What Cyberspace Regulation Can Learn from Traditional Arms Control

Can lessons from traditional Arms Control (AC), such as in relation to chemical weapons, offer useful guidance for future regulation of cyberspace despite the apparent distinctiveness of the weapon system involved? Drawing on expert interviews from the fields of cybersecurity, AC, and policy, this chapter argues that important conceptual lessons can be learned from traditional AC, as illustrated here using concepts from the Chemical Weapons Convention (CWC).¹

Why Look at Traditional Arms Control for the Regulation of Cyberspace?

We are seeing a rise in cyber incidents worldwide, increasingly linked to hybrid warfare, with cyberattacks becoming ever more targeted and destructive.² Cyber operations have become an increasingly influential instrument in international security and military conflict, where state and non-state actors employ offensive cyber capabilities for espionage, disruption, and attacks on critical infrastructure.³ While appropriate approaches to regulating cyberspace are urgently needed, no binding international AC or regulatory regime currently exists for cyberspace. Existing governance approaches mainly rely on voluntary norms, confidence-building measures, and informal cooperation. The key fora and institutions in the field are the Group of Governmental Experts on Advancing Responsible State Behaviour in Cyberspace in the Context of International Security (GGE), the Open-Ended Working Group on Developments in the Field of ICTs in the Context of International Security (OEWG), and the UN Treaty on Cybercrime, overall constituting a rather informal and fragmented normative regulatory structure.⁴

Arms control agreements have proven successful in many areas. “Arms control aims at preventing conflicts and fostering stability in inter-state relations by either reducing the probability of usage of a specific weapon or regulating its use and thus, reducing the costs of armament”.⁵ Approaches to AC can be diverse and may address aspects beyond the regulation of use. While scholars are skeptical about simply applying traditional AC measures to emerging technologies,⁶ we ask: What would effective AC measures for cyberspace look like? Instead of comparing regulatory approaches, we focus on the similarities in the challenges involved in regulating weapons; here “established arms control regimes are confronted with comparable challenges, including dual-use26 considerations and technological change”.⁷

We recognize that contemporary AC “captures the wide range of control initiatives that can be deployed to limit the instruments of armed violence”,⁸ including soft law approaches, such as informal norms and practices that are already established in this domain.⁹ Here, recent studies indicate a shift in cyber governance toward informal regulation and norms-based approaches.¹⁰ At the same time, norms-based regulation has always been an essential part of traditional AC. By assessing similar challenges across different weapon technologies, we aim to derive lessons for regulation and examine them against the backdrop of the growing importance of soft law approaches. As “informal governance mechanisms are already evolving to fill that governance gap”,¹¹ such mechanisms often serve as precursors to the formalization and standardization of these norms. This particularly concerns incorporating domain-specific expertise by non-state and private actors and building on their established practices. With a view to achieving chemical weapons disarmament, engineers and scientists played a central role in drafting the CWC.¹² Since the CWC is considered one of the most successful AC regimes, we will use it here as an example.

The Challenges of Regulating Cyber Weapons

One reason for the regulatory gap lies in the specific characteristics of cyberspace, compounded, inter alia, by the absence of a universally accepted international definition of what constitutes a cyber weapon. Building on our past work,¹³ we defend the validity and appropriateness of using the term cyber weapon, drawing extensively on scholars who have examined in detail the conceptualization of bellicose cyber operations as cyber weapons.¹⁴ As such, we consider definitional approaches that focus on the purpose and intent of cyber tools to be the most useful,¹⁵ i.e., “any computer equipment or device that is designed, intended or used to have violent consequences; that is, to cause death or injury to persons or damage or destruction of objects”.¹⁶ Similarly, the definition of chemical weapons in the CWC centers on the capacity of toxic chemicals to cause harm.¹⁷ Moreover, cyber technologies are dual-use, meaning they have both civilian and military applications or can be used for both offensive and defensive purposes. Dual-use cyber technologies can include cryptography and encryption software, intrusion software and spyware, as well as artificial intelligence (AI) and its harmful potentials.¹⁸ Furthermore, cyber technologies evolve rapidly, with software being continuously updated, modified, and integrated into diverse applications. It would therefore appear difficult to transfer traditional AC mechanisms based on counting, monitoring, or destroying weapons stockpiles to the cyber domain. Verification of actions in cyberspace presents a particular challenge, since commercial, state, and civilian applications are difficult to differentiate, quantitative limitations cannot be imposed, and cyber weapons are hard to track due to their non-physical nature. The private and commercial industry sector, in particular, is gaining importance in the cyber domain through its ownership of important infrastructure, operational rights, and state-of-the-art knowledge.¹⁹

