10 Civic Virtue and Cybersecurity

Cyberspace is emerging as one of the most important conflict arenas in the twenty-first century, all the more so as the line between cyberconflict and conventional kinetic conflict is gradually erased. This chapter argues that the traditional “rights” framework is not adequate to the task of both theorizing cybersecurity and cyberpeace and constructing effective institutional systems for their maintenance. What is recommended, instead, are theoretical and institution-building approaches based upon the “civic virtues” framework. Foremost among the arguments for employing the “civic virtues” framework is that it is far better adapted to the complex and constantly changing community structure within cyberspace, wherein the practices conducive to the achievement of community-specific goods cannot be adequately facilitated and protected by means of a general and static specification of rights. The chapter concludes with consideration of specific civic virtues pertinent to life in the cyberworld, prominent among them being comity and peaceableness.

Examples illustrate the challenge. With Estonia (2000) and France (2009) taking the lead, a total of six nations have now, in some manner, declared internet access a human right, and, in 2011, United Nations Special Rapporteur Frank La Rue asserted more or less the same in a report prepared at the behest of the UN General Assembly's Human Rights Council. 1 Already in 2003, the "Declaration of Principles" of the UN and International Technological Union World Summit on the Information Society asserted that: Communication is a fundamental social process, a basic human need and the foundation of all social organization. It is central to the Information Society. Everyone, everywhere should have the opportunity to participate and no one should be excluded from the benefits the Information Society offers. 2 One is hard pressed to imagine the United States, Russia, or China following suit, certainly not in the near term. And Google Vice-President Vinton G. Cerf argues that, while internet access is increasingly a crucial asset for the achievement of rights like freedom of expression, the Internet itself is simply a technology and cannot, therefore, be either a human right or a civil right. 3 There will be no international consensus on a right to internet access with Google in the dissent. How, then, secure the Estonian's asserted right if that right ceases to be a right at the Russian and Latvian borders?
Consider another example. It was reported in September 2012 that Microsoft had discovered many laptops made in China that shipped with a fake version of Windows infected with malware associated with the Nitol directed denial-of-service (DDoS) botnet. 4 In public, the finger of blame was pointed at criminal enterprises taking advantage of an insecure supply chain. China being China, one may be forgiven for doubting that attribution. I have always assumed that, from the moment I first make an internet connection while traveling in China, my computer, tablet, or smart phone will be compromised. Have my rights been violated? Or is "traveler beware" the axiom? I have always assumed that the Chinese-made Lenovo laptops my university forces me to use come preloaded with spyware, if not also malware of the mentioned kind. Do I have a right to privacy with what I store, email, and post with my Lenovo? If my infected laptop is used in a Chinese government botnet attack on Japan, do I have a right not to be a target of Japanese retaliation? If so, who polices those rights?
There will be no structure of international law and law enforcement to secure internet access and privacy rights. The will and the wherewithal is lacking. What, then, is to be done?

Failures of the Rights Framework
One of the fundamental problems standing in the way of progress on these issues is the rights framework itself. Claims about human rights are usually grounded either in claims about the status of human persons and their natures or in claims about the consequences of respect for rights as conducive to the achievement of interests. The American Declaration of Independence asserts, famously, that "all men… are endowed by their Creator with certain unalienable Rights," and another variety of status theory grounds a right to personal freedom in a claim of property in or propriety over one's individual body and mind. The metaphysics is questionable and contestable. No rights without theism? No individual rights for communitarians? It is surely hard to imagine that some sudden change in human nature made internet access a human right when, previously, there was none such. And does my Second Life avatar have a nature from which flow rights?
