Jusletter IT

The integrity of the Internet depends on its proper functioning without technical interference and (unjustified) governmental intervention. During the last few years, different terms have been coined to describe such kind of integrity of the Internet. At the beginning, cybersecurity was the most used word, followed by other terms such as the stability and the resilience of cyberspace; hereinafter, cybersecurity will remain the keyword of the international law considerations.

Cybersecurity refers to processes and measures protecting networks and data form cybercrimes. So far, no standard or universally accepted definition of the term cybersecurity exists. As the Internet Society remarked, “as a catchword, cybersecurity is frighteningly inexact and can stand for an almost endless list of different security concerns, technical challenges and ‘solutions’ ranging from the technical to the legislative”.¹ The International Telecommunications Union (ITU) defines cybersecurity as “the collection of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions trainings, best practices, assurance and technologies that can be used to protect the cyber environment and the organizations’ and users’ assets”.²

General security objectives include (i) confidentiality, (ii) integrity, and (iii) availability, also known as the “CIA” triad in the information security industry. Thereby, confidentiality means that information is not improperly disclosed to unauthorized individuals, processes or devices; integrity refers to information being protected against unauthorized modification or destruction; availability pertains to a timely and reliable access to data and information for authorized users.³ The International Organization for Standardisation (ISO) defines “information security” as the preservation of confidentiality and availability in its “ISO/IEC (International Electrotechnical Commission) 27’000 Family of Information Security Management System Standards”. Cybersecurity encompasses not only the protection of information and data but also the protection of assets that are non-information based and vulnerable to threats.

Usually, the cyberthreat landscape is described by using a linear approach that distinguishes either between (i) threat agents, (ii) threat tools, and (iii) threat types⁴ or between (i) computer network exploitations, (ii) computer network attacks, and (iii) information operations.⁵ While such categorizations are useful for certain legal qualifications, they do not paint a comprehensive picture of the very complex nature and characteristics of cyberthreats.⁶ The array of external and internal agents endangering cybersecurity is mostly very wide, going from nation States to hackers and insiders. Threat tools encompass malware and its variances as well as botnets. Threat types include information modification or misuse, information destruction, unauthorized access, data breach, data theft and distributed denial-of-service.

The term “governance” can be traced back to the Greek word “kybernetes”, the “steersman”, leading over the Latin word “gubernator” to the English notion “governor” addressing aspects of steering and governing behavior.⁷ Consequently, cybersecurity governance looks at the measures taken by the concerned players with the objective to protect information and data as well as the underlying assets and infrastructure.

This contribution does not analyze the details of the existing legal instruments (or their preparatory documents) combatting cybercrime, but shortly mentions their existence and some key issues thereof (chapter 2). Based on the (substantively rather pessimistic) assessment of their relevance, a bridge will be built from legal instruments to concepts (chapter 3) and the core question will be discussed to what extent the established and widely accepted international normative concepts (in particular the concept of global public goods, of shared spaces and of State responsibility) can contribute to an acceptable global cybersecurity governance (chapter 4); specific challenges are posed by the implementation of the mentioned concepts (chapter 5). An outlook closes the contribution (chapter 6).

Cybersecurity now routinely tops political agendas.⁸ For decades, international and regional organizations have tried to develop legal instruments that could harmonize the regulatory standards in the field of cybersecurity prevention.⁹ Some efforts have been (partly) successful, mainly if implemented as so-called “security exceptions” in multilateral agreements of sector-specific international organizations (ITU, WTO).¹⁰

On the global level, legal instruments intending to combat cybercrime are discussed for quite some time. Already five United Nations Group of Governmental Experts (UNGGE) have exchanged ideas and published reports, without, however, agreeing on binding principles.¹¹ In particular, the third UNGGE (2012/13) advocated for the application of the UN Charter to cyberspace, which was to remain “open, secure, peaceful and accessible”. The group also confirmed that States were sovereign to regulate cyberspace and had the territorial jurisdiction over the cyberspace infrastructure. Furthermore, it argued that “State efforts to address the security of ICT must go hand-in-hand with respect for human rights and fundamental freedoms” and that States were obliged not to “use proxies to commit internationally wrongful acts”.¹²

