To foster accountability, upholding international law and international norms for responsible state behaviour is essential. This includes existing treaties and agreements, such as the UN Charter, and the 11 UN norms on responsible state behaviour in cyberspace, but also a plethora of relevant bilateral and multilateral agreements. Such accountability starts with effective attribution, requiring a more agile and rapid process for attribution determinations and consensus –building, particularly among aligned coalitions of states like those within the NATO alliance or the EU. To this date, perpetrators of malicious cyber operations rarely face significant responses, be it through public attribution or imposing costs such as sanctions.
The lack of effective enforcement of current norms and the insufficient impact of attributing cyber actions reveals the need for greater consistency in the application of existing norms and possibly stronger deterrence measures. These strategies should seek to reduce perceived benefits of cyberattacks and amplify potential costs. Discussions on cyber deterrence need to centre on establishing clear criteria for evaluating harm from cyber incidents in order to determine proportional countermeasures, for instance by defining when cumulative effects of cyberattacks can amount to an armed attack, etc. These criteria will aid in defining appropriate countermeasures. Additionally, like-minded nations may need to accept that deterrence will require meaningful steps and the willingness to act if red lines are crossed.
Accountability through common norms and attribution
Agreeing new initiatives to advance norms discussions at the international level is critical, so proposals such as the UN Programme of Action on cybersecurity are welcome. It is also crucial to think about how existing norms can promote accountability in smaller partnerships. Successful enforcement of norms depends on being able to attribute cyberattacks to states. Timely attribution of state-sponsored cyberattacks publicly and privately is crucial for effective deterrence in cyberspace. Yet, in the European context, there seem to be multiple components that complicate public attribution. First, decision-makers may be reluctant to make public attributions due to persisting concerns that these will result in pressure to impose consequences on perpetrators that could escalate conflicts and amplify geopolitical tensions. Moreover, a lack of capacity may be a further obstacle to effective attribution. However, there are positive examples of public attributions, demonstrating both willingness and capacity, namely the joint attribution made by the Czech Republic with Germany, the EU and NATO in May 2024, denouncing activities by a Russian state-controlled actor. Existing efforts such as the
EU Cyber Diplomacy Toolbox provide a framework for using the EU’s Common Foreign and Security Policy measures to "prevent, deter and respond to malicious cyber activities" and to make joint attributions. One key challenge seems to be that Member States (MS) may be reluctant to utilize the toolbox sufficiently as it requires the sharing sensitive data across all EU MS and unanimous decision-making. These barriers ultimately result in preferences by MS to favour unilateral rather than collective attribution. Such attribution tends to be ad hoc and less effective in consolidating deterrence efforts. Hence, structural challenges European actors face in individual and collective attribution should be addressed to improve the impact of public attribution. Outside the EU, NATO could be another suitable forum for addressing alignment challenges with transatlantic partners in attributing attacks. The NATO Cyber Defence Pledge and the Comprehensive Cyber Defence Policy focus on improving information sharing, mutual assistance and coordination of collective responses to cyber-attacks. However, similar to the EU, attribution decisions are taken individually by NATO members, not by the Alliance itself. Solutions should focus on fostering a culture of confidence to make use of existing frameworks and processes which leverage cooperation at both EU and NATO level.
Deterrence through consequences
As current costs imposed on bad actors have proven insufficient to stop them from conducting further cyberattacks, more effective deterrence will need to include commitments to imposing more robust, dynamic and creative sets of countermeasures when adversaries wilfully violate clear international expectations. The goal is to reduce the perceived benefits and drive up the perceived costs of cyberattacks. To set uniform criteria, it’s crucial to agree on when cyberattacks constitute the 'use of force' or an 'armed attack' that could warrant proportionate reactions by affected states. Codifying common definitions and understanding at EU and NATO level, can shape the debates at UN level.
