Saving Face in the Cyberspace: Responses to Public Cyber Intrusions in the Gulf

How do states “save face” following a cyber intrusion directed at them? A new article identifies how Gulf states employ diverse rhetorical strategies—beyond attribution—to narrate cyber intrusions and keep cyber conflict contained.

In July 2017, nearly two months after Qatar had suffered a public cyber intrusion, the Qatari Ministry of Interior (MOI) revealed evidence concerning the intrusion. Rather than only providing technical details about the intrusion, the MOI broadcasted a dramatic video with intense music, thrilling graphics, and a spy-style vibe to reveal the intrusion step-by-step. In addition to delegitimizing cyber intrusions as acts of terrorism, the video emphasizes the Qatari remarkable success in containing the intrusion and detecting its source despite the intrusion’s sophistication.

This Qatari press conference was not unique. When cyber intrusions become public, states do not only engage in technical strategies to deal with the intrusion and identify the initiator, but also manage their public relations – they publish messages, hold press conferences, brief reporters, and rhetorically try to manage the crisis.

However, these performative and symbolic strategies are often left unnoticed in existing research on cyber discourse. Of course, many studies zoom in on the strategy of attribution, but as we see, much more is going on following a public cyber intrusion.

In this article, we explore the rhetorical strategies used by governments in the Gulf in response to a public cyber intrusion they suffered. We do so via an original discourse analysis of official statements and state-sponsored media reports in five cyber intrusions that differ in their targets and methods: Saudi Arabia’s response to cyber intrusion against its oil company Aramco (“Shamoon” 2012), Saudi Arabia’s response to a “hack-and-leak” intrusion (2015), Saudi Arabia’s response to intrusions using “Shamoon 2.0” malware (2017), Qatar’s response to a “hack-and-fake” intrusion (2017), and Bahrain’s response to multiple hacking operations (2019).

Responding to Public Cyber Intrusions

When a cyber intrusion becomes public knowledge, targeted states must find ways to address and explain the resulting social costs. The need to “save face” in these situations arises from the undesirable implications for the identity and image of the state in front of both domestic and international audiences. We suggest that states employ rhetorical strategies to “save face” – to protect their public image in front of domestic, regional, or international audiences.

To better understand these strategies, we propose a typology of “face-saving” strategies that can be categorized into three broad groups: diminishing strategies, self-complimenting strategies, and accusing strategies.

Diminishing strategies involve minimizing the effect of the intrusion, normalizing it, or debunking false information. Minimizing means that states try to reduce the magnitude of the intrusion. Normalizing means that states frame the intrusion as a common occurrence in global politics, highlighting that other countries also experience cyber intrusions. Debunking means that states try to dispute the authenticity of leaked information and provide evidence to counter false claims. These strategies serve to diminish the impact and prevent further dissemination of damaging information.

Self-complimenting strategies are used to enhance the positive perception of the targeted state. States employ bolstering rhetoric to emphasize their successes, international connections, and positive values. Reasserting control is a rhetorical move that showcases measures taken to ensure future protection, often involving investigations, new cyber institutions, and regulations. Correcting is a rhetoric that aims to replace leaked or fabricated information with a more positive narrative by providing an alternative and beneficial account.

Accusing strategies involve exposing the intrusion, condemning the perpetrators, and attributing the attack to specific actors. By adopting these strategies, states shift blame and position themselves as victims.

Findings

When thinking about the public response of states to public cyber intrusions, existing literature primarily discusses the risks of retaliation or escalation as well as attribution. However, as this article shows, states engage in multiple “face-saving” strategies to manage their image and legitimize their restraint. Attribution is only one rhetorical option out of many.

The results of our systematic discourse analysis suggest that different contextual factors shape the specific strategies used. In cyber intrusions that involve leaking or faking information involve, unique strategies of debunking or correcting were used.

Regarding attribution, the cases involving Saudi Arabia – a regional power – did not include public attribution. In contrast, Bahrain and Qatar – smaller powers – did attribute the intrusions but did so only after such attribution was made by American media. These suggestive contextual factors might be used in future research on the rhetoric of cyber responses in other areas.

Understanding these face-saving strategies is crucial for two reasons. First, it provides insights into the restraint and limited nature of cyber conflicts. Existing research focuses on operational aspects and restraint shown by targeted states, but the public narrative and strategic narration of these events are often overlooked. By adopting face-saving strategies, targeted states aim to reduce pressure to retaliate or escalate and justify why such actions are unnecessary. Second, this study contributes to constructivist scholarship by expanding the repertoire of strategies used by states to cope with embarrassment. By focusing on the Gulf countries, we highlight the agency of states in the Global South to interpret cyber intrusions in front of different audiences.

Yehonatan Abramson and Gil Baram are the authors of “Saving Face in the Cyberspace: Responses to Public Cyber Intrusions in the Gulf” in Contemporary Security Policy, which is available here.

The cyber-domain as a narrative battlefield

How do the main actors in cyberspace make sense of its fragmented governance, and how does that translate to their broader strategic narratives? André Barrinha and Rebecca Turner study strategic narratives in their new article in order to find out.

