This is How They Tell me Cyber Peace is Achieved
It was revealed this week that Google had detected an online counterterrorism operation being carried out by a U.S.-allied government, and made the unilateral decision to shut it down. This is certainly not the first time Google, AWS, or another platform has detected such activity, but it is arguably the most public declaration that platforms are not necessarily going to allow such activity to go on unabated, no matter what the underlying motivation or what flag is waving behind the scenes.
Government-communications industry collaboration, when the former needed to use the latter to accomplish something, is not new. In fact, the exchange of personnel to the benefit of both sides used to be a fairly common occurrence, because to coin a phrase, what was good for the country was good for AT&T, and vice versa. But given these most recent events it would seem the government hasn’t established such relationships with platforms.
This is a problem because today’s platforms are as big or bigger than the old-school telecoms. Telecoms moved electrons and platforms do the same, along with much richer data, which makes them more powerful and more valuable in a military and intelligence sense. Early instances of governmental exploitation of networks date back at least to the 1980s and telecom’s inability to detect much less stop that sort of activity is well documented. Today’s platforms are much better equipped to deal with these issues, which begs the question: what role the FAANGs in political-military shenanigans?
They could spend a lot of energy trying to thread a very narrow needle when it comes to the use of their resources for sovereign-state machinations, which would be an interesting contortionist act given how skillfully they parse corporate sovereignty when the issue is taxes. Certain decisions might be easier to make given the general disdain the workforces in such firms have for national security work, but it would stand in ahistorical contrast to the history of the valley and the critical role it played in the defense of the nation.
Alternately, they could adopt a “zero tolerance” policy, significantly reducing the ability to carry out cyber-attack and -espionage by any nation. At that point a great deal of the work and investment in things like Cyber Command (not just the one in the U.S. but all the variations on the theme that have been stood up over the years worldwide) starts to become moot.
While the wisdom of using political approaches to address cybersecurity issues is regularly called into question (the big news in diplomatic circles is that we finally have global agreement on what makes for good behavior online – it has only taken 20+ years), platforms can use technical means to bring about long-desired political ends at scale. More to the point: they can do so without having to deal with the competing interests of national intelligence services. Let’s be clear: no matter what agreement a country’s diplomats may sign, that country’s spies will never stop violating that agreement on a daily basis. Platforms can, to some degree, take the spooks off the table.
At this point we have no idea how this will play out. There could be bi- or multi-lateral discussions going on right now that will have things sorted out behind the scenes and we may never hear of this again. Likewise, any such talks could break down and platforms may start dropping press releases weekly about how many offensive activities they took down, forcing the world’s cyber warriors and spies to fight not only their adversaries but their enablers as well (giving new meaning to the term ‘hostile environment’).
The well-worn martial cliché says that no matter how elegant your plans, it is important to remember that the enemy gets a vote in how successful they are. The transition of military and intelligence activities to cyberspace didn’t change that, but it got more complicated because the traditional calculus rarely incorporated non-state actors and their ability to project power online (a monopoly held by states in meat-space, but possible by anyone in cyberspace). Should platforms decide to take a more active and prominent role in these issues, it won’t just mean that they too get a vote: they get a veto.
