Liberal-democratic nation-states make frequent and explicit reference to five key elements of the global internet in their policy documents and cyber strategies: free, open, interoperable, secure, and resilient, or some combination of those elements. However, there are two fundamental problems with this approach.

The first is that the global internet never has embodied the absolute of any of these principles—and it is unlikely to in the future.

The second is that these five principles are in tension with one another—for instance, considering that complete network openness has some negative effect on network security—but this is not reflected in a vision of the internet where they all exist in harmony.

Recognizing that the principles of freedom, openness, interoperability, security, and resiliency are not representative of the internet reality, we have developed an analytical framework for comparing the idealized version of the internet—as imagined by liberal-democratic policymakers—with the internet reality. Within this document itself, the framework allows us begin to identify the current divergence from the idealized version of the global internet and thus identify gaps, pitfalls, and tensions in the liberal-democratic policy community’s approach to the internet. Outside the scope of this document and going forward into future work, this framework enables anyone to plug in a single nation-state’s internet policies to track divergence from the idealized version and to compare differences between countries. This framework is also an initial version and will be iteratively updated as needed.

For the past several decades, the governments of the United States and many other liberal-democratic societies have espoused the benefits of a global internet that is, in some combination, free, open, interoperable, secure, and resilient. These are what we term the liberal-democratic policy community’s five internet principles. As far back as the early 2000s, the U.S. government referenced most of this language in its policy documents,¹ and those ideas have persisted since—most recently in the U.S. Department of Homeland Security’s Cybersecurity Strategy (released May 15, 2018)² and the U.S. State Department’s Recommendations to the President on Protecting American Cyber Interests through International Engagement (released May 31, 2018).³ The United Kingdom’s 2016 cybersecurity strategy called to protect a “free, open, peaceful and secure cyberspace”;⁴ France’s international digital strategy relies on principles of internet openness, net neutrality, and decentralization;⁵ and Canada’s newly-minted cybersecurity strategy makes similar mention of an open, free, and secure internet.⁶ These five terms, while usually not precisely defined, are frequently used by policymakers in liberal-democratic nation-states.⁷

Liberal-democratic societies have espoused the benefits of a global internet that is free, open, interoperable, secure, and resilient. 

In contrast, countries like Russia, China, and Iran have gradually developed methodologies for shaping the internet in their borders that do not depend on these five principles. While largely acknowledging and working to maximize the economic benefits of the internet, many of these countries’ internet regulatory and legislative structures emphasize and seek to reassert the state’s sovereignty over a space not originally designed to recognize sovereign boundaries.⁸ In doing so, these countries aspire to forge advantageous, efficient economic environments and leverage the internet’s potential to grow wealth, while also managing its capacity to sow instability and create new harms at home and abroad. Many of these countries have developed compelling arguments—to some—for why their nation’s model for the internet is the better one. Russia has exported its surveillance technology to encourage compliance with its model of the internet,⁹ and China has used assorted mechanisms—such as investment in underwater internet cables in the Asia Pacific¹⁰ and low-cost infrastructure projects in Africa¹¹—to push its tightly-controlling, sovereignty-centric internet model as well.

At the same time, the repeal of net neutrality protections in the United States¹² has elevated some discussion of the idealism behind the five principles of freedom, openness, interoperability, security, and resiliency. Not only do liberal-democratic nation-states often challenge their own vision of the global internet through domestic policies, as some commentators are beginning to understand, but some of these characterizations are in tension with one another and in conflict with the architecture of the internet itself.

The internet’s physical infrastructure is filled with so-called “choke points” where single companies¹³ or governments¹⁴ control massive flows of information—creating single points of failure (SPOFs) that challenge the principle of resilience. In 2017, for instance, private corporation CloudFlare revealed that they handle around 10 percent of all American internet requests.¹⁵ Globally, just four corporations account for upwards of 90 percent of all traffic to content delivery networks (CDNs), challenging the resiliency of dependent systems.¹⁶ Companies and governments have begun reinvesting in control of undersea internet cables,¹⁷ and nations like Iran have built their own internal internets.¹⁸ Centralization, rather than decentralization, is the name of the game.

