The Internet Freedom LeagueSeptember/October 2019 189
controls up to the Schengen standards. Four ¤ members—Bulgaria,
Croatia, Cyprus, and Romania—have not been allowed to join the
Schengen area partly because they have failed to meet those stan-
dards. Bulgaria and Romania, however, are in the process o im-
proving their border controls so that they can join. In other words,
the incentives are working.
But these kinds o incentives have been lacking in every attempt to
bring the international community together to address cybercrime,
economic espionage, and other ills o the digital age. The most suc-
cessful o these eorts, the Council o Europe’s Convention on Cyber-
crime (also known as the Budapest Convention), sets out all the
reasonable actions that states should undertake to combat cybercrime.
It provides model laws, improved coordination mechanisms, and
streamlined extradition procedures. Sixty-one countries have rati¿ed
the treaty. Yet it is hard to ¿nd defenders o the Budapest Convention,
because it hasn’t worked: it doesn’t oer any real bene¿ts to joining or
any real consequences for failing to live up to the obligations it creates.
For the Internet Freedom League to work, it would have to avoid
that pitfall. The most eective way to pull countries into line would be
to threaten to deny them the products
and services o companies such as Am-
azon, Facebook, Google, and Microsoft
and to cut o their businesses’ access to
the wallets o hundreds o millions o
consumers in the United States and
Europe. The league would not block all
trac from nonmembers—just as the Schengen area does not shut out
all goods and services from nonmembers. For one thing, the ability to
meaningfully ¿lter out all malicious trac on a national level is be-
yond the capability o technology today. Moreover, doing so would
require that governments have the ability to decrypt trac, which
would do more to harm security than to help it and would infringe on
privacy and civil liberties. But the league would prohibit products and
services from companies and organizations known to facilitate cyber-
crime in nonmember countries, as well as block trac from rule-
breaking Internet service providers in nonmember states.
For example, imagine i Ukraine, a well-known safe haven for cyber-
criminals, were threatened with being shut out from access to the
kinds o services on which its citizens, companies, and government
China and Russia can
either follow the rules, or
they can get cut o.