State Behaviour In Cyberspace Research Articles

The role of insurers in shaping international cyber-security norms about cyber-war

ABSTRACT Faced with defending against myriad online threats, businesses are increasingly turning to insurers to purchase cyber-insurance policies that will shield them from bearing the full costs of these incidents. Eager not to miss out on the expanding market, insurers have aggressively ramped up their cyber-insurance offerings, and in doing so, have assumed enormous responsibility—and power—as the arbiters of what types of state-sponsored cyber-attacks are covered by insurance. This article argues that insurance companies are influencing multilateral processes and setting de facto standards around responsible state behavior in cyberspace through their policies on risk and liability for serious cyber-operations and “cyber-war.” It approaches this issue through the lens of the 2017 Russian NotPetya cyber-attack which led to significant legal disputes between many insurers and their policyholders about whether Russia’s behavior constituted a “warlike action” and was therefore excluded from insurance coverage under standard war exclusions.

Strategic narratives and the multilateral governance of cyberspace: The cases of European Union, Russia, and India

ABSTRACT The last few years have seen the emergence of a cybersecurity regime complex divided into specialized forums discussing different sub-issues. But how do the main actors in cyberspace make sense of its fragmented governance, and how does that translate to their broader strategic narratives? Furthermore, to what extent are these in line with the predominant macro-narratives in the cyber-domain? To answer these questions, this article explores the strategic narratives of the European Union, Russia, and India in two of these specialized forums: one related to responsible state behavior in cyberspace, the other to cyber-crime. Through the study of narrative fragments — a new approach to the study of strategic narratives in multilateral settings — it concludes that these actors largely include these two issues within their broader strategic narratives. This highlights the importance of cross-issue analysis in the study of multilateral arrangements, particularly in the context of emerging regime complexes.

Towards Norms for State Responsibilities regarding Online Disinformation and Influence Operations

The Internet has provided a global mass communication system, and in particular social media technologies began a social revolution for the public sphere. However, these platforms have been exploited for the purposes of influence operations and disinformation campaigns to hinder or subvert national decision-making processes by affecting the policy makers, voters, or swaying general public opinion. Often this is achieved through manipulative means falling within a grey area of international and constitutional systems. Existing proposed normative frameworks for responsible state behaviour in Cyberspace have tended to focus on cyber operations. While online influence operations are recognised as a concern, they were not explicitly discussed in the frameworks, resulting in knowledge gaps related to countering influence operations and disinformation. There is a growing narrative that influence operations and disinformation campaigns are a cyber security issue and nations sometimes include legislation related to disinformation in cyber security. This indicates that existing cyber norms can be used to guide the development of norms for addressing disinformation and influence operations. This paper aims to propose a normative framework for state responsibility relating to influence operations emerging from thematic analysis of existing cyber norms and research on mitigating influence operations.

Election hacking, the rule of sovereignty, and deductive reasoning in customary international law

AbstractThis article considers the international laws applicable to irresponsible state behaviour in cyberspace through the lens of the problem of election hacking. The rule of sovereignty has taken centre stage in these discussions and is said to be preferred to the non-intervention rule because it evades the problem of coercion. Proponents of the cyber rule of sovereignty contend that there is such a rule; opponents reject the existence of the rule as a matter of existing law. The objective here is to explore the methodologies involved in the identification of the cyber rule of sovereignty under customary international law. The work first frames the debate in the language of regulative and constitutive rules, allowing us to show that a regulative rule of sovereignty can, logically, and necessarily, be deduced from the constitutive rule of sovereignty. The content of the regulative rule can also be deduced from the constitutive rule of sovereignty, but it has a more limited scope than claimed by the proponents of the rule, notably the Tallinn Manual 2.0. The rule of sovereignty prohibits state cyber operations carried out on the territory of the target state and remote cyber operations which involve the exercise of sovereign authority on that territory, e.g., police evidence-gathering operations. The rule of sovereignty does not, however, prohibit other remote, ex situ state cyber operations, even those targeting ICTs used for governmental functions, including the conduct of elections. The rule of sovereignty is not, then, the solution to the problem of election hacking.

State Behaviour in Cyberspace: Normative Development and Points of Contention

The increasing use of digital technologies in cyberspace in the context of international conflicts has put pressure on the existing legal framework of international law. After progress in terms of norm development and clarification could be achieved through multilateral processes at the United Nations, Russia’s invasion of Ukraine cast doubt on the possibility of further breakthroughs. In light of this development, unilateral declarations of legal positions by states will gain further relevance.