Not only do liberal-democratic nation-states often challenge their own vision of the global internet through domestic policies, as some commentators are beginning to understand, but some of these characterizations are in tension with one another and in conflict with the architecture of the internet itself.

Further, the internet is certainly not secure; if anything, it was designed for redundancy and constant availability—for protocols to route around failure rather than encrypt data or filter out malicious packets. But even those original principles of redundancy and constant availability have been challenged, with attacks that manipulate data and botnets that shut down entire subsections of a nation’s internet.¹⁹ This is perhaps equally true in authoritarian nation-states, where governments restrict public internet access and rigorously police instances in which access is permitted. The web has drastically changed since its inception.

The U.S. and other liberal-democratic nation-states make reference to an internet that is, in some combination, free, open, interoperable, secure, and resilient. The precise meanings of these terms are unclear. However, as we interpret them based on existing policy documents, these terms mean:

• Free: Any user can access and exchange information on and through the internet without unreasonable restriction.
• Open: Systems and infrastructure are merely conduits for data transmission; they are net neutral and oblivious to what goes through them.
• Interoperable: Parts of the global system (network) work with other parts of the global system (network); A can easily move or convert to B.
• Secure: The system upholds the confidentiality, integrity, and availability (CIA) of its users, its data, and itself.
• Resilient: No single points of failure exist in the network; systems do their intended job despite impediments.

Here we provide an elaboration on how we arrived at these definitions and some of the nuance behind them. These definitions are of course subjective, particularly in their original usage by each government, but there is relatively consistent usage among liberal-democratic nation-states which we attempted to extract.

In 2011, the United States’ International Strategy for Cyberspace asserted that “the more freely information flows, the stronger our societies become.”²⁰ It also noted that “the ability to seek, receive and impart information and ideas through any medium and regardless of frontiers has never been more relevant.”²¹ France produced a document that same year which stated, “France condemns all censorship and arbitrary or general restriction of Internet access and seeks to promote freedom of opinion, expression, information, assembly and association on the Internet.”²² A 2012 report to the U.S. House Committee on Energy and Commerce held that any deviation from the “the free flow of commerce and ideas” would harm the internet’s “ability to spread both prosperity and freedom.”²³ France’s 2015 National Digital Security Strategy writes that the internet should remain “a place of free expression for all citizens, where abuses can only be prevented within the limits set by the law and in line with our international agreements.”²⁴ Israel’s 2017 National Digital Program says that “freedom of expression and free access to information, which are vitally important for the social resilience of the State of Israel and its democratic nature, must be ensured.”²⁵ Australia explicitly defines internet freedom as a state where “people are not burdened by undue restrictions on their access to and use of cyberspace; and their human rights are protected online as they are offline so that cyberspace remains a vibrant force for economic, social and cultural development.”²⁶ And a 2017 address of the European Commission by the Greek Vice-President even discussed Greece’s backing of the free flow of internet data.²⁷ Our definition is based on these (and many other) references to freedom tying into the ability to access and share information online. Most often, this principle of internet freedom is impacted by laws, regulations, social norms, and political actions.

Australia defines an open internet as “interoperable across borders and accessible to all; it facilitates unrestricted participation and the free flow of information, driving inclusive online collaboration, innovation and growth.”²⁸ France’s 2017 international digital strategy discusses the importance of openness and network neutrality, guaranteed by decentralized internet architecture.²⁹ The Italian government sets “net neutrality, open networks, [and] equivalent and non-discriminatory access conditions” as key goals of its internet strategy, adding the importance of “a technical solution completely open and neutral, deploying only passive infrastructures and laying optic fiber according to a fiber-to-the-building (FTTB) reference architecture to allow the wholesale unbundled access to all operators.”³⁰ The U.S. Federal Communications Commission (FCC) stated in 2016 that openness more or less refers to net neutrality, which ensures that “broadband service providers cannot block or deliberately slow speeds for internet services or apps, favor some internet traffic in exchange for consideration, or engage in other practices that harm internet openness.”³¹ Our definition is therefore oriented to a non-discriminatory architecture that is net-neutral. What this means in practice is that the internet infrastructure is oblivious to the nature of the data or traffic flowing through it. Regardless of what the data is, it will be treated the same way by the infrastructure. Often, violations of internet freedom (e.g., passage of a censorship law) are what prompt violations of openness in architecture (e.g., corresponding filtering on the part of internet service providers [ISPs]).

