Toward Cyberpeace: Managing Cyberattacks through Polycentric Governance

Views range widely about the seriousness of cyberattacks and the likelihood of cyberwar. But even framing cyberattacks within the context of a loaded category like war can be an oversimplification that shifts focus away from enhancing cybersecurity against the full range of threats now facing companies, countries, and the international community. Current methods are proving ineffective at managing cyberattacks, and, as cybersecurity legislation is being debated in the U.S. Congress and around the world, the time is ripe for a fresh look at this critical topic. This Article searches for alternative avenues to foster cyberpeace by applying a novel conceptual framework termed polycentric governance. Proponents such as Nobel Laureate Elinor Ostrom have championed the theory, which promotes self-organization and networking regulations at multiple levels to address global collective action problems. Such a framework contrasts with the increasingly state-centric approach to both Internet governance and cybersecurity preferred by a growing list of nations. This Article will use the Internet Corporation for Assigned Names and Numbers (ICANN) and the Internet Engineering Task Force (IETF) as case studies, as well as the International Telecommunication Union (ITU) as an illustrative example to explore different governance models and some of their security implications. Ultimately, the case is made that polycentric analysis may provide new insights about how to reconceptualize both cybersecurity and the future of Internet governance."We have a faith-based approach [to cybersecurity], in that we pray every night nothing bad will happen."-James Lewis, Center for Strategic and International Studies1INTRODUCTIONEpsilon and its customers, including JPMorgan Chase, Verizon, Sony, the International Monetary Fund, Sega, Citigroup, and more, were hit by cyberattacks in just three months, from April to June 2011.2 More recently, in March 2013 what has been billed as the "biggest cyberattack in history" impacted service for millions of Internet users around the world,3 the same month as South Korean banks and broadcasters were hit by attacks purportedly coming from North Korea.4 What do these events have in common? Each reveals some of the many facets of "cyberattacks," defined by the U.S. National Research Council as "deliberate actions to alter, disrupt, deceive, degrade, or destroy computer systems or networks or the information and/or programs resident in or transiting these systems or networks."5 Given the ubiquity of the Internet, how can we better enhance cybersecurity across networks and borders? A great deal of uncertainty and debate pervades this question, and the stakes are high. How the cyberthreat is managed will affect everything from U.S. national and international security to the competitiveness of firms and the future of Internet governance.6Difficulties stem in part from the rate of technological advancement,7 as well as geopolitical divides and legal ambiguities. Throughout the long and tumultuous history of conflict, new technologies have revolutionized both battlefields and businesses, either gradually, as with gunpowder or the Industrial Revolution, or abruptly, as with nuclear fission. Information technology (IT) is no exception. Networked computers have given tremendous advantages to and demonstrated vulnerabilities of the cyberpowers, including China, Israel, Russia, the United States, and the United Kingdom.8 These nations can now launch sophisticated cyberattacks, but their own militaries, economies, and critical national infrastructures (CNI) are also vulnerable.9 The rise of new cyberpowers underscores the shiftin international relations after the Cold War from a bipolar world order dominated by the United States and the Soviet Union to a multipolar order featuring more emerging power centers.10 This shiftcomplicates international efforts to reach consensus on improving cybersecurity through multilateral organizations such as the United Nations,11 hampering policymaking just as the political and economic costs of the cyberthreat mount. …