Cyber operations against critical infrastructure under norms of responsible state behaviour and international law

Abstract There has been agreement at the United Nations level about a set of norms of responsible state behaviour in cyberspace, including norm (f) which prohibits cyber operations that cause intentional damage or impairment to critical infrastructure (CI). This article examines norm (f) in light of existing international law prohibiting malicious cyber operations against CI. It argues that norm (f) introduces complexity to the application of the law in this context that is counterproductive to developing clarity about the cyber operations against CI that are prohibited by international law. This is due to the subjectivity of the concept of CI, the contradictory legal status of norm (f), and due to existing uncertainties in how international law applies to state conduct in cyberspace which are compounded by norm (f). The article concludes that states need to develop more clarity about the relationship between international law and the norms of responsible state behaviour in cyberspace, and about how international law applies to cyber operations, particularly where CI is targeted.

Russian Approaches to Regulating Use of Force in Cyberspace

Discussion in the United Nations on how international law applies to cyberspace has lasted more than two decades. Initially, the issue was raised by Russia and gained little attention by Western States; today, however, the question of state responsibility, applicability of humanitarian law and thresholds of intervention, use of force or armed attack have become a high priority for all digitalised States. Debate on the matter has, in many aspects, polarised and one of the divides occurs between Russia and Western States. This Chapter analyses the Russian approach to the applicability of international law to state behaviour in cyberspace from the perspective of Russian approaches to international law in general. In doing so, the Chapter aims to explain the sometimes-controversial positions taken by a State that is at once a world power, one of the most active cyber-actors and often in an adversarial position. Special focus is put on the Russian approach to use of force in the ICT environment.

Tracing strategic preferences in cyberspace: The role of regional and domestic strategic culture

ABSTRACT Our understanding of strategic preferences in cyberspace rests on the material and strategic factors that shape state behavior. This, however, is derived from the actions of established cyber powers. Given the material resources required to effectively operate in this environment and repeated interactions that form the boundaries of accepted behavior, the literature does not adequately explain the emergence of strategic preferences among novice actors. The article posits that these are not exclusively the function of either the material or strategic factors. Instead, strategic culture features prominently in the selection of strategic preferences that shape state behavior in cyberspace.

The Securitization of Cyberspace: From Rulemaking to Establishing Legal Regimes

With the development of information and communication technologies (ICTs), the Internet has become increasingly important in terms of national security, economic development, and global leadership. Apparently, conflicts and contentious issues in cyberspace requires creating rules and development of regulation. The authors examine the process of making up rules in cyberspace from the perspective of M. Castells’ network society theory and B. Buzan’ securitization theory. According to M. Castells, key challenges have gradually altered in the network society and power relations and social management are based on the control of communication and information which embraces a network society. Furthermore, the authors investigate the development of the Internet in the context of securitization theory. It is stressed that cyberspace has become a full-fledged political space with the central position of digital sovereignty and information security. The article for the first time proposes a comprehensive periodization of international relations’ transformation in cyberspace. Afterwards, the authors consider the appearance of tensions between actors in cyber space, which include political and economic threats. It encourages state actors to establish a preliminary regulation and to agree on norms regulating state behavior in cyberspace. These mechanisms have become a venue for promoting different concepts of cyber law and establishing legal regimes. In conclusion the authors analyze the hierarchy of actors in global Internet governance to assess the actors’ influence on the establishment of legal regimes in cyberspace. The main assessment criteria are as follows: ability to influence global production chains of high-tech goods, ability to conduct offensive and defensive cyber operations, and influence on the formation of international legal regimes. The authors divide actors into two major groups - rule-markers capable of influencing the global information space and constructing legal regimes, and rule-takers that are an object of great powers competition in cyberspace.

