Cyber Norms Research Articles

Norm diffusion in cyber governance: China as an emerging norm entrepreneur?

Abstract In light of China's growing weight as a technological power in the international arena, an increasing body of literature is dedicated to conceptualizing China as a nascent norm-shaper in global cyber governance. However, a nuanced investigation into the process of China's norm diffusion in cyber governance has been lacking. Drawing on the latest advancements from norm diffusion theory, this study provides a nuanced understanding of the complex and multidimensional nature of China's cyber-governance norm cluster and the diffusion mechanisms. By contesting the linear and static conceptualization of norms, this study conceptualizes China's cyber governance norms through the lens of norm cluster. It demonstrates that China has actively promoted a constellation of values and appropriate behaviours in order to address the myriad of problems and challenges it identifies in global cyber governance, revolving around three core values, namely: cyber sovereignty, multilateralism and the balance between security and development. This research also demonstrates that instead of using a single diffusion mechanism, China has relied on a dynamic combination of socialization and positive incentives which are driven by both state-led actors and private sectors to diffuse its cyber norms and approaches at regional and international levels.

Cybersecurity and the Future of International Relations

This research examines the growing influence of cybersecurity on international relations, focusing on how cyber threats, digital espionage, and cyber warfare are transforming state sovereignty, diplomacy, and global security. With the rise of state-sponsored cyberattacks and the increasing involvement of non-state actors, cybersecurity has become a central issue in the global power dynamics between major nation-states and international organizations. The study analyzes high-profile cyber incidents, such as the SolarWinds and Stuxnet attacks, and investigates their geopolitical implications, including how they have reshaped cyber norms and governance strategies. Through a comparative analysis of national cybersecurity strategies in countries like the U.S., China, and the EU, this research assesses the effectiveness of current international treaties, such as the Budapest Convention on Cybercrime, and multilateral efforts to establish cybersecurity norms. Preliminary findings suggest that cybersecurity has evolved into a strategic tool in global competition, with cyberattacks being used for coercion and disruption. Moreover, the rise of cyber espionage has heightened the stakes in digital diplomacy, leading to the establishment of specialized cyber units within foreign ministries. This study advocates for the development of comprehensive international treaties focused on cyber governance, with an emphasis on conflict prevention, cyber deterrence, and collective defense mechanisms. Additionally, it calls for greater involvement of multilateral organizations, such as the United Nations and NATO, in creating transparent and accountable frameworks for state-sponsored cyber activities. The research underscores the urgent need for cohesive global governance models to address the complex challenges posed by cybersecurity in shaping the future of international relations.

Global Cyber Norms Subsidiarity (UN GGE and UN OEWG) within ASEAN’s Body

In the context of cybersecurity, ASEAN plays an important role as a normative extension that carries out norm subsidiarity of UN global cyber norms generated from UN GGE and UN OEWG processes. The subsidiarity of norms promoted by ASEAN serves to place any kind of global issues and global interest at the regional level, as well as regional issues and regional interest at the global level. This paper focuses on the implications of ASEAN as a regional institution in the context of cyber norm subsidiarity toward UN global cyber norms. This paper utilizes Acharya’s norm subsidiarity to explain how ASEAN performs a norm subsidiarity of UN’s cybersecurity norms. We argue that ASEAN’s norm subsidiarity role is possible due to the fact that the UN’s cybersecurity norms to regulate the responsible state behavior in cyberspace from the UN GGE and UN OEWG process were symmetrical to ASEAN Way’s emphasis on prioritization member states’ sovereignty and non-intervention principles. Furthermore, this article finds that the implication of ASEAN’s norm subsidiarity to the region’s own cybersecurity accomplishment is still unidentifiable. This article also finds that there are many factors affecting the process of norm subsidiarity in ASEAN, such as the heterogeneity within the institution and the lack of political will of the member states.

The Institutionalisation of Security Norms in the Context of Cyber Alignments: The Transatlantic Alignment in the Cyber Domain

Realists argue that security alliances are established to confront military threats posed by one state to others. In contrast, this study argues that nonmilitary cyberthreats have become a factor in establishing new security arrangements that do not necessarily take the form of an alliance, but rather emerge in the form of alignments. Cyberthreats lie in the political, economic, societal and military repercussions caused by the employment of cyber technologies, not these technologies themselves. Therefore, alignments are not automatic reflections of cyber capabilities, but depend on common perceptions and meanings that identify a certain behaviour as a security threat. The transatlantic alignment in the cyber domain, having been produced by common EU and US cyber norms, represents this type of security alignment. These norms have constructed common meanings and perceptions of cyberthreat patterns, which are primarily embodied in Chinese and Russian policies and behaviour in the cyber domain, involving a set of alternative and competing norms to those adopted by the former two, and through which China and Russia seek to alter the structure of the prevailing international order.

