International Cybersecurity Norms and Responsible Cyber Sovereignty

Abstract

Initially envisioned as a free and open communication space between people, free from state regulation and intervention, cyberspace has become a fundamental subject of national and global politics over the last decade. Allegedly state-sponsored cyber operations against Estonia in 2007, Georgia in 2008 and Iran in 2010 played an important role in turning cybersecurity into a national and international security issue. Although the development of cyber diplomacy and international cybersecurity law were left behind the militarization of cyberspace, nevertheless, there have been many international initiatives to adopt international cybersecurity norms in the past decade. Within the framework of the life cycle model of the norms developed by Martha Finnemore and Kathryn Sikkink (1998), this article aims to shed light on the emergence of international cybersecurity norms by focusing on the negotiations held at the First Committee of the United Nations for more than twenty years. The article argues that those negotiations held under the First Committee dealing with disarmament and international security issues indicate the first stage of the formation of international rules related to cyberspace, and the negotiations to be completed under the UN Open-Ended Working Group in 2021 is critical for the transition of international cybersecurity norms from the first to the second stage.

Keywords

• International politics
• International norms
• International cyber security
• United nations
• International organizations
• Cyberspace
• Information security
• International law
• Cyber war
• Cyber norms
• International cybersecurity norms

Uluslararası Siber Güvenlik Normları ve Sorumlu Siber Egemenlik

Abstract

Başlangıçta, devlet düzenlemesi ve müdahalesinden arınmış kişiler-arası özgür ve açık bir iletiş im, haberleş me ve paylaş ma alanı olarak tahayyül edilen siber alan kısa sürede ulusal ve küresel siyasetin temel bir konusu haline gelmiştir. 2007’de Estonya’ya, 2008’de Gürcistan’a ve 2010’da İran’a yönelik devlet-destekli olduğu iddia edilen siber operasyonlar, siber güvenliğin ulusal ve uluslararası bir güvenlik meselesine dönüşmesinde önemli rol oynamıştır. Her ne kadar siber diplomasi ve uluslararası hukuk, siber alanın militerleşmesini geriden takip etse de son on yılda uluslararası siber güvenlik normların benimsenmesi amacıyla birçok uluslararası girişim olmuştur. Bu makale, Martha Finnemore ve Kathryn Sikkink (1998) tarafından geliştirilen normların yaşam döngüsü modeli çerçevesinde Birleşmiş Milletler’in silahsızlanma ve uluslararası güvenlik konuları ile ilgilenen Birinci Komitesi’nde yirmi yıldan uzun bir süredir uluslararası güvenlik bağlamında devletlerin siber teknoloji kullanımlarına yönelik sürdürülen müzakerelere odaklanarak uluslararası siber güvenlik normlarının ortaya çıkışına ve siber alana ilişkin uluslararası rejimlerin oluşumunun ilk aşamasına, yani norm yaşam döngüsünün başlangıcına ışık tutmayı amaçlamaktadır. Makale, Birleşmiş Milletler’in Birinci Komitesi altında görev yapan Açık Uçlu Çalışma Grubu’nun 2021 yılındaki nihai raporunun siber alanda sorumlu devlet davranışına ilişkin normların ilk aşamadan ikinci aşamaya geçmesi bakımından kritik öneme sahip olduğunu iddia edecektir.

Keywords

• Uluslararası siyaset
• Uluslararası normlar
• Uluslararası siber güvenlik
• Birleşmiş milletler
• Uluslararası örgütler
• Siber alan
• Enformasyon güvenliği
• Uluslararası hukuk
• Siber savaş
• Siber normlar
• Uluslararası siber güvenlik normları

Supporting Institution

Yazar bu çalışma için finansal destek almadığını beyan etmiştir.

