‘A small group of thoughtful committed people can change the world. Indeed, it is the only thing that ever has.’
Margaret MeadFootnote 1
‘States are, at this moment of history, still at the heart of the international legal system.’
Rosalyn HigginsFootnote 2
‘[C]ompliance with international law frees us to do more, and do more legitimately, in cyberspace[.]’
Harold H. KohFootnote 3
1. Introduction
Today's international community faces a gamut of global challenges ranging from climate change to international terrorism to cyber threats. What these challenges have in common is that they cannot be adequately addressed by any single international actor, irrespective of how powerful that actor may be. Instead, all such contemporary phenomena necessitate a framework for effective international co-operation. It is international law that ‘affords [such] a framework, a pattern, a fabric for international society’.Footnote 4
Although the law establishes a framework of constraints, it simultaneously guarantees a sphere of autonomy for its subjects.Footnote 5 In the context of international law, legal norms lay down shared boundaries of acceptable conduct in international relations, while preserving important space for manoeuvre, discretion and negotiation. This idea is at the root of the ‘Lotus presumption’,Footnote 6 according to which states may generally act freely unless prevented by a contrary rule of international law.Footnote 7
In order to delineate this zone of freedom for states and other international actors with respect to any internationally significant phenomenon, it is necessary to identify, interpret and apply the relevant legal rules.Footnote 8 Despite the ongoing debates about the supposed decline of the sovereign state,Footnote 9 states have maintained their centrality in the formation, interpretation, and application of international legal rules in general.Footnote 10 But have they kept an equally firm hold on the development of international cyber security law?Footnote 11
There is little doubt that cyberspace, broadly understood, is a phenomenon of international significance. Crucially, the uses and abuses of this complex, borderless, virtual space impinge on vital state interests in the physical world, including national security, public safety, and economic development. As such, cyberspace extends far beyond the domain of internal affairs of any state.Footnote 12 It is therefore imperative to clarify the boundary between the constraints that apply to actors in cyberspace and their autonomy.
Yet, with respect to the management of cyberspace, it may appear that international law presently fails to deliver. Even though the main building blocks of the Internet's architecture were laid almost three decades ago,Footnote 13 it took until 2013 for state representatives to agree that international law even applies to cyberspace.Footnote 14 The agreement was touted at the time as a ‘landmark consensus’,Footnote 15 but its actual import is controversial.
To begin with, it was expressed in the form of a non-binding report of a Group of Government Experts (GGE) established by the UN General Assembly.Footnote 16 At the time, the group was composed of representatives of 15 UN member states,Footnote 17 including the three ‘cyber superpowers’ China, Russia, and the US.Footnote 18 On the one hand, anchoring the process at the UN added to the legitimacy of its outputs in general.Footnote 19 The 2013 report itself can arguably be taken as reflecting a shared understanding in the international community.Footnote 20
On the other hand, the report raised more questions than it answered. International law is supposed to apply, but which international law? Although the group endorsed the centrality of the UN Charter,Footnote 21 several of its members questioned the applicability of a prominent subdomain of international law – the law of armed conflict – to cyber operations.Footnote 22 Perhaps more importantly, how is international law supposed to apply?Footnote 23 It is one thing to know that the online realm is not a lawless world, but quite another to understand how existing rules apply to cyber phenomena.Footnote 24
Against this background, this article examines whether the current situation is fairly described as one of crisis. To that end, it starts by weighing three key crisis indicators touching on states’ reluctance to engage in law-making in the area of international cyber security law (Section 2). Since new binding rules are few and far between, it then looks to the pre-existing landscape of international law and the extent to which it provides a regulatory mechanism in its own right (Section 3). Subsequently, the article shows that states’ retreat from their traditional legislative function has left a power vacuum, triggering a number of non-state initiatives seeking to fill it (Section 4). On the basis of historical precedents that include the development of legal regimes for Antarctica and nuclear safety, the article then argues that states now have a critical window of opportunity to build on the plurality of emerging non-binding norms and thus reclaim their central law-making position (Section 5). Whether they succeed in doing so will determine the nature of cyberspace governance, as well as the role played by international law in this regard.
