[Draft 3] International Cybersecurity Convention

[PotatoFarmers]

David Jossiah Beckingham, chairman of Poafmersia's World Assembly board: "This was a project that we have been working on for a long time. We note that there are interests in a proposal on cybersecurity, and that a fellow ambassador from another nation has been working a proposal of the same topic. We feel, however, that our direction is more realistic, and therefore, have proceeded to open the following draft for review by fellow ambassadors."

International Cybersecurity Convention
Category: International Security
Strength: Mild

The World Assembly,

Noting that the prevalence of technology in our day-to-day lives,

Realising that technological advancement has made us vulnerable to various forms of cyberattacks,

Recognising previous efforts to regulate against cyberattacks, as seen in GA#100 and GA#360,

Determined to establish regulations to protect against cyberattacks,

Hereby:

1. Defines the following:
   
   1. Critical infrastructure as systems and structures, physical or technological, which are vital to the functioning of the society. This includes water and energy utilities; agriculture and food storage facilities; as well as healthcare facilities and their associated computer infrastructure.
   2. A cyberattack as an offensive action targetting computer networks and associated infrastructure for the purpose of causing disruption or destruction of services, and/or divulgence or theft of sensitive information.
   3. Cyber hygiene as a set of routines individuals should undertake to ensure the security of the computer infrastructure.
   4. Cybercriminals as individuals or organisations who conduct cyberattacks for the sake of personal profits.
   5. Malware as computer applications which are used for malicious purposes, as part of a cyberattack.
   6. Penetration Testing as a closely-monitored process of checking for vulnerabilities in a computer infrastructure, with prior permission from the owner of the infrastructure.
2. Criminalises cyberattacks, or attempts to conduct cyberattacks, on critical infrastructure.
   
3. Establishes the Cybersecurity Advisory Board (CAB), which will be empowered to do the following:
   
   1. Keep a record of known cybercriminals around the world and their tactics, techniques and procedures.
   2. Maintain a database of known malware for reference by cybersecurity agencies and organisations.
   3. Facilitate intelligence sharing of known cyber threats between member states.
   4. Assist member states in the formation of local cybersecurity agencies.
4. Requires that member states establish a cybersecurity agency in their country, which shall do the following:
   
   1. Support private organisations to establish protocols to protect the organisation against cyberattacks.
   2. Investigate cases of known cyberattacks in the state's jurisdiction.
   3. Implement measures to reduce the number of cyberattacks in the state.
   4. Assist the CAB in the investigation of cross-border cybercriminals.
   5. Educate the public about cyberattacks and the importance of cyber hygiene.
5. Encourages member states to establish a framework governing penetration testing.
   
6. Clarifies that this resolution does not affect state-sponsored cyberattacks, and encourages the Assembly to adopt a separate resolution to regulate state-sponsored cyberwarfare.

---

The World Assembly,

Noting that the prevalence of technology in our day-to-day lives,

Realising that technological advancement has made us vulnerable to various forms of cyberattacks,

Recognising previous efforts to regulate against cyberattacks, as seen in GA#100 and GA#360,

Determined to establish regulations to protect against cyberattacks,

Hereby:

1. Defines the following:
   
   1. Critical infrastructure as systems and structures, physical or technological, which are vital to the functioning of the society. This includes water and energy utilities; agriculture and food storage facilities; as well as healthcare facilities.
   2. A cyberattack as an offensive action targetting computer networks and infrastructure for the purpose of causing disruption or destruction of services, and/or divulgence or theft of sensitive information, except for the purposes of penetration testing as defined below.
   3. Cybercriminals as individuals or organisations who conduct cyberattacks for the sake of personal profits.
   4. Malware as computer applications which are used for malicious purposes, as part of a cyberattack.
   5. Penetration Testing as a closely-monitored process of checking for vulnerabilities in a computer infrastructure, with prior permission from the owner of the infrastructure.
2. Criminalises cyberattacks, or attempts to conduct cyberattacks, on critical infrastructure.
   
3. Establishes the Cybersecurity Advisory Board (CAB), which will be empowered to do the following:
   
   1. Keep a record of known cybercriminals around the world and their tactics, techniques and procedures.
   2. Maintain a database of known malware for reference by cybersecurity agencies and organisations.
   3. Facilitate intelligence sharing of known cyber threats between member states.
   4. Assist member states in the formation of local cybersecurity agencies.
4. Requires that member states establish a cybersecurity agency in their country, which shall do the following:
   
   1. Support private organisations to establish protocols to protect the organisation against cyberattacks.
   2. Investigate cases of known cyberattacks in the state's jurisdiction.
   3. Implement measures to reduce the number of cyberattacks in the state.
   4. Assist the CAB in the investigation of cross-border cybercriminals.
   5. Educate the public about cyberattacks and the importance of cyber hygiene.
5. Encourages member states to establish a framework governing penetration testing.

The World Assembly,

Noting that the prevalence of technology in our day-to-day lives,

Realising that technological advancement has made us vulnerable to various forms of cyberattacks,

Recognising previous efforts to regulate against cyberattacks, as see in GA#100 and GA#360,

Determined to establish regulations to protect against cyberattacks,

Hereby:

1. Defines the following:
   
   1. Critical infrastructure as systems and structures, physical or technological, which are vital to the functioning of the economy and society. Examples will include power plants, water treatment and distribution systems, and medical facilities.
   2. A cyberattack as an offensive action targetting computer networks and infrastructure for the purpose of causing disruption or destruction of services, and/or divulgence or theft of sensitive information.
   3. Cybercriminals as individuals or organisations who conduct cyberattacks for the sake of personal profits.
   4. Malware as computer applications which are used for malicious purposes, as part of a cyberattack.
   5. Penetration Testing as a closely-monitored process of checking for vulnerabilities in a computer infrastructure.
2. Mandates that member states criminalises cyberattacks, or attempts to conduct cyberattacks, on critical infrastructures.
   
3. Establishes the Cybersecurity Advisory Board (CAB), which will be empowered to do the following:
   
   1. Keep a record of known cybercriminals and their tactics, techniques and procedures.
   2. Maintain a database of known malware for reference by cybersecurity agencies and organisations.
   3. Facilitate intelligence sharing of known cyber threats between member states.
   4. Assist member states in the formation of local cybersecurity agencies.
4. Requests that member states establish a cybersecurity agency in their country, which does the following:
   
   1. Support private organisations to establish protocols to protect the organisation against cyberattacks.
   2. Investigate cases of known cyberattacks in the state's jurisdiction.
   3. Implement measures to reduce the number of cyberattacks in the state.
   4. Educate the public about cyberattacks and the importance of cyber hygiene.
5. Encourages member states to establish a framework governing penetration testing.
   
6. Declares that penetration testing, with explicit permissions granted by the owner of the said infrastructure, should not be considered a criminal offence.

[Fachumonn]

I wouldn't bold your definitions. Unnecessary and not a regular practice.

[Tinhampton]

This (almost) falls into much the same trap as RDW does: what is a critical infrastructure, for starters?

[Hulldom]

"On a first glance, we could likely support this presuming the proposal offered by the delegation from SherpDaWerp does not pass."

OOC: There's a couple of grammar notes here from me while I mull over the overarching resolution.

1. "vital to the functioning of the economy and society"-->"vital to economic and societal functions".

2. "criminalises" in clause 2 should be "criminalise".

3. Probably just a me thing but I prefer the Oxford comma after "techniques" in clause 3(i).

4. Is "penetration testing" a singular noun or a collective one? If the former, drop the s from "permissions" in (6).

A few content notes:

1. I would remove "for the sake of personal profits" from your definition of "cybercriminals" in 1(c), I think that makes the definition of "cybercriminals" unnecessarily narrow. For instance, and you can correct me if I'm wrong, wouldn't a DDOS attack have precisely the opposite effect in reducing/eliminating the ability to make profits.

2. Same for everything after the comma after "purposes" in 1(d). This also feels unnecessarily restrictive.

3. For clause 3, I'd say pick a system of listing. Either use the (i), (ii), (iii) system you establish in this clause or the (a), (b), (c) system you use in clause 1. Either is acceptable, and while it my be nitpicky, both are not.

4. Just to strengthen the resolution, I would actually make (4) a requirement rather than simply a request.

[PotatoFarmers]

This (almost) falls into much the same trap as RDW does: what is a critical infrastructure, for starters?

"I refer you to clause 1a."

Critical infrastructure as systems and structures, physical or technological, which are vital to the functioning of the economy and society.

I wouldn't bold your definitions. Unnecessary and not a regular practice.

"Fixed that slight formatting error, unintended."

OOC:

OOC: There's a couple of grammar notes here from me while I mull over the overarching resolution.

1. "vital to the functioning of the economy and society"-->"vital to economic and societal functions".

2. "criminalises" in clause 2 should be "criminalise".

3. Probably just a me thing but I prefer the Oxford comma after "techniques" in clause 3(i).

4. Is "penetration testing" a singular noun or a collective one? If the former, drop the s from "permissions" in (6).

Will edit these grammatical errors.

OOC:

A few content notes:

1. I would remove "for the sake of personal profits" from your definition of "cybercriminals" in 1(c), I think that makes the definition of "cybercriminals" unnecessarily narrow. For instance, and you can correct me if I'm wrong, wouldn't a DDOS attack have precisely the opposite effect in reducing/eliminating the ability to make profits.

I am thinking of a differentiation between state-backed actors and random groups of cybercriminals outside with that definition. Guess we could make both fall under this resolution, and therefore, unintentionally manage cyberwarfare too (?). Anyways, on your example, a DDOS attack is indeed reducing ability to make profits for the party being targetted, but for the party doing the attack, it does result in profits, economically or whatever (eg. Company A hires mercs to DDOS attack Company B, and pays the mercs for the attack)

2. Same for everything after the comma after "purposes" in 1(d). This also feels unnecessarily restrictive.

That, I can get around with.

3. For clause 3, I'd say pick a system of listing. Either use the (i), (ii), (iii) system you establish in this clause or the (a), (b), (c) system you use in clause 1. Either is acceptable, and while it my be nitpicky, both are not.

Must be me having a brainfart, will fix.

4. Just to strengthen the resolution, I would actually make (4) a requirement rather than simply a request.

Agreeable point

[Barfleur]

"I am broadly supportive of the proposal, with some advice. In clause 4(iv), or clause 4(d), the proposal makes reference to 'cross-border cybercriminals.' What are those? Are they cybercriminals who launch cyberattacks from one nation affecting another nation, or does it just mean cybercriminals who physically travel between nations and commit their crimes in different places? And in clause 4(v)/4(e), I think 'cyber hygiene' ought to either be defined or explained in text. Other than that, you have my support."

[SherpDaWerp]

Critical infrastructure as systems and structures, physical or technological, which are vital to the functioning of the economy and society.

Is a local medical clinic considered "vital to the functioning of society", and if not, why do you deem it acceptable to cyberattack any medical facilities? Furthermore, member states are not required to criminalise cyberattacks on non-"critical" infrastructure, so why do you deem it acceptable to cyberattack, say, a local newsagent? Or any small, non-critical business, for that matter.

A cyberattack as an offensive action targetting computer networks and infrastructure for the purpose of causing disruption or destruction of services, and/or divulgence or theft of sensitive information.

If I hit a server with a baseball bat, that is an "offensive action". Does this proposal intend to regulate physical attacks on computer infrastructure?

Broadly, it would have been nice to cooperate on our proposals, rather than ending up where we have now.

[Potted Plants United]

OOC: "Computer infrastructure" to me reads as physical computers, landlines and modems. "Technological" does not automatically make that include programs and databases and such. Maybe "intangible contents" instead? Though why are you limiting this to computers? Smartphones, tablets, and pretty much anything programmable should be included if possible.

The exception for penetration testing should just exclude it from being part of the cyberattack definition, rather than make it not criminal. And the bit about profit should be removed. Many cyberattacks are simply out of malice or for benefits other than profit (shutting up political opposition for example).

[Makko Oko]

We here in the Ministry Of Diplomatic Affairs feel that this resolution is very well needed and support its passing 100%. We do have some feedback we'd like to voice to the Ambassador however.

2. Mandates that member states criminalises cyberattacks, or attempts to conduct cyberattacks, on critical infrastructures.

For this, it feels somewhat redundant in our personal view as wouldn't it just be an international crime under this resolution? Why do you see the need to criminalize it via the states as well, creating more paperwork for bodies such as ours. We think that if something is designated as an international crime by the WA, then it is by part, a crime in each WA member state.

6. Declares that penetration testing, with explicit permissions granted by the owner of the said infrastructure, should not be considered a criminal offence.

Furthermore, we do feel that this clause could be better defined. For purposes such as government-sanctioned or for penetration testing on government infrastructure, there needs to be security protocols in place. We could also optionally ban penetration testing on government infrastructure and criminalize it, however, we personally as the IT hub of the world, feel that this would carry negative consequences.

[PotatoFarmers]

"We have updated this with a new draft and are happy to take further comments and questions."

[Separatist Peoples]

"This currently seems to ban the use of targeted EW systems against military air defense targets, given the functionally indispensable nature of defense systems to society. Even taken strictly, it seems to prevent suppression of communication systems. In a more concerning comment, this draft appears to prevent targeted denial of access to bnaking information, a method of attack that would be essential to limited sanctions and strikes against, say, an elite, ultrawealtht oligarchy running a state during an illegal occupation of a smaller neighbor. Banking systems are certainly critical infrastructure in modern society, after all."

[Fachumonn]

OOC: Support.

[PotatoFarmers]

"This currently seems to ban the use of targeted EW systems against military air defense targets, given the functionally indispensable nature of defense systems to society. Even taken strictly, it seems to prevent suppression of communication systems. In a more concerning comment, this draft appears to prevent targeted denial of access to bnaking information, a method of attack that would be essential to limited sanctions and strikes against, say, an elite, ultrawealtht oligarchy running a state during an illegal occupation of a smaller neighbor. Banking systems are certainly critical infrastructure in modern society, after all."

OOC: The first one may be easy once I figure out what is the best way to remove cyberattacks on military assets from the regulations. Which, I will leave to a separate resolution (I know Sherp has his one which attempts to regulate EW) to handle. For the second one...it is tricky, no? If you DOS a banking service, you technically affect civilians' ability to access banking services, and do we really want that?

[Lile Ulie Islands]

"On behalf of the Lile Ulie Islands, we support this legislation and hope to see it passed. Good luck on your bill-writing journey and if you need any help, don't hesitate to reach out."

- Nancy Kai
WA Ambassador

[Separatist Peoples]

"This currently seems to ban the use of targeted EW systems against military air defense targets, given the functionally indispensable nature of defense systems to society. Even taken strictly, it seems to prevent suppression of communication systems. In a more concerning comment, this draft appears to prevent targeted denial of access to bnaking information, a method of attack that would be essential to limited sanctions and strikes against, say, an elite, ultrawealtht oligarchy running a state during an illegal occupation of a smaller neighbor. Banking systems are certainly critical infrastructure in modern society, after all."

OOC: The first one may be easy once I figure out what is the best way to remove cyberattacks on military assets from the regulations. Which, I will leave to a separate resolution (I know Sherp has his one which attempts to regulate EW) to handle. For the second one...it is tricky, no? If you DOS a banking service, you technically affect civilians' ability to access banking services, and do we really want that?

Ooc: mine was an IC post but I suppose we can go OOC.

Cyberattacks on banks may be an effective alternative to combat. Seems to me to be a preferable outcome to dropping bombs.

[Fachumonn]

"On behalf of the Lile Ulie Islands, we support this legislation and hope to see it passed. Good luck on your bill-writing journey and if you need any help, don't hesitate to reach out."

- Nancy Kai
WA Ambassador

"Not that anyone would want to consult you, anyways."

[Separatist Peoples]

"On behalf of the Lile Ulie Islands, we support this legislation and hope to see it passed. Good luck on your bill-writing journey and if you need any help, don't hesitate to reach out."

- Nancy Kai
WA Ambassador

"Not that anyone would want to consult you, anyways."

Ooc: Can we not?

[PotatoFarmers]

OOC: The first one may be easy once I figure out what is the best way to remove cyberattacks on military assets from the regulations. Which, I will leave to a separate resolution (I know Sherp has his one which attempts to regulate EW) to handle. For the second one...it is tricky, no? If you DOS a banking service, you technically affect civilians' ability to access banking services, and do we really want that?

Ooc: mine was an IC post but I suppose we can go OOC.

Cyberattacks on banks may be an effective alternative to combat. Seems to me to be a preferable outcome to dropping bombs.

OOC: I tend to switch to OOC when I am breaking the fourth wall to avoid confusion, especially in the WA where the fourth wall is a good reference for things.

It's a tricky one, no? Unless I refer to the same rules like in warfare and use the same definition for civilian critical infrastructure, in which case, is banking systems considered?

[Separatist Peoples]

Ooc: mine was an IC post but I suppose we can go OOC.

Cyberattacks on banks may be an effective alternative to combat. Seems to me to be a preferable outcome to dropping bombs.

OOC: I tend to switch to OOC when I am breaking the fourth wall to avoid confusion, especially in the WA where the fourth wall is a good reference for things.

It's a tricky one, no? Unless I refer to the same rules like in warfare and use the same definition for civilian critical infrastructure, in which case, is banking systems considered?

Ooc: none of this particularly needs to break the fourth wall.

[PotatoFarmers]

"Bump. Not sure if changing the definition of the critical infrastructure this way addresses the concerns you all have."

[PotatoFarmers]

"Calling for more feedback before we submit this for voting."

[Tinhampton]

Recognising previous efforts to regulate against cyberattacks, as see in GA#100 and GA#360,

As seen.

Requires that member states establish a cybersecurity agency in their country, which does the following:

"...in their country, which shall:"? (Avoids the pernickety/inconsistent tenses in the list that follows.)

[West Barack and East Obama]

Dr Justin Obama, Deputy Minister of Foreign Affairs: Why mandate an agency be created? Why not just mandate that the measures happen?

[The Orwell Society]

No opposition in principle.

[PotatoFarmers]

Recognising previous efforts to regulate against cyberattacks, as see in GA#100 and GA#360,

As seen.

Requires that member states establish a cybersecurity agency in their country, which does the following:

"...in their country, which shall:"? (Avoids the pernickety/inconsistent tenses in the list that follows.)

"Yeah I definitely was napping when writing that. Noted."

Dr Justin Obama, Deputy Minister of Foreign Affairs: Why mandate an agency be created? Why not just mandate that the measures happen?

"Personal preference. This board can also be used for future legislation on cyberattacks as a form of non-kinetic warfare, as well as other areas not covered by this base legislation."