Role of the UN Security Council
The United Nations has sought to define the rules of behavior for cyberspace for nearly two decades. As cyberweapons become more sophisticated and widespread and their use increasingly risks escalation or unintended global consequences, this task has grown more urgent. However, the UN Security Council has yet to specifically address the issue of cybersecurity in a formal setting, though it has addressed the issue in informal discussions and as it relates to broader subjects. As the threat cyberwarfare poses grows more apparent, council members will need to consider what role they can play to prevent or respond to cyber clashes to maintain international peace and security.
Furthermore, although the dispute at hand is primarily between the United States and China, its roots in the ongoing territorial disputes in the South China Sea give it far-reaching implications. Several other countries involved in maritime disputes with China—including Brunei, Japan, Malaysia, the Philippines, Taiwan, and Vietnam—will have an interest in how the Security Council can manage or resolve the dispute and the broader issue of cyber behavior. Japan, the Philippines, Taiwan, and Vietnam have also been targets of Chinese cyberattacks. Moreover, the United Nations has yet to successfully deescalate disputes in the South China Sea. This impacts countries’ access to fishing rights, oil exploration, and shipping lanes. To date, the UN Permanent Court of Arbitration has primarily addressed territorial claims. The court has dismissed China’s claims of its “historic title” in the South China Sea in a case brought by the Philippines and other countries in 2016. However, China has so far ignored its rulings. The Security Council could offer an avenue to more robust action or more fruitful negotiations.
Securing any council action in the dispute is likely to be difficult. Given that both parties to this dispute, the United States and China, are veto-bearing permanent members of the Security Council, the council’s influence in this matter is likely to be modest. Both countries will be able to block any action they perceive as against their interests. Therefore, policy options that criticize or impose penalties on either party, including sanctions, are likely to be exceedingly difficult for the council to approve. A country could still propose such resolutions in an attempt to embarrass the other side and force it to use its veto. Security Council members will need to explore what action is possible given the likelihood of a U.S. or Chinese veto and how to negotiate the support of permanent members. Members could explore actions that could prevent the crisis from escalating, even if the Security Council cannot impose a comprehensive resolution. Some members could also use this occasion to advance broader norms of behavior in cyberspace. In general, member states will need to weigh the desire for a timely response to a crisis against the need to secure support from as many council members as possible, especially permanent members.
The principal policy options available in this case are discussed below. These responses are available individually, in combination, or all together.
Policy Options
Call on the United States and China to negotiate
Council members could adopt a resolution calling on the United States and China to enter negotiations over their behavior in the South China Sea and in cyberspace. Negotiations could occur through the offices of the secretary-general or another respected authority. This option would be the easiest to implement. It bears the least risk of drawing a U.S. or Chinese veto. Negotiations could steer the current clash away from escalation. They could also facilitate a broader discussion of both countries’ practices in cyberspace. However, it is also the least likely to have lasting effects. The United States and China could be reluctant to accept the outcome of any international arbitration. Indeed, Beijing has ignored prior rulings by the International Court of Justice regarding the South China Sea. In addition, this option does nothing to address the establishment of broader norms in cyberspace.
Manage the dispute within the UN Security Council
The Security Council could attempt to address the dispute using its own powers. This option could include several actions. The council could commission a report on how the dispute has been managed with recommendations for how to manage the dispute without escalation. Council members could further adopt a resolution prohibiting certain actions, such as military responses or cyberattacks on critical infrastructure, in an attempt to prevent escalation. Finally, Security Council members could propose sanctions on one or both parties as punishment for their actions and as a deterrent to escalation.
Defining what actions are appropriate in the current conflict could prevent escalation and also set a precedent for the negotiation of future cyber norms. However, commissioning a report and recommendations would take significant time. Securing the consent of both the United States and China to place limitations on either country’s actions would be difficult. Imposing any form of sanctions is likely impossible. Council members pursuing this option will need to consider what actions are most likely to allow consensus and whether proposing actions that will force a veto is worthwhile as a tactic to shame one or both parties.
Use the dispute to establish broader cyber norms
The Security Council could use this dispute as an opportunity to debate norms of conduct in cyberspace more broadly. This could include questions regarding what types of targets are appropriate and whether and when kinetic military measures (i.e., those against physical targets) are justified in response to cyberattacks. Given the binding nature of UN Security Council resolutions, a resolution that establishes a strong standard of conduct in cyberspace provides the council with an avenue to deter or punish future attacks. Such a resolution could also establish a committee within the Security Council to address cybersecurity issues as they arise, similar to its counterterrorism committee.
However, reaching consensus on an issue as broad as cyber practices will take time. This could allow the current dispute at hand to potentially escalate unaddressed. Moreover, given that other UN forums on cyber practices have failed to reach consensus, often largely because of the United States, China, and Russia, the Security Council is not guaranteed to prove more effective.
Do Nothing
The Security Council could decide it is unable to take meaningful action on the dispute in light of conflicting interests among council members. In this case, Security Council members could issue a presidential statement expressing concern about the situation but ultimately leave action up to individual countries. If the situation worsens, however, council members could revisit the matter.