Laws and regulations governing cybersecurity

“A consensual hallucination experienced daily by billions of legitimate operators, in every nation, by children being taught mathematical concepts... A graphic representation of data abstracted from banks of every computer in the human system. Unthinkable complexity. Lines of light ranged in the nonspace of the mind, clusters and constellations of data. Like city lights, receding...“

William Gibson: Neuromancer (1984)

Cyberspace is a metaphorical sandbox where we move, but it is also a key element in the definition of cybersecurity. In order to be able to define cyberspace, it is essential to define the concept of the Internet, which pertains directly to it.

The global beginnings of the Internet, which is a necessary material foundation of cyberspace, date back to the 1950s. At that time, networks of interconnected computers were built and tested, primarily for scientific research and military purposes. Although the Internet was built on the foundations of the ARPANET and NSFNET[1] networks, no one currently owns the Internet, and there is no central authority or institution to manage it. “Nevertheless, there are institutions that play a significant role in the operation and further development of the Internet. First, let’s mention the Internet Society (ISOC), which brings together Internet users. ISOC has two main components: the Internet Activities Board (IAB) and the Internet Engineering Task Force (IETF). Both of these components work with the most important computer companies to create the standards needed for the further development of the Internet.”[2]

ICANN[3] (Internet Corporation for Assigned Names and Numbers) has a sovereign position within the Internet. The scope of activities of this association includes setting rules for the operation of the domain name system. Nowadays, however, ISPs are gaining more and more prominence, and they are playing a bigger role.[4]

The material foundation of the Internet is its backbone network, which conducts a signal (data) through air, cables or other transmission media. In technical terms, it means the worldwide distributed computer network composed of individual smaller networks that are interconnected using internet protocols (IPs) and thus enable communication, data transfer, information and provision of services between entities. This actually creates a dynamic, ever-changing and evolving system tied to hardware, but at the same time, it creates a hard-to-define and virtually unlimited cyberspace. It can be said that cyberspace is a virtual reality that is effectively boundless. However, this virtual reality is completely dependent on the material foundation, i.e. the technologies found in the real world. This creates an interesting paradox that allows the existence of intangible media (cyberspace) able, due to the distribution of tangible media (network elements, individual computer systems, cloud storage, interconnected services, etc.) to adapt and change in case of damage to material media, but in the event of a complete collapse of material medium (or all its components), irreversible damage or extinction of cyberspace as such will occur.

Cyberspace can also be defined as a space of cybernetic activities, or as a space created by information and communication technologies where a virtual world (or space) parallel to real space is created.

The concept of cyberspace began to become more widely known after the declaration of John Barlow (founder of the Electronic Frontier Foundation): „A Declaration of the Independence of Cyberspace“:

Governments of the Industrial World, you weary giants of flesh and steel, I come from Cyberspace, the new home of Mind. On behalf of the future, I ask you of the past to leave us alone. You are not welcome among us. You have no sovereignty where we gather.

We have no elected government, nor are we likely to have one, so I address you with no greater authority than that with which liberty itself always speaks. I declare the global social space we are building to be naturally independent of the tyrannies you seek to impose on us. You have no moral right to rule us nor do you possess any methods of enforcement we have true reason to fear.

Governments derive their just powers from the consent of the governed. You have neither solicited nor received ours. We did not invite you. You do not know us, nor do you know our world. Cyberspace does not lie within your borders. Do not think that you can build it, as though it were a public construction project. You cannot. It is an act of nature and it grows itself through our collective actions.

You have not engaged in our great and gathering conversation, nor did you create the wealth of our marketplaces. You do not know our culture, our ethics, or the unwritten codes that already provide our society more order than could be obtained by any of your impositions.

You claim there are problems among us that you need to solve. You use this claim as an excuse to invade our precincts. Many of these problems don't exist. Where there are real conflicts, where there are wrongs, we will identify them and address them by our means. We are forming our own Social Contract. This governance will arise according to the conditions of our world, not yours. Our world is different.

Cyberspace consists of transactions, relationships, and thought itself, arrayed like a standing wave in the web of our communications. Ours is a world that is both everywhere and nowhere, but it is not where bodies live.

We are creating a world that all may enter without privilege or prejudice accorded by race, economic power, military force, or station of birth.

We are creating a world where anyone, anywhere may express his or her beliefs, no matter how singular, without fear of being coerced into silence or conformity.

Your legal concepts of property, expression, identity, movement, and context do not apply to us. They are all based on matter, and there is no matter here.

Our identities have no bodies, so, unlike you, we cannot obtain order by physical coercion. We believe that from ethics, enlightened self-interest, and the commonweal, our governance will emerge. Our identities may be distributed across many of your jurisdictions. The only law that all our constituent cultures would generally recognize is the Golden Rule. We hope we will be able to build our particular solutions on that basis. But we cannot accept the solutions you are attempting to impose.

In the United States, you have today created a law, the Telecommunications Reform Act, which repudiates your own Constitution and insults the dreams of Jefferson, Washington, Mill, Madison, DeToqueville, and Brandeis. These dreams must now be born anew in us.

You are terrified of your own children, since they are natives in a world where you will always be immigrants. Because you fear them, you entrust your bureaucracies with the parental responsibilities you are too cowardly to confront yourselves. In our world, all the sentiments and expressions of humanity, from the debasing to the angelic, are parts of a seamless whole, the global conversation of bits. We cannot separate the air that chokes from the air upon which wings beat.

