By Trevor Schmitt

Picture: Globe License: Public Domain

2017 Cybersecurity Statistics

As expected, 2017 brought more cybersecurity incidents than any previous year. Apart from a reduction in the average cost to organizations for each lost or stolen data record (down from $158 in 2016 to $141 in 2017), the social and economic costs of cybersecurity vulnerabilities rose significantly across the board. Here are the numbers:

• In the first half of 2017, over 900 data breaches led to almost 2 billion compromised data files, an increase of 164% from the last six months of 2016. (link)
• By the end of 2017, the Identity Theft Resource Center and CyberScout reported a record year-end high of 1,579 record breaches. This represents an overall increase of 44% from 2016. (link)
• These breaches largely stem from an uptick in cyber-attacks targeting businesses, climbing from 82,000 in 2016 to nearly double that figure at 159,700 in 2017. This increase is, in part, due to the rise of mass ransomware-based attacks. (link)
• In the United States alone, 16.7 million U.S. citizens were subject to identity fraud in 2017, an 8% increase from 2016. (link)
• Worldwide spending on cybersecurity rose 7% to a record setting high of $86.4 billion in 2017 compared to 2016. (link)

Despite the persuasiveness of these statistics, not all cyber-incidents are created equal. In addition to the sheer increase in overall cyber-attacks, 2017 saw some of the most devastating single-origin incidents in terms of both geographic reach and overall costs.

Major Cyber-Attacks

While firms spent massive amounts of resources attempting to reduce their cybersecurity vulnerabilities, cybercriminals spent 2017 finding and refining innovative and powerful ways to extort their victims at scale. The global criminal hacking community (including certain nation-states) used these new methods to carry out last year’s largest breaches. A few examples:

• WannaCry – In May, the WannaCry ransomware infected over 150 countries worldwide. The ransomware, built using leaked U.S. Intelligence spyware, targeted businesses running outdated Windows software. Once the ransomware infected a system, the hackers demanded money, most often in the form of the cryptocurrency, to unlock the system’s files. An estimated 300,000 systems were infected, including hospitals, car companies, and public utilities. In December, U.S. officials placed blame on North Korea for the attack.
• NotPetya – Just a month after WannaCry, in June, a malware dubbed “NotPetya” began infecting businesses across the globe. Though initially targeting Ukrainian businesses, the malware spread to multiple major global business including several advertising, shipping, and energy giants. In early September, Fedex claimed to have faced losses of $300 million as a result of the attack. The U.S. recently announced that it believe Russia was responsible for the attack.
• Equifax – In September, major U.S. credit reporting agency Equifax announced that criminal hackers leveraged vulnerabilities in open source code used by the company to steal information on 145 million U.S. Citizens. Although less globally significant than WannaCry and Notpetya, the Equifax breach is significant because the records involved contained powerfully sensitive information.

In response to a growing number of attacks connected to nation-states, 2017 saw some experts call for an international response to the global cybercrime crisis. Despite important steps forward, efforts largely failed to coordinate agreement on a viable international cyber law regime.

[Inter]National Cyber Law

Hopes were set high for international cooperation following the release of the Tallinn Manual 2.0, in early 2017.  The manual, a collective effort of internationally renowned cybersecurity experts, serves as a cyber resource to international actors. Specifically, the manual addresses the international norms of state-sponsored cyber operations as well as more common cyber incidents.

Despite the early success of the Tallinn Manual 2.0, 2017 ended without international agreement. In Summer 2017, The U.N. sponsored Government Group of Experts (GGE) announced they had failed to reach a consensus on the status of international laws and norms in cyberspace. The announcement marked the unsuccessful end to a nearly seven-year process to write the rules on state activity in cyberspace.

            

Much, if not all, of 2017 is defined by the failure of cybersecurity efforts to fend off malicious attacks by both private and public actors. Without international agreement on a viable legal framework or innovate tech-based solutions, the global population remains vulnerable. But maybe things will get better. After all, there’s always next year.

Read More

March 05, 2018

By Xiaoyi Wang

Image: Porapak Apichodilok License: Creative Common Zero

Background

The Montreal Protocol on Substances that Deplete the Ozone Layer (the Montreal Protocol) celebrated its thirty years on September 16, 2017. The Montreal Protocol is an international treaty designed to protect the ozone layer by phasing out 99 percent of nearly 100 ozone-depleting substances (ODS), including CFCs, HCFCs and halon. As one of the most successful and effective environmental treaties ever negotiated and implemented, the Montreal Protocol has helped reduce the depletion of the ozone layer by about 20 percent from 2005 to 2016. The shrinking of the ozone hole will bring numerous benefits to people’s health (reducing the chance of having skin cancers and eye disorders) and agriculture. It will also help slowdown global climate change and to prevent extreme weather events (hurricanes, floods and droughts). The Montreal Protocol was a “milestone for all people and our planet,” said UN Secretary-General António Guterres.