A BRIEF STUDY OF INTERNATIONAL LAW IN THE AGE OF CYBERSECURITY

The rapid evolution of cyberspace has transformed the global landscape, giving rise to a complex and interconnected digital realm. As nations and individuals increasingly rely on digital technologies, the need to establish a robust framework for cybersecurity within the realm of international law has become paramount. This paper explores the evolving landscape of international law in the age of cybersecurity, focusing on key challenges, developments, and the imperative for international cooperation. The digital domain transcends geographical boundaries, making traditional notions of state sovereignty and jurisdiction inadequate for addressing cyber threats. This has necessitated the development of international norms and regulations to govern cyberspace. The paper delves into the prominent developments in international law, including the Tallinn Manual and the United Nations Group of Governmental Experts, which have sought to clarify the application of existing legal principles to cyberspace. Cybersecurity challenges such as state-sponsored cyberattacks, cyber espionage, and the weaponization of information have strained the existing framework of international law. The paper discusses the critical need for a consensus on defining cyberattacks and determining proportionate responses in accordance with the principles of self-defense and the law of armed conflict. Furthermore, this paper emphasizes the importance of international cooperation and the role of multilateral organizations in promoting cyber stability. It explores the potential for global cyber norms and confidence-building measures to enhance international security and reduce the risk of cyber conflict. However, as the digital age continues to reshape the global landscape, the adaptation and evolution of international law in response to cybersecurity challenges is imperative. The paper highlights the ongoing developments and challenges in this arena, underscoring the necessity for collaborative efforts among nations to establish a secure and stable digital environment for all. KEYWORDS: Cybersecurity, International Law, Cyberspace, Norms, Cooperation

New Norms for AI: Zero Trust—Verify Then Trust

This conceptual article highlights an important puzzle concerning the actions of prominent AI industry leaders calling for a six-month halt to the further development and training of AI, while some have already deployed and continue to deploy AI; a so-called arms race. As security risks increase at scale, managing the security of AI is an essential consideration. Although implementing standards for AI is currently a preferred solution for many, this article argues that, on their own, standards may not provide sufficient capability and flexibility. An argument is presented that cyber norms of zero trust for AI (ZTAI) alongside standards are essential for the security of AI, along with a call to action.

Towards Norms for State Responsibilities regarding Online Disinformation and Influence Operations

The Internet has provided a global mass communication system, and in particular social media technologies began a social revolution for the public sphere. However, these platforms have been exploited for the purposes of influence operations and disinformation campaigns to hinder or subvert national decision-making processes by affecting the policy makers, voters, or swaying general public opinion. Often this is achieved through manipulative means falling within a grey area of international and constitutional systems. Existing proposed normative frameworks for responsible state behaviour in Cyberspace have tended to focus on cyber operations. While online influence operations are recognised as a concern, they were not explicitly discussed in the frameworks, resulting in knowledge gaps related to countering influence operations and disinformation. There is a growing narrative that influence operations and disinformation campaigns are a cyber security issue and nations sometimes include legislation related to disinformation in cyber security. This indicates that existing cyber norms can be used to guide the development of norms for addressing disinformation and influence operations. This paper aims to propose a normative framework for state responsibility relating to influence operations emerging from thematic analysis of existing cyber norms and research on mitigating influence operations.