A consequentialist about rights has an easier time with internet access as a fundamental human right, arguing from the interests served by the existence of such a right. Of course, one might ask whether it is the interests of the individual internet user or the interests of the access provider that, in fact, not in theory, count for more. More generally, the consequentialist approach makes the existence of human rights a matter of contingencies, for all relevant claims about consequence are empirical, a circumstance that puts pressure on the notion of there being fundamental human rights. For example, a consequentialist like Hobbes (or is he a contractarian?), views respect for rights as a check against the slide into a barbarous state of nature, and, thus, as conducive to the interests of those constituting a civil society. But what if people are by nature beneficent, not selfish? That's an empirical question. If, in fact, people are naturally nice to one another, as premised by the theory of the moral sentiments espoused by Adam Smith and David Hume, is respect for rights no longer necessary?
Is the situation any better with respect to civil rights, by contrast with human rights? Claims about civil rights are usually grounded in explicit, legal assignments of rights. The US Bill of Rights grants a right to protection against self-incrimination, a right of due process, a right of assembly, a right to the free practice of religion, a right to privacy, and, in the opinion of some, a right to bear arms. But each polis might confer different rights upon its members. Many other nations do not grant that last right, at least, a right to bear arms. And, absent a duly constituted political authority, are there any civil rights at all? What, for example, are we to say of the Universal Declaration of Human Rights' curious assertion that "everyone has the right to a nationality?" 5 Which nation will be compelled, as a last resort, to grant citizenship or permanent residency to a particularly wretched or abhorrent, stateless soul, and what authority can enforce such a right? Do we constitute a new polity just for the stateless? Is the United Nations the polis of last resort?
Status approaches to human rights are as fragile as the metaphysics they all require. Consequentialism about human rights runs aground on problems of contingency about what is or is not an interest of an individual or a group and about whose interests count for more. Contingency of a different kind-accidents of political geography and topology-plagues the civil rights framework.
Forgive this breezy rehearsal of what are old laments about the rights framework. The point mainly to be stressed is that, however serious are all of these old objections, the problems grow only worse still when we ask about rights in cyberspace. This is especially true of the civil rights framework, because the notion of the polity that traditionally underpins it-a geographically contiguous (or roughly so) group of individuals living within a structure of law and custom with duly constituted and acknowledged authority over the members of the groupsimply does not exist, for the most part, in cyberspace. Internet users form a group; arguably even a community and a complex network of subcommunities, as will be discussed later. But they do not form a polity, mainly for want of the kind of duly constituted authority through which civil rights could be granted and guaranteed and partly because the community structure within cyberspace does not respect the boundaries of the traditional human communities whose political structures might otherwise have been easily extended-with their laws, rights, and policing mechanisms-into cyberspace. One might imagine a global form of cybergovernance and policing. Were there such, the argument would run differently. But, except within very limited domains, there is none such and will be none. 6 If the customary rights framework will not work in cyberspace, what are we to do? My answer is to turn from talk of civil rights to talk of civic virtues.

Rights Versus Virtues
A deep incompatibility between the rights framework and the virtues framework is widely assumed. The most famous modern virtue theorist, Alasdair MacIntyre, is often quoted as saying in his classic, After Virtue, that "there are no such things as rights, and belief in them is one with belief in witches and in unicorns." 7 At issue for MacIntyre are both the metaphysics of status approaches to human rights and the political ontology of the liberal individualism that otherwise informs much of recent rights theory. MacIntyre is, in modern parlance, a communitarian, one whose political ontology makes the individual not an autonomous center of moral and political authority but, as it were, a functional unit in a larger social whole. For MacIntyre, there can be no individual rights because there are no individuals of the kind assumed by liberal political theory. That same organic conception of the person in the polis informs MacIntyre's perspective on virtue as cultivated habit aiming at the good, such habits developing only through social mediation as socially inculcated and maintained patterns of action.
Some theorists would argue that the incompatibility is, more specifically, between rights and duties, the latter presumed to comport more easily with the virtue framework. Locating the problem here is a move that I find less helpful than MacIntyre's locating it at the deeper level of political ontology. This is because I view duties as just the complement to rights, duties being obligations to act, whereas rights are immunities from action, entailing, thus, obligations on the part of the state and its agents not to act. Hence, to whatever extent rights are held to be derivative from laws, so, too, are duties. Besides, on my view, extracting duties from virtues risks exchanging the flexibility of virtues for the rigidity of duties. Part of the charm of the virtues framework is, precisely, that the expectations attached to virtues are not for always and everywhere, but, again, for the most part and on the whole.
