Source: Wall Street Journal

It took the threat of sanctions and a flurry of last-minute negotiations to get China to sit down for serious talks about cybersecurity with the U.S. Now comes the hard part.

Chinese President Xi Jinping’s announcement last fall that Beijing would stop state sponsorship of hacking for commercial gain caught many by surprise. By multiple recent accounts, China has stayed true to its word. But in the area military types increasingly refer to as the “fifth domain” — after land, sea, air and space — of warfare, a cloud of questions large and tiny still loom over relations between the world’s great powers

One emerging expert on the uncertain business of cyberpolitics is Carnegie Endowment for International Peace researcher Tim Maurer, who visited Beijing in late June to meet with Chinese cybersecurity scholars. China Real Time picked Mr. Maurer’s brain on next steps for the U.S. and China, Beijing’s ambitions for managing the internet and the cybersecurity threat that worries him the most. Here are excerpts edited for length and clarity:

After the agreement between Obama and Xi, what’s the next cybersecurity question for the U.S. and China?

Now that we have an agreement, there’s a bigger strategic discussion that will continue to play out around the future of the internet and the issue of sovereignty. Topics like cloud storage and the role that multinational companies play still need to be resolved, and we still haven’t seen a resolution to some of the security issues, like backdoors and other supply-chain integrity questions, that were raised by [NSA leaker Edward] Snowden and are a concern for both countries.

China’s ​is big on this idea of Internet sovereignty–that national borders and national laws should extend into cyberspace. What does Beijing have to do to overcome political opposition in the U.S. and other countries and make that a reality?

There’s a trade-off involved for the Chinese government, I think, between security and growth. China in and of itself is a huge market and is capable of satisfying a lot of Chinese companies. But​ for global companies like Alibaba, Huawei and ZTE, ​the biggest growth opportunities are probably beyond China. This notion of technological sovereignty implies certain changes to the internet at several layers — whether it’s physical infrastructure, applications or control of content — that will increase the cost of doing business globally ​through the internet. If you look at G20 economies, the internet actually accounts for a larger share of the economy in China than in the U.S.

Where do the U.S. and China stand on question of establishing norms of behavior in cyberspace?

There are disagreements over definitions of terms like “international wrongful act” and how norms will apply in a military context, but the major tension is over whether there should be a treaty. Russia and China are pushing for one. The U.S. and other Western governments are pushing for voluntary norms instead.

Why not have a treaty? What do voluntary norms accomplish?

There’s been a gradual trend away from treaties and conventions the past few decades. One concern is that you undermine international law when you create treaties that are ineffective. That doesn’t mean you can’t have one, but there are lots of technical issues around issues like verification and enforcement. How do you determine when a violation has taken place, and how do you punish it? With voluntary norms, the idea is to to develop a standards of acceptable behavior that state actors will adhere to because it’s in their self-interest to be a part of the community, to maintain access to shared information and resources.

What will it take to get everyone to agree?

There’s already been significant progress in the last two or three years. Some people say there won’t be much more progress until there’s a major cyberattack. I think something else that might create movement is a growing threat from nonstate actors, like cybercriminals or terrorists, which is already happening.

When you survey the variety of cybersecurity threats out there, what is the biggest concern you have?

Probably the biggest concern is with the integrity of data. The vast majority of hacking incidents so far have been relatively unsophisticated stealing of data, which is the low-hanging fruit. In most instances, that’s because defenses are so bad — including at the government level. But now you’re starting to see increasingly sophisticated malware, and there’s a concern about hackers not just stealing data, but altering it.

We haven’t seen a lot of these attacks yet, but they are hard to detect and the potential damage is quite large, particularly in the financial sector. Electrical grids are confined to individual countries, but financial markets are highly interconnected. Imagine what would happen if people started losing faith in the integrity of financial data. It could have a domino effect. This is one area where we think there is potential for cooperation between states like the U.S., China and Russia.

This article originally appeared in the Wall Street Journal