高端视野 | 吴沈括 S. Boutillier：网络空间国际规则与《巴黎倡议》

全球数字治理前沿系列研究之：

网络空间国际规则与《巴黎倡议》 

吴沈括

网络法治国际中心执行主任、博导

中国互联网协会研究中心副主任

Siane Boutillier du Retail

网络法治国际中心研究助理

Short Summary :On November 12, 2018, on the occasion of the meeting at UNESCO of the Internet Governance Forum (IGF) and the first Paris Peace Forum, the French President, Emmanuel Macron, launched the Paris Call for Trust and Security in Cyberspace, a high-level declaration articulated around nine principles and shared values to make cyberspace a free, safe and open space.The Paris Appeal has now become the world's largest multi-stakeholder initiative on cybersecurity, with more than 1,200 supporters from all continents (states, companies, civil society organizations, local communities and public authorities), including 81 states. For the time being, China is not among them. However, Huawei and Shundun Technology have decided to support it. The support of the United States and the European Commission for the Paris Appeal were announced at the 2021 edition of the Paris Peace Forum. Question Presented :How does the Paris Call form a new beginning for the world of cybersecurity?Brad Smith, the president of Microsoft, considers the Paris call as a "real turning point", Eugene Kaspersky speaks of a very positive change considering the climate of growing mistrust in the world.To understand its importance, the memorandum will outline the main characteristics of the Paris call, with on one hand, the background, purposes and values (I) and on the other hand, the current status and the next steps (II). (I) Background, purpose and values The Paris Appeal was born from the definition of cyberspace, its positive contributions but also its negative contributions.Cyberspace for the Paris Call is considered as a communication space that includes, network infrastructures (99% cables, 1% satellites + data centers), the devices (computers and smartphones); the software used by these devices and the data transported (what is known as "big data"). From this definition, the Paris Call lists the positive contributions linked to the development of cyberspace meaning : economic progress, cultural development and access to information.In fact, it would be interesting to argue about the role of cyberspace in cultural development and access to information: this is the case for earthlings who are sufficiently literate and trained and have a good command of written English, and depending on the country which you live in too. But is this really the case for those who must, in cyberspace, content themselves with watching moving images without being able to understand what they mean and where they come from, but which can serve as a sounding board for fear and hate?The Paris Call then lists the threats encountered, because cyberspace can’t only be one sided. The first one is cybercrime. Nonetheless, it isn’t defined, but in French criminal law, a "crime" is the highest level of the penal system of offenses. Such a word could suggest that cyberspace can be a place where crimes are committed. This is not really possible since it is a mainly virtual space (except if we attack the "data centers" and those who keep them) where we are not in physical contact with people (the crimes are murder - voluntary unpremeditated homicide, assassination - voluntary premeditated homicide - and rape). On the other hand, cyberspace can be used to order crimes and to organize themselves to commit them. But "cybercrime" is a generic term and more often encompasses crimes such as theft, extortion and illegal downloading. The other threats listed were information manipulation, political or economic espionage, attack on infrastructure, theft of personal information or confidential data, jeopardizing the information and communication systems of citizens, and companies and administrations.In fact, we are just beginning to become aware of the considerable dangers linked to this cyberspace, both for our individual lives (the most serious threat is identity theft), and for the functioning of economic life (threatened by attacks on the networks, viruses, especially of the "ransomware" type -which demand a ransom-, the functioning of the democratic political life (when an electronic voting system or the media system can be manipulated) and worse, when the administration or the security of a State is attacked (by trying to break into its systems).We can nonetheless no longer do without cyberspace to operate the world's air transport, rail transport, to pay the civil servants of a State, to manage the organization of a high school (timetables, absences, grades) which is entirely based on a software that is a priori secure. We don't want to give it up but we know that those who designed the programs have the same skills as those who attack them and that no computer system can be 100% secure, as soon as the data -even encrypted- are sent on the networks.The Paris Appeal specifies that threats on cyberspace can come from state groups (which means that it can be a new form of war) and from non-state groupsThus, in order to ensure that the fundamental rights and principles that apply in the physical world are respected in cyberspace, States must act together, but also join forces with partners from the private sector and civil society.The Paris Call's supporters therefore commit to working together towards 9 principles, constituting both lines of thought and action.The first one is : to protect individuals and critical infrastructure from malicious cyber-activities by increasing prevention and resilience to malicious online activities. With this in mind, the European Hotline Association proposes cybersecurity recommendations to ensure the safety of citizens.   