The United States’ FCC discussed interoperability as far back as 2003 in the context of signaling architectures, call control architectures, voice over wireless, inter-provider interfaces, directory services, and safety and security features, broadly referring to features by which different networks and systems interact.³² Australia’s recent international cyberspace strategy links interoperability with the harmonization of global internet standards (e.g., through organizations such as the International Organization for Standardization).³³ A 2014 paper from the U.K.’s Chief Scientific Adviser frames interoperability the same way: compelled by universally-recognized standards.³⁴ The United States’ Computer Emergency Readiness Team (US-CERT) defines interoperability as “the ability of two or more systems or components to exchange information and to use the information that has been exchanged.”³⁵ The European Commission expands upon all of these definitions, asserting that “interoperability is not simply a technical issue concerned with linking up computer networks. It goes beyond this to include the sharing of information between networks and the reorganisation of administrative processes to support the seamless delivery of eGovernment services.”³⁶ Our definition therefore broadly refers to the ability of different components of a given system—in this case, the global internet—to interact without failure.

Germany’s 2011 Cyber Security Strategy defines security in context as “the sum of all national and international measures taken to protect the availability of information and communications technology and the integrity, authenticity and confidentiality of data in cyberspace.”³⁷ Australia’s government holds that “a secure cyberspace is safe, reliable and resilient; it fosters an environment of trust so that individuals, businesses and governments can engage online with confidence and realise the opportunities and minimise the risks of the digital age.”³⁸ Canada’s recent Cyber Security Strategy categorizes cybersecurity as response and mitigation measures to unauthorized data access and electronic attacks.³⁹ The Spanish government discusses cybersecurity as a broad objective to “ensure that Spain makes secure use of the Information and Telecommunications Systems, strengthening cyber-attack prevention, defence, detection, analysis, investigation, recovery and response capabilities.”⁴⁰ And US-CERT defines cybersecurity as “the activity or process, ability or capability, or state whereby information and communications systems and the information contained therein are protected from and/or defended against damage, unauthorized use or modification, or exploitation.”⁴¹ Our definition comes from these and other references, which in aggregate aim to protect the confidentiality, integrity, and authenticity (CIA) of the global internet and its related components—from broad strategy down to highly-technical processes.

Israel’s previously-mentioned National Digital Program ties the internet directly into the social resilience of the nation-state.⁴² The U.S. President’s National Security Telecommunications Advisory Committee (NSTAC) issued a 2017 report on resiliency that linked it to network redundancy and the security of communications and infrastructure.⁴³ The U.S. Department of Homeland Security discusses resilience in context with technical and operational resistance to cyber attacks.⁴⁴ Spain’s Ministry of Defence defines resilience as “the defensively oriented policy that maximizes the ability of possible target systems to prevent, deter and withstand cyber attacks and, if they occur, to minimize and mitigate their effects” which “is a multidimensional concept and has technical, organizational, political and legal components that need to be combined to be effective.”⁴⁵ France’s Internet Resilience Observatory most recently defined resilience on the internet as “the ability [for the internet] to operate during an incident and return to the nominal state. It can be characterized by measurable indicators, some of which come directly from engineering rules called best practices.”⁴⁶ Our definition aims to encompass the underlying thread in these and other definitions, which center around the ability of a system to essentially route around failure, regardless of the underlying cause.

Even in an idealized version of a global internet, not every dimension or element in our framework necessarily needs to contain or implicate all five of these ideal principles. However, in the idealized version of the internet in our framework, we provide a description of a global network that we believe captures the vision of a free, open, interoperable, secure, and resilient global internet. It is our hope that this mapping further clarifies the definitions and our interpretations of free, open, interoperable, secure, and resilient and provides an idealized archetype from which we are able to identify real departures.