The fourth UNGGE (2015) produced a comprehensive report on norms, rules and principles regarding the responsible behavior of States in cyberspace as well as with regard to international cooperation, confidence building measures, and capacity building. Its findings confirmed four principles concerning the application of international law to cyberspace.¹³ In particular, principle 1 states that “in their use of ICT, States must observe, among other principles of international law, State sovereignty, the settlement of disputes by peaceful means, and non-intervention in the international affairs of other States”. Specifically, the fourth UNGGE made the following forward-looking statement:¹⁴

1. “In their use of ICTs, States must observe, among other principles of international law, State sovereignty, the settlement of disputes by peaceful means, and non-intervention in the internal affairs of other States.
2. Existing obligations under international law are applicable to State use of ICTs and States must comply with their obligations to respect and protect human rights and fundamental freedoms.
3. States must not use proxies to commit internationally wrongful acts using ICTs, and should seek to ensure that their territory is not used by non-State actors to commit such acts.
4. The UN should play a leading role in promoting a dialog on the security of ICTs in their use by States, and in developing common understandings on the application of international law and norms, rules and principles for responsible State behavior.”

The fifth UNGGE (2016/17) did not really overcome the challenge of transposing the generally accepted principles into detailed obligations being operable for the States. The failure was also caused by political tensions of various kinds.¹⁵

In 2019, two newly established groups were mandated to come up with further recommendations in the course of 2021.¹⁶ However, a basic problem consists in the fact that the two mandates do not appear to be coherent.¹⁷ Notwithstanding the recent publication of the Final Substantive Report by the UN Cyber OEWG (Open-ended working group),¹⁸ the key assessment of the fourth UNGGE pointing to the importance of the principles of international law as normative pillars of cybersecurity remains valid and justifies a deeper analysis of applicable legal concepts.

Regional approaches have been more successful: particularly in Europe, multilateral legal instruments do exist and are also applied in practice. The main organizations are the Council of Europe and the European Union.

(i) The Council of Europe (CoE) adopted the (Budapest) Convention on Cybercrime in 2001 encompassing now more than 60 ratifying States (also outside of Europe, including Argentina, Australia, Canada, Chile, Israel, Japan and the United States).¹⁹ As set forth in the Preamble, the main objective of the Budapest Convention is to pursue a “common criminal policy” against cybercrime “by adopting appropriate legislation and fostering international cooperation”. The aim of the Convention is to “deter action directed against the confidentiality, integrity and availability of computer systems, networks and computer data as well as misuse of such systems”.²⁰ The most effective security measures should be implemented to prevent unauthorized access to protected infrastructures.

The Budapest Convention was the first (ambitious) attempt to harmonize the legal framework for combatting cybercrime. Despite its role in providing an internationally recognized framework for global harmonization, the Convention has been panned by its critics as largely outdated and in great need of reform.²¹ Various reasons have been cited for its supposed obsolescence, including the fact that the Convention is based on the types of offenses that prevailed at the time of its drafting (i.e. the late 1990s) and therefore (logically) does not take into account new cyberattack rules (such as botnets and ransomware)²². As a result, there have been calls for a general revision of the Budapest Convention and even calls for the adoption of a new (and truly) universal treaty on cybercrime.²³ Now, a revision of the Convention is on the way, but its final adoption cannot be forecasted.

(ii) Apart from the General Data Protection Regulation (GDPR) 2016/679 of 27 April 2016, in force since 25 May 2018, that is containing several regulations on data security, the European Union (EU) released the Network and Information Society (NIS) Directive²⁴ in 2016 (with the main objectives/measures of improving [i] national cybersecurity capabilities, [ii] the EU-level-cooperation and [iii] the security and incident notification requirements) as well as the Cybersecurity Act in 2019 (implementing a certification regime).²⁵ As a noteworthy remark it may be emphasized that “digital infrastructure” is named alongside to energy, transport, banking, health sector and drinking water supply as a “critical infrastructure” in Annex III of the NIS-Directive.²⁶ The success of the NIS Directive and the Cybersecurity Act cannot yet be assessed since the national implementation only dates back a short time. Nevertheless, it should be positively stated that the role of the European Union Agency for Cybersecurity (ENISA) has gained importance and that the established national Computer Security Incident Response Teams (CSIRT) have attempted to improve cross-border cooperation.²⁷

The EU Commission is continuing to address cybersecurity issues with a high priority as the new “Cybersecurity Strategy for the Digital Decade” of 16 December 2020 clearly evidences to the widespread addressees.²⁸ The Cybersecurity Strategy points to the importance of resilience in respect of infrastructures and critical services and proposes to build a European Cyber Shield (including the implementation of a cyber-skilled EU workforce). As special aspects the call for an advancement of responsible State behavior in cyberspace and the call for cooperation in a multistakeholder community are particularly noteworthy.

