U.S.-India cyber agreement puts more pressure on China

The wide-ranging pact deepens the partnership on global cyber and tech issues.

The U.S. and India’s comprehensive agreement this week to work more closely on cybersecurity issues is tacitly aimed in part at pressuring China to abide by international cyberspace norms, a Washington information security expert said.

“There are a few items in the cybersecurity language [in the accord] that seem particularly oriented toward the U.S. getting India, and I assume other Asian countries, to align with the U.S. and against China in ‘cyberspace behavior norms’ — not using the Internet to steal intellectual property, not trying to inhibit computer security incident response teams and so on,” said John Pescatore, director of emerging security trends at the SANS Institute. “Those all translate to [concur] that China’s actions violate agreed-upon norms.”

Adam Segal, the Maurice R. Greenberg senior fellow for China studies and director of the Digital and Cyberspace Policy Program at the Council on Foreign Relations, told us that “in any kind of security cooperation with India these days there is some balancing going on against China.”

He added that “one of the important principles that the Indians agreed to was this commitment to the multi-stakeholder model of Internet governance, which clearly is directed in part against China.”

A commitment to a wide-ranging framework for India-U.S. cooperation on cyber was a key outcome of the bilateral summit Tuesday between President Barack Obama and Prime Minister Narendra Modi of India. The meeting, the third in a series of U.S.-India summits at the White House, marked “the deepening strategic partnership” between the U.S. and India on an assortment of global challenges, according to a joint statement.

The two leaders stressed cyberspace enables economic growth and reaffirmed their commitment to “an open, interoperable and reliable Internet, underpinned by the multi-stakeholder model of Internet governance.” They also committed to enhancing cyber collaboration on critical infrastructure, cybercrime, and malicious activity by state and nonstate actors.

Additionally, Obama and Modi affirmed their commitment to “the voluntary norms” that no country should conduct or knowingly assist online activity that intentionally damages critical infrastructure, prevents responses to security incidents, supports theft of intellectual property and is not consistent with international law, including the United Nations Charter.

Segal noted that the Chinese government has signed off on some of the voluntary norms addressed in the U.S.-India framework. In September 2015, for example, after Chinese President Xi Jinping visited Obama at the White House, China and the U.S. agreed to norms relating to the theft of intellectual property and trade secrets. Prior to this agreement, there had been an increasingly active debate in the U.S. about imposing sanctions against China.

As a result, the U.S.-India cyber framework “is not directed at China in a kind of oppositional way,” Segal said. “It’s more a way of further binding China to those kinds of commitments, I would say.”

Overall, the U.S.-India pact is clearly a positive step, Segal said. “The fact that the two sides can identify a whole set of common principles they can commit to is an important framework for the two sides to work forward,” he said.

Segal cautioned that “we’re going to have to wait for actual implementation to see how closely they cooperate on information sharing, threat sharing and those kinds of things. But I think there’s a lot of enthusiasm for both the government of India and the U.S. government to make cyber an important area of cooperation.”

The framework for the U.S.-India cyber relationship is expected to be signed within 60 days, White House officials said.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Election official says Tina Peters would be consultant, won’t have access to election systems