China and Russia do not share the liberal-democratic view of the internet—quite the contrary, in fact. The Chinese and Russian governments have long emphasized security of the state over ideas of openness, resilience, and decentralization (online as much as offline). In addition to censoring content and aggressively cracking down⁴⁷ on the ability of foreign companies to operate in and thereby influence their internet, China has clear strategies on internet governance, covering everything from the digital economy to terrorism.⁴⁸ Its government and corporations are making significant investments in physical internet infrastructure, gaining control of valuable underwater cables in the Asia Pacific.⁴⁹ Further, China’s government has begun pushing its policies within international organizations such as the International Telecommunications Union (ITU) and other standards bodies.⁵⁰ Chinese policymakers have also made clear their prioritization of “cultural security” and “innovation security,” which collectively safeguard the domestic online environment from internal and external threats.⁵¹

China’s cyberspace strategy is “vastly different” from that of its liberal-democratic counterparts—perhaps foremost in its acceptance of the internet reality.⁵² Its government addresses security issues, digital and otherwise, head-on.⁵³ But China’s policy is also cohesive: as one scholar puts it, “Beijing has moved to rapidly…[to] construct a policy and regulatory framework spanning cybersecurity, the digital economy, and online media content—all under one mantel.”⁵⁴

The Chinese and Russian governments have long emphasized security of the state over ideas of openness, resilience, and decentralization (online as much as offline).

Similar to China, Russia actively seeks to control the internet governance narrative in its favor through the “politicization of global cyber issues”⁵⁵ and its use (and export)⁵⁶ of SORM-3, a system enabling mass censorship and surveillance.⁵⁷ Russia consistently pushes norms in the ITU, the Internet Corporation for Assigned Names and Numbers (ICANN), and the Internet Governance Forum (IGF) to uphold multilateralism⁵⁸ over the West-favored multi-stakeholder approach.⁵⁹ And its leadership acknowledges the fundamental use of the internet as a foreign policy tool, viewing cyberspace as a “chaotic domain…which reinforces global anarchy.”⁶⁰ Russian treatment of the internet ties in visibly with its other economic, social, and political goals.

On the point of multilateralism, China and Russia actively cooperate on international cyberspace issues, signing a joint letter to the UN General Assembly in 2015 on an “international code of conduct for information security.” In addition to emphasizing the importance of sovereignty in cyberspace, it called for others “not to use information and communications technologies and information and communications networks to carry out activities which run counter to the task of maintaining international peace and security.”⁶¹ This comes back to China and Russia’s mutually-held idea that online information is “a potential threat to their political stability that demands tight controls.”⁶²

These countries’ visions of the internet may not be desirable, but that does not mean their underlying assumptions (e.g., its insecurity) are flawed. It also does not imply a lack of consistent messaging: China and Russia actively pass laws in support of their own security-centric internet policies, from banning encrypted messenger Telegram⁶³ and broadly regulating online discourse⁶⁴ to controlling gateways to the global internet⁶⁵ and punishing search engines that link to banned Virtual Private Networks (VPNs).⁶⁶ The same goes for authoritarian countries such as Iran, where violations of net neutrality⁶⁷ are consistent with their professed internet strategy.⁶⁸

These countries’ visions of the internet may not be desirable, but that does not mean their underlying assumptions are flawed.

In contrast, many liberal-democratic laws and policies—that is, what happens in practice—may not align with their governments’ visions. The United States repealed its protection of net neutrality in June 2018,⁶⁹ a core element of an open internet. While the European Union is still officially committed⁷⁰ to net neutrality, some argue this falls short in practice.⁷¹ National cyber defenses, such as the United Kingdom’s filtering of threats at the border,⁷² run directly in the face of complete openness, as do the majority of liberal-democratic countries whose surveillance programs aggressively monitor the flow of online information.⁷³

In 2015, Freedom House named France as the nation with the second-greatest annual increase in internet censorship, in that case due to blowback from the terrorist attacks against Charlie Hebdo.⁷⁴ Censorship laws similarly passed in the name of domestic security have gained foothold in the United States,⁷⁵ Germany,⁷⁶ Canada,⁷⁷ and the United Kingdom,⁷⁸ to name several others. Again, this may be for legitimate reasons, but the passage of these laws represents at least some shift away from the idea of internet openness, freedom, and interoperability and further toward the idea of the internet’s inherent vulnerability and capacity for harm.

The United States permits challenges to internet resilience, allowing only a few internet service providers to control a significant amount of traffic.⁷⁹ Some argue this is a byproduct of the United States’ capitalist approach to the technology market,⁸⁰ but the centralization of control over internet architecture is at least evident. This challenges internet security insofar as single centers hold valuable access to high volumes of traffic (a goldmine for hackers and foreign nation-states wishing to spy on American internet communications).

