Norms and Normalization
By Dr. Martin C. Libicki
| March 23, 2020
The search for norms has proven to be one of the most frustrating elements of cyberspace operations. Informed consensus holds that there should be norms of international behavior to tame the Wild West of cyberspace. Yet, if norms are defined to exist when a country refrains from operations otherwise in its interest[1] (taking domestic and international politics into account) they do not exist. That is, there are zero such norms that enjoy adherence that matters. In light of such disappointments, this paper mulls a different approach to thinking about norms. Rather than focusing on what responsible governments should not do, it looks at what they actually do as a guide to what activities in cyberspace have effectively been normalized (that is, within de facto norms)—and may remain normalized until the rewards from such activities no longer merit the effort. This argument has three parts. The first part discusses the lack of progress towards norms. The second defines normalization and examines the extent to which the behaviors of specific countries establish what has, in effect, been normalized. The third part focuses on one particular activity—implanting malware into the weapons systems of potential adversaries—as a candidate for normalization.
FULL ARTICLE HERE