In China, Germany, France, Russia, Singapore, Italy and the United States, you are trying to ward off the virus of liberty by erecting guard posts at the frontiers of Cyberspace. These may keep out the contagion for a small time, but they will not work in a world that will soon be blanketed in bit-bearing media.

Your increasingly obsolete information industries would perpetuate themselves by proposing laws, in America and elsewhere, that claim to own speech itself throughout the world. These laws would declare ideas to be another industrial product, no more noble than pig iron. In our world, whatever the human mind may create can be reproduced and distributed infinitely at no cost. The global conveyance of thought no longer requires your factories to accomplish.

These increasingly hostile and colonial measures place us in the same position as those previous lovers of freedom and self-determination who had to reject the authorities of distant, uninformed powers. We must declare our virtual selves immune to your sovereignty, even as we continue to consent to your rule over our bodies. We will spread ourselves across the Planet so that no one can arrest our thoughts.

We will create a civilization of the Mind in Cyberspace. May it be more humane and fair than the world your governments have made before.

Davos, Switzerland
February 8, 1996[5]

Even almost twenty years after the publication of this declaration, its text remains undeniably relevant. Today’s society is trying to respond to the huge expansion of information and communication technologies, their intertwining and interconnection, the emergence of new trends, etc. However, this reaction is often primarily based on enforcement and restriction, rather than understanding and educating users.

Cyberspace, in contrast to the real world, is very specific, and it is certainly wrong to assume that the same rules will work in it as “offline”. In general, it can be stated that standard criteria can be applied to cyberspace, and they are valid in relation to the actual physical location of data or information. The second possibility is the creation of new criteria for the application of the principle of local jurisdiction. (This is a virtual localisation of legal relations.)[6]

It is characteristic of cyberspace that a large part of society is connected to it (the estimated involvement of around 3.6 billion people from a global population of around 7.4 billion people).[7] At the same time, it must be stated that the mass involvement of society began only about 15–20 years ago.

Features of cyberspace include its decentralisation, globality, openness, richness of information (including information in the form of “information smog”, utter nonsense, half-truths and lies), interactivity and the ability to influence opinions through users (avatars[8]). The essential character of cyberspace is that technology and related services play a primary role in it. Recently, it has become increasingly clear that the manifestation of the virtual world can and does have implications in the real world.

The speed and especially the availability of transmitted data is becoming a key element of today. As a rule, users do not want or do not try to find out where and how the data they entered into information networks are transmitted. They are also not interested in where the recipient of the transmitted data is located or where the data are retained, thus content is dematerialised from the physical structure of information networks.

On the one hand, it is possible to observe a situation where social relations are delocalised in cyberspace[9], which entails problems in terms of law enforcement, but on the other hand, this delocalisation allows users to communicate, send, store and change data freely (and without restrictions in the form of borders).

Features of cyberspace include its decentralisation, globality, openness, richness of information, interactivity and the ability to influence opinions through a user. An essential attribute of cyberspace is that technology and related services play a primary role in it. Recently, it has become increasingly clear that the manifestation of the virtual world can and does have implications in the real world.

As for a legal definition of cyberspace, it is possible to use, for example, the wording of Section 2 (a) of Act No. 181/2014 Coll., on Cybersecurity[10], where it is stated that “cyberspace is a digital environment enabling the creation, processing and exchange of information, consisting of information systems, and electronic communications services and networks.”

In our opinion, one of the more effective definitions of cyberspace is in Cyberspace Operations: Concept Capability Plan 2016–2028, which defines cyberspace as a space composed of three layers:[11]

1.     physical,

2.     logical and

3.     social.

These layers then consist of a total of five components.

Ad 1) Physical layer

This layer includes the term “geographic component” and the term physical network components. The term “geographic component” means the exact location of network elements in the physical world. The term physical network components includes the infrastructure in the form of cables, network control elements (switch, router) and other devices.

This division of the physical layer has its own logic. While geopolitical borders between states can be easily crossed in cyberspace, in the real world there are still limitations that stem from the nature of our physical world.

Translating this idea into a world of cyberattacks and incidents means that, as an attacker, I can damage a physical layer element either remotely, for example, by knowing its specific vulnerability that can be remotely attacked, or I can damage it directly in the real world if I can get to it physically and attack it, for example, using physical force. The impact in cyberspace will be the same, but the execution of the attack itself is quite different.

Ad 2) Logical layer

This layer contains logical network components, which means logical connections between network nodes. These are implemented via network communication protocols. Nodes can be computers, telephones and other network devices.

Ad 3) Social layer

This layer consists of components called “cyber personality” and personality.

The “cyber personality” component includes the identification of a person on the network, such as email address, IP address, telephone number and more. The personality component consists of real people connected to the network. One individual can then have multiple “cyber personalities”, such as different emails on different devices, and one “cyber personality” can actually be multiple different real people, using, for example, a single shared account.

Cyberspace can also be defined according to the availability and traceability of data for an average user. According to this division, cyberspace can be divided into services and data available via the Internet, services and data available only within specific networks and devices, and services and data intentionally hidden and accessible using special tools.

Typically, the following names are used for these categories:

1.     Surface Web,

2.     Deep Web and

3.     Dark Web.

The Deep and Dark Web are also collectively referred to as D4rkN3ts – Darknets. All these components together create the real cyberspace.[12]

Unfortunately, the terminology where the term web is used to divide cyberspace has been influenced by the fact that the following simple equation holds true for most of the general public:

CYBERSPACE = INTERNET = WEB

However, cyberspace is not just about websites but all the computer systems, services, users and data of this space.