Cybersecurity, National Security and Trade in the Digital Era

This note considers the nature of the cybersecurity concerns that have been raised in the decoupling debate and their implications for national security, contrasts those with the nature of the national security concerns that have traditionally been included in the rules-based trade framework, and draws conclusions about the implications for the design of a national security exception for the age of data that allows a high degree of flow of data across borders, including across geopolitical fault lines. The framing of the WTO national security exception reflects the strategic and economic considerations that shaped national security interests at the time of the creation of the GATT. The context in 2021 is very different from that in 1947 – and going forward it will be perhaps inconceivably more different. First, the “made in the world” system of production which evolved under the WTO in a unipolar security context is newly vulnerable to the weaponization of trade and investment links that cross these divides in a newly multipolar world. Second, entirely new language is required to craft national security exceptions tailored for a digital environment where measures are not triggered by “emergencies” but must address an environment of continuous threat; where “attacks” are hard to attribute, making it difficult to distinguish state-to-state actions from ordinary criminal activity; and where the consequences are highly skewed, with most being trivial from a national security perspective – but outlier extreme events cannot be excluded. Third, the way we reconcile trade and security in the new setting may need a fundamental adjustment, by renegotiating commitments to reflect the new reality of cyber vulnerabilities in a multipolar order and to shift the emphasis in dispute settlement from a hard legalism to a more diplomacy-based approach, given that the attribution problem makes it well nigh impossible to address individual cases through state-to-state dispute settlement, especially in a context where ordinary rules of evidence cannot be expected to apply, since everything will be confidential