Reality shows that in particular the efforts on the global level for the implementation of cybercrime regulations have failed to be successful. Even the CoE Cybercrime Convention did not have remarkable effects.²⁹ The EU legal instruments are limited to their regional scope of application. Therefore, the search for other normative “frameworks” becomes imperative; as will be shown, the widely acknowledged international legal concepts appear to be a viable alternative solution.

Among the State-led responses that target cybersecurity challenges, the North Atlantic Treaty Organizations (NATO), an intergovernmental organization of Western countries focused on conflicts and international peace, has been at the forefront in adapting numerous prominent documents. At its Security Summit in 2016, NATO recognized cyberspace as the fifth warfare domain and confirmed that a cyberattack against any of its allies would be considered an act of war.³⁰ A particularly important document is the “Tallinn Manual” of 2013, now available in the revised, amended and improved version “Tallinn Manual/2.0” of 2017, being the first comprehensive study of international law applicable to cyberspace.³¹

The Tallinn Manual defines critical infrastructure to include all systems and assets, physical and virtual, within a nation State’s jurisdiction; it also describes the term “cyberinfrastructure” as governing communications, storage, and computing resources upon which computer systems operate.³² The Tallinn Manual 2.0 offers a comprehensive regulatory scheme (154 rules), laying out the general legal principles governing cyber operations and their interaction with specialized international law regimes.³³

A recent study about the implementation of the rules laid down in the Tallinn Manual shows a differentiated picture: some principles have been taken over by a couple of countries into the national law, some others were rejected. The findings are described as evidencing a “limited support in state practice for certain key Rules” making it “difficult to ascertain whether states accept the Tallinn Rules and wish them to become authoritative articulations of international law governing cyberoperations”.³⁴ The case study reveals three interrelated strategies employed by States under the given conditions:³⁵

“(1) Optionality – regarding the framework described in the Tallinn Manuals as optional, in the sense that the states have a choice about whether or not to invoke international law rights and obligations applicable to cyberspace;

(2) Parallel Tracks – state practice in the field of cyberoperations appears to develop along to parallel tracks, acknowledged and unacknowledged, resulting in the emergence of two sets of “rules of the game” – international law rules and softer informal rules, which also limit state power. [….]

(3) Gradations in law enforcement – states seem to develop with regard to cyberoperations a nuanced understanding of law enforcement, distinguishing between violations likely to lead to some form of response and those unlikely to do so.”

In general, the impression prevails that law will gradually develop into the direction of encompassing data and other non-physical targets of consequential importance.³⁶ But the problem exists that a certain lack of transparency in this field exists due to underreporting of cyberoperations and limited attribution claims that makes it difficult to identify relevant State practice.³⁷ In addition, the experience has shown that the identification of customary international law containing indications of “opinio juris” appears to be difficult in this context.³⁸

As recently pointed out by well-known cybersecurity scholars, States are also adopting a cautious approach toward publicly attributing State responsibility; rather the approaches of silence and ambiguity are followed even if this may convey a message of impunity to other “would-be cyberattackers”.³⁹ Consequently, from the field of the Internet law in general the lesson can be drawn that policy reluctance or even disagreements in respect of the application of legal norms to new technologies is prevailing in many respects.

The expression “bridge over troubled water” stems from the world-known song of Simon and Garfunkel. Notwithstanding the fact that the expression was coined fifty years ago, it keeps its importance also in the context of cybersecurity and international law. The discussions about an improved cybersecurity framework show the relevance of global concepts for Internet integrity and cyberspace stability.⁴⁰

In the cybersecurity context, international law develops and functions under conditions of significant normative uncertainty (and partly also in the absence of effective enforcement mechanisms).⁴¹ Nevertheless, international law does not exist in a vacuum; attributions of tasks and responsibilities are possible. Even if the uneasy “fit” between traditional international law principles governing the exercise of State power inside and outside its territory and the regulation of a de-territorialized cyberspace is obvious, the conclusion that no international law regulation of cyberoperations would be possible or desirable goes into the wrong direction.⁴² No reason appears to exist that would prevent States from reacting against unprovoked cyberattacks or cyberoperations deliberately harming civilians based on the generally accepted global legal concepts which are to be outlined hereinafter.

