Maintaining Private, Professional Control over Cyber Security Standards. Perhaps the most fundamental of all issues in considering whether to support international agree- ments that allocate significant functions related to cyber systems to an IGO is who would participate in developing and approving standards, and how the IGO would relate to existing organizations such as the IETF, ETSI, and ICANN. The current, dominant role of private individuals, entities, and compa- xxxx in creating, managing, developing, and defending the cyber infrastructure is one of its defining features. The creation of an IGO need not—and in our view should not—entail a shift in the power to perform those functions from the private, volunteer and professional entities and forces that currently dominate cyber standard-setting, to international appointees who may lack the expertise and commit- ment that private groups have provided since the Internet was created. Such a shift would generate tremendous resistance, since it might place control of standard setting in persons with particular politi- cal allegiances inconsistent with universal access and technological progress. Great expertise has been developed regarding cyber threats and security, moreover, within existing private-sector entities, and the support and involvement of these experts would improve the prospect that policies and rules proposed internationally will reflect industry needs and professional opinion rather than political objectives and professionally inadequate conclusions. Instead of a shift in power, the assignment to an IGO of authority over cyber-security issues could (and should) be fashioned so that it creates a complementary source of power to existing arrangements. An international treaty establishing a specialized agency to regulate cyber security can be fashioned in a manner that preserves private sector influence over the development of cyber system rules. Many multilateral treaty regimes convey substantial influence—amounting in some instances to effective control of key issues—to private sector representatives or entities. The established method for dealing with subject matter that requires “a great deal of technical knowledge” is to grant authority to com- mittees of private-sector experts to fashion technical standards.69 In ICAO, for example, the 33 member Council is empowered to adopt standards and practices, but these standards and practices must first be considered and recommended to the Council by the Air Navigation Commission (Chicago Conven- tion, Art. 56), a bod...
