The Real Cyber War

Introduction

Cyber Pearl Harbor. Cyber 9/11. Cyber Hiroshima. Analogies like these are occasionally made to galvanize public awareness of the threat of ‘cyber war’, or conflict mediated via networked devices. Yet such ostentatious cyber conflict is unlikely to occur unhinged from a broader military struggle. In fact, it misses the key areas of conflict altogether. Every day, millions of networked intrusions occur across the world, as state, private, and rogue actors engage in espionage and theft. The costs are subtle, widespread, but enormous. Yet an even bigger, and even more subterraneous, cyber-linked conflict is occurring right now. There is currently a conflict being waged over the nature of the standards, protocols, and network infrastructure that undergird the internet. The real cyber war is not principally taking place via malware embedded in critical infrastructure; rather, it is taking place in the build out of physical infrastructure across the world and in high-level standards setting bodies. In particular, the Chinese Communist Party (CCP) is attempting to instantiate a de-facto norm of ‘cyber sovereignty,’ with each nation being able to control the data flowing across its networks. The most likely outcome, this paper will argue, is the effective splitting of the internet into at least two versions based upon entirely divergent value systems.

The Nature, Character, and Purpose of Internet Suppression in China

The CCP is changing the world in a manner conducive to its survival.11Nadege Rolland. China’s Vision for a New World Order. 2020. National Bureau of Asian Research. https://www.nbr.org/publication/chinas-vision-for-a-new-world-order/ This includes altering the structure and values undergirding the internet. If we want to understand how the internet is likely to change, it is instructive to look at China’s domestic network to see how it already has.

Since the internet first came to China in 1994, the CCP has blocked and censored it. Yet, contrary to some popular perceptions, the primary thrust of China’s internet control was initially, and has remained since, on forestalling domestic impediments to its reign. That explains why two of the three websites first blocked were domestically run neo-Maoist sites (since reform and opening, the Party’s most vociferous and effective domestic critics have been conservative, leftist radicals denouncing the Party for not being true to Mao’s vision).22For specific citation on blocking neo-Maoist sites, see: James Griffiths. The Great Firewall of China. 2019. Pp 32. For overview of Maoist critiques against the CCP: Jude Blanchette. China’s New Red Guards. 2019. Still today, though, the Party’s intent is primarily on forestalling acts of solidarity–collective action like the student protests that erupted across the country in 1989 and resulted in the June 4th massacre in Tiananmen square.33Gary King, Jennifer. How Censorship in China Allows Government Criticism But Silences Collective Expression. 2013. https://gking.harvard.edu/publications/how-censorship-china-allows-government-criticism-silences-collective-expression Limiting the inward flow of outside information has been the second-tier concern of the Party.

While heuristically easier to do, conceptualizing the Great Firewall (GFW) as a monolithic device is not the best way to think about it. Rather, it should be thought of as a two-headed hydra. The first is blocking off international access, and the second is regulating and manipulating the Chinese ‘intranet ecosystem’ that has built up. The former of the two is the easier part of the GFW to understand.

The CCP, a Leninist Party to its core, still engages in Soviet-style information and political warfare.44On the former: James Mulvenon. The PLA and Information Warfare. RAND. https://www.rand.org/content/dam/rand/pubs/conf_proceedings/CF145/CF145.chap9.pdfOn the latter: Ross Babbage. Winning Without Fighting: Chinese and Russian Political Warfare Campaigns and How the West Can Prevail. 2019. Center for Strategic and Budgetary Assessments. https://csbaonline.org/research/publications/winning-without-fighting-chinese-and-russian-political-warfare-campaigns-and-how-the-west-can-prevail As such, the CCP desires to shield itself from ‘foreign threats’, epitomized in Document 9,55ChinaFile. Document 9: A ChinaFile Translation. 2013. ChinaFile. https://www.chinafile.com/document-9-chinafile-translation while pushing its own propaganda abroad (something it often confuses with soft power).66Soft power is the ability to attract via legitimacy of government or attractiveness of civil society, CCP modus operandi is more apropos of sharp power. Joseph Nye. What China and Russia Don’t Get About Softer Power. 2013. Foreign Policy. https://foreignpolicy.com/2013/04/29/what-china-and-russia-dont-get-about-soft-power/ A Leninist approach to politics does not recognize legitimate dissent from or criticism of the Party’s line, it believes simply in power politics (something encapsulated in the idea 话语权, or ‘discourse power’).77Nadege Rolland. China’s Vision for a New World Order. 2020. National Bureau of Asian Research. https://www.nbr.org/publication/chinas-vision-for-a-new-world-order/ To a Leninist Party like the CCP, their real-politik view of the world is fundamentally zero-sum, and information control is simply one element of the struggle for power. Of course, there has been an evolution in this line of thinking within the Party, as it has become more or less Leninist overtime. Nonetheless, under Xi especially, the Party has little desire for outside information flooding into its country and ‘poisoning the minds of its citizens.’

