Norms of Responsible State Behaviour in Cyberspace

Abstract

Cyberspace has witnessed a 'militarisation' as a growing number of states engage in a variety of cyber operations directed against foreign entities. The rate of this militarisation has outstripped the diplomatic efforts undertaken to provide this unique environment with some 'rules of the road'. The primary mechanism for discussing possible norms of responsible state behaviour has been a series of UN Groups of Governmental Experts, which have produced three consensus reports over the last decade. The 2015 report recommended a series of principles and confidence-building measures to prevent conf1lict, but prospects for its implementation have receded as differences amongst states persist over how security concepts should be applied to cyberspace. Renewed efforts to promote responsible state behaviour will require greater engagement on the part of the private sector and civil society, both of which have a huge stake in sustaining cyber peace.

On the normative equivalence paradigm in cyberspace

“…Moreover, it asserts that it considered how International Law applies to the use of ICTs by States [42] but a thorough lecture and analysis does not reveal clearer issues than the previous ones. The 2015 Report also contains a series of recommendations [43], as voluntary norms, rules and principles for the States' behaviour in Cyberspace. That was the maximum result of the UN GGE because in 2017 it ended in a deadlock as it was not able to adopt a consensus report [44].…”

The Chinese approach to artificial intelligence: an analysis of policy, ethics, and regulation

“…On the one hand, China has officially promoted international initiatives for regulating hostile state-run activities in cyberspace, and to fill the existing regulatory gap for state behaviour in this domain (Ku 2017;Austin 2016;Taddeo 2012;Taddeo 2016). For example, China co-sponsored the International Code of Conduct for Information Security at the UN General Assembly in September 2011, which sought a commitment against using information technologies in acts of aggression and has provided continued support for dialogue by the UN Group of Government Experts in preventing cyber conflicts (Meyer 2020). On the other hand, China has also run cyber operations targeting US infrastructure and aiming at extracting commercial and scientific information as well as acquiring relevant intelligence against several countries, including Australia, Philippines, Hong Kong, and the US.…”

A principlist framework for cybersecurity ethics

“…An important distinction is often made in this literature between the ethical issues related to state or national cybersecurity and those related to civil or commercial cybersecurity. The former grouping includes issues such as cyberwarfare and state-sponsored cyber-surveillance, which are typically discussed in terms of just war theory, state sovereignty, international relations, and national security ( Meyer, 2020 ;Schlehahn, 2020 ). In contrast, the latter includes issues such as the hacking of commercial entities or end users, which are not typically discussed in such terms and which raise a different set of ethical issues ( Nissenbaum, 2005 ;2011 ).…”

“…To focus our discussion, we limit ourselves to the ethical issues raised by computer or information security in the context of civil or commercial cybersecurity where issues such as just war theory, state sovereignty and national security are not central. We thus omit discussion of state cybersecurity cases (but for a treatment of such cases see: Efrony and Shany, 2018 ;Macnish, 2018 ;Manjikian, 2018 ;Meyer, 2020 ;Schlehahn, 2020 ;Stevens, 2020 ). Cybersecurity within a civil or commercial context encompasses not only threats to infrastructure that stores commercial or user data, but also an ancillary set of financial, psychological, and social harms associated with the everyday use of information and communications technologies.…”