Geography
The Evolution of Cybersecurity Norms in International Law
Quick fact
In 2015, the UN Group of Governmental Experts (UNGGE) – including the US, Russia, and China – unanimously agreed that international law applies in cyberspace and that states must not use proxies to commit cyber attacks. This marked a rare moment of consensus among rivals.
Why this is interesting
Every day, states probe each other's digital defenses, yet there is no binding global treaty against cyberwar. How do countries agree on what's allowed in cyberspace?
Read the full explanation
Understanding The Evolution of Cybersecurity Norms in International Law
Imagine a playground with no written rules. Kids still develop informal norms – don't push, don't steal others' toys – but misunderstandings lead to conflicts. Similarly, cyberspace is a new domain, and states are still figuring out the rules. Initially, there was a 'cyber wild west' with little agreement. But over time, key documents like the Tallinn Manual – a scholarly but influential guide – were produced, and the UN created forums where states could discuss. The process is not like a treaty with formal signatures; instead, norms build gradually through practice, consensus, and precedent.
A deeper explanation
The evolution of cybersecurity norms is driven by the need for predictability and restraint among states. International law, particularly the UN Charter, provides a baseline – the prohibition on the use of force, sovereignty, and non-intervention. The Tallinn Manual, first published in 2013 and updated in 2017, was a landmark expert effort to interpret how these existing rules apply to cyber operations. Meanwhile, the UNGGE produced consensus reports in 2013 and 2015, where states agreed that international law applies in cyberspace, and recommended voluntary norms like not attacking critical infrastructure. Why does this matter? Because formal treaties are difficult to negotiate, norms fill the gap, shaping behavior and providing a basis for diplomacy. Yet, there is no binding enforcement mechanism, so the evolution is ongoing, with ongoing debates about how to apply concepts like sovereignty and self-defense to a domain without physical borders.