The bridge that must be built could start with the implementation of behavioral rules. For example, in the sustainability context the general principle that acting with due diligence or with due care can contribute to the avoidance of transboundary harm appears to be widely acknowledged.⁴³ Taken over to the cyber world this would mean that States should avoid to potentially disrupt communication channels and should closely cooperate in the efforts to pursue cyber-related global interoperability.

As will be outlined hereinafter, cybersecurity might be reasonably warranted if the international community is ready to accept some basic and common legal standards being applicable around the globe. Several theoretical models have been developed so far;⁴⁴ as most important international normative standards, (i) the concept of global public goods, (ii) the concept of shared values and (iii) the concept of State responsibility will be further analyzed hereinafter.

In principle, it is not contested that new norms and policies should be developed to enhance the global resilience, stability and security of the Internet. This statement is commonly accepted even if Martti Koskenniemi has skeptically noted a limited practical applicability of international law, not constituting on actual enforcement mechanism for a global consensus on values.⁴⁵ In November 2019, at the occasion of the Internet Governance Forum (IGF) in Berlin, the Global Commission on the Stability of Cyberspace (GCSC) has proposed a comprehensive Cyberstability Framework encompassing (1) multistakeholder engagement, (2) cyberstability principles, (3) the development and implementation of voluntary norms, (4) adherence to international law, (5) confidence building measures, (6) capacity building objectives and (7) the open promulgation and wide spread use of technical standards ensuring cyberstability.⁴⁶

This approach can be validly underlined with three international legal concepts having achieved a high level of acceptance in the concerned community; the respective concepts will be discussed in detail hereinafter.

One of the starting points for a discussion on protecting cybersecurity could be the concept of “global public goods”.⁴⁷ Although not perfectly aligned to the needs of cybersecurity and the network’s architecture, it is worth a closer look. Ideally, global public goods are those which benefit humanity as a whole; accordingly, these goods should be advantageous to (i) more than one group of countries or geographic regions, to (ii) a broad spectrum of the global population, crossing population segments, and (iii) to present generations without jeopardizing the ability of future generations to meet their own needs.⁴⁸

The idea of guaranteeing cybersecurity as a public core of the Internet or as a “global public good” can be perceived as a derivative of a policy concept: The ambiguous notion of “global public goods”, as generated in the era of globalization, is derived from the economic literature on “public goods”.⁴⁹ It refers to all globally available goods that are non-rivalrous (consumption does not influence the quantity available to others) and non-excludable (their use cannot be prevented); the examples of global public goods include knowledge as well as the common heritage of mankind.⁵⁰

International law in its classical form with its consent-based structure is not easily suitable to meet the requirements of the global public goods concept. Moreover, a structural bias exists; in particular, the Westphalian system leads to severe problems for this concept. As Nobel Memorial Prize (2018) laureate William N. Nordhaus pointed out: “The requirement for unanimity is in reality a recipe for inaction. […] To the extent that global public goods may become more important in the decades ahead, one of our major challenges is to devise mechanisms that overcome the bias toward the status quo and the voluntary nature of current international law in life-threatening issues”.⁵¹ But international law is not without solutions to such problems; for example, the notion of the public core of the Internet being important in cybergovernance can be made fruitful;⁵² indeed, core values also influence cybersecurity.⁵³

Equally, from an international law perspective, global public goods theories are not totally new. The idea of a certain “communality” already lies at the core of Roman law concepts of “ius cogens” or “erga omnes”.⁵⁴ Similarly, the concept of “critical infrastructures” and their protection can serve as another or complementary point of reference.⁵⁵ In addition, the well-known “public interest” concept is also able to peremptorily impose binding obligations on States that have a comparable foundation.⁵⁶ Based on these thoughts it can be argued that global public goods theories involve a broad approach that considers political economy implications besides legal aspects⁵⁷ and, therefore, merits attention in future discussions.

