Inaugural lecture given by Prof. dr. Dennis Broeders On the acceptance of his position as professor of Global Security and Technology at Leiden University on Friday March 31, 2023
Vériter, S.L.; Kaminska, M.K.; Broeders, D.W.J.; Koops, J.A. 2021
This collection, edited by Sophie Vériter, Monica Kaminska, Dennis Broeders and Joachim Koops, includes six papers exploring and investigating European responses to COVID-related disinformation,... Show moreThis collection, edited by Sophie Vériter, Monica Kaminska, Dennis Broeders and Joachim Koops, includes six papers exploring and investigating European responses to COVID-related disinformation, specifically the responses of France, Sweden, Germany, the United Kingdom, Serbia, and Hungary.The coronavirus pandemic has emphasised the crucial role that information flows play in safeguarding public order and the safety of individuals. With an increasingly volatile (social) media eco-system and an unprecedented climate of uncertainty, false reports and harmful campaigns have flourished, highlighting the disruptive intentions of some geopolitical actors on the global scene.This research project investigates how European states have responded to information influence operations related to COVID-19, particularly investigating the role of foreign sources of influence. Our objective has been to better understand the new challenges – both in practice and research – that have arisen from national experiences. The questions that guided our research project have been: How has the context of a pandemic impacted the way European states counter information influence? Which policy trends have emerged and which results have they yielded? Which issues generated divergence and/or convergence across Europe?This publication looks at European responses to COVID-related disinformation, specifically responses of France, Sweden, Germany, the United Kingdom, Serbia and Hungary, with contributions by Corneliu Bjola, Semir Dzebo, Martin Fertmann, Elsa Hedling, Jean-Baptiste Jeangène Vilmer, Péter Kállai, Matthias C. Kettemann and Tamás Peragovics. Show less
This paper investigates whether and how the twin UN processes of the UN Group of Governmental Experts (UN GGE) and the OpenEnded Working Group (OEWG) are willing and able to address two ‘below-the... Show moreThis paper investigates whether and how the twin UN processes of the UN Group of Governmental Experts (UN GGE) and the OpenEnded Working Group (OEWG) are willing and able to address two ‘below-the-threshold’ problems in their deliberations. The call for the protection of the public core of the internet and the call for the protection against foreign election interference have been flagged by many state and non-state parties for consideration by both processes. This paper analyses the threats that the vulnerability of the public core of the internet and foreign election interfere pose for stability in cyberspace, as well as the legal and normative proposals that have been suggested to promote responsible state behaviour. On the basis of the public documents that states have submitted to the more transparent OEWG process, the contours are sketched of what the inclusion of these issues in possible consensus reports for both processes may look like. The OEWG concluded its deliberations with a consensus report that addresses some aspects of these issues, shifting the task of further elaboration and guidance firstly onto the ongoing UN GGE process, as well as onto the new OEWG 2021–2025 and other UN processes that are emerging. Show less
Private sector Active Cyber Defence (ACD) lies on the intersection of domestic security and international security and is a recurring subject, often under the more provocative flag of ‘hack back’,... Show morePrivate sector Active Cyber Defence (ACD) lies on the intersection of domestic security and international security and is a recurring subject, often under the more provocative flag of ‘hack back’, in the American debate about cyber security. This article looks at the theory and practice of private cyber security provision and analyses in more detail a number of recent reports and publications on ACD by Washington DC based commissions and think tanks. Many of these propose legalizing forms of active cyber defence, in which private cyber security companies would be allowed to operate beyond their own, or their clients’ networks, and push beyond American law as it currently stands. Generally, public-private governance solutions for security problems have to manage a balance between (i) questions of capacity and assigning responsibilities, (ii) the political legitimacy of public–private security solutions and (iii) the mitigation of their external effects. The case of private active cyber defence reveals a strong emphasis on addressing the domestic security (and political) problem, while failing to convincingly address the international security problems. The proposals aim to create a legitimate market for active cyber defence, anchored to the state through regulation and certification as a way to balance capacity, responsibilities and domestic political legitimacy. A major problem is that even though these reports anticipate international repercussions and political pushback, against what is likely be received internationally as an escalatory and provocative policy, they offer little to mitigate it. Show less
Kaminska, M.K.; Broeders, D.W.J.; Cristiano, F. 2021
The fact that States resort to automated cyber operations like NotPetya, which spread virally and have indiscriminate effects, raises the question of how the use of these might be regulated. As... Show moreThe fact that States resort to automated cyber operations like NotPetya, which spread virally and have indiscriminate effects, raises the question of how the use of these might be regulated. As automated operations have thus far fallen below the threshold of the use of force, the letter of international humanitarian law (IHL) does not provide such regulation. In IHL, the principles of distinction and discrimination hold that attacks should in their targeting distinguish between the civilian population and combatants, and between civilian objects and military objectives. Attacks must not be indiscriminate, and operations that might foreseeably spread to affect civilian objects are prohibited. This paper draws inspiration from the legal principles of distinction and discrimination to suggest a non-binding norm for responsible State behaviour with regard to automated operations that fall below the threshold of the use of force: the norm proposes that States should design cyber operations so as to prevent them from indiscriminately inflicting damage. The paper finds that in the case of automated cyber operations, a distinction between the nature of the operation and the use of the operation does not make sense because the design (nature) of the malware defines the use. In order to conform with the norm, responsible States should conduct a review of cyber operations prior to their execution. Finally, as the paper illustrates with a comparative analysis of NotPetya and Stuxnet, the post-incident forensic analysis of an operation can allow third parties and victims to determine whether the operation’s designer conformed with the norm. This can help set a normative benchmark by providing a basis upon which States may call out unacceptable behaviour. Show less
The norm to protect the public core of the internet, originally advocated by the Netherlands Scientific Council for Government Policy, can be operationalised in two ways. Both a layered approach... Show moreThe norm to protect the public core of the internet, originally advocated by the Netherlands Scientific Council for Government Policy, can be operationalised in two ways. Both a layered approach and a functional approach to defining the public core of the internet provide productive ways to discuss safeguarding the functionality and integrity of the core logical and physical infrastructure of the internet from unwarranted state interventions. The article further discusses the tensions between the concept of ‘the public core of the internet’ and those of state sovereignty and national security. It describes two tiers of objection to the protection of the core internet infrastructure and suggests ways to mitigate them. It concludes that even though there are no easy answers to national security in the cyber age, in the long run, reducing ambiguity in cyberspace will benefit all states. Lifting the public core of the internet out of that ambiguity would be a good starting point. Show less