Cyber-attacks and the right of self-defense: a case study of the Netherlands

Whilst Article 51 of the UN Charter as a rule indicates that an “armed attack” may trigger a State’s right of self-defense, the actual purport of armed attack remains a matter of interpretation and qualification. To improve the notion of the rule on self-defense and contribute to the jus ad bellum, more clarification as to what constitutes an armed attack in cyberspace is necessary. Therefore, policy norms—regarding when cyber-attacks reach the threshold of an armed attack—could guide State behavior. On the one hand, these policy norms could be used in the political decision-making processes for States that consider initiating cyber-attacks. On the other, they could help victim States in their decision-making processes in response to grave cyber-attacks. The aim of the paper is to propose a tangible guideline that outlines when cyber-attacks—perpetrated solely in or through cyberspace and not in conjunction with conventional military attacks—can qualify as an armed attack. By assessing the positions of States and leading academic opinions regarding the qualification of cyber-attacks as armed attacks, and applying international and interdisciplinary policy documents to transfer the legal debate into tangible options, a policy framework is deduced that can serve as a baseline for international cyber norms. This framework distinguishes three separate categories of armed attack in cyberspace, each with their own distinctive levels to determine when a cyber-attack can qualify as an armed attack. These absolute levels are tailored for the Netherlands but could also be suitable for other States when transferred to percentages of the gross national/domestic product and the population size.

Great power narratives on the challenges of cyber norm building

States, companies and civil society actors broadly agree that ICT misuse needs to be prevented through effective international policies and regulatory efforts. However, corresponding norm-building processes have been repeatedly characterized by setbacks and controversies regarding interpretations. Whenever such a situation has arisen, state representatives quickly engaged in intense storytelling, accusing their counterparts of seeking to impose “the law of the jungle” or of following hidden policy agendas at the UN. This paper focusses on the stories state representatives use to explain the international community’s recurrent failures, such as arms races, crisis escalations or destructive criminal acts. Using narrative concepts and methods, the analysis explores the dynamics of this emerging transnational public diplomacy, focusing on Russia and the United States in particular. Beyond comparing main structural elements of each narrative, the goal is to elucidate legitimization strategies and dilemmas, resulting in several policy implications. For example, United States representatives and allies need to make specific and concise references to UN cyber norms during public attributions, lest they could play into the hands of a counter-narrative of Western domination and hypocrisy.

The Power of Beliefs in US Cyber Strategy: The Evolving Role of Deterrence, Norms, and Escalation

AbstractCyberspace's role in military power is vociferously debated. But how do these ideas manifest in cyber strategy? In this article, we trace the development of ideas about military cyber power, with a focus on the USA. In particular, we use a decade of US defense cyber strategies as a lens to explore how ideas about the role of the military in promoting cyber norms, the feasibility of cyber deterrence, and the risks of escalation have morphed over time. In doing so, we identify sources of continuity and discontinuity. We then turn to the academic literature to evaluate those ideas and appraise US defense cyber strategies, identifying gaps and tensions. Finally, we leverage these insights to provide recommendations for future US defense cyber strategies.

Cyber Operations in South America

South American countries have been leading on global international peace and disarmament initiatives, but the analysis of cyber operations frameworks across four of the most developed States in the region (Argentina, Brazil, Chile, and Colombia) shows the need for more transparency in how cyber operations are regulated in these countries, especially around their commitment to existing cyber norms. At the same time, lack of an incremental approach and lack of a better regulatory framework for cyber operations performed by these countries also present a risk. These tasks are currently performed mostly by their intelligence services with few legal safeguards, without proper political authorisation, and blurry boundaries with law enforcement agencies. These elements create a high risk for escalation in case of cyber-attacks, and need to be urgently addressed by those States.

Back to the Roots: The Laws of Neutrality and the Future of Due Diligence in Cyberspace

Abstract The question of whether the due diligence rule applies in cyberspace has become a key issue in the cyber norms debate. Yet there is no consensus whether the rule is binding, and states lack clear guidance on what the norm requires them to do. This is not just unfortunate but also dangerous since a crisis caused by a cyber attack routed through a third state where the victim state and the third state have fundamentally different views as to which duties apply carries a serious escalation risk. While scholars have suggested adapting legal approaches from other successful due diligence regimes, these rules are not a good match for the crucial issue in cyber due diligence: what do states need to do to ensure that no state is attacked using their networks? This article suggests going back to the roots and implementing principles derived from the laws of neutrality, the field that originally brought the due diligence principle into international law. Designed to manage escalation risk at the fringes of international conflict, it is our best guide through the grey zone of due diligence in cyberspace. The classic cases such as Alabama and Corfu Channel were disputes related to armed conflicts but between states that were at peace with each other. Read closely, they offer clear guidance on how to develop a flexible, but reliable, due diligence standard for cyberspace that will help states manage expectations of responsible behaviour and thereby defuse future potential conflicts before they arise, while avoiding the need to formally attribute the original attack. The final section will seek to consolidate the historical, legal as well as technological developments discussed here to lay out what the due diligence rule in cyberspace is likely to look like soon.