The passage of these censorship laws represents at least some shift away from the idea of internet openness, freedom, and interoperability and further toward the idea of the internet’s inherent vulnerability and capacity for harm.

All of this said, most liberal-democratic nation-states strongly disagree with Russia, China, and other authoritarians on how to govern the internet; the U.S. government, for instance, does not hire citizens to pervasively spread propaganda (as with China⁸¹ and Russia).⁸² The Netherlands, to use another example, is known for open sharing of online information rather than aggressive internet censorship.⁸³ So the challenging of one’s own principles does not necessarily (and in this case, does not) constitute full alignment with authoritarian nation-states. However, liberal-democratic countries still need to shift their stances from the total ideal of freedom, openness, interoperability, security, and resiliency to one that is more attuned with today’s reality—raising the question of how this should be done.

Recognizing that the five characteristics of the idealized internet are a departure from the internet reality—what is a series of increasingly restricted, vulnerable, centralized, and often sovereign networks—we have built the following framework⁸⁴ to identify pitfalls, gaps, and tensions in the liberal-democratic policy community’s idealized portrait of the global internet. Importantly, this idealized version of the internet is not necessarily the same as that of the initial internet founders, technology companies, or internet users. Instead, it is an interpretation of the picture painted of the internet by liberal-democratic policy statements. It therefore serves as a baseline from which we can analyze current policies towards the internet (e.g., mapping and understanding the divergence from the baseline).

This, we believe, is where our framework proves useful. Highlighting the gap between the ideal and the reality allows us to better understand the challenges and tensions at play, from the physical wires that compose the global internet to the laws and social norms that shape its pervasive impact. Furthermore, understanding this gap helps us better understand the implications of policies and may assist in identifying just how far liberal-democratic societies are willing to push their internet regulations and restrictions in pursuit of cyber and broader security.

In order to better understand and classify the idealized version of the internet and the real internet, as well as current activities and proposals, we suggest a two-tier analytical framework.

In this section, we provide the framework along with a description of its tiers and elements. In the following section, we then use the framework to construct a baseline idealized version of the internet and map todays internet reality, to capture the departure from the ideal. Once this baseline is established and the contrast is evident, future work can use the framework to systematically analyze individual nation-state policies and practices around cybersecurity and governance of the internet.

To be clear, this is not a model for the global internet itself; rather, we introduce an analytical framework for understanding the global internet, specifically geared towards helping policymakers with non-technical backgrounds understand the internet reality. The five aforementioned principles—freedom, openness, interoperability, security, and resiliency—are merely a lens, and as such, our perspective in creating the framework remains that of policymakers in liberal-democratic nation-states. In the larger context, highlighting the gaps between the ideal and the reality allows us to guide liberal-democratic thinking on internet governance and cybersecurity policy. For instance: What tensions exist within country X’s vision of the global internet? Are their current policies challenging or undermining this goal? What are nation-states like Iran doing under this lens? What are their thresholds for upholding or violating these principles—that is, what gaps do they tolerate between the liberal-democratic ideal and their reality? And so on.

In the larger context, highlighting the gaps between the ideal and the reality allows us to guide liberal-democratic thinking on internet governance and cybersecurity policy.

Our framework integrates softer governance issues such as politics, economics, national security, and international norms with harder architecture issues such as system resilience, protocol interoperability, and network security—factors often isolated from one another in existing internet analysis.⁸⁵ Nation-states like China and Russia have set up bureaucratic structures to integrate these ideas,⁸⁶ and liberal-democratic nation-states should as well. Further, we believe this integration—that is, a comprehensive and intersectional view of the global internet—will guide the most effective policy creation.

The first tier (the Governance Tier) breaks out influencers of the internet into four categories: laws and regulations, social norms, standards, and markets. This tier largely examines legal, societal, and economic code rather than technical code.