International cooperation on critical infrastructure protection is not the only analogy to be drawn from existing legal frameworks.⁵⁸ Equally, for example, the concept of shared spaces, to be used by all States in a uniform, non-harmful way is not new to the international community and in international relations. Already Grotius in the seventeenth century explained the law of all nations as the law “derived from nature, the common mother of us all, and whose sway extends over those who rule nations”.⁵⁹

Many global legal areas, constituting a “law on international spaces”⁶⁰, have turned out to be relevant over time. From a substantive perspective, it can be said that a feature common to the international spaces encompasses the obligation of peaceful use of resources and the principle of equal rights of all States. Indeed, several authors already expressed the opinion that Internet safety and security are a shared responsibility.⁶¹ Based on this understanding areas of international law that can be used for reference with regard to guaranteeing cybersecurity include:⁶²

(i) Law of the sea: The most important rules for the maritime area (i.e. the oceans) are contained in the Convention on the High Seas of 1958 and the Convention on the Law of the Sea of 1982.⁶³ The main objective of these Conventions being a good example of a wide multifaceted cooperation, consists in the establishment of the freedom of the seas’ principle meaning that seas might not be subject to individual sovereignty claims.⁶⁴

(ii) Air and space law: The legal regime of outer space was basically established by the Treaty of Principles Governing the Activities of States in the Exploration and Use of Outer Space, Including the Moon and other Celestial Bodies of 1976.⁶⁵ The main purpose of this treaty consists (i) in the submission of all activities in outer space to international law, as well as (ii) in the principles of non-discrimination and of non-appropriation by any claim of sovereignty.⁶⁶ Air law is also subject to many multinational treaties under the auspices of the International Civil Aviation Organization (ICAO).⁶⁷

(iii) Diplomatic and consular law: The Vienna Convention on Diplomatic Relations of 1961 contains basic, partly even comprehensive rules about the principles to be observed and complied with in the diplomatic and consular world.⁶⁸

(iv) International human rights law: The need to harmonize global rules in the context of human and fundamental rights has become obvious in the aftermath of the Second World War; the main legal sources are the UN Universal Declaration of Human Rights (1948)⁶⁹ as well as the two UN Covenants (i) on Civil and Political Rights and (ii) on Economic, Social and Cultural Rights (1966).

(v) International telecommunication law: The International Telecommunications Union (ITU) is the second-oldest international body having been founded in 1865; the need to harmonize the communications rules has been obvious since then and has even become more important with the advent of the Internet.⁷⁰

(vi) International environmental law: The fact that environmental resources must be used respectfully, sustainably and in a shared way is well known for decades; several international treaties are existing and have culminated in the declarations related to the climate change challenges (for example the Kyoto Agreement and the Paris Agreement).⁷¹

(vii) International trade law: The World Trade Organization, following the General Agreement on Tariffs and Trade and being in place since January 1995, is the best example for the acknowledgment that harmonized global trade rules are of importance.⁷²

(viii) Money laundering and terrorism financing laws and policies: Having some similarities to the measures combating the negative effects of cyberattacks, the fight against money laundering and terrorism financing is a global task. The respective activities are exercised by the Financial Action Task Force (FATF), a UN body domiciled with the OECD in Paris.⁷³

While each of these legal regimes offers interesting insights that can be useful to Internet stability, a concise and general assessment derived from all those areas of international law and relations is still outstanding. Nevertheless, the basic principles being applicable in all mentioned areas of laws, in particular the notion of due diligence, can be made fruitful in context of cybersecurity; governments should closely cooperate in a continuing effort to arrive at an operable consensus that takes into consideration global interoperability, network stability, reliable access and cybersecurity due diligence.⁷⁴

For the sake of completeness it may be added that according to the Tallinn Manual 2.0 overarching international law principles relevant to all those specified regimes are to be taken into account:⁷⁵ (i) sovereignty, (ii) jurisdiction, (iii) state responsibility, and (iv) due diligence.⁷⁶ While sovereignty and the matrix of jurisdictional principles remain an unresolved challenge for critical infrastructure protection, subject to enhanced debate and still far from consensus, the two other principles, namely State responsibility and due diligence, can be easily applied to the biggest international open networks and their key components.⁷⁷ As the Global Commission on the Stability of Cyberspace has identified, uniform standards of protection for the whole infrastructure and its services recognized as fundamental to the global networks’ stable and reliable operation are necessary and can be expressed through (i) international cooperation, (ii) exchange of good practices, and (iii) benchmarking.⁷⁸

The concept of State responsibility can be perceived as a general normative framework, applicable in addition to all other specified international law norms imposing obligations upon States.⁷⁹ Once an international obligation of a State is breached – be it an obligation of conduct or one of result – the consequences provided for in the law of State responsibility entail.