References

1. Acharya A, ‘How Ideas Spread: Whose Norms Matter? Norm Localization and Institutional Change in Asian Regionalism’ (2004) 58 (2) International Organization 239–75.
2. Chesney R ve Citron D, ‘Deepfakes and the New Disinformation War: The Coming Age of Post-Truth Geopolitics’ (January / February 2019) Foreign Affairs 147–155.
3. Choucri N ve Clark D D, ‘Who Controls Cyberspace?’ (2013) 69 (5) Bulletin of the Atomic Scientists 21–31.
4. Choucri N ve Clark D D, International Relations in the Cyber Age: The Co-Evolution Dilemma (The MIT Press, 2019).
5. Clark D ‘Characterizing Cyberspace: Past, Present and Future’ (2010) MIT/CSAIL Working Paper,  https://projects.csail.mit.edu/ecir/wiki/images/7/77/Clark_Characterizing_cyberspace_1-2r.pdf >
6. Çelik Ş, ‘Stuxnet Saldırısı ve ABD’nin Siber Savaş Stratejisi: Uluslararası Hukukta Kuvvet Kullanmaktan Kaçınma İlkesi Çerçevesinde Bir Değerlendirme’ (2013) 15 (1) Dokuz Eylül Üniversitesi Hukuk Fakültesi Dergisi 137-175.
7. Darıcılı A B, ‘Demokrat Parti Hack Skandalı Bağlamında ABD ve RF'nin Siber Güvenlik Stratejilerinin Analizi’, (2017) 1 (1) Ulisa: Uluslararası Çalışmalar Dergisi, 1-24.
8. Deibert R J ve Crete-Nishihata M, ‘Global Governance and the Spread of Cyberspace Controls’ (2012) 18 Global Governance 339-361.

