Cybersecurity Diplomacy: Business and Tech Replacing the States?

The domain of global politics was traditionally formed by state actors, especially in security affairs. However, the emergence of new technologies and subsequent challenges for nation states brought new actors to the table. In the past, states count on traditional diplomatic methods to cope with cybersecurity challenges: bilateral cybersecurity agreements, regional systems of cybersecurity (e.g. NATO, CIS, and SCO). Reality has shown, geographically isolated means are not efficient in cyberspace. New actors – private sector and technical community - are getting powerful, as they produce content, soft-/hardware, own and operate critical Internet infrastructure. A lack of cyber capacities for incident response and investigation forced the establishment of CERTs/CSIRTs. As the latter requires a high-level of trust and networking, the IGF (2017) discussed the phenomenon of CERT diplomacy. Governments are suspicious of each other due to different political reasons. Tech actors seem to be more cooperative in security issues and are highly interested in participating in cybersecurity debates. A demand for a global “code of conduct” for cyberspace is visible and Microsoft pioneered by proposing the Digital Geneva Convention – six basic principles for international cybersecurity. Finally, these developments must be evaluated in context of the 5th UN GGE failure to produce a consensus report on applicability of international law norms to cyberspace. The outcome signals the strong politicization of cybersecurity, an obstacle for further intergovernmental dialog on this level. The paper aims to trace a power shift from states to non-state actors in international cybersecurity and reveals current trends in cybersecurity diplomacy.