Last week, the White House announced that the U.S. and China had agreed to stop cyber economic espionage and work together to stop cybercrime.
Well, that was easy, wasn’t it? Too easy.
The reality is that the president has just made another paper agreement that will do little to change the behavior of bad actors.
While it will certainly make some feel good for having “solved” a problem through only talking, it has deprived us of an opportunity to change China’s behavior through the application of sanctions in the face of their blatant cyber actions.
The White House press release is filled with worrisome conclusions, indicating that this agreement ignores the seriousness of this problem and kicks the can down the road.
Here are some of the highlights:
- [T]he United States and China…agree to cooperate…with requests to investigate cybercrimes, collect electronic evidence, and mitigate malicious cyber activity emanating from their territory.
Great, but think about the implications. The Chinese will request that the U.S. help it stop all sorts of dissident hackers and activists. The U.S. lives up to its agreements so it will dutifully help the Chinese even as oppressed individuals are jailed for cybercrimes, such as “jeopardizing Internet security” or accessing “illegal and harmful information,”—i.e., anything the Chinese Communist Party doesn’t like.
Then what stops the Chinese from stonewalling to protect their hackers? Will the Chinese help the U.S. investigate the five Chinese military officers that the U.S. charged with cybercrimes last year? Doubtful.
- The United States and China agree that neither country’s government will conduct or knowingly support cyber-enabled theft of intellectual property, including trade secrets or other confidential business information, with the intent of providing competitive advantages to companies or commercial sectors.
The U.S. does not engage in economic espionage because it goes against U.S. principles of rule of law and property rights. However, while everyone knows that the Chinese engage in economic espionage, Beijing has always vigorously denied it.
Less than a week ago, Xi Jinping said, “The Chinese government does not engage in theft of commercial secrets in any form, nor does it encourage or support Chinese companies to engage in such practices in any way.”
He emphasized this point throughout his trip to the U.S. What, then, have the Chinese actually agreed to do? They have agreed to stop a behavior that they deny ever engaging in. That doesn’t bode well as an indicator of their future behavior.
- Both sides are committed to making common effort to further identify and promote appropriate norms of state behavior in cyberspace within the international community.
This point underscores how little the U.S. understands with whom it is negotiating. The Chinese have a dramatically different view of cyberspace and warfare. For them, their cyber operations, ranging from the economic to the more traditional government espionage, are just parts of their larger warfare strategy during peacetime. On a domestic level, the U.S. believes the Internet is a tool that enriches commerce and freedom, while the Chinese government fears the Internet for the same reasons.
Norm development (agreeing that certain types of behavior are wrong) may constrain actors who all agree to core principles, but when coming from such radically different places, norm development is meaningless.
- The United States and China agree to establish a high-level joint dialogue mechanism on fighting cybercrime and related issues.
This point doubles down on the flawed ideas expressed earlier in the document. But it also betrays a key assumption present throughout the document: the Chinese are victims and partners in the fight against cyber criminals.
Regrettably, this is a huge step back to the mindset the Obama administration held years ago. China is not a partner and it is not a victim—it is the perpetrator.
By granting China moral equivalence with the U.S., the Obama administration has sacrificed the moral high ground, giving the Chinese exactly what they want—legitimacy. The U.S. government has now all but adopted the Chinese position and language on cyber policy, surrendering to Chinese demands in exchange for a nice sounding press release. What is worse, this agreement will probably stop the U.S. from implementing any of the cyber sanctions waiting in the wings against China.
This agreement will do nothing to keep the U.S. safe in cyberspace, but gives China the moral and political legitimacy they want on this issue and will likely keep important cyber sanctions at bay.
Of course we could just trust everything the Chinese say. And if that’s the case, I’ve got a bridge to sell you in China.