International Cybersecurity Norms and Responsible Cyber Sovereignty
Initially envisioned as a free and open communication space between people, free from state regulation and intervention, cyberspace has become a fundamental subject of national and global politics over the last decade. Allegedly statesponsored cyber operations against Estonia in 2007, Georgia in 2008 and Iran in 2010 played an important role in turning cybersecurity into a national and international security issue. Although the development of cyber diplomacy and international cybersecurity law were left behind the militarization of cyberspace, nevertheless, there have been many international initiatives to adopt international cybersecurity norms in the past decade. Within the framework of the life cycle model of the norms developed by Martha Finnemore and Kathryn Sikkink (1998), this article aims to shed light on the emergence of international cybersecurity norms by focusing on the negotiations held at the First Committee of the United Nations for more than twenty years. The article argues that those negotiations held under the First Committee dealing with disarmament and international security issues indicate the first stage of the formation of international rules related to cyberspace, and the negotiations to be completed under the UN Open-Ended Working Group in 2021 is critical for the transition of international cybersecurity norms from the first to the second stage.
Uluslararası Siber Güvenlik Normları ve Sorumlu Siber Egemenlik
Başlangıçta, devlet düzenlemesi ve müdahalesinden arınmış kişiler-arası özgür ve açık bir iletişim, haberleşme ve paylaşma alanı olarak tahayyül edilen siber alan kısa sürede ulusal ve küresel siyasetin temel bir konusu haline gelmiştir. 2007’de Estonya’ya, 2008’de Gürcistan’a ve 2010’da İran’a yönelik devlet-destekli olduğu iddia edilen siber operasyonlar, siber güvenliğin ulusal ve uluslararası bir güvenlik meselesine dönüşmesinde önemli rol oynamıştır. Her ne kadar siber diplomasi ve uluslararası hukuk, siber alanın militerleşmesini geriden takip etse de son on yılda uluslararası siber güvenlik normların benimsenmesi amacıyla birçok uluslararası girişim olmuştur. Bu makale, Martha Finnemore ve Kathryn Sikkink (1998) tarafından geliştirilen normların yaşam döngüsü modeli çerçevesinde Birleşmiş Milletler’in silahsızlanma ve uluslararası güvenlik konuları ile ilgilenen Birinci Komitesi’nde yirmi yıldan uzun bir süredir uluslararası güvenlik bağlamında devletlerin siber teknoloji kullanımlarına yönelik sürdürülen müzakerelere odaklanarak uluslararası siber güvenlik normlarının ortaya çıkışına ve siber alana ilişkin uluslararası rejimlerin oluşumunun ilk aşamasına, yani norm yaşam döngüsünün başlangıcına ışık tutmayı amaçlamaktadır. Makale, Birleşmiş Milletler’in Birinci Komitesi altında görev yapan Açık Uçlu Çalışma Grubu’nun 2021 yılındaki nihai raporunun siber alanda sorumlu devlet davranışına ilişkin normların ilk aşamadan ikinci aşamaya geçmesi bakımından kritik öneme sahip olduğunu iddia edecektir.
Cyberspace has increasingly been subjected to highly sophisticated, large-scale, and often allegedly state-sponsored cyber operations. An important question that arises here is how the basic power rivalries that provide this increase in offensive cyber abilities will affect diplomatic efforts to prevent conflict in cyberspace. Over the past decade, many states have begun to develop their national cyber capabilities, defined cybersecurity strategies, and started to establish cyber defense commands within their military structures that can fight in cyberspace. Although the development of cyber diplomacy and the application of international law left behind the militarization of the cyberspace, the international community has, nevertheless, agreed on an international framework comprising four elements: the application of international law to cyberspace, the adoption of the norms of responsible state behavior in times of peace, the development of confidence-building measures as a way to reduce cyber conflict, and capacity building to enable states to better protect themselves from destructive or unbalancing cyber activity. All members of the UN General Assembly have repeatedly reaffirmed this framework, which was included in three consecutive UN Group of Governmental Experts (GGE) reports in 2010, 2013 and 2015. The norms recommended by the UN GGE in 2015 to provide an ‘open, safe, stable, accessible and peaceful cyberspace for all’ were supported by many multilateral and multi-stakeholder international and regional platforms. Disagreements on how to apply international law to cyberspace and the scope of cyber sovereignty prevented the UN GGE from reaching a consensus at its last meeting in 2017, representing a short pause in the life cycle of international cybersecurity norms. Yet, a new process started by the approval of the two rival motions by the UN General Secretariat in 2018 and two different groups [a new GGE and a new Open-Ended Working Group (OEWG)] were established in 2019 with a similar mandate.
The OEWG, which allows all states and stakeholders to participate, has the potential to play a critical role in spreading these norms to wider audiences by producing concrete recommendations on what responsible state behavior in cyberspace means in practice and how they can be implemented. As a matter of fact, diplomatic negotiations within the OEWG may contribute to the formation of an inter-state agreement on what behaviors are considered appropriate in cyberspace. When it comes to the compliance of states with norms, the shared recognition of norms is more important than their official validity. Considering that the effectiveness of the norms depends on how and where these norms are accepted, which actors participate in international interactions and where and how often they interact with, the OEWD with its wide multi-stakeholder structure, has the potential to increase the social recognition and legitimacy of these norms. The literature reveals that acceptance of norms depends on actors being part of the process of building socially structured The OEWG, which allows all states and stakeholders to participate, has the potential to play a critical role in spreading these norms to wider audiences by producing concrete recommendations on what responsible state behavior in cyberspace means in practice and how they can be implemented. As a matter of fact, diplomatic negotiations within the OEWG may contribute to the formation of an inter-state agreement on what behaviors are considered appropriate in cyberspace. When it comes to the compliance of states with norms, the shared recognition of norms is more important than their official validity. Considering that the effectiveness of the norms depends on how and where these norms are accepted, which actors participate in international interactions and where and how often they interact with, the OEWD with its wide multi-stakeholder structure, has the potential to increase the social recognition and legitimacy of these norms. The literature reveals that acceptance of norms depends on actors being part of the process of building socially structured.
