A Dose of Realism: The Contestation and Politics of Cyber Norms

Abstract

Norms for cyberspace remain highly contested internationally among governments and fragmented domestically within governments. Despite diplomatic activities at the United Nations over the past two decades, intersubjective agreement on norms governing coercive cyber power is still nascent. Agreed upon, explicitly stated norms are considered voluntary, defined vaguely, and internalized weakly. Implicit state practice is slowly emerging, yet poorly understood, and cloaked in secrecy. This raises the question: how do norms emerge for cyberspace? What has been the contribution of the UN process to the international community’s understanding of norms for cyberspace? Why did the process collapse in 2017, the very same year that two of the biggest cyber attacks to date—WannaCry and NotPetya—caused indiscriminate economic harm worldwide each with an estimated cost of several billion U.S. dollars? And why did member states, in an unprecedented move in the UN’s history, create two separate processes dedicated to the same issue in 2018? To answer these questions, this article analyses the various factors feeding into the dynamic process of norm contestation including an in-depth discussion of the process at the United Nations, the role of international law, and the main points of critiques.