Norms are the informal codes which determine the acceptable behaviour. These norms can be individualistic and group based. They become universally accepted over the course of time with continued practice. A decline in the development and novelty of norms happened as soon as society’s pace of evolution accelerated as a result of industrial revolution. Fast forwarding to the contemporary times of cyberspace, cyber norms are defined as the appropriate behaviours in cyberspace that can be accepted so as to regulate the state behaviours and contain damages from unlawful activities. These norms stem as a consequence of threats emanating from cyberspace – state actors or non-state actors.
The security of cyberspace is being intentionally debated for its stability. Because of the cyber insecurity, may it be of national, social, economic or humanitarian nature, a new ecosystem of “cyber norms” have emerged. Therefore, at the intergovernmental level, the debate on cyber security beefed up that resulted in Carnegie’s Cyber Norms Index. It is a search tool that makes comparison of international standards of appropriate behaviour in the cyberspace. The said search tool enables users to compare documents in the categories of international law and norms, confidence and capacity building, threat perception and process.
The United States (US) argued that technologies evolved rapidly over the period of time, while the multilateral negotiations are time-consuming and cannot keep the pace with such and evolving pace of ICTs. Therefore, the US became proponent of international law in general and UN Charter and laws of war in particular for their applicability to cyberspace.
The history and development of cyber norms has its roots in a Russian sponsored resolution in 1998 that was passed in the United Nations General Assembly (UNGA) raising concerns that Information and Communication Technologies (ICTs) could adversely affect the security of states. Since then, the western diplomatic focus on cyber norms is increasing. Russia argued that cyberspace provides chaotic environment that threatens the security of the states, and hence, it should come under control through a multilateral treaty.
On the other hand, the United States (US) argued that technologies evolved rapidly over the period of time, While the multilateral negotiations are time-consuming and cannot keep the pace with such an evolving pace of ICTs. Therefore, the US became proponent of international law in general and UN Charter and laws of war in particular for their applicability to cyberspace. Hence, the US and its allies resort to norms adoption as a responsible function of state behaviour.
It has argued for the adoption of the concept of Internet sovereignty that aligns the international legal norm of state sovereignty with absolute control of the state regime over cyberspace.
China has also put its weight on the international debates concerning digital norms or more so the cyber norms. It has argued for the adoption of the concept of Internet sovereignty that aligns the international legal norm of state sovereignty with absolute control of the state regime over cyberspace.
In 2016, international cyber norms were also developed by NATO Cooperative Cyber Defence Centre of Excellence (NATO CCD COE). The Centre previously developed Tallinn Manual that incorporates applicability of international law in cyberspace, and now the Centre has also published its book to further define, explain and develop cyber norms. The book comprehensively discussed international law vis-à-vis cyber laws and cyber norms, both in inner space (space at or near the Earth’s surface) and outer space (beyond Earth). In April 2017, G7 Declaration on Responsible States Behaviour in Cyberspace recognised the necessity of increased international cooperation in order to promote security and stability in cyberspace. And it was meant for reducing malicious activities in the cyberspace by both state and non-state actors. Furthermore, the declaration promoted a strategic framework for conflict prevention in cyberspace by the application of already existing international law to state behaviour, promotion of non-binding norms, and development of confidence building measures among the states.
In 2019, UN held its first-ever multi-stakeholder meeting on peace and stability in cyberspace at the global level. With the establishment of Open Ended Working Group and 6th UN Group of Governmental Experts, the conference deliberated on global cyber security norms and efforts to counter the threats emanating from digital space.
In 2019, UN held its first-ever multi-stakeholder meeting on peace and stability in cyberspace at the global level. With the establishment of Open Ended Working Group and 6th UN Group of Governmental Experts, the conference deliberated on global cyber security norms and efforts to counter the threats emanating from digital space. Prior to that, the United Nations Institute for Disarmament Research launched a Cyber Policy Portal that acts as a tool for policymakers and experts to access cyber security policy profiles of all UN member states. The portal also includes multilateral frameworks as well as the role of regional and international organisations.
University of Pennsylvania’s Perry World House and Carnegie Endowment for International Peace convened a workshop on cyberspace and geopolitics in October 2019. The workshop highlighted four weaknesses – inherent low security barriers to enter cyberspace, lack of transparency in state behaviours to measure norms adherence, lack of great power cooperation, and the lack of incentives for internalising norms. Against it, four recommendations were made which include research on cyber norms to close gap between behaviours and existing accords, shared global database of cyber processes to improve transparency, incentives to promote norms adoption, and increased multi-stakeholder cooperation with great powers.
The non-state actors do not just come to fore in the form of terrorists. Rather they are cyber criminals who try to disrupt the governmental websites and databases in tandem with creating social and economic disruption for states as well as their critical infrastructure.
From the perspective of nation-states, they are driven by competition for power, where realism drives states to pursue any means possible to increase their relative power. This in turn, has become one of the reasons, where states are not actively engaging the development of cyber rules and cyber norms. The states use cyberspace to their advantages due to obvious reasons of keeping an eye on the subjects (surveillance techniques) and also leveraging the same cyberspace to compete against their competitors in domestic or international politics. Similarly, the utility of cyberspace by the non-state actors provide them opportunity to increase their asymmetric war fighting strategies and tactics from training to induction to execution. The non-state actors do not just come to fore in the form of terrorists. Rather they are cyber criminals who try to disrupt the government websites and databases in tandem with creating social and economic disruption for states as well as their critical infrastructure.
Nonetheless, another trend must be kept in mind and that is of rising populism where right-wing politicians would not cater for the rights but rather use such cyberspace technologies to gain competitive advantage over their adversaries.
The future of cyber norms and its development is quite uncertain, to say the least. Cyberspace provides luxury to states in terms of discretion and non-attribution. However, those concerning with human rights would continue to raise their voices for the development of cyber norms. Nonetheless, another trend must be kept in mind and that is of rising populism where right-wing politicians would not cater for the rights but rather use such cyberspace technologies to gain competitive advantage over their adversaries.
