International Cyber Norms in The Cyber and Information

International Cyber Norms in The Cyber and Information Security

Strategies of The Russian Federation and The Netherlands

Written by: Benno Elderkamp

Student number: 1227386

Supervised by: Prof. dr. B. Van den Berg // Liisi Adamson

Second Reader: Prof. dr. A.L.Dimitrova

Leiden University

Faculty of Governance and Global Affairs

Msc Crisis and Security Management

2

Index Introduction .......................................................................................................................................... 4

Research Question ............................................................................................................................ 6

Sub-Questions ................................................................................................................................... 6

Academic and Societal Relevance .................................................................................................... 6

Reading Guide .................................................................................................................................. 8

Theoretical Framework ......................................................................................................................... 9

(Cyber) Norms .................................................................................................................................. 9

Cyberspace, Cyber-Security, Information Security, Cyber-Attack, and Cyber Conflict ................. 11

Securitization .................................................................................................................................. 12

Methodology ....................................................................................................................................... 15

Research Design ............................................................................................................................. 15

Case Selection ................................................................................................................................. 15

Research Method ............................................................................................................................ 16

Limitations ...................................................................................................................................... 17

Data Collection and Analysis .............................................................................................................. 18

Documents Used ............................................................................................................................. 18

Operationalization ........................................................................................................................... 19

Validity and Reliability ................................................................................................................... 21

United Nations Group of Governmental Experts and Cyber Norms ................................................... 22

Norm Emergence ............................................................................................................................ 22

Norm Cascade ................................................................................................................................. 26

International Law and Human Rights ......................................................................................... 26

Infrastructure ............................................................................................................................... 27

Prevention, Deterrence, Attribution. ........................................................................................... 30

Norm Internalization ....................................................................................................................... 32

The Russian Federation and Cyber Norms .......................................................................................... 34

International law and Human Rights ............................................................................................... 34

3

Infrastructure................................................................................................................................... 37

Prevention, Deterrence, and Attribution .......................................................................................... 38

The Netherlands and Cyber Norms ..................................................................................................... 41

International Law and Human Rights ............................................................................................. 41

Infrastructure................................................................................................................................... 44

Prevention, Deterrence, and Attribution. ......................................................................................... 45

Comparison ......................................................................................................................................... 48

International Law and Human Rights ............................................................................................. 48

Infrastructure................................................................................................................................... 50

Prevention, Deterrence, and Attribution .......................................................................................... 51

Future of the UNGGE ..................................................................................................................... 53

Cyber Securitization ........................................................................................................................... 56

Securitizing Actors ......................................................................................................................... 56

Referent Objects ............................................................................................................................. 57

Existential Threat ............................................................................................................................ 59

Functional Actors ............................................................................................................................ 59

Speech Act ...................................................................................................................................... 61

Conclusion .......................................................................................................................................... 63

Cited Sources ...................................................................................................................................... 65

4

Introduction The world has experienced a rising number of cyber-attacks. A particular watershed moment

in cyber-attacks were the 2007 cyber-attacks against Estonia (Tamkin, 2017). It was the first

instance a state allegedly used state-sanctioned cyber-attacks to advance its own foreign policy

objectives. A second important cyber-attack was the 2010 Stuxnet malware attack against

Iranian nuclear power plants (Finkle, 2013). Both attacks showed many states that they were

unprepared to deal with such attacks. These attacks were an unforeseen phenomenon in the

world. Many states scrambled to establish their own cyber-security strategies in order to deal

with these issues stemming from cyberspace. States recognized that the insecurities derived

from cyberspace would have to be dealt with through collaboration on an international level.

These collaborative efforts continue to be undermined by several inherent issues.

One of these issues is a lack of a global mechanism to address cyber-attacks and

cybercrime, limiting the ability of states to attribute and assign appropriate punishment. This

issue is further problematised by a lack of universally accepted definitions and understandings

on many cyberspace related terms (Radunovic, 2017). Each individual public and private actor

tends to use a different set of terms and approach in dealing with the insecurities in cyberspace.

A lack of common language is a fundamental issue as it problematizes any collaborative effort

on cooperation and negotiations (Radunovic, 2017). In recent years, these collaborative and

cooperative efforts have come together within the United Nations Group of Governmental

Experts in the Field of Information and Telecommunications in the Context of International

Security (UNGGE).

The meetings within the UNGGE were initially promising. Although the initial

meetings did not deliver any significant progress, a landmark report was issued in 2013

(A/68/98, 2013). The report constructed a set of norms and concluded that international law

was applicable to cyberspace. Both norms and international law were deemed necessary for a

secure “open, secure, peaceful and accessible ICT environment” (A/68/98, 2013, p. 2). The

2015 report emphasised and expanded the progress made in the 2013 report. However, with

the 2016-2017 UNGGE, a roadblock was hit.

The purpose of the 2016-2017 meetings was to provide recommendations on how

international law would apply in cyberspace. The group of governmental experts failed to reach

a consensus and talks collapsed as a fundamental divide had arisen (Markoff, 2017). The divide

was between the United-States and like-minded states which include the Netherlands, and the

Russian Federation and their respective allies. The Russian Federation and its allies disagreed

5

on the application of international law to an online conflict. The like-minded states sought ways

for international law to be used during or as a means to respond to an online conflict (Grigsby,

2017). The Russian Federation and its allies argued for the creation of a new set of laws to

prevent a conflict which they felt should not occur at all (MODRF, 2011; A/69/723, 2015).

A second divide was on the meaning and nature of cyber conflict and cyberspace. The

different approach dictates the way each side views the construction of the problem and the

solution. Whereas the Netherlands speaks of cyberspace, the Russian Federation approaches it

as information space. Cyberspace by the Netherlands is “understood to cover all entities that

are or may potentially be connected digitally” (MODNL, 2012, p. 4). Information space is

defined by the Russian Federation as the “formation, creation, transformation, transmission,

use, and storage” of information which affects amongst other things “the individual and social

consciousness, information infrastructure and the information” itself (MODRF, 2011, p. 5).

These two different ideological approaches led to the collapse of talks at the 2017 UNGGE.

The future of the UNGGE remains uncertain, as no new meeting has been planned for the

future.

Nonetheless, the Russian Federation remains fixed on its primary objective to promote

a new set of international laws; presented as codes of conduct. These laws are to prevent states

from developing cyber weapons as a means to interfere in the internal affairs of states

(A/66/359, 2011; A/69/723, 2015). In contrast, the Netherlands continues to argue that such

laws already exist. The Netherlands firmly believes in approaching international matters

consistently and in line with its previous obligations (MFAICSNL, 2017). Meaning, the

Netherlands is reluctant to deviate from already established rules and regulations and wishes

establish the cyber norms in adherence of said framework. This reluctance to deviate is part of

the like-minded camps concern for the protection of human rights online and offline. They are

concerned about the growing number of states who violate these rights and seek to offset this

through the UNGGE (MFAICSNL, 2017). Despite these differences, both camps share a

common interest in seeking to improve the stability in cyberspace and to eliminate the

incentives which motivate states to take risk.

This thesis will look at how the cyber (information) security strategies of both states

have evolved between 2007 and 2017. These evolving strategies will be analysed to determine

whether they can explain their divergent ideological approaches towards the cyber norms

debate. The theory of securitization will be used to determine to what extent both states have

securitized their cyber (information) security strategies. The theory will further be used as a

6

means to determine the potential for reconciliation between both ideologies and the future of

the international cyber norms debate.

Research Question The purpose of the thesis is to answer the following main research question and sub-questions:

Research question: How have the cyber security strategies of the Netherlands and Russia

developed between 2007 and 2017, and to what extent can the development of their cyber

security strategies explain their (different) ideological approaches towards the cyber norms

debate?

Sub-Questions (1) What are (cyber) norms?

(2) What does the concept of securitization entail?

(3) How has the discussion on cyber norms evolved within the UNGGE working group?

(4) How is the development of international cyber norms framed within Russia’s approach

to cyber security?

(5) How is the development of international cyber norms framed within the Netherlands

approach to cyber security?

(6) What do these developments have in common, and to what extent do they differ?

(7) Is cyberspace securitized?

Academic and Societal Relevance The research has both academic and societal relevance. The academic relevance lies in the

research effort to examine a current development within the world and add to a growing body

of research. Research which debates whether cyberspace and cyber-security have been

securitized, and if so, to what extent. The research will investigate the motivations behind the

two dominant perspectives on cyberspace. These perspectives will be framed within the

UNGGE debate on cyber norms. Together, the research would add to the growing body of

academic literature which seeks to apply traditional theories like realism, deterrence, attribution

and onto the field of cyber-security. These theories are applied to test their applicability and

suitability, and as a means to gain understanding in an otherwise complex issue.

7

The societal relevance of the study would be to gain understanding in the Russian

Federations approach into its information security strategies. The Russian Federations position

is interesting as it is one of the major actors within cyberspace whose position is contradictory.

They have been noted to seek limits on states behaviour with respect to cyber-attacks to prevent

cyber conflicts. At the same time, the Russian Federation has repeatedly been accused of

conducting the same type of cyber-attacks it wishes to prevent. The 10-year (2007-2017)

approach could shine light into this duality of thinking.

The Netherlands plays a significant role within the cyber community. The Netherlands

is one of the most digitalised states in the world. Nonetheless, it has yet to experience a cyber-

attack on the same level as Estonia, Germany, the United Kingdom, and the United States. This

despite the Netherlands containing the largest internet exchange point in the Amsterdam

Internet Exchange (AMS-IX). In 2018, the ABN AMRO, ING, and Rabobank were hit by a

DDos attack which lasted for several hours before being resolved (Zwienen, 2018). In 2016 it

came to light that the Dutch-German company Rheinmetall Defence had been hacked since

2012, leading to a loss of information. It serves as one of the rare occasions that an act of digital

espionage could potentially be attributed to a specific Chinese hacker group; although this is

unconfirmed (Modderkolk, 2018). However, the arguably most impactful and known cyber-

attack was the 2011 attack on DigiNotar. The Iranian secret service allegedly used the

vulnerabilities in the digital certification of DigiNotar to spy on Iranian citizens, although some

suspect US involvement (Hijink, 2013). However, these cyber-attacks do not compare to those

experienced by other states; placing the Netherlands in a rather unique position.

With its relatively small size, the Netherlands is forced to rely on diplomacy and has

historically emphasised a firm belief in international law. Examining the Dutch approach could

provide valuable, more nuanced information. Similar results would not be present when

examining the United States (US), whose foreign policy does not rely entirely on its soft-power

capabilities. As one of the largest actors in cyberspace, its relation and approach to the UNGGE

norms debate would be influenced by its relationship with the Russian Federation and China.

This would effectively resort to a great power struggle; whereby objective comparison would

be clouded by the history of both states. Lessons learned from the Netherlands could be applied

to states who are within a similar “disadvantaged” position, either side of the ideological debate.

By contrasting and comparing Russia and the Netherlands, lessons can be learned from

both perspectives. The research could discover areas within which there is potential for

conciliation and convergence on cyber norms. Finally, the research may discover the path

forward for the establishment of international cyber norms.

8

Reading Guide

The path of the research shall be as followed. The focus and relevance of the thesis are

explained in the introduction. Following the introduction, the theoretical framework within

which the study will operate is discussed in chapter two. The thesis will discuss the

methodology in chapter three. The development and analysis of the UNGGE cyber norms

debate in chapter four. In chapter five the study will provide an analysis of the Russian

development of cyber norms and do the same for the Netherlands in chapter six. The results of

all two previous chapters will be analysed to compare and contrast the similarities and

differences in chapter seven. Chapter eight will analyse and determine to what extent cyber has

been securitized. Finally, chapter nine will conclude the thesis, followed by the cited sources.

9

Theoretical Framework A brief examination of the academic literature highlights the lack of commonly accepted

definitions for any cyber or information security related term. This is in part due to the inability

of states to agree on the meaning and means on how to solve many issues in cyberspace. This

chapter will elaborate on the theoretical framework which serves as the foundation of the

research. The first section will explore the concept of (cyber) norms and answer the sub-

question: “What are (cyber) norms?”. The second section will define cyber-space, cyber

conflict, cyber-attack, cyber-security, and information security. These definitions are important

for the continuation and influence the analysis within the thesis. The third section will explore

the theory of securitization and answer the sub-question: “What does the concept of and move

to securitization entail?”.

(Cyber) Norms

Finnemore and Sikkink (1998) define norms as “a standard of appropriate behavior for actors

with a given identity” (Finnemore & Sikkink, 1998, p. 891). Norms in this sense are approached

form a constructivist perspective, whereas a sociologist speaks of institutions when referring

to the same behavioural rules. March and Olsen (1998) define an institution as “a relatively

stable collection of practices and rules defining appropriate behavior for specific groups of

actors in specific situations” (March & Olsen, 1998, p. 948). A difference between norms and

institutions is that norms isolate single standards of behaviours. Institutions on the other hands

focus on a collection of rules and practices and how these are structured together and

interrelated (Finnemore & Sikkink, 1998) . The danger herein is that norms are often discussed

as if they are institutions. Sovereignty, for example, is often discussed as if it is a singular entity,

whereas, in reality, it is a collection of norms whose rules and practices changes over time

(Finnemore & Sikkink, 1998). Cyber norms in this context are thus standards of appropriate

behaviour for actors with a given identity in cyberspace. Cyber-security or information security,

on the other hand, are not singular entities. They are a collection of norms in the form of

practices and rules which change over time and attract new meaning as the norms evolve.

Norms are commonly categorised as either constitutive or regulative norms.

Constitutive norms “create new actors, interests, or categories of action (roles)” and regulative

norms “order and constrain behavior” (Finnemore & Sikkink, 1998, p. 891). Constitutive

norms create or define an activity. Regulative norms establish a set of duties or permissions

(Finnemore & Sikkink, 1998). Mazanec (2015) further distinguishes within the regulative

10

norms between constraining and permissive regulative norms. Constraining norms limit the

behaviour of states, whereas permissive norms suggest that certain behaviour is acceptable and

expected (Mazanec, 2015).

Finnemore and Sikkink go on to suggest a model of the life cycle of norms. The life

cycle suggests when and which norms are likely to reach a tipping point to be accepted. The

life cycle consists of three stages: norm emergence, norm cascade, and norm internalization. In

the first stage, norms entrepreneurs arise who are convinced something has to change

(Finnemore & Sikkink, 1998). These norm entrepreneurs use existing organizations and norms

to ensure the norms are adopted. When a norm has been adopted, it moves on to the second

stage: norm cascade. In the second stage states adopt new norms either in response to

international pressure, to enhance their domestic legitimacy, out of conformity, or for the sake

of their self-esteem (Finnemore & Sikkink, 1998). In the third stage, the norms become

internalized and professionals press for their codification. Over time, these norms are

internalized to an extent that they seize to be seen as norms.

The likelihood of norms reaching the tipping point in the third stage depends on the

timing. The timing is determined by legitimation, prominence, intrinsic qualities, adjacency

claims or path dependence, and world time context. States may adopt certain norms for the

sake of legitimacy or international status (Finnemore & Sikkink, 1998). When their domestic

legitimacy and power wavers, norms are adopted to perpetuate a state’s own ideology. Norms

are also more likely to be adopted when they are held by prominent and powerful states, or

when their intrinsic qualities make adopting said norms more likely. Norms that seek to end

human suffering or promote equality tend to be valued more and are more appealing to many

other states (Finnemore & Sikkink, 1998). Furthermore, norms are more likely to be adopted

when they resemble existing norms or can be derived from it. Norms also tend to arise as a

result of world events like as economic shocks or wars. Such events tend to lead to the search

of new norms and ideas to prevent a reoccurrence of said events (Finnemore & Sikkink, 1998).

Within cyberspace, norms primarily seek “to improve the stability of cyberspace and

remove the incentives inherent to cyberspace that encourage risk taking” (Grigsby, 2017, p.

111). Constraining these incentives should improve the stability of cyberspace and decrease

the risk of a cyber-attack or conflict (Grigsby, 2017).

11

Cyberspace, Cyber-Security, Information Security, Cyber-Attack, and Cyber Conflict In order to discuss the UNGGE norms and the security strategies of the Russian Federation and

the Netherlands, it is important to clarify what is meant by the concepts which are to be used

in this research. These concepts are cyberspace, cyber-security, information security, cyber-

attack, and cyber conflict. This clarification is particularly necessary considering the lack of

generally accepted definitions on any of these concepts.

There are many different approaches to defining cyberspace. However, for the purpose

of the research Kuehl’s (2009) definition of cyberspace will be used. Kuehl definiens

cyberspace as: “a global domain within the information environment whose distinctive and

unique character is framed by the use of electronics and the electromagnetic spectrum to create,

store, modify, exchange, and exploit information via interdependent and interconnected

networks using information-communication technologies” (Kuehl, 2009, p. 28).

Cyber-security, as defined by the Netherlands, is “the state of being free of danger or

damage caused by a disruption or failure of IT or through the abuse of IT. The danger or

damage caused by abuse, disruption or failure may comprise a limitation of the availability and

reliability of the IT, violation of the confidentiality of information stored in IT environments

or damage to the integrity of that information” (NCTV, 2017, p. 59).

Information security as defined by the Russian Federation is “the state of protection of

the individual, society and the State against internal and external information threats, allowing

to ensure the constitutional human and civil rights and freedoms, the decent quality and

standard of living for citizens, the sovereignty, the territorial integrity and sustainable socio-

economic development of the Russian Federation, as well as defence and security of the State”

(MFARFIS, 2016, p. 3).

