Cyberweapons and Bullies: Regulate It All (Final)

-- By ArielBenson - 29 Nov 2024

A long way to go

Since the days of Snowden there have been concerns about the government watching our every move, infiltrating our private places, and documenting our personal lives. Over time, the public outcry has dissipated and moved on to the next horrendous thing the government has participated in. Domestic critique is now led by scholars and human rights activists. The current charge for regulating cyberweapons is relying on implicating trade and protecting privacy. Enacting change won’t be as easy as regulating small arms light weapons (SALW). It will take innovation and forcing the hands of the most powerful. Frankly, it will take a miracle.

Pushing for the right to privacy

In the documentary Surveilled, NGO Group admitted to testing and utilizing its products (including Pegasus) on Arab Palestinians. While obviously in conflict, and potentially utilizing some type of war powers-esk authorization to surveille labeled (unproven) criminals, it is difficult to wrap my head around the lack of regulation and respect implemented into the cyberweapon community by Israel. We have allowed PETA to aim higher and gain more accountability in the animal-cruelty space than what we as a global society have allowed to occur regarding testing and implementation of surveillance products.

The lack of privacy allotted for by governments utilizing such cyberweapons brings into question whether there is a right here at all. Sure, activists and scholars may find moral disdain for the acts but requiring regulation or right-protections for a non-right is difficult. Outside of the Fourth Amendment, the United States began developing privacy right scholarship in the late 1800s, with Warren and Brandeis leading the charge. Fast forwarding almost one hundred years, Thomas Scanlon nuanced the right to privacy by noting that we have the right to privacy in specific zones. This logic has of course been present in privacy cases, distinguishing that when there is a reasonable expectation of privacy present, a privacy zone is created (See Katz). For example, compare United States v. Knotts (1983) holding (where it was found that a defendant who traveled over the public streets voluntarily conveyed his information it to anyone who wanted to look) to Carpenter v. United States (2018) (where it notes the dangers of modern technology’s overreach, especially when looking at historical data that derives from a place where intentional sharing is absent).

Clearly, the United States continues to back the domestic right to privacy, but unilaterally determined rights cannot be forced upon the rest of the world. Finding a right to privacy in the international realm requires a reimagining of jus cogens to include privacy. It seems to be doable on the surface. Arguably, the right is more orientalist than occidentalist. The American can absolutely look to expressed, legal privacy tradition, but what is the comfortability of a woman to remove a hijab in the confinements of her home without the existence of the right to privacy? The answer is nothing. The only obstacle in the way of admitting such a natural right — as it pertains to the cyberweapon conversation at hand — is the national security argument. This argument counters all state weaponry regulation. It is up to the world to decide that national security risks can be mitigated, maybe even by utilizing cyberweapons, but without the erasure of the right to privacy by overzealous states.

Pushing for the right trade outcome

There is also the practical issue of regulating the sale and trade of cyberweapons. Export Controls in the United States look to regulate dual-use items that derive from the United States and can be used against the interests of the State. However, the list of items overseen, the Entity List, and the topics of concern have grown astronomically over the past two regimes. If Commerce or State want to have a significant and relevant impact on the cyberweapon industry, the regulators must become less centralized (see concerns on cyberweapon regulation). Cyberweapon regulation requires military and intelligence expertise, market and scholarship foresight, and predictable rule making professionals (Consider WA backlash). Thus, in an ideal world, a new State Department division would be created to oversee such export control and trade regulation.

There too is the option of working within the status quo. The Bureau of Industry & Security (BIS) currently overregulates when new technologies emerge. For example, consider the proposed AI language added to the already existing rules this past summer. There was no nuance. Simply “AI” was added at the end of regulations. Following current practice, nuancing the regulations can occur at a later date, allowing for stakeholders agitated by the too general rules to enter the conversation (maybe through a round of comments or lobbying) and fix what is now broken. Nonetheless, domestic regulation alone will not suffice however it is implemented.

Relying on state export controls does not create a checks and balance structure for all states utilizing cyberweapons. On the flip side of regulating how and where the technology is utilized, there is also the necessity of accountability outside of the new jus cogens. Shalev Hulio himself likened the sale of his products to an arms trade (See Surveilled). Of course, we should listen when the horse speaks. Utilizing international instruments to confine state usage and trade to appropriate standards is necessary and practical. Sure, states across the Arms Trade Treaty ignore much of what it has to say. I am of the mind that some compliance is better than none and that accountability can be prosecuted at any time. If the world relies only on export controls to regulate these cyberweapons, we will end up with the conundrum of universal jurisdiction or SALW stockpiles. The West will remain flagrant in its actions, while the rest of the world will be under a microscope and sanctioned for actions happening by those authorizing the blockade.

Updated from The Conudrum of the Eldest Daughter paper

You are entitled to restrict access to your paper if you want to. But we all derive immense benefit from reading one another's work, and I hope you won't feel the need unless the subject matter is personal and its disclosure would be harmful or undesirable. To restrict access to your paper simply delete the "#" character on the next two lines:

• #Set ALLOWTOPICVIEW = TWikiAdminGroup, ArielBenson
• #Set DENYTOPICVIEW = TWikiGuest

Note: TWiki has strict formatting rules for preference declarations. Make sure you preserve the three spaces, asterisk, and extra space at the beginning of these lines. If you wish to give access to any other users simply add them to the comma separated ALLOWTOPICVIEW list.