In discussions to date about how international law applies in cyberspace, commentators have tended to focus their attention on how the rules on the use of force, or the law of armed conflict, apply to cyber activities conducted by states that give rise to physical damage, injury or death.

But in practice, the vast majority of state cyberattacks fall below this threshold. Far more common are persistent, low-level attacks that may leave no physical trace but that are capable of doing significant damage to a state’s ability to control its systems, often at serious economic cost.

Such cyber incursions might include network disruptions in the operation of another government’s websites; tampering with electoral infrastructure to change or undermine the result; or using cyber means to destabilize another state’s financial sector.

For these kinds of cyber operation, the principle of sovereignty, and the principle of non-intervention in another state’s internal affairs, are the starting point.

A UN Group of Government Experts (GGE) agreed in 2013 and 2015 that the principles in the UN Charter, including sovereignty and the prohibition on intervention in another state’s affairs, apply to states’ activities in cyberspace. The 2015 GGE also recommended eleven (non-binding) norms of responsible state behaviour in cyberspace.

However, states have not yet reached agreement on how to apply these principles. Until recently, there has also been very little knowledge of what states actually do in cyberspace, as they usually conduct cyber operations covertly and have been reluctant to put their views on record.

A new Chatham House research paper analyses the application of the principles of sovereignty and non-intervention to state cyberattacks that fall below the principle of use of force. As well as analysing the application of the law in this area, the paper also makes recommendations to governments on how they might best make progress in reaching agreement in this area.

Existing rules or new rules?

As the research paper makes clear, there is currently some debate, principally between countries in the West, about the extent to which sovereignty is a legally binding rule in the context of cyberspace and, if so, how it and the principle of non-intervention might apply in practice.

In the last few years, certain states have put on record how they consider international law to apply to states’ activities in cyberspace, namely the UK, Australia, France and the Netherlands. While there may be some differences in their approaches, which are discussed in the paper, there also remains important common ground: namely, that existing international law already provides a solid framework for regulating states’ cyber activities, as it regulates every other domain of state-to-state activity.

There is also an emerging trend for states to work together when attributing cyberattacks to hostile states, enabling them to call out malign cyber activity when it violates international law. (See, for example, the joint statements made in relation to the NotPetya cyber attack and malicious cyber activity attributed to the Russian government).

However, other countries have questioned whether existing international law as it stands is capable of regulating states’ cyber interactions and have called for ‘new legal instruments’ in this area.

This includes a proposal by the Shanghai Cooperation Organization (led by Russia and China) for an International Code of Conduct on Information Security, a draft of which was submitted to the UN in 2011 and 2015, without success. The UN has also formed a new Open-Ended Working Group (OEWG) under a resolution proposed by Russia to consider how international law applies to states’ activities in cyberspace.

The resolution establishing the OEWG, which began work earlier this year, includes the possibility of the group ‘introducing changes to the rules, norms and principles of responsible behaviour of States’ agreed in the 2013 and 2015 GGE reports. In the OEWG discussions at the UN in September, several countries claimed that a new legal instrument was needed to fill the ‘legal vacuum’ (Cuba) or ‘the gap of ungoverned areas’ (Indonesia).

It would be concerning if the hard-won consensus on the application of international law to cyberspace that has been reached at past GGEs started to unravel. In contrast to 2013 and 2015, the 2017 meeting failed to reach an agreement.

On 9 December, a renewed GGE will meet in New York, but the existence of the OEWG exploring the same issues in a separate process reflects the fact that cyber norms have become an area of geopolitical rivalry.

Aside from the application of international law, states are also adopting divergent approaches to the domestic regulation of cyberspace within their own territory. The emerging trend towards a ‘splinternet’ – i.e. between states that believe the internet should be global and open on the hand, and those that favour a ‘sovereignty and control’ model on the other  – is also likely to make discussions at the GGE more challenging.

Distinct from the international law concept of sovereignty is the notion of ‘cybersovereignty’, a term coined by China to describe the wide-ranging powers it assumes under domestic law to regulate its citizens’ access to the internet and personal data within its territory. This approach is catching on (as reflected in Russia’s recently enacted ‘Sovereign Internet Law’), with other authoritarian states likely to follow suit.

