Eight years ago, Edward Snowdon changed the overall posture of global cybersecurity by exposing the U.S. PRISM project. Cybersecurity has become the biggest risk and challenge in both international and national security; however, there has been no global consensus on the most basic concept of cybersecurity. This is mainly because the international community has seriously lacked reflection on the PRISM incident. Only a small number of countries, China and Russia among them, have reflected on the project's threat to international and national security.
Not long ago, media reports exposed large-scale U.S. surveillance of the EU, including German and French leaders, via Denmark. The incident again attracted broad international attention. But unless there is serious reflection on the matter in the international community, the U.S. will simply continue its large-scale surveillance all over the world, similar scandals will continue to be exposed, peace and security will be difficult to preserve in cyberspace and there will only be increasing threats to international security.
Why has the U.S. been conducting large-scale cyber surveillance? We must be very clearheaded about the fact that cyberspace has become the main source of intelligence for the U.S. as well other members of the “Five Eyes.” There have been reports that nearly 70 percent of the content of the daily briefings presented to President Barack Obama by the U.S. intelligence community were from the Tailored Access Operations (TAO) office under the National Security Agency, which is mainly engaged in signal intelligence collection. Rob Joyce, currently special assistant to the president and a cybersecurity coordinator on the U.S. National Security Council, had once been in charge of the office.
On the other hand, the U.S. is willing to pay any price to preserve cyber intelligence collection. Former NSA director Keith Alexander, who had denied the existence of large-scale surveillance at a Congressional hearing, was “dismissed” for openly lying to Congress after the “PRISM-gate” revelations. U.S. officials have insisted on all occasions that cyber intelligence collection is “legal” and “legitimate.” According to media reports, the U.S. Office of Personnel Management was the target of a cyberattack in 2015, resulting in the leaking of personal data on nearly 20 million government employees. Then Director of National Intelligence James Clapper openly claimed the incident was a matter of intelligence collection and not in violation of international law.
In order to conduct cyber intelligence collection, the U.S. wouldn't make an exception for its allies, or even their leaders. While the U.S. president and the secretary of state once made promises to leaders of allied countries on cyber surveillance following the PRISM exposure, U.S. intelligence agencies represented by the NSA obviously think otherwise, continuing to undertake all kinds of surveillance programs worldwide. The U.S. has been even more outrageous when it comes to such identified rivals as China and Russia. The NSA has hacked into the core networks of Huawei and China Telecom to install a “back door” in the Russian power grid.
Ironically, the U.S. once proposed the “clean network” plan, which looks like a joke today. The so-called clean network was meant to get rid of all factors that impede U.S. collection of cyber intelligence. China and its leading 5G telecommunications equipment provider have become the biggest obstacles. Huawei once claimed it wouldn't cooperate with the intelligence agencies of any country if it would endanger user security. This was the main reason that U.S. intelligence departments have launched relentless attacks against Huawei. While excluding Huawei from their 5G networks, countries like Germany and France are actually voluntarily opening a window to large-scale U.S. cyber surveillance.
Large-scale surveillance conducted by the U.S. has already become the most important enemy that threatens international and national security. It ruins diplomatic confidence and international rule-making for cyberspace. Judging from past experience, condemning the U.S. intelligence community will be useless. The international community must engage in serious discussions about whether cyber intelligence collection is necessary and, if it is, where the boundaries should be. Any ambiguity or hesitation on the part of the international community will lead others to mimic the U.S., the malicious consequences of which will only grow worse.
Therefore, multilateral institutions like the UN should immediately launch corresponding discussions and strictly limit cyber intelligence collection, especially prohibiting illicit invasion into other countries' cyberspace and the theft of other countries' network data in the name of intelligence collecting. Meanwhile, intelligence collecting activities at key infrastructure sites around the globe — such as DNS resolvers, submarine cables and cable landing points — should also be banned. Only in this way can we stop America's illicit actions in cyberspace.
At the bilateral level, if the U.S. wants to reach an agreement with China in the field of cybersecurity, it must also stop its large-scale cyber surveillance against China. The two sides may communicate over the negative impacts of cyber intelligence collection and other cybersecurity issues in their relationship, and reach a consensus not to conduct cyberattacks against each other. This is of significant importance to preserving peace and restoring mutual trust in cyberspace.
