Cyber threats – self-made evil

Today, there is no safe place in cyberspace. Cybersecurity policies have to seek effective protection for the individual as well as for the proper functioning of our economic, social and political systems. With the internet of things, we are becoming even more dependent, in matters of everyday life, on the security of the devices and services offered by IT and the internet. Smart homes and smart energy, electronic banking and financial markets, digital traffic regulation and autonomous cars, industry 4.0 or automated decision-making on taxation and in other fields of administration on their way to becoming ‘smart government’^{Footnote 24} are but a few examples of applications through which we are making ourselves dependent upon functioning IT. In particular, the protection of critical infrastructures is key to the functioning of our societies, but so is the multitude of individually used hard- and software applications, machine learning and artificial intelligence that are increasingly determining our daily life and work.

We have allowed the internet in our digital society to play the role that oxygen plays in our daily life; stupidly, perhaps. The more we are dependent upon it, the more we have to take cybersecurity seriously. Before we become engaged in developing cyber armaments, however, with the effect of potentially increasing the threats to our security, it would seem to be wise to better study and understand the risks. The first insight is the correlation between the increased use of IT and the increased risks we create, far beyond the IT systems strictu sensu. The more we make our societies dependent on safely functioning IT-related products, processes and structures, the more cybersecurity will be in demand.

Cyber defence and attribution

National security and defence policies, as we know from history, are directed against a potential or real enemy. The government of another country deciding to invade our country by sending troops and tanks, supported by naval and air forces may try to strike down our defences, walls, troops etc and to subject our country and people to foreign authority. Cyberwar and cyber-attacks are different. Nothing and nobody needs to move or invade; the attack works on the inside – simply through some signals or messages on the net from anywhere in the world – but the destructive effects can be similar. A cyber-attack might prepare the ground; it might be the first step followed by more classical warfare. It might be for other purposes. Who knows? And who knows where the attack is coming from? It could be a state, or an individual, or a terrorist organisation acting from within our own country or from outside it.

The problem of attribution remains unresolved.^{Footnote 25} In spite of great efforts – and some apparent success as in the case of the North Korean attack on Sony – there seems to be no technical solution to the problem yet.^{Footnote 26} Talking about ‘cyber-deterrence’ and ‘self-defence’ against a determined offender in the traditional sense, thus makes little sense, except cases where the attacker reveals reliably his or her identity. And even if we could qualify, legally, a cyber-attack of a certain gravity as an ‘armed attack’ in the sense of Chapter VII and, in particular, Article 51 of the UN Charter, who should we take measures to restore peace, or self-defence, against?

We thus need a conceptual change in security thinking. We also need to revisit our legal concepts and practical approaches to preserve international peace and security in the digital constellation. This includes considering who is – or should be – responsible for the preservation of peace in the digital age.

Shared responsibilities for cybersecurity and peace

As everybody is a potential victim and a potential attacker in cyberspace, we find ourselves back in a Hobbesian ‘state of nature’^{Footnote 27} – potentially a war of everybody against everybody. The answer of the contractualists in political philosophy was the social contract: the individual authorises the state to ensure security, if necessary by violence, while the state is bound to respect fundamental rights and constitutional principles like the democratic participation of the individual and the rule of law. Security, both internal and external, is the ultimate justification and responsibility of the sovereign state.

This was the approach during the seventeenth, eighteenth and nineteenth centuries. Eventually, terrible wars of the twentieth century told us that a new approach was needed. The idea of European integration, presented by Jean Monnet, can safely be taken as a revolutionary step ahead, giving us a period of almost 70 years of peace in the EU.^{Footnote 28} The new approach means that public authority is shared among diverse levels of responsibility for diverse areas of action, in accordance with the principle of subsidiarity. It adds new sovereign powers in areas that are beyond the reach of national policies. This seems to be the greatest achievement of political thinking in the twentieth century!

Similar creativity is needed in the twenty-first century for what I call the the digital constellation. States play a key role in preserving peace, but the digital constellation not only presents new opportunities, but also entails a new risk environment.^{Footnote 29} The responsibility of states includes what Bannelier and Christakis call ‘cyber-diligence’: protection against and prevention of cyber-attacks on and from the national territory.^{Footnote 30} But more is necessary. States are only one of the instruments available to help us organise cybersecurity and so preserve cyber peace – ‘us’ meaning the digital society, which is not national, not European or American, but is becoming global.

