SPEECH: THE CHALLENGE FOR DEMOCRACY: A NEW APPROACH TO TECHNOLOGY POLICY
17/11/2021
SPEECH TO AISA CYBER CONFERENCE 2021 -
THE CHALLENGE FOR DEMOCRACY: A NEW APPROACH TO TECHNOLOGY POLICY
MELBOURNE
WEDNESDAY, 17 NOVEMBER 2021
***CHECK AGAINST DELIVERY***
I acknowledge the Wurundjeri Woi Wurrung people as the traditional owners of the lands that I am joining you from today, and pay my respects to their elders, past present and emerging.
It's great to be back at another AISA Cyber Conference.
It's been a massive year for everyone in infosec - here and around the world.
An epidemic of ransomware attacks against targets ranging from local small businesses to major critical infrastructure owners, a new wave of supply chain attacks targeting service providers and cyber security companies being mounted by APTs and criminal groups alike, as well as a series of incidents across the Middle East that's seen petrol stations, train networks and ports shut down and prison surveillance networks popped.
There's been a bit going on.
So a shout out to the incident responders, I know it's been a slog out there in the trenches!
Given all this, it's no wonder that infosec issues have hit the top of the agendas of meetings of international leaders this year.
In this context, I want to talk to you today about the evolving relationship between democracy, autocracy and technology policy we are seeing around the world - and what we should be doing about it here in Australia.
In his first press conference as US President, Joe Biden declared that the world is in the midst of "a battle between the utility of democracies in the 21st century and autocracies" and that the current generation of democratic leaders must "prove democracy works."
This wasn't just a throwaway line - the contest between democratic and autocratic values was a consistent theme of his campaign for the Presidency.
President Biden wasn't talking about the kind of great power conflicts of the 20th century in which some states sought to impose an ideology or system of government on other nations.
Instead, he was talking about a contest between democrats and a new breed of autocrats - leaders and citizens alike - whose individual decisions are shaping the way societies around the world operate.
A contest that is as much within nations as between them.
A contest between a democratic model whose institutions and norms were largely developed in the 19th century, and a new model of authoritarianism utilising technologies developed in the 21st century to exercise control over their societies.
A contest between those who believe that democracies - while often messier and more frustrating - can still deliver the best opportunity for human flourishing in the long-term, and those turning to simpler, more immediate authoritarian responses to governing.
President Biden wants democrats around the world to be up for this contest and next month he will bring together the world's democracies - including Australia - in a "Summit for Democracy" to "renew the spirit and shared purpose of the nations of the free world", and to "strengthen our democratic institutions, honestly confront nations that are backsliding, and forge a common agenda".
There is nowhere that a renewed agenda to strengthen democracy is needed more than in the way democratic governments around the world engage with the internet and technology policy.
The contest between democratic and authoritarian values is now utterly pervasive in the technology sector.
Where globally integrated technology supply chains and transnational social media platforms once brought people and organisations from around the world together, today these sites of cross border interaction are the front lines of a contest of values marked by decoupling and balkanisation.
We see this trend most clearly in autocratic states.
Over the past 20 years authoritarian nations have developed a coherent philosophy of state control over the internet - 'internet sovereignty' - and have been both implementing it domestically and expanding its influence within international internet governance forums.
While in 2000, President Clinton jokingly wished authoritarian nations 'good luck' in their attempts to control the internet and likened the exercise to 'nailing jello to the wall', over the past 20 years authoritarian nations have shown how state control of underlying infrastructure, data localisation requirements on over-the-top providers and aggressive promotion of domestic technology champions can effectively impose autocratic values on the technologies their people use.
Authoritarian states have leveraged state power throughout the technology stack to implement pervasive surveillance and information control strategies - a combination of censorship and propaganda - to entrench their power.
Take just a few examples from this year.
Russia has gone so far as to build its own national DNS and trial disconnecting 'RUnet' from the global internet altogether, routing all traffic solely through government-controlled infrastructure.
It also set about exercising total control over the services operating on this infrastructure by threatening specific local staff of Apple and Google with arrest if they did not remove a mobile app developed by jailed opposition leader Alexei Navalny from their app stores.
China's recently released 14th five-year plan declared its intention to deepen state control over the data of private sector technology firms.
As a measure of the state's seriousness in this exercise, in the first six months of this year a series of interventions by Chinese regulators wiped out more than $800 billion in market value from companies like Didi, Ant, Alibaba, Tencent, Bytedance and Baidu.
Most recently, the Cyberspace Administration of China has imposed a series of regulations on technology companies, requiring them to 'promote socialist core values' in 'internet information service algorithm recommendation activities'.
In response to these interventions, Yahoo, Linkedin and Epic games became the latest US tech companies to exit the country.
As a result, while the underlying protocols of the internet remain interoperable around the world - for now - a series of parallel national technology ecosystems have been emerging.
While 20 years ago, the experience of using the internet in Sydney, St Petersburg, and Shanghai was broadly similar, over the last 20 years parallel internet infrastructures and app ecosystems have emerged around the world, each governed by the differing values of the nations within which the user resides.
We shouldn't exaggerate.
Some parts of the technology stack have so far proved too resource intensive to duplicate.
For example, we're years of heavy investment away from new operating systems reaching a level of maturity needed to reliably and securely support a national technology ecosystem.
But the trend is clear: the digital global village is being divided and enclosed.
In barely a decade, we've moved a long way from what then Secretary of State Hillary Clinton once championed as the ideal of "one internet, one global community, and a common body of knowledge that benefits and unites us all" in a landmark 2010 speech on internet freedom.
While it's tempting to reach for a hackneyed metaphor at this point and declare that a silicon curtain has descended across the internet, the reality is complicated by a similar trend that has emerged within democratic states.
In parallel to the increasing exercise of state power over the internet in authoritarian countries, the vision of an internet free from government intervention and control championed by its early trailblazers in the United States has also reached the end of its useful life in democratic states.
John Perry Barlow's 1991 "Declaration of the Independence of Cyberspace", famously declared to the "Governments of the Industrial World" that
"You are not welcome among us. You have no sovereignty where we gather.... the global social space we are building (is) naturally independent of the tyrannies you seek to impose on us. You have no moral right to rule us nor do you possess any methods of enforcement we have true reason to fear."
But in the two decades since, it's become increasingly clear that these cyberpunk, libertarian values don't have much of a constituency in 21st century democratic nations.
We've seen a cyber space without democratic government and it's a dark place.
No voting public will tolerate an online space where paedophiles, terrorists and Nazis are given free reign and ransomware crews are allowed to menace schools, hospitals and critical infrastructure with impunity.
Responding to these public sentiments, democratic governments around the world have increasingly sought to expand state powers cyberspace in response to legitimate online threats like child abuse, terrorism, hate speech, foreign interference, cybersecurity and copyright infringement.
The trend has been gathering pace in the last 12 months.
Australia, the UK and Canada have all either passed or are debating the passage of online safety bills regulating harmful content online.
India's new internet i