The development of legal rules related to State responsibility is not an easy task; the efforts of the International Law Commission (ILC) lasted decades and the final guidelines of 2001 have been adopted by the UN bodies.⁸⁰ The ILC based its work on two fundamental presumptions:⁸¹ (i) A breach of an international obligation of a primary norm leads to a responsibility if a “sanction” is stated therein; otherwise, the responsibility is vested in the general international principle of responsibility as secondary norm. (ii) An international wrongful act causes a State responsibility.

The responsibility principle is linked to the due diligence requirement implying a State’s duty to act with proper care in preventing a violation of international law. Indications of what is meant with “due care” in particular circumstances are to be derived from the legal practice within individual areas of international relations between States.⁸² The due diligence principle can be seen as shared element of treaty-based regimes and rules of conduct⁸³ having a very broad scope of application that also extends to private actors as for example shown in the OECD Due Diligence Guidance.⁸⁴

The principle of due diligence in preventing transboundary harm has become mainly important in environmental matters.⁸⁵ Nevertheless, by analogy, a due diligence standard for cybersecurity with shared responsibility⁸⁶ could equally build an entry point for the State’s responsibility in respect of an omission resulting in transboundary harm, e.g. a disruption of communications channels within a State territory.⁸⁷ The existing community standards with regard to good business practice within each of the specific Internet sectors (e.g. root zone operation, IXP operation, DNS and TLD management)⁸⁸ could be referred to in connection with State responsibility. Due diligence appears in almost all legal regimes, and it is even relevant for the law on neutrality in armed conflicts, which is, in principle, applicable to cyberspace.⁸⁹ In other words, governments should closely cooperate in a continuing effort to arrive at an operable consensus that takes into consideration global interoperability, network stability, reliable access and cybersecurity due diligence.⁹⁰

The three discussed concepts, namely the global public goods, the shared spaces and the State responsibility, appear to constitute the most important international normative standards. Nevertheless, further Internet-specific concepts have been developed that could also be made fruitful; in particular, the Global Commission on the Stability of Cyberspace (GCSC) addressed the following principles:

(i) The requirement of “restraint” imposes on State and non-state actors the behavioural rule to act in accordance with general principles of international peace and security in order to avoid that harmful acts are undermining the resilience and stability of cyberspace.⁹¹

(ii) The requirement to “act principle” contains a duty to take affirmative action for preserving the stability of cyberspace; State and non-state actors should take care that inadvertently escalating tensions or increasing instability are avoided.⁹²

(iii) Furthermore, human rights are important legal yardsticks that can safeguard cyberspace stability; the disruptive effect on human activity resulting from the threats for the availability or integrity of information and communications technologies is obvious and impacts human rights of individuals in a severe way.⁹³

The Global Commission on the Stability of Cyberspace as the expert group having developed the most recent standards in the context of Internet integrity has also drafted specific norms; for the sake of completeness, it is worth to quote the respective norms:⁹⁴

1. “State and non-state actors should neither conduct nor knowingly allow activity that intentionally and substantially damages the general availability or integrity of the public core of the Internet, and therefore the stability of cyberspace.
2. State and non-state actors must not pursue, support or allow cyber operations intended to disrupt the technical infrastructure essential to elections, referenda or plebiscites.
3. State and non-state actors should not tamper with products and services in development and production, nor allow them to be tampered with, if doing so may substantially impair the stability of cyberspace.
4. State and non-state actors should not commandeer the general public's ICT resources for use as botnets or for similar purposes.
5. States should create procedurally transparent frameworks to assess whether and when to disclose not publicly known vulnerabilities or flaws they are aware of in information systems and technologies. The default presumption should be in favor of disclosure.
6. Developers and producers of products and services on which the stability of cyberspace depends should (1) prioritize security and stability, (2) take reasonable steps to ensure that their products or services are free from significant vulnerabilities, and (3) take measures to timely mitigate vulnerabilities that are later discovered and to be transparent about their process. All actors have a duty to share information on vulnerabilities in order to help prevent or mitigate malicious cyber activity.
7. States should enact appropriate measures, including laws and regulations, to ensure basic cyber hygiene.
8. Non-state actors should not engage in offensive cyber operations and state actors should prevent such activities and respond if they occur.”

These fundamental standards are to be kept in mind when implementing legal rules in practice as explained hereinafter. Furthermore, ethical considerations merit to play a more important role.⁹⁵

The identification of international legal concepts and relevant norms of soft law does not suffice. Moreover, it is important to fully implement the respective (binding or non-binding) guidelines. As experience has shown during the last years, enforcement of legal provisions is always difficult in the international context, even more so in case of global normative concepts.