Is it possible to understand cybersecurity and peace not only as our common interest but, beyond this, as our shared responsibility? If we want to benefit from the new information technologies globally, can we excuse ourselves and escape from taking responsibility at this level? Thus, the question is: how can we conceptualise our shared responsibility for cybersecurity and peace at the global level? Let me offer an answer that is ‘all inclusive’: a multilevel and multi-stakeholder system of cybersecurity governance, a system that includes all stakeholders: the individual citizen and civil society, business enterprises, and public authorities, from the local up to the global level.

Individuals: Self-protection, resilience, participation

As individuals and users of the internet, we cannot leave it up to only the public authorities to protect us. There is no such thing as an internet police force. Self-protection is necessary, possible and crucial. Self-protection in digital matters means education, digital literacy, care with our passwords, awareness and attention when we are purchasing and using hardware and software. Self-protection means the application of firewalls, regular updating of software, frequent backups, the responsible choice and use of devices, making sure that they are protected against, and not abused by hackers. Self-protection in some cases adds to the cybersecurity of others too.

Resilience is a priority. As a general concept ‘resilience’ means robustness as well as flexibility and adaptability.^{Footnote 31} It is about the quality of hardware and software. It may be costly but it pays off. Certain precautions, such as updating software in order to increase robustness, can easily be taken by everybody. Regular backups allow the private user to protect themselves against the loss or destruction of documents or software.

In contrast, self-defence in the form of ‘wild’ hack-back^{Footnote 32} is not a tool applicable among private parties, if it is a tool at all. For deterrence, criminal law, and for compensation delict law exist and apply in cyber-relations as in other areas of personal security, without exception. But, again, how can we determine exactly who the attacker is?

An almost forgotten tool in the hands of the citizens is active participation in the political processes and multi-stakeholder bodies with the aim of enhancing cybersecurity. This includes discourse and pressure through civil society organisations, but also the use of information, transparency and control, made available by the internet, in order to press for more security and to hold political leaders and institutions accountable for their actions or omissions.

Business enterprises: Product design, alert systems, security-engineering, standards

Businesses should intensify efforts to support individual self-protection and to provide their own self-defence and security. No unprotected hardware device should be put on the market. Systems of bug detection and security updates for software should be mandatory. Enterprises have set up and should adhere to private systems for mutual information on cyber-attacks and sharing of best practices,^{Footnote 33} such as ‘Threat-Exchange’ offered by Facebook^{Footnote 34} and the German DCSO.^{Footnote 35} Such systems should stretch across borders and become global. Privacy- and security-engineering^{Footnote 36} must be part of the product development of all industries and have to be intensified. Technical standardisation in IT areas should focus also on privacy and security by design so as to meet basic security requirements.

As global players, private enterprises should proactively engage in the framing of structures to enhance cybersecurity. In some form of self-regulation they could establish globally applicable codes of conduct regarding privacy, data- and cyber-security and so set general standards for privacy- and security-engineering and establish technical safety requirements. A more audacious proposal is the trilogy of Microsoft with Brad Smith calling for the adoption of a ‘Digital Geneva Convention to protect Cyberspace’ as a legally binding instrument for states^{Footnote 37}, supported by a ‘Tech Accord’ among business enterprises requiring them not to support ‘offensive cyber operation’, to protect customers, and to bolster first-response efforts.^{Footnote 38} The third pillar is the proposal to establish an ‘Attribution Organisation’ as a ‘private-sector-led, independent and transparent’ body to provide a ‘foundation of a fact-based, global dialogue about the nature of significant cyber-attacks’.^{Footnote 39} The tasks of this organisation would be limited to attribution only, while incident response and enforcement would remain the responsibility of the states.^{Footnote 40} However, the establishment of such an organisation would presuppose that attribution is possible. No evidence, however, exists for this hypothesis.