The CCP has limited access to the broader global internet communications array to three access points, all served exclusively by Chinese Internet Service Providers (ISPs).88Hugo Butcher Piat. Navigating the Internet in China: Top Concerns for Foreign Businesses. 2019. China Briefing. https://www.china-briefing.com/news/internet-china-top-concerns-foreign-businesses/ As such, it can straightforwardly monitor traffic into and out of the country. It does this via both a header analysis of packets (high-level information about packet destination), as well as an algorithmic Deep Packet Inspection (DPI) that looks at the content of the packet itself.99Duncan Geere. How deep packet inspection works. 2012. Wired. https://www.wired.co.uk/article/how-deep-packet-inspection-works However, unlike a traditional personal-use firewall, the CCP’s GFW sits ‘on-path’ as opposed to ‘in-path’, meaning that it cannot literally drop packets from the network to stop it from proceeding to its destination. Rather, once DPI and/or meta-data have found evidence of banned content in a packet stream, it injects ‘TCP Reset’ packets into the network that travel to both the server and the user device to ‘break state’ and drop connection.1010Chao Tang. In-depth Analysis of the Great Firewall of China. 2016. Tufts University. https://www.cs.tufts.edu/comp/116/archive/fall2016/ctang.pdf From the CCP’s perspective, this method of censorship has the benefit of limiting latency issues while still being fairly effective at disrupting connections. Still, many users can ‘jump the firewall’ via VPNs and other access devices. But, due to the flourishing native ecosystem (WeChat, Weibo, etc.) and the threat of Ministry of Public Security officials showing up at their door, most Chinese users have little incentive to do so.1111Paul Mozur. Coronavirus Outrage Spurs China’s Internet Police to Action. 2020. New York Times. https://www.nytimes.com/2020/03/16/business/china-coronavirus-internet-police.html Indeed, the Party is less concerned with ensuring complete censorship of foreign content than it is with manipulating China’s internal internet users’ views of the CCP (with an army of ‘wumao’ (五毛) fabricating upwards of 448 million posts a year).1212Gary King, Jennifer Pan, and Margaret E Roberts. “How the Chinese Government Fabricates Social Media Posts for Strategic Distraction, Not Engaged Argument.” American Political Science Review 111, no. 3 (2017): 484–501. doi:10.1017/S0003055417000144.

As mentioned, the only ISPs that are allowed to build Information and Communications Technology (ICT) are Chinese, and all are state-owned (China Mobile, China Telecom, and China Unicom). The defining feature of the CCP’s internal internet repression is that it controls all aspects of the physical infrastructure upon which the internet runs. Indeed, the CCP’s internet system can reasonably be considered an intranet, given its complete internal connectivity (all domestic Chinese transit paths stays within China) and ability to shut off from the outside world and continue to function.1313See: Dave Allen. Analysis by Oracle Internet Intelligence Highlights China’s Unique Approach to Connecting to… 2019. https://internetintel.oracle.com/blog-single.html?id=Analysis+by+Oracle+Internet+Intelligence+Highlights+China%E2%80%99s+Unique+Approach+to+Connecting+to+… Furthermore, all companies who control major pieces of the internet are required by law to serve the interests of the Communist party, including the ISPs but also including social media platforms. In fact, these companies are personally liable for any ‘illegal content’ that appears on their platforms and over their infrastructure.1414ChinaPower. How web-connected is China? CSIS. 2019. https://chinapower.csis.org/web-connectedness/ Given that they receive funding and subsidies from the Party, have Party committees within their organizations, and otherwise have deep connectivity to the Party, these organizations are induced or otherwise coerced into following the Party’s line on censorship.1515Jude Blanchette. Against Atrophy: Party Organizations in Private Firms https://madeinchinajournal.com/2019/04/18/against-atrophy-party-organisations-in-private-firms/ Further, the 2018 Cybersecurity Law “centralizes all internet policy within the Cyberspace Administration of China (CAC)” while the 2017 National Intelligence Law effectively mandates data sovereignty,1616Bloomberg News. The Internet is Splitting in Two Amid US-China Spat. 2018. https://www.bloomberg.com/news/articles/2018-11-09/the-internet-is-splitting-in-two-amid-u-s-dispute-with-china?sref=DUuD2uV0 and states that “any organization or citizen shall support, assist and cooperate with the state intelligence work in accordance with the law.” These laws are nebulously broad, and are just the most prominent examples of the Party-state’s wide control.1717Adrian Shahbaz. The Rise of Digital Authoritarianism. 2018 https://freedomhouse.org/report/freedom-net/2018/rise-digital-authoritarianismand Arjun Kharpal. Huawei says it would never hand data to China’s government. Experts say it wouldn’t have a choice. 2019. https://www.cnbc.com/2019/03/05/huawei-would-have-to-give-data-to-china-government-if-asked-experts.html The CCP has thus developed a quick and decisive ability to censor its intranet. And what the CCP has produced for itself, it now wants to share with others.