CYBER DIMENSION OF HYBRID WARS: ESCAPING A ‘GREY ZONE’ OF INTERNATIONAL LAW TO ADRESS ECONOMIC DAMAGES

The subject of the article is the international and national legal aspects of compensation for economic damages caused by cyber attacks. The purpose of the article is to contribute to the ongoing debate on attribution and liability for malicious and destructive cyber activity. Cyber attacks have become a global problem facing the international community, posing enormous risks to the stability of international security, economic and social development, and the safety and well-being of individuals. Cyber attacks have proven to be numerous problems for domestic and international law – international humanitarian law, human rights law, the law of armed conflict – how to counter the actions of hybrid warfare by legal means, what are the remedies for losses due to cyber attacks. This article examines cyber attacks to show how the international community is moving toward responsible behavior by states in cyberspace, protecting civilians and critical infrastructure. The article's methodology is based on doctrinal legal research in this area, as well as international legal instruments, in order to examine how economic damages should be paid to victims of malicious acts in cyberspace. The difficulty of attributing cyber attacks has been analyzed to show that perpetrators evade responsibility, a separate problem for international law. It is concluded that international law, as it currently stands, provides little legal basis for substantive guidance on responsible state behavior in cyberspace, the necessary levels of attribution to establish state or non-state responsibility for cyber attacks. Economic losses from cyber attacks can be covered by insurance schemes, although analysis has shown that they do not work because insurers argue that cyber attacks exclude military risk insurance clauses that exclude coverage, which is reasonable, although it leaves victims of cyber attacks without the ability to recover damages. The paper supplements current research with a comprehensive analysis of legal and economic issues and calls for the development of an appropriate strategic environment, legal and infrastructural framework. The need for a joint international framework is emphasized, as civil liability under national law is hardly possible because cyber attacks are predominantly transnational in nature. A joint structure is also needed to prevent, deter and respond to state-sponsored cyber attacks.

Unpacking strategic behavior in cyberspace: a schema-driven approach

AbstractThe contemporary literature on cybersecurity and related interstate interactions often cites the need to overcome uncertainty due to an inherent information deficit about cyber operations. While this notion remains relevant in studies that advance our understanding of state behavior in cyberspace, noticeable gaps persist. These stem from the limited utility of cyber operations to shift the balance of strategic power between states or to signal intent and resolve effectively. In response, this article advances a cognitive-cultural framework, wherein behavior reflects preferences derived from schema usage. Using cross-national wargames, the article illustrates the schematic use of strategic culture as a basis for deriving strategic objectives and the means of achieving these. Consequently, the article is an initial foray aimed at expanding our understanding of interstate behavior in cyberspace.

Revisiting past cyber operations in light of new cyber norms and interpretations of international law: inching towards lines in the sand?

ABSTRACT This article traces the evolution of interpretations of international law and international cyber norms on responsible state behaviour in cyberspace by reassessing five major – and allegedly state-led – cyber operations: Stuxnet 2010; Belgacom 2013-2014, the Ukrainian power grid 2015, the US presidential election 2016, and NotPetya 2017. Taking recent normative developments and emerging state practices as primary points of refence, it investigates how the current normative landscape can shed light on the nature, (il)legitimacy, and (un)lawfulness of these past operations. For each case, the analysis engages with: i) the elements triggering the violation of norms, principles and international law; ii) the legal and normative significance of recent sources of norms and interpretations of international law; and iii) the legal and political obstacles still lying beyond their application. Taken together, the reassessment of these cyber operations reveals how, in hindsight, the international community has come a long way in calibrating its normative language and practices in calling out irresponsible behaviour in cyberspace. With states taking small, but unprecedented, steps through public attributions and statements on international law in cyberspace, most of the past cyber operations analysed here would arguably feature an attribution in the current climate. At the same time, substantial differences in national interpretations of international law continue to stand in the way of clarity on the terms of its application. In light of this, this article ultimately suggests that cyber norms and the interpretations of international law require further granularity to become ‘lines in the sand’.

EU cybersecurity and cyber diplomacy

Over the last decades cybersecurity has become a cornerstone of European digital development. Alongside with the diffusion of information and communication technologies and the deepening (as well as widening) of the European Union, the initial narrow and sectoral data security policies have expanded into a comprehensive cybersecurity framework addressing issues from resilient infrastructure and technological sovereignty, through tackling cybercrime, to cyber defence capabilities and responsible state behaviour in cyberspace. In this complex web of interrelated policies a relative newcomer at the European Union (EU) level is cyber diplomacy. Sometimes also called public diplomacy 2.0, it factors into the cross-border connectivity of cyberspace and reflects a shift in international relations where the lines between external and internal policies, military and civilian domains are blurred. However, the term cyber diplomacy is fluid and it is not well understood which topics should be under its “umbrella”, in particular in relation to cybersecurity, where it seems to be linked the most. This article aims to map existing and proposed instruments that make up the EU’s arsenal in this broad context to answer the following questions: what is cyber diplomacy and how is it related to the EU cybersecurity? Is cyber diplomacy in the EU becoming something in its own right as a distinct set of tools to secure the EU policy objectives?

