Cybersecurity, Multilateral Export Control, and Standard Setting Arrangements

Abstract

This chapter focuses on two trade mechanisms and their role in pursuing the policy imperatives of promoting international trade in information and communication technologies (ICTs) while seeking to mitigate cybersecurity risks. The first mechanism, international standard setting and certification efforts, aims to facilitate international trade by providing benchmarks and assurances for security features. In contrast, the second mechanism, international export controls, explicitly seeks to restrict the trade in certain ICT goods for national and international security purposes. The chapter begins by introducing the concepts of standards and certification, and surveying the landscape of cybersecurity standard setting before providing a discussion of the major intergovernmental certification scheme, the Common Criteria Recognition Arrangement. It then looks at the Wassenaar Arrangement and examines its recent experience in bringing two types of technologies, intellectual property (IP) surveillance systems and intrusion software, under the purview of export controls.