Introduction

For the past several decades, the governments of the United States and many other liberal-democratic societies have espoused the benefits of a global internet that is, in some combination, free, open, interoperable, secure, and resilient. These are what we term the liberal-democratic policy community’s five internet principles. As far back as the early 2000s, the U.S. government referenced most of this language in its policy documents,¹ and those ideas have persisted since—most recently in the U.S. Department of Homeland Security’s Cybersecurity Strategy (released May 15, 2018)² and the U.S. State Department’s Recommendations to the President on Protecting American Cyber Interests through International Engagement (released May 31, 2018).³ The United Kingdom’s 2016 cybersecurity strategy called to protect a “free, open, peaceful and secure cyberspace”;⁴ France’s international digital strategy relies on principles of internet openness, net neutrality, and decentralization;⁵ and Canada’s newly-minted cybersecurity strategy makes similar mention of an open, free, and secure internet.⁶ These five terms, while usually not precisely defined, are frequently used by policymakers in liberal-democratic nation-states.⁷

Liberal-democratic societies have espoused the benefits of a global internet that is free, open, interoperable, secure, and resilient. 

In contrast, countries like Russia, China, and Iran have gradually developed methodologies for shaping the internet in their borders that do not depend on these five principles. While largely acknowledging and working to maximize the economic benefits of the internet, many of these countries’ internet regulatory and legislative structures emphasize and seek to reassert the state’s sovereignty over a space not originally designed to recognize sovereign boundaries.⁸ In doing so, these countries aspire to forge advantageous, efficient economic environments and leverage the internet’s potential to grow wealth, while also managing its capacity to sow instability and create new harms at home and abroad. Many of these countries have developed compelling arguments—to some—for why their nation’s model for the internet is the better one. Russia has exported its surveillance technology to encourage compliance with its model of the internet,⁹ and China has used assorted mechanisms—such as investment in underwater internet cables in the Asia Pacific¹⁰ and low-cost infrastructure projects in Africa¹¹—to push its tightly-controlling, sovereignty-centric internet model as well.

At the same time, the repeal of net neutrality protections in the United States¹² has elevated some discussion of the idealism behind the five principles of freedom, openness, interoperability, security, and resiliency. Not only do liberal-democratic nation-states often challenge their own vision of the global internet through domestic policies, as some commentators are beginning to understand, but some of these characterizations are in tension with one another and in conflict with the architecture of the internet itself.

The internet’s physical infrastructure is filled with so-called “choke points” where single companies¹³ or governments¹⁴ control massive flows of information—creating single points of failure (SPOFs) that challenge the principle of resilience. In 2017, for instance, private corporation CloudFlare revealed that they handle around 10 percent of all American internet requests.¹⁵ Globally, just four corporations account for upwards of 90 percent of all traffic to content delivery networks (CDNs), challenging the resiliency of dependent systems.¹⁶ Companies and governments have begun reinvesting in control of undersea internet cables,¹⁷ and nations like Iran have built their own internal internets.¹⁸ Centralization, rather than decentralization, is the name of the game.

Not only do liberal-democratic nation-states often challenge their own vision of the global internet through domestic policies, as some commentators are beginning to understand, but some of these characterizations are in tension with one another and in conflict with the architecture of the internet itself.

Further, the internet is certainly not secure; if anything, it was designed for redundancy and constant availability—for protocols to route around failure rather than encrypt data or filter out malicious packets. But even those original principles of redundancy and constant availability have been challenged, with attacks that manipulate data and botnets that shut down entire subsections of a nation’s internet.¹⁹ This is perhaps equally true in authoritarian nation-states, where governments restrict public internet access and rigorously police instances in which access is permitted. The web has drastically changed since its inception.