Both definitions are heavily influenced by their specific interpretation and construction

of threats. These definitions lack a more generalized and objective approach which provides a

clearer distinction between the two definitions. A subjective approach would also influence the

meaning of a cyber-attack and cyber-conflict. Thus, for the purpose of this thesis cyber-security

will be defined as the protection or defence of ICTs in cyberspace, and the protection of those

who function in cyberspace and their assets. These include non-information-based and

vulnerable assets to threats using ICTs (Von Solms & Van Niekerk, 2013).

Information security is defined as the protection of information (data) itself. This

includes information beyond ICTs; meaning both online and offline information and

information which is stored or transmitted not using ICTs (Von Solms & Van Niekerk, 2013).

12

The Netherlands defines a cyber-attack as “a series of actions targeted at information systems,

where the availability, integrity or confidentiality of the information is affected” (NCTV, 2017,

p. 28). The Russian Federation defines a cyber-attack as “an offensive use of a cyber weapon

intended to harm a designated target” (Godwin et al., 2014, p. 44). Both definitions are not

satisfactory in their very specific construction of the target and construction of the “tool” with

which the attack is to be committed. Thus, for the purpose of this thesis a cyber-attack will be

defined as an action or actions within cyberspace targeted at ICTs or those who function within

it, where the availability or integrity of ICTs or ICT dependent systems and information is

damaged or disrupted.

Cyber conflict of this thesis is defined as “a tense situation between and/or among

nation-states and/or organized groups where unwelcome cyber-attacks result in retaliation”

(Godwin et al., 2014, p. 44).

Securitization The potential for retaliation or cyber conflict depends to a degree, whether or cyberspace has

been securitized. This section will conceptualize the Copenhagen Schools theory of

securitization. This conceptualization will be used as a guide the research and used to answer

the sub-questions, including: “Is cyberspace securitized?”.

The Copenhagen Schools securitization theory emphasises the danger of framing a

societal issue as a security issue. As a security issue, extraordinary measures are allowed to be

taken to resolve the issue. The securitizing actor transforms the issue into an existential threat

(Buzan, Wæver, & Wilde, 1998). This is not because an actual objective threat exits but rather

because the actor presents the issue as such. The threat does not have to be real but can be

imaged as well. The weight of a threat depends thus on the perspective of the actor who

perceives the threat. However, for extraordinary measures to be taken, the threat must be

threatening enough (Buzan et al., 1998).

A successful securitization process has several requirements. The first requirement is

to have a securitizing actor; the actor who securitises an issue by declaring it is existentially

threatened. The second requirement is to have a referent object; that which is seen as being

existentially threatened and needs to be protected (Buzan et al., 1998). A third requirement is

an existential threat; that which threatens the referent object. A fourth requirement is functional

actors. Functional actors are “actors who affect the dynamics of a sector, without being the

13

referent object or the actor calling for security on behalf of the referent object, this is an actor

who significantly influences decisions in the field of security” (Buzan et al., 1998, p. 36).

Beyond the securitizing actor, referent object, existential threat, and functional actors

the theory requires an audience to be successful. An audience who accepts the securitizing

actors move to securitize an issue in order for extraordinary measures to be taken (Buzan et al.,

1998). The securitizing actor needs to convince the audience via a speech act that normal rules

are insufficient and need to be changed. If the audience is unconvinced, the securitization

attempt has failed (Buzan et al., 1998).

The success of the speech act is dependent on two conditions: internal and external

conditions. The internal conditions are the linguistic-grammatical construction of the referent

object; meaning the speech act must refer to an existential threat, a point of no return, a solution,

and follow the dialects that are part of the sector (Buzan et al., 1998). An example of such a

dialect is sovereignty for politics. The speech act has a high chance of succeeding when above-

mentioned conditions are met. The external conditions refer to the securitizing actors social

and contextual standing. The securitizing actor needs to be in a position of authority in relation

to its audience. It is also easier for the securitizing actor to construct a security threat if it is

generally perceived to be threatening; such as guns or a tornado (Buzan et al., 1998).

However, Huysmans (2004) argues that this securitization process tends to narrow

democratic elements within a society in order to fight what is perceived as a threat. The law is

replaced with norms which have the same force of the law but not the same form. As a result,

these norms gradually undermine the separation of judicial, legislative, and executive powers

(Huysmans, 2004).

Bigo (2002) argues that through such measures governments have managed to gain

control over the political process by utilizing networks of surveillance and data mining (Bigo,

2002). This is because securitization relies on a set of normative assumptions and not objective

or empirical facts (Buzan & Hansen, 2009).

Trombetta (2008) argues against the negative assumptions made by the Copenhagen

School and as described by Huysmans and Bigo. Trombetta especially argues against the

proposed ‘logic of security’ which suggest the term security evokes and justifies a set of

extraordinary practices (Trombetta, 2008). The logic of security is that of war which follows

a zero-sum understanding of security. The logic of security could supposedly lead to the

depoliticization and marginalization of otherwise serious issues (Trombetta, 2008).

In discussing environmental security, Trombetta argues that the logic of security instead

is more flexible and not as rigid as the Copenhagen School argues. The securitization of

14

environmental issues has reframed the logic of security and the practices with it. As an

antagonistic approach to these environmental threats was not the best way to deal with such

issues (Trombetta, 2008). Preventive measures proved to be more effective. Within

environmental security, the appeal to security has “emphasized the relevance of preventive,

nonconfrontational measures and the importance of other actors than states in providing

security” (Trombetta, 2008, p. 600). Thus, securitization does not have to lead to the adoption

of extraordinary measures. It can also lead to cooperation. In respect to cyber norms, the

securitization of cyberspace thus does not have to lead to states adopting extraordinary

measures. It can lead to the diffusion of an issue and to cooperation.

15

Methodology

Research Design The main focus of this thesis is to examine how the cyber and information security strategies

of the Russian Federation and the Netherlands have developed, and to what extent this can

explain the different ideological approaches toward the UNGGE cyber norms debate. In order

to achieve this purpose, the study will follow a qualitative multiple case study design. The

multiple case study design is chosen as it allows for a more in-depth look at how both cyber

and information security strategies have been constructed over time, and how this has

influenced the international debate on cyber norms. The assumption herein being that their

ideological position towards the cyber norms debate should align with their cyber and

information security strategies.

Case Selection

The Russian Federation and the Netherlands were both chosen as representatives of the two

different ideological sides in the norms debate. The Russian Federation representing the

information security side, and the Netherlands the cyber-security side.

The Russian Federation is a global power in cyberspace and plays a significant role in

the UNGGE discussions. The Russian Federation has also on numerous occasions been accused

of carrying the type of cyber-attacks the UNGGE seeks to limit. The Russian Federation was

chosen instead of the China which tends to focus its efforts in Asia. China has furthermore (so

far) not actively used cyber-attacks as a means to further its foreign policy objectives. The

Russian Federation was also chosen for the sake of convenience and availability of documents

that could be used for this thesis. The Russian Federation simply had more sources available

in English than China.

The Netherlands was chosen over the United States as its position on cyberspace is well

documented within the academic literature and media. A comparison between the United States

and the Russian Federation would result in a battle of great powers and revolve around the

extremes of both ideological positions. The Netherlands allows for a more nuanced comparison

as it does not possess the hard-power of the United States. The Netherlands is forced to rely on

soft-power measures such as diplomacy to further its foreign policy objectives. Latvia, Estonia,

Lithuania, Belarus, Ukraine, and the rest of the East-European states all have a certain bias

against the Russian Federation as their major adversary. Their security strategies would be

influenced by their contentious history.

16

The decision to look at only two states is the result of time constraints. The scope of the

research would become too broad. There are also only two sides to the debate, which would

have meant two more states would have to be added to keep the balance. As stated, the Russian

Federation remains one of the few states of which there enough data available and in English.

A discourse analysis requires a small data set to analyse. Comparing over ten documents of

approximately fifteen UNGGE members would be impossible to do considering the time frame

of the research (+/- 8 weeks).

Research Method The research will use critical discourse analysis to analyse the security strategies of the Russian

Federation and the Netherlands. Discourse analysis allows for the study in the ways language

is used in texts and contexts. It considers the social and historical context which is important

for the study of cyber norms and the ideological positions of states. Through a longitudinal

approach, it becomes possible to see how the norms have changed over time and how the

position of states has changed with respect to the issue. Discourse analysis looks at the overall

strategy and impact of words. It looks at what is written, what is implied, and what is or is

unsaid in a text. As a result, discourse analysis only allows for a small number of text to be

examined. An advantage of discourse analysis is that it is context specific and relevant at any

given moment. It can reveal hidden motives and interpret them if necessary. Meaning in

cyberspace and cyber norms are never fixed and require a certain level of interpretation to be

understood.

To guide the discourse analysis, the study will use Buzan, Waever, and de Wilde’s

(1998) securitization theory. The theory focuses on the framing of speech acts and as such fits

the purpose of this study. The theory can help establish emerging patterns, their presentation,

and evolution of cyber norms by identifying the relevant actors and determine to what extent

the cyber norms and cyber and information security strategies are framed as an existential threat.

The study will primarily use both primary and secondary sources. Primary sources will be in

the form of the Russian Federation and the Netherlands (cyber and information) security

strategies and policies. Secondary sources will be the academic literature. The primary sources

are used as they can provide a historical account of the cyber and information security strategies.

The secondary sources will help to ground the information extracted from the primary sources

into reality and contextualise them.

17

Limitations Discourse analysis does not provide absolute answers. The meaning of a text is never fixed and

open to interpretation and negotiation. This can be problematic when discussing the definitions

of cyber related terms, whose meaning tends to change over time and perspective. However,

as it is the purpose of this study to analyse these changes, discourse analysis remains the most

suitable.

A limitation of using the theory of securitization is that it frames the issue in a certain

way. It is possible that certain frames or angles are missed due to this narrowing process. The

documents which will be analysed are governmental and thus contain a certain type of language.

It is unlikely that the entire truth will be revealed in said documents. Yet, they can still serve

as a good indicator as to the direction both states think in. A final limitation is that the study is

forced to rely on translations when analysing the Russian Federations information security

strategies.

The research also has to take into consideration the fact that there is no consensus on

the definition of any cyber related terms. The security strategies of both the Netherlands and

the Russian Federation tend to use various definitions inconsistently. Thus, although the

researched provides working definitions in the theoretical framework, this reality has to be

taken into account.

18

Data Collection and Analysis The research will focus on the cyber and information security strategies between 2007 and

2017. This 10-year time period is chosen as in 2007 Estonia was the subject of a cyber-attack.

It was the first time a state used cyberspace to advance its own foreign policy objectives. The

attack and rising amount of cyber-attacks subsequently initiated the wider policy discussion on

cyber-security and the necessity of developing norms to govern it (Tamkin, 2017). 2017 was

chosen as this was the year where the negotiations within the UNGGE came to a halt, and the

pursuit towards cyber norms was ceased until further notice.

Documents Used United Nations Group of Governmental Experts

1. Resolution Adopted by the General Assembly A/RES/53/70: Developments in the field

of information and telecommunications in the context of international security (1998)

2. Resolution Adopted by the General Assembly on 8 December 2003 A/RES/58/32

Developments in the field of information and telecommunications in the context of

international security (2003)

3. Report of the Group of Governmental Experts on Developments in the Field of

Information and Telecommunications in the Context of International Security (2010)





6. Report of the International Security Cyber Issues Workshop Series (2016)

Russian Federation

1. Russia’s National Security Strategy to 2020 (2009)

2. Military Doctrine of the Russian Federation (2010)

3. Conceptual Views Regarding the Activities of the Armed Forces of the Russian

Federation in the Information space (2011)

4. Basic Principles for State Policy of the Russian Federation in the Field of International

Information Security to 2020 (2013)

5. Military Doctrine of the Russian Federation (2014)

6. Russian National Security Strategy (2015)

19

7. Doctrine of Information Security of the Russian Federation (2016)

8. Foreign Policy Concept of the Russian Federation (2016)

9. Letter dated 12 September 2011 from the Permanent Representatives of China, the

Russian Federation, Tajikistan and Uzbekistan to the United Nations addressed to the

Secretary-Genera (2011)

10. Letter dated 9 January 2015 from the Permanent Representatives of China, Kazakhstan,

Kyrgyzstan, the Russian Federation, Tajikistan and Uzbekistan to the United Nations

addressed to the Secretary-General (2015)

The Netherlands

1. The National Cyber Security Strategy (NCSS) (2011)

2. The Defence Cyber Strategy (2012).

3. International Security Strategy: A secure Netherlands in a Secure World (2013)

4. Netherlands Defence Doctrine (2013).

5. The National Cyber Security Strategy 2 (NCSS) (2013).

6. International Cyber Strategy – Building Digital Bridges – Towards an Integrated

International Cyber Policy (2017).

7. Wereldwijd voor een veiling Nederland – Geïntegreerde Buitenland-en-

Veiligheidsstrategie 2018-2022 (2017).

8. Developments in the field of information and telecommunications in the context of

international security A/66/152 Report of the Secretary-General (2011).


international security A/68/156/Add.1 (2013).


international security- Resolution 69/28 (2015).


international security- Resolution 71/28 (2017).

Operationalization

The following concepts are operationalized as a means to guide the research into indicators

along which the discourse analysis can be codified and the data be analysed.

20

Theory Concept Definition Indicators Securitization (Buzan, Waever, and Wilde, 1998).

Securitization The process in which a security actor frames a societal issue as an existential threatened by declaring a referent object – which justifies the usage of extraordinary measures to resolve the issue. Buzan, Waever, and Wilde identify several conditions Referent objects Securitizing actors Functional actors Speech act

Securitizing actors The actors who securitize an issue by declaring an it being existentially threatened Existential threat The object that is potentially harmful The referent objects Issues that are seen to be existentially threatened and have a claim to survival. Functional actors Actors who are not the referent or securitizing actors, but who significantly influences decisions in the security field. Speech act/Audience The target audience that must be convinced by the securing actors construction of the referent objects perceived threat.

Norms (Finnemore and Sikkink, 1998)

Norms A standard of appropriate behaviour Finnemore and Sikkink differentiate between two different type of norms: Constitutive and Regulative

• Constraining regulative (Mazanec, 2015)

• Permissive regulative (Mazanec, 2015)

Constitutive norms Constitutive norms create new actors, interests, or categories of actions. Regulative Norms Regulative norms order or constrain behaviour and can influence a states behaviour. (1) Constraining regulative norms

Indicate that certain behaviour is not acceptable. (2) Permissive regulative norms Indicates that certain behaviour is acceptable.

Model of the life cycle of norms (Finnemore and Sikkink, 1998)

Life cycle of norms

Suggests when and which norms are likely to reach a tipping point to be accepted. The life cycle has three stages: Norm emergence Norm cascade Norm internalization

Norm emergence Norm entrepreneurs arise that are convinced something much change. Norm cascade States adopt new norms in response to international pressure, conformity, esteem, and to enhance their domestic legitimacy. Norm internalization Norms become internalized as professionals press for the codification and adherence to these norms.

21

Validity and Reliability As the study follows a case study design, it has a limited external validity. The results cannot

necessarily be generalized onto other contexts. A similar study applied to two different states

on both ends of the ideological spectrum should provide similar results. However, there will

naturally be case specific differences.

Although a multiple case study of all UNGGE involved nations would have improved

the reliability, time constraints prevent the possibility. The scope of the research would be too

wide for a master thesis and difficult to control. The vast difference in the available

documentation would make any comparison unbalanced. The fact that the documents used are

institutional documents, which influences the language used in each document. This will

influence the reliability of the data and has to be taken into consideration. This can be resolved

through the use of discourse analysis, where context matters.

By using the theory of securitization through discourse analysis, specific boundaries

are set up which improve the reliability and validity of the research. However, in the case of

the Russian Federation, the language barrier has to be noted, which influences the language

used.

22

United Nations Group of Governmental Experts and Cyber Norms The UNGGE is one of the most important venues for discussing issues on cyberspace and

international security. Reports issued by the UNGGE are important in their ability to shape the

global agenda on cyber-security. Each report adds to the growing progress of creating an

international agreement on responsible state behaviour in cyberspace (Lewis & Vignard, 2016).

The purpose of this chapter is to discuss and discuss the sub-question: “How has the discussion

on cyber norms evolved within the UNGGE working group?”. The chapter has been divided

into three sections: norm emergence, to determine how the UNGGE came into being; norm

cascade, where the norms will be categorised and discussed; and norm internalization, to

discuss the breakdown of the UNGGE and its future. A future which is determined by the norm

entrepreneurs in the first stage of the life cycle of norms.

Norm Emergence

In the first stage of the life cycle of norms, norm emergence, norm entrepreneurs arise who are

convinced something must change (Finnemore & Sikkink, 1998). There are many different

actors within the UNGGE who could be considered norm entrepreneurs. Designating these

norm entrepreneurs is problematized due to the inherent nature of cyberspace. Cyberspace is

an all-encompassing entity which touches upon all aspects of society. This results in an

inexhaustible number of different actors who compete for different threat perceptions (Hansen

& Nissenbaum, 2009). Securitization theory assumes the opposite. Although the theory does

account for multiple actors, the initiation of the process is done, arguably, by a single

securitizing actor (Buzan et al., 1998). The securitizing actor declares an issue as existentially

threatened and by doing so, allows for extraordinary measures to be used to resolve the issue

(Buzan et al., 1998). In contrast, the life cycle of norms suggests that norm entrepreneurs will

respond to the same issue by creating new norms.

What the model and theory have in common is that they both see the state as the most

important actor (Buzan et al., 1998; Finnemore & Sikkink, 1998). Although non-state actors

can be norm entrepreneurs, only states can adopt and press for the internalization of norms.