A first step could consist in the improvement of the involved actors’ commitments, for example by engaging in capacity building efforts and confidence building measures.⁹⁶ Implementing norms in a more granular way helps building consensus on the meaning of norms and can lead to a better understanding of their relevance. In addition, such kind of measures have a potential to prevent and mitigate conflicts.⁹⁷ Partly, the respective efforts have been introduced but much more needs to be done.⁹⁸

Nevertheless, capacity building and confidence building alone do not lead to a fully satisfactory implementation of normative guidelines. The sharing of best practices and of resilience/security standards must be encouraged on the basis of the relevant normative guidelines.⁹⁹ The respective efforts should include increased cooperation in the areas of protection and defence.¹⁰⁰ The duty of cooperation is a well-known principle in international law¹⁰¹ and merits to be equally applied in the cybersecurity context.

The recently published Final Substantive Report of the Open-ended working group on developments in the field of information and telecommunications in the context of international security (OEWG) of 10 March 2021, unanimously adopted on 12 March 2021 (OEWG-Report), also refers to confidence building measures (paras. 41–53) as well as to capacity building (paras. 54–67).¹⁰² (i) Confidence building measures should comprise transparency, cooperative approaches and stability measures that contribute to preventing conflicts, avoiding misperceptions and misunderstandings, and reducing tensions (para. 41). In addition, such measures can strengthen the overall security, resilience and peaceful use of ICTs; furthermore, they are suitable for implementing “norms of responsible State behaviour, in that they foster trust and ensure greater clarity, predictability and stability” (para. 41). Nevertheless, it should not be overlooked that the OEWG is not really putting forward new measures (except the establishment of National Contact Points) but pleads for pursuing existing efforts instead of taking specific forward-looking actions.¹⁰³

(ii) The OEWG-Report equally flags the fact that capacity building is an important aspect of international cooperation in order to achieve an “open, secure, stable, accessible and peaceful ICT environment” (para. 55). The States should be guided by the following principles (para. 56): (i) Capacity building must be understood as a sustainable process, comprising specific activities by and for different actors; (ii) the activities must have a clear purpose and be result-focused; (iii) the measures need to be evidence-based, politically neutral, transparent, and accountable, etc. Again, these measures are to be implemented on a voluntary basis (para. 64) meaning that their realization depends upon the willingness of the States to go ahead with the respective actions.

Consequently, the respective international legal concepts must be operationalized by incorporating them into international and national policies as well as into legislation. This activity should also go along with a more intensive cyber diplomacy between the States; the most recent EU Cybersecurity Strategy drives into this direction and outlines potential initiatives that could be pursued in the near.¹⁰⁴

In order to achieve a reasonable cybersecurity governance encompassing the necessary steering functions the new regulatory framework must be based on international legal concepts and be implemented through (i) private institutions with regulatory functions, (ii) hybrid intergovernmental-private arrangements, (iii) distributed regimes of regulators in cooperative schemes and (iv) collective actions by transnational networks.¹⁰⁵ Such kind of multistakeholder approach appears to have the best chances in realizing an appropriate regulatory framework.

Cybersecurity governance is an objective that should eliminate or at least minimize risks caused by an inappropriate use of international electronic infrastructures. Risk is the function of the likelihood of an adverse event, interacting with the magnitude of harm upon the occurrence of an adverse event. Risk prevention and risk mitigation are issues requiring cooperation between States; therefore, the implementation of a broadly understood duty of cross-border cooperation as a general legal standard is required.¹⁰⁶

Risk prevention and risk mitigation are not only a governmental task but also a matter to be dealt with by private actors. In particular, precautionary measures can be taken by the market participants; insofar, generally accepted data/information security standards are existing; for example, the network security provisions of ISO/IEC 27001 of 2013 as well as the updated specific security provisions of ISO/IEC 27701 of 2019 are widely complied with by the concerned industry.¹⁰⁷

Previous experience in the field of cybersecurity has shown that the traditional international law approach operating on the State level through multilateral treaties, thereby failing to directly address duties of private actors, is hardly able to cope with the challenges of combatting interference with the integrity of the Internet (in different forms). Therefore, the inclusion of various stakeholders into a new regulatory framework appears to be unavoidable. This attempt has been undertaken by Microsoft in 2017/18 when suggesting the adoption of an international treaty to guarantee the peaceful use of cyberspace.¹⁰⁸ The proposal to develop a “Digital Geneva Convention” envisaged to implement an international legal instrument similar to the “Treaty on the Non-Proliferation of Nuclear Weapons” and the “Treaty on Chemical Weapons”; these examples of international regimes have the objective of limiting vital threats to human existence. However, the Microsoft proposal met the scepticism of many States and it also seems to be unclear to what extent other Internet stakeholders could be included in such an arrangement.¹⁰⁹