9. Deibert R J ve Rohozinski R, ‘Risking Security: Policies and Paradoxes of Cyberspace Security’ (2010) 4 (1) International Political Sociology 15–32.
10. Deibert R J, Rohoinski R ve Crete-Nishihata M, ‘Cyclones in Cyberspace: Information Shaping and Denial in the 2008 Russia–Georgia War’ (2012) 43 (1) Security Dialogue 3–24.
11. Deibert R, The Geopolitics of Cyberspace after Snowden (2015) 114 (768) Current History 9-15.
12. Dutton W H ve Peltu M, ‘The Emerging Internet Governance Mosaic: Connecting the Pieces’ (2017) 12 Information Polity 63–81.
13. Duygulu Ş, Dönüşen Savaşların Değişen Araçları (SETA, 2019).
14. Ebert H ve Maurer T ‘Contested Cyberspace and Rising Powers’ (2013) 34 (6) Third World Quarterly 1054–1074.
15. Farwell J P ve Rohozinski R, ‘Stuxnet and the Future of Cyber War’ (2011) 53 (1) Survival 23-40, DOI: 10.1080/00396338.2011.555586
16. Feick J ve Werle R, ‘Regulation of Cyberspace’ icinde Robert Baldwin, Martin Cave, ve Martin Lodge (der.), The Oxford Handbook of Regulation (Oxford University Press, 2010) 523-547.
17. Ferrara E, Disinformation and Social Bot Operations in the Run Up to the 2017 French Presidential Election (2017) 22 (8) First Monday, https://doi.org/10.5210/fm.v22i8.8005
18. Finnemore M ve Hollis D B, ‘Constructing Norms for Global Cybersecurity’ (2016) 110 (3) The American Journal of International Law 425- 479.
19. Finnemore M ve Sikkink K, ‘International Norm Dynamics and Political Change’ (1998) 52 (4) International Organization 894-905.
20. Finnemore M ve Toope S J, ‘Alternatives to “Legalization”: Richer Views of Law and Politics’ (2001) 55 (3) International Organization 743-758.
21. Flonk D, ‘Content Control Contestations: Russia and China as Entrepreneurs of Illiberal Internet Norms’ (2019) Paper for the Authoritarian Politics and International Relations Workshop in Berlin, January.
22. G20, ‘Leaders' Communiqué Antalya Summit’ (2015) November 15-16  http://www.g20.utoronto.ca/2015/151116-communique.html > Erişim Tarihi 8 Ocak 2020
23. G7, ‘Principles and Actions on Cyber’ (2016)  https://www.mofa.go.jp/files/000160279.pdf > Erişim Tarihi 8 Ocak 2020
24. Geneva Internet Platform (GIP) Digital Watch, ‘UN GGE and OEWG’ (2019)  https://dig.watch/processes/un-gge > Erişim Tarihi 3 Ocak 2020 Gibson W, Neuromancer (Ace Science Fiction Books, 1984).
25. Grigsby A, ‘The End of Cyber Norms’ 2017 59 (6) Survival 109-122, DOI: 10.1080/00396338.2017.1399730
26. Henderson C, ‘The United Nations and the Regulation of Cybersecurity’, ‘çinde Nicholas Tsagourias ve Russell Buchan, (der.), International Law and Cyberspace. Research Handbooks in International Law, (Edward Elgar, 2015) 474-475.
27. Herzog S, ‘Revisiting the Estonian Cyber Attacks: Digital Threats and Multinational Responses’ (2011) 4 (2) Journal of Strategic Security 49-60.
28. Howard P N ve Kollany B, ‘Bots, #StrongerIn, and #Brexit: Computational Propaganda during the UK-EU Referendum’ (2016) ArXiv, abs/1606.06356,  https://arxiv.org/abs/1606.06356>
29. Inkster N, ‘Information Warfare and the US Presidential Election’ (2016) 58 (5) Survival 23-32, DOI: 10.1080/00396338.2016.1231527
30. Jenkins R, ‘Is Stuxnet Physical? Does It Matter?’ (2013) 12 (1) Journal of Military Ethics 68-79, DOI: 10.1080/15027570.2013.782640
31. Joint Statement on Advancing Responsible State Behavior in Cyberspace, (2019) 23 Eylül 2,  https://nz.usembassy.gov/joint-statement-on-advancing-responsible-state-behavior-in-cyberspace/ > Erişim Tarihi 5 Ocak 2020
32. Korzak E, ‘The Quest for Cyber Norms’ (2016) 72 (5) Bulletin of the Atomic Scientists 348-350 DOI: 10.1080/00963402.2016.1216683
33. Lindsay J R, ‘Stuxnet and the Limits of Cyber Warfare’ (2013) 22 (3) Security Studies 365-404, DOI: 10.1080/09636412.2013.816122
34. Maurer T, ‘A Dose of Realism: The Contestation and Politics of Cyber Norms’ (2019) Hague Journal on the Rule of Law 1-23.
35. Maurer T, ‘Cyber Norm Emergence at the United Nations, – An Analysis of the UN‘s Activities Regarding Cyber-security’ (2011) Belfer Center Discussion Paper #2011-11,  https://www.belfercenter.org/sites/default/files/files/publication/maurer-cyber-norm-dp-2011-11-final.pdf >
36. McCombie S, Uhlmann A J ve Morrison S, ‘The US 2016 Presidential Election & Russia’s Troll Farms’ (2020) 35 (1) Intelligence and National Security 95-114, DOI: 10.1080/02684527.2019.1673940
37. Mueller M L, Networks and States: The Global Politics of Internet Governance (MIT Press, 2010).
38. NATO, ‘Warsaw Summit Communiqué: Issued by the Head of States and Governments participating in the meeting of the North Atlantic Council in Warsaw on 8-9 July 2016,  https://www.nato.int/cps/en/natohq/official_texts_133169.htm?selectedLocale=en > Erişim Tarihi 5 Ocak 2020.
39. Nocetti J, ‘Contest and Conquest: Russia and Global Internet Governance’ (2015) 91 International Affairs 111-130, doi:10.1111/1468-2346.12189