Public authorities: Constitutional duties, European and international cooperation

States play a special role in cybersecurity. In a constitutional perspective, fundamental rights and principles are providing the framework for security policies: while limiting governments in their actions, they are also requiring legislators and governments to take action. The tools for public authorities at national, European and international level are diverse in impact and reach, ranging from awareness-raising and promoting best practices, legislation and the establishment of cybersecurity agencies, new forms of military defence, intelligence and intergovernmental cooperation, to cooperation within international organisations and through international treaties.^{Footnote 41}

Constitutional frame: Fundamental rights and principles

In 2008 the German Federal Constitutional Court established, in its famous case regarding online searches, a new fundamental right relating to cybersecurity:

Fundamental rights protect the individual against public authority, and the Court found the right to integrity of information technology systems violated in the case on online searches.^{Footnote 43} But they are also an expression of values to be given effect by the legislator and may, thus, legitimise restrictions of other fundamental rights. This equally applies to Article 6 of the European Charter of Fundamental Rights, the guarantee of the ‘right to liberty and security of the person’, a wording similar to that of Article 5(1) ECHR. The ECJ understands the guarantee of the confidentiality and integrity of information technology systems as a full subjective right of the individual,^{Footnote 44} and refers to Article 6 of the Charter laying down ‘the right of any person not only to liberty, but also to security’, in order to emphasise, in its 2014 ruling on the case Digital Rights Ireland, that security constitutes an objective of general interest and, in particular,

The fundamental right to security so legitimises legislation that, within the limits of proportionality, imposes restrictions on other fundamental rights, like data protection. Given this broad interpretation, the right to security under Article 6 of the Charter means that if it is not a subjective right of the individual to be protected by the courts, at least it establishes a fundamental principle compelling governments and legislators to promote cybersecurity and to make sure that cybersecurity is taken seriously by businesses and individuals.^{Footnote 46}

Article 9(1) of the International Covenant on Civil and Political Rights (1966) providing for ‘everyone … the right to liberty and security of person’ should be interpreted in the same way: it compels states and organisations to take action on cybersecurity and, in implementing this duty, to engage in international cybersecurity cooperation.

Legislation and agencies

At a European and national level, one important focus of legislative activities is rules on general information, warning and cooperation requirements in the event of cyber-attacks. The EU’s Agency for Network and Information Security (ENISA) was set up in as early as 2004, and since then has provided expertise and encouraged cooperation between national authorities. It is now responsible for supporting the implementation of the new Directive 2016/1148 ‘concerning measures for a high common level of security of network and information systems across the Union’ (NIS). This Directive mainly provides for national cybersecurity strategies, cooperation and trust among national authorities within a ‘computer security incident response teams network’ (‘CSIRTs network’). It also establishes security and notification requirements for operators of essential services and for digital service providers. It is to be transposed into national law by May 2018, though much of its contents is already in place in some Member States. In Germany the ‘Federal Office for Information Security’ (BSI) was established as early as 1991, and the new ‘IT-Security Act’ of 2016 largely implements the requirements of the Directive.^{Footnote 47}

Cyber crime is another area in which action has already been taken. The Treaty of Lisbon established a new competence of the EU to harmonise legislation on computer crime.^{Footnote 48} Directive 2013/40/EU on attacks against information systems is a first, but important, step to combat cyber crime and to protect cybersecurity EU-wide. Data security is mentioned as one of the principles of data protection under Article 5(1)f GDPR, and Articles 32 to 34 of this Regulation impose on the controllers and processors of data not only the duty to ensure security of the data in their possession but also to notify personal data breaches to the supervisory authority and to the data subject. With a view to the possible damage for the data-subject or reliability of databases caused by manipulation or destruction of data the integrity of data is becoming a major concern also of cybersecurity and needs particular attention.

More is possible and necessary, however. Products are often put on the market without necessary checks to ensure their safe application and security.^{Footnote 49} Attackers abuse them for DDos attacks without the owners being aware of it. This cannot be accepted. Specific IT-related regulation on product safety and product liability needs to be adopted. But users too are to be made liable for damages arising from negligent or improper use of devices that do not meet minimum safety requirements, or for failing to regularly update their system as required. Insurers will assess the risks and, accordingly, fix the amount of fees to be paid. Only at this point will the real cost of IT systems including cybersecurity become visible.