All For One and One For All: the CCP and its Cyber Sovereign Friends1818Friendship in the CCP’s parlance is a very politically-laden term. According to Anne Marie Brady the label is principally a reflection of whether the CCP views you as furthering its realpolitik interests. Brady, Anne-Marie. “The Political Meaning of Friendship: Reviewing the Life and Times of Two of China’s American Friends.” China Review International 9, no. 2 (2002): 307-319. doi:10.1353/cri.2003.0072.

The CCP’s National Cyberspace Security Strategy in 2016 “pointed out that cybersecurity threatened the state and society on several fronts: “cyber infiltration endangers political security,” “cyber-attacks threaten economic security,” “harmful cyber information erodes cultural security,” and “cyber terrorism and crimes undermine social security.”1919Jinhe Liu. China’s Data Localization. 2019. _Chinese Journal of Communcation_https://www.tandfonline.com/doi/full/10.1080/17544750.2019.1649289?src=recsys By building out other country’s infrastructure and bolstering authoritarian regimes with similar concerns, the CCP reliably cultivates fellow travelers in advocating for an internet governance system organized around the principle of protecting against such ‘security’ threats via ‘cyber sovereignty.’ The CCP defines cyber sovereignty as “each government [having] the right to manage its Internet and [having] jurisdiction over information and communication infrastructure, resources and information and communication activities within their own borders.”2020The full text of “National Cyberspace Security Strategy.” 2016. Cyberspace Administration of China. http://www.cac.gov.cn/2016-12/27/c_1120195926.htm

One can see the CCP’s denial of ‘Western universalism’ (see Document 9) playing out in the cyber arena, as the CCP advocates for a ‘state’s rights’ solution that privileges each state’s sovereign ability to regulate its own information and network environment. Common refrains can be seen from Chinese scholars, such as: “it is crucial to consider cultural values and different economic and political environments when we discuss Internet governance” and “one of the most important issues … is the management of root nameservers under ICANN [Internet Corporation for Assigned Names and Numbers] control … what surprises us is the US’s obstruction to letting more international representative institutions like the United Nations be part of the management.”2121Gianluigi Negro (2020) A history of Chinese global Internet governance and its relations with ITU and ICANN, Chinese Journal of Communication, 13:1, 104-121, DOI: 10.1080/17544750.2019.1650789 Irrespective of their validity, these statements evoke a clear concern, stemming from CCP leadership on down, for state’s rights and for mediating these conflicts in a forum, such as the UN, where sovereign governments are the primary actors.

Battles at the UN and Over Standard Settings Bodies

Over the last few years the CCP “has enlarged its role in both the ITU and ICANN” in a bid to increase its influence in these bodies.2222Ibid. However, the CCP has routinely faced push back from these organizations. In 2014 and 2015, at two separate meetings of the UN’s ITU, the CCP tried and failed to get language such as ‘sovereign rights of states’ into outcome documents.2323Yu Hong * G Thomas Goodnight. How to think about cyber sovereignty: the case of China. 2019. Chinese Journal of Communication. https://www.tandfonline.com/doi/full/10.1080/17544750.2019.1687536 Nonetheless, the CCP is persisting, and its continued bilateral overtures to states are paying dividends in terms of support within these institutions. Most recently, it has also been revealed that Huawei has been pushing in favor of a ‘New IP’ system in the ITU. Although details are still sparse, this is a particular substantive demonstration of Beijing’s intent to reconfigure the infrastructure undergirding the internet (the decentralized TCP/IP packet sharing system).2424Madhumita Murgia and Anna Gross. Inside China’s Controversial Mission to Reinvent the Internet. 2020. Financial Times. https://www.ft.com/content/ba94c2bc-6e27-11ea-9bca-bf503995cd6f

