One of the most important questions regarding cyber weapons
has been whether – and if so, how – arms control measures can be applied in the cyber realm.
According to many arms control experts,
the “gold standard” of arms control usually entails,
first, a legally binding treaty,
second, restricting a clearly and detailed defined subject
and, third, ensuring compliance through an effective yet non-intrusive verification regime.
Unfortunately, it is significantly harder to archive this in cyberspace
than in other more classical military realms.
First, it is hard for states to agree on what to regulate or ban to begin with.
Well established arms control concepts like “effector” or “carrier”
– introduced in learning unit one –
are hard to apply.
Second, given the fast pace of technological developments in information technology,
detailed arms control agreements
might always be behind current technological trends.
Third, by their very nature,
cyber weapons are basically nothing but software code
and can be programmed, stored on or released from
any computer or mobile device.
In consequence,
hiding malicious code or changing code on the fly is extremely easy.
This means that verification in the arms control sense is a real challenge,
and trust is way harder to archive.
Given these problems,
two other paths are currently in the limelight:
One is to focus on voluntary normative restraints
rather than legally binding treaties,
the other is to implement so-called transparency and confidence building measures,
or CBMs.
Both approaches have pros and cons.
CBMs offer transparency and information exchange
on a voluntary basis
but do not restrict actors in the way arms controllers would like.
They are relatively easy to achieve.
The OSCE member states, for instance,
have agreed on certain CBMs
to defuse emerging tensions,
for example setting up official contact points.
And in 2013,
Russia and the United States
established a cyber hotline to inform each other about relevant cyber instances.
In contrast to CBMs,
normative restraints or simply “norms”
“reflect the international community’s expectations,
set standards for responsible State behaviour
and allow the international community
to assess the activities and intentions of States“,
as the report of the 2015 UN Group of Governmental Experts explains.
The Russian Federation
first suggested developing behavioural norms
in a draft proposal to “regulate” “Information Warfare”
and its subcomponent cyberwarfare in 1998.
Russia tried to bind the technologically more advanced US to international norms,
but with no result.
Since then, however,
some international norms on responsible state behaviour in the cyber realm
seem to have emerged,
like “do not allow your territory to be used for internationally wrongful acts
using information technology”
or “do not intentionally damage critical infrastructures.”
Interestingly enough,
not only states have acted as norm entrepreneurs,
but also private business
and intelligence agencies.
But norms can be violated
and the level of compliance is dependent
on the internalization of the norm by all actors.
Some experts, however,
still think that at least some forms of harder arms control
might be able to be applied to military cyber preparations and operations.
One approach could be
a binding international definition of what constitutes a cyber weapon
that is strongly tied to technical aspects
and can be assessed before its actual usage.
A second venture
would be the establishment of technical approaches
to control or oversee military IT networks
to detect the application of weaponized code.
None of these tools could prevent
covert state activities
– a burden that arms control has always had to carry –
but they can create important steps towards
more effective cyber verification regimes.