Similarly, only states can effectively securitize an issue and use extraordinary measures

through the logic of security (Buzan et al., 1998). In the context of the UNGGE, state actors

also serve as the most important actor, even if only non-state actors are not allowed to

participate. However, the cyber norms debate does not only exist within the boundaries of the

23

UNGGE and has been influenced by both state and non-state actors. Each who on their own

called for the creation of an international agreement on cyber norms.

A particular notable non-state effort was the Tallinn Manual 1.0 and 2.0 (M. N. Schmitt,

2013). With the support of the NATO Cooperative Cyber Defence Centre of Excellence

(CCDCOE) the manuals focused on the legal obligations of states in cyberspace (Schmitt, 2013,

2017) . In essence, the 1.0 Manual focused on interpreting how norms apply the conduct of

states in cyberspace. The 2.0 Manual significantly expanded the scope of the first manual,

expanding to include state responsibility, peacetime international law, sovereignty, attribution,

and human rights law (Schmitt, 2017). Much of the work done by the Tallinn manual is

reflected within the UNGGE norm construction. Non-state actors can be considered norm

entrepreneurs and functional actors, as each successive action, to some extent, shaped and

informed the UNGGE reports. Nonetheless, the relationship between state and non-state actors

is, in terms of power and resources, marked by a balance that is clearly in favour of states

(Bannelier & Christakis, 2017).

One of the first state actors to declare the necessity for change at the UN was the

Russian Federation in 1998 (A/RES/53/70, 1998). In resolution 53/70, Russia warns of the

potential misuse of information technologies by criminals and terrorists. The resolution further

suggests something must be done and calls for the development of international principles

(A/RES/53/70, 1998). In doing so, the Russian Federation fulfils the requirement to be

classified as a norm entrepreneur and potentially a securitizing actor. Criminals and terrorists

are both functional actors, in serving as existential threats. Yet, despite this, the resolution fails

to suggest a point of no return or a concrete solution and fails the international conditions of

the speech act. The Russian Federation is in a position of authority as a permanent member of

the UN Security Council. However, there are still issues concerning the audience it has to

convince.

The UN General Assembly should in this instance be the audience, be convinced by the

Russian Federations construction of the threat and solution. However, the resolution was

adopted without a vote first by the First Committee of Disarmament and International Security

and subsequently by the UN General Assembly. Meaning, in both instances there technically

was no audience to convince (A/RES/53/70, 1998). If there was an audience, it would have to

be the members of the First Committee Bureau (Belgium, Kazakhstan, Chile, Belarus, and

Egypt) who made the decision to accept the resolution (UNGAFC, 1998). However, this would

be a stretch as none of the official UN documents indicate any form of discussion on the subject

had taken place (A/RES/53/70, 1998). As such, the Russian Federations 1998 resolution can at

24

best be considered a securitization attempt by a norm entrepreneur, but one that did not meet

all of the required criteria to be successful. Since the 1998 resolution, the issue has become part

of the UN and evolved through multiple resolutions which were equally all adopted without a

vote.

The 2003 58/32 resolution notes an existential threat and functional actors in the

potential misuse of information technologies for criminal and terrorist purposes. The referent

object has evolved from the 1998 resolution and adds beyond international security and

stability the integrity of infrastructure of states, the security of states in the civil and military

field (A/RES/58/32, 2003). It also called for the creation of the UNGGE but did not call for the

creation of cyber norms. This was done in the UNGGEs 2010 report ( A/65/201, 2010).

The 2010 report reaffirmed the existential threat as the malicious use of tools and

technologies by criminals and terrorists. It created a new existential threat in expressing

concern about the potential usage of ICTs by states as instruments for warfare, intelligence, or

political purposes ( A/65/201, 2010). As a result of these concerns, the 2010 report calls onto

states to cooperate in developing a shared understanding on the use and prevention of these

malicious tools. International cooperation and the creation of cyber norms were emphasised as

being the way to reduce and prevent any misconceptions between states and threats to

international peace and security ( A/65/201, 2010). The 2010 report further recognises the role

the private sector and civil society as functional actors in reducing these threats. However, the

dominant role within the cyber norms debate remained assigned to the states themselves

( A/65/201, 2010).

Naming the 2010 report a successful securitization effort, would suggest an end to the

process and lead to the use of extraordinary measures, which clearly has not been the case. It

would also assume that each new state that joined the UNGGE agreed with the construction of

the referent objects and existential threats by the 2010 UNGGE member states and does not

take into account the somewhat arbitrary selection of the UNGGE members.

Members of the UNGGE were selected based on regional and political position and the

level of interest shown by the state to ensure an equitable geographical distribution. Members

of the UN Security Council (UNSC) were added automatically as part of the UN regulations

(Lewis & Vignard, 2016). It is difficult thus determine the direct level of interest of

participating member had shown prior to joining the UNGGE. Table 1 shows that with each

successive round, the interest in the UNGGE and creation of cyber norms has grown (Lewis &

Vignard, 2016).

25

Table 1 Participating Members UNGGE 2004-2005 2009-2010 2012-2013 2014-2015 2016-2017 Belarus Brazil China France Germany India Jordan Malaysia Mali Mexico Republic of Korea Russian Federation South-Africa United Kingdom United States of America

Belarus Brazil China Estonia France Germany India Israel Italy Qatar Republic of Korea Russian Federation United Kingdom United States of America

Argentina Australia Belarus Canada China Egypt Estonia France Germany India Indonesia Japan Russian Federation United Kingdom United States of America

Belarus Brazil China Colombia Egypt Estonia France Germany Ghana Israel Japan Kenya Malaysia Mexico Pakistan Republic of Korea Russian Federation Spain United Kingdom United States of America

Australia Botswana Brazil Canada China Cuba Egypt Estonia Finland France Germany India Japan Kazakhstan Kenya Mexico Netherlands Republic of Korea Russian Federation Senegal Serbia Switzerland United Kingdom United States of America

Source: (Lewis & Vignard, 2016).

It is important to note that due to the UNGGE rules, the Russian Federation as a permanent

member of the UNSC was part of the discussion since the first UNGGE in 2004. In contrast,

the Netherlands had to lobby or wait for its position in the 2016-2017 UNGGE and as such has

arguably been less influential in the debate. However, non-participating states were still able

to submit their official response to the UN General Assembly and vote on the final report and

continuation of each successive UNGGE (Lewis & Vignard, 2016). Within this context, the

non-participating members can be called functional actors in their ability to influence the

decisions made in the security field. They can only tentatively be named norm entrepreneurs

as their willingness to submit official responses indicated an interest and belief that something

must change. However, as their official responses were reactive instead of proactive, it cannot

be said they fully embrace the proactive qualities required of a norm entrepreneur. However,

naming the permanent members as norm entrepreneurs is equally problematic considering the

selection process. What can be said is that irrespective of the existence of securitizing actors

and norm entrepreneurs, the UNGGE discussion moved on from the norm emergence stage,

and onto the second, norm cascade stage. The potential lack of these actors and entrepreneurs

does question whether the norms in the 2013 and 2015 reports can be classified as norms to

begin with.

26

Norm Cascade This may be difficult considering the way both reports discuss the norms. The 2013 report

speaks of “recommendations on norms, rules, and principles of responsible behaviour by states”

(A/68/98, 2013, p. 8). The 2015 report changes this by only speaking “norms, rules, and

principles for the behaviour of States” (A/70/174, p. 7). The paragraphs do not make clear

which are norms, which are rules, and which are principles. However, accepting Finnemore

and Sikkings definition of (cyber) norms, norms are a set of rules and practices which govern

the behaviour of states (Finnemore & Sikkink, 1998). The differentiation between norms, rules,

and principles is minimal. As Shannon (2000) argues, “the more parameters norm possesses,

and the more ambiguous those parameters are, the easier it is for actors to interpret them

favourably” (Shannon, 2000, p. 293). This is beneficial to the UNGGE considering that both

the UNGGE governmental experts and the UN General Assembly have to reach a consensus

to release the final report (Lewis & Vignard, 2016).

A result of this consensus making is that the norms in the 2013 and 2015 reports cover

similar themes from which they do not deviate extensively. The norms can be categorized into

three themes: international law and human rights; infrastructure; and prevention, deterrence,

and attribution (A/68/98, 2013; A/70/174 2015). The themes represent the overarching points

of discussion within the UNGGE and the ideological division between the Russian Federation

and the Netherlands. In essence, international law and human rights determine the prevention,

deterrence, and attribution measures a state can undertake to protect their construction of its

infrastructure. The three themes are thus interrelated and affect the way states approach each

issue and the UNGGE debate overall. The three themes will thus be used in the rest of the thesis

as a means to better structure the research.

International Law and Human Rights

The 2013 UNGGE report was hailed as a landmark report as it concluded that international was

applicable to the use of ICTs by states in the ICT-environment (A/68/98, 2013). However, the

report fails to explain how or to what extent international law is applicable, or what it meant

by ICT-environment. Following Kuehl’s (2009) definition of cyberspace, ICTs are used as a

means to operate and connect with cyberspace. The use of ICT-environment instead may be a

more concrete and specific way for the UNGGE to focus on the use of ICTs by states, instead

of the more abstract nature of cyberspace. Nonetheless, it is still part of cyberspace and will be

27

referred to as such in order to avoid adding unnecessary confusion to the already ambiguous

UNGGE reports.

In their use of ICTs, States must observe, among other principles of international law, State sovereignty, sovereign

equality, the settlement of disputes by peaceful means and non-intervention in the internal affairs of other States.

Existing obligations under international law are applicable to State use of ICTs. States must comply with their

obligations under international law to respect and protect human rights and fundamental freedoms; (A/70/174,

2015, p. 12).

The 2015 UNGGE report adds some clarification by explaining which principles of

international are applicable to the use of ICTs by states as mentioned above (A/70/174, 2015).

However, like the 2013 report, the 2015 report fails to explain how these principles apply to

the behaviour of states. It also fails to explain if and to what extent the respect to protecting

human rights and fundamental freedoms override a state’s rights of sovereignty, non-

intervention, and territorial integrity (A/70/174, 2015). Besides, as Von Heinegg (2015) argues,

there already is a general consensus that the laws, principles, rights, and freedoms as listed

above apply to the behaviour of states in cyberspace. The disagreement is not whether they

apply, but how they apply to cyberspace. As such they can therefore not really be considered

constitutive norms, as they do not extend a state power, create new interests or categories of

action. They are at best constraining regulative norms in that they limit the behaviour of states

instead of permitting certain behaviour through permissive regulative norms.

This lack of permissive regulative norms makes it difficult to argue what states are

allowed to do in cyberspace in relation to international law and the respect of human rights and

fundamental freedoms. This affects the way states approach prevention, deterrence, and

attribution measured by allowing states to interpret to an extent the manner in which they seek

to protect their infrastructure, which in itself has its definitional issues.

Infrastructure

The definitional issues concern the difference between the various ways the UNGGE addresses

the protection infrastructure. In general, the UNGGE reports norms speak of either critical

infrastructure or critical information infrastructure but fail to provide a definitional difference

between them. Lopez, Setola, and Wolthusen (2012) attempt to make a distinction between the

two definitions. They define critical infrastructure as those that are essential for the continued

availability and reliability of services. When these critical infrastructures are disrupted or

28

unavailable, they could cause severe economic damage or a loss of life (Lopez, Setola, &

Wolthusen, 2012). Critical information infrastructure is considered a critical infrastructure in

itself to stress the importance of the ICT sector. However, is also unique in that it provides the

interconnectedness and is a fundamental component to the operating of other critical

infrastructure. (Lopez et al., 2012). The problem with this definition is that the classification is

entirely dependent on the perspectives of states, who do not all agree what is or what is not part

of its critical infrastructure or critical information infrastructure (Mattioli & Levy-Bencheton,

2015).

The lack of explanation within the UNGGE reports is problematic as the report does

make an explicit difference between the two within the norms. The UNGGE norms mainly

address the critical infrastructure of states through permissive regulative norms and frame them

as referent objects. States are asked to protect their critical infrastructures; cooperate with states

whose critical infrastructures are “subject to malicious ICT acts”; and report responsibly on

ICT vulnerabilities as a means to reduce threats to ICT-dependent infrastructure (A/68/98,

2013; A/70/174, 2015, p. 8).

A State should not conduct or knowingly support ICT activity contrary to its obligations under international law

that intentionally damages critical infrastructure or otherwise impairs the use and operation of critical

infrastructure to provide services to the public (A/70/174, 2015, p. 8).

States are asked through a single constraining regulative norm not to damage or impair the use

of critical infrastructure which provide services to the public. The phrasing of the norm does

not make clear whether this indeed means the protection of critical infrastructure which

provides services, or to the ability of a state to provide services to the public. It also does not

explain what may be classified as critical infrastructure which provides services to the public,

as technically all infrastructure provides some services to the public. In its current state, it does

suggest that states are allowed to conduct and knowingly support ICT activity against critical

information infrastructure and is not to be considered a referent object.

The only information infrastructure referent object mentioned is the authorised

emergency response team’s information systems (A/70/174, 2015). This specification is still

problematized by the different criteria used by states in designating what are or what are not

authorised emergency response teams. The report also does not make clear to what extent a

difference will be made between public and private teams. According to the European Union

Agency for Network and Information Security (ENISA), the Russian Federation has 2

29

emergency response teams, whereas the Netherlands has 19 (ENISA, n.d.). The designation of

these teams is therefore somewhat arbitrary and explains how different perspectives by states

can result in different outcomes.

It does however not explain how both critical infrastructure and critical information

infrastructures fit within the framework of international law, human rights, and fundamental

freedoms. It makes it difficult to determine the boundaries of these referent objects. This

especially considering that the most significant threat to states is not damage or disruption of

their infrastructure, but rather cyber espionage or hacktivism.

These activities are largely perpetrated by non-state actors and do not have to damage

or impair the critical infrastructure or critical information infrastructure of a state (Bendovschi,

2015). Instead, states were more likely to be victims of a cyber-attack which granted

unauthorised access to information (Bendovschi, 2015). Espionage has an ambiguous position

in international law and is technically not forbidden by it; although the practice is frowned

upon by other states (Weissbrodt, 2013). States may want to avoid discussing cyber-espionage

in the UNGGE context. It would lead to an entirely separate discussion on the legality of

espionage and states rarely articulate their views on the relationship between espionage

(intelligence activities) and international law (Deeks, 2017). This is because states tend to

refrain from limiting their own flexibility in protecting themselves through means that are not

unlawful (Deeks, 2017).

However, discussing cyber-espionage would arguably fall within the mandate of the

UNGGE. Its mandate as established in resolution 58/32 is to “consider existing and potential

threats in the sphere of information security and possible cooperative measures to address them”

( A/RES/58/32, 2003, p. 2). Cyber-espionage is an existing threat within the sphere of

information security but does not necessarily threaten to damage or disrupt the infrastructure

of states. This argument is however entirely dependent on how the UNGGE defines existing

threats; something which it has not done in any of its reports.

Yet, there is no doubt that the UNGGE has securitized critical infrastructure and critical

information infrastructure. What that means however, is up to the interpretations of states. It

has arguably less to do with their physical structures, but more with their ability to provide

services. It could indicate that it would not matter if a specific infrastructure was damaged, as

long as its overall ability to provide services to the public was not inhibited. This ambiguity

can be problematic when discussing prevention, deterrence, and attribution measures which are

heavily dependent on what is or what is not deemed a referent object, and what is or is not an

existential threat.

30

Prevention, Deterrence, Attribution.

Most of the prevention, deterrence, and attribution measures presented within the norm revolve

around the notion that cooperation and the exchange of information can reduce the threats from

cyberspace (A/68/98, 2013; A/70/174 2015). However, much like the other norms, the norms

on prevention, deterrence, and attribution are limited and ambiguous.

States should cooperate in developing and applying measures to increase stability and security in the use of ICTs

and to prevent ICT practices that are acknowledged to be harmful or that may pose threats to international peace

and security (A/70/174, 2015, p. 7)

The norms on prevention, deterrence, and attribution are mainly framed as permissive

regulative norms and promote cooperation and the exchange of information (A/68/98, 2013;

A/70/174 2015). States are asked to not knowing let their territories be used for international

wrongful acts (A/70/174, 2015). The report fails to mention what international wrongful acts

are or how states are supposed to prevent these acts. In many cases, cyber-attacks are only

discovered as they occur, and others are only discovered after they have run for several months

or even years (Guitton, 2017). An example of this is Stuxnet. Researchers at Symantec believe

that the computer was developed as early as 2005 and deployed in 2007. However, the attack

was only discovered years later in 2010 (Finkle, 2013). As such, it is difficult for states to take

appropriate measures to prevent and protect their infrastructure from these threats.

Yet, states are still asked within the UNGGE norms to take reasonable measures to

ensure the integrity of the ICT supply chain, prevent the proliferation of malicious ICT tools,

techniques, and the use of harmful hidden functions (A/70/174, 2015). Abelson et al (2015)

argue that instead of leading to more security, such preventative measures would lead to less

security (Abelson et al., 2015). It would limit the number of available tools and mean that the

malicious actors would concentrate their efforts on only a small number of targets. Furthermore,

despite these measures, there will always be many different alternatives available for state and

non-state actors to acquire their tools and will not deter them in their activities (Abelson et al.,

2015).

Although the measure has a deterrence quality, the UNGGE norms do not address

issues concerning deterrence directly and they are mainly grouped together with preventative

measures (A/70/174, 2015). The issue is that the constraining regulative norms only limit

behaviour and seek to prevent it, but do not actively seek to deter it as well. This is rather

problematic considering that deterrence can play a significant role in regulating the behaviour

31

of states in cyberspace. Nye (2016) argues that the effectiveness of deterrence measures in

cyberspace depend on who and what measure is taken. They would rely on evoking

humanitarian law and call upon the taboo of using cyber-attacks against civilians (Nye, 2016).

