32
Ronald Deibert and Rafal Rohozinski
sealed requests are made to disclose information about its users, such as one recently
made to Twitter for information about supporters of Wikileaks.
35
It would be misleading to equate these policies with the types of pressures that such
companies face in jurisdictions like Iran or Belarus where there are no meaningful
checks and balances or spaces for an adversarial press to report on them without
considerable risk. But they do provide a justifi cation for such actions, albeit in a different context and wrapped in a different rationale. As the Iranian case illustrates,
what is deemed cybercrime in one context can be translated into something entirely
different in another, all under the rubric of legitimizing regulation of cybercrime as a
global norm. Recently, for example, South Korea bolstered its capacity to enforce
cybercrime laws that make it illegal to host pro – North Korean messages on Web sites
and forums. Between January and June 2010, the new South Korean cybercrime team
of the National Policy Agency forced Web site operators to delete 42,787 pro – North
Korean posts from their Web sites — an increase from 1,793 deletions under the previous liberal Roh Moo-hyun administration in 2008.
36
Assertions of state power in cyberspace mesh with one of the other drivers mentioned earlier: the demographic shift in cyberspace to the South and East. In these
regions, many states have a well-established tradition of government intervention and
state control, particularly of the mass media and the economy. Already having such
a tradition in place, they are also coming into cyberspace at a much different historical
juncture than the “ early adopters ” of the technology in the North and West. For the
latter, cyberspace was either something to be cordoned from government intervention
altogether or a mystery best left untouched. For the former, they are coming at cyberspace from the perspective of a much different security context surrounding cyberspace and a much greater understanding of its contested terrain. They are doing so
building upon the knowledge and practices of prior experiments and are adopting and
sharing best practices of information control and denial.
One area where these best practices may be increasingly shared and policies coordinated is among regional security organizations. Until recently, the Shanghai Cooperation Organization (SCO),
37 the Arab League,
38 the Gulf Cooperation Council
(GCC),
39 the Association of Southeast Asian Nations (ASEAN), the North Atlantic
Treaty Organization (NATO), and others had not dealt with cyberspace issues in a
concerted fashion, but that situation is changing. Recently, there have been indications that regional security organizations may be harmonizing laws, practices, and
doctrines around cyberspace operations. After its 2010 Lisbon Summit, for example,
the NATO alliance affi rmed a greater commitment to joint cyberspace operations and
doctrine. Although the activities of some of the other regional organizations, like the
SCO, are much more opaque, there is evidence of coordination around “ information
security ” practices, including evidence of joint exercises to counter mass social
mobilization. Refl ecting a regime stability view of cyber security, an August 2009 SCO
Ronald Deibert and Rafal Rohozinski
sealed requests are made to disclose information about its users, such as one recently
made to Twitter for information about supporters of Wikileaks.
35
It would be misleading to equate these policies with the types of pressures that such
companies face in jurisdictions like Iran or Belarus where there are no meaningful
checks and balances or spaces for an adversarial press to report on them without
considerable risk. But they do provide a justifi cation for such actions, albeit in a different context and wrapped in a different rationale. As the Iranian case illustrates,
what is deemed cybercrime in one context can be translated into something entirely
different in another, all under the rubric of legitimizing regulation of cybercrime as a
global norm. Recently, for example, South Korea bolstered its capacity to enforce
cybercrime laws that make it illegal to host pro – North Korean messages on Web sites
and forums. Between January and June 2010, the new South Korean cybercrime team
of the National Policy Agency forced Web site operators to delete 42,787 pro – North
Korean posts from their Web sites — an increase from 1,793 deletions under the previous liberal Roh Moo-hyun administration in 2008.
36
Assertions of state power in cyberspace mesh with one of the other drivers mentioned earlier: the demographic shift in cyberspace to the South and East. In these
regions, many states have a well-established tradition of government intervention and
state control, particularly of the mass media and the economy. Already having such
a tradition in place, they are also coming into cyberspace at a much different historical
juncture than the “ early adopters ” of the technology in the North and West. For the
latter, cyberspace was either something to be cordoned from government intervention
altogether or a mystery best left untouched. For the former, they are coming at cyberspace from the perspective of a much different security context surrounding cyberspace and a much greater understanding of its contested terrain. They are doing so
building upon the knowledge and practices of prior experiments and are adopting and
sharing best practices of information control and denial.
One area where these best practices may be increasingly shared and policies coordinated is among regional security organizations. Until recently, the Shanghai Cooperation Organization (SCO),
37 the Arab League,
38 the Gulf Cooperation Council
(GCC),
39 the Association of Southeast Asian Nations (ASEAN), the North Atlantic
Treaty Organization (NATO), and others had not dealt with cyberspace issues in a
concerted fashion, but that situation is changing. Recently, there have been indications that regional security organizations may be harmonizing laws, practices, and
doctrines around cyberspace operations. After its 2010 Lisbon Summit, for example,
the NATO alliance affi rmed a greater commitment to joint cyberspace operations and
doctrine. Although the activities of some of the other regional organizations, like the
SCO, are much more opaque, there is evidence of coordination around “ information
security ” practices, including evidence of joint exercises to counter mass social
mobilization. Refl ecting a regime stability view of cyber security, an August 2009 SCO