This regulation should go hand in hand with new legislation on technical requirements for IT products regarding cybersecurity (including certification – CE-label). With the competence the EU has for the internal market, consumer and data protection, the EU should – and indeed seems to intend to – take the necessary measures.^{Footnote 50}

Cyberspace and military defence

States have recognised cyberspace as a new dimension of military defence, apart from land troops, the air force and the navy. This adds to the notion of cyberwar as a war in the proper meaning of the term. Some states are already spending billions of dollars not only on cyber defence but also on offensive cyberwar technology. Is this necessary in order to understand threats better, as a basis for defining effective strategies of defence? As has already been stated, with regard to the problem of attribution, classical concepts of response, hack-back and deterrence are questionable. Many states are not advanced in cyber defence. Bannelier and Christakis state in their preparatory study that ‘the technical capabilities of the digital giants and their economic strength are not commensurate with those of many States, especially the less technologically advanced ones’.^{Footnote 51}

More importantly, the question of whether offensive capabilities really add to cybersecurity remains an open question. As a matter of reason and humanity, international agreements have been reached to ban chemical and biological weapons and to limit, at least, nuclear armaments. Accordingly, for the costs of a new arms race and the unforeseeable new risks of damages for the civilian population, cyberwar is not an option and should be banned, while taxpayers’ money should be invested in strategies and technology of resilience that make cyber-attacks impossible or, at least, ineffective.

Cybersecurity intelligence

Could intelligence activities be part of such strategies? Tapping internet cables and nots worldwide or other activities may help, one day, to finding the origins of attacks, at least geographically. New German legislation passed in 2015 includes provisions for powers of the Foreign Intelligence Service (BND) to detect serious risks of international cyber-attack.^{Footnote 52} But the definition of these powers is vague and general; in addition, action on foreign territory is not excluded. But what country would accept, in the absence of a cooperation agreement, such intelligence action led by foreign services on its own national territory? The Snowden revelations are a warning. In the name of national security, the NSA destroyed trust on a global scale. A legal regime containing clear limitation, strict control and cooperation should replace unilateral national action. Common intelligence with close parliamentary oversight should be established for well-defined purposes, including cybersecurity, at the European level.^{Footnote 53} Similarly, as a matter of common concern, joining all efforts at cybersecurity intelligence is a matter to be considered at the transatlantic and even at the global level, with due regard, however, to effective privacy and data protection.

The work of international organisations on cybersecurity

States are already cooperating on cybersecurity within the framework of international organisations. The most important of these organisations is, of course, the UN. The result of a Russian initiative in 1998 and established under resolutions of the UN General Assembly,^{Footnote 54} the Global Group of Experts on Cybersecurity (GGE) has, since 2004, been reporting to the UN Secretary General on issues of priority and national strategies for cybersecurity.^{Footnote 55} While these reports contain important observations on the risks and on recent developments, and confirm the full application of international law to cyberspace (2013), they remain too general in their conclusions and recommendations. As a result, the GGE has been harshly criticised for its poor ‘real world impact’, and it has been suggested that it should become more inclusive, ‘involving more stakeholders and producing outcomes that really shape policy, reflecting the realities of the cyber game’.^{Footnote 56} Its work, nonetheless, can be understood as an important effort to implement UN General Assembly Resolution 64/211 recognising ‘that a robust global culture of cybersecurity needs to be encouraged, promoted, developed and vigorously implemented’.^{Footnote 57} The 2017 Report, promised to be adopted and published in September 2017, has not been accomplished. Too controversial seem to have been the views of the participating states on questions of self-defence, the possible abuse of rights where the problem of attribution persists, or the question of openness or sovereign control over the national information space, if all countries had been ready to find consensus. Perhaps it was too ambitious to envisage agreement on ‘how international law applies to the use of information and communications technologies by states’, as the GGE was tasked, or things like confidence- and capacity-building at the UN level.^{Footnote 58} Or the GGE, a group of experts from national governments, even at this high level, is simply not a body that can produce far-reaching political or legal commitments of the international community as needed for effective protection of cybersecurity.