The Governance Tier is an adaptation of Lawrence Lessig’s regulators of behavior in cyberspace⁸⁷—which he identifies as laws, standards/social norms, and markets. His approach is theoretically effective for strategic and policy analysis, but Lessig groups together standards and social norms, two factors which have developed increasingly different roles over time. Standards, developed and maintained by such organizations as the ITU, the Institute of Electrical and Electronics Engineers (IEEE), and the Internet Engineering Task Force (IETF), are formal protocols for device and network activity. They are increasingly necessary to access the global internet; those who do not comply with IP address rules, for instance, will not be able to access Netflix.

The Governance Tier largely examines legal, societal, and economic code rather than technical code.

Social norms, in contrast, differ from standards in both design and enforcement. Norms face the challenge of soliciting and encouraging nation-state agreement—going through mechanisms of the United Nations, for instance, rather than simply saying “comply and connect, or do not comply and stay offline.” Incentivizing agreement with norms often is not as black-and-white as it often is with global internet standards.⁸⁸ Further, internet norms are typically far less technical than internet standards. For example, IEEE 802.11, the set of standards for wireless local area networks (WLANs),⁸⁹ has extreme technical specificity in contrast with a norm such as not interfering in the “internal affairs” of other nations through the internet.⁹⁰ Thus, separation between standards and social norms is necessary but nonexistent in Lessig’s model.

We therefore have our Governance Tier of laws and regulations, social norms, standards, and markets.

Governance Tier

The second tier (the Architecture Tier) describes different layers of internet architecture, using an adaptation of the well-known OSI (Open Systems Interconnection) model.⁹¹

The OSI model is composed of seven layers:

• Application
• Presentation
• Session
• Transport
• Network
• Data Link
• Physical

The OSI model is a popular tool for understanding the processes behind the global internet itself, such as IP routing and packet transmission. However, OSI has a problematic omission: content.⁹² Although content (information) is not necessarily distinct from presentation (code becoming readable characters, aka data) on a technical level, it must be separated in policy and cultural contexts. Different countries have fundamentally different understandings of terms like “information security,” because their fundamental understandings of online information are different—regardless of any technical similarities between systems.⁹³ Britain, for instance, may use the phrase “information security” in reference to data and network security, whereas Russia may use the term in reference to controlling the flow of information and general public discourse itself.⁹⁴ Thus, the particular importance of online information merits a comprehensive analysis of content as its own element.

We refer to these components as elements rather than layers to make clear the interplay between each component. The network cannot route traffic without the support of data link and transport protocols just as there is nothing to send without applications and content. “Layer” seems to denote physical separation between components, and we aim to show differently. We also combine OSI’s Application and Presentation layers into a single Application and Presentation element, as the distinction is not necessary for our purposes. Minimal policy decisions occur around character code translation (OSI’s Presentation layer) but many do occur around applications (e.g., encrypted messaging apps like Telegram and Signal).

We therefore have our Architecture Tier of Content, Application and Presentation, Session, Transport, Network, Data Link, and Physical elements.

Architecture Tier

Of course, governance and architecture, while sometimes distinct, can and often do overlap. For example, laws or regulations about the legality of some content (Governance Tier) will necessarily implicate the internet’s content element (Architecture Tier) as well as its network element (Architecture Tier). Likewise, markets (Governance Tier)—especially local language information markets—also implicate the content element (Architecture Tier). The separation of tiers, and the separation of dimensions and elements within those tiers, does not mean that each component operates in isolation. Rather, their separation allows for a useful analytical framework for understanding the forces shaping the internet we see today.

Our framework for understanding the gaps between the liberal-democratic internet ideal and the global internet reality is below. In the next section, we offer an overview of our mapping of the idealized and real internet. (See Appendix for an example of the full mapping)

Governance Tier

Architecture Tier

In this section, we offer a mapping of the different elements of our framework through the lens of a free, open, interoperable, secure, resilient internet. In doing so, we create two distinct pictures of the internet. The first column—Idealized Version—in each of the below tables describes what an internet built on the absolutes of these five principles would look like. In the second column—The Global Reality—we describe how the current internet departs from this idealized picture.

Governance Tier

Laws and Regulations
Laws and regulations are the primary tools used by states to shape behavior. They impose sanctions or punishment for (defined) undesirable actions or behaviors and/or provide incentives for (defined) desirable actions or behaviors.

In the context of the internet, laws can both shape the behavior of internet users and provide guidelines on how internet architecture should operate.