As such, these deterrence norms may only be effective against major states and less so against

non-state actors and has to deal with issues of attribution (Nye, 2016).

The UNGGE does not directly discuss attribution or what measures states through

responsibility are supposed to undertake. The norms only mention that states should consider

the relevant information in terms of the larger context of the incident, the challenges of

attribution, and the extent of the consequences of attributing an incident (A/70/174, 2015). As

it stands, states can be held accountable failure to exercise under the principle of due-diligence

(Kulesza, 2009). States are expected to undertake reasonable measures, yet the UNGGE reports

does not explain responsibility to such an extent and neglect to mention it for the most part.

This despite the fact that responsibility is one of the major aspects of the cyber norms debate,

especially considering the legal definitions of aggression, use of force, and cyber-attacks

(Kulesza, 2009). Without a proper mechanism to determine state responsibility, states could

potentially unilaterally interpret the self-defence article (article 51 UN Charter) within

international law and end up in a cyber conflict (Kulesza, 2009; United Nations, 2015).

A further significant issue is however that most of these measures are focused on state-

actors instead of non-state actors. This despite the fact that non-state actors demand much more

attention than state actors and represent the actual dominant threat (Schmitt & Watts, 2016).

However, the state-centric approach of international law in inadequate the address the

challenge made by non-state actors in cyberspace. The added principles associated with

sovereignty and non-intervention further limit the states legally in dealing with or using cyber

operations against non-state actors (Schmitt & Watts, 2016). It makes sense that non-state

actors are not included within the UNGGE cyber norms debate.

Nonetheless, in their current form, the norms premature and require multiple iterations

before they potentially could be considered sufficient enough. In their current frame, the norms

feel more like placeholders; topics which are important and which will be discussed at a later

date. As such, it cannot be said that the norm cascade stage has been successful and is thus

unable to move onto the norm internalization stage.

32

Norm Internalization The unsuccessful move came in part as a result of the 2016-2017 UNGGE. The discussion at

the 2016-2017 UNGGE had, amongst others, moved towards discussing how international law

applied to states in cyberspace. At the centre of the discussion were the international

humanitarian law (IHL), right to self-defence, and state responsibility (Markoff, 2017). The

final report was supposed to address and clarify the application of these issues and move away

from the ambiguity of the previous reports. However, certain states were no longer willing to

apply these international law, rules, and principles onto cyberspace. They believed that they

should be free to act in cyberspace to achieve their political ends without limits or constraints

(Markoff, 2017; Rodrigues, 2017).

The same group of states believed that certain parts of international law were

incompatible with the objective of the UNGGE to seek the peaceful settlement and prevention

of conflicts. This fear was particularly aimed at the inclusion of IHL, state responsibility, and

the right to war (jus ad bellum) (Markoff, 2017; Rodrigues, 2017). It was thought that states

could potentially use international law to justify punitive actions such as sanctions or military

actions in cyberspace. States could do so by claiming to be victims of a malicious cyber-attack

and under the justification of self-defence retaliate (Mačák, 2017; Markoff, 2017; Rodrigues,

2017).

This frame of logic follows the securitization theories logic of security in a rather

conflicting way. In essence, they are securitizing against what they believe is a successfully

securitization process of other states. They believe other states will use extraordinary measures

to resolve their issues. The UNGGE reports naturally do not reflect this sentiment, although its

ambiguous does leave a lot much room for interpretation.

Dependent on this interpretation, it may appear that there is indeed a way in which

states are able to justify their “punitive” response. This is especially true concerning the norms

on prevention, deterrence, and attribution (A/70/174, 2015). The lack of clarity on these norms

may allow states to respond in certain ways which could be deemed to go against the

international law, rules, and principles in cyberspace. States are only asked to take into account

several considerations, but no limit is placed in their response or how this relates to issues of

responsibility.

The logic of security in the argument suggests states could securitize any cyber-attack

and use this frame to justify extraordinary measures. However, the 2013 and 2015 reports do

not discuss the issue of self-defense or the right to war (jus ad bellum) (A/68/98, 2013;

33

A/70/174 2015). The possibility for securitization through this framework is therefore only

possible due to the ambiguities as present in the reports. Instead, the reports securitized for the

most part states critical infrastructure and critical information infrastructures as referent objects

and criminals and terrorists, and extremists as existential threats. States in this instance were

framed as both referent objects and existential threats.

How these ambiguities in framing are understood, depends greatly on the interpretation

of the states that encounter them. The following chapters will delve into the security strategies

of the Russian Federation and the Netherlands, to determine their position towards these

contentious issues by using the three main themes as derived from the 2013 and 2015 reports,

namely: international law and human rights; infrastructure; and prevention, deterrence, and

attribution. The lack of clarity on these issues within the UNGGE invites states such as the

Russian Federation and the Netherlands to take different interpreting positions and lead to

unnecessary complex situations which are difficult to resolve and ensure the application of

international law in cyberspace.

34

The Russian Federation and Cyber Norms The Russian Federations information security development has, much like the UNGGE cyber

norms debate, been shaped by its complex relationship with international law. This approach

will have a significant influence in the way they interpret and approach the cyber norms as

presented in the 2013 and 2015 reports. Therefore, the purpose of this chapter is to answer the

sub-question “How is the development of international cyber norms framed within the Russian

Federations approach to information security?”. The approach of the Russian Federation within

is security strategies is often difficult to parse due to its often ambiguous and contradictory

nature.

International law and Human Rights

The starting position of the Russian Federation towards the UNGGE is that the existing rights,

principles, and obligations as derived from international law are insufficient to protect them in

cyberspace. They believe that current laws are unable to prevent potential malicious actors

from damaging or disruption its information infrastructure (A/66/359, 2011; A/69/723, 2015).

In contrast, the Russian Federation also argues that adherence to international law is in the

national interest and part of its national security objectives (MFARFFP, 2016; SCRF, 2013).

The solution to this contrasting position is for the Russian Federation the creation of a separate

international information security system (IISS) (MFARFIS, 2016; MODRF, 2011).

The overarching purpose of the IISS would be to counter the potential malicious use of

ICTs for activities which run contrary to existing international law, rights, principles, and

obligations (MFARFIS, 2016; MODRF, 2011). To realise this, the Russian Federation seeks

to create new laws or amend existing ones, until they are tailored to the specific interest of the

Russian Federation.

To contribute to the development of regional systems and establishment of a global information security system

based around universally recognized principles and standards of international law (respect for state sovereignty,

non-interference into internal affairs of other states, refraining from the threat or use of force in international

relations, right of individual and collective self-defence, respect for human rights and fundamental freedoms)

(SCRF, 2013, p. 6)

The interest of Russia is to have the IISS exist within the sphere of the UN and be linked to

“generally accepted principles of international law” such as sovereignty, territorial integrity,

and non-intervention (SCRF, 2013). However, beyond this, little is explained about its actual

35

construction and functioning. Nonetheless, some assumptions about its functioning can be

made based on the recommendations of the members of the Shanghai Cooperation (A/66/359,

2011; A/69/723, 2015).

In their 2011 and 2015 letters to the UN General Assembly, the Russian Federation,

amongst others, provided a codes of conduct to the UNGGE debate to provide an alternative

perspective against the UNGGE norms (A/66/359, 2011; A/69/723, 2015). However, despite

their presentation, these codes of conduct do not entirely qualify as norms along the line of the

UNGGE.

Like the UNGGE norms, a code of conduct are non-legal, in that the intent to adhere to

these norms or codes is derived from the context and environment they were created in (Bothe,

1980). The difference is that the UNGGE norms eventually have the potential to become legal

norms whereas the codes of conduct do not. The codes of conduct rely on a voluntary adherence

to the principles of sovereignty, non-intervention, territorial integrity, but do not include a legal

responsibility (A/66/359, 2011; A/69/723, 2015). The UNGGE reports do not discuss

responsibility or legal consequences either but do suggest that international law is applicable

in cyberspace (A/68/98, 2013). Thus, although the UNGGE norms currently do not qualify as

legal norms, it is mainly due to a lack of specification, clarification, and progress.

The purpose of the codes of conduct and the IISS combined is to establish a regime

with a voluntary adherence to universally recognized principles and standards of international

law but without any of its enforcement mechanisms (Von Heinegg, 2015). The issue is that the

UNGGE generally agrees on the inclusion of these principles (A/68/98, 2013; A/70/174 2015).

The difference being the development and interpretive position the Russian Federation has with

respect to these principles. These principles through the IISS are for the most part an effort by

the Russian Federation to extend its control over cyberspace (Von Heinegg, 2015).

This effort is problematized in respect to international law concerning human rights and

fundamental freedoms. The UNGGE takes a strict stance on protecting and ensuring these

rights and freedoms are universally applied in cyberspace (A/68/98, 2013; A/70/174 2015). In

contrast, the Russian state seeks to remain the guarantor of security and the rights of its citizens.

Meaning, the state should be responsible for the protection of these human rights and

effectively determine which rights and freedoms apply and which do not.

For the Russian Federation, the purpose of international law and the UNGGE cyber

norms should not be to limit or regulate the behaviour of states. Instead, the UNGGE norms

should focus on preventing the malicious use of ICTs by states and non-state actors altogether

(MODRF, 2011). The belief is that state and non-state actors could potentially use malicious

36

ICTs to damage or disrupt the Russian Federations information infrastructure for criminal,

terrorist, extremist, or separatist purposes (MOFRF, 2014; MFARFFP, 2016; SCRF, 2009,

2013). Sovereignty in this context is for the Russian Federation absolute. It awards each state

the right to manage its own cyberspace according to its domestic laws and regulations.

Sovereignty therefore also extends to give each state the right to control the flow of incoming

and outgoing information and as a result prevent the malicious use of ICTs (Krutskikh &

Streltsov, 2014).

Yet, despite being a fervent proponent of the sovereignty of states, the Russian

Federation fears said principle in relation to the use of self-defence. This in particular concerns

IHL and the use of force to include a cyber component (Krutskikh & Streltsov, 2014). The fear

is that the inclusion of a cyber component could lead to the legitimization of cyberconflicts

through the right of self-defence as described in article 51 of the UN Charter (UN Charter,

2015). The cyber-attack could be framed as the use of force and potentially lead to states using

extraordinary measures to defend themselves against the attack (Krutskikh & Streltsov, 2014).

An inherent issue in this logic for the Russian Federation is the possibility for wrongful

attribution (Krutskikh & Streltsov, 2014).

Although this may have been the case in the past, most cyber-attacks can and are

identified and attributed accurately (Jensen, 2012). The fear that a cyber-attack could justify a

cyber conflict also remains unsupported. Besides, not every cyber-attack which violates a

state’s sovereignty could convincingly be qualified as a use of force and trigger the self-defence

mechanisms (Von Heinegg, 2015). The UNGGE suggest that states are allowed to undertake

measures consistent with international law and the UN Charter, which would include Article

51. However, the right to self-defence in Article 51 is only permitted in cases of an armed

attack which cyber-attacks currently are not classified as (UN Charter, 2015). However, this

entirely depends on the definition cyber-attacks may obtain in the future. The lack of

clarification in the UNGGE reports can thus be dangerous if left open to the interpretation by

states.

The discussion on this issue during the 2016-2017 UNGGE did however not lead to a

consensus on the matter; indicating that the Russian Federation and its allies were unable to

convince the other participating members of their concerns (Lewis & Vignard, 2016). The push

for control by the Russian Federation is directly linked to the framing and interpretation of its

referent objects, the Russian information infrastructure, whose functioning is linked to its

sovereignty and survival.

37

Infrastructure Infrastructure in the Russian Federation is predominantly approached as information

infrastructure. Information infrastructure refers to the systems and means which use and store

information (SCRF, 2013). Unlike the UNGGE, the Russian Federation does not frequently

mention its critical information infrastructure and fails to explain the definitional difference

adequately. Instead, it focuses more on discussion its information infrastructure and critical

infrastructures separately, although they both fall under the Russian Federations national

security umbrella (MODRF, 2010, 2014). For Russia, the information infrastructure has to

remain a safe environment within which information can be circulated safely, is reliable, and

where damaging and disrupting impacts can be resisted. This resistance is framed as the

protection of human and civil rights, and to sustain the socio-economic development of the

Russian Federation (MFARFIS, 2016).

Enhancing the safe operation of information infrastructure objects, including with a view to ensuring stable

interaction between government bodies, preventing foreign control over these objects, and ensuring the integrity,

smooth operation and safety of the unified telecommunications network of the Russian Federation, as well as

ensuring the security of information transferred through this network and processed within information systems

in the territory of the Russian Federation (MFARFIF, 2016, p. 8)

The fear within the Russian Federation that its infrastructure is at a high risk to be damaged or

disrupted by state and non-state actors. The ultimate goal of protecting these systems is the

creation of a single unified system which is controlled by the state and supports the Russian

Federations national security objectives (SCRF, 2009). The threats from cyberspace are

directly linked to the survival of its information infrastructure. Damage or disruption to these

systems is seen as a violation of the Russian states sovereignty, non-intervention, and territorial

integrity (MODRF, 2010; A/69/723, 2015).

A problem is that the Russian Federation extends its information infrastructure to the

functioning of the organs of state power. Meaning, the Russian states ability to govern is linked

to the continuing of the information infrastructures (MODRF, 2010). Within such a framing, it

becomes difficult to see where the boundary of the Russian information infrastructure begins

and ends. It could encompass all infrastructure within the geographical borders, under the

notion that all critical infrastructure contains a component of information infrastructure (Lopez

et al., 2012). As such, it becomes another means for the Russian Federation to justify its total

38

control over the flow of information that passes through its information infrastructures

(Finnemore & Hollis, 2016; Von Heinegg, 2015).

In terms of human rights and fundamental freedoms, the Russian Federation would not

benefit from the application of international law onto cyberspace. Such a move would interfere

with its understanding of sovereignty in relation to the level of control it wishes to maintain

over its own cyberspace. Thus far, the Russian Federation has been relatively successful in

tightening its control over the flow of information in Russia (Freedom House - NET, 2017;

Freedom House - PRESS, 2017). The creation of the IISS is more of a condition which prevents

the violation of the Russian rights within cyberspace (SCRF, 2013). A separate system would

allow the Russian Federation to add its information infrastructure as a protected entity and

justify its level of control over it. Thus, the Russian Federation has clearly securitized its

information infrastructures as referent objects. Yet, instead of using extraordinary measures,

the Russian Federation instead supposedly seeks to promote its ideals on an international level

through the UNGGE (A/66/359, 2011; A/69/723, 2015). This approach to protecting the

information infrastructure and the information flow within, influences to a considerable degree

the prevention, deterrence, and attribution measures the Russian Federation is willing to

undertake.

Prevention, Deterrence, and Attribution

The objective of the Russian Federation is to prevent the malicious use of ICTs completely. A

significant part of this prevention effort is preventing the spread of information weapons and

the demilitarization of cyberspace (MODRF, 2011). Information weapon is defined only once

in 2011 as the means and methods used for the purpose of waging information war using

information technologies (MODRF, 2011). Information war is defined as:

…confrontation between two or more states in the information space for damaging the information systems,

processes and resources, which are of critical importance, and other structures, to undermining the political,

economic and social system, and massive brainwashing of the population for destabilizing the society and the

state, and also forcing the state to make decisions in the interests of the confronting party (MODRF, 2011, p. 5).

To prevent such an information war or conflict, the Russian Federation wants to create the IISS

as a legal regime for the non-proliferation and arms control of information weapons (SCRF,

2013). The existential threat is linked to the referent objects of international principles of

sovereignty, non-intervention, and territorial integrity and are thus also linked to efforts of

39

control. However, the above-mentioned application of a legal regime does indicate a rather

conflicting IISS if it is to pick and choose the instances where international law is applied.

Finnemore and Hollis (2016) argue that the proposed non-proliferation and arms

control measures have been met with little enthusiasm by other states (Finnemore & Hollis,

2016). Many of the states fear that these measures may not work and is largely dependent on

the definition used for malicious ICTs and information weapons. Furthermore, demilitarizing

cyberspace would be difficult in itself. All armed forces in the world use ICTs to a degree and

make use of both public and private infrastructures to do so (Gottwald, 2009; Von Heinegg,

2015). Even outside of a conflict, ICTs can be used for purposes which may go against the

interests of the Russian Federation. ICTs could facilitate political violence through collective

action and increase the mobilization of people. A particular example of this being the Arab

Spring. A revolution which was to a large extent facilitated by the use of social media and thus

information (Weidmann, 2015). However, ICTs could also be used by states to limit political

speech or for intelligence gathering efforts (Finnemore & Hollis, 2016; Weidmann, 2015). The

Russian Federation wants to protect and deter this possibility and believes it is allowed to take

all necessary measures to do so (MODRF, 2010).

Enhancing the protection of the critical information infrastructure and reliability of it’s functioning, developing

mechanisms of identification and prevention of information security threats and elimination of their effects, as

well as enhancing the protection of citizens and territories from the effects of emergencies caused by information

and technical impacts on the objects of critical information infrastructure (MFARFIS, 2016, p. 7).

These measures include the creation of information weapons and the involvement of the

Russian Armed forces as part of a strategic deterrence effort to prevent armed conflicts

(MODRF, 2010, 2011). No definition for strategic deterrence is provided, although it is

frequently discussed in relation to nuclear deterrence. The purpose of these deterrence

measures in cyberspace is to deter the use of ICTs for military or political aims which can

damage the sovereignty and territorial integrity of the Russian Federation (MFARFFP, 2016).

Following Nye (2016) categories of deterrence, the Russian Federation appears to rely on

entanglement measures. The purpose of the entanglement measures is to ensure that both sides

benefit from the status quo much like nuclear-deterrence (Nye, 2016).