2. Crisis indicators: International law and cyber security
Three stand-out indicators suggest a crisis in this area of law. First, the domain of cyber security appears resistant to codification of the applicable rules in a comprehensive multilateral binding treaty.Footnote 25 This is not for want of trying by the leading international stakeholders. In 1996, France put forward the earliest proposal with the lofty title Charter for International Cooperation on the Internet.Footnote 26 Later, a Sino-Russian initiative resulted in two proposals for a Code of Conduct for Information Security, submitted to the UN General Assembly in 2011 and 2015, respectively.Footnote 27 However, none of these proposals was met with much enthusiasm by other statesFootnote 28 and scholars describe the prospects of an ‘omnibus’ treaty being adopted in the near future as slim to negligible.Footnote 29 This is no doubt partly because, whatever the subject, the ‘very word “treaty” may conjure up the fearsome formalities of diplomacy’, with a chilling effect on states’ willingness to engage in this form of law-making.Footnote 30 Yet, with respect to cyber security, this aversion appears to be particularly pronounced.
Second, states have shown extreme reluctance to contribute to the development of cyber-specific customary international rules. In addition to state practice in this area being inevitably shrouded in secrecy,Footnote 31 states have been reluctant to offer clear expressions of opinio juris on matters related to cyber security.Footnote 32 At times, this approach may be understandable, as it is the consequence of domestic political gridlock or a deliberate waiting strategy.Footnote 33 On other occasions, it may rather be due to the persistent ‘cybersecurity knowledge gap’; in other words, the striking lack of understanding of cybersecurity permeating governments around the world.Footnote 34 On the whole, this reluctance adds to the pervasive ambiguity as far as the specific applicability of international law is concerned.
This trend is visible even in the most recent developments. A representative example of another missed opportunity to steer the development of cyber custom is provided by the recent US Law of War Manual adopted in July 2015 and updated in December 2016.Footnote 35 Although it does contain a chapter on cyber operations,Footnote 36 the Manual skirts virtually all unsettled issues, including standards of attribution, rules of targeting or the requirement to review cyber weapons.Footnote 37
While the first two indicators relate to states’ reluctance to act in ways meaningful for the generation of new rules, the third concerns their actual conduct in relation to cyber governance. It would be inaccurate to claim that states have entirely given up on standard-setting. However, instead of interpreting or developing rules of international law, state representatives have generally sought refuge in the more ambiguous term ‘norms’. It is true that law and norms are ‘intimately intertwined’ concepts and that inter-state agreement on ‘norms’ may gradually influence the development of the law.Footnote 38 Yet, a fundamental difference between the two is that a violation of a binding rule of international law gives rise to international legal responsibility,Footnote 39 while the same cannot be said of non-legal norms regulating cyber conduct.Footnote 40
The trend of promoting cyber norms is most visible in the work of the UN GGE. In its latest report, the group touted the advantages of ‘[v]oluntary, non-binding norms of responsible State behaviour’.Footnote 41 The report claimed that such norms prevent conflict in cyberspace, foster international development, and reduce risks to international peace and security.Footnote 42 The report further recommended 11 such norms for consideration by states,Footnote 43 while making it clear that these norms operate on a decidedly non-legal plane.Footnote 44 Despite their minimalistic nature, the norms have thus far received very limited endorsement by their addressees. For example, at a US-China summit in September 2015, the two participating heads of state ‘welcomed’ the report but refrained from committing themselves to any of the proposed norms.Footnote 45
Together, these three indicators signify a trend of moving away from the creation of legal rules of international law in the classical sense. Instead of developing binding treaty or customary rules, states resort to normative activity outside the scope of traditional international law. Although this trend appears to be especially prominent in the area of cyber security, it is by no means limited to it.Footnote 46 In legal theory, this phenomenon has been described as ‘the pluralisation of international norm-making’,Footnote 47 characterized by the observation that ‘only a limited part of the exercise of public authority at the international level nowadays materializes itself in the creation of norms which can be considered international legal rules according to a classical understanding of international law’.Footnote 48 In order to understand the impact this situation has on the international legal regulation of cyber security, we must step back and appreciate the broader context of existing international law.
