The Foreign Service Journal, June 2021

THE FOREIGN SERVICE JOURNAL | JUNE 2021 23 T he State Department and the Foreign Service should watch the developing debates over cyberspace policy, strategy and norms with a few thoughts in mind: • The cyberspace strategic environment is one characterized by strategic competition; its norms are contested. That’s why cyberspace has evolved away from the laudable vision of an open, worldwide internet that promotes global civil society. • Competition is occurring along ideological fault lines between liberal democracies and techno-authori- tarian regimes that do not share that earlier vision. • Cyberspace operations have become a standard tool of diplomacy and competition, with continuous cam- paigns of nonviolent operations in and through cyber- space calculated to avoid provoking armed responses. • What works to deter catastrophic cyberattacks will not dissuade adversaries from routinely operating in and through cyberspace for strategic gain. • Adversaries are adaptive at exploiting the seams in our laws and institutions, and in international law, achieving strategic gains without the risks of war. • We should expect states and even nonstates to continue experimenting in cyberspace, whether we respond or not. •We need not be passive; we have demonstrated that we can preclude and disrupt state-sponsored cyber intrusions and interference without escalating to armed conflict. • Relying on redlines and responding to incidents after the fact have not stemmed malicious cyberspace activity, and there is no reason to believe such measures will sud- denly dissuade authoritarian sponsors of cyberattacks. • In cyberspace the rewards for misbehavior are cumulative. Thus, it is insufficient to concentrate on stopping individual incidents or deterring catastrophic attacks that produce “significant” consequences. We need to operate at the speed and scale com- mensurate with the cyberspace challenges we face. This requires a coordinated and sustained focus of energy and resources—across the U.S. government and with allies and partners—to achieve unity of effort and a whole-of- nation-plus (with allies) approach. —Emily Goldman What Every FSO Should KnowAbout Cyber Issues State has developed and advocated a “cyber deterrence initiative” to promote collective attribution of cyberattacks and collaboration among a like-minded coalition of governments to impose swift, costly and appropriate consequences for misbe- havior by bad actors. Unfortunately, well-intentioned efforts to respond to significant incidents and to “establish” norms by outlining broad, voluntary rules (with no enforcement attached to them) have stalled. Collective attribution and post facto cost imposition, chiefly through sanctions and indictments, have not deterred state-sponsored actors from harming their neighbors and rivals in and through cyberspace. A renewed commitment to the same approaches will not produce different outcomes. The current environment of strategic competition need not alter America’s vision for cyberspace (i.e., a global, open, interoperable arena for discourse and trade that supports dem- ocratic values and protects privacy). Yet the global competition nevertheless demands we change our approach to achieve that vision. A diplomatic strategy for the future must adopt a competitive mindset because the vision of a free, open and resilient cyber- space now faces a rival (and well-resourced) techno-authoritar- ianism. Dictators are defending their virtual borders by reach- ing into the societies of their rivals to intimidate opposition and weaken democratic institutions with diplomacy, development programs, and military and intelligence operations. The United States must leverage diplomacy more effectively to compete and set favorable conditions for security in cyber- space, transforming what has been a permissive environment for our adversaries into one in which the U.S. is actively and persistently competing on behalf of that vision of a global and open cyberspace. Cyber diplomacy must reinvent itself to gain the initiative. This requires: (1) an active, rather than a reactive, mindset; (2) a focus on setting security conditions rather than changing adver- sary motivations; and (3) on-the-ground efforts with partners to construct norms by persistently contesting adversary cyber campaigns of disinformation, sabotage, propaganda, political interference and theft. Eschew Deterrence, Embrace Competition The focus on deterrence and response is deeply ingrained in national security thinking. It is telling that the Cyber Diplo- macy Act in its current iteration calls on the State Department to “lead United States Government efforts to establish a global deterrence framework for malicious cyber activity; … to develop and execute adversary-specific strategies to influence adver-