We need not follow MacIntyre in simply repudiating talk of rights as incompatible with talk of virtues. In a moment, I want to take up the question of how to reconstruct rights talk within the virtue ethics framework, the short version being that just as laws are understood by virtue theorists as tools for policing community boundaries, so, too, are the rights derivative from some laws best understood as exercises in political perimeter patrol. But first we need a refresher course on virtue ethics and civic virtue.

Moral Virtues and Civic Virtues
For virtue theorists from the time of Aristotle and Aquinas up to MacIntyre, virtues are settled habits of action aiming at the good. Included are virtues like wisdom, generosity, prudence, justice, humility, hope, charity, and love. Neither instincts nor mechanical, repetitive behavioral routines, virtues as habits are dispositions to act, for the most part, on the whole, for the good. For MacIntyre, as for Aristotle, each virtue, such as courage, lies at some mean between two extremes, in this case the extremes of rashness and timidity. Virtues are contextual, in that where the mean lies depends upon circumstance. Rashness in the face of overwhelming odds might be timidity in the face of a weak foe.
Virtues are contextual also in the sense that they exist only among persons who live in community, being, as mentioned, socially inculcated and maintained, and reflecting, therefore, the goods of that community. Spartan courage and Athenian courage are different.
The sum of the virtues that makes a whole person is character. The person of exemplary moral character, the moral model, acts morally by nature, with "nature" understood now not as some ontologically fixed, perhaps divinely ordained kind of being but, instead, as the inscribed result of growth to moral maturity in a community. One is who and what one is, as a moral agent, as a result of one's having been nurtured in virtue from childhood and sustained in virtue by life in a community of other moral agents whose better dispositions reinforce and complement one's own.
Moral judgment, as understood in this framework, is less a matter of enacting a practical syllogism from moral first principles to consequent acts and more a matter of modeling one's actions upon those of moral exemplars. The reflective moment in moral action involves not so much theory and its implications for action but a discerning survey of the exemplars of which one finds oneself possessed through a lifetime of moral experience. If anything resembles a principle, it looks less like a self-evident moral truth and more like a generalization, the product of an induction from many examples of right action in a wide variety of circumstances and, being such, it will be hedged about with ceteris paribus clauses and other such qualifications necessitated by the contextual nature of all virtue.
The exercise of virtue is a straightforward matter with virtue defined as a species of habit, for a habit, a disposition to act, is such only if, on the whole, one does so act. The beneficent person is generous not thanks to any external compulsion but simply because he or she is beneficent, for to be a beneficent person is, simply, to act generously in the right circumstances. This may sound like the hocus-pocus involved in a natural philosophy that explains opium's tendency to put one to sleep as a consequence of its possessing a dormitive virtue, when the dormitive virtue turns out to be nothing more than the very tendency one sought to explain. It would be a comparable error to explain the philanthropist's charity as caused by his or her beneficence, but the point is precisely that virtues do not cause their entrained behaviors, for a virtue simply is the tendency so to act. The causality lies elsewhere, in the social structures and the actions of one's elders and fellow citizens whereby the virtuous habit was first instilled and then sustained. The causality is out in the community, not in the person. There is no conscience, no bossy little homunculus inside my soul either whispering, metaphorically, in my ear or kicking my metaphorical behind. There is, instead, a community structure proper participation within which is the life of virtue.
Thus, the moral virtues in general. The civic virtues are the virtues specific to life in a community or polis, or, rather, to the flourishing of the community. A contemporary theorist, Michael Walzer, lists five such in an influential essay from roughly the same time as MacIntyre's After Virtue: Loyalty, service, civility, tolerance, and participation. 8 Their cultivation and exercise among a sufficiency of the citizenry is held to be essential to the proper functioning of the community. Like the moral virtues, the civic virtues are settled habits to act toward the good, and wherein consists loyalty, service, civility, tolerance, and participation depends partly upon circumstance.