3. Gaps and patches: The existing legal landscape
3.1. Generally applicable rules
The absence of a cyber-specific system of rules of international law does not mean that there are no legal rules that would apply to cyber activities. As we have seen, states accept that generally applicable rules of international law apply to states’ conduct in cyberspace, too. This is undoubtedly correct. If international law is to be an efficient governance structure, it must be adaptable to new phenomena without the need to constantly reinvent the entire regulatory framework.Footnote 49
By way of example, the UN Charter was finalized when the invention of nuclear weapons was still a closely guarded secret,Footnote 50 so this instrument understandably did not refer to such weapons in its provisions on the use of force.Footnote 51 Still, the International Court of Justice (ICJ) had little difficulty in holding, in the Nuclear Weapons Advisory Opinion issued decades later, that those provisions ‘apply to any use of force, regardless of the weapons employed’,Footnote 52 notwithstanding the fact that a particular type of weapons might not yet have been generally known or even invented when the Charter was adopted.Footnote 53 Following the same logic, cyber operations must equally be subject to the international law regulation of the use of force.Footnote 54
The applicability of international human rights law (IHRL) to states’ conduct online is another highly relevant example. The foundations of this body of law were laid in the post-Second World War period, when states adopted instruments which together form the so-called ‘International Bill of Human Rights’.Footnote 55 Needless to say, these texts considerably predate contemporary challenges inherent in, and amplified by, cyberspace. Still, this chronology does not render IHRL inapplicable to cyber activities. Quite the contrary: the fact that today ‘people are as likely to come together to pursue common interests online as in a church or a labor hall’ requires that universal human rights ‘also apply in cyberspace’, as then-US Secretary of State Hillary Clinton argued in a path-breaking speech in 2011.Footnote 56 This position has since been endorsed by two resolutions of the UN Human Rights Council, in 2012 and 2016, which included identical phrases affirming that ‘the same rights that people have offline must also be protected online’.Footnote 57
While the conclusion that these generally applicable rules of international law apply to conduct in cyberspace may offer some solace, many crucial questions remain unanswered. For instance, it is one thing to posit the applicability of the law on the use of force to cyberspace, but quite another to determine whether a specific cyber attack crosses the threshold of force in concrete circumstances. Although an influential set of factors known as the ‘Schmitt criteria’ have emerged in the literature,Footnote 58 little is known about states’ views in that regard.Footnote 59 Crucially, no cyber operation – including Stuxnet, which has arguably been the most intrusive one thus far, having caused extensive physical damage to an Iranian nuclear facility in 2010Footnote 60 – has ever been considered to amount to a use of force by any state,Footnote 61 whether by a victim or a bystander.Footnote 62
Similarly, the general agreement that human rights are also available online tells us very little about the legal qualification of new cyber phenomena that are without existing offline precedent. A case in point is Tor, a technology that protects users against surveillance and traffic analysis online and thus enables them to communicate anonymously on the Internet.Footnote 63 Western states, including the US and Sweden, apparently see Tor as a means of protecting privacy and freedom of expression, and, as such, worthy of their moral and financial support.Footnote 64 In contrast, China views this technology as a security threat and a tool of cyber attacks;Footnote 65 in this light, it is unsurprising that the use of Tor is unlawful in China.Footnote 66 Likewise, other non-western states including Ethiopia, Iran, and Kazakhstan have reportedly sought to block Tor traffic in the past.Footnote 67 In sum, it is unclear how to square the near-identical proclamations made by states that remain highly general with their divergent behaviour with respect to particular phenomena unsubstantiated by any corresponding legal justification.Footnote 68
3.2. Sectoral and regional treaties
In addition to generally applicable rules of international law, certain sectoral and regional treaties, taken together, provide a ‘patchwork of regulations’ for cyber activities.Footnote 69 These include, in particular, the 1992 Constitution of the International Telecommunication Union;Footnote 70 the 2001 Budapest Convention on CybercrimeFootnote 71 and its 2006 Protocol on Xenophobia and Racism;Footnote 72 the 2009 Shanghai Cooperation Organization's Information Security Agreement;Footnote 73 and the 2014 African Union's Cyber Security Convention.Footnote 74 Although important in their own right, these international agreements govern only a handful of cyber-related activities (such as criminal offences committed using computer systemsFootnote 75 or operations interfering with existing telecommunications networksFootnote 76 ), or have a very limited membership (six states in the case of the Shanghai Cooperation Organization's agreementFootnote 77 and none yet in that of the African Union's conventionFootnote 78 ).