China’s use of rhetorical adaptation in development of a global cyber order: a case study of the norm of the protection of the public core of the internet

ABSTRACT How does China shape a global information order, regarding the norms and institutions that manage cyberspace? Cyber norms are the preferred tool to govern cyberspace given the rapidity of technological change. China’s advances ‘cyber sovereignty’ (wangluo zhuquan) norms to reorient internet governance to the United Nations and specialist state-led international fora and emphasise the dominant position of the state regarding information management. The paper uses a critical case study of a foundational cyber norm: the protection of the public core of the internet, which focuses on ‘safeguarding the functionality and integrity of the core logical and physical infrastructure of the internet from unwarranted state interventions’ (Broeders 2017a). Using descriptive research drawing from primary and secondary sources in Chinese and English languages, I highlight China’s use of rhetorical adaptation – a strategy and set of tactics that simultaneously modify norm content while also deflecting and reducing critiques of norm obstructionism to modify cyber norms. China’s use of rhetorical adaptation renovates norm content by centring the state as the public core of the internet that must be protected – in short internet infrastructure security is in service to state security.

Cyber Security Norms: Trust and Cooperation

As cyber crime becomes ever more sophisticated and a significant asymmetric threat, the need for effective cyber security is of vital importance. One important cyber security response is through cyber norms. At the same time, calls for multi-sector and multi-domain trust and cooperation are widespread. Yet research on the nature of trust and cooperation in cyber security norms appears to be underdeveloped. Key questions remain concerning the emergence and nature of trust and cooperation in norms. In addressing this gap, the article first considers how we can understand trust and cooperation in cyber norms through leveraging well-established theory from management research on trust building. Next, the paper examines the SolarWinds breach, as an example, to evaluate norms, trust and cooperation. The paper then applies principles from prominent trust-building theory to examine the antecedents, processes of outputs involved in building trust and cooperation. The contribution of this work presents a foundational conceptual framework, to allow the dynamics of norms, trust, and cooperation in managing cyber crime incidents to be studied. In doing so, the literature on examining trust and cooperation in norms is extended. Other researchers’ interest is encouraged as is an agenda for further research on norms, trust, and cooperation to support cyber security management. Implications may help the cyber security community as they construct and manage norms, trust, and cooperation.

An Attractive Alternative? China’s Approach to Cyber Governance and Its Implications for the Western Model

ABSTRACT China’s cyber norm-building efforts can be usefully explored based on the concept of the norm life cycle developed by Finnemore and Sikkink. Although China puts cyber sovereignty and government involvement at the core of its cyber governance approach, its Internet policies are a result of interactions between state agencies and business units, and recent reforms suggest greater involvement of Chinese companies. Moreover, many countries, including some from the West, have placed increasing emphasis on intergovernmental involvement and data sovereignty when developing their Internet policies. The EU, for instance, believes that digital sovereignty is necessary to protect its own market from US and Chinese technology giants. Despite the fundamental differences between Brussels's digital sovereignty and Beijing’s cyber sovereignty, the dichotomy between China’s sovereignty-oriented approach and the more open approach of Western countries is more blurred than it may appear, leading to Western countries, the EU in particular, potentially becoming more receptive to China’s cyber norms.

Revisiting past cyber operations in light of new cyber norms and interpretations of international law: inching towards lines in the sand?

ABSTRACT This article traces the evolution of interpretations of international law and international cyber norms on responsible state behaviour in cyberspace by reassessing five major – and allegedly state-led – cyber operations: Stuxnet 2010; Belgacom 2013-2014, the Ukrainian power grid 2015, the US presidential election 2016, and NotPetya 2017. Taking recent normative developments and emerging state practices as primary points of refence, it investigates how the current normative landscape can shed light on the nature, (il)legitimacy, and (un)lawfulness of these past operations. For each case, the analysis engages with: i) the elements triggering the violation of norms, principles and international law; ii) the legal and normative significance of recent sources of norms and interpretations of international law; and iii) the legal and political obstacles still lying beyond their application. Taken together, the reassessment of these cyber operations reveals how, in hindsight, the international community has come a long way in calibrating its normative language and practices in calling out irresponsible behaviour in cyberspace. With states taking small, but unprecedented, steps through public attributions and statements on international law in cyberspace, most of the past cyber operations analysed here would arguably feature an attribution in the current climate. At the same time, substantial differences in national interpretations of international law continue to stand in the way of clarity on the terms of its application. In light of this, this article ultimately suggests that cyber norms and the interpretations of international law require further granularity to become ‘lines in the sand’.

