Deterrence and Norms to Foster Stability in Cyberspace

International Review of Law, Computers & Technology, 2018

The paper argues that the obligation of States to prevent harmful international activities perpetrated within their territory, or any other area under their exclusive control, applies to activities conducted in cyber space. Thus, a State is bound by an obligation to prevent detrimental cyber conduct committed from its territory or transiting through its territory, or any other area under its exclusive control, when it knows or should have known of the conduct, when the conduct contradicts the rights of another State, and when it may cause or is causing serious harm. Where a State is aware or should have been aware of the misuse of its territorial cyber infrastructure, the State must attempt to prevent or to react to the harmful transboundary operation, applying all reasonable measures. The content of the obligation of due diligence to prevent damaging crossborder cyber activities depends on the economic, financial and human resources of the State. The paper concludes that the obligation to preclude harmful international cyber operations constitutes only a first step in securing information and communication technology and should be sustained and improved by the introduction of a treaty on cyber security.

Nação e Defesa, 2022

What are the leading obstacles to reaching a consensus on international norms that regulate state-sponsored cyber-offences? This type of operation increases swiftly, whilst issues related to international law go unnoticed, are poorly understood, or are manipulated, clouding the debate on norms of international conduct in cyberspace. This article analyses the main obstacles to regulating such cyber-offences. It argues that the main difficulties concern statecraft and state power promotion, not novelty or innovation speed, ideological or technological issues, as usually claimed. The analysis encompasses the applicability of the current rules of armed conflicts to the cyberspace context, the perspectives and positions regarding multilateral conventions, the option for bilateral or regional agreements and the normalisation of some cyber-activities as means of influencing consuetudinary law. It is shown that some nations advocate for maintaining the status quo that favours them, whilst others insist on the need for specific regulations.

Juridical Tribune, 2021

After the international legal community widely endorsed the application of international law to cyberspace, many open questions remain on the concrete interpretation of existing rights and obligations to the cyber realm. In pursuit of its mandate to promote human rights and conflict prevention, the OSCE can play a major role to support operationalization of international law and application of existing principles to cyberspace. This paper examines some key steps in the aftermath of the creation of norms of behavior, and transparency and confidence-building measures. After a brief analysis of the normcreation process, this piece identifies several pressing cybersecurity challenges on the international landscape, and offers suggestions for consolidating the voluntary non-binding norms States agreed upon. Using lessons learned from other domains, the analysis will focus on mechanisms of building further stability and transparency in cyberspace, in particular by reference to the due dil...

Cyber aggression is an increasing threat to international security and stability. While national policies intended to deter cyber aggression may offer some solution in the short term, their effects in the long term are doubtful. National cyber-deterrence policies entail the risk of an ongoing cyber arms race and a cycle of escalation between potential cyber opponents. Diplomacy may offer fewer results in the short term, but it is more promising in the long term. Confidence-building measures and international norms and values may not be easy to reach, but in the end they could be more effective (and cheaper) than a single focus on national cyber-deterrence strategies. In the long term, cooperation between states to establish confidence and commonly accepted norms of behaviour in cyber space are the most promising ways available to achieve enduring cyber security and stability. Enhancing interstate cooperation , transparency and predictability of behaviour in cyberspace will reduce the risks of misperception, escalation and conflict.

There are few more critical questions in the field of cyber security than the issue of how to prevent malicious cyber actions and the utility of deterrence in the cyber domain. For many, deterrence will protect us from an uncertain cyber future. Yet, the proliferation of scholars and academics conceptually stretching an age old or nuclear era concept to the new domain prevents the development of logics that might be more applicable and progressive in this transformative digital age. Put simply, cyber deterrence is logically problematic, empirically unsupported, and impractical to put into practice in cyberspace. The most powerful states in the world, conventionally or in terms of cyber power, are constantly attacked and probed, yet their capabilities do not deter the adversary given the conditions of the cyber framework. Building more powerful systems, making clear the threats and consequences of actions, or extending the threats to conventional actions will not save deterrence and make it work. Instead the concept of restraint offers a more viable perspective by which to understand cyber conflict dynamics and perhaps offers a better way to manage future interactions. This article explores the evolution of the concept, its application to the cyber domain, the problems with its implementation and logic, and the policy implications of our inability to move beyond the concept. By giving up the crutch of deterrence, strategists can finally focus on the important tasks required in the cyber domain-defenses, hygiene, understanding restraint dynamics, and shared norms and institutions that might make a cyber future a safe one. A clear intellectual debt is owed to

