes responsible state behavior in cyberspace, but that work is largely irrelevant if there are no consequences for those who violate that consensus. We have not done a very good job of deterring malicious actors—particularly nation-state actors. There are many reasons for this, including difficulties with attribution, a limited stock of potential consequences, and difficulties sharing information among partner countries. Nevertheless, at the heart of deterrence is the threat of a cred- ible and timely response to the transgressor. Failure to act in a credible or timely way signals to the adversary that their actions are acceptable—or at the very least cost-free. For example, the lack a sufficiently strong, timely and continuing response to Rus- sian interference with our electoral process virtually guarantees that Moscow will attempt to interfere again, both in the United States and in other democratic countries. We must do better. Diplomacy can and should play a vital role in this effort—it is one of the key tools in the tool kit of response options that also include law enforcement actions, economic sanctions and cyber and kinetic responses. We must continue to employ diplomacy effectively and work to enhance all of our existing response options. We must also work with like-minded partners and other stakeholders to develop creative new tools that can be used swiftly and later reversed to change an adversary’s behavior— expanding the tool set and communicating, as transparently as possible, the likely costs that will be imposed for bad behavior. And we must enhance collective action. Although the United States reserves the option to act alone if it must, deterrence and legitimacy are better served when several countries band together against a bad actor. There is much diplo- matic work to do in forming such an agile coalition of like-minded countries who can call out bad behavior and collectively impose costs on our adversaries. Such a coalition should be flexible and can involve different countries and different actions depending on the actor; but creating it, and solving information sharing and other issues, will require a significant diplomatic effort. Mainstreaming Cyber Issues in the Department. Cyber issues are inherently cross-cutting, involving nearly every functional directorate and every regional bureau. Because they are relatively new, they still need to be worked into the efforts and priorities of regional bureaus and posts around the world. Accordingly, the Office of the Coordinator for Cyber Issues worked with the under secretary of State for political affairs to have each regional bureau, in consultation with the field, draft detailed cyber engagement strategies, raising the profile of these issues and prioritizing them according to the needs of each region. We also created and trained a cadre of cyber policy offi- cers at posts around the world using the regional strategies as a basis for implementation. For the cyber issues office to thrive, it cannot be seen as a boutique or solely technical matter, but must be thought of instead as a core national security, economic and human rights issue that is part and parcel of the department’s work. The Way Ahead Although much has been achieved over the last few years in cyber diplomacy, there is a long road ahead. The work we do and The lack of any clear consensus on acceptable state behavior in cyberspace poses substantial risks. ISTOCKPHOTO.COM/MAXGER