The treaty has been ratified or accepted by all 197 UN member states. “Thirty years ago the world proved it can come together and tackle a global problem with global resolve,” said Erik Solheim, head of the United Nations Environment Programme (UNEP). The ozone layer is expected to return to 1980 levels between 2045 and 2060 as long as countries continue to meet their obligations.

The Success of the Montreal Protocol

There are a number of multinational treaties dealing with environment issues. Among them, the Montreal Protocol has achieved a great deal of success in atmosphere protection.  The lackluster compliance with the Kyoto Protocol, which was set in place to reduce the emissions of greenhouse gases, as the prominent counter-example. The success of the Montreal Protocol does not come from nowhere.

The Role of the United States

The United States government played an exceedingly aggressive role in producing the Montreal Protocol, which contributes to its success. By the 1980s, the industry within the United States achieved significant progress in producing safe substitutes for CFCs. Not only was the financial obstacle progressively removed, the ongoing disagreement within the Reagan Administration and the U.S. Environmental Protection Agency (EPA) was resolved after a careful cost-benefit analysis from the President’s Council of Economic Advisers, which suggested that the costs of controls would be far lower than anticipated, and the benefits far higher. Considering the benefits to mankind and the cost of reducing CFCs when its substitute was readily available, even unilateral action was well-justified for the United States. “But if the world joined the Montreal Protocol, the benefits for the United States would be nearly tripled, because it would prevent 245 million cancers by 2165 including more than five million cancer deaths,” stated by Scott Barrett in Environment and Statecraft: The Strategy of Environmental Treaty-Making.

Global Participation

To assist developing countries to meet their commitments, the Multilateral Fund (Fund) was established in 1991. To date, the Fund has approved activities including industrial conversion, technical assistance, training and capacity building worth over $3.6 billion. With the financial assistance from the Fund, developing countries largely comply with the Montreal Protocol. Currently, 147 of the 197 parties to the Montreal Protocol meet its criteria.

The other element that encouraged countries to ratify the Montreal Protocol was its trade provisions. The trade provision limits the signatories to trade only with other signatories on CFCs and other ODS. Once the main producing countries signed up to the treaty, it was only a matter of time before all countries joined in the system. 

After over thirty years in picture, the Montreal Protocol still benefits the mankind. The success of the Montreal Protocol provides a workable system when environment protection requires global cooperation. 

Read More

January 24, 2018

By Nico Nalbantian

On September 11^th, 2017, Georgetown University Law Center’s Institute of International Economic Law (IIEL) hosted former Deputy Director of the Central Intelligence Agency David S. Cohen. Cohen discussed Russia, Venezuela and North Korean sanctions in an interview with IIEL Faculty Director Chris Brummer. Described by some in the Obama administration as a “financial Batman”, Cohen focused much of his talk on the evolution of sanctions policy between the Obama and Trump administrations.

The Goal of Sanctions

Cohen began the event by highlighting the purpose of sanctions. Ultimately, sanctions are a diplomatic tool for coercing a country into one of two things: (i) target the behavior of a country and change the targeted behavior, or (ii) disable what that country is doing. The case Cohen shared from the Obama administration was Iran. Iran had been causing global concern due to its alleged nuclear weapons program. The sanctions imposed on Iran were part of a “dual track strategy”. Should Iran continue down its path of nuclear armament, then sanctions would be ratcheted up and cut more deeply into the Iranian economy. Alternatively, should Iran be willing to negotiate and step-away from its nuclear program, then sanctions would be lifted and Iran could “return to the fold” of the international marketplace.

Cohen’s dual track analogy contrasts a common misunderstanding of how sanctions should be used. Sanctions are effective because they apply pressure on a country while simultaneously offering an opportunity to relieve that pressure. Sanctions applied on a country simply for the sake of harm produce no results beyond the harm itself caused to the target country and the host country for bearing the economic cost of the sanction. Another example of an appropriate use of sanctions are, at least initially, the sanctions imposed by the United States and the EU against Russia. The sanctions on Russia are in place to encourage Russian withdrawal from Ukraine. Like Iran, should Russia continue illegal aggression against Ukraine sanctions should be increased and cut deeper into the Russian economy. Alternatively, should Russia begin talks and withdrawal from Ukraine, then the sanctions imposed on Russia by the United States and the EU should be lifted.