Walzer's is an interesting list, to some of which I will return later with specific reference to civic virtue in cyberspace. For the moment, and by way of anticipation, think only about the first. Loyalty to what? Walzer's answer is interesting, for it is not loyalty to the nation, per se; rather, it is loyalty to the idea of republican government as embodied in a nation. It is loyalty to an ideal, not loyalty to a people, a place, or even a specific set of constitutional arrangements. One might deride this as an all-tootypical American form of irreality, contrasted with, say, the Croat's more ethnically centered loyalty to Croatia or the Catalan's loyalty to place as well as people. But "place" and "people" are just as much abstractions as "the Slovak Republic" or "Athens." Consider the words that Michael Frayn has Heisenberg speak in the play, Copenhagen: Germany is where I was born. Germany is where I became what I am. Germany is all the faces of my childhood, all the hands that picked me up when I fell, all the voices that encouraged me and set me on my way, all the hearts that speak to my heart. Germany is my widowed mother and my impossible brother. Germany is my wife. Germany is our children. 9 Heisenberg's Germany, the Germany to which Heisenberg was loyal and the Germany where Heisenberg served as leader of the German atomic bomb project, is another abstraction, one embodied in faces, hands, voices, brother, wife, and children, but an abstraction, nonetheless. Since loyalty to abstractions is about all that we can imagine in cyberspace, it is well to be reminded that this first among Walzer's civic virtues has about it already an air of the virtual.
Walzer wrote his classic essay, "Civility and Civic Virtue in Contemporary America" in 1974 to query the perception of a decline in civic virtue. His main point was a subtle one. He proposed an exhaustive list of the civic virtues, about the alleged decline of which he then commented: We shall see that we are the citizens we ought to be, given the social and political order in which we live. And if critics of our citizenship remain dissatisfied, then it will be time to ask how that order might be changed. 10 The task that confronts us in thinking about rights in cyberspace is of a piece. We perceive a problem and we ask how the social and political order might be changed. Like Walzer, I choose to think about that problem in the language of civic virtues.

Rights and Virtues Reconsidered
Tension between rights talk and virtues talk was noted earlier, where we located the basis of MacIntyre's objection to rights in a communitarian political ontology that precluded individual rights because it denied the existence of individuals of the kind assumed in liberal political theory. Does any room remain within the virtues framework for rights or some functional surrogate for rights? If we think of rights not as human rights but as civil rights, as rights conferred by law, then rights might well have a place alongside virtues.
The same MacIntyre who so vigorously disputes the liberal individualist conception of rights provides the clue when he writes about laws, within the virtues framework, as tools for policing community boundaries. In a properly functioning community, with a sufficiency of the citizenry acting virtuously, law and moral principle are not as important for sustaining the community as might be imagined by those who are products of different traditions, and certainly not the children of the liberal individualist tradition. In a trivial sense, virtuous citizens simply do the right thing without compulsion or fear of punishment, so that, in a community of morally perfect citizens, law would be unnecessary.
But, of course, even in the best of all political worlds, not every citizen behaves thusly. The vicious, who lack virtue, behave badly, but so, too, sometimes, do the virtuous, for virtues, being habits, which is to say, dispositions or tendencies, are not mechanical routines, nor could they be. Thus, the actions of even the best sometimes miss the mark. Stray too far from the mark too often and one's membership in the community is at risk. In smaller communities, this happens by shunning. One who, among a tight-knit group of friends, regularly betrays secrets, harshly criticizes others, and lets favors go unrepaid will soon find him-or herself without those friends. In larger, more complicated communities, exile might take the place of shunning, including forms of internal exile ranging from disenfranchisement to prison. One lives, physically, within the community but does not partake fully in the life of the community.
