Cyber-Monroe Doctrine?

I was recently involved in a discussion in which someone argued that a cyberspace equivalent of the Monroe Doctrine would be the best way to protect the U.S. from spam and various kinds of cyberattacks.

The Monroe Doctrine, in case you’ve forgotten (I was pretty fuzzy on it), is a policy President James Monroe announced on December 2, 1823. As Wikipedia explains, the Monroe Doctrine “said that further efforts by European governments to colonize land or interfere with states in the Americas would be viewed by the United States of America as acts of aggression requiring US intervention.” President Monroe claimed the United States “would not interfere in European wars or internal dealings, and in turn, expected Europe to stay out of the affairs of the New World.” Wikipedia.

So as I understand it, the proponent(s) of creating a new cyber-Monroe Doctrine argue that we should do something similar in cyberspace. I assume this means we would put other countries on notice that any attempt to interfere with our “sphere of influence” in cyberspace (whatever that is) will be treated as an “act of aggression” and responded to as such.

Actually, as I understand the proposal, it has two parts: One is that if we find ourselves under attack (cybercrime, cyberterrorism, cyberwarfare, a fusion of any/all of them), we will seal our cyberborders and go into garrison state mode for at least as long as that cyber-emergency exists. The other part of the proposal seems to be more analogous to the original Monroe Doctrine; it seems to contemplate that we will declare “United States cyberspace” to be our exclusive sphere of influence and will regard any attempt to erode or otherwise interfere with that sphere of influence as . . . what? . . . an act of cyberwar, I guess.

Before we go any further, I have to put you on notice: I am not a fan of this proposal. As I’ll explain in a minute, it reminds me of a similar proposal outlined several years ago; I think both are flawed conceptually and empirically. And aside from anything else, I don’t think an early nineteenth century solution can be an appropriate analogy for dealing with a world that has drastically changed in so many respects.

The earlier, similar proposal came from Professor Joel R. Reidenberg in his article, States and Internet Enforcement, 1 University of Ottawa Law & Technology Journal 213 (2003-2004). Professor Reidenberg proposes nation-states use two devices to deal with cybercrime; and while he’s only analyzing measures to control cybercrime, his proposal could also apply with equal logic to cyberterrorism andor cyberwarfare.

The first device is “electronic borders.” By electronic borders, Professor Reidenberg means the kind of filtering some countries – like China and Saudi Arabia – use to control the online content that is accessible by people in their territory. He argues that when a nation-state establishes an electronic border, it in effect quarantines cybercriminals (and, by implication, cyberterrorists and cyberwarriors) so they cannot cause “harm” in that country.

So if the U.S. were to adopt this device as a way of dealing with cyberthreats, it would establish an electronic border that, I presume, would seal “our” part of cyberspace off from the parts of cyberspace that are accessible in other countries and presumably to other countries. We would essentially be transposing geography into cyberspace; that is, we would be trying to export the notion of the nation-state as a sovereign entity that controls, and is defined by, the physical territorial area it controls into the virtual world of cyberspace.

Not being technologically adept, I don’t know if how feasible it would be to implement Professor Reidenberg’s electronic border. For the sake of analysis, though, I’ll assume that it could be implemented as effectively as he postulates. As I’ve noted before, though, when it comes to cyberthreats (cybercrime, cyberterrorism and cyberwarfare), our focus needs to be not on technology, as such, but on people.

It’s my understanding that people in countries where Internet filtering is being used are bypassing the filtering with varying degrees of success; I suspect techniques for evading such filtering will only improve over time (as, of course, will the filtering techniques). I suspect that if we tried to rely on the electronic border strategy, we’d succeed in quarantining law-abiding people and entities (which, of course, is not our real goal) but have much less success in keeping out the bad guys.

So my first objection is that the use of an electronic-border-enforced-cyber-Monroe-Doctrine would isolate the country using the strategy (the U.S.), thereby depriving it of the substantial and evolving benefits of online communications and commerce while doing relatively little to prevent dedicated bad guys from successfully attacking us. Such a solution would no doubt reduce the incidence of certain types of cybercrime, such as spam. Personally, though, I’d prefer to deal with spam and have the benefit of a borderless cyberspace.

The other device Professor Reidenberg proposes is an electronic blockade, which is the mirror image of the electronic border strategy. The electronic border is designed to keep the bad guys “out” of a demarcated area in cyberspace (the U.S.’ sphere of influence, whatever that would be); the electronic blockade is designed to keep the bad guys inside the country (area of cyberspace) from which they operate. It’s the cyber equivalent of the naval blockades that countries historically used to bottle up pirate ships or the ships belonging to a nation with which the state implementing the blockade was at war.

As Professor Reidenberg notes, an electronic blockade, unlike an electronic border, is a hostile act. If the United States were to implement an electronic blockade that prevented any packets from being transmitted “out of” the territory of Country A, Country A would certainly regard that as a hostile act, something conceptually equivalent to bombing Pearl Harbor. Now, as I’ve noted here and elsewhere, it is not at all clear that such an electronic assault would justify the retaliatory use of armed force under the current laws of war, but Country A might not care if it was justified or not. Country A might retaliate in the real-world . . . or it might figure out some way to retaliate in the cyberworld (by, say, hiring mercenaries or getting another, non-blockaded country to help it out).

Professor Reidenberg, of course, was not proposing the use of either device as a way to enforce a twenty-first century cyber-Monroe Doctrine. He was proposing both devices as ways to improve law enforcement’s effectiveness against cybercriminals. While I agree that this is something we need to do, I do not think their either device would be particularly effective in that regard . . . and I certainly do not think either could be used to enforce the cyber-Monroe Doctrine we’re analyzing.

It seems to me isolationist solutions have no place in an increasingly linked world. I think electronic borders and blockades and a cyber-version of the Monroe Doctrine would be about as effective in keeping out cyber-intruders as was the Tokugawa shogunate’s attempt to keep foreigners out of Japan.