“What Did Biden Achieve in Geneva?” Joseph S. Nye, Jr., Project Syndicate, 07.07.21. The author, a professor at Harvard University, writes:

• Even if formal [cyber] arms control treaties are unworkable, it may still be possible to set limits on certain types of civilian targets, and to negotiate rough rules of the road. For example, despite deep ideological differences, in 1972 the US and the Soviet Union negotiated an Incidents at Sea Agreement to limit naval behavior that might lead to dangerous escalation. Espionage is not against international law, and an agreement to ban it would not be credible. Nonetheless, the US and Russia might negotiate limits to their behavior regarding the extent (not the existence) of their cyber spying. Or they might agree to set limits on their intervention in each other’s domestic political processes. Even if there is no agreement on precise definitions, they could exchange unilateral statements about areas of self-restraint and establish a regular consultative process to contain conflict. This seems to have been the approach explored by Biden in Geneva. According to press accounts, Biden handed Putin a list of 16 areas of critical infrastructure – including energy, health, information technology, financial services, chemicals, and communications – that he said “should be off limits to attack, period.” 
• [In his comments on] the ransomware attack on Colonial to the Russian government… Biden was implying a deterrent threat if Russia continued to violate the voluntary norms prohibiting attacks on civilian infrastructure and use of its territory for harmful purposes.  Putin is smart, and he certainly heard the message, but whether Russian behavior will improve depends on Biden’s credibility. Drawing red lines can be tricky. Some critics worry that by specifying what needed to be protected, Biden might have implied that other areas were fair game. Moreover, red lines must be enforced to be effective. ... The US will need to state unilaterally the norms that it pledges to stand by. When Russia crosses such a line, America will have to be prepared with targeted retaliation. 
• Criminal groups often act as state proxies in varying degrees, and the US will have to make clear that acting as a haven for cyber criminals will lead to retaliation. And because the rules of the road will never be perfect, they must be accompanied by a regular consultative process that establishes a framework for warning and negotiation. Whether Biden succeeded in launching such a process in Geneva, or whether Russian and American cyber relations will remain their bad normal, may well become clearer in the coming months. 

Photo by Gage Skidmore, shared under a Creative Commons license. The opinions expressed herein are solely those of the authors.