Challenges in Cybersecurity Risks, Strategies, and ... - Unidir

BACKGROUND
As cyberattacks grow in number and sophistication, and states, as well as non-state actors such
as private hackers and organized criminals, appear to be becoming involved, the threat is
increasingly perceived as a problem in both a national and an international security context. Yet
assessments of how real the threat is, where the danger lies, who is best suited to respond to it,
and what kind of international measures and strategies are appropriate to protect information
societies against malicious actors – in short, how best to safeguard the long-term stability and
peaceful use of the internet – vary widely.
States are increasingly aware of the need to seriously address the daunting challenges of
protecting their information networks – especially those related to national security and critical
infrastructures – from any attacker. Recent developments have shown that there is more to this
endeavor than answering technical questions, particularly since many technical problems do not
necessarily seem to have solutions. The cybersecurity question needs to be placed within a
larger framework of international cooperation, norms, and rules for appropriate and responsible
state behavior that will ensure the peaceful use of cyberspace. To make such a framework
possible, a variety of questions have to be addressed:
� The potential impact of the actions of newly emerging, sophisticated cyberattackers, state
as well as non-state actors, their motivations, tactics, and procedures.
� The costs and benefits to national and international security of military doctrines
incorporating offensive cyber operations have yet to be fully understood. Due to the nature
of this type of technology, it is very difficult to attribute cyberattacks. Offensive uses of
such technologies in the cyber domain could lead to geo-strategic instability and raise the
risk of miscalculations in times of crisis. This in turn could lead to escalation and serious
conflicts. It is important to understand current trends and developments regarding the
potential of cyberattacks for conflict and war, and the possible effects on civilian
infrastructure, economies, and human security.
� Open questions regarding the application of international laws and norms have to be
addressed, as there is still no multilateral understanding about how to apply these to the
cyber realm, or even about why doing so is important for the future. For example, how
should national militaries apply the laws of armed conflict and humanitarian law to
cyberwarfare in the lead up to or in actual times of armed conflict? How does one apply the
principle of proportional response to “cyberwar”? What level of cyber disruption
constitutes “unacceptable harm” to civilians? Even more fundamentally, what constitutes a
casus belli in cyberspace with possible effects on other domains causing a conventional
response?
� The question of what constraints can and should be put upon offensive cyber operations
given their technical conditions and the current legal regimes needs to be further
investigated. Is it possible to control various kinds of cyber operations and confine their
impact? What are the strengths and weaknesses of major strategies to prevent the misuse of
cyberspace? An effective response to the threat of cyberattacks will have to involve a
variety of stakeholders. But what are the respective roles of non-state and transnational
actors such as civil society and industry? What role can national governments play? How
can global cybersecurity be strengthened through international norms of behavior,
8