Diplomacy is needed to manage governance and security in cyberspace. Diplomats must better engage with the big technology and internet companies.

Twenty years ago, I wrote a book called The New Diplomacy. In that book I envisaged diplomats liberated from their embassies using sensors and digital technologies to communicate directly with their foreign ministries in truly networked diplomatic services. I got it wrong.

I underestimated diplomats’ aversion to digital technologies. Foreign ministries have, of course, accepted digital technologies for communication. Foreign ministry and embassy webpages abound, although they are often badly managed and not kept up to date. But it says much about “digital diplomacy,” and the associated academic literature, that it is predominantly conceived of as the use of social media platforms in public diplomacy. As the old joke has it, the ambassador is on Facebook, the first secretary prefers LinkedIn, while the third secretary tweets.

In my experience, few diplomats understand the algorithms underlying social media platforms and search engines or what they mean for a social media-based public diplomacy. The COVID-19 pandemic did force diplomats more onto digital platforms, with a slew of international meetings, including the UN Security Council and General Assembly, being held online. Diplomats complained about the lack of personal contact and the difficulties of contact networking online (apparently unaware that people now use online dating services to find life partners – do we need a Tinder for diplomats?). As the COVID-19 restrictions diminish, some have spoken of a new hybrid diplomacy mixing the face-to-face with the online. I see diplomats desperate to get back to “normal.”

Diplomacy and Technology along Three Axes

Diplomacy engages with digital technologies along three axes: agency, process, and subject matter. Agency explores the different actors in international affairs and how that is changed by digital technologies – who are the diplomats? Process looks at how diplomats are able to use digital technologies to better fulfil their roles. Subject matter considers how the art and skills of diplomacy can be applied to the international problems being generated by digital technologies.

There is already an extensive literature on how diplomats use digital technologies, even if much of it is unedifying through its excessive focus on social media. Agency could explore the automation of diplomatic functions through deep learning and other AI developments. Some diplomatic functions, such as applications for passports, visas, and other documentation, have already been automated. But to what extent could we envisage AI-driven autonomous diplomatic systems analogous to the lethal autonomous weapons systems being developed by the military? This remains at the highly speculative stage with no danger for the job security of current diplomats. More relevant in the short term is how the development of digital technologies, including AI, is generating a series of powerful international actors in the form of the major internet and technology companies.

Diplomacy and diplomats came late to cyberspace and digital technologies. There was an initial assumption that because the Internet depended on digital technologies and was created by engineers and technicians, its problems would be essentially technical and could be left to the techies. In fact, the main international problems generated by cyberspace are political and geopolitical, whether in internet governance or cybersecurity. Issues like protection of data, privacy, or harmful content are not susceptible to technical solutions, as social media platforms like Facebook have discovered. Cybersecurity threats may require a level of technical defence, but technical measures alone are no more sufficient for global cybersecurity than military measures alone are sufficient for global physical security.

Just as soldiers need diplomats to negotiate the international rules of the game for physical security, and, if possible, protect it without recourse to military means, so technicians need diplomats to negotiate the geopolitical rules of the game in cyberspace. At the end of the First World War, French Prime Minister Georges Clemenceau commented that war was too important to leave to soldiers. Cyberspace is too important to leave to techies.

Norms and Rules in Cyberspace

Nor is it good enough, as some countries have done, simply to assert that international law or the Law of Armed Combat (LOAC) apply in cyberspace. Presumably we would want to affirm that international law applies, in principle, in all domains. But we need to explain what that means. There are significant differences between physical and cyberspace, and some terms may have different meanings or even not apply. Given the ambiguity of coding, which incidentally reinforces the need for diplomats “on the ground” to interpret the intentions of their host governments, negotiations about arms control may make little sense in cyberspace. More relevant may be to focus on targets rather than weapons, limiting, for example, attacks on critical civilian infrastructure.

Cyberspace also throws up different problems than physical space. Attribution, which is rarely a serious problem in physical space, becomes a complicated and time-consuming process in cyberspace. Deciding on a proportionate response to a cyberattack involves not only considerations of outcomes and impacts but also whether you can respond to a cyberattack with an attack in physical space. Should what starts in cyber necessarily stay in cyber? NATO doctrine says no. The international law approach also overlooks the fact that much behaviour in international security is governed not by formal laws but by informal rules of the game. Espionage in physical space has thus always been governed by certain unwritten (and often unspoken) rules tacitly acknowledged by governments and intelligence services. At the moment, no such “rules of the game” seem to apply to cyberespionage, which can only increase the risk of international tensions and misunderstandings.

The Diplomacy of Cyberspace

The diplomacy of cyberspace must adapt traditional diplomatic arts to the dynamic international environment of the 21^st century. It must understand that top-down imposition of norms by international conferences is no longer possible or relevant. Reaching international agreements in the 21^st century involves a painful and painstaking process of bottom-up diplomacy. Diplomats will not only negotiate with other governments but must engage with a broad range of state and non-state actors, including technology and internet companies and user groups. State and non-state actors cannot be excluded because they do not share our values or ideology – excluding major cyber powers on ideological grounds automatically renders any cyber norms agreed irrelevant. Effective cyberdiplomacy will identify the shared interests or preferred outcomes of other actors and use them to build coalitions. Progressive agreements may be recorded on blockchain technologies. The major internet and technology companies will become geopolitical actors in their own right. They already behave like them, more powerful and wealthier than most states, issuing their own currencies and interfering in war zones. Technology itself is becoming a battleground for geopolitical rivalries (with significant risks of new technologies fragmenting into incompatible variants – look out for the battles over 6G mobile networks). Effective diplomatic engagement with these companies will be as important as relations with other states: a multistakeholder diplomacy built on interests and not values. And then there is the Metaverse…

Shaun Riordan is Director of the Chair for Diplomacy and Cyberspace at the European Institute of International Studies. A former British diplomat, he is the author of The New Diplomacy (2003), The Geopolitics of Cyberspace: A Diplomatic Perspective (2018), and Cybersecurity: Managing Security and Governance Online (2019).

This article is published under a Creative Commons Licence and may be republished with attribution.