40. Nye J S, ‘The Regime Complex for Managing Global Cyber Activities’ (2014). Global Commission on Internet Governance Paper Series  https://www.cigionline.org/publications/regime-complex-managing-global-cyber-activities > Erişim Tarihi 3 Kasım 2019
41. OSCE Decision No. 1202, ‘OSCE Confidence-Building Measures to Reduce the Risks of Conflict Stemming from the use of Information and Communication Technologies’ (2016)  https://www.osce.org/pc/227281?download=true > Erişim Tarihi 8 Ocak 2020.
42. Paris Call for Trust and Security in Cyberspace (2018) 12 November  https://www.diplomatie. gouv.fr/IMG/pdf/paris_call_text_-_en_cle06f918.pdf > Erişim Tarihi 9 Ocak 2020
43. Risse T, Ropp S C ve Sikkink K(der.) The Power of Human Rights: International Norms and Domestic Change (Cambridge University Press, 1999).
44. Russian Federation, ‘Information Security Doctrine of the Russian Federation’ (2000)  https://www.itu.int/en/ITU-D/Cybersecurity/Documents/National_Strategies_Repository/Russia_2000.pdf > Erişim Tarihi 20 Kasım 2019.
45. Safshekan O, ‘Iran and the Global Politics of Internet Governance’ (2017) 2 (2) Journal of Cyber Policy 266-284 DOI: 10.1080/23738871.2017.1360375
46. Sander B, ‘Democracy under the Influence: Paradigms of State Responsibility for Cyber Influence Operations on Elections’ (2019) 18 (1) Chinese Journal of International Law 1–56.
47. Schmitt M N, Tallinn Manual on the International Law Applicable to Cyber Warfare. (Cambridge University Press, 2013).
48. Shanghai Cooperation Organization, ‘Agreement on Cooperation in the Field of International Information Security’ (2009) 16 Haziran  https://ccdcoe-admin.aku.co/wp-content/uploads/2018/11/SCO-090616-IISAgreement.pdf > Erişim Tarihi 15 Ocak 2020.
49. Sullivan J E ve Kamensky D. ‘How Cyber-Attacks in Ukraine Show the Vulnerability of the U.S. Power Grid’ (2017) 30 (3) The Electricity Journal 30-35, https://doi.org/10.1016/j.tej.2017.02.006.
50. Sunstein C R, ‘Social Norms and Social Roles’ (1996) 96 (4) Columbia Law Review 903-968.
51. The Global Commission on the Stability of Cyberspace, ‘Advancing Cyberstability Final Report’ (2019) Kasım  https://cyberstability.org/report/#6-norms > Erişim Tarihi 10 Ocak 2020.
52. The Global Commission on the Stability of Cyberspace, ‘Norm Package Singapore’, (2018) Kasım  https://cyberstability.org/wp-content/uploads/2018/11/GCSC- Singapore-Norm-Package-3MB.pdf > Erişim Tarihi 5 Ocak 2020
53. Tikk-Ringas E, ‘Developments in the Field of Information and Telecommunication in the Context of International Security: Work of the UN First Committee 1998-2012’ ( ICT4Peace Publishing, 2012)  https://ict4peace.org/wp-content/uploads/2012/08/Eneken-GGE-2012-Brief.pdf > Erişim Tarihi 3 Ocak 2020
54. Türkay, S ‘Siber Savaş Hukuku ve Uygulanma Sorunsalı’ (2013) 71 (1) Journal of Istanbul University Law Faculty 1177-1227.
55. U. N. General Assembly Report of the Secretary-General 60/202 - Group of Governmental Experts on Developments in the Field of Information and Telecommunications in the Context of International Security, (5 August 2005), A/60/202,  https://undocs.org/en/A/60/202>
56. U.N. General Assembly First Committee 13th meeting Sixtieth session (17 October 2005), A/C.1/60/PV.13
57. U.N. General Assembly Letter dated 12 September 2011 from the Permanent Representatives of China, the Russian Federation, Tajikistan and Uzbekistan to the United Nations addressed to the Secretary-General, A/66/359,  https://digitallibrary.un.org/record/710973>
58. U.N. General Assembly Letter dated 9 January 2015 from the Permanent Representatives of China, Kazakhstan, Kyrgyzstan, the Russian Federation, Tajikistan and Uzbekistan to the United Nations addressed to the Secretary-General, U.N. Doc. A/69/273,  http://www.un.org/Docs/journal/asp/ws.asp?m=A/69/723 >
59. U.N. General Assembly Note by the Secretary-General 65/201, Group of Governmental Experts on Developments in the Field of Information and Telecommunications in the Context of International Security, (30 July 2010), A/65/201  https://www.unidir.org/files/medias/pdfs/information-security-2010-doc-2-a-65-201-eng-0-582.pdf >
60. U.N. General Assembly Report of the First Committee, Developments in the Field Of Information and Telecommunications in The Context Of International Security, (13 November 2013), A/68/406  https://undocs.org/A/68/406 >
61. U.N. General Assembly Report of the Secretary-General, Developments in the Field of Information and Telecommunications in the Context of International Security (10 August 1999), A/54/213  https://undocs.org/A/54/213>
62. U.N. General Assembly Resolution 53/70-Developments in the Field of Information and Telecommunications in the Context of International Security, (4 January 1999), A/RES/53/70  https://undocs.org/A/RES/53/70 >