Law marks the boundaries of acceptable action within the community, circumscribing the limits of full citizen participation. In a sense, law applies to all, both the law-abiding citizens and the scofflaws. But in the moral psychology of the virtuous majority, neither law, nor promise of reward, nor threat of punishment act as motives. I pay my taxes, for example, not because I think that I must in consequence of the law nor because I fear the consequences of an Internal Revenue Service audit. It is, simply, what I do as a virtuous member of the community; it is my wont, to use a good old English word. Laws do not motivate the good. They function instead more like signposts: "Beyond this point lies moral and political oblivion." Stray too far from the virtuous mean and you lose your status as full-fledged member of the community.
Within the virtues framework, the boundaries marked by laws are fuzzy. Virtues being always for the most part and in the main, as well as context-dependent, lapses from virtue will be likewise. Almost never will one vicious act, except for the most heinous, suffice for complete and permanent removal from society. Three strikes and you're out, not one. Exceptions will be numerous. Wide discretion in the application of the law will be needed. A star infielder won't be benched for one error, but a pattern of error will have the coach thinking about substitution. Likewise, pilfering from the till and a few white lies won't get one sent to prison. Only when misdemeanor becomes felonious will stronger measures be appropriate.
How does the virtue theorist think about those stronger measures? Are they punishments? Retribution? Therapeutic interventions in hope of remediation? Earlier I invoked the metaphor of internal exile. It was seriously intended. For the virtue theorist, full membership in the community is necessary for individual flourishing, and a virtuous citizenry is necessary for the flourishing of the community. Lapses from virtue that near the boundaries marked out by law then call for removal from the community. Such removal comes in many forms, the most extreme of which are imprisonment, exile, and execution. The virtue theorist regards them all as, in the first instance, modes of removal from full citizen participation. Likewise more modest measures.
Attend carefully to the language now. Notice how we speak about lesser lapses as calling for steps like the revocation of a driver's license for driving while intoxicated where no direct harm to others was done. One loses one's "right" to drive. In the United States, a convicted felon, after release from prison, loses the right to vote. A monetary fine or the seizure of one's property can be seen as limiting one's right to own property or, thanks to diminished means, one's right to the pursuit of happiness. And, after all, imprisonment entails loss of the right to liberty and the right to privacy, and execution entails the loss of the right to life. The point is that what the virtue theorist sees as lesser or greater removal from full participation in the life of the community is easily parsed as the loss of rights of one kind or another.
That is precisely the clue about how we might think about rights in the virtues framework. What is normed is not rights, in the first instance, but full citizen participation in the life of the community. It would be an abuse of language and theory to speak of a "right" to full participation, but rights talk comes quickly to mind when we talk of constraints on full participation, this in the form of talk of loss of one's rights. If we switch from the negative to the positive, from talk of the loss of rights to talk of full possession and exercise of rights, we find ourselves naming in this manner the modes of full citizen participation.
As a friend of the virtues framework and a skeptic about the rights framework, I see here a considerable gain. No list of rights can capture the richness of the notion of the virtuous citizen's full participation in community. Furthermore, rights talk alone merely delimits spheres of the permitted without prizing the exercise of the capabilities that should flourish in those spheres. Foregrounding, instead, the notion of the virtuous citizen's full participation in community valorizes the active exercise of the virtues within the arenas access to which is correlative with full participation. In the agora, I may speak and I will, when and as appropriate.

Civil Rights, Civic Virtues, and Cybersecurity
Forgive the longish excursus through a virtue ethics landscape well known to many. But with that behind us, let us return, now, to the question of civil rights and cybersecurity, reformulating the issue in the virtues framework. The key notion will be the virtuous citizen's full participation in community. Virtues being derivative from life in community, the first problem is what counts as the relevant notion of community in cyberspace.
