In the context of globalisation and privatisation, an emerging body of literature has applied the concept of an ‘assemblage’ to international relations and security studies. This article will argue that an assemblage framework provides the best means for understanding the complex configuration of cyber security actors, given that contemporary cyber security practices do not conform to the traditional public-private and global-local distinctions used in security studies and International Relations literature. With the configuration of cyber security actors, and the relationships between them in constant flux, an assemblage framework provides a means for understanding the contested, dynamic and diachronic nature of contemporary cyber security provision. While the concept of security assemblages is favoured in this article, the process and context in which the term has traditionally been used cannot be blindly imposed on the issue of cyber security. This article will therefore propose a different model of how cyber security assemblages have developed and explain the implications this has on contemporary security dynamics.

/pdf/cyber-security-assemblages-a-framework-for-understanding-the-4qg6n524gm.pdf

Cyber Security Assemblages: A Framework for Understanding the Dynamic and Contested Nature of Security Provision

This book offers a comprehensive analysis of the international law applicable to cyber operations, including a systematic examination of attribution, lawfulness and remedies. It demonstrates the importance of countermeasures as a form of remedies and also shows the limits of international law, highlighting its limits in resolving issues related to cyber operations. There are several situations in which international law leaves the victim State of cyber operations helpless. Two main streams of limits are identified. First, in the case of cyber operations conducted by non-state actors on the behalf of a State, new technologies offer various ways to coordinate cyber operations without a high level of organization. Second, the law of State responsibility offers a range of solutions to respond to cyber operations and seek reparation, but it does not provide an answer in every case and it cannot solve the problem related to technical capabilities of the victim.

Cyber Operations and International Law

Several indicators point to a crisis at the heart of the emerging area of international cyber security law. First, proposals for binding international treaties by leading stakeholders, including China and Russia, have been met with little enthusiasm by other states, and are generally seen as having limited prospects of success. Second, states are extremely reluctant to commit themselves to specific interpretations of controversial legal questions and thus to express their cyber opinio juris. Third, instead of interpreting or developing rules, state representatives seek refuge in the more ambiguous term ‘norms’. This article argues that the reluctance of states to engage in international law-making has left a power vacuum, lending credence to claims that international law fails in addressing modern challenges posed by rapid technological development. In response, several non-state-driven norm-making initiatives have sought to fill the void, including Microsoft's cyber norms proposals and the Tallinn Manual project. The article then contends that this emerging body of non-binding norms presents states with a critical window of opportunity to reclaim a central law-making position, similar to historical precedents including the development of legal regimes for Antarctica and nuclear safety. Whether the supposed crisis will lead to the demise of inter-state cyberspace governance or a recalibration of legal approaches will thus be decided in the near future. States should assume a central role if they want to ensure that the existing power vacuum is not exploited in a way that would upset their ability to achieve strategic and political goals.

/pdf/from-cyber-norms-to-cyber-rules-re-engaging-states-as-law-29qf2fphyg.pdf

From Cyber Norms to Cyber Rules: Re-engaging States as Law-makers

Cyber Mercenaries explores the secretive relationships between states and hackers. As cyberspace has emerged as the new frontier for geopolitics, states have become entrepreneurial in their sponsorship, deployment, and exploitation of hackers as proxies to project power. Such modern-day mercenaries and privateers can impose significant harm undermining global security, stability, and human rights. These state-hacker relationships therefore raise important questions about the control, authority, and use of offensive cyber capabilities. While different countries pursue different models for their proxy relationships, they face the common challenge of balancing the benefits of these relationships with their costs and the potential risks of escalation. This book examines case studies in the United States, Iran, Syria, Russia, and China for the purpose of establishing a framework to better understand and manage the impact and risks of cyber proxies on global politics.