Therefore, although cyberspace is certainly not beyond the reach of international law, for now there is no complex regulatory mechanism governing state cyber activities.Footnote 79 Moreover, states seem reluctant to engage in the development and interpretation of international law applicable to cyber security. This voluntary retreat has left a power vacuum, enabling non-state actors to move into the space vacated by statesFootnote 80 and pursue various forms of ‘norm entrepreneurship’.Footnote 81
4. Power vacuum: Withdrawal of states and emergence of non-state initiatives
4.1. Power and law
Vectors of power and law do not overlap perfectly. State power is influenced by many factors, which may include military might, wealth, and moral authority.Footnote 82 Nonetheless, it needs little emphasis that the relationship between power and law is a particularly close one at the international level.Footnote 83 In this sense, states typically opt for one of two approaches in exploiting that relationship to further their interests. On the one hand, they frequently choose the path of legal certainty in order to consolidate and project their power. Indeed, if we understand power in the Nyean sense as ‘the ability to alter others’ behaviour to produce preferred outcomes’,Footnote 84 then setting specific legal obligations is one way how to exercise this ability.Footnote 85 Everything else being equal, it is more likely that these ‘others’ will act in accordance with a certain standard of behaviour when it is required by law than when it is not.Footnote 86
On the other hand, in certain contexts, the competing approach of legal uncertainty may be desirable to even the most powerful states. In other words, states may choose to instrumentalize the ambiguity surrounding the existence, content, and interpretation of legal rules as a power-protecting tool. For example, during the early days of space exploration, only two states were capable of acting in outer space: the US and the Soviet Union. Yet these two states resisted, for a significant time, commitment to any binding rules that would govern outer space. Both believed that the adoption of such rules would only serve to constrain their activities. In that vein, ‘[l]egal uncertainty was useful to those with the power to act in space, on either side of the cold war’.Footnote 87
However, cyberspace and outer space – albeit frequently lumped together as so-called ‘global commons’Footnote 88 – are decidedly different from one another. This is not only because many states are challenging the very idea of cyberspace as commons by seeking to assert greater control online.Footnote 89 More importantly, cyberspace is already a much more crowded domain than outer space could ever be. To wit, the US and the Soviet Union were not just the only states engaged in space exploration for several decades – they were also the only capable actors in this field.Footnote 90 In contrast, cyberspace is populated primarily by non-state actors, which include individuals, corporations, and other more loosely organized groups.Footnote 91 The possibility of anonymity online and the corresponding difficulty of attribution of cyber operations have resulted in the ‘dramatic amplification’ of power in the hands of these non-state actors at the expense of their state counterparts.Footnote 92
The effect of legal uncertainty is thus much more complex than previously seen in relation to outer space, as it affects a far more populous spectrum of actors, state and non-state alike. It is true that in terms of power and available resources, the relationship between states and non-state actors in cyberspace remains marked by ‘a clear disequilibrium in favor of States’.Footnote 93 And yet, faced with states’ silence, non-state actors have moved into the vacated norm-creating territory previously occupied exclusively by states. These developments have been primarily driven by the private sector and by academia, as epitomized by Microsoft's cyber norms proposal and the so-called Tallinn Manual project.
4.2. Leading non-state-driven initiatives
Firstly, Microsoft's proposal, entitled International Cybersecurity Norms: Reducing Conflict in an Internet-Dependent World, was published in December 2014.Footnote 94 Interestingly, this white paper was not the first private-sector initiative of its kind. Exactly 15 years earlier, Steve Case, then-CEO of AOL, urged states to revise their ‘country-centric’ laws and adopt instead ‘international standards’ governing crucial aspects of online conduct, including security, privacy, and taxation.Footnote 95 Still, Microsoft's text was the first comprehensive proposal of specific standards of online behaviour, which, despite its private origin, proposed norms purporting to regulate solely the conduct of states.Footnote 96 The openly-proclaimed central aim of this white paper was to reduce the possibility for information and communications technology (ICT) products and services to be ‘used, abused or exploited by nation states as part of military operations’.Footnote 97 To that end, the paper advanced six cyber security norms, which collectively called on states to improve their cyber defences and limit their engagement in offensive operations.Footnote 98