Cyber norms: technical extensions and technological challenges

ABSTRACT Since the late 1990s, the UN has been home to debates and negotiations on the rules, norms and principles of states' responsible behaviour in cyberspace. As these discussions matured over years, they have been taken further to different fora and have been embedded in various stakeholder initiatives. In early 2021, the Open-Ended Working Group on Developments in the Field of ICTs in the context of international security (OEWG) and the UN Group of Governmental Experts on advancing responsible state behaviour in cyberspace in the context of international security (GGE) presented their respective consensus reports, the result of over two years work. It is not only the content of this work per se that is of interest - both in what has been achieved and which parts of these mandates were less successful. These processes, historically due to the two-decades-long GGE efforts, are shaping more than just the states' commitments around cyber strategies. They help build an overarching normative environment shifting priorities in cyber risk management and contribute to the development of voluntary tech-norms, while doing this out of sync with the implications of the emerging technologies for state as well as non-state actors' accountability in cyberspace.

On the strategic consequences of digital espionage

ABSTRACT Digital espionage has Cold War origins, but states are still determining how to respond when they are found to be its latest victims. In multilateral discussions about norms of responsible state behaviour in cyberspace, digital political espionage is the elephant in the room. Like other aspects of inter-state intelligence competition, digital espionage is ‘business as usual’ but can also lead to tensions, particularly when operations become public. The strategic consequences of digital espionage appear significant, as asymmetries of state power and poor understanding of technical aspects of cyber operations lead to uncertainty about appropriate responses to ‘cyber victimhood’. We offer multiple propositions to frame state responses to digital espionage, focusing on the relational power of the victim and spying states and their bilateral relationships. States will generally respond proportionately to state-on-state digital espionage, whilst domestic-political factors pressure them to adopt more robust, cost-imposing measures that may exacerbate the strategic consequences of digital espionage. We illustrate these propositions with three recent cases – the Snowden revelations (2013); the Office of Personnel Management breach (2014); and the SolarWinds breach (2020) – and explore the importance of calibrated responses to digital political espionage for strategic stability and state behavioural norms in cyberspace.

The Networked Politics of Cybersecurity: Co-Production and Tensions around Incident Response.

Computer systems, networks and infrastructures are the foundation of a digitally connected society. They are managed and maintained by a diverse and transnational group of actors. While many cybersecurity scholars have focused on the role of states and private companies in the ‘making of cyber-security’, such emphases tend to obfuscate the plethora of practices, understandings and communities across the public-private continuum that are engaged in identifying, handling, and responding to incidents and threats. Historically, incident response has been continually associated with the role of CERTs or Computer Security Incident Response Teams (CSIRTs) – an organisation that operates as a focal point to the identification, reporting and handling of cyber incidents. These so-called — yet often-unseen —‘digital fire brigades’ or ’first responders’ (Skierka et al. 2015) possess specific communicational designs (e.g.: informal networks based on interpersonal relationships, protocols such as Common Vulnerability Scoring System and others) and jointly comprise a global network of information sharing and cooperation. However, as a practice, incident response remains perennial to the functioning of any interconnected system and infrastructure, often taking different institutional forms across public and private institutions. In addition, incident response also signifies the operation of many communities working on conducting these routine activities that are focused on the repair, maintenance, improvement and measurement/classification of cybersecurity incidents that may or may not be under a CERTs or CSIRTs. In general terms, incident response predates institutionalised forms of ‘teams’. From a system administrator monitoring networks in an institution to more offensive-facing teams such as Security Operation Centres (SOC), different communities engage in incident response. Teams have taken distinct shapes and forms in response to numerous factors that include but are not restricted to business incentives for threat-detection and more ‘active’ approaches, national cybersecurity concerns, and acceptance of widespread discourses around the lack of professional capacities as an inherent condition to contemporary cybersecurity challenges (Shires, 2018). The politics of change in incident response practices do not occur in a vaccum, rather they are co-produced (Jasanoff, 2004) in a landscape where cybersecurity has become the object of dispute in geopolitical battles, regulatory agendas, business solutions, among other areas. These changes are often enunciated in official speeches from heads of state, crystallized in government and business reports, and stabilized through the development of tools, manuals and standards that suggest new ways for conducting ‘response’. From G7 2021 declaration mentioning responsible state behaviour in cyberspace to cybersecurity manuals, incident response is a key function for coordination, resilience, and stability of cyberspace. Understanding and exploring the spectrum of political challenges reconfiguring incident response can therefore aid in better-capturing challenges in coordination and the fragmentation of efforts to respond to cyber threats. What is more, it provides a perspective of how particular representations of incident response are crystallized and the consequences that has to cybersecurity governance. So, while incident response is networked as a practice, we explore the tensions that arise in networking processes. Based on document analysis of CSIRT manuals, cybersecurity regulations and policies, and incident response literature, the paper looks at three areas where these tensions arise: professional development, regulatory advances, and geopolitical disputes. Each of these areas provides an important insight into the ways in which ‘response’ is prescribed, stabilised and networked in emergent ways – and the consequences they bring to the politics of cybersecurity. The paper is divided into three parts. First, we explore some of the factors that are shaping how incident response is practised and understood, and why this matters for understanding new configurations of cybersecurity politics. Second, the paper analyses the different ways in which incident response has been institutionalised and the impact that has to shifting the actors and practices that integrate ‘incident response’. Third, we discuss some of the ‘pressure points’ that have been contesting and reshaping the supposed borders of how and who should be involved in ‘response’.