Another important international organisation dealing with questions of cybersecurity is the International Telecommunications Union (ITU).^{Footnote 59} A fundamental role given to the ITU by WISIS and the ITU governors is ‘to build confidence and security in the use of Information and Communication Technologies (ICTs)’. The ITU runs a Global Cybersecurity Index (GCI), which is a multi-stakeholder initiative monitoring the cybersecurity commitments of different countries. Already in 2007 it launched the Global Cybersecurity Agenda (GCA) establishing a ‘framework for international cooperation aimed at enhancing confidence and security in the information society’. ITU is also active in standardisation, with valuable work such as setting up the ‘Focus Group on Smart Sustainable Cities’. In 2015 this group produced a technical report of high quality on ‘cybersecurity, data protection and cyber resilience in smart sustainable cities’.^{Footnote 60} Yet, binding regulation on the technology or the use of the internet and, in particular, related to cybersecurity is not among the powers of ITU.

International conventions

In contrast, an international agreement can have legally binding effect, at least upon the participating states that ratified it. Few conventions have been concluded at a regional or international level for the purposes of cybersecurity. A first important achievement was the Budapest Convention on Cyber Crime of November 2001. It entered into force on 1 July 2004 and requires the criminalisation of all kinds of computer- and internet-related offences for the, so far, 54 contracting parties.

Another prominent example is the African Union Convention on Cyber Security and Personal Data Protection, adopted in June 2014.^{Footnote 61} This is a remarkable step towards coordinated action, combining privacy and security in one document and imposing effective action on the contracting parties, including, in Article 26, the establishment of a ‘Culture of Cybersecurity’.^{Footnote 62} The role of governments is defined here to ‘provide leadership for the development of the cyber security culture within its borders’, although in Article 27 the Convention also addresses ‘cybersecurity governance’ under the leadership of the governments, the establishment of an institutional framework and international cooperation (Article 28).

The Microsoft initiative of a ‘Digital Geneva Convention to protect Cyberspace’, already mentioned, has not yet received sufficient attention. It is meant to prohibit cyber-attacks on critical infrastructures, or causing damage to the global economy or to cloud-based services, causing major global disruption. It bans hacking personal accounts or ‘private data held by journalists and private citizens involved in electoral processes’ and requires states to refrain from inserting or requiring ‘backdoors in mass-market commercial technology products’ etc.^{Footnote 63} The many issues covered here reflect general concerns of cybersecurity and should guide upcoming negotiations at the international level. In spite of strong lobbying of Brad Smith for this project also at the 2017 IGF in Geneva,^{Footnote 64} this initiative does not seem to have received sufficient support by the governments.

These are promising initiatives, although they fail, if in force, either to go far enough in terms of providing concrete substance or to cover, as is needed, the territories of all countries and so to being effective at the global level. The experience is, that negotiation and ratification procedures of international conventions are most time-consuming and often take many years. This is particularly true in sensitive areas like internet regulation and cybersecurity. Technical developments are many times quicker than what governments can negotiate. Finally, international agreements, once in force, often suffer from the reluctance of states to completely carry out their duties. Compliance procedures, as known from international environmental protection regimes like the Montreal Protocol on Subtances that Deplete the Ozone Layer^{Footnote 65} or the Åarhus Convention,^{Footnote 66} are difficult to achieve and of limited effect.

In the absence of effective means of enforcement and judicial protection, thus, new additional methods are needed to ensure cybersecurity at all levels. Given the shared responsibility of individuals, business enterprises, and state governments, with their respective tools and powers, an inclusive multi-stakeholder model of cybersecurity governance should be considered as the way forward.

Multi-stakeholder governance mechanisms

Cybersecurity governance can be understood as a specific sector of internet governance, insofar as the latter is handled by private and/or multi-stakeholder organisations or platforms, such as ICANN for domain administration, IETF or ISO for standardisation and, more generally, the IGF as an open and global platform for the discussion of the most salient issues of internet governance. One of these issues is cybersecurity. While, except for the functioning of the domain name system, ICANN does not seem to be a key player in cybersecurity matters, IETF, ISO and the IGF certainly are.