The enforcement of these preventative measures can to some extent be linked to the

Russians deterrence measures. As part of the IISS, the Russian Federation advocates for the

creation of an international mechanism to continuously monitor cyberspace. The purpose of

40

the system would be to prevent the malicious use of ICTs in interfering in the internal affairs

of states and violate its sovereignty (SCRF, 2013). This system could in essence also be used

as a deterrence measure. States may be less likely to use information weapons or malicious

ICTs if their activities are continuously monitored. The implementation of this system may be

difficult. This measure of denial may be effective but does require states to have the resources

to do so (Nye, 2016). However, as Von Heinegg (2015) argues, not many states are capable of

monitoring their data traffic consistently and effectively. It would also require a state-centric

approach and a level of control over their ICT industry which only like the Russian Federation

have and are unlikely to be adopted by democratic states (Von Heinegg, 2015).Yet, this

monitoring system would follow the UNGGE norm recommendation that states should not

knowing allow their territory to be used for international wrongful acts (A/69/723, 2015). It

may be only way for states to be certain that their territory was not knowingly used. However,

according to the International Telecommunications Union (ITU), over 48% of the world’s

population uses the internet (ITUFAF, 2017). Effectively monitoring all this data traffic may

be impossible.

Nonetheless, the Russian Federation has securitized its information infrastructure and

contradictory advocated for both the use of extraordinary measures, but also for the non-

proliferation of these measures (SCRF, 2013). Through the framing of the referent objects and

the existential threats, it appears that the Russian Federation has not necessarily securitized its

information infrastructure, but rather the information it contains and its sovereign right to

control the access to said information within its territory. The development of its security

strategies is guided by this principle, which to a large extent is not compatible with the purpose

and objective of the UNGGE norms. The UNGGE reports recognise that (critical) information

infrastructures are referent objects and the jurisdiction states have over it (A/69/723, 2015).

However, this is in relation to human rights and fundamental freedoms which does not allow

the type of control the Russian Federation wants and advocates for through the UNGGE, and

which differs significantly from the approach of the Netherlands.

41

The Netherlands and Cyber Norms In contrast to the Russian Federations focus on control through sovereignty, the Dutch cyber-

security development has been shaped by its beliefs in the importance of cooperation, self-

regulation, and individual responsibility in a multi-stakeholder model (MODNL, 2012;

MOJNL, 2011; NCTV, 2013). These beliefs significantly influence the approach of the

Netherlands to cybersecurity and will be used to answer the sub-question: “How is the

development of international cyber norms framed within the Netherlands approach to cyber-

security?”.

International Law and Human Rights The Netherlands approach to cyber-security is framed as one which has a strong connection

and belief in the effectiveness and functioning of international law. With its limited

international power and open economy, the realisation of the Netherlands interests is dependent

on an effective and stable international legal. An order which ensures the stability, prosperity,

and security of the Netherlands (MFAISSNL, 2013; NCTV, 2018). It is particularly important

for the Netherlands economic security that other states can be held accountable based on mutual

agreements, transparency, and the objective to settle any dispute peacefully. Adherence to

international law thus protects the Netherlands from the arbitrary actions of other states

(MFAISSNL, 2013).

This belief in international law is transferred to the development of cyber norms, where

the Netherlands advocates for the creation of international agreements and an internet

governance model. This model has to, through the multi-stakeholder approach, take into

account the interests of the various public and private actors in cyberspace (MFAISSNL, 2013;

NCTV, 2018). To that end, the Netherlands wants a more detailed debate on the application of

international law in cyberspace and specifically cyber operations (MFAICSNL, 2017). It

believes, in respect to the UNGGE, that international law does not need to be reinvented. It is

consistency in application what needs to be ensured (MFAGVBNL, 2018; A/68/156/Add.1,

2013). The approach of the Netherlands on the applicability of international law aligns with

that of the UNGGE which similarly does not see a necessity to reinvent current laws (A/70/174,

2015).

However, the self-regulation, self-responsibility, and multi-stakeholder approach of the

Netherlands does not fit within the UNGGE approach. The multi-stakeholder model ascribes

responsibility to the relevant stakeholders whereas the UNGGE primarily sees states as the

42

responsible actor. The 2013 report briefly advises states in the norms to encourage the

participation of the private sector and civil society in improving security in cyberspace

(A/68/98, 2013). However, their role is no longer discussed in the 2015 report. The state

remains the only relevant actor and is responsible not only for its own actions but also that of

non-state actors who use its territory (A/70/174, 2015). As such, the multi-stakeholder model

distorts the process of securitization as the responsibility for resolving the security issue no

longer is the sole responsibility of the state. It goes against the logic of security as extraordinary

measures cannot be taken by design by non-state actors (Buzan et al., 1998).

A problem of the multi-stakeholder model is that it creates many different actors whom

each has a different perspective on what they perceive as existentially threatening. Yet,

Finnemore and Hollis (2016) argue that their inclusion can have benefits. The process of

inclusion can generate a behavioural change in attitudes and makes the spread and acceptance

of norms easier. Through participation, a sense of ownership of the norms is created, which in

return facilitates compliance through institutionalization (Finnemore & Hollis, 2016). For the

Netherlands, international forums such as the UN and NATO as part of the multi-stakeholder

approach serves as a means to achieve a greater security in cyberspace, whilst also raising

awareness on the protection of human rights and fundamental freedoms (MFAICSNL, 2017;

NCTVNCANL, 2018).

To maintain and advocate fundamental rights and freedoms internationally, the government pursues a policy on

human rights that includes an international cyber component. Respect for human rights is the basis for an open,

free and secure society. The protection of personal data and privacy, freedom of expression, the right to seek

information, freedom of association and assembly, and the prohibition on discrimination are under increasing

pressure from some governments, which use national security as a pretext for disproportional intrusions

(MFAICSNL, 2017, p. 14).

It is essential for the Netherlands that human rights and fundamental freedoms are safeguarded

both offline and online. The Netherlands believes these efforts are vital as a means to offset a

negative trend where a growing number of states are putting pressure on internet freedom

(MFAICSNL, 2017). To ensure the protection of these rights and freedoms, the Netherlands

seeks to have international law on human rights include a cyber component, and the protection

of personal data (MFAICSNL, 2017).

In terms of protection, the Netherlands does not believe in the threat or use of force and

respects the principles of sovereignty and prohibition of force in the UN Charter. However, in

recognizing Article 51, the Netherlands recognises the right for individual and collective self-

43

defence (MODNL, 2013). An exception to the prohibition on the use of force for the

Netherlands is in cases of humanitarian intervention. The Netherlands believes that a military

intervention is permissible as a last resort under strict conditions and exceptional cases which

can be justified on political or moral grounds (MODNL, 2013). These limitations are also

applied to the use of cyber operations (MFAICSNL, 2017). This inclusion may be premature

considering that there is still an ongoing debate on the application of human rights in

cyberspace (Schmitt & Vihul, 2014). The issue, according to Schmitt and Vihul concerns

defining what can and cannot be seen as a part of a personal object in cyberspace. This

definition will have an effect on how cyber-attacks can be qualified as violating human rights

and fundamental freedoms and as a result be immensely important to the UNGGE discussion

(Schmitt & Vihul, 2014).

In the current reports, the UNGGE norms do not directly or explicitly seek to guarantee

this level of personal protection. The norms speak of respecting Human Rights Council

Resolutions 20/8 and 26/13 and the UN General Assembly resolution 68/167 and 69/166

(A/HRC/RES/20/8, 2012; A/HRC/RES/26/13, 2014; A/RES/68/167, 2014; A/RES/69/166,

2014). The norms do not explicitly state the direct link between the respect for human rights

and the protection of personal data. However, resolution 69/166 does argue that the “unlawful

or arbitrary surveillance and/or interception of communications, as well as unlawful or arbitrary

collection of personal data…violate the rights to privacy and to freedom of expression”

(A/RES/69/166, 2014, p. 2). To that extent, the UNGGE agrees in principle with the

Netherlands on the importance of data protection although they are not explicit, explained, or

directly mentioned in the UNGGE reports.

There have been regional efforts made by the EU via the General Data Protection

Regulation (GDPR) to address the issue of processing and protecting personal data. The

regulation suggests that an individual’s data is something to be protected and that those who

collect and manage it must prevent its misuse or exploitation (2016/679, 2016).

This EU effort means it has securitized and defined personal data as a referent object.

This will not necessarily bring any changes for the Netherlands and its approach to the UNGGE

considering it already seeks to advocate for such measures. However, now that the GDPR has

gone into effect, its existence may be influential for the continuation of any potential future

UNGGE. It may have major consequences in relation to the application of international law

and human rights, the principles of sovereignty, non-intervention, and territorial integrity, and

in the framing and protection of the infrastructure of the Netherlands.

44

Infrastructure The Netherlands uses many different definitions to describe its infrastructure. It speaks of cyber

infrastructure, digital infrastructure, information infrastructure, critical information

infrastructure, IT infrastructure, ICT infrastructure, strategic infrastructure, essential

infrastructure, vital infrastructure, critical infrastructure, civil infrastructure, global

infrastructure, and on occasion simply refers to infrastructure (MODNL, 2012; MFAISSNL,

2013; MFAICSNL, 2017; MSJNL, 2011; NCTV, 2013). The most mentioned infrastructures

are critical infrastructure and information infrastructure although none of these definitions are

explained within the security strategies. This lack of explanation and cohesion is troubling

when compared to the UNGGE which only discusses critical infrastructure and critical

information infrastructure (A/68/98, 2013; A/70/174 2015).

An effort was made in 2015 and 2016 to create a classification and criteria of the critical

infrastructure in the Netherlands (MSJNL, 2015, 2016). The classification covers both public

and private infrastructure and is divided into two categories dependent on the economic,

physical, and societal consequences damage or disruption to those infrastructures would cause

(MJSNL, 2015). Category A includes energy, drink water, and nuclear infrastructure or

industry (MJSNL, 2015). Category B includes transport, chemical, financial, public

administration and since 2016 telecom and ICT infrastructure (MSJNL, 2015, 2016). In cases

of damage or disruption, category A infrastructure has a higher priority than category B

infrastructure (MJSNL, 2015). In relation to the UNGGE, this would suggest that critical

information infrastructure with respect to telecom and ICT are less important to the Netherlands

than its critical infrastructure. Thus, in terms of securitization, it would suggest that the

Netherlands believes is critical infrastructure is more important referent object.

Cyber security concerns ICT security and the security of information stored in ICT systems. Disruptions to ICT-

based services and processes may have major social consequences, and a disruption to vital services and processes

may even lead to social unrest. Protecting personal information, state secrets and other sensitive information is

vital for ensuring the trust parties have in the digital domain (NCTV, 2013, p. 18).

Nonetheless, in respect to the UNGGE, the Netherlands does mainly focus on its critical

information infrastructure and the economic and social consequences damage or disruption

might cause. Determining the economic cost and effect is more difficult and estimates vary

widely. Even so, Deloitte (2017) estimates that the Dutch economy approximately loses 10

billion euros or 1.5% of its GDP value per year. However, they also argue that the risk are

45

significantly outweighed by the benefits derived from cyberspace (Deloitte, 2017). Together,

this economic and social perspective has certain implications for the way the Netherlands

approaches prevention, deterrence, and attribution, which for the most part is defensively

orientated.

Prevention, Deterrence, and Attribution.

The Netherlands does not believe that a total and all-encompassing cyber defence is possible,

practical, or affordable (MODNL, 2012). Persistent and technological advanced opponents

would still be capable of damaging its infrastructure and cause the feared economic and social

damage or disruption. The objective is therefore to build as much flexibility in the protection

of its infrastructure and in the ability to actively respond to a cyber-attack (MODNL, 2012).

The purpose of this defensive flexibility is to protect data, the exchange of data, and the

infrastructures to a degree that they remain available, accessible, and functional in the aftermath

of a cyber-attack (MODNL, 2012).

To that end, the Netherlands believes that prevention is better and cheaper than a cure.

It believes that effective prevention is only possible if the interest and goals of the relevant

actors in cyberspace are aligned, which in turn allows for a more effective and accurate threat

assessment (MFAISS, 2013). The threat from cyberspace is framed as cyber criminality from

non-state actors, and digital espionage and disruptive attacks from state actors (Kingdom of the

Netherlands, 2015). The Netherlands also believes that certain state-actors are using cyber-

operations for political objectives which include spreading disinformation to influence public

opinion. This foreign influence could potentially lead to economic damage, the erosion of

democratic legitimacy, and a cyber arms race (MFAGBVNL, 2018).

These preventative actions are also supposed to function as deterrence measures. One

of these measures is the ban or the introduction of a mandatory export license on specific

hardware, software, and technology. These goods are supposed to be part of a list of controlled

goods and be incorporated into relevant EU Dual-Use Regulation and the Wassenaar

Agreement (MFAICSNL, 2017). The dual-use regulation includes “software and technology,

which can be used for both civil and military purposes, and shall include all goods which can

be used for both non-explosive uses and assisting in any way the manufacture of nuclear

weapons or other nuclear explosive devices” (428/2009, 2009, p. 3). There is currently an

ongoing debate and proposal to include cyber-surveillance technology to this definition.

46

The Netherlands is to a certain extent in favor of expanding existing controls. Yet, on

the other hand, they are also critical of the EUs proposal to amend the dual-use regulation list

(MFAICSNL, 2017). The fear is that these measures could disrupt the level-playing field on a

global level and disadvantage the EUs industry, seeing as the control list only applies to the

EU (MFAICSNL, 2017). Both regulations however fit within the objectives of the UNGGE

norms, which asks states to prevent the “proliferation of malicious ICT tools and techniques

and the use of harmful hidden functions” (A/70/174, 2015, p. 8). However, a ban or limitations

on these technologies could have implications for the law enforcement and intelligence service

“legal” use of these systems (Bromley, 2017).

Defensive operations in the information domain are designed to counter external influence and internal misuse or

corruption of vital friendly information systems. Offensive operations in the information domain focus on the

acquisition of information and intelligence, and the deliberate release of information in order to influence a

situation in support of the national interest. Activities in this domain are conducted in intelligence, information or

cyber operations or a combination of these (MODNL, 2013, p. 86).

The “legal” use involves the creation of offensive and defensive cyber capabilities (MODNL,

2013). The use of these capabilities is framed as a combination of preventative, deterrence

measures, and retaliatory (MODNL, 2013; MFAGBVNL, 2018). The purpose of these

capabilities is to detect, neutralise, deter, and if necessary retaliate proportionally to cyber-

attacks (MFAGBVNL, 2018). Offensive assets may be deployed for the sake of information

and intelligence gathering efforts. This could be done by infiltrating the relevant information

systems and networks of potential attackers. The gathered information and intelligence will be

used as an early warning sign and to assist counterintelligence activities (MODNL, 2012;

MFAICSNL, 2017). The purpose of defensive capabilities is to protect “friendly” data and the

supply of information (MODNL, 2013). Dutch intelligence services have already used these

information capabilities. They were able to penetrate the computer network of the Russian

hacker group Cozy Bear and monitor their activity, and witness them launch several attacks

against the US Democratic Party during the 2016 US Elections (Modderkolk, 2018). As these

efforts were directed at non-state actors, they are arguably acceptable according to the UNGGE

norms, although discussing their role falls outside of its purpose.

The Netherlands seeks to widen the scope of international legislation to encourage more

cross-border investigations and presses for the further ratification and spread of the Budapest

Convention on Cybercrime; in part to resolve issues of attribution. If the origin, perpetrator, or

objective of an attack cannot be identified, it limits the possible responses the Netherlands can

47

undertake (MFANL, 2017). The Netherlands already cooperates with private actors and

“friendly” states in several investigations to elevate the attribution issues and prosecute

potential suspects (MFANL, 2017). So far, the Netherlands has participated in several cross-

border investigation operations. They cooperated in 2018 with the United Kingdom and

Europol to shut down the DDoS-for-hire website WebStressers (Landelijke Politie, 2018).

They also cooperated with the United States, Germany, and Europol to shut down the dark web

marketplace Hansa (Greenberg, 2018).

However, these intelligence efforts of the Netherlands are ultimately contradictory in

nature, considering the UNGGE and securitization theory. On the one hand, the international

investigative efforts of the Netherlands comply with the requests of the UNGGE to cooperate

and exchange information for the sake of addressing threats and prosecuting terrorist and

criminal use of ICTs (A/68/98, 2013; A/70/174, 2015). Yet, these same efforts go directly

against the UNGGE cyber norms to prevent the use of harmful hidden functions (A/70/174,

2015). The Netherlands cannot both want the non-proliferation of cyber weapons and harmful

hidden functions and at the same time justify using it themselves. It creates a conflict in

securitization as it does and does not allow for the use of extraordinary measures. The UNGGE

has not clarified the “legal” usage of these measures and will be required to do so, especially

considering the opinions of other states like the Russian Federation which is firmly against the

use of these measures as shall be discussed in the next chapter.

48

Comparison This comparison will serve to answer the sub-question: “What do these developments have in

common, and to what extent do they differ?” The comparison will highlight the underlining

similarities and differences between the Russian Federation and the Netherlands and their

approach to the UNGGE cyber norms debate. The comparison will conclude by theorizing

whether the ideological differences can be reconciled and offer a path for the future of the

UNGGE cyber norms debate.

International Law and Human Rights

Despite their differences, both the Russian Federation and the Netherlands agree that

international law is applicable to cyberspace.

The Netherlands believes that existing international law does not need to be amended

and is sufficient to limit the behavior of states in cyberspace. The Russian Federation does not

believe this is the case and seeks to have existing international laws to be amended or replaced

by new laws via the creation of an IISS. The purpose of the system is to ensure adherence to

the principles of sovereignty, non-intervention, and territorial integrity. Through a hardcoded

adherence the Russian Federation wants to ensure its, and other states sovereign right to control

cyberspace according to their national laws and without interference from other states. The

Netherlands is against this system, as it wants to ensure the consistent and equal application of

international law and avoid its arbitrary application as would be the case under the IISS.