Microsoft's original proposal was met with criticism to the effect that by focusing on states, the paper ignored the crucial role that the industry must itself take on to achieve global cyber security.Footnote 99 In 2016, Microsoft responded to these claims by issuing another white paper, entitled From Articulation to Implementation: Enabling Progress on Cybersecurity Norms.Footnote 100 In it, the company proposed six further cybersecurity norms, this time addressed to ‘the global ICT industry’.Footnote 101 These were meant to complement and strengthen the norms published in the earlier document.Footnote 102
On the whole, however, the text made no secret of the fact that it, like the entire Microsoft-led cyber norms project, was still primarily addressed to states. Even parts that concerned the role of the industry were written in the form of demands that the recognition of that role would place on states. For instance, the paper appealed to states to involve the industry in the norms debate, to draw on its technical expertise, and to give greater weight to its input overall.Footnote 103 In early 2017, Microsoft further stepped up its initiative, calling on states to transform its six state-oriented norms into an international treaty with a bold working title: ‘a Digital Geneva Convention’.Footnote 104
Secondly, the Tallinn Manual was a seven-year project completed under the auspices of the Estonia-based NATO Cooperative Cyber Defence Centre of Excellence (CCD COE).Footnote 105 The project brought together an international group of experts under the leadership of Professor Michael Schmitt and resulted in the publication of two editions of the Manual, in 2013Footnote 106 and 2017 respectively.Footnote 107 Although both editions acknowledged the support of the NATO CCD COE, they also made it clear that the text reflected only the personal views of the experts and not their states or institutions of origin.Footnote 108
The first edition, entitled Tallinn Manual on the International Law Applicable to Cyber Warfare, maintained an almost exclusive focus on activities above the level of use of force. Its text identified 95 purported rules of customary international law, the vast majority of which related to the law on the use of force (jus ad bellum)Footnote 109 and the law of armed conflict (jus in bello).Footnote 110 The Manual quickly became a standard reference point and was deservedly praised for breaking new ground, as well as providing useful practical guidance.Footnote 111 However, early reviews and reactions from states not involved in the project criticized its preoccupation with military uses of cyberspace and noted that in reality, most (if not all) cyber operations fall below the threshold of use of force.Footnote 112
The 2017 edition, published under the slightly modified title Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations, addressed these criticisms by considerably expanding the scope of the study.Footnote 113 The second edition thus nearly doubled the number of rules identified, with a total of 154 agreed rules of custom, half of which relate to the jus ad bellum and the jus in bello.Footnote 114 In addition, the Tallinn Manual 2.0 covers multiple areas of ‘peacetime international law’,Footnote 115 including state responsibility,Footnote 116 law of the sea,Footnote 117 air and space law,Footnote 118 and even human rights law.Footnote 119 This substantive revision and expansion of the text will likely further strengthen the project's overall relevance, as well as its claim to authority. Yet like the Microsoft paper, both iterations of the Tallinn Manual project present standards of state behaviour and are avowedly state-centric in their approach.
4.3. Differences and similarities
Understandably, the two initiatives differ in important ways. The ‘norms’ proposed by Microsoft are clearly meant as broad suggestions only, meaning that states need to transform them into more specific commitments. For instance, norm 2 stipulates that ‘states should have a clear principle-based policy for handling product and service vulnerabilities that reflects a strong mandate to report them to vendors rather than to stockpile, buy, sell, or exploit them’.Footnote 120 As recognized in the 2014 paper, such policies need to be developed by, and tailored to the needs of, individual states.Footnote 121 The 2016 paper complements this general proposal by endorsing the existing best practice standards of co-ordinated vulnerability disclosure by the ICT industry.Footnote 122 However, neither of the two texts puts forward any more detailed prescriptions for states.Footnote 123
By contrast, the Tallinn Manual ‘rules’ take on the more restrictive and specific form of purported customary legal obligations, which should simply be observed by states as binding without the need for further endorsement or adaptation.Footnote 124 In other words, both editions of the Manual have aimed to interpret how ‘extant legal norms’ apply to conduct in cyberspace,Footnote 125 and not to ‘set forth lex ferenda’.Footnote 126 Nonetheless, the detailed and frequently novel positions put forward by the Manuals blur the fuzzy line between norm interpretation and norm development.Footnote 127 For example, Rule 99 (ex Rule 37) sets out the prohibition on cyber attacks against civilian objects in the context of armed conflict.Footnote 128 Both crucial terms – ‘cyber attacks’ and ‘civilian objects’ – are precisely defined in the Manual. Footnote 129 Although some disagreements may persist about the application of the rule in specific circumstances,Footnote 130 the content of the norm is sufficiently clear and precise to generate legal rights and obligations.