The importance of non-state actors

In parallel with regional and UN discussions on how international law applies, a number of initiatives by non-state actors have also sought to establish voluntary principles about responsible state behaviour in cyberspace.

The Global Commission on the Stability of Cyberspace, a multi-stakeholder body that has proposed principles, norms and recommendations to guide responsible behaviour by all parties in cyberspace, recently published its final report. The Cybersecurity Tech Accord  aims to promote collaboration between tech companies on stability and resilience in cyberspace. President Macron’s ‘Paris Call for Trust and Security in Cyberspace’ has to date received the backing of 67 states, 139 international and civil society organizations, and 358 private-sector organizations.

It remains to be seen in the long term whether the parallel processes at the UN will work constructively together or be competitive. But notwithstanding the challenging geopolitical backdrop, the UN GGE meeting next week at the least offers states the opportunity to consolidate and build on the results of past meetings; to increase knowledge and discussion about how international law might apply; and to encourage more states to put their own views of these issues on the record.

This roundtable is part of a series under the project, 'Implementing the Commonwealth Cybersecurity Agenda', funded by the UK Foreign and Commonwealth Office (FCO). The roundtable aims to provide a multi-stakeholder, pan-Commonwealth platform to discuss how to implement the Commonwealth Cyber Declaration with a focus on its third pillar 'To promote stability in cyberspace through international cooperation'.

In particular, the roundtable focuses on points 3 and 4 of the third pillar which revolve around the commitment to promote frameworks for stability in cyberspace including the applicability of international law, agreed voluntary norms of responsible state behaviour and the development and implementation of confidence-building measures consistent with the 2015 report of the UNGGE. 

The workshop also focuses on the commitment to advance discussions on how existing international law, including the Charter of the United Nations and applicable international humanitarian law, applies in cyberspace.

The roundtable addresses the issue of global cyber governance from a Commonwealth perspective and will also include a discussion around the way forward, the needed capacity of the different Commonwealth countries and the cooperation between its members for better cyber governance.

Participants include UNGGE members from Commonwealth countries in addition to representatives to the UN Open-Ended Working Group from African countries as well as members from academia, civil society and industry.

Concerns about transatlantic security are high following the US 2018 Nuclear Posture Review and its interpretation of the Russian doctrine, the demise of the Intermediate Range Nuclear Forces Treaty (INF), the uncertainty surrounding the potential extension of the New Strategic Arms Reduction Treaty (New START), and Russian deployment of Avangard hypersonic, nuclear-capable missile systems.

Emerging technologies, especially quantum technologies, jeopardize the reliability of existing encryption measures. Some of the most sophisticated cyber attacks are already assisted by artificial intelligence. The possibility that nuclear weapons systems can be interfered with both during conflict and peacetime by these technologies, without the knowledge of the possessor state, raises questions on the reliability and integrity of these systems, with implications for military decision-making, particularly to deterrence policy.

These issues and more indicate the changes in the security landscape that have a bearing on the future of nuclear deterrence.

This project is supported by the Hiroshima Prefecture and Government of Ireland.