/pdf/cyber-mercenaries-the-state-hackers-and-power-1gtwiu8yws.pdf

Cyber Mercenaries: The State, Hackers, and Power

Addressing both scholars of international law and political science as well as decision makers involved in cybersecurity policy, the book tackles the most important and intricate legal issues that a state faces when considering a reaction to a malicious cyber operation conducted by an adversarial state. While often invoked in political debates and widely analysed in international legal scholarship, self-defence and countermeasures will often remain unavailable to states in situations of cyber emergency due to the pervasive problem of reliable and timely attribution of cyber operations to state actors. Analysing the legal questions surrounding attribution in detail, the book presents the necessity defence as an evidently available alternative. However, the shortcomings of the doctrine as based in customary international law that render it problematic as a remedy for states are examined in-depth. In light of this, the book concludes by outlining a special emergency regime for cyberspace.

Unilateral Remedies to Cyber Operations: Self-Defence, Countermeasures, Necessity, and the Question of Attribution

Since the late 1990s, the United States has operated from the premise that international law applies in cyberspace. This remains the U.S. approach nearly two decades later. What appears to have changed since then is the Department of Defense’s position on sovereignty in cyberspace. In 1999, the question was not whether a State could violate another State’s sovereignty as a matter of law; rather, the challenge was identifying when cyber operations do so. Recently, the DoD has indicated that it may have reassessed its position that sovereignty can be violated as a matter of international law in the cyber context. In this article, Professors Schmitt and Vihul examine the point of contention between the DoD’s earlier view, as well as the Tallinn Manuals’, and that which now appears to be the revised DoD position.

Respect for Sovereignty in Cyberspace

Globalization has not conquered sovereignty Instead, the notion of sovereignty occupies center stage in discussions concerning the normative architecture of cyberspace On the diplomatic level, the term is generally cast in its broadest sense, one that signifies freedom from external control and influence For instance, when western States raise the issue of human rights in cyberspace, those occupying the opposite side of the negotiating table fall back on sovereignty-based arguments Mention of sovereignty in consensus documents is consequently often the price that liberal democracies pay for recognition of their policy priorities, such as individual freedoms and the availability of self-help measures in response to hostile cyber operations Unfettered by the constraints of political agendas and negotiating tactics, the international law academy has tended to approach the notion from a normatively analytical perspective For legal scholars, the question of how the principle of sovereignty, as well as its derivate rules, govern cyber activities by and against States has become a dominant topic on the research agenda This article assesses a recent controversy over whether sovereignty is a primary rule of international law, sets forth the authors’ views on sovereignty violations in cyberspace, and highlights several resultant policy issues

/pdf/sovereignty-in-cyberspace-lex-lata-vel-non-5e24id0pvf.pdf

Sovereignty in cyberspace: lex lata vel non?

The special expanded issue of the NATO Cooperative Cyber Defence Centre of Excellence's Tallinn Papers examines the nature, formation and evolution of international legal norms governing cyber activities The inquiry’s foundational premise is that the rules of international law governing cyber activities are identical to those applicable to other types of conduct Any differences in their explication and application are the product of the unique nature of cyber activities, not a variation in the legal strictures that shape their content and usage It conducts the examination by genre of legal norm: treaty, customary law and general principles

https://papers.ssrn.com/sol3/Delivery.cfm/SSRN_ID2543520_code1411821.pdf?abstractid=2543520&mirid=5

The nature of international law cyber norms

The article examines the use of non-State actors by States to conduct cyber operations against other States. In doing so, it examines attribution of a non-State actor’s cyber operations to a State pursuant to the law of State responsibility, attribution of a non-State actor’s cyber armed attack to a State for the purposes of a self-defense analysis, and attribution of cyber military operations to a State in the context of determining whether an international armed conflict has been initiated. These three very different legal inquiries are often confused with each other. The article seeks to deconstruct the issue of attribution into its various normative components.

Liis Vihul

Papers

Respect for Sovereignty in Cyberspace

Sovereignty in cyberspace: lex lata vel non?

The nature of international law cyber norms

Proxy wars in cyber space: the evolving international law of attribution

The emergence of international legal norms for cyberconflict