Yet, what initiatives like Microsoft's white papers and the Tallinn Manual project share is their non-state origin and expressly non-binding nature. Microsoft was keenly aware of its proposal's limitations in this respect and noted that it merely ‘encouraged’ states to set the proposed norms on the trajectory towards making them first ‘politically’ and then ‘legally’ binding.Footnote 131 Similarly, the first edition of the Manual stated in its introduction that it was meant to be ‘a non-binding document’.Footnote 132 As these texts are entirely the products of non-state initiatives, they could hardly amount to anything else. After all, with potential minor qualifications in the area of collective security, it is still true that only ‘the states are the legislators of the international legal system’.Footnote 133
If these texts are non-binding, one might question their relevance from the perspective of international law. Admittedly, their normativity (in the sense of the strength of their claim to authorityFootnote 134 ) is lower than that of international legal rules. Similarly, the ongoing International Law Commission (ILC) study on the Identification of Customary International Law notes in this regard in its draft conclusion 4 at paragraph 3 that the conduct of actors other than states and international organizations ‘is not practice that contributes to the formation, or expression, of rules of customary international law’.Footnote 135
But that does not mean that these efforts are wholly irrelevant in the formation of rules of international law, and even less do they suggest the irrelevance of international law to the area of cyber security. On the contrary, non-state-driven initiatives of this kind potentially amount to ‘a vital intermediate stage towards a more rigorously binding system, permitting experiment and rapid modification’.Footnote 136 Moreover, they render the law-making process more multilateral and inclusive than the traditional state-driven norm-making can ever be.Footnote 137 As the ILC recognizes in the remainder of the cited draft conclusion, conduct of non-state actors may be relevant when assessing the practice of states.Footnote 138 Therefore, the crucial question is whether states decide to take up the challenge and follow the example set by their non-state counterparts.
5. Offline analogies: States at a critical juncture
5.1. Soft law and hard law
The current situation is certainly not without historical parallel. Cyberspace is not the first phenomenon to have evaded global governance structures for some time after its emergence. A degree of waiting or stalling may even reflect states’ desire to obtain a better understanding of the new phenomenon's strategic potential.Footnote 139 Yet with states’ improved grasp of the new situation usually comes increased willingness to subject themselves to binding rules. Even the domain of outer space was eventually subjected to a binding legal regime,Footnote 140 despite the strong initial reluctance of the dominant spacefaring states.Footnote 141
Other domains with a higher number of participants may provide more appropriate analogies. A good example is the legal regime of the Antarctic region. Although its central instrument, the 1959 Antarctic Treaty,Footnote 142 is a binding international agreement, it did not establish a comprehensive legal regime regulating all aspects of the Antarctic environment.Footnote 143 Instead, it allowed for and, to some extent, encouraged the adoption of ‘recommended measures’ and other types of non-binding norms for specific areas of international concern.Footnote 144 Indeed, in the 1960s and 1970s, state representatives put forward many ‘soft norms’ of this kind, which shared the objective of preservation and conservation of living and non-living resources in Antarctica.Footnote 145 Subsequently, some of these measures were implemented by many (though not all) parties to the Antarctic Treaty in their domestic law, paving the way for consolidation of the norms in question into international ‘hard law’.Footnote 146 This finally materialized with the adoption of the 1991 Antarctic Environmental Protection Protocol, a complex binding instrument that has since been ratified by all key stakeholders.Footnote 147
Another useful parallel is the regulation of nuclear safety in international law. Although the first nuclear power plant became operational in 1954 in Obninsk, Soviet Union,Footnote 148 it took over three decades for the first international conventions on nuclear safety to be adopted.Footnote 149 In the meantime, states were guided by non-binding safety standards and criteria, most of which were issued by the International Atomic Energy Agency (IAEA).Footnote 150 Afterwards, nuclear safety conventions adopted in the 1980s and 1990sFootnote 151 consolidated this emerging body of non-binding norms and made many of the relevant standards mandatory for all member states.Footnote 152 Once again, states proceeded cautiously, slowly transforming into binding law those norms that were perceived as workable and acceptable by all stakeholders.