Summary

• This collection of essays explores, from the perspectives of eight experts, four areas of deterrence theory and policymaking: the underlying assumptions that shape deterrence practice; the enduring value of extended deterrence; the impact of emerging technologies; and the ‘blurring’ of the lines between conventional and nuclear weapons.
• Nuclear deterrence theory, with its roots in the Cold War era, may not account for all eventualities in security and defence in the 21st century, given the larger number of nuclear actors in a less binary geopolitical context. It is clear that a number of present factors challenge the overall credibility of ‘classical’ nuclear deterrence, meaning that in-depth analysis is now needed.
• Uncertainty as to the appetite to maintain the current nuclear weapons policy architecture looms large in discussions and concerns on global and regional security. The demise of the Intermediate-Range Nuclear Forces Treaty, doubts over the potential extension of the New Strategic Arms Reduction Treaty, heightened regional tensions in Northeast and South Asia, together with the current and likely future risks and challenges arising from global technological competition, making it all the more urgent to examine long-held assumptions in the real-world context.
• Extended deterrence practices differ from region to region, depending on the domestic and regional landscape. Increased focus on diplomatic capabilities to reduce risks and improve the long-term outlook at regional level, including by spearheading new regional arms-control initiatives, may be a viable way forward. Addressing the bigger picture – notably including, on the Korean peninsula, Pyongyang’s own threat perception – and the links between conventional and nuclear missile issues will need to remain prominent if long-term and concrete changes are to take hold.
• Most states have long held nuclear weapons to be ‘exceptional’: their use would represent a dramatic escalation of a conflict that must never be attained. Latterly, however, some officials and scholars have made the case that the impact of the use of a low-yield nuclear weapon would not be entirely distinct from that of a large-scale conventional attack. This blurring of lines between conventional and nuclear deterrence strips nuclear weapons of their exceptional nature, in a context in which states are faced with diverse, complex and concurrent threats from multiple potential adversaries that are able to synchronize non-military and military options, up to and including nuclear forces. The use of nuclear weapons risks becoming a ‘new normal’, potentially reducing the threshold for use – to cyberattacks, for example. This has direct implications for discussions around strategic stability. 
• While emerging technologies may offer tremendous opportunities in the modernization of nuclear weapons, they also present major risks and destabilizing challenges. Artificial intelligence, automation, and other developments in the cyber sphere affect dynamics on both the demand and supply sides of the nuclear deterrence equation. States and alliance such as NATO must adapt their deterrence thinking in light of these technological developments, and define their primary purpose and priorities in this shifting security context. Resilience planning, adaptation to the evolving security environment, threat anticipation, and consistent crisis management and incident response – as well as thinking about the mitigation measures necessary to prevent conflict escalation should deterrence fail – will all be critical in upholding nuclear deterrence as both policy and practice.

Summary

• This collection of essays explores, from the perspectives of eight experts, four areas of deterrence theory and policymaking: the underlying assumptions that shape deterrence practice; the enduring value of extended deterrence; the impact of emerging technologies; and the ‘blurring’ of the lines between conventional and nuclear weapons.
• Nuclear deterrence theory, with its roots in the Cold War era, may not account for all eventualities in security and defence in the 21st century, given the larger number of nuclear actors in a less binary geopolitical context. It is clear that a number of present factors challenge the overall credibility of ‘classical’ nuclear deterrence, meaning that in-depth analysis is now needed.
• Uncertainty as to the appetite to maintain the current nuclear weapons policy architecture looms large in discussions and concerns on global and regional security. The demise of the Intermediate-Range Nuclear Forces Treaty, doubts over the potential extension of the New Strategic Arms Reduction Treaty, heightened regional tensions in Northeast and South Asia, together with the current and likely future risks and challenges arising from global technological competition, making it all the more urgent to examine long-held assumptions in the real-world context.
• Extended deterrence practices differ from region to region, depending on the domestic and regional landscape. Increased focus on diplomatic capabilities to reduce risks and improve the long-term outlook at regional level, including by spearheading new regional arms-control initiatives, may be a viable way forward. Addressing the bigger picture – notably including, on the Korean peninsula, Pyongyang’s own threat perception – and the links between conventional and nuclear missile issues will need to remain prominent if long-term and concrete changes are to take hold.
• Most states have long held nuclear weapons to be ‘exceptional’: their use would represent a dramatic escalation of a conflict that must never be attained. Latterly, however, some officials and scholars have made the case that the impact of the use of a low-yield nuclear weapon would not be entirely distinct from that of a large-scale conventional attack. This blurring of lines between conventional and nuclear deterrence strips nuclear weapons of their exceptional nature, in a context in which states are faced with diverse, complex and concurrent threats from multiple potential adversaries that are able to synchronize non-military and military options, up to and including nuclear forces. The use of nuclear weapons risks becoming a ‘new normal’, potentially reducing the threshold for use – to cyberattacks, for example. This has direct implications for discussions around strategic stability. 
• While emerging technologies may offer tremendous opportunities in the modernization of nuclear weapons, they also present major risks and destabilizing challenges. Artificial intelligence, automation, and other developments in the cyber sphere affect dynamics on both the demand and supply sides of the nuclear deterrence equation. States and alliance such as NATO must adapt their deterrence thinking in light of these technological developments, and define their primary purpose and priorities in this shifting security context. Resilience planning, adaptation to the evolving security environment, threat anticipation, and consistent crisis management and incident response – as well as thinking about the mitigation measures necessary to prevent conflict escalation should deterrence fail – will all be critical in upholding nuclear deterrence as both policy and practice.