To that end, the Netherlands seeks to include a cyber component into the protection of

human rights and fundamental freedoms. The UNGGE agrees to an extent on the inclusion of

human rights and fundamental freedoms but does not explain how these norms are to be applied

or enforced. Hathaway and Shapiro (2011) argue that such enforcement measures do not have

to involve threats or the use of violence. However, there must be an actor somewhere that is

tasked to ensure compliance; something which currently does not exists within the UNGGE

(Hathaway & Shapiro, 2011). The Russian Federation is adamantly against the inclusion of a

cyber component within human rights (Krutskikh & Streltsov, 2014). It fears that the inclusion

of a cyber component could lead to the legitimization of a cyber conflict by evoking the right

to self-defence as described in Article 51 of the UN Charter. The unlawful use of ICTs would

remove the issue from the sphere of international law and allow for the use of excessive force

and threaten international peace and security (Krutskikh & Streltsov, 2014).

49

However, this fear is unsupported. Not every cyber-attack could convincingly be

classified as a violation of a state’s sovereignty, non-intervention, territorial integrity, human

rights or fundamental freedoms (Von Heinegg, 2015). Furthermore, a violation of these

principles, rights and freedoms, would not count under the right to self-defence as described in

Article 51, which only allows the use of self-defence to occur in cases of an armed attack which

a cyber-attack certainly is not (United Nations, 2015). These measures would also go against

the purpose of the UNGGE norms which seek to limit this behaviour. Instead, the UNGGE

norms encourage cooperation and the exchange of information and call for the settlement of

disputes through these peaceful means.

Yet, the continued ambiguity and lack of explanation or clarification of the UNGGE

norms drives the Russian Federation to create the IISS. A system which effectively becomes a

means for the Russian Federation to ensure its brand of information security in cyberspace. The

fear for the Russian Federation is that state and non-state actors could use ICTs for political

and military purposes and as a result allow for destructive or disrupting information to violate

its sovereignty. Its efforts of control are mainly aimed at regulating these flows of information

in cyberspace, to prevent this from occurring. The issue is that these measures essentially go

against the principles of human rights and fundamental freedoms as advocated by the UNGGE

and the Netherlands. These rights and freedoms seek to protect, amongst others, the right to

privacy and the freedom of expression. The Russian Federation at the same time believes it is

the state’s prerogative through sovereignty to dictate what does and what does not fall under

these rights and freedoms. The irony being that it argues against the application of international

law by referring to another.

This of pick-and-choose and alter mentality must ensure the Russian Federation has full

control and whereby the principles of sovereignty, non-intervention, and territorial integrity are

applied if only to ensure its domestic laws trump that of human rights and fundamental

freedoms and overall ensure the Russian states security policy objectives. An effort which goes

against the UNGGE norm which suggests that states should “comply with their obligations

under international law to respect and protect human rights and freedoms” (A/70/174, 2015, p.

12).

The Netherlands does not seek the same level of control and ensures its domestic laws

are in line with international law instead of the other way around. It is, however, unable to

support the Russian objective to extend the states control over cyberspace. Through its multi-

stakeholder model and mostly privately-owned infrastructure, the Netherlands would be unable

to comply or even entertain the notion. Rather than attract more control, the Netherlands seeks

50

the inclusion of other relevant non-state actors to include, believing their inclusion is essential

for securing cyberspace.

The creation of the IISS would be a monumental effort and span multiple decades due

to the fact that ICTs, cyberspace, touches upon every single aspect of daily life. The

construction of new norms in an international setting would have to go through the entire

catalogue of existing international law from labour, treaties, economics, human rights, trade,

armed conflict, and criminal law. It has already been proven difficult to have all states agree

on more than one viewpoint, application of international law, and the interpretation of said law

within the UNGGE. Ironically, it is far more likely that through the application of existing laws

such an IISS could be set in place to monitor or arbitrate on cyber or information security issues.

In general, the position of the Russian Federation towards the UNGGE norms debate on

international law appears contradictory and lacks a particularly well-presented feasible

direction. The Netherlands, in contrast, offers little resistance. The UNGGE norms debate does

not explicitly reflect the Netherlands entire objective but is does not limit it either and follows,

for the most part, the Netherlands in terms of protecting its infrastructure.

Infrastructure

The UNGGE debate allows for the both the Netherlands and the Russian Federation to frame

their critical infrastructure and critical information infrastructure as a referent object. However,

there is some disparity in the use of different definitions. The UNGGE mainly allows for the

protection of a state’s critical infrastructure and to a lesser extent critical information

infrastructure. The Russian Federation approaches its infrastructure mainly from the critical

infrastructure and information infrastructure perspective. The Netherlands uses many different

definitions of which critical infrastructure and information infrastructure are discussed the most.

There is an obvious overlap concerning the framing of the referent object in all three

approaches. However, the difference lies in the underlining motivations of why these

infrastructures are referent objects.

For the Russian Federation, the national interest is the protection of its information

infrastructure (online and offline) from damage or disruption. The functioning of the

information infrastructure is linked to the functioning and continuation of the Russian state

through adherence to the principles of sovereignty, non-intervention, and territorial integrity.

The purpose of protection is to create a unified system which ensures the survival of the Russian

Federation. It is not made evidently clear whether the protection of the physical information

51

infrastructures stands above the protection of the flow and storage of information. This,

especially considering that the existential threats are framed as terrorists, criminals, extremists,

and separatists. The fear is that these existential threats would be capable of spreading

destructive information and result in social unrest and threaten the survival of the regime.

The Netherlands focuses on a similar protection of the flow of information but does not

include an offline component beyond a respect of human rights and fundamental freedoms

which it believes are universally applicable. It also similarly seeks to infrastructure and

information infrastructure and the storage and transport of information. However, it is arguably

less interested in the information itself. What may be more important is that the infrastructure

remains capable of facilitating and transporting said information for the sake of its economic

objectives. There is a fear that this information can be manipulated, but the Netherlands does

not link said manipulation to the survival of the state.

This does leave the question as to what the Russian Federation and the Netherlands

have effectively securitized beyond their infrastructures. This question primarily revolves

around the framing of data as a referent object and the relation of personal data with respect to

human rights and fundamental freedoms. Both states recognise its value, although it may be a

topic which falls beyond the discussion of the UNGGE. Its lack of inclusion in the UNGGE

norms does indicate that the approach of both states to the UNGGE may appear to be similar

but has significant underlying differences which will need to be addressed. The protection of

data would significantly influence the norms debate. This, in turn, will also influence the

prevention, deterrence, and attribution measures states will be allowed to undertake.

Prevention, Deterrence, and Attribution Both the Russian Federation and the Netherlands believe they, through their sovereignty, have

the right to take necessary measures to defend themselves and prevent cyber-attacks. The

UNGGE reports does not explicitly allow this, but instead ask states to resolve their disputes

through peaceful means; meaning cooperation and the exchange of information.

The Russian Federation has a different perspective and instead seeks to prevent the

spread of information weapons and advocates for the demilitarization of cyberspace. The non-

proliferation and demilitarization efforts are shared by the Netherlands and to an extent also by

the UNGGE which suggests that states should prevent the proliferation of malicious ICT tools

and techniques. In a somewhat different approach, the Netherlands seeks to ban or introduce a

mandatory export license on specific hardware and software and make them part of the list of

52

dual-use goods; meaning goods which can be used for both civil and military purposes.

Together with 42 states, including the Russian Federation, the Netherlands is part of the

Wassenaar Agreement, a voluntary export control regime. The measure is different from that

of the Russian Federation as the Netherlands does not necessarily seek the non-proliferation or

demilitarization. Instead, it primarily wants to prevent the export of these goods and prevent

the import of these goods by potentially malicious actors.

The UNGGE is unclear to what extent it wants states to seek to prevent the proliferation

of malicious ICTs and what is specifically meant with that definition. The dual-use list can be

problematic in relation to ICTs considering that even a personal computer, tablet, or

smartphone could be used for both civil and military purposes. The contradictory position is

that despite arguing for the limitation of hardware and software technology, the Netherland and

the Russian Federation also actively seeks to create offensive and defensive cyber capabilities.

The creation of these capabilities is framed as part of the Netherlands prevention,

deterrence, and retaliatory measures. Offensive operations are focused on acquiring

information and intelligence, and the release of information (including deception) to influence

a situation for the sake of the national interest. Similar to the Netherlands, the Russian

Federation frames the creation of information weapons as part of its prevention and deterrence

efforts, specifically aimed at preventing an armed (cyber) conflict. A secondary purpose of

these weapons is to deter the use of ICTs for military or political purposes which can potentially

damage or disrupt the Russian information infrastructure and result in violations to its

sovereignty, non-intervention, and territorial integrity.

The UNGGEs position towards the creation and usage of these capabilities and

weapons is conflicting. By asking states to take appropriate measures to protect their

infrastructure, the measures by the Netherlands could be considered acceptable. This would

not be the case with the Russian Federation. Although the creation of information weapons is

framed as a preventative and deterrence measure, their usage can only be offensive and would

actively go against the norm to prevent the proliferation of malicious ICTs. A norm under

which the Netherlands offensive and defensive capabilities arguably would not fall under as its

purpose is not to be destructive or disrupting like the Russian weapons are.

In line with its aspirations, the Russian Federation seeks to include these preventive and

deterrence measures in the IISS; those being the non-proliferation and demilitarization efforts.

Part of this effort would be a monitoring function which subsequently holds states responsible

for preventing the malicious use of ICTs against other states. Although the system is somewhat

in line with the UNGGE norms to prevent the knowing use of its territory, it remains unfeasible

53

for most states to realise. Despite its potential effectiveness, it does require states to have the

necessary resources to implement such a system (Nye, 2016). Not many states possess the

resources to monitor their data traffic consistently enough to be effective. Many democratic

states like the Netherlands are unlikely to adopt such a measure due to the inherent violations

of human rights and fundamental freedoms it would involve. Most of these democratic states

currently require a court order before they are able to intercept and monitor suspects (Brown,

2015). Expanding this system would also require a more detailed construction of the referent

object and existential threats.

Instead of a monitoring system, the Netherlands emphasizes the expansion of the

international investigative capabilities by seeking the expansion of international legislation on

cybercrime. Together with the intelligence from the offensive and defensive cyber capabilities,

both efforts would assist in preventing and attributing cybercrimes. These cross-border

investigations would fulfil the UNGGE objective to promote the criminal investigation into the

criminal and terrorist use of ICTs. It is also more in line with the reality of cyber-attacks and

their perpetrators, which are predominantly non-state actors. Yet, the discussion on the role of

non-state actors is not a part of the UNGGE and would require a separate debate. The Russian

Federation is against the expansion of these cross-border investigations, fearing that the

(involuntary) exchange of information and access as part of the investigations attribution

efforts could be an excuse and serve as a means for an adversary to penetrate its information

infrastructure; resulting in a violation of its sovereignty, non-intervention, and territorial

integrity (Krutskikh & Streltsov, 2014).

Future of the UNGGE The position of the Russian Federation and the Netherlands towards the UNGGE can be

explained via their security strategies; but they do not explain the UNGGE reports in its entirety

which for the most part comes as a result of its ambiguous construction and lack of explanation.

The lack of explanation and the inherent confusion may serve well within the context of the

UNGGE, but it does not help the purpose of applying international law to cyberspace by having

state interpret the norms as they wish. This issue is further exasperated by the voluntary and

non-binding nature of the norms, which makes it possible for states to decide whether they to

adhere to them or not. The logic behind the ambiguous UNGGE norms construction could be

explained through the belief that only a few like-minded states will initially accept them, after

which more states will slowly follow (Hurwitz, 2014). However, through the ideological

54

division, the Russian Federation and its allies in the Shanghai Cooperation Organisation should

be counted as well. The problem lies in the additional belief that all states should be subject to

some of these norms and that they will come to accept them in time through incentives,

confidence-building measures, or sanctions employed by the like-minded states (Hurwitz,

2014). It is unlikely that the Russian Federation will alter its position through the above-

mentioned measures. The larger disagreement between both groups is on who should set the

norms, and which states should be subject to them (Hurwitz, 2014).

The disagreement between both states on sovereign control over cyberspace is unlikely

to disappear or be resolved in the immediate future. The Russians top-down model contrast

starkly with the Netherlands bottom-up approach as evident through its multi-stakeholder

model (Eichenseir, 2015). The survival component for the Russian Federation will most likely

be too great a hurdle for it to overcome and side with the Netherlands. The bottom-up model

of the Netherlands would also not be feasible or acceptable from the perspective of the Russian

Federation as an authoritative regime. The IISS directly contradicts this approach and instead

would increase the sovereign control of states to regulate cyberspace. Cyberspace would be

assimilated into the sovereign territory of states and allow for similar protective measures as

awarded to the protection of a state’s physical borders (Eichenseir, 2015).

If a new UNGGE were to be established, it would have to start at the beginning, in order

to re-considering the motivations of those who disagreed. place. The development of the

security documents of the Russian Federation and the Netherlands have not changed

significantly between 2007 and 2017. This means that both ideological different approaches

have existed long before the creation of the 2013 and 2015 UNGGE report; that is, if it can be

called an ideological difference.

The different ideological approach is between the right of states to control its portion

of cyberspace and regulate the flow of information against potential destructive or disruptive

information against the protection of human rights and fundamental freedoms which require

the freedom of expression, right to seek information, the freedom of assembly and association,

and non-discrimination. In essence, the ideological division revolves around the age-old debate

on the freedom of expression against national security; and something which has been seen a

resurgence with the rise of right-winged extremism (Mchangama, 2016).

Although it is a genuine discussion and ideological difference, the interpretation and

motivation for national security has a different meaning for the Russian Federation. Silencing

dissident voices and limiting the flow of information which critiques the regime should not be

considered an ideological position. Instead, the Russian Federation and its allies have

55

appropriated an already existing discussion and linked it to their objections on the use of force

and right to self-defence which overall are not very strong arguments. These objections mask

the more pressing concern the Russian Federation has in the application of international law,

human rights, and fundamental freedoms. This position and the general fears of the Russian

Federation are not reflected within the UNGGE reports. They are entirely assumed based on

their perspective on how the application of international law may turn out; which is only

possible due to the ambiguous construction of the reports. It is understandably an opportunity

for the Russian Federation and its allies to essentially legitimize its control over their corner of

cyberspace. Yet, it will never be acceptable to the like-minded states such as the Netherlands.

It leads to questions on the motivations of states that participated within the UNGGE despite

knowing that this was a likely outcome. This considering that the cyber and information

security strategies of both the Netherland and the Russian Federation have not changed

significantly between 2007 and 2017. Their participation could perhaps then only be explained

as part of a securitization process, whereby the continued belief in an existential threat ensures

their continued strive towards the creation of norms on an international level.

56

Cyber Securitization There are several different ways, in the current research, through which cyberspace could have

been securitized. The UNGGE, Russian Federation, and the Netherlands could all have

successfully securitized cyberspace together or without the other two having done so as well.

The problem is that technically speaking only one state should be able to do so in an

international setting. If cyberspace has been securitized, this would imply a certain degree of

action and should have influenced the UNGGE norms discussion to some degree. It would also

signal the probability that states will remain motivated to resolve the insecurities from

cyberspace, and whether or not they are likely to change their mind. The following chapter will

seek to answer the sub-question: “Has cyber securitized?” The chapter will look at the

developments presented in the previous chapters in order to determine whether cyberspace has

successfully been securitized, and if so, to what extent.

Securitizing Actors In theory, the securitizing actor could be anyone who is able to construct an issue as being

existentially threatened through a speech act. The success of this depends significantly on the

status of the actor and the context within which the actor attempts to securitize an issue (Buzan

et al., 1998). Additionally, the theory also positions a definitive moment in time where the

speech act is accepted by the audience and leads to an issue being successfully securitized or

not. A successful securitization act would imply that the issue has received a disproportional

amount of resources and attention and has legitimized extraordinary measures to resolve the

issue (Buzan et al., 1998). However, the framing and expected results as presented by the theory

present certain problems in determining the potential of a successful securitization within the

UNGGE, the Russian Federation and the Netherlands.

The initial problem exists in the nature of cyberspace; which is a global entity but

cannot be limited within the boundaries of one state. Its global status should allow for multiple

actors, at different points in time, to declare their own portion to be existentially threatened. It

is not clear whether it is possible for a singular securitizing actor to declare cyberspace as

existentially threatened and convince the whole world of it through a speech act; although it

should theoretically be possible. Nonetheless, designating these securitizing actors within the

UNGGE is difficult, in part due to the limitations of the theory.

The 1998 resolution of the Russian Federation fails to meet the required indicators due

to issues in designating the audience who would have accepted its construction of the

57

existential threat and referent objects. The resolution and those that followed were all accepted

without a vote which may suggest no audience was needed for the issue to be successfully

securitized. However, even if the instance is accepted as a successful securitization move, it

hardly led to a diversion of resources, an increase in attention or the use of extraordinary

measures. Instead, following the life cycle of norms, the UNGGE was established to investigate

existing and potential threats in cyberspace; meaning, that the process of determining the

referent objects and existential threats had yet to begin and would continue to evolve over many

years. Although securitization theory does not dictate a specific timeframe between the

securitization effort and the use of extraordinary measures, it does imply a rather faster process

than witnessed within the UNGGE. 14 years is a long time to act upon a potential successful

securitization act.

Furthermore, the theory does not discuss the possibility of other state actors or non-

state actors individually securitizing the issue and only later on joining in on the international

effort. This was the case of the Netherlands and many other states within the UNGGE process.

