Bad News: Cyber Norms Probably Won’t Constrain Cyber Conflict

Brian M. Mazanec is an adjunct professor at George Mason University. His book, The Evolution of Cyber War: International Norms for Emerging-Technology Weapons, will be published by Potomac Books next month.

The U.S. government has put the promotion of its cyber norms at the forefront of its cyber diplomacy with the hopes that it will constrain pervasive cyberattacks. Past experience with norm promotion efforts provide insight on whether the United States is likely to be successful. Unfortunately, the future is bleak.

As a general rule, states develop norms to promote their interests and a norm will only spread if other states perceive it to be in their interest to abide by it. Historical examples of this are plentiful. In the late 19^th century, Russia pursued constraining norms against the possession and use of chemical and biological weapons as well as strategic bombing at the First Hague Conference. Russia had failed to master these new weapons and wanted to constrain potential adversaries. Britain, on the other hand, opposed a norm restricting strategic bombing because it saw bombing as a tool to offset the relatively small size of its ground forces. As a result, the conference agreed to prohibit the “discharge of projectiles and explosives from balloons or by other new analogous methods” for a temporary period of five years while prohibiting chemical and biological weapons indefinitely. These bans lasted until the powers of the day determined it was not in their self-interest to maintain them. Britain and Germany both used chemical weapons in World War I and strategic bombing was used throughout World War II by all parties.

The requirement that states perceive a norm to be in their self-interest means that norms containing offensive cyber activity are unlikely to work. Unlike other forms of weaponry, cyber weapons are stealthy, making it difficult for planners to determine whether cyber weapons will be useful in the future. Furthermore, some states rely more on cyberspace than others, making states that are less dependent on the Internet less vulnerable to an attack. These relatively immune states will struggle to determine if constraining norms are in their interest as many states did with strategic bombing and will want to keep their options open.

Chinese, Russian, and U.S. cyber activities appear to indicate that these states believe they have more to gain from embracing cyberattack capabilities than constraining norms:

There are other reasons beyond self-interest that make containing cyber norms less likely to emerge. For example, unlike when the United States was briefly the only nuclear power after World War II and was able to establish a precedent of restraint in post-World War conflicts, it is too late to have a state establish a precedent through restraint or establish a prohibition on cyberattacks.

While policymakers are fixated on the development of constraining rules of the road for cyberspace, history shows that U.S. efforts to promote norms to constrain offensive cyber activities are unlikely to succeed.