Trump Administration Complications

Having set out the theoretical underpinnings of the Trump administration, Cohen explored how the new administration has evolved its sanctions policy and some of their challenges going forward. The first digression is the disagreement between Congress and the White House over Russia sanctions. Of course, Congress has an important role in the sanctions process, but Congress’s moves were far more prescriptive than in the past. Previously, Congress would defer to the President or the Treasury Secretary on the lifting and imposition of sanctions to complement the executive’s diplomatic efforts. With the Russia sanctions legislation, some sanctions have been effectively locked into place in such a manner that it is no longer an effective tool at the disposal of the administration. Cohen conceded that Congress had legitimate concerns over the White House’s commitment on punishing Russia for its invasion of Ukraine. However, time will tell if sanctions will lose the flexibility and nimbleness that makes them such an effective foreign policy tool.

The Trump administration’s most important challenge will be establishing a North Korean sanctions regime. Cohen argued that it was possible for the United States, in cooperation with China, to establish an effective sanctions regime on North Korea. North Korea needs the ability to sell its arms, labor, and textiles to earn foreign currency around the world. All those transactions are vulnerable to the secondary sanctions that were effective against Iran. Secondary sanctions would be cutting off any company that does business with North Korea from the US economy. The challenge for the Trump administration is, unlike Iran, North Korea does over 90% of its trade with China. Therefore, any effective sanctions against China North Korea would likely rely on effective communication with the Chinese. Unfortunately, the Trump administration’s seeming desire to reimpose sanctions on Iran due simply to the desire to punish them does not bode well for an effective and dynamic sanctions policy.

Should readers wish to view David Cohen’s talk in full, an online recording can be found here.

Read More

September 17, 2017

Join the Georgetown Journal of International Law for our February 27 and 28 conference exploring the many facets of International Justice. Join professors, students, and professional in discussions about sanctions, cyber sextortion, the international law challenges facing our current administration, maritime law, cyber warfare, and more. RSVP here.

Read More

February 22, 2017

By Nicholas Nalbantian

Photo: Wikimedia Commons/Julian Nitzsche, Creative Commons License

On September 27, 2016, at the National Press Club in Washington, D.C., Gary Vikan presented his memoir: Sacred and Stolen. After twenty-seven years at the Walters Art Museum in Baltimore, including eighteen years as its director, we were given an inside view of the art world and the development of the international law of art theft.

Dr. Vikan began by recounting an earlier time, in the 1970s and 1980s, when the comfort level for purchasing stolen art was still high. Collectors were more concerned with whether any particular piece had been called “stolen” publicly rather than concerned for the reality surrounding the item. Such little care made the West a ready market for plundered works of artistic and historical significance. From 1975 to 1984, Dr. Vikan worked at the Dumbarton Oaks Research Library and Collection, an American center for Byzantine art. During that time, Dr. Vikan witnessed the flood of plundered artifacts following the Turkish invasion of Cyprus, a part of the more general effort to “de-Hellenize” Northern Cyprus.

Dr. Vikan’s talk focused on two particular episodes: In the first, he recounted the entertaining tale of how Vikan helped Dominique De Menile, the oil heiress, obtain thirteenth century frescos in 1983. Through her generosity, these plundered mosaics were housed in Houston, with permission from Cyprus, until 2012 when they were returned. However, the second episode more significantly highlights the contribution Dr. Vikan made to the jurisprudence of international art theft. This is the saga of the sixth century Kanakaria Mosaics.

The Kanakaria Mosaics were likely stolen from the Cypriot Church of the Panagia Kanakaria in 1979. In 1988, the mosaics were sold for $1.2 million in cash from a dubious German art dealer in Geneva to Peg Goldberg, an Indianapolis dealer in nineteenth and twentieth century paintings. Upon returning to the United States, Goldberg tried to sell the mosaics to the J. Paul Getty Museum in California for $20 million; such a high profile item sale alerted Cypriot authorities to the mosaic’s location.

