The opposite is true for biological and information technology, which were first and foremost civilian technologies whose destructive potential was recognized only after their legitimate uses had been well established. Biological materials and equipment have extensive civilian uses, including in research, medicine, and agriculture. Information technology also has an unlimited number of legitimate applications. Governments have played an important role in the development and use of both technologies. The first applications of modern information technology, computers, were for military purposes such as code breaking and computations for the atomic bomb. But the most important stakeholders in both the biological and information technology areas are private entities: academic institutions, companies, and individuals.2
The nature and availability of the material and equipment, as well as the level of effort needed to use nuclear, biological, and information technology for destructive purposes, also are very different. In the case of a nuclear explosive device, the number of key materials (primarily highly enriched uranium and separated plutonium) and key technologies (enrichment and reprocessing) are limited, although other dual-use materials (such as low enriched uranium and spent fuel) and technologies (nuclear reactors) can also be used. There also are a relatively limited number of countries that possess or can supply the necessary technology. Moreover, although nonstate actors may be able to acquire a so-called dirty bomb, developing a nuclear weapon that will not only work but can be delivered successfully to a target is extremely challenging and costly and requires a dedicated national program.3
Rather than special materials or facilities, the key technology used in cyber weapons is information technology. Information technology is available wherever computers are available. Initially, the small number of computers was the determining factor in limiting hostile applications of information technology. Today, an estimated fifteen billion devices around the world are connected to the Internet, a significant portion of which are computers, and the number is growing.4 Except for high-end uses, cyber weapons also are orders of magnitude easier and cheaper to produce than nuclear explosive devices or biological weapons, as anyone with access to a computer can, in principle, develop such a weapon.
A final characteristic that has influenced the governance potential of each of these technologies is its destructive effects. Since the attacks on Hiroshima and Nagasaki in 1945, it has been clear that nuclear technology can be used to cause massive loss of life as well as physical damage. While no comparable use of biological technology has occurred, the potential impact, particularly of a highly lethal agent that can spread from person to person, also has been recognized for many years. These concerns about the mass-destruction effects of nuclear and biological weapons have helped stimulate efforts to prevent the spread and use of the relevant technologies, including the negotiation of the Treaty on the Non-Proliferation of Nuclear Weapons (NPT), the Biological Weapons Convention (BWC), and many of the other governance measures discussed in the preceding pages.
Biological technology occupies a position between nuclear and information technology on a governance continuum. Biological technology has far more civilian applications than nuclear technology, but it is not ubiquitous, as is the case with information technology. The range of biological materials and equipment that could produce a highly dangerous pathogen is much larger than with nuclear technology but, even with advances in science, not as widespread as the computers used to launch cyber attacks. The universe of actors that have a stake in biological governance continues to expand well beyond those engaged in nuclear activities but does not include every level of society, as with information technology.
Given these differences, it is not surprising that a side-by-side comparison of the types of governance measures that have been adopted in these technology areas reveals the greatest common ground between nuclear and biological technology. As Table 6 shows, various international and national measures have been adopted in an effort to prevent dual-use nuclear and biological technology from being used for weapons purposes. The NPT and the BWC have been central to these efforts, embodying both the norm against destructive applications of these technologies and the specific obligations that give it legal effect. At the national level, many countries have adopted legislation criminalizing the activities prohibited by the treaties and, in the case of the NPT, authorizing International Atomic Energy Agency (IAEA) inspections and monitoring of their civilian nuclear activities.
A much wider range of international and national efforts have sought to control access to dual-use nuclear and biological materials, equipment, and information. Some, such as the export control harmonization activities of the Zangger Committee, the Nuclear Suppliers Group (NSG), and the Australia Group, have focused on denying other countries access to technology that could be used to develop nuclear and biological weapons and thus are important complements to the NPT and BWC. Preventing the spread of weapons and related technology to other countries was also the initial aim of the U.S. Nunn-Lugar Cooperative Threat Reduction program, which helped Russia and other former Soviet republics secure nuclear, biological, and other materials, dismantle former biological weapons facilities, and redirect former weapons scientists to peaceful activities.
Many other measures, particularly since September 11, have sought to deny terrorists access to technology that could be used to develop nuclear and biological weapons. This has been done through a variety of means. For example, under United Nations Security Council Resolution (UNSCR) 1540, all UN member states are obligated to adopt national legislation to prevent terrorists from obtaining materials, equipment, and information for nuclear, biological, and other weapons. Other measures, such as the Proliferation Security Initiative (PSI) and the IAEA Illicit Trafficking Database, are designed to help countries track and interdict illegal shipments of dual-use materials. Even international industry groups have become involved, with nuclear power plant exporters and two synthetic biology industry associations committing to screen customer orders for the dual-use items they sell. On a national level, antiterrorism legislation in the United States and other countries has tightened domestic controls on biological materials and facilities, as well as on the individuals who have access to them. Similar efforts have been undertaken to ensure the security and safety of domestic nuclear facilities and materials.
Finally, international and national measures have been developed to promote the safe and secure handling and use of dual-use nuclear and biological technology. This includes guidelines on nuclear security issued by the IAEA and guidelines on biosafety and biosecurity issued by the World Health Organization (WHO). It also includes the codes of ethics and conduct promulgated by various international and national scientific organizations to discourage destructive applications of biology. In addition to these nonbinding measures, European Union (EU) member states have enacted controls on the safe handling of genetically modified organisms, based on EU regulations and directives, and Israel and Denmark have enacted legislation requiring prior review and approval of certain categories of dual-use biological research that could raise security concerns.
It is not surprising, therefore, that only a handful of governance measures have been adopted to try to prevent destructive applications of information technology. Internationally, the forty-seven states that are parties to the Budapest Convention on Cybercrime have agreed to enact national legislation criminalizing certain behaviors in cyberspace, such as unauthorized access to a computer or illegal interception of data. Many of these countries, as participants in the Wassenaar Arrangement, also control the export of certain dual-use items that could be used in cyber weapons, such as equipment related to intrusion software or network surveillance systems. At the national level, legislation in various countries also has proscribed certain unauthorized uses of information technology, including to gain access to computers or to intercept electronic communications. In the United States, a society for computer professionals, ACM, also has issued a code of ethics for its members that prohibits them from using computing technology in ways that cause harm.
As the previous chapters have shown, governance efforts in each of the three technology areas have faced serious challenges. Some are a direct result of technical considerations. This is clearly the case in the cyber area, where the absence of choke points, such as specific weapons-related materials or activities, renders efforts to govern the development of cyber weapons nearly impossible. Detecting work on nonnuclear components of nuclear weapons also is technically challenging because such activity does not have an obvious signature, unlike work with nuclear material, which leaves detectable traces.
Other challenges can be linked to scientific and technological advances. This is particularly true in the biological area, where synthetic biology is increasing the number of potential threat agents, the types of equipment used in their development, and the range of practitioners involved, thus greatly complicating efforts to control the transfer of or access to biological agents and technology.
These factors help explain the nature of the different governance measures that have been adopted in these three technology areas. They also underscore why a common governance approach is not feasible when it comes to managing the risks from dual-use technologies. This does not mean that the concept of dual-use technology is not useful and should be abandoned. On the contrary, as the previous chapters show, the concept provides a valuable analytical tool for identifying and assessing technologies that have the potential to cause large-scale loss of life or damage to commercial or economic interests even as they continue to be used for legitimate purposes. By analyzing three examples from this category of technologies, as the preceding pages have done, a number of broader lessons become apparent.
b37509886e