Of course, there are important differences between these areas of international law and the cyber security domain. Perhaps most visibly, unlike the cyber norms initiatives analyzed previously, the law-making processes relating to the environmental protection in Antarctica or the global nuclear safety had been predominantly state-driven. However, that should not detract from their value as examples following the time-honoured trajectory of transformation from soft law norms into hard law rules.Footnote 153
After all, there is no doubt that non-state actors have, on many occasions, contributed to the adoption of binding multilateral international treaties. For instance, it is well known that the lawyer Raphael Lemkin played a central roleFootnote 154 in campaigning for, and later drafting, the 1948 Genocide Convention.Footnote 155 Similarly, the 1984 Convention against TortureFootnote 156 was adopted after years of international pressure led by Amnesty International.Footnote 157 A more recent example is the 2008 Convention on Cluster Munitions,Footnote 158 agreement on which was catalyzed by the presence of cluster munition attack survivors at the formal negotiations.Footnote 159 To partially paraphrase Margaret Mead's famous quote,Footnote 160 non-state actors might not be the only thing that ever has changed international law, but they are certainly capable of doing so.Footnote 161
Therefore, instead of lamenting the supposed crisis of international law, it is more appropriate to view the current situation as an intermediate stage on the way towards the generation of cyber ‘hard law’. Non-state-driven initiatives provide opportunities for states to identify overlaps with their strategic interests. In other words, these initiatives may serve as norm-making laboratories, allowing states to weigh the pros and cons of various proposals in context and decide which ones to endorse and which ones to reject. Their usefulness in this sense is confirmed by a 2015 EastWest Institute report, which helpfully maps out areas of convergence across various proposals of norms of state behaviour in cyberspace including those analyzed in this article.Footnote 162 As noted in the report, most norm-making initiatives agree on the general principles ensuring the stability and security of cyberspace, as well as on the need for state co-operation in mitigating malicious cyber incidents.Footnote 163
5.2. Timeliness and attribution
Even if this article's contention regarding the feasibility of the soft-to-hard-law pathway in cyberspace is accepted, one might still question whether it is the right time for states to take legislative action. It is submitted that the key to this question of timeliness can be found by unpacking the so-called attribution problem, which relates to the difficulty in determining the identity or location of a cyber attacker or their intermediary.Footnote 164 In fact, for some time, the attribution problem was rightly seen as an impediment to the development of effective legal regulation of cyber activities. It was argued that the prevailing anonymity online ‘makes it difficult – if not impossible – for rules on either cybercrime or cyberwar to regulate or deter.’Footnote 165 Indeed, without victim states being at least theoretically capable of identifying sources of malicious cyber operations against them, any attempts to design rules aimed at constraining the perpetrators of such attacks would have very limited prospects of success.
However, recent technological progress has translated into increased state confidence in attribution of cyber activities. For instance, since 2012 the US has maintained that it possesses the capacity to locate cyber adversaries and hold them accountable.Footnote 166 It has subsequently put this position into practice by unequivocally attributing several high-profile cyber attacks to other states (the 2014 ‘Sony hack’ to North KoreaFootnote 167 and the 2016 ‘DNC hack’ to RussiaFootnote 168 ). In a recent publication, a US Department of Justice official made the link between cyber attribution and norm-making explicit: ‘[W]e will be able to use our ability to attribute malicious cyber activity to push other countries toward accepting and abiding by cyber norms’.Footnote 169
Other countries soon followed suit. In 2014, Canada noted that it had robust systems in place allowing it to localize cyber intrusions, including those orchestrated by state-sponsored actors.Footnote 170 In 2015, the United Kingdom stated it was ‘increasingly confident in [its] ability to determine from where attacks come’.Footnote 171 In 2016, Germany's Federal Office for the Protection of the Constitution reported that it had been able to attribute ‘electronic attacks’ against targets in Germany to attackers operating from China and Russia, as well as to Iranian governmental agencies.Footnote 172
The extent to which these public statements should be taken at face value is debatable.Footnote 173 When signaling confidence in their attribution capabilities, states may admittedly be motivated by other factors, including their legitimate aim to deter future attacks in general.Footnote 174 After all, to put the point at its lowest, deception is certainly not a behavioural pattern foreign to the cyber domain.Footnote 175 Nevertheless, as a general trend, maintaining anonymity online is becoming more difficult and actors in cyberspace may consequently be expected to give increased consideration to the regulation of cyber conduct.
In addition to these technical considerations, significant progress has also been made in understanding the legal standards of attribution as applied to online conduct.Footnote 176 Although the existing law of state responsibility is not without uncertainties in relation to the attribution of cyber operations to states, it can no longer plausibly be claimed that this area of law is unsuitable for cyber conduct. On the basis of the foregoing, it can therefore be summarized that while it is probably correct that the attribution problem can at most be managed, but not solved,Footnote 177 these developments show that the time may have arrived for states to endorse the regulatory and deterrent potential of international legal rules.
5.3. Way forward
Building on the emerging normative convergence identified above, states today have a unique opportunity to reclaim their central role in international law-making as far as the law of cyber security is concerned. Due to the complex nature of the field and the plurality of actors that populate it at present, this will likely not be a quick or a simple process. In this regard, states’ prospects of success will depend on their willingness to act in specific legislative ways that can be organized into short-, medium-, and long-term strategies.
