About | HeinOnline Law Journal Library | HeinOnline Law Journal Library | HeinOnline

LOG IN
LOG IN


7 J. Cybersecurity 1 (2021)

handle is hein.journals/jnlocybrs7 and id is 1 raw text is: 1 a t Journal of Cybersecurity, 2021, 1-9 d oi: 10.1093/cybse c/tya b009 Research Paper Research Paper Why international law and norms do little in preventing non-state cyber attacks Nori Katagiri * Department of Political Science, Saint Louis University, McGannon Hall 152, 3750 Lindell Boulevard, St Louis, MO 63108, USA *Correspondence address. Department of Political Science, Saint Louis University, McGannon Hall 152, 3750 Lindell Boulevard, St Louis, MO 63108, USA. Tel: +1-314-977-1462; E-mail: nori.katagiri@slu.edu Received 26 May 2020; revised 5 February 2021; accepted 18 February 2021 Abstract In this article, I investigate why international law and norms have failed to keep cyberspace peaceful. The problem comes mainly from their failure to address what non-state actors, such as individual hackers and technology firms, do in cyberspace. Created by the extensive input of government offi- cials decades ago with heavy focus on states as primary actors of international politics, international law is incoherent with the dominance of non-state actors as de facto operators of cyberspace. The critical problem shared by international law and institutions of having no teeth to penalize non- state violence extends to cyberspace. As a result, noncompliance with international law has become practical, and it has even bolstered the private sector, especially major technology firms, to assert themselves in the legal void, leverage their digital products to reshape norms, and become norm entrepreneurs in the business of digital defense. However, the multiplication of norm entrepreneurs has accelerated in an uncoordinated manner, and the way they built their interests does not neatly align with those of the states. While some norms of cyberspace behavior have been accepted, many others remain contested. In the meantime, norm discourse in diplomatic venues, including in multi- lateral debates at the United Nations, has become highly undemocratic, dominated by a small mix of great powers and active middle powers that are also split over what norms should guide state and nonstate behaviors. Key words: international law; cyber norms; democracy; nonstate actors Introduction The Coronavirus Disease 2019 (COVID-19) outbreak was a sudden blessing to cyber warriors looking for opportunities to trick people with scams and malware. Hackers capitalized on the pandemic by registering malicious coronavirus-related domains, selling dis- counted off-the-shelf malware on the dark web, and sneaking into networks of people forced to log on from home. By March 2020, the number of new domains designed to profit off the global health con- cern increased 10-fold the average number of previous weeks, along with an uptick in the number of phishing emails thrown at hospitals and virus testing facilities. At one point, an Android app called CovidLock promised to deliver the latest information on the pandemic, only to lock up a user's phone with a strain of malicious software and demand ransom of $100 in bitcoin to be paid within 48 h of infection OThe Author(s) 2021. Published by Oxford University Press. [1]. At another time, Pakistan's state-sponsored threat actor called APT36 ran a spear-phishing campaign using COVID-themed docu- ments that masqueraded as health advisories to deploy the Crimson Remote Administration Tool onto target systems [2]. It was a familiar picture for most observers of international se- curity in times of crisis; national governments scrambling to protect their networks, private firms recovering from damages, and insurers looking for every excuse to raise premiums. One fact emerged: vic- tims received little to no visible protection from international institu- tions, laws, or norms of cyberspace behavior. The United Nations called for collective action on the coronavirus, but none on cyberat- tacks, and no international institution stood up to defend cyberspace during the crisis. Some existing norms of behavior, ranging from re- sponsible state behavior to the ban on deliberate attacks on civilians, This is an Open Access article distributed under the terms of the Creative Commons Attribution License (http://creativecommons.org/licenses/by/4.0/), which permits unre- stricted reuse, distribution, and reproduction in any medium, provided the original work is properly cited.