The second one is : to protect the availability and integrity of the public core of the Internet. It requires close cooperation between different types of actors, including the Internet Corporation for Assigned Names and Numbers (ICANN), a non-profit organization, and private companies like Nameshield. The Hague Center for Strategic Studies (HCSS) is also initiating a community of interest on protecting the public core of the Internet.The third one is to prevent interference designed to destabilize electoral processes. The Transatlantic Commission on Election Integrity (TCEI) is in this sens promoting solutions for securing electoral processes. The Alliance for Securing Democracy, Canada and Microsoft are also working to prevent malicious interference by foreign actors.The fourth one is : to defend intellectual property against cyber threats by working together against cyber-based intellectual property violations. The Linux Foundation for example supports communities that share their knowledge by Protecting software based on free licenses.The fifth one is : to prevent and deter the proliferation of malicious software and computing practices. For instance, YesWeHack organizes Bug Bounty programs to reveal and fix vulnerabilities before malicious tools get hold of them. This would combat the proliferation of malware at the root.The sixth one is : to increase the security of digital products and services. Therefore, the Carnegie Foundation offers recommendations to governments and businesses in the area of information and operational technologies.The seventh one is : to improve computer hygiene for all. For example, the Ecuadorian Association for Cyber Security, Seguros en la red, promotes computer hygiene among children in Ecuador.The eighth one is : to prevent non-state actors, including the private sector, from engaging in cyber-attacks. The Tech Accord as a consequence is initiating a conversation on definitions and best practices.The last one is : to strengthen international standards of responsible behavior and confidence-building measures. The Nuclear Threat Initiative is currently bringing together nuclear technical teams to equip themselves.Thus, the supporters adhere to these principles, and bring, when possible, their stone to the building.As for the values, in addition to the above-mentioned principles, they can be found in the legislative texts on which the Paris Appeal is based on. Indeed, in 2018, the Paris Appeal reaffirms that international law, including the United Nations Charter in its entirety, international humanitarian law and customary international law, applies to the use of information and communication technologies (ICT) by States. It also reaffirms that the rights that people enjoy offline must also be protected online and that international human rights law applies to cyberspace.Finally, it reaffirms that international law, together with the voluntary norms of responsible behavior of States in peacetime and the confidence-building and capacity-building measures developed within the framework of the United Nations, constitute the foundation for international peace and security in cyberspace.This background, principles and values have put in place the Paris Call, which has, since the last three years, been implemented and continued. (II) Current status and next stepThe Paris Call has already led to big changes. The joint effort of states has already led to some changes in Europe and South America, which have included strengthened cybersecurity measures around emergency phone systems, protect domain name systems and set up larger bug bounty programs. The goal is to avoid spreading too thinly and to bring all the initiatives together. Today, initiatives have been also launched by huge companies such as the Siemens trust charter or the campaign for digital peace launched by Microsoft. All this competes with traditional interstate diplomacy.  