Social Norms
Social norms are expectations about “appropriate behavior for actors with a given identity.”⁹⁵ They regulate behavior through societal pressure.

In the context of the internet, social norms typically guide how users interact with the internet and with one another on the internet. However, social norms have in the past also shaped the way infrastructure owners and operators administer internet architecture.

Standards
Standards give “specifications for products, services and systems to ensure quality, safety and efficiency.”⁹⁶

In the context of the internet, standards provide guidelines primarily for using and configuring architecture.

Markets
Markets regulate behavior through price. “Through the device of price, the market sets my opportunities, and through this range of opportunities, it regulates.” ⁹⁷

In the context of the internet, markets shape the creation, acquisition, and configuration of architecture. They also impact the options available to internet users and the way users react to architectural changes.

Architecture Tier

Content
The content element is the result of translating machine-readable code into human-interpretable information. Content is what is presented on the screen of most internet users.

Examples of content include information on websites (not the websites themselves), email messages (not email protocols or applications), text messages, and Voice over Internet Protocol (VoIP).

Application and Presentation
The application and presentation element serves to translate character code representations (machine-readable code, what is often referred to as “data”) into physical windows, text, graphics, and other representations that are discernable to an average user. The result of this translation is content.

Examples of application and presentation architecture include internet browsers, websites themselves (search engines, news sites, social media platforms, etc.), email and messaging applications, the Hypertext Transfer Protocol (HTTP), and others, as well as file types (JPG, .doc, .pdf, etc.), encryption protocols (RSA, PGP, etc.), and character code representations (ASCII, Unicode, etc.).

Session
The session element is, for the purposes of the global internet, the interaction between an internet user and a host of internet content. A session is initiated by a user on the user’s own device, sending a signal to a host via the transport element. The host then decides to accept or reject the request for access and sends that signal back to the user. The session remains open for as long as the user maintains access to the host’s content.
For example, when an internet user wants to access facebook.com, she enters the URL into her browser, ostensibly sending a session request to a Facebook server. The server chooses whether to accept or deny that request and sends it back to the user.

Transport
The transport element consists of the processes and protocols that allow devices to communicate to one another over the network (see below).

Network
The network element is the processes and protocols that help internet traffic identify its intended destination. Network processes and protocols help assign identities to users and hosts.

These most notable of these processes and protocols are the Internet Protocol (IP) and domain name service (DNS) registries.

Data Link
The data link element is oriented around packets themselves rather than users and hosts. The data link processes and protocols dictate how packets are sent and received and how they act when delivered to their destination. Data link processes and protocols play a basic role in ensuring the functionality of the internet by detecting and correcting basic errors in transmitted data.Data link processes and protocols include media access control (MAC) addresses.

Physical
The physical element is the physical infrastructure and hardware that enables all the other elements.
Physical elements of the global internet include servers, undersea cables, satellites, routers, Ethernet cables, internet exchange points (IXPs), cellphones, tablets, and computers themselves.

One of the primary values of this framework is its ability to highlight tensions inherent in the idealized internet. These inherent tensions partly explain some of the incoherence in liberal-democratic nation-state approaches to cyberspace policy. The absolutes of the five principles—freedom, openness, interoperability, security, and resiliency—may not be compatible with one another. For instance, a network cannot be completely open and completely secure.⁹⁸ However, the absolutes of these principles are not implemented in practice; in other words, they are not the reality, which in fact lies somewhere on a spectrum. Thus, there are tensions between these five principles which must be explored to determine the right balance. Some are starting to realize this fact, as demonstrated by a report from the U.S. National Security Telecommunications Advisory Committee, which in 2017 noted that “as networks become more open and interconnected, [the current] trust model can no longer be the sole foundation for Internet security.”⁹⁹ Others have begun to point to inherent tensions and problems with this approach as well.¹⁰⁰ However, most liberal-democratic policymakers are still reluctant to consider the tensions at play. Here, we identify some such tensions and identify key considerations and challenges for liberal-democratic policymakers as they devise future cyberspace policies.