In an era of increasing digital connectivity, the governance of cyberspace has become a critical global concern. Multilateral efforts to navigate the complexities of cyber governance are well underway, with two cyber initiatives currently ongoing at the United Nations (UN).

At the forefront is the Open-ended Working Group (OEWG) on developments in the field of information and telecommunications in the context of international security overseen by the UN General Assembly’s (UNGA) First Committee. The OEWG is responsible for negotiating norms related to international cybersecurity and responsible state behaviour in cyberspace. The second more recent group is the Ad Hoc Committee (AHC) on cybercrime, overseen by UNGA’s Third Committee. The AHC was created with the intention to create a new treaty specifically addressing cybercrime. These two groups are operating in parallel because of the assumption that international cybersecurity and cybercrime should be addressed separately, as two distinct cyber regimes under the same complex.

International cybersecurity is understood to be divided along three main groups: the liberals, also known as the gatekeepers of cyberspace and custodians of the internet’s core principles, including the UK, US, EU and other likeminded states; the sovereigntists, led by Russia and China, who are inspired by a much more state-centric and territorialised approach to cyberspace regulation; and finally, the non-aligned or swing states, including Brazil, India and South Africa, who oscillate between the former two groups depending on the policy issue.

In our article, we explore the narrative battlefields of the OEWG and AHC using strategic narratives as our starting point. By examining the approaches of key actors from each of the groups – the EU as a representative of the liberals, Russia as an advocate for the sovereigntists and India as a swing state – we aim to uncover their storytelling techniques and the associated implications for the multilateral governance of cyberspace.

As we conclude, the existence of two different forums does not seem to impact the consistency of each actor’s strategic narratives. Rather, there is a strong continuum across the two forums, as described below.

The EU: a force for good

For the EU, both forums serve as opportunities to reinforce its position as a global force for good, committed to responsible leadership and democratic values. Central to the EU’s narrative is the defence of the rules-based order and the founding principles of the internet, which emphasise its global, open, free, stable, and secure nature. In championing these values, the EU establishes itself as an advocate for maintaining the status quo. The EU’s commitment to being a status quo actor is likely motivated by concerns about “Westlessness” – the perception that the world, and cyberspace, is gradually becoming less Western-centric and less aligned with liberal ideals. The EU’s force for good identity narrative and rules-based order system narrative directly facilitates its policy narratives around cooperation, development, and capacity-building.

Russia: the norm-entrepreneur

Russia’s strategic narratives in the OEWG and AHC revolved around four main themes: Russophobia, anti-Westernism, sovereignty and multilateralism. These narrative elements were consistently present in both forums, indicating that Russia’s establishment of the AHC was driven less by a belief in the institutional separation of crime and international cybersecurity as distinct cyber regimes, and more by a desire to counter existing legal and diplomatic structures that Moscow perceives as leaning towards liberal ideals. Through these strategic narratives, Russia aims to position itself at the forefront of cyber diplomacy as a norm-entrepreneur, shape future policy decisions to its advantage, and influence the global discourse on cyberspace governance.

India: the multi-aligner

India is still in the process of formulating a comprehensive strategic approach to cyberspace that aligns with its national interests and aspirations. This ongoing process helps to explain why India adopts a position of multi-alignment in the cyber domain, seeking to maintain connections with both ‘Liberals’ and ‘Sovereigntists’. Consequently, India’s strategic narratives in the cyber realm appear more ambiguous in comparison to the EU and Russia. India articulates narratives around sovereignty, technological autonomy, multilateralism, democracy, and its status as a developing nation. But, while these narratives are present in both the OEWG and AHC, they often lack coherence and occasionally conflict with one another. For instance, the struggle between upholding human rights and asserting stringent sovereign controls exemplifies India’s discursive frictions on fundamental cyber issues.

Narratives matter

Given the relatively nascent stage of the cyber domain and the conflicting views and priorities of the three groups under analysis, the way cyber issues are discursively approached offers intriguing insights into the state of cyber diplomacy. As the AHC moves towards a draft convention on cyber-crime and the OEWG into the second year of its second iteration, the world remains significantly divided on what should and should not be allowed to happen in cyberspace. Understanding the narratives underpinning those divergences is crucial if we are to move towards a safe and stable cyberspace.

As we conclude in the article, for all the specificities and technicalities associated with cybercrime or with the potential application of international humanitarian law to cyberspace, there are over-arching narratives told by the active actors in this domain that need to be taken into consideration. Ultimately, the successful implementation of any agreement or norm will rely on the incorporation of those positive steps within those actors’ strategic narratives of cyberspace.

André Barrinha and Rebecca Turner are the authors of  “Strategic narratives and the multilateral governance of cyberspace: The cases of European Union, Russia, and India” in Contemporary Security Policy, which is available here.