Furthermore, the Paris Call has been extended. As of last November, the European Union and the United States became supporters of the Paris Call. This will allow the Paris Call to become even stronger and to go further in defending the stability of cyberspace. Indeed, before Kamala Harris left for Paris to meet the French President regarding certain issues , two senior U.S. Congressional leaders - Senate Foreign Relations Committee Chairman Robert Menendez and House Foreign Affairs Committee Chairman Greg Meeks - sent her a letter urging the United States to join the Paris Call. The French president spearheaded the initiative's creation in 2018, and has long sought to include the United States. But former President Donald Trump's administration refused to join, criticizing it for not including China and Russia either. Nevertheless, the United States and mostly the Biden-Harris Administration, now interprets the Paris Appeal as consistent with its existing national and international obligations and commitments, including the importance it places on respect for human rights, freedom of expression and privacy. They say they should support it because "this announcement builds on the United States' ongoing work to improve cybersecurity for our citizens and businesses, including rallying G7 countries to hold accountable nations that harbor cybercriminals, supporting NATO's cyber policy update for the first time in seven years, and the recent anti-ransomware engagement with more than 30 countries around the world to accelerate international cooperation in the fight against cybercrime."Moreover, even though the absence of a major world power is noticeable, the Paris Call still appealed to many cyberspace players, which have made it work. Indeed, the Paris Call has the merit of having the support of large companies such as Google, Meta, Amazon but also Microsoft. We can also note the support of IBM, Samsung, Cisco, Nokia, Oracle, Dell, Orange cyberdefense, Daily Motion, Qwant, Snap, Twitter ... The Paris Call has even convinced companies that are not necessarily focused on the IT market but which may be exposed to cyberattacks. For example, can be found : Airbus, Total, Nestlé, Thales, Visa, MasterCard, Engie, Allianz.During the last year, the Paris Call working groups have been working throughout the year to put into action the principles of the Paris Call. Indeed, in the multi-stakeholder spirit of the Paris Call, an online consultation was launched in 2020 to better understand the concerns and expectations of supporters. The contributions received, highlighted the desire of supporters to become more involved in order to continue to strengthen the Paris Appeal community and concretely implement the principles that structure it.It is to respond to this request that the French Minister of Europe and Foreign Affairs announced, at the Paris Peace Forum in November 2020, the launch of six dedicated working groups open to all supporters. Each of these groups is co-chaired by two or three supporters of the Appeal from different sectors or countries.The first group was working on broadening the Community of Support. It has for co-chairs, the Paris Peace Forum General Secretariat and the National Democratic Institute.The second group was working on engaging Stakeholders from Emerging Countries. It has for co-chairs, the Paris Peace Forum General Secretariat and the State of Sao Paulo and Schneider Electric.The third group was working on promoting a multi-stakeholder approach to cyber negotiations at the UN. It has for co-chairs, the Cybersecurity Tech Accord and AccessCyber.org.The fourth group was working on advancing International Standards. It has for co-chairs: Microsoft, F-Secure, and the Center for Cybersecurity Studies and International Relations at the University of Florence.The fifth group was working on building a cyberspace stability index. It has for co-chairs: the Geopolitics of the Datasphere research center (GEODE - Université Paris 8), the Hague Center for Strategic Studies and the CyberPeace Institute.The last group was working on developing concrete tools for supporters. It has for co-chairs: Cigref and Kaspersky.These groups presented their work at the Paris Peace Forum in November 2021, including the methodology for calculating a cyberspace stability index and a report on securing the digital supply chain. France will bring this work to the OECD to study the opportunity to deepen it in this framework, hoping also to broaden and provide a real scope to this work.The Paris Appeal is also keen to increase the number of its supporters. Conclusion :To conclude, the Paris Call has clearly formed a new beginning for the world of cybersecurity. It has in its principles and in its effort to work together to their realization. As a matter of fact, the groups of works and the outcome of them, perfectly demonstrate it. In just three years, it has also gathered important supporters, which play a great role in cyberspace. The question now is will it be able to continue gathering supporters and will the work recently presented, come to fruition. 
— END —
网络法治国际中心 | 全球数字治理前沿系列：高端视野|吴沈括 L. Valenti：数据跨境调取与布达佩斯公约第二补充议定书
高端视野|吴沈括 H. MANZOOR：数字安全与联合国打击网络犯罪公约高端视野|吴沈括 Elena Scarpelli：欧盟数据主权与《电子证据条例》立法高端视野|吴沈括 Andrea Fusi：欧盟数字转型与《数字权利和原则宣言》高端视野|吴沈括 Deuse Clément：欧盟数字主权与《数据法案》立法进程网络法治国际中心 | 跨境数据治理前沿系列：
高端视野 | 吴沈括 邓立山：WTO框架下的数据跨境规则研究高端视野 | 吴沈括 邓立山：OECD框架下的数据跨境规则研究高端视野 | 吴沈括 邓立山：DEPA框架下的数据跨境规则研究
高端视野 | 吴沈括 邓立山：G20框架下的数据跨境规则研究
高端视野|吴沈括 邓立山：CPTPP框架下的数据跨境规则研究
高端视野|吴沈括 邓立山：RCEP框架下的数据跨境规则研究
高端视野 | 吴沈括 邓立山：APEC框架下的数据跨境规则研究高端视野|吴沈括 邓立山：APEC框架下关于数据跨境的CBPR规则研究

图文编辑：北京师范大学  黄诗亮