Much has been written, both deep and facile, about new community structures in cyberspace. They range from groups of Facebook friends and Twittermates, to the social action networks that played such a large role in Arab Spring, from crowd funders and players of massively multiplayer online role-playing games to users of the US Department of Defense's ultra-secure intranet. The Internet in its totality might be modeled as a community. These structures have a complicated topology and geography, with overlap, hierarchy, varying degrees of mutual isolation, and mutual interaction. There are also communities of corporations or corporate persons, gangs of thieves, and bands of angels doing charity on scales small and large. With progress in artificial intelligence, there are already now and soon will be more non-human and trans-human actors in cyberspace. Most cyber communities transcend traditional geographical and political boundaries, but some-either by accident or design-respect such bounds, as with my neighborhood discussion list.
Each of these communities evokes virtues appropriate to its own goods, context, and history. Just as Athenian virtue and Spartan virtue are somewhat different, so, too, will be the virtues appropriate to the community of online genealogists and the community of Spotify fans. It follows immediately that there will be no univocal answer to the question of balancing, say, a right to privacy, or the virtue ethics surrogate for that, against the need for online security. If I have any one main point that I want to stress in this chapter it is that the community-relative nature of the configurations-by which I mean, ultimately, the social and political structures-will norm our practices. Each community will evolve different customs regarding permitted and commendable disclosure and refusal to disclose. The Facebook community is more accepting of extensive disclosure, the LinkedIn community a bit less so. Individual preferences can and do vary within each, but patterns of practice emerge. The two communities differ, as well, with regard to the degree of intrusion and control they tolerate for the sake of guaranteeing their respective expectations about privacy. The more corporate LinkedIn world tolerates tighter, top-down controls. Facebook users are quicker to complain about highhandedness on the part of the Facebook management and expect more individual latitude in setting privacy levels.
Noteworthy in my view is the manner in which customs and norms evolve from within these communities, rarely by way of explicit legislation or rule making, more often just emerging as communities mature. Since I happen to be a long-time member of the community of online genealogists (it's a hobby of mine), let me speak about examples in that domain. When the community was young and first enjoying the gains of easy data sharing, it was common for GEDCOMS (the acronym for Geneological Data Communication) to contain birth dates for living individuals and social security numbers for even the recently deceased. 11 Today, one almost never sees either. The reason is simple. It was quickly realized that identity thieves were lurking in the community and harvesting such data. There exists no authority for policing genealogical practice.
No new laws have been written, and no one has been fined or jailed for a breach of privacy rights. But community practice changed nonetheless. How practice changed is interesting. First, exemplary practices were emulated, as one just noticed how wiser collaborators shared their data and then followed suit, learning along the way to be more alert to the risks of disclosing too much and more respectful of those whose lives were affected. Civility is among the relevant civic virtues here. Second, those whose practices did not mature in this way just disappeared from the community. Since there is no constituted authority, no one was forbidden to post to discussion boards or publish data online. Instead, those who cared more about best practices simply stopped sharing with those who did not. Those lacking in virtue were exiled.
Striking the right balance is an ongoing challenge within this community. There was an outcry from genealogists-but also epidemiologists, social scientists, and other researchers-when the Social Security Administration several years ago removed some four million death records from its public data base, after determining that it was not legally obligated to make this batch of data public. The government's aim was to make identity theft more difficult, a goal upon which all members of the community agree. But the research communities clearly preferred self-policing of their practices. The balance preferred within all of these communities involves open initial access to the data with strict, self-imposed restrictions on the further sharing of that data.
What about my data? Do I have a right to privacy about my birth date and my social security number in online databases? In all honesty, it has never occurred to me to think that way. Why? Consider a different online community, the community of customers of my local credit union. A lot of my personal data sits in the credit union's servers. If I were to assert a privacy right to the data in that context, it surely would not be absolute, because the reasons why I joined that community entail a necessity precisely to reveal that data to some members of the community, namely, those employees of the credit union whose jobs require access to that data. My full participation in that community, with all of the goods that such participation makes possible, from direct deposit of my paycheck to low-cost mortgage financing, requires disclosure. The problem is not disclosure per se. The problem is disclosure to the wrong people in the wrong fora at the wrong times and in the wrong ways, or the use of the data in the wrong way. The failure, the lapse, if there is one, is not that my right to privacy has been violated but that another member of the community has not behaved as virtue demands.