Since Microsoft’s Convention proposal did not really advance, a new initiative has been established, namely the Geneva Dialogue on Responsible Behaviour in Cyberspace.¹¹⁰ This initiative, mainly led by Switzerland, should contribute to shaping a joint vision regarding the security of digital products/services and to enhancing those global policy processes which attempt to achieve a trusted, secure, and stable cyberspace. During phase 1 of the Geneva Dialogue a so-called “Baseline Study” was published in June 2019 by DiploFoundation,¹¹¹ based on two framework documents of November 2018, prepared by the private sector and by civil society. The Geneva Dialogue envisages to develop common policy requirements for boosting the security of digital products as well as to improve the feedback loop between corporate efforts and cybersecurity processes that develop norms, regulations, policies, and standards during the ongoing phase 2 in 2021.

As mentioned, the open-ended working group on developments in the field of information and telecommunications related to international security (OEWG) adopted the Final Substantive Report of the involved participants on 12 March 2021 (OEWG-Report).¹¹² At the beginning, political observers did not expect that the large number of involved countries would unanimously agree on certain principles within relatively short time. Amongst others, the OEWG has developed rules, norms and principles for responsible State behaviour (paras. 24–29 of the Report), followed by specific recommendations (paras. 30–33 of the Report). The respective norms are voluntary and non-binding; however, progress should be made by way of shared experiences and good practices.

Furthermore and most importantly, the OEWG points to the relevance of taking into account the principles and concepts of international law (paras. 34–40 of the Report) which should be concretely applied to the use of ICTs in the context of international security (para. 38 of the Report). The reference to international law takes up the respective recommendation of the fifth UNGGE (2016/17).¹¹³ But the OEWG-Report is insofar only a reiteration of the status quo and does not advance the inclusion of international law into the policies’ design.¹¹⁴ In particular, some States (China, Cuba, Belarus) voiced their opposition to the applicability of international humanitarian law, arguing that such a perception could be seen as justification of cyberspace militarization. However, this argument does not appear to be very convincing since the applicability of international humanitarian law would be suitable to limit or prevent the development of new cyber capabilities.¹¹⁵

In addition, the OEWG Report does not clearly address and emphasise the multistakeholder concept playing a central role in the Internet Governance context.¹¹⁶ Equally, the efforts of the UN realizing an environment of digital cooperation (UN High-Level Panel Report of 2019 and UN Secretary-General’s “Roadmap” of 2020) are not prominently reflected. Such “omissions” contradict the inherent value of the cyberspace governance ecosystem that touches upon aspects which have a “common interest” character being a well-known concept in international law.¹¹⁷

Summarizing, in a nutshell, the so far (incoherent) patchwork of cybersecurity regulations does not really correspond to the political needs. The only exception concerns the EU with the recently adopted (directly or indirectly applicable) legal regime; however, the practical implementation in the EU still needs to become successful. On a global level, further efforts to achieve a better coordinated regulatory framework are required; the recent OEWG Report can serve as a starting point, however, it does not suffice as a solid foundation for a safe environment.

Moreover, the widely accepted international legal notions such as the concept of public goods, the concept of shared spaces and the concept of State responsibility might be a good way to go forward. The normative contents of these concepts can give guidance for cybersecurity governance and potential behavioural rules designing the ecosystem of a stable and resilient cyberspace. Thereby, it is also up to businesses and academics to contribute to these efforts with more emphasis.

Prof. Dr. Rolf H. Weber, is professor of international business law at the Law Faculty, Zurich University, Switzerland (rolf.weber@rwi.uzh.ch). There he acts as co-director of the Research Program on Financial Market Regulation, the Center for Information Technology, Society, and Law as well as the Blockchain Center. He is also member of the Editorial Board of Swiss and international legal periodicals and a practicing attorney-at-law at Bratschi Ltd., Zurich (rolf.weber@bratschi.ch). An earlier shorter version of this article was presented at the Annual Symposium of GigaNet during the Internet Governance Forum on 2 November 2020.

All Internet sources were last visited on 20 April 2021.