The Paradox and Perils of Authoritarian Support for Multilateral Cyber Governance

Support for international organizations remains a foreign policy mainstay for most democratic states. In a new article, Mark Raymond and Justin Sherman explain why the situation is more complicated with respect to cyber governance. They find that major authoritarian states are championing their own distinct variant of authoritarian multilateralism, while many democratic states have embraced a contemporary form of multilateralism that incorporates substantial elements of multistakeholder governance. The divergence on how to accomplish cyber governance is rooted in a difference over what multilateralism means and the appropriate way to practice it, with deep implications for the broader trajectory of rule-based global order. The widespread adoption of authoritarian multilateralism would amount to CRISPR gene editing the liberal DNA out of the post-1945 order, leaving the form but not the vital substance of liberal multilateralism.

Varieties of Multilateralism 

International Relations scholarship recognizes multilateralism as one of the pillars of the contemporary rule-based global order. Language invoking multilateralism as an idea, and as a practice instrumental to maintaining global security, also features prominently in leaders’ public foreign policy statements. President Biden’s preferred formulation, “rules-based order,” is a close cognate of multilateralism, at least to the ears of listeners in democratic states, who largely accept the notions that the rule of law entails the equal application of rules to actors regardless of power differentials, and that rules should be authored by those subject to them.

However, we think there are good reasons to suspect not only that authoritarian states have different views of how multilateralism should be practiced, but also that democratic states are experiencing ‘dri’ over time in their understandings of what multilateralism entails. We identify and describe two distinct variants of multilateralism: liberal and authoritarian.

The liberal variant is the familiar one, rooted in notions of equality before the law and representation in rule-making processes. In contrast, authoritarian multilateralism is rooted in notions of great power privilege, akin to hierarchical notions of great power management more commonly associated with nineteenth-century world politics. It also differs from liberal multilateralism in the underlying purpose it accords to global governance arrangements. Liberal multilateralism emphasizes transparency and participation, and the realization of human rights as a key goal of global governance arrangements more generally; authoritarian multilateralism is more opaque and statist, and privileges state sovereignty over the welfare of individuals.

Authoritarian Multilateralism in Cyber Governance 

There is broad agreement that China and Russia are the main players in a substantial international coalition seeking to nudge cyber governance arrangements toward multilateralism and away from private and multistakeholder governance modalities. Our analysis goes further by drawing atention to the specific means that they are using in service of this goal: (1) exploiting established procedures to subvert established liberal multilateral governance arrangements; and (2) parallel order-building efforts that employ or create new governance arrangements that lack the distinctive hallmarks of liberal multilateralism.

Russia first sought a multilateral arms control treaty for cyberspace at the United Nations in 1998, leading to the Group of Governmental Experts (GGE) process that continued until 2021. Russia and China supplemented this flagship UN process with increasing involvement in private and multistakeholder Internet and cyber governance arrangements, especially for establishing technical standards.

Landmark GGE reports in 2013 and 2015 and deteriorating relations with the United States and other Western states led China and Russia to shi their UN strategy. They criticized the GGE as fundamentally undemocratic because it included only a select group of states, calling for the establishment of an Open-Ended Working Group (OEWG). Crucially, the OEWG expanded participation to tilt the composition in favor of authoritarian states, and it shied the terms of reference to include negotiation of international agreements rather than the study oriented GGE mandate. Although the first OEWG became more inclusive of non-state actors over time due to democracies’ efforts, the initial design was more akin to authoritarian rather than liberal multilateralism.

Outside the UN, China and Russia also seek to advance authoritarian multilateralism by way of increased engagement with technical standard-seng processes for digital technologies and in bilateral infrastructure diplomacy. However, the parallel order-building strategy is most evident in long-standing efforts by the Shanghai Cooperation Organization, which stands out as an explicitly illiberal international organization substantially less transparent than IGOs created with strong involvement from the world’s major democracies. Most recently, China has announced that it intends to transition its World Internet Conference into a new multilateral organization specifically for cyber governance. Such a step would substantially elevate parallel order-building efforts in the cyber regime complex.

Implications for Rule-Based Global Order 

Cyber governance is not only vitally important, it is also an especially stark contrast between two different visions of what multilateralism means and how it should be practiced. The authoritarian variant illustrated here is opaque, insulated from participation by non-state actors, and aims at creating an international order that excises core aspects of the post-1945 order rooted in democracy and human rights as core values. The liberal variant, in contrast, has evolved over time to be more inclusive of nonstate actors than its initial form, such that multilateralism as practiced by democratic states now incorporates elements of multistakeholder governance.

Which of these variants predominates in global governance is thus a consequential question for policymakers, and for the trajectory of the rule-based global order. It also poses foreign policy challenges for democratic states. If China moves ahead with a multilateral international organization for cyber governance, democracies will face a choice: should they join such an organization, hoping to influence its decisions? If so, they will need to operate in a fundamentally different procedural context than most major international organizations. If they stay out, it will provide greater freedom of action for Russia, China and other authoritarian states to shape the future of cyber governance in ways that may have significant global effects over time.

Mark Raymond and Justin Sherman are the authors of “Authoritarian Multilateralism in the Global Cyber Regime Complex,” Contemporary Security Policy, which is available here