In the more immediate future, states should be more forthcoming in expressing opinions on the interpretation of existing international law to cyber issues.Footnote 178 This will in time enable the applicable opinio juris to consolidate, thus facilitating the process of transformation of state power into obligations of customary law.Footnote 179 In order to increase their ability to meaningfully engage in this process, all states should make the development of cyber security expertise a domestic priority; complete or update national cyber security strategies;Footnote 180 and streamline decision-making, leading to the adoption of positions on ambiguous legal matters concerning cyber security.
Crucially, these steps may include the need to engage with those non-state actors that are currently driving the ongoing norm-making efforts.Footnote 181 States participating in the UN GGE process acknowledged as much in the 2013 report.Footnote 182 Similarly, Microsoft included a call for states to take industry input into account in its most recent white paper.Footnote 183 Finally, in early 2016, over 50 states submitted observations on the draft second edition of the Tallinn Manual to the international group of experts as part of the so-called ‘Hague Process’, a joint effort of the Dutch Ministry of Foreign Affairs and NATO CCD COE.Footnote 184 This demonstrates states’ growing awareness of the importance of contributing to the international norm-making process.Footnote 185 However, the Hague Process consultations were held behind closed doors and the views submitted by participating states have not been and will not be made public.Footnote 186 As such, they cannot be seen as contributing to the formation of customary international law per se.Footnote 187 Still, the fact that so many states felt ready and able to take part in the consultations suggests that to the extent states remain silent on their opinio juris, this decision needs to be explained by factors other than the purported absence of considered legal views on their part.Footnote 188
Although it is important for states to become more open in expressing their cyber opinio juris, that is but the first step if they are to succeed in reclaiming a central role in international law-making. In the medium term, states should also aim to gradually overcome their current aversion to treaty commitments. There are some early signs that this process may already be under way. For example, in September 2015, the US and China concluded a ‘surprising’Footnote 189 agreement to refrain from certain types of cyber espionage.Footnote 190 A series of further non-binding bilateral agreements between the key players entered into in the recent period may also gradually pave the way for legally binding cyber treaties.Footnote 191
Finally, this iterative process of state-appropriated norm-making could plausibly result in the adoption of comprehensive multilateral undertakings. These would likely begin with definitional matters, enabling future consensus-building over more substantive issues.Footnote 192 There are a number of key terms with contested or unclear meanings, including ‘critical infrastructure’,Footnote 193 ‘cyber attack’, ‘cyber warfare’ and ‘cybercrime’.Footnote 194
Once states agree on a shared definition of these concepts, the next step may be to identify the ‘low-hanging fruit’ of agreement on matters of substance. Their precise scope falls to be determined by further research. However, studies looking at overlaps between various norms proposals may provide some initial pointers.Footnote 195 Equally, states may be willing to act – including by legislating on the international plane – against threats that affect them all. One such example may be ‘botnets’, networks of private computers infected by malware and controlled as a group without their owners’ knowledge.Footnote 196 These have rightly been described as ‘a scourge to all’ and a multilateral consensus to outlaw the building of such systems may be within the realm of the possible.Footnote 197
6. Conclusion
International cyber security law is at a critical juncture. It is true that states’ hesitation to engage in the development and application of international law has left a power vacuum allowing for the emergence of non-state norm-making initiatives. Still, it would be premature to speak of crisis.
Several historical parallels show that a mixture of initial soft-law approaches combined with a growing set of binding rules can provide a logical and functioning response to a novel phenomenon. In the twenty-first century, pluralization of norm-making processes involving diverse state and non-state actors is a common feature at the international level and it need not be feared as such.Footnote 198 Moreover, states have recently started to awaken to the need to publicly express their views on how international law applies in cyberspace.Footnote 199
To return to the quotes cited at the start of this article, initiatives by small groups of thoughtful committed people from academia, industry or elsewhere should be welcomed because of their potential to change the world by steering the development of law accordingly.Footnote 200 What matters is whether states will respond in a way that will reaffirm their position at the heart of the international legal system when it comes to cyber security.Footnote 201 It appears that at least some state representatives already realize that compliance with international law frees them to do more, and do more legitimately, in cyberspace.Footnote 202
It remains to be seen whether this awareness will spread and gradually translate into states’ general willingness to also shape the content of the law by reclaiming their traditional central legislative role in this area. In this way, states’ conduct over the next few years will determine whether we observe the demise of inter-state governance of cyberspace or a fundamental recalibration of legal approaches, with states taking centre stage once again. If they want to ensure that the existing power vacuum is not exploited in a way that might upset their ability to achieve strategic and political goals, states should certainly not hesitate too long.