Meanwhile, a nascent program under development called “China Standards 2035” straightforwardly endeavors to turn China into a “standards superpower.”2525Elsa B. Kania. Securing Our 5G Future. 2019. _Center for a New American Security._https://www.cnas.org/publications/reports/securing-our-5g-future In this vein, the CCP’s Huawei Technologies has contributed by far the most 5G technical contributions in the world.2626Statista. Huawei is Leading the Race to Develop 5G. 2019. Statisia https://www.statista.com/chart/17536/mobile-network-standards/ It is striking, though, that while the CCP has been trying to strategically build a coalition to alter the status quo via standard setting bodies like the UN’s ITU, ICANN, and 3GPP, Beijing’s bilateral endeavors have done far more to change on-the-ground realities. Indeed, just as the CCP has created a de-facto version of cyber sovereignty within its borders, so too have its Digital Silk Road and bilateral technology transfers begun to create the de-facto conditions for cyber sovereignty in many other countries.

Building out Telecommunication Infrastructure for Friends2727Friendship, again, in the CCP’s political self-interested definition

The most straightforward example of the CCP’s norm-changing endeavors is the infrastructure it is building, and already has built, for other regimes. Through its heavily subsidized state champions, such as Huawei and ZTE, China has expanded its ‘going out’ policy into its Digital Silk Road strategy.2828Shen, Hong. “Building a Digital Silk Road? Situating the Internet in China’s Belt and Road Initiative.” International Journal of Communication, 12 (2018): 19. Web. 26 Apr. 2020 Therein, the CCP is literally building out the telecommunications infrastructure of other countries. The CCP gives them the tools and training to control the flow of information into and out of their country, effectively instantiating cyber sovereignty.

As Freedom House notes, “China was once again the worst abuser of internet freedom in 2018, and over the past year, its government hosted media officials from dozens of countries for two- and three-week seminars on its sprawling system of censorship and surveillance.”2929Adrian Shahbaz. The Rise of Digital Authoritarianism. 2018 https://freedomhouse.org/report/freedom-net/2018/rise-digital-authoritarianismand Specifically, the CCP has worked via the Shanghai Cooperation Organization (SCO) and the Quadrilateral Cooperation Coordination Mechanism (QCCM) to outfit Tajikistan, Uzbekistan, Kyrgyzstan, and Kazakhstan with ICT, smart city, and facial recognition surveillance equipment.3030Felix Light. Russia Is Building One of the World’s Largest Facial Recognition Networks. 2019. Moscow Times. https://www.themoscowtimes.com/2019/11/12/russia-building-one-of-worlds-largest-facial-recognition-networks-a68139and Bradley Jardine. China’s Surveillance State Has Eyes on Central Asia. 2019. Foreign Policy. https://foreignpolicy.com/2019/11/15/huawei-xinjiang-kazakhstan-uzbekistan-china-surveillance-state-eyes-central-asia/ The CCP has similarly supplied the Iranian Revolutionary Guard Corps with ICT infrastructure and Iran’s largest telecommunications firm, TCI, with the “ability to locate users, intercept their voice, text messaging … emails, chat conversations or web access.”3131Daniel S. Markey. China’s Western Horizon. 2020. pp 138 Similar stories can be seen as far afield as Ecuador3232Paul Mozur, Jonah M. Kessel, Melissa Chan. Made in China, Exported to the World: The Surveillance State. 2019. New York Times. https://www.nytimes.com/2019/04/24/technology/ecuador-surveillance-cameras-police-government.html, Ethiopia, and South Africa.3333Authoritarians Are Exporting Surveillance Tech, And With it Their Vision for the Internet. Council on Foreign Relations. https://www.cfr.org/blog/authoritarians-are-exporting-surveillance-tech-and-it-their-vision-internet The CCP has also helped Russia ‘Sinicize’ its own network surveillance, and is installing 5G infrastructure.3434The Sinicization of Russia’s Cyber Sovereignty Model. 2020. Council on Foreign Relations. https://www.cfr.org/blog/sinicization-russias-cyber-sovereignty-model The resulting influence the CCP has curried redounds to its mission of instantiating a global norm of ‘cyber sovereignty,’ and can be concretely seen via other countries, principally authoritarian, growing insistence that ‘cyber sovereignty’ is the ideal network and infrastructure set up.

