61. Creating Accountability for Global Cyber Norms
- Author:
- James A. Lewis
- Publication Date:
- 02-2022
- Content Type:
- Special Report
- Institution:
- Center for Strategic and International Studies
- Abstract:
- The year 2021 saw all UN member states agree in the Open-Ended Working Group (OEWG) on a framework for responsible state behavior in cyberspace, based on norms developed in the United Nations Group of Governmental Experts (GGE) in 2015.1 The OEWG formalized global agreement on the 2015 norms. This consensus agreement means that the framework for responsible state behavior is now politically binding for all member states. Global agreement on the obligations for responsible state behavior is a substantial step forward in building international cybersecurity in a rules-based environment. Unfortunately, international experience since 2015 has shown that agreement on norms, even when politically binding, is by itself not enough to ensure their observation or create stability in cyberspace. This has shifted discussion from what norms are needed to how to build accountability and what to do when norms are ignored. While the norms agreed to by all member states will ultimately reinforce international stability, to make progress, it will be necessary to develop a collective diplomatic strategy to improve the observation of norms and increase accountability when they are ignored. A strategy of sustained engagement and the imposition of consequences is necessary for norms to have effect. Our assumption is that accountability for malicious cyber actions can only be strengthened if there are consequences for a state’s decision not to observe norms. If nothing else, a failure to take action in response to transgressions seems to only encourage opponents. An immediate task is to define the conditions for collective action. There has been an initial and informal agreement among like-minded democratic nations that accountability requires the imposition of consequences for a failure to observe norms, but several issues must be addressed. These include agreement on standards for attribution of the source of a malicious action and agreement on a proportional, lawful, and effective response. A collective approach is essential if efforts to create accountability are to succeed, and any response to a cyber incident will require political heft and sustained engagement.
- Topic:
- Security, International Cooperation, United Nations, Cybersecurity, Accountability, Transparency, and Cyberspace
- Political Geography:
- Global Focus