Turn our attention to another asserted right, discussed at the beginning of the chapter, the right claimed in Estonia and France to internet access itself. Does one have such a right? My answer is no. But that doesn't mean that I don't want people to have internet access. I would have us ask, instead, what is required for full citizen participation in various communities and, thus, the flourishing of those communities. Internet access being a precondition for participation in any cyber community, there simply are no such communities without access, so if we deem full participation in any cyber community a good, then members of the community must have access. Internet access is not a right in part because no duly constituted authority on an appropriately international scale can declare it to be a right. But civic virtue among the relevant members of many online communities-say each official of the telecom agency in each member state of the European Union as it exists in cyberspace (and all states now exist in cyberspace)-involves their taking such steps as are necessary and appropriate to facilitate internet access for those within their area of responsibility. A good analogy would be as follows. Full citizen participation in democratic government requires access to voting. Corresponding to that is the expectation that election officials will facilitate, not impede, access to the polls. Service-in the guise of public service-is the relevant civic virtue from Walzer's list, service in this context involving the facilitation of access to both the voting booth and the internet.
Exactly how to facilitate access and who has a responsibility to help in affording access will remain a matter local to different communities. In a poor nation, internet access will probably have to be free for all. In a wealthy nation, paid access for most will suffice, with subsidized access for the few. In a community with excellent public transportation or widespread ownership of private transportation, it will suffice to open the doors to the polls. In a poor, rural community, with isolated elderly voters scatted over a wide space with no transport of their own, it may well be necessary to provide transportation for at least some voters. And in a community such as that, responsibility for providing transportation may extend beyond election officials to ordinary members of the community who can help by giving Grandpa Jones a ride.
What if security against cyberattack, cyberespionage, or cybertheft required compromise with internet access? Would that be an impermissible breach of a right? Clearly not in all circumstances. The question, again, is not about rights per se but about what is involved in the flourishing of life in community. Shutting off internet access for someone whose laptop is infected with the Nitol botnet malware may well be necessary to protect a nation's banking industry and thereby the unhindered access of many other community members to their own bank accounts. Even if the laptop's owner is not personally responsible for the machine's having become infected through failure to update security software or incautious behavior on the Internet, the well-being of the community, and thereby, the well-being of that individual requires action. Do not object that, in this way, a license is given to let the needs of the community always and anywhere trump the needs of the individual, or that a tyranny of the majority threatens. Such objections assume a mistaken, merely additive model of community good. In the virtues framework, the good of the community is not the sum of all individual goods, and most individual goods are derivative from the individual's mode of participation in the community.
Much of the allure of rights talk comes from the suggestion that, if rights are universal-"all men are endowed by their Creator with certain unalienable Rights"-then we have premises for critiquing the practices of other nations and communities. We think a theocracy unacceptable because it limits or disallows the free exercise of religion that we think a right of all. A common criticism of the virtues framework is that, by contrast, in making all questions relevant to a community, we lose the ability to critique the practices of others. But this criticism has always failed for assuming a simplistic geography and topology of community structures. Yes, it might be a problem if Athens and Sparta were isolated communities whose members never came together in war, commerce, the Olympics, or other common endeavors. But that has never been the case in pre-internet days, and it is certainly not the community structure of cyberspace, where, as has now repeatedly been stressed, the structure of communities is extremely complicated. I am a member of many score communities online, some of them disjoint, some of them overlapping, many of them subordinate to others, all of them subordinate to the internet community as a whole. Critique occurs when I step, momentarily, out of one community identity and into another, as when Don the United Airlines online customer exhorts Verizon to do a better job with online customer service, more like the service I get from United. Critique occurs as well when I step up to a more comprehensive community identity that I share with the targets of my critique, as when Don the citizen of the world internet community faults Chinese snooping on internet traffic when he is traveling in China. Relativity to community does not devolve into relativism.
