Microsoft president calls for digital Geneva convention
The US and other countries must draw up a digital equivalent to the Geneva convention to protect civilians and companies from cyber warfare, Microsoft President Brad Smith said at the RSA conference in San Francisco. Citing the reported success of a 2015 pledge not to conduct or encourage cyber espionage signed by China and the US, Smith added that international diplomacy is needed to manage the negative effects of cyber attacks linked with military or intelligence agencies. Also at RSA, Chair of the House Homeland Security Committee Michael McCaul concurred that cyber warfare requires "clear rules of the road".

“Nation-state hacking has evolved into attacks on civilians in times of peace,” said Smith at the RSA Conference in San Francisco, echoing the language of the Geneva Convention. “We need to call on the world’s governments to come together [as] they came together in 1949 in Switzerland.” Smith, who is also Microsoft's chief legal officer, has recently lobbied for legal reforms to update privacy and security protections for the Internet era (see "Microsoft's Top Lawyer Becomes a Civil Rights Campaigner").

Smith listed six requirements such an agreement might lay on countries, for example not to target private companies or critical infrastructure with digital campaigns.

He said the 2014 attack that crippled Sony Pictures—an attack the U.S. blamed on North Korea—was an example of the kind of event that shows the need for international agreement on hacking. North Korea is believed to have targeted Sony because of its displeasure with the movie The Interview, which satirized its leader, Kim Jong-Un.

Smith cited a 2015 agreement signed by China and the U.S. pledging not to conduct or encourage corporate cyberespionage as evidence that international diplomacy can rein in what happens in cyberspace. Security experts and the U.S. government had complained for years that China’s military helped steal corporate secrets. China has always denied such claims, but U.S. officials and security companies say the incidence of attacks from the country has dropped (although some experts remain skeptical of the cause). The G20 later signed a similar compact.

Smith’s sentiments about the importance of diplomacy in tackling what is often seen as a technical problem were echoed Tuesday by Michael McCaul, chair of the House Homeland Security Committee.

Countries would always differ in their attitudes on privacy and security, but coördination is necessary to prevent cyberattacks causing serious harm, said McCaul, also speaking at RSA. “The U.S. should be engaging with overseas partners,” he said. “We must develop clear rules of the road when it comes to cyberwarfare.”

McCaul cited evidence that Russia had used hacking to try to influence the U.S. presidential election as an example of the consequences of loose policies on cyberattacks. Russian-backed hackers have also been accused of taking down power grids in Ukraine last year.

Mikko Hypponen, chief security officer with F-Secure, and who has helped chart the rise of government malware, told MIT Technology Review that the idea of something like a digital Geneva Convention is plausible. But despite rating the U.S.-China agreement as a success, he’s skeptical that anything like it will come anytime soon.

Hypponen recommends looking to a different period in history as a model for how the next few years of the cyberwar era will play out. “This arms race is in the early days,” he says, because nations still sense they have much to gain over competitors by aggressively expanding digital espionage and attack capabilities. “I believe we will get to disarmament and control in the end as we did with nuclear weapons, but it’ll take a while.”