63. U.N. General Assembly Resolution 56/19, Developments in the Field of Information and Telecommunications in the Context of International Security, A/RES/56/19,  https://undocs.org/A/RES/56/19 >
64. U.N. General Assembly Resolution 58/32, Developments In The Field Of Information And Telecommunications In The Context Of International Security, (8 December 2003), A/RES/58/32,  https://undocs.org/A/RES/58/32 >
65. U.N. General Assembly Resolution 60/45 “Developments in the Field of Information and Telecommunications in the Context of International Security” [on the report of the First Committee (A/60/452)], (8 December 2005), A/RES/60/45,  https://undocs.org/A/RES/60/45 >
66. U.N. General Assembly Resolution 66/24 (2 December 2011), A/RES/66/24  https://documents-dds-ny.un.org/doc/UNDOC/GEN/N11/460/26/PDF/N1146026.pdf?OpenElement >
67. U.N. General Assembly Resolution 68/243 [On the Report of the First Committee (A/68/406)], (27 December 2013) , A/RES/68/243 ,  https://undocs.org/A/RES/68/243 >
68. U.N. General Assembly Resolution 70/237 [on the report of the First Committee (A/70/455)] 30 December 2015, A/RES/70/237
69. U.N. General Assembly Resolution 73/266 [on the report of the First Committee (A/73/505)] Advancing responsible State Behavior in Cyberspace in the Context of International Security, (2 January 2019), A/RES/73/266,  https://undocs.org/A/RES/73/266 >
70. U.N. General Assembly Resolution 73/27. [on the Report of the First Committee (A/73/505)] Developments in the Field of Information And Telecommunications In The Context Of International Security, (11 December 2018), A/RES/73/27 ,  https://undocs.org/A/RES/73/27 >
71. U.N. General Assembly Revised Draft Resolution, Russian Federation, A/C.1/53/L.17/Rev.1, 2 Kasım 1998,  https://digitallibrary.un.org/record/263069 >
72. U.N. Group of Governmental Experts on Developments in the Field of Information and Telecommunications in the Context of International Security, (24 June 2013), A/68/98,  https://www.unidir.org/files/medias/pdfs/developments-in-the-field-of-information-and-telecommunications-in-the-context-of-international-security-2012-2013-a-68-98-eng-0-518.pdf >
73. U.N. Group of Governmental Experts on Developments in the Field of Information and Telecommunications in the Context of International Security, (22 July 2015), A/70/174,  https://undocs.org/A/70/174 >
74. U.N. Institute for Disarmament Research, Report of the International Security Cyber Issues Workshop Series (2016)  https://unidir.org/files/publications/pdfs/report-of-the-international-security-cyber-issues-workshop-series-en-656.pdf > Erişim Tarihi 3 Ocak 2020
75. U.N. Office for Disarmament Affairs, Fact Sheet: Developments in the Field of Information and Telecommunications in the Context of International Security (2015)  https://unoda-web.s3-accelerate.amazonaws.com/wp-content/uploads/2015/07/Information-Security-Fact-Sheet-July2015.pdf >
76. U.N. Open-Ended Working Group (2019)  https://www.un.org/disarmament/open-ended-working-group/ > Erisim Tarihi 4 Ocak 2020
77. United Kingdom National Security Strategy 2016-2021  https://www.gov.uk/government/publications/national-cyber-security-strategy-2016-to-2021 >
78. United Kingdom Parliament Digital, Culture, Media and Sport Committee, Disinformation and ‘Fake News’: Final Report, Eighth Report of Session 2017–19, HC 1791, (House of Commons, 2019)  https://publications.parliament.uk/pa/cm201719/cmselect/cmcumeds/1791/1791.pdf >
79. United States Government, US Army Joint Publication JP 3-12 Cyberspace Operations, (CreateSpace Independent Publishing Platform, June 2018)  https://www.jcs.mil/Portals/36/Documents/Doctrine/pubs/jp3_12.pdf >
80. United States International Strategy for Cyberspace (2011)  https://obamawhitehouse.archives.gov/sites/default/files/rss_viewer/international_strategy_for_cyberspace.pdf > United States National Security Council, Cyberspace Policy Review: Securing America's Digital Future, (Cosimo Incorporated, 2010).
81. United States National Security Presidential Directive 54/Homeland Security Presidential Directive 23 (NSPD-54/HSPD-23),2008,  https://fas.org/irp/offdocs/nspd/nspd-54.pdf >
82. Unwala A ve Ghori S, ‘Brandishing the Cybered Bear: Information War and the Russia-Ukraine Conflict’ (2015) 1 (1) Military Cyber Affairs DOI: http://dx.doi.org/10.5038/2378-0789.1.1.1001
83. Uren T, Hogeveen, B ve Hanson F, ‘Defining Offensive Cyber Capabilities’ (2018) Australian Strategic Policy Institute,  https://www.aspi.org.au/report/defining-offensive-cyber-capabilities > Erişim Tarihi: 17 Subat 2020
84. Wiener A ve Puetter U, ‘The Quality of Norms is What Actors Make of It’ (2009) 5 (1) Journal of International Law and International Relations 1‐16.
85. Yayla M, ‘Hukuki Bir Terim Olarak —Siber Savaş’ (2013) 104 TBB Dergisi 177-202.