Worlds Apart: The Future of the Internet

It is increasingly clear that we are past a point of no return. Two competing and irreconcilable visions for the future of the internet exist. One, in favor of decentralization, the free flow of information, and undergirded by respect for individual sovereignty. The other, in favor of centralization, top-down control over information flows, and prioritization of State power. The former has largely characterized the nature of the internet since its inception, indeed the very structure of the internet, a decentralized mesh network based upon decentralized TCP/IP protocols, has these values deeply embedded. Meanwhile, the version of the internet that has been built in China and that the CCP is helping build out in various countries around the world, is based on the latter set of principles. There is no escaping the fact that while the infrastructure and operational protocols undergirding the internet are fundamentally technical issues, “they are also sites of mediation over political and economic values.”3535Laura DeNardis. Hidden Levers of Internet Control. 2012. Information, Communication & Society. https://www.tandfonline.com/doi/full/10.1080/1369118X.2012.659199?scroll=top&needAccess=true Given that irreconcilable values are incorporated into these two infrastructure and technological models, there will effectively be a splitting of the internet itself.

Two camps are likely to emerge and differentiate themselves. First, liberal democracies and other states that fundamentally respect individual sovereignty and predicate their political legitimacy on the consent of the governed. Second, authoritarian states who concentrate power at the top and believe that the political elite should have the power to decide what their subjects can speak and learn about.

Secretary Clinton in a now infamous speech on cyber technology laid out the US-led faction’s vision, stating that:

“[The U.S. is] also supporting the development of new tools that enable citizens to exercise their rights of free expression by circumventing politically motivated censorship. We are providing funds to groups around the world to make sure that those tools get to the people who need them in local languages, and with the training they need to access the Internet safely. The U.S. has been assisting in these efforts for some time, with a focus on implementing these programs as efficiently and effectively as possible. Both the American people and nations that censor the Internet should understand that our government is committed to helping promote Internet freedom.”3636Richard Andres, Cyber Conflict and Geopolitics, 2019

Although a parody, Beijing easily could have responded with a version of its own vision:

‘The CCP is supporting the development of new tools that enable states to exercise their ‘right to development’3737Andrea Worden. The CCP at the UN: Redefining development and rights. 2019. Sinopsis. https://sinopsis.cz/en/the-ccp-at-the-un-redefining-development-and-rights/ by ensuring political control over the internet. We are providing funds, technology, and building infrastructure on the ground in countries around the world to make sure that those tools get to the strong state actors who need them, and with the training they need to control the internet steadfastly. The CCP has been assisting in these efforts for some time, with a focus on implementing these programs as efficiently and effectively as possible. Both subversive foreign agents and hegemonic nations that promote destabilizing speech should understand that our government is committed to helping promote cyber sovereignty.’

As one analyst pithily stated, China seems increasingly poised to create a “cyber Sinosphere.” In many ways, this is something that already exists, in China itself as well as in places along its Digital Silk Road. At this point, it is abundantly clear that we are witnessing a de-facto splitting of the internet. Whether or not this splitting of the internet ultimately represents a geopolitical pivot point, a-la Mackinder and Maher, where China is able to achieve preeminence utilizing a new technology, remains to be seen.3838Richard Andres, Cyber Conflict and Geopolitics, 2019 Similarly, the precise contours of a split internet remain enigmatic. Will networks in authoritarian countries themselves fragment into mutually excludable intranets, or coalesce around a leader (the CCP)? Will liberal democracies stand together to sustain the original architecture of the internet, or will they lose faith and fragment themselves? Can two divergent models coexist, or will one ultimately prevail? Some western academics have claimed a fait accompli: “in the debate over freedom versus control of the global network,” they claim, “China was largely correct, and the U.S. was wrong.”3939Jack Goldsmith and Andrew Keane Woods. Internet Speech Will Never Go Back to Normal. 2020. The Atlantic. https://www.theatlantic.com/ideas/archive/2020/04/what-covid-revealed-about-internet/610549/ If these academics are to be proven wrong, and if the original framework of the internet, with its undergirding values of openness and freedom, is to endure, it will require a fight. The real cyber war will be over the nature and character of the internet itself.