It is becoming widely accepted that we have transitioned, or are now transitioning, from an international liberal order to a different reality. Whether that reality is different solely in terms of power dynamics, or also in terms of values and institutions, is up for discussion. The growing body of literature on ‘post-liberalism’ is used as an entry-point for this article, which aims to explore how the post-liberal transition applies to cyberspace. We explore how power dynamics are evolving in cyberspace, as well as how established norms, values and institutions are contested. The article then looks at the emergence of cyber diplomacy as a consequence and response to the post-liberal transition. As it will be argued, if cyberspace was a creation of the liberal order, cyber-diplomacy is a post-liberal world practice. What role it plays in shaping a new order or building bridges between different political visions, and what it means for the future of cyberspace, will constitute key points of discussion.

In discussions to date about how international law applies in cyberspace, commentators have tended to focus their attention on how the rules on the use of force, or the law of armed conflict, apply to cyber activities conducted by states that give rise to physical damage, injury or death.

But in practice, the vast majority of state cyberattacks fall below this threshold. Far more common are persistent, low-level attacks that may leave no physical trace but that are capable of doing significant damage to a state’s ability to control its systems, often at serious economic cost.

Such cyber incursions might include network disruptions in the operation of another government’s websites; tampering with electoral infrastructure to change or undermine the result; or using cyber means to destabilize another state’s financial sector.

For these kinds of cyber operation, the principle of sovereignty, and the principle of non-intervention in another state’s internal affairs, are the starting point.

A UN Group of Government Experts (GGE) agreed in 2013 and 2015 that the principles in the UN Charter, including sovereignty and the prohibition on intervention in another state’s affairs, apply to states’ activities in cyberspace. The 2015 GGE also recommended eleven (non-binding) norms of responsible state behaviour in cyberspace.

However, states have not yet reached agreement on how to apply these principles. Until recently, there has also been very little knowledge of what states actually do in cyberspace, as they usually conduct cyber operations covertly and have been reluctant to put their views on record.

A new Chatham House research paper analyses the application of the principles of sovereignty and non-intervention to state cyberattacks that fall below the principle of use of force. As well as analysing the application of the law in this area, the paper also makes recommendations to governments on how they might best make progress in reaching agreement in this area.

Existing rules or new rules?

As the research paper makes clear, there is currently some debate, principally between countries in the West, about the extent to which sovereignty is a legally binding rule in the context of cyberspace and, if so, how it and the principle of non-intervention might apply in practice.

In the last few years, certain states have put on record how they consider international law to apply to states’ activities in cyberspace, namely the UK, Australia, France and the Netherlands. While there may be some differences in their approaches, which are discussed in the paper, there also remains important common ground: namely, that existing international law already provides a solid framework for regulating states’ cyber activities, as it regulates every other domain of state-to-state activity.

There is also an emerging trend for states to work together when attributing cyberattacks to hostile states, enabling them to call out malign cyber activity when it violates international law. (See, for example, the joint statements made in relation to the NotPetya cyber attack and malicious cyber activity attributed to the Russian government).

However, other countries have questioned whether existing international law as it stands is capable of regulating states’ cyber interactions and have called for ‘new legal instruments’ in this area.

This includes a proposal by the Shanghai Cooperation Organization (led by Russia and China) for an International Code of Conduct on Information Security, a draft of which was submitted to the UN in 2011 and 2015, without success. The UN has also formed a new Open-Ended Working Group (OEWG) under a resolution proposed by Russia to consider how international law applies to states’ activities in cyberspace.