Once located, the Autocephalous Greek Orthodox Church brought suit in federal district court in Indianapolis in 1989 for the return of the mosaics. In an illustration of how the law treats the issue of plundered art like any other stolen item, the action of replevin had to begin with the court considering whether Indiana applied the O’Keeffe v. Snyder rule on the statute of limitations. The court determined that the O’Keeffe v. Snyder rule did apply, which meant that the statute of limitations began upon discovery of the mosaics by the Orthodox Church, rather than running from their date of theft. Dr. Vikan was called as an expert witness to explain whether these mosaics were sufficiently suspicious to defeat Goldberg’s defense that she was a good faith purchaser. Judge Nolan was unconvinced by Goldberg and ruled in favor of the Orthodox Church. Goldberg appealed, but the Seventh Circuit affirmed:

“Lest this result seem too harsh, we should note that those who wish to purchase art work on the international market...are not without means by which to protect themselves. Especially when circumstances are as suspicious as those that faced Peg Goldberg, prospective purchasers would do best to do more than make a few last-minute phone calls. As testified to at trial, in a transaction like this, ‘All the red flags are up, all the red lights are on, all the sirens are blaring.’”

With the Seventh Circuit quoting the testimony of Dr. Vikan – "All the red flags are up, all the red lights are on, all the sirens are blaring." –  he has made a noted contribution to the growing customary international law on art theft as the choices made by the United States may influence other states’ courts in the future. The international law of art theft has seen improvement since the 1970s, but is still lacking in many regards.

Dr. Vikan’s experiences with the occupation of northern Cyprus can inform how to deal with the current trade of plundered artifacts from Syria and Iraq.  Art theft is the third highest-netting criminal enterprise after drugs and guns, and a number of valuable pieces remain on the market as a result. The governmental instinct is that of restriction, such as Cyprus’ foreign minister  Ioannis Kasoulides’ request that the UN Security Council “apply universal limitations on the trade and transfer of artefacts originating from all conflict zone, with the obligation of proof of legitimate trade resting on the traders, auction houses and buyers and not on the originating state.” The hope is that cutting off market access will remove a stream of income available to ISIS. Combating terrorism is important, but we should perhaps take a more nuanced approach than the one espoused by Kasoulides.

ISIS has been destroying antiquities like the Temple of Baalshamin or the contents of the Mosul Museum. Their movement is iconoclastic and they wish to remove evidence of pre-Islamic civilization. Yet, should we follow Kasoulides’ lead, we risk the further destruction of Syrian and Iraqi history. Dr. Vikan shared his belief that there is value in providing safe harbor to these items of national and cultural significance, a notion that it is better that the sixth century mosaics eventually return to Nicosia than risk their permanent destruction at the hands of nationalists or iconoclasts. So too recovered relics should be protected by states without conflict zones rather than rejecting them out of hand. The U.S. government passed the Protect and Preserve International Cultural Property Act in September 2016, which, in part, adopted this tendency. The Act includes provisions that allow for the waiver of import restrictions if “the President determines that, for purposes of protecting and preserving such material, the material should be temporarily located in the United States.” This is the goal epitomized by Dominique De Menile. The law should allow for these cultural relics to be protected in the stable states, without taking title to the item, in the hope that these antiquities will someday be returned to their home region.

As for items that are already in the United States illegitimately, there needs to be a process of recovery superior to the one the Cypriote government went through with the Goldbergs. There are laws in place aimed at preventing the theft of the historical objects, including the 1970 UNESCO Convention requiring the repatriation of objects illegally removed from many countries. However, the process is still cumbersome and can take four to five years for an identified piece to be returned to Egypt. The Protect and Preserve International Cultural Property Act was a step in the right direction, but more needs to be done to aid the recovered pieces to be returned to their rightful homes.

The book “Sacred and Stolen: Confessions of a Museum Director” by Dr. Gary Vikan was published September 20, 2016.

Read More

November 13, 2016

By Olga Symeonoglou

On April 25, the American Society of International Law and Georgetown University Law Center will host a one-day conference at Georgetown Law in honor of the 40^th anniversary of the Foreign Sovereign Immunities Act. The conference program will feature a keynote by Chief Judge Diane P. Wood, U.S. Court of Appeals (7th Circuit), as well as panels on: the origins of the FSIA; sovereign immunity in international law and practice, enforcement, terrorism, and human rights; and the Argentine Debt Case.

Read More

April 18, 2016

By Megan Abbot

The Sepur Zarco case, named after a military base in which widespread human rights abuses occurred against the civilian population, charges Lieutenant Colonel Esteelmer Reyes Giron, former commander of the base, and former military commissioner Heriberto Valdez Asig for their leadership of crimes of mass sexual violence and slavery.  The prosecutor is charging these crimes as violations of international humanitarian law, and thus as war crimes. Jo-Marie Burt reports for the International Justice Monitor that it is the first time that the Guatemalan court has prosecuted a crime of sexual violence from its decades-long civil war.  It is the first time that any court of any country is hearing crimes of sexual violence as crimes under international law.

Read More

February 22, 2016