The infrastructure and standardisation basket
Surveillance and espionage The 2013 revelations by the NSA employee Edward Snowden have again confirmed that states – the USA included – exploit the vulnerabilities of the Internet for their own interests. The NSA’s PRISM project based its surveillance capabilities on the ability to access the cables, routers, and cloud servers of major Internet companies (US-based telecoms, service, and content providers). In response, other countries – especially EU and BRICS – have started considering mitigation tactics, including laying their own intercontinental submarine cable connections to avoid passing through US nodes,74 requiring Internet companies to store personal data of their citizens on data centres within their jurisdictions, and encouraging the development of local services and content. In 2013, the US-based security company Mandiant released a report about a cyber-espionage campaign against US companies conducted by China.75 After the USA charged five Chinese ‘military hackers’, China in turn accused the USA of cyber-espionage, which resulted with the suspension of the activities of the China-US Cyber Working Group.76 The increasing militarisation of cyberspace through the use of exploits and hacking tools by states leads to increasing political tension. Such tension may accelerate the need for global efforts to prevent the proliferation of cyberarms. Cybersecurity and human rights The link between cybersecurity and human rights is highly relevant for the future of the Internet. So far, these two fields are being addressed separately in their respective silos. However, recent experiences (SOPA, ACTA, PRISM/NSA) show that the protection of human rights (privacy, freedom of expression, access) is not only a value-based priority, it is also a very practical tool for ensuring that the Internet remains open and secure. Human rights are a matter of cyber realpolitik. Individual Internet users are the pillars of cybersecurity. Yet they are often the ‘weakest link’ when it comes to protection from cyber-attacks. Our personal computers are used to stage cyber-attacks (as part of botnets) and spread viruses and malware. Unprotected access to our computers and mobile devices offers a backdoor for access to the datasets of our companies or institutions, and compromises many more computers. Concerns of the end users, however, are usually not about possible greater damage (often due to ignorance) as a result of their compromised computer, 71