The theory does not describe the role of states which have securitized the same issue but are,

through institutional regulations, not allowed to participate directly in the discussion; meaning

the Netherlands until the 2016-2017 meetings. Finally, the theory does not explain the role of

states which took part in the securitizing effort, but who left, only to either return or not return

to the discussion at all. With these many potentially different securitizing actors, the theory

does not facilitate the possibility of different perspectives on the same existentially threatened

issue and does not account for the potential convergence or evolvement of ideas, existential

threats, and referent objects through norms.

Referent Objects The theory of securitization would suggest that the referent objects is fixed before any means

to protect the referent object are discussed. The theory also assumes to a degree that the

securitizing actors frame their referent objects and interpret its existential threat along a similar

line. However, the theory does not take into account the possibility of different states

constructing their own referent objects which may or may not be represented at all within an

international context such as the UNGGE. Each UNGGE could represent a new securitization

round, where the framing of the different indicators evolves with each meeting until the norms

are finalized. Yet, the theory does not allow for such an iterative securitization process.

58

The referent objects described within the UNGGE norms are critical infrastructure,

critical information infrastructure, ICTs, and ICT-dependent infrastructure, and the information

systems of authorized emergency response teams. The reports also frequently mention

international peace and security but do not explain why these objects are referent objects. The

lack of criteria on these subjects allows for different interpretation by both the Russian

Federation and the Netherlands on what they consider and interpret as referent objects. Both

states recognize the status of their own critical infrastructure and critical information

infrastructure and that of their allies. Although it is discussed in general terms within the

UNGGE, the Russian Federation and the Netherlands do clearly make a distinction between

their infrastructure and that of their potential adversaries.

A larger question pertains to what the boundaries of cyberspace are and to what extent

a distinction between critical infrastructure and critical information infrastructure makes sense.

Cyberspace has penetrated every aspect of daily life to a degree that there might not be any

critical infrastructure which is not ICT-dependent or could exist without cyberspace. Almost

every issue being dealt with on a national or international level has a cyber component, from

terrorism to trade, to environmentalism and the rise of extremism. Within in this context,

cyberspace is the one things that connect them all. Considering these issues would be a part of

the UNGGEs mandate to consider existing and potential threats and cooperative measures to

address them.

The UNGGE is supposed to regulate the behaviour of states in cyberspace but neglects

to discuss a larger discussion on what cyberspace is. It neglects to discuss what the role of the

state is and should be in cyberspace, and to what extent the behaviour of states should be

regulated through containing or permissive regulative norms. Meaning, should the UNGGE

norms regulate the behaviour of states in cyberspace concern all behaviour and include

behaviour in regards to things such as agriculture, education, medical and immigration; sectors

which use ICTs and are ICT-dependent. Or should the UNGGE norms only focus on the

behaviour of states in small and selective areas such as crime and terrorism as appears to be

the case with the current UNGGE reports?

Doing so may be preferable for the UNGGE but does neglect the construction of

referent objects of other states such as the Russian Federation and the Netherlands. Underlining

their critical infrastructure and critical information infrastructure lies the deeper question on

the status of data as a referent object. Added to this would be a discussion on the rights of states

to determine what is or what is not destructive or malicious information and data. The

protection of this information or data is linked to either the survival of the state in the Russian

59

case or the economy and society in the case of the Netherlands. Altogether, the framing of the

referent object is important as it can to a large extent determine the type of existential threat

each of these different referent objects may expect.

Existential Threat The frame of existential threats can refer to many different actors within cyberspace and the

UNGGE. The UNGGE constructs these existential threats as criminals, terrorist, extremists,

and (other) states. It is not necessarily the existence of these actors that is considered a threat,

but rather their behavior in relation to using cyberspace to commit their acts. The UNGGE does

not describe or explain what these acts may be beyond describing them as the malicious use of

ICTs.

For the Russian Federation, the existential threat is mainly constructed as criminals,

terrorists, extremists, separatist, and other states using ICTs in a way which would violate the

Russian states sovereignty and principles of non-intervention, and territorial integrity. The

Netherlands frames the threat more generally as state and non-state actors attempting to damage

or disrupt its infrastructure in terms of potential economic loss or social disruption. They pay

little attention to the use of these malicious tools by states against non-state actors, which

should be an important part of the discussion, even if it falls outside the mandate of the UNGGE.

Nonetheless, it is especially important for states like the Netherlands, where a significant part

of its infrastructure is in the hands of (semi) private actors. This refers to a larger debate with

respect to framing the referent object on the distinction that should be made between public

and private property in relation to the functioning of the state and society.

Like most of the other indicators and definitions, it depends entirely on the

interpretation of states and the definitions used. However, the ambiguity may be preferable for

the sake of reaching a consensus on the final report which has to account the opinions of many

different state actors and potentially many different functional actors as well.

Functional Actors Dependent on the context, states can be functional actors. Within the context of the UNGGE

states can be both securitizing actors and functional actor’s dependent on their participating

status. The problem with the UNGGE discussion is that more often then not, states could be

securitizing actors and declare an issue existentially threatened, be referent objects which need

protection, be existential threats and functional actors to other states. Meaning, the participating

60

member states of the UNGGE are effectively securitizing against themselves. Yet,

securitization theory does not allow for the functional actor to also be the securitizing actor or

referent object. The functional actor is supposed to be actors who significantly influence the

decisions in the security field. These are the context of the UNGGE states. Even if they were

not considered functional actors, they would still be referent objects. It may be possible to make

a distinction between directly participating states, attributing states, and non-participating

states. Not all states directly take part in the UNGGE. Only 24 out of 193 UN member states

participated in the 2016-2017 UNGGE, and only 15 states beyond of the participating states

contributed with their official responses (A/72/315, 2017). The problematic part is determining

to what extent the participation of these contributing states could be considered significant.

In general, it is almost impossible to know which who are functional actors unless their

contribution is clearly noted. This is especially true for existential threat actors such as

criminals and terrorists who through their existence and actions influence the decisions made

by states and the UNGGE and therefore could be considered functional actors. The same could

be said about the UN. The UNGGE debate takes place under the umbrella of the UN and its

contextual influence through the rules and regulations as imposed on governmental groups of

experts (Lewis & Vignard, 2016). It is those rules that determine the criteria for which state is

allowed to participate and thus directly influence the direction of the debate. This influence is

also extended to the construction of the norms and the release of the final reports, which

through regulations require a consensus to be released (Lewis & Vignard, 2016).

Determining the functional actors within the Russian Federation and the Netherlands is

somewhat easier. The Netherlands through its multi-stakeholder seeks the inclusion of all

relevant stakeholders in crafting and enacting its cyber-security strategies. Within this

framework, non-state actors are both functional actors, securitizing actors, referent objects, and

in certain cases also existential threats. They provide the government with information on what

they perceive are existential threats and referent objects. It is not a one directional relationship

as is the case with the Russian Federation. In Russia, the state is the directive organ of power

who dictates what is and what is not an existential threat and functional actor. However, the

Russian Federation does work with other states in regional organizations such as the Shanghai

Cooperation Organization. The Netherlands similarly cooperates within the framework of the

EU and NATO. However, unlike the Netherlands, the Russian Federation approaches the

UNGGE debate as a collective, being part of the Shanghai Cooperation Organization. This

would make the organization a securitizing actor in itself and a functional actor to the UNGGE,

further complicating the issue. In general, it can be said that with most of the other indicators,

61

the status of an actor as a functional actor depends greatly on the time, place, level of

cooperation, and perspective; which is carried over in determining the occurrence of a speech

act.

Speech Act It is unlikely that any speech would have convinced a state of the necessity to securitize

cyberspace. The speech act indicator supposes that an audience has to be convinced by the

securitizing actors construction of the threat. As discussed in the previous paragraphs,

determining these actors is difficult or at the very least has many caveats. If we accept that the

Russian Federation securitized cyberspace in 1998 by uttering a speech act then no other state

actor could ever securitize again. Each state would have to adhere to the construction as

ascribed by the Russian Federation. However, as adoption of the resolution has not resulted in

the use of excessive force, it cannot be said that the process was successful in the traditional

sense. Cyberspace could be securitized following Trombetta’s (2008) arguments and not have

resulted in the use of extraordinary force, but instead led to cooperation within the UNGGE.

Even so, as evident by the discussion within this chapter, attempting to locate the

corresponding objects or actors results in a circular discussion. The nature of cyberspace does

not allow for declarative statements to be made. There are too many exceptions and definitions

which need to be accounted for, which move the theory away from its original construction. It

is thus, in its current state it is impossible to declare that cyberspace has successfully been

securitized from the UNGGE perspective.

When viewed from the perspective of the Russian Federation and the Netherlands, then

cyberspace is definitely securitized; albeit very specific parts of it. Part of this securitization

process would have to take into account that the securitizing actor convinced itself of its own

construction of the referent objects and existential threats. Threats, some of which have

arguably already been securitized such as critical infrastructure and criminal and terrorist’s

activities.

For the Russian Federation, information and data would still be securitized even without

cyberspace, and the same can be said for the Dutch economy and society. Nevertheless, all

these different issues have gained a cyber aspect through cyberspace which required a re-

securitization of the issues to include said cyber component. However, none of these acts of

securitization have led to the use of extraordinary measures; especially considering the lack of

a cyberconflict. Thus, to say that cyberspace has been successfully securitized would grossly

62

understate the complexity that is cyberspace. What is required is research to examine each

individual sector/ issue area to determine whether it has been re-securitized with a cyber

component or not. Only then could one definitively state that cyber has been securitized.

However, until then, it is more prudent to say that very specific areas in cyberspace have indeed

been securitized.

63

Conclusion The analysis presented in the thesis of the Russian Federations and the Netherlands cyber and

information security strategies has demonstrated some similarities, but ultimately many

underlining differences in their development and approach towards the UNGGE cyber norms

debate. The development of these cyber and information security strategies has remained

consistent between 2007 and 2017 and explains the Russian and Dutch different ideological

approaches to the UNGGE.

The approach of the Russian Federation to the cyber norms debate has been guided by

its objective to reaffirm the sovereign right of states to govern and control cyberspace according

to their national laws and in the name of national security. To ensure this right, the Russian

Federation requires the UNGGE norms discussion to include a hardcoded adherence to the

principles of sovereignty, non-intervention, and territorial integrity. Adherence to these

principles is to ensure no other states has a right to interfere in the way the Russian Federation

manages its cyberspace. Management of which is linked to the survival of the Russian state,

which is threatened by the spread of destructive or disrupting information by criminals,

terrorists, extremists, and separatists. A point of contention for the Russian Federation is that

this right to control clashes with the UNGGEs inclusion and promotion of human rights and

fundamental freedoms.

The inclusion of these rights and freedoms has been a significant part of the Netherlands

development and approach of its cyber-security strategies. The approach of the Netherlands

has primarily revolved around promoting its multi-stakeholder model and adherence to existing

international laws a means to resolve the insecurities from cyberspace. The Netherlands

requires a consistent application of international law together with a free and open cyberspace

to realise its economic and foreign policy objectives. Thus, instead of control, the Netherlands

believes in cooperating with the relevant stakeholders in cyberspace to combat the threats it

faces. This threat is constructed in economic and social terms. The Netherlands fears that a

cyber-attack could either lead to significant economic loss or social displacement or disruption

of its citizens. It is thus important for the Netherlands to have the UNGGE norms include a

cyber component in order to ensure the protection of human rights and fundamental freedoms

online and offline.

The Russian Federation is against this inclusion as the insurance of human rights and

fundamental freedoms. Its inclusion would undermine the Russian states efforts to control the

flow of damaging and disrupting information. For the Russian Federation, human rights and

64

fundamental freedoms are connected to the sovereign right of the Russian state to protect its

citizens against destructive or disrupting flows of information. In contrast, the Netherlands

especially wants the inclusion of these rights and freedoms because it fears certain states will

use its control and influence over cyberspace to silence dissenting voices and violate human

rights and fundamental freedoms in the process.

The resulting UNGGE reports are an ambiguous mix of these ideological positions;

giving it the appearance that both sides have been taken into account. However, it is never

entirely clear what is precisely meant by the norms, how they to apply, or how and to what

extent they are to be enforced. The norms include references to sovereignty, non-intervention,

and territorial integrity, but also the protection of human rights and fundamental freedoms yet

never explicitly explain which has a higher priority. This is a problem born out of a lack of

explanation and definitions which subsequently limits many of the arguments made within the

thesis. Arguments which are primarily based upon the different perspectives and interpretations

of definitions, weaknesses in the theory of securitization, and as a result often rely on

technicalities to make an argument.

As a result of these many limitations, the UNGGE discussion feels premature as it fails

to address the most pressing concerns in the world appropriately. Part of the initial UNGGE

discussion should have focused on defining and clarifying many of the cyber-related concepts.

Now, the interpretation is left up to the states and allows for wildly different assumption to be

had Russian Federation and the Netherlands. What is needed is clarity and consistency in their

interpretation form an international legal perspective and not necessarily from an academic one.

A significant portion of the academic literature already has devoted a lot of time theorizing on

different cyber-related definitions. An international effort to construct these definitions is

needed, even if it may not fall under the mandate of the UNGGE.

Nevertheless, what appears to be evident is that the UNGGE discussion does not discuss

the most pressing issue both the Russian Federation and the Netherlands are concerned with;

that being the status of information and data in cyberspace as a referent object. It is also the

status of this information and data which connects to the ideological division on control for the

sake of national security versus human rights and fundamental freedoms. It should therefore

be the recommended that future research devotes to resolving this problematic connection

between the topics; especially as discussing these issues does not fall under the mandate of the

UNGGE. Unless the above-mentioned, and the definitional problems are resolved, it may

difficult to see any significant behavior change through the creation and implementation of

international cyber norms.

65

Cited Sources Abelson, H., Anderson, R., Bellovin, S. M., Benaloh, J., Blaze, M., Diffie, W., … Weitzner, D. J. (2015).

Keys under doormats: mandating insecurity by requiring government access to all data and

communications. Journal of Cybersecurity, 69. https://doi.org/10.1093/cybsec/tyv009

Bannelier, K., & Christakis, T. (2017). Cyber-Attacks – Prevention-Reactions: The Role of States and

Private Actors (SSRN Scholarly Paper No. ID 2941988). Rochester, NY: Social Science

Research Network. Retrieved from https://papers.ssrn.com/abstract=2941988

Bendovschi, A. (2015). Cyber-Attacks – Trends, Patterns and Security Countermeasures. Procedia

Economics and Finance, 28, 24–31. https://doi.org/10.1016/S2212-5671(15)01077-1

Bigo, D. (2002). Security and Immigration: Toward a Critique of the Governmentality of Unease.

Alternatives: Global, Local, Political, 27(1_suppl), 63–92.

https://doi.org/10.1177/03043754020270S105

Bothe, M. (1980). Legal and Non-Legal Norms – a meaningful distinction in international relations? *.

Netherlands Yearbook of International Law, 11, 65–95.

https://doi.org/10.1017/S0167676800002725

Bromley, M. (2017). Export controls, human security and cyber-surveillance technology: Examining

the proposed changes to the EU Dual-use Regulation, 1–40.

Brown, C. S. D. (2015). Investigating and Prosecuting Cyber Crime: Forensic Dependencies and

Barriers to Justice. International Journal of Cyber Criminology, 9, 55–119.

https://doi.org/10.5281/zenodo.22387

Buzan, B., & Hansen, L. (2009). The evolution of international security studies. Cambridge, UK ; New

York: Cambridge University Press.

Buzan, B., Wæver, O., & Wilde, J. de. (1998). Security: a new framework for analysis. Boulder CO

[etc.]: Lynne Rienner.

Deeks, A. (2017). Intelligence Communities and International Law: A Comparative Approach (SSRN

Scholarly Paper No. ID 2700900). Rochester, NY: Social Science Research Network. Retrieved

from https://papers.ssrn.com/abstract=2700900

Deloitte. (2017). Cyber Value at Risk in The Netherlands 2017 - Dealing efficiently with cybercrime |

Cyber Risk | Deloitte. Retrieved 27 May 2018, from https://www.sbs.ox.ac.uk/cybersecurity-

capacity/system/files/Deloitte_Cyber%20VaR%20NL%202017.pdf

Eichenseir, K. E. (2015). The cyber-law of nations. Georgetown Law Journal, 103(2), 317–379.

European Council. (2009). Council Regulation (EC) No 428/2009 of 5 May 2009 setting up a

Community regime for the control of exports, transfer, brokering and transit of dual-use

items. Retrieved 1 June 2018, from https://eur-lex.europa.eu/legal-

content/EN/TXT/PDF/?uri=CELEX:32009R0428&from=EN

66

European Parliament, & Council of the European Union. (2016). Regulation (EU) 2016/679 OF The

European Parliament And Of The Council OF 27 APRIL 2016. Retrieved 27 May 2018,

from http://eur-lex.europa.eu/legal-

content/EN/TXT/PDF/?uri=CELEX:32016R0679&from=EN

European Union Agency for Network and Information Security. (n.d.). CSIRTs by Country -ENISA.

Retrieved 29 May 2018, from https://www.enisa.europa.eu/topics/csirts-in-europe/csirt-

inventory/certs-by-country-interactive-map/csirt-inventory.pdf

Finkle, J. (2013, February 26). Researchers say Stuxnet was deployed against Iran in 2007. Reuters.

Retrieved from https://www.reuters.com/article/us-cyberwar-stuxnet/researchers-say-

stuxnet-was-deployed-against-iran-in-2007-idUSBRE91P0PP20130226

Finnemore, M., & Hollis, D. B. (2016). Constructing Norms for Global Cybersecurity. American

Journal of International Law, 110(3), 425–479.

https://doi.org/10.5305/amerjintelaw.110.3.0425

Finnemore, M., & Sikkink, K. (1998). International Norm Dynamics and Political Change.