There is certainly some tension between internet security and internet openness, as we just referenced. Firewalls, email filters, and other components of a network defense are in fact designed to restrict the open flow of information for purposes of security. These technical interventions on the network’s architecture explicitly make infrastructure aware (or otherwise the opposite of oblivious) of the traffic traversing it. Even at the internet’s content level, allowing anything to be transmitted anywhere, by any user, empowers the spread of propaganda and disinformation in addition to child pornography and other illegal or undesirable information. This raises a key question for liberal-democratic policymakers: how closed are they willing to make the internet in the name of security? Some democracies, notably the United Kingdom, are beginning to realize the value in nationally-coordinated cyber defenses, in this case through national filtering of low-level threats like phishing emails.¹⁰¹ While authoritarian approaches to internet openness, like China’s Golden Shield and Great Firewall, similarly manipulate the openness of architecture to filter out malicious traffic, the operative difference is in the definition of malicious traffic—or essentially the instructions for the national firewall. This is a prime example of how liberal-democratic policymakers must examine the tensions between internet security and internet openness in order to find their ideal balance in policies and processes.

The resilience of data may similarly be in tension with security. Ensuring the persistence of all packets sent across a network enables a version of all worms, viruses, and other malware to indefinitely reside on the global internet. On the other hand, ensuring resilience of internet routers can prevent botnets like Mirai¹⁰² from disabling large components of a nation’s internet. Resilience harms security in the former case but supports security in the latter, indicating that different elements of the Architecture Tier may therefore expose different tensions or compatibilities between resilience and security. Again, no network is going to be entirely resilient or entirely secure. The objective, instead, should be striking an optimal balance between the two.

Interoperability can arguably help and harm security at once. Having interoperable communications (e.g., network protocols) can enable stronger security between devices and thus across entire networks and systems (e.g., through standardized encryption). Within single government or corporate systems, interoperability of devices and programs enables integrated security defenses such as packet filtering and secure data management. Conversely, wireless interoperability that enables device and network communication permits hackers to easily hop from one to device to the next, essentially using a single entry point to seamlessly cascade down a string of networks and devices. As smartphones and the internet of things (IoT) increase interconnectivity, for example, the risk of remote and/or data-based attacks that exploit interoperability also grows. This is by definition a tension as both realities exist in tandem. The interoperability of the global network is also what allows nation-states to attack one another from within their own countries.

Interoperability supports openness insofar as it enables the flow of data through neutral systems, and it supports resilience insofar as it allows devices, systems, and networks to rely on each other for resource protection and thus maintain constant availability. But to what extent does interoperability allow content restriction through centralized surveillance, thus harming the principle of internet freedom?

Freedom and openness are intertwined. Laws and regulations that restrict freedom of access to or expression of information will often be implemented via architectural interventions that limit openness. In other words, nation-states often approach the same organizations to censor content (restricting freedom) as they allow to violate net neutrality (restricting openness): ISPs and IXPs. Further, once an organization begins filtering content for purposes of censorship, it’s not a far step to scan the content for purposes of speed throttling or price discrimination (e.g., violating net neutrality). There is a clear distinction between the two in nation-states like Iran, which slow connections to foreign sites rather than censoring them entirely,¹⁰³ but the challenges to freedom and openness are again closely related. This perhaps explains the frequent grouping of a free and open internet in liberal-democratic policy documents.¹⁰⁴

The goal of this framework is to help build greater understanding of where the current internet departs from the idealized version in liberal-democratic foreign policy. We highlight a number of tensions here, but there are a lot more to be explored. Notably, complete security appears to clash with each and every one of the other principles at various levels of architecture and in the governance tier. In part for this reason, the urgency with which liberal-democratic governments must start with these types of questions, even if at high levels, is great. Understanding what stance to take towards each of these five characteristics is contingent upon an understanding of the underlying tensions. If we want better security, for instance, we have to sacrifice some openness.

The purpose of this exercise—and the tensions identified herein—is not to highlight contradictions for the sake of highlighting contradictions. Rather, the goal is to help liberal-democratic policymakers understand where the internet is currently, where it could be headed, and the implications of those directions. The ultimate goal is to help policymakers understand these tensions so they might be effectively balanced in a more cohesive and coherent strategy.

In order to demonstrate our methodology to inform the analysis of this report and provide an example of how the framework could be applied by others we are providing our full mapping in this attachment: Appendix – The Idealized Internet vs. Internet Realities.