The resolution establishing the OEWG, which began work earlier this year, includes the possibility of the group ‘introducing changes to the rules, norms and principles of responsible behaviour of States’ agreed in the 2013 and 2015 GGE reports. In the OEWG discussions at the UN in September, several countries claimed that a new legal instrument was needed to fill the ‘legal vacuum’ (Cuba) or ‘the gap of ungoverned areas’ (Indonesia).

It would be concerning if the hard-won consensus on the application of international law to cyberspace that has been reached at past GGEs started to unravel. In contrast to 2013 and 2015, the 2017 meeting failed to reach an agreement.

On 9 December, a renewed GGE will meet in New York, but the existence of the OEWG exploring the same issues in a separate process reflects the fact that cyber norms have become an area of geopolitical rivalry.

Aside from the application of international law, states are also adopting divergent approaches to the domestic regulation of cyberspace within their own territory. The emerging trend towards a ‘splinternet’ – i.e. between states that believe the internet should be global and open on the hand, and those that favour a ‘sovereignty and control’ model on the other  – is also likely to make discussions at the GGE more challenging.

Distinct from the international law concept of sovereignty is the notion of ‘cybersovereignty’, a term coined by China to describe the wide-ranging powers it assumes under domestic law to regulate its citizens’ access to the internet and personal data within its territory. This approach is catching on (as reflected in Russia’s recently enacted ‘Sovereign Internet Law’), with other authoritarian states likely to follow suit.

The importance of non-state actors

In parallel with regional and UN discussions on how international law applies, a number of initiatives by non-state actors have also sought to establish voluntary principles about responsible state behaviour in cyberspace.

The Global Commission on the Stability of Cyberspace, a multi-stakeholder body that has proposed principles, norms and recommendations to guide responsible behaviour by all parties in cyberspace, recently published its final report. The Cybersecurity Tech Accord  aims to promote collaboration between tech companies on stability and resilience in cyberspace. President Macron’s ‘Paris Call for Trust and Security in Cyberspace’ has to date received the backing of 67 states, 139 international and civil society organizations, and 358 private-sector organizations.

It remains to be seen in the long term whether the parallel processes at the UN will work constructively together or be competitive. But notwithstanding the challenging geopolitical backdrop, the UN GGE meeting next week at the least offers states the opportunity to consolidate and build on the results of past meetings; to increase knowledge and discussion about how international law might apply; and to encourage more states to put their own views of these issues on the record.

Please note this an online-only event.

Norway is one of the few European countries that remains outside of the European Union. After the country’s population rejected the prospect of joining the EU twice, Norway’s relationship with the Union has been based on its membership of the European Economic Area (EEA), alongside Iceland and Liechtenstein.

The ‘Norway Model’ was often mentioned in the run up to the Brexit vote as a possible basis for Britain’s future relationship with the bloc, not least because it offers the least disruption to the current arrangement. Equally, Norway is not subject to the EU fisheries policy - an anticipated major issue in the next phase of Brexit talks. Nor is it part of the EU Customs Union.

Even though Prime Minister Johnson has now ruled out the type of deep economic and regulatory integration with the EU that Norway enjoys through its EEA membership, the country’s experience can still offer valuable lessons for the UK as it prepares to exit the transition period at the end of 2020.

In this session, the speaker will share Norway’s experience as a long-standing EEA member and discuss the challenges of engaging with the EU from the outside. What lessons can Norway offer the UK ahead of the negotiations on the future of UK-EU relations? What are the limits of its current arrangement with the EU? And is there any appetite among the Norwegian population to revisit it?

This closed-door roundtable explores possible strategic shifts in the Indo-Pacific between now and 2024. Focusing on trade security, climate change disruptions and security cooperation, it aims to enhance the understanding of the regional goals of, and strategic relationships between, the key countries active in the region.

The workshop is part of a larger project funded by the Strategic Policy Division of the Australian Department of Defence. The project includes workshops in the United States, the United Kingdom, France, Japan, India and the Pacific Islands (Tonga).

Attendance at this event is by invitation only.