The IETF and the ISO are setting technical standards which, though not binding, are of key importance to the interoperability and functioning of the internet. For years now, explicit descriptions of effects on cybersecurity have been one of the requirements that RfC’s (requests for comments, instruments published by IETF as standards) have to meet, and RfC’s have had to indicate the measures they take to ensure that security is taken care of in the implementation of the proposed technical standards. While IETF specialises in technical protocols like TCP/IP, the work of the International Standards Organisation (ISO) has a broader scope. ISO has issued numerous standards for cybersecurity analysis, engineering and management. The question is how to make sure that a certain level of protection is respected by these standards, allowing them to be implemented on a global scale.

Though the IGF does not take decisions, the expertise and views expressed at its sessions may be relevant for the establishment of such minimum requirements as the first stage of a normative process for globally applicable standards. The IGF has existed since 2006, having been established by the UN Secretary General at the request of WSIS. Its mandate was renewed for another ten years in 2015.^{Footnote 69} The discussions at the IGF are open to all stakeholders present or participating online. Cybersecurity was the first subtheme of the IGF in 2015,^{Footnote 70} and it seems also to be a priority issue at the December 2017 meeting in Geneva.^{Footnote 71} The further work of IGF should focus on the minimum requirements for IT products and the ways in which these can be met and concretised by standardisation, following the model of the ‘new approach’ adopted years ago by the EU for internal market harmonisation.^{Footnote 72} The discussions held at IGF are an important source of mutual information on best practices and experiences, the IGF provides room for deliberation and opinion-building and so can constitute a useful basis for the next steps of a normative process, as described below.^{Footnote 73}

Expert groups, institutions and networks

The IGF, however, is not the only platform to take up and discuss the issues of cybersecurity. At the Munich Security Conference in February 2017 the ‘Global Commission on the Stability of Cyberspace’ was launched by the Dutch government together with the Hague Centre for Strategic Studies and the EastWest Institute.^{Footnote 74} It was announced as ‘a global body formed to convene key global stakeholders to develop proposals for norms and policy initiatives to improve the stability and security of cyberspace’. For some years now, the Dutch National Cyber Security Centre has been organising the ‘International One Conferences’ with experts on cybersecurity.^{Footnote 75} A ‘Commonwealth CyberSecurity Forum ‘17’ was held in London in March 2017.^{Footnote 76} These and other initiatives and discussions in academic circles are gradually creating an informal network of practitioners, politicians and scientists that provide expertise and inform politics bottom up through a global deliberative process.

Special attention is deserved by the Tallinn Manual on the International Law applicable to Cyber Warfare (2013). This is the result of the work of an expert group working under the auspices of NATO, with ‘the unofficial input of many States and over 50 peer reviewers’. This manual provides us with a number of important definitions, rules and profound advice relating to cyber warfare.^{Footnote 77} It seems, therefore, to represent the state of the art on almost all relevant questions, including the definition of terms like ‘armed attack’ or ‘threat to international peace’, the concepts of sovereignty, state responsibility, attribution and human rights, and how to protect civilians in cyberwar contexts, as well as more concrete issues like at what point the UN Security Council would be called upon to take action in the event of a cyber-attack under Chapter VII of the Charter of the United Nations.^{Footnote 78} A second edition of the Tallinn Manual was issued in 2017, now also covering legal peacetime regimes.^{Footnote 79} These works are of great value for the legal assessment of state action and responsibilities, even if they do not set binding rules but simply contribute to clarification of the existing international law with regard to cyber issues.

The problem with these studies, however, is that they do not overcome the traditional war-logic but, instead, strive to adapt the patterns of war and the law of war to the digital constellation. This is important, but it may not achieve what is needed for cybersecurity.

Emergence of a global framework for rules on cybersecurity

People, stakeholders and experts active in the diverse forums and platforms focusing on cybersecurity not only meet and network with each other regularly but also produce a vast amount of knowledge, experience and creative thinking. New ideas flow from one forum to another and eventually become more or less accepted principles and some sort of shared common sense. Stakeholders learn from it, and knowingly or not, integrate what they ‘bring home’ from such discussions into their respective work. This way, they may ultimately inform government action or even legislative proposals. Much of it, though, is left to coincidence.