Cybernorms: Analysis of International Norms in France's Paris Call for Trust and Security in Cyberspace

Cybercrime is a crime involving computers and networks that began to develop after the Cold War. International politics also have developed through computer networks or cyberspace, especially in communication and diplomacy. Many actors who have different interests make the cybersphere unstable. Several state and non-state actors themselves have collaborated and conventions in the cyber realm. In 2018, France made a high-level declaration called the Paris Call for Trust and Security in Cyberspace to maintain stability in cyberspace. Through the Paris Call, France tries to establish an international norm in the cyber domain known as Cybernorms. This norm has been supported by several state and non-state actors. This study seeks to see the importance of the Paris Call that has been made by the French government which aims to remind the general norms of cyber that are not popular or see the formation of international norms in the cybersphere. This study uses a qualitative method with the process-tracing data analysis method used to explain change and cause-and-effect. This research argues that cyber norms are very important for state or non-state actors in maintaining the stability of the cyber world.

Cyber norms: technical extensions and technological challenges

ABSTRACT Since the late 1990s, the UN has been home to debates and negotiations on the rules, norms and principles of states' responsible behaviour in cyberspace. As these discussions matured over years, they have been taken further to different fora and have been embedded in various stakeholder initiatives. In early 2021, the Open-Ended Working Group on Developments in the Field of ICTs in the context of international security (OEWG) and the UN Group of Governmental Experts on advancing responsible state behaviour in cyberspace in the context of international security (GGE) presented their respective consensus reports, the result of over two years work. It is not only the content of this work per se that is of interest - both in what has been achieved and which parts of these mandates were less successful. These processes, historically due to the two-decades-long GGE efforts, are shaping more than just the states' commitments around cyber strategies. They help build an overarching normative environment shifting priorities in cyber risk management and contribute to the development of voluntary tech-norms, while doing this out of sync with the implications of the emerging technologies for state as well as non-state actors' accountability in cyberspace.

Look south: challenges and opportunities for the ‘rules of the road’ for cyberspace in ASEAN and the AU

ABSTRACT As the inaugural United Nations Open-Ended Working Group (UN OEWG) has not significantly updated nor advanced the ‘rules of the road’ for cyberspace, regional organizations such as the Association of Southeast Asian Nations (ASEAN) and the African Union (AU) provide additional venues wherein deliberations can continue among a smaller group of states. Several ASEAN and AU member states are also active participants at the UN OEWG. Nonetheless, questions remain on how and where agreement on international law and cyber norms at the regional level can be achieved. To assess the challenges and opportunities for progress, this paper examines the public positions of two ASEAN member states, Indonesia and Singapore, and two AU member states, Kenya and South Africa, during the 2019–2021 UN OEWG meetings and situates them in their respective regions. We argue that substantial progress at the regional level is challenging to achieve, due to varying attitudes and levels of technological development among states, long-standing concerns over state sovereignty, and the vital role that a highly motivated and well-resourced regional actor plays in championing the cause. Opportunities exist, however, in that ASEAN and the AU provide paths for leveraging existing partnerships on cybersecurity and building trust in the region.

“Norm Subsidiarity” or “Norm Diffusion”?

Cybercrime has been a contentious issue among security actors, vis-à-vis the extent to which international cooperation may be fostered to respond to the accelerating incidence of cyber-attacks. This paper contrasts between the cyber-governance approaches adopted by two non-Western regional organizations, the Association of Southeast Asian Nations and the Gulf Cooperation Council, over the past decade. Considering their similar institutional origins, Most Similar Systems Design methodology was employed to assess how ASEAN and GCC have distinctly responded to cybercrime. It considers the dynamics of the digital divide — a divide which is exacerbated by the COVID-19 pandemic — and in which ASEAN and the GCC are challenged to bolster their cyber-capabilities. Findings reveal that GCC increasingly diffuses norms of international cooperation to tackle cybercrime. By contrast, ASEAN embodies cyber norms which regulate behavior along the lines of intra-regional cooperation, wherein norms of international cooperation are rendered subsidiary to norms of regional autonomy.