2017

2020

Cyber norms and other ways to regulate responsible state behavior in cyberspace is a fast-moving political and diplomatic field. The academic study of these processes is varied and interdisciplinary, but much of the literature has been organized according to discipline. Seeking to cross disciplinary boundaries, this timely book brings together researchers in fields ranging from international law, international relations, and political science to business studies and philosophy to explore the theme of responsible state behavior in cyberspace. . Divided into three parts, Governing Cyberspace first looks at current debates in and about international law and diplomacy in cyberspace. How does international law regulate state behaviour and what are its limits? How do cyber superpowers like China and Russia shape their foreign policy in relation to cyberspace? The second focuses on power and governance. What is the role for international organisations like NATO or for substate actors like ...

Several indicators point to a crisis at the heart of the emerging area of international cyber security law. First, proposals of internationally binding treaties by the leading stakeholders, including China and Russia, have been met with little enthusiasm by other states, and are generally seen as having limited prospects of success. Second, states are extremely reluctant to commit themselves to specific interpretations of controversial legal questions and thus to express their cyber opinio juris. Third, instead of interpreting or developing rules, state representatives seek refuge in the more ambiguous term 'norms'. This article argues that the reluctance of states to engage themselves in international law-making has generated a power vacuum, lending credence to claims that international law fails in addressing modern challenges posed by the rapid technological development. In response, several non-state-driven norm-making initiatives have sought to fill the void, including Microsoft's cyber norms proposals and the Tallinn Manual project. The article then contends that this emerging body of non-binding norms presents states with a critical window of opportunity to reclaim a central law-making position, similarly to historical precedents including the development of legal regimes for Antarctica and nuclear safety. Whether the supposed crisis will lead to the demise of interstate cyberspace governance or to a recalibration of legal approaches will thus be decided in the near future. States should assume a central role if they want to ensure that the existing power vacuum is not exploited in a way that would upset their ability to achieve their strategic and political goals.

2018

The current state of affairs can be described as an intermediate phase in cybersecurity diplomacy: states have made considerable efforts to develop international cyber law, but it was proved impossible to agree on legally binding rules. The most likely scenario for now is that states will closely follow the initiatives of non-state actors and eventually include the most appropriate norms into intergovernmental discussions. At the moment, groups of like-minded states are diametrically opposed in their vision of cybersecurity and are not ready to give up their relative freedom of action in cyberspace for the sake of universal security and stability. In the absence of common rules of conduct, businesses are left to follow their own defined standards and rules of cybersecurity to reduce the costs of cyberattacks to a certain extent

Cyber-deterrence has become a fashionable concept, and there has been a wealth of literature and polemic produced which seeks to simplify it, sell it as an applicable theory and fight for its insertion into national security strategies; most zealously in the United States. It is a grafting of the theory of nuclear deterrence which underpinned and ‘stabilised’ the Cold War. In the modern era of ‘new security challenges’, especially those threats posed through the cyber-domain (cyber-espionage, cyber-warfare, cyber-attacks, computer network exploits/ attacks, hacking and cyber-vandalism, theft of industrial/ state secrets, and so on) deterrence has enjoyed a renaissance. The argument is that deterrence by punishment as a theory worked under the auspices of the Cold War - when applied to cyber-warfare and the cyber-realm it becomes unfeasible, and in practice its ability to navigate and function within the virtual terrain is restricted. Its linearity and determinism mean that the underpinning assumptions of state-centrism, US/ Western state forms of rationality, and the omniscience implicit in ‘knowing your enemy’ do not, in the cyber-realm, fit (through the plurality of actors, range of targets and space for irrational actions or vandalism or folly) and therefore, centrally, the foundations which allow the theory to operate in reality cannot gain traction or make headway. As such, the theory is stranded.