Russia’s cybermeddling in the 2016 US presidential election has been accompanied by what US and European experts describe as a worrisome Kremlin campaign to rewrite the rules for global cyberspace.

A draft of a Russian proposal for a new “United Nations Convention on Cooperation in Combating Information Crimes” was recently shown to me by a security expert who obtained a copy. The 54-page document includes 72 proposed articles, covering collection of internet traffic by authorities, “codes of conduct” for cyberspace and “joint investigation” of malicious activity. The language sounds bureaucratic and harmless, but experts say that if adopted, it would allow Russia to squeeze cyberspace even more.

The Kremlin’s proposed convention would enhance the ability of Russia and other authoritarian nations to control communication within their countries, and to gain access to communications in other countries, according to several leading US cyberexperts. They described the latest draft as part of Moscow’s push over the past decade to shape the legal architecture of what Russian strategists like to call the “information space.”

The proposal was floated by the Kremlin early this year, and outlined in an April 4, 2017, article in Kommersant. The Moscow daily reported that the Russian Foreign Ministry had described the convention as an “innovative” and “universal” attempt to replace the 2001 Budapest Convention, which has been signed by the US and 55 other countries but rejected by Russia. Kommersant said “Russian authorities saw a threat to the sovereignty of the country” in the Budapest pact.

Russia’s bid to rewrite global rules through the UN was matched by a personal pitch on cyber cooperation in July from President Vladimir Putin to President Trump at the G-20 summit in Hamburg. Putin “vehemently denied” to Trump that Russia had interfered in the US election, Trump said in a tweet. Trump then floated a mystifying proposal: “Putin & I discussed forming an impenetrable Cyber Security unit so that election hacking, & many other negative things, will be guarded and safe.”

Trump’s suggestion that America join Russia in cyber defense provoked an uproar in the US One Twitter commentator wrote: “This is like the FBI asking the Mafia to form an anti-crime unit together.”

The White House quickly backtracked after Trump’s tweet. Homeland security adviser Tom Bossert told reporters on July 14, “I don’t believe that the US and Russia have come to that point yet in cyberspace. And until we do, we wouldn’t have the conversation about partnership.”

Many US cyber experts share Bossert’s view that although any formal treaty or partnership with Moscow now is unwise, quiet confidence-building discussions might be useful. Those could include military-to-military or technical contacts to explore how to avoid catastrophic cyber events that might cripple strategic systems or pose systemic risk.

US and Russian officials had maintained such a dialogue to explore norms for the internet, but so far it has been a dead end. The Russians were led by Andrey Krutskikh, a Foreign Ministry official who is Putin’s cyber adviser; and on the US side, by Christopher Painter, who was White House cyber chief under President Obama and then cyber coordinator at the State Department, a post he’s leaving soon.

These contacts are sensible, but they have withered as US-Russia relations have deteriorated. A high-level working group stopped meeting after Russia invaded Ukraine in 2014. A UN-sponsored “Group of Governmental Experts on Information Security” broke up in June after failing to reach consensus on measures for improving information security. Putin’s bilateral proposal at Hamburg quickly disappeared after Trump’s premature endorsement.

The Russians, meanwhile, continue their campaign to regulate cyberspace on their terms, by mobilizing allies to support their alternative to the Budapest convention; Moscow’s biggest complaint is that the Budapest framework, in Article 32 (b), allows the owners of data to control its use, rather than governments. Moscow wants state control of information.

Russia got some global support for its rules-making effort at a September gathering in Xiamen, China, of the so-called BRICS countries: Brazil, Russia, India, China and South Africa. In their formal declaration, the countries “recognize the need for a universal regulatory binding instrument on combatting the criminal use of ICTs (information and communications technologies) under the UN auspices.” The countries “acknowledge the initiative” of Russia in seeking such a binding pact.

If the events of the past year have taught us anything, it’s that Russia views information as a decisive political weapon and wants to control this potential battlespace. The global regulatory side of this contest gets little attention, but it could help determine whether open information flows survive in the age of the autocrats.


By David Ignatius

David Ignatius’ email address is davidignatius@washpost.com. -- Ed.


(Washington Post Writers Group)