How, within the virtues framework, can critique of practice be effective in bringing about needed change when laws and rules are not to be had or, perhaps, are not even desirable tools? Let me make a few suggestions. The first is that critique, to be effective, must be more than mere reprimand, complaint, or even exhortation. It is one thing to name a wrong; it is quite another to name it in a manner likely to effect change. Overt coercion, threats, and intimidation sometimes work, as does exile or other forms of removal from full community participation, as discussed previously. But unless those are tied to some clear plan for reshaping defective habits, for turning vices into virtues, their effectiveness is limited. The real aim is to encourage changes in practice. In this connection, shame is one underutilized tool. Putting people on display in the stocks was often quite effective in changing patterns of behavior. What is the cyber equivalent? But even shaming has its drawbacks. Far better than any of the aforementioned is critique in the form of oneself proffering a model of better, more virtuous behavior. One's making oneself an example of best practices is often the most effective way of inducing change for the good. This is my second suggestion. Think back to the case of the community of online genealogists. Better practices with respect to data like birth dates and social security numbers emerged mainly in consequence of the more thoughtful and respectful members of that community changing their practices in ways that were clearly visible to all. Critique in the form of one's making oneself a better model has much to recommend it. It avoids exposing others to ridicule or embarrassment; it leaves behind much less in the way of negative affect. If done too ostentatiously, it can pass over into moral priggishness. But the remedy for that is tact.
There may be settings in which mere modeling is inadequate, especially in complex communities where even the best practices might not always be visible to all members of the community. My third suggestion is that, in such cases, the public promulgation of norms can be effective. There is nothing novel in this suggestion. Professional associations do it all the time when they develop codes of ethics. Such codes have little legal standing or normative force. They function as reminders, suggestions, or sketches of model behavior. We are already beginning to see the employment of explicit norms in the cyberworld, as with the yearslong project to develop what are now termed the Tallinn norms for the regulation of cyberconflict. More such are needed to address the challenges less helpfully addressed by assertions of rights in the cyberworld.
One especially important area where the promulgation of explicit norms is urgently needed is in corporate cybersecurity. Even if one thinks that the notion of corporations as persons is more than a little silly, corporations nonetheless form communities, and their behaviors can be assayed within the virtues framework. There are corporate virtues, just as there are individual ones. Moreover, as recent debates in the United States make clear, there is very little chance of our adequately addressing the problem of corporate cybersecurity through explicit legislation. Progress is more likely if we work through governments, industry associations, and international organizations to develop appropriate norms for everything from outsourcing data storage to the maintenance of adequate internal security controls and granting access, as needed, to external entities such as the FBI and, in extremis, US Cybercommand, or their counterparts in other nations.

Conclusion: Duties as Well as Rights
Recasting questions about rights in cyberspace in the virtues framework, asking what promotes the flourishing of life in community, brings many advantages. Foremost among them, in my mind, is that it directs the conversation not only to questions about what rights, traditionally conceived, permit such as free association or free speech-but also to what positive actions are required for the flourishing of community life. Call these duties, if you will. But what is intended are more than duties narrowly conceived. What is intended are all of the many forms of action that constitute the good life in a community. I may not have a moral duty to help my aged neighbor cross a busy street, but my community prospers if I do. It is an old saw that rights unexercised are no rights at all. It is noteworthy that Walzer listed last-hence first-among the civic virtues the virtue of participation itself. When I look to a remarkable event like the use of social media in Arab Spring, what impresses me the most is not that the agents of change claimed a right to access, even in the face of government efforts to thwart access to the social media, but that they acted for the good in the domain thus opened and, by example, empowered others to do the same.

Notes
Open Access This chapter is licensed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons. org/licenses/by/4.0/), which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license and indicate if changes were made.
The images or other third party material in this chapter are included in the chapter's Creative Commons license, unless indicated otherwise in a credit line to the material. If material is not included in the chapter's Creative Commons license and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder.