States advance on agreeing international norms in cyber operations

On 15 April 2021, the United States sanctioned several Russian entities for their involvement in the SolarWinds hack, a cyber-espionage operation that it attributed to the Russian Foreign Intelligence Service (Sluzhba vneshney razvedki: SVR). Washington denounced the attack on the supply chain and the undue burden on the private sector and invoked Russia’s past behaviour as an argument for strongly responding to the cyber operation. However, it is less clear why the US adopted sanctions for this particular cyber-espionage campaign, as many other examples exist. As explained by Robert Chesney in a blog post on Lawfare on 15 April 2021, it is difficult to establish “what normative line did Russia cross”.

The SolarWinds hack and other malicious cyber activity also refocus attention on international efforts to establish norms for regulating behaviour in cyberspace. The United Nations Open-Ended Working Group (OEWG) on information and communication technologies (ICTs), in the context of international security, adopted its final report (UN document A/75/816) on 12 March 2021, offering an opportunity to review past agreements made at the UN level and to ask what they might mean for current and future intelligence agency operations in cyberspace.

General Paul Nakasone, director of the National Security Agency, addresses a hearing of the House Armed Services Subcommittee on Cyber, Innovative Technologies, and Information Systems in Washington, D.C., on 14 May 2021. He took questions regarding the Department of Defense’s preparations for action to prevent future cyber attacks. (Anna Moneymaker/Getty Images)

Multilateral pathway

The digital revolution has brought tremendous social, economic, and political opportunities for societies, but it has also been accompanied by new threats that push the limits of even what science fiction has imagined. As Frédérick Douzet wrote in an article published in June 2020 in French geopolitical magazine Hérodote