International Organization, 52(4), 887–917.

Freedom House - Net. (2017, October 27). Freedom on the Net 2017: Manipulating Social Media to

Undermine Democracy. Retrieved 26 May 2018, from

https://freedomhouse.org/sites/default/files/FOTN_2017_Final.pdf

Godwin, J., Kuplin, A., Frederick Rauscher, K., & Yaschenko, V. (2014). Critical Terminology

Foundations 2: Russia-US Bilateral on Cybersecurity, 1–82.

Gottwald, S. (2009). Study on critical dependencies of energy, finance and transport infrastructures

on ICT infrastructures. Retrieved 25 May 2018, from https://ec.europa.eu/home-

affairs/sites/homeaffairs/files/e-library/docs/pdf/2009_dependencies_en.pdf

Greenberg, A. (2018). How Dutch Police Took Over Hansa, a Top Dark Web Market | WIRED.

Retrieved 27 May 2018, from https://www.wired.com/story/hansa-dutch-police-sting-

operation/

Grigsby, A. (2017). The End of Cyber Norms. Survival, 59(6), 109–122.

https://doi.org/10.1080/00396338.2017.1399730

Guitton, C. (2017). Foiling cyber attacks. In 2017 International Conference on Cyber Security And

Protection Of Digital Services (Cyber Security) (pp. 1–7).

https://doi.org/10.1109/CyberSecPODS.2017.8074853

Hansen, L., & Nissenbaum, H. (2009). Digital Disaster, Cyber Security, and the Copenhagen School.

International Studies Quarterly, 53(4), 1155–1175. https://doi.org/10.1111/j.1468-

2478.2009.00572.x

Hathaway, O., & Shapiro, S., J. (2011). Outcasting: Enforcement in Domestic and International Law.

Yale Law Journal, 121, 252–2405.

67

Hijink, M. (2013). ‘NSA maakte gebruik van hack IT-bedrijf DigiNotar’. Retrieved 5 June 2018, from

https://www.nrc.nl/nieuws/2013/09/14/nsa-maakte-gebruik-van-hack-it-bedrijf-diginotar-

a1431586

Human Rights Council. (2012). 20/8. The promotion, protection and enjoyment of human rights on

the Internet. Retrieved 31 May 2018, from https://documents-dds-

ny.un.org/doc/RESOLUTION/GEN/G12/153/25/PDF/G1215325.pdf?OpenElement

Human Rights Council. (2014). 26/13 The promotion, protection and enjoyment of human rights on

the Internet. Retrieved 31 May 2018, from http://hrlibrary.umn.edu/hrcouncil_res26-13.pdf

Hurwitz, R. (2014). The Play of States: Norms and Security in Cyberspace. American Foreign Policy

Interests, 36(5), 322–331. https://doi.org/10.1080/10803920.2014.969180

Huysmans, J. (2004). Minding Exceptions: The Politics of Insecurity and Liberal Democracy.

Contemporary Political Theory, 3(3), 321–341. https://doi.org/10.1057/palgrave.cpt.9300137

International Telecommunication Union. (2017). ICT Facts and Figures 2017. Retrieved 30

May 2018, from https://www.itu.int/en/ITU-

D/Statistics/Documents/facts/ICTFactsFigures2017.pdf

Jensen, E. T. (2012). Cyber deterrence. Emory International Law Review, 26(2), 773–824.

Kingdom of the Netherlands. (2015). Developments in the field of information and

telecommunications in the context of international security Kingdom of the Netherlands 2015

General appreciation of the issues of information security. Retrieved 1 June 2018, from

https://unoda-web.s3-accelerate.amazonaws.com/wp-

content/uploads/2015/08/NetherlandsISinfull.pdf

Krutskikh, A., & Streltsov, A. (2014). International Law and the Problem of International Information

Security, 1–65.

Kuehl, D. (2009). From Cyberspace to Cyberpower: Defining the Problem. In Cyberpower and

National Security. Washington: Potomac Books.

Kulesza, J. (2009). State Responsibility for Cyber-attacks on International Peace and Security. Polish

Yearbook of International Law, (29), 139–151.

Landelijke Politie. (2018). Operation Power Off – Police close down largest DDoS website. Retrieved

27 May 2018, from https://www.politie.nl/nieuws/2018/april/25/operation-power-

off-%E2%80%93-police-close-down-largest-ddos-website.html

Lewis, J., & Vignard, K. (2016). Report of the International Security Cyber Issues Workshop Series.

United Nations Institute for Disarmament Research (UNIDIR) and Centre for Strategic and

International Studies (CSIS). Retrieved from

http://www.unidir.org/files/publications/pdfs/report-of-the-international-security-cyber-

issues-workshop-series-en-656.pdf

Lopez, J., Setola, R., & Wolthusen, S. D. (2012). Critical infrastructure protection information

infrastructure models, analysis, and defense. Berlin: Springer.

68

Mačák, K. (2017). From Cyber Norms to Cyber Rules: Re-engaging States as Law-makers, 30(4), 877–

899. https://doi.org/10.1017/S0922156517000358

March, J. G., & Olsen, J. P. (1998). The Institutional Dynamics of International Political Orders.

International Organization, 52(4), 943–969. https://doi.org/10.1162/002081898550699

Markoff, M. (2017, June 26). Explanation of Position at the Conclusion of the 2016-2017 UN Group of

Governmental Experts (GGE) on Developments in the Field of Information and

Telecommunications in the Context of International Security. Retrieved 3 March 2018, from

/remarks/7880

Mattioli, R., & Levy-Bencheton, C. (2015). Methodologies for the identification of Critical Information

Infrastructure assets and services — ENISA [Report/Study]. Retrieved 25 May 2018, from

https://www.enisa.europa.eu/publications/methodologies-for-the-identification-of-ciis

Mazanec, B. M. (2015). The evolution of cyber war: international norms for emerging- technology

weapons. Place of publication not identified: Potomac Books.

Mchangama, J. (2016). Freedom of Expression and National Security.(Symposium: The Freedom of

Expression). Society, 53(4), 363–367. https://doi.org/10.1007/s12115-016-0029-1

Ministry of Foreign Affairs of the Russian Federation. (2016). Doctrine of Information Security of the

Russian Federation. Retrieved 3 March 2018, from

http://www.mid.ru/foreign_policy/official_documents/-

/asset_publisher/CptICkB6BZ29/content/id/2563163

Ministry of Defence. (2012). Defence Cyber Strategy - Cyber security - Defensie.nl [onderwerp].

Retrieved 27 May 2018, from

http://www.ccdcoe.org/strategies/Defence_Cyber_Strategy_NDL.pdf

Ministry of Defence. (2013, November 20). Defence Doctrine - Publication - Defensie.nl [publicatie].


https://english.defensie.nl/downloads/publications/2013/11/20/defence-doctrine-en

Ministry of Defence of the Russian Federation. (2010). Military Doctrine of the Russian Federation.

Retrieved 26 May 2018, from http://kremlin.ru/supplement/461

Ministry of Defence of the Russian Federation. (2011). Conceptual Views Regarding the Activities of

the Armed Forces of the Russian Federation in the Information Space. Retrieved 26 May 2018,

from http://www.ccdcoe.org/strategies/Russian_Federation_unofficial_translation.pdf

Ministry of Defence of the Russian Federation. (2014). The Military Doctrine of the Russian Federation.

Retrieved 26 May 2018, from http://rusemb.org.uk/press/2029

Ministry of Foreign Affairs. (2013, June 21). International Security Strategy - Policy note -

Government.nl [beleidsnota]. Retrieved 27 May 2018, from

https://www.government.nl/documents/policy-notes/2013/06/21/international-security-

strategy

69

Ministry of Foreign Affairs. (2017, February 12). International Cyber Strategy - Parliamentary

document - Government.nl [kamerstuk]. Retrieved 27 May 2018, from

https://www.government.nl/documents/parliamentary- documents/2017/02/12/international-

cyber-strategy

Ministry of Foreign Affairs. (2018, March 20). Geïntegreerde Buitenland- en Veiligheidsstrategie

(GBVS) - Rapport - Rijksoverheid.nl [rapport]. Retrieved 27 May 2018, from

https://www.rijksoverheid.nl/documenten/rapporten/2018/03/19/praatplaat-

geintegreerde-buitenland--en-veiligheidsstrategie-gbvs

Ministry of Foreign Affairs of the Russian Federation. (2016a). Doctrine of Information Security of the

Russian Federation. Retrieved 26 May 2018, from

http://www.mid.ru/foreign_policy/official_documents/-


Ministry of Foreign Affairs of the Russian Federation. (2016b). Foreign Policy Concept of the Russian

Federation (approved by President of the Russian Federation Vladimir Putin on November 30,

2016). Retrieved 26 May 2018, from http://www.mid.ru/foreign_policy/official_documents/-


Ministry of Security and Justice. (2011). The National Cyber Security Strategy (NCSS) - Strenght

Through Cooperation. Retrieved from https://english.nctv.nl/binaries/cyber-security-

strategy- uk_tcm32-83648.pdf

Ministry of Security and Justice. (2015). Voortgangsbrief Nationale Veiligheid 12 Mei 2015. Retrieved

31 May 2018, from https://www.nctv.nl/binaries/voortgangsbrief-nationale-veiligheid-12-

mei-2015_tcm31-32518.pdf

Ministry of Security and Justice. (2016, September 16). Nationale Veiligheid; Brief regering;

Voortgangsbrief Nationale Veiligheid [officiële publicatie]. Retrieved 31 May 2018, from

https://zoek.officielebekendmakingen.nl/kst-30821-32.html

Modderkolk, H. (2018). Dutch agencies provide crucial intel about Russia’s interference in US-

elections. Retrieved 27 May 2018, from https://www.volkskrant.nl/g-b4f8111b

National Coordinator for Security and Counterterrorism. (2013, May 14). National Cyber Security

Strategy 2 - From Awareness to Capability [webpagina]. Retrieved 27 May 2018, from

https://english.nctv.nl/binaries/national-cyber-security-strategy-2_tcm32-84265.pdf

National Coordinator For Security and Counterterrorism. (2017, November 23). Cybersecuritybeeld

Nederland 2017: Digitale weerbaarheid Nederland blijft achter op groeiende dreiging | NCSC

[webpagina]. Retrieved 3 March 2018, from

https://www.ncsc.nl/actueel/Cybersecuritybeeld+Nederland/cybersecuritybeeld-nederland-

2017.html

National Coordinator for Security and Counterterrorism. (2018, April 21). Nederlandse Cybersecurity

Agenda: Nederland digitaal veilig - Rapport - Rijksoverheid.nl [rapport]. Retrieved 27 May

70

2018, from https://www.rijksoverheid.nl/documenten/rapporten/2018/04/21/nederlandse-

cybersecurity-agenda-nederland-digitaal-veilig

Nye, J. S. (2016). Deterrence and Dissuasion in Cyberspace. International Security, 41(3), 44–71.

https://doi.org/10.1162/ISEC_a_00266

Radunovic, V. (2017, February 17). Towards a secure cyberspace via regional co-operation. Retrieved

4 March 2018, from https://www.diplomacy.edu/blog/new-study-towards-secure- cyberspace-

regional-co-operation

Rodrigues, M. (2017). Declaration By Miguel Rodríguez, Representative Of Cuba, At The Final Session

Of Group Of Governmental Experts On Developments In The Field Of Information And

Telecommunications In The Context Of International Security. Retrieved 25 May 2018, from

https://www.justsecurity.org/wp-content/uploads/2017/06/Cuban-Expert-Declaration.pdf

Schmitt, M. N. (2013). Tallinn Manual on the International Law Applicable to Cyber Warfare.

Cambridge University Press.

Schmitt, M. N. (2017). Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations.


Schmitt, M., & Vihul, L. (2014). The Nature of International Law Cyber Norms, 1–35.

Schmitt, M., & Watts, S. (2016). Beyond State-Centrism: International Law and Non-state Actors in

Cyberspace. Journal of Conflict and Security Law, 21(3), 595–611.

https://doi.org/10.1093/jcsl/krw019

Security Council of the Russian Federation. (2009). Russia’s National Security Strategy to 2020 -

Rustrans. Retrieved 26 May 2018, from http://rustrans.wikidot.com/russia-s-national-

security-strategy-to-2020

Security Council of the Russian Federation. (2013). Basic principles for State Policy of the Russian

Federation in the field of International Information Security. Retrieved 26 May 2018, from

http://www.scrf.gov.ru/security/information/document114/

Shannon, V. P. (2000). Norms Are What States Make of Them: The Political Psychology of Norm

Violation. International Studies Quarterly, 44(2), 293–316. https://doi.org/10.1111/0020-

8833.00159

Tamkin, E. (2017). 10 Years After the Landmark Attack on Estonia, Is the World Better Prepared for

Cyber Threats? Retrieved 5 June 2018, from https://foreignpolicy.com/2017/04/27/10-years-

after-the-landmark-attack-on-estonia-is-the-world-better-prepared-for-cyber-threats/

Trombetta, M. J. (2008). Environmental security and climate change: analysing the discourse.

Cambridge Review of International Affairs, 21(4), 585–602.

https://doi.org/10.1080/09557570802452920

United Nations. (2015). Charter of the United Nations: Chapter VII — Action with respect to Threats

to the Peace, Breaches of the Peace, and Acts of Aggression - Article 51. Retrieved 31 May

2018, from http://www.un.org/en/sections/un-charter/chapter-vii/index.html

71

United Nations General Assembly. (1998a). A/53/PV.79 - United Nations Official Document - General

Assembly Official Records Fifty-third Session 79th plenary meeting Friday, 4 December 1998,

10 a.m. New York. Retrieved 4 June 2018, from

http://www.un.org/en/ga/search/view_doc.asp?symbol=A/53/PV.79

United Nations General Assembly. (1998b). A/RES/53/70 - Developments in the field of information

and telecommunications in the context of international security. Retrieved 24 May 2018, from

http://undocs.org/A/RES/53/70

United Nations General Assembly. (1998c). First Committee Bureau - Disarmament and International

Security. Retrieved 4 June 2018, from https://www.un.org/ga/53/session/first/bureau1.htm

United Nations General Assembly. (2003). A/RES/58/32 - Resolution adopted by the General Assembly

on 8 December 2003. Retrieved 24 May 2018, from

http://www.un.org/en/ga/search/view_doc.asp?symbol=A/RES/58/32

United Nations General Assembly. (2010). A/65/201 - Report of the Group of Governmental Experts

on Developments in the Field of Information and Telecommunications in the Context of

International Security. Retrieved 24 May 2018, from

http://www.un.org/ga/search/view_doc.asp?symbol=A/65/201

United Nations General Assembly. (2011). Letter dated 12 September 2011 from the Permanent

Representatives of China, the Russian Federation, Tajikistan and Uzbekistan to the United

Nations addressed to the Secretary-General. Retrieved 24 May 2018, from

http://undocs.org/A/66/359

United Nations General Assembly. (2013a). A/68/98 - Report of the Group of Governmental Experts


International Security. Retrieved 24 May 2018, from


United Nations General Assembly. (2013b). A/68/156/Add.1 - Developments in the field of

information and telecommunications in the context of international security- Report of the

Secretary-Genera- Addendum** A/68/156/Add.1 - E. Retrieved 31 May 2018, from

http://undocs.org/A/68/156/Add.1

United Nations General Assembly. (2014a). A/RES/68/167 - Resolution adopted by the General

Assembly on 18 December 2013 - 68/167. The right to privacy in the digital age. Retrieved 31

May 2018, from https://ccdcoe.org/sites/default/files/documents/UN-131218-

RightToPrivacy.pdf

United Nations General Assembly. (2014b). A/RES/69/166 - Resolution adopted by the General

Assembly on 18 December 2014 - 69/166. The right to privacy in the digital a. Retrieved 31

May 2018, from http://undocs.org/en/A/RES/69/166

United Nations General Assembly. (2015a). A/69/723 - Letter dated 9 January 2015 from the

Permanent Representatives of China, Kazakhstan, Kyrgyzstan, the Russian Federation,

72

Tajikistan and Uzbekistan to the United Nations addressed to the Secretary-General.

Retrieved 26 May 2018, from http://undocs.org/A/69/723

United Nations General Assembly. (2015b). A/70/174 - Report of the Group of Governmental Experts


International Security A/70/174. Retrieved 25 May 2018, from


United Nations General Assembly. (2017). A/72/315 - Developments in the field of information and

telecommunications in the context of international security - Report of the Secretary-General.

Retrieved 4 June 2018, from http://undocs.org/A/72/315

Von Heinegg, W. H. (2015). International Law and International Information Security: A Response to

Krutskikh and Streltsov. International Law and International Information Security, 9, 1–17.

Von Solms, R., & Van Niekerk, J. (2013). From information security to cyber security. Computers &

Security, 38(C), 97–102. https://doi.org/10.1016/j.cose.2013.04.004

Weidmann, N. B. (2015). Communication, technology, and political conflict: Introduction to the special

issue. Journal of Peace Research, 52(3), 263–268.

https://doi.org/10.1177/0022343314559081

Weissbrodt, D. (2013). Cyber-conflict, cyber-crime, and cyber-espionage. Minnesota Journal of

International Law, 22(2), 347–387.

Zwienen, S. van. (2018, January 29). Na ABN AMRO en ING ook Rabobank getroffen door zware

cyberaanval. Retrieved 5 June 2018, from https://www.ad.nl/binnenland/na-abn-amro-en- ing-

ook-rabobank-getroffen-door-zware-cyberaanval~a0eae3f8/