There may be many ways to organise these deliberative processes more systematically, so as to achieve more coordinated and thus more effective results. To be sure, the process should be based upon, and controlled by, public deliberation in order to receive democratically rooted legitimacy: citizens of the states should be involved and understand themselves as global citizens taking responsibility and having the final say, while it should be for the UN Secretary General to take responsibility for setting up a framework of coordination. The process should be fully transparent and based upon a broad, open global discourse actually made possible by the internet.^{Footnote 80}

Based upon already existing structures and processes and, in particular, cybersecurity policies at national and regional levels, a new model of a complementary normative process will be developed for cybersecurity governance at the global level, which is (a) built upon internet-enabled open information and deliberation that will serve as (b) a fundament for the establishment of bodies to elaborate and adopt a set of principles on cybersecurity to be (c) further concretised and made legally binding by combined processes of standardisation and legislation, while (d) more general globally binding norms will have to be agreed in the form of international conventions with the UN bodies taking responsibility for the coordination and supervision of the processes aiming at the adoption of globally applicable rules, the application of which (e) special UN bodies would monitor and courts at all levels would have to give effect to in individual cases.

Towards global (multilevel) constitutionalism

The present outline of a model framework for global cybersecurity regulation certainly does not represent what we commonly understand as a Constitution. Nevertheless, it is suggested here that a discussion on possible developments should be commenced from which a constitutional setting for democratically legitimate regulation at the global level could emerge. It is similar to the concept of ‘transnational popular sovereignty’ developed by Milton Mueller with a view to overcoming the ‘mismatch between internet territory and political territory’ already mentioned.^{Footnote 83} But the aim is not to ‘detach information policy from the state today’ and construct a global polity based upon ‘net nationalism’ with ‘a people of the internet’, as he sees the system of ICANN.^{Footnote 84} Nor is it to conceive a ‘community formed in and around internet connectivity’ displacing ‘specific pieces of territorial states’ authority over global communication’ with the aim that ‘national governments have no sovereignty over content and to gradually de-legitimize these efforts’ (of blocking and filtering access to websites and applications).^{Footnote 85} In contrast, the aim is to provide people with an instrument for effective, democratically legitimate action on matters beyond the reach of individual states more generally. Internet governance and, more particularly, cybersecurity governance, is only one issue. The term ‘constitutional’ is understood not to imply a state-like structure but an additional level of action through the establishment of institutions and processes that are rooted in the will of, and ultimately driven by, the citizens, defining themselves as global citizens with regard to such forums, bodies and institutions that are vested with specific powers for the achievement of objectives determined in the constituent texts through political processes in which they participate with the aim of setting globally applicable rules. Multilevel constitutionalism^{Footnote 86} is the normative theory that permits us to conceptualise such a constitutional framework, not as a centralised system of power at the global level, but as part of a composed constitutional system encompassing national, supranational and global elements, so as to reflect the shared responsibilities of citizens and actors at the diverse levels.^{Footnote 87}

Global rule generation as one part of governance, and of global cybersecurity governance in particular, as an activity accepted by the global citizens as being democratically legitimate, would require inclusive processes of will formation and decision-making that do not replace but build upon national political and legislative processes, while adding a new, complementary level of action, control and judicial review. It would allow for the kinds of policies required by global challenges like cybersecurity and should be guided by globally agreed fundamental rights or principles like the principle of (cyber-)security. Accordingly, an emerging constitutional framework of cybersecurity governance would build upon existing national, supranational and international institutions and processes. It would be complementary to them and be limited to issues that are beyond the control of states.

Given the potential of the internet with regard to real-time information, education, deliberation and participation in political processes across borders, it is not impossible in the long run to imagine democratic decision-making at the global level on the concrete rights and duties not only of states but also of individuals and business enterprises. Such global decision-making could lead to the creation of regulations that are legally binding worldwide and may intervene where self-regulation and other forms of private ordering remain ineffective. E-democracy, in particular, is key to this development of global constitutionalism,^{Footnote 88} and it could, in future, supplement the existing toolbox of cybersecurity governance.