Rethinking the African Union Non-Aggression Treaty as a Framework for Promoting Responsible State Behavior in Cyberspace

In Africa, regional organisations have established legal measures with a view to promoting norms for cybersecurity governance. However, such measures do not explicitly address State aggression in cyberspace. This appears to create legal uncertainty in determining the behavior of States with respect to activities that can constitute aggression in cyberspace. In 2005, the African Union established the Non-Aggression and Common Defense Pact to put an end to ‘conflicts of any kind within and among States in Africa’. Given the absence of an explicit regime to govern the behavior of Member States with respect to activities that can constitute aggression in cyberspace, the question arises as to whether it is possible to apply the AU Non-Aggression and Common Defense Pact for such purposes. This paper considers the prospects and challenges of applying the Pact to State behavior in cyberspace. It makes a case for the application of the Pact’s principles to promote responsible State behavior in cyberspace and suggests that such approach will enhance legal certainty with respect to activities that can constitute aggression in cyberspace.

The vital role of international law in the framework for responsible state behaviour in cyberspace

ABSTRACT This article explores the importance of international law in debates about responsible behaviour in cyberspace – in providing a rules-based framework, in legitimising states’ actions in response to unlawful activity in cyberspace by other states, and in lending normative force to statements calling out malicious cyber activity. At the same time, the article seeks to highlight the challenges involved in applying international law, and uses the application of two peacetime precepts of international law – the principle of sovereignty and the principle of non-intervention in other states’ internal affairs – to illustrate some of the doctrinal issues with which states are grappling. While acknowledging these challenges, the article concludes that even if the UN parallel processes in the form of the Open Ended Working Group and Group of Government Experts do not result in substantial agreement between states on issues of international law, the debates in themselves are valuable in encouraging states to deliberate on these issues and to make their views public. By publicising their views, states add momentum to the journey towards cyber-specific understandings of international law.

Beyond Naming and Shaming: Accusations and International Law in Cybersecurity

Abstract Accusations of bad state behaviour in cyberspace are proliferating, yet this increase in naming has not obviously produced much shame. Accused states uniformly deny the accusation or decline to comment, without changing behaviour. For international lawyers, the problem is compounded by the absence of international law in these charges. States are not invoking international law when they complain of other states’ behaviour, suggesting the law is weak – or worse, irrelevant – in holding states accountable for their cyber operations. In lieu of ‘naming and shaming’, we introduce and examine the broader concept of ‘accusation’ as a social, political and legal practice with diverse uses in cyberspace and beyond. Accusers must make strategic choices about how they frame their accusations, and we unpack various elements accusers may manipulate to their advantage. Accusations also have many purposes. They may seek to ‘name and shame’ an accused into conforming to certain behavioural expectations, but they may also aim at defensive or deterrent effects on both the accused and, crucially, on third parties. Particularly important, accusations may play a constitutive role, constructing new norms, including customary international law, within the international community. In short, accusations offer states and other stakeholders a menu of strategic options beyond those identified by the extant literature on naming and shaming.

Cyber Norms and the United Nations: Between Strategic Ambiguity and Rules of the Road

‘Cyberspace’ became a UN issue in 1998 when Russia first tabled a resolution on ‘Developments in the Field of Information and Telecommunications in the Context of International Security’ with the aim of starting negotiation of a treaty to regulate the possible use of ICTs in international conflict. Interestingly, what Russia feared most at that time was the ‘development, production or use of particularly dangerous forms of information weapons’, i.e. information warfare, which is arguably what Russia is best at today. Most Western states – in this debate often grouped under the term ‘likeminded states’ – did not want to go down the route of negotiating a multilateral treaty. In their view cyberspace did not substantially differ from the offline world and thus standing international law would be sufficient for its regulation. The compromise between these positions was the start of the United Nations Group of Governmental Experts on Developments in the Field of Information and Telecommunications in the Context of International Security’ (commonly referred to as UN GGE). In 2002 the first UN GGE went to work. Since then, a succession of six different working groups has contributed, through ups and downs, to fostering the role of the United Nations as a normative power in the promotion of responsible state behaviour in cyberspace.