From Chemical Disarmament to Cyberspace Regulation: What Can We Learn?

Common challenges in regulating both chemical substances and cyber technologies include the dual-use dilemma, verification difficulties, rapid technological change, and the significant role played by private actors. Experts highlight the fact that cyber weapons are harder to regulate than chemical weapons because they lack physical materiality. Verification therefore represents one of the most difficult challenges to effective cyberspace regulation. Traditional inspection regimes—such as the one established by the Organisation for the Prohibition of Chemical Weapons (OPCW)—would require intrusive access to sensitive systems and could expose state secrets or defensive capabilities. At the same time, technological change in cyberspace occurs much faster than in traditional AC domains. In addition, the private sector plays a much larger role because major parts of cyberspace infrastructure are privately owned and operated.

The success of the CWC was closely linked to historical experiences and the political conditions prevailing at the time of its negotiation, shortly after the end of the Cold War. Chemical weapons had already caused large-scale human suffering, creating a strong normative taboo against their use.²⁰ Experts argue that these conditions are not yet present for cyber weapons. Cyber capabilities also provide considerable strategic advantages for military operations, espionage, and intelligence gathering, reducing incentives for comprehensive restrictions.

Focusing on Context of Use Instead of Technologies

Despite these differences, experts identify several mechanisms from chemical weapons AC that could inform cyberspace regulation. One particularly relevant concept is the General-Purpose Criterion (GPC) contained in the CWC. Rather than prohibiting only specific substances, the GPC defines chemical weapons according to their intended harmful use. Applied to cyberspace, this approach would shift attention away from regulating specific technological applications—such as software or technical tools—and toward harmful behavior, intended effects, and prohibited targets such as critical infrastructure.

Experts, therefore, suggest that, rather than attempting to ban individual technologies, cyberspace regulation should define unacceptable actions and contexts of use. Behavior-based regulation is more adaptable to technological innovation, may help prevent regulatory loopholes, and could provide a means of addressing the dual-use problem.

Attribution and Verification of Cyber Operations

While traditional AC verification mechanisms are difficult to apply in cyberspace, experts repeatedly emphasize the growing importance of attribution. In the case of a suspected (cyber)attack, attribution refers to the identification of the actor responsible for the attack. Regarding cyber operations, attribution has become considerably more feasible in recent years due to improved technical capabilities and investigative expertise, and is already being carried out by the private sector and independent research institutes. Davis et al.,²¹ for example, demonstrate how stateless attribution is already being established in practice. Building on this, future cyber AC could rely less on intrusive inspections and more on trusted attribution structures. For example, Reinhold et al.²² have developed a method for eliminating matching cyber weapons stockpiles without the need for intrusive measures. In cyberspace, stockpiles refer to the collection of knowledge of vulnerabilities and exploits.²³ To adapt the managed access approach from chemical weapons disarmament verification for cyberspace would require technical expertise for fact finding and ensuring protection of sensitive data, as well as political credibility. At the same time, as with chemical weapons disarmament in general, this should take place within a multi-stakeholder framework. An independent institution, for instance under the auspices of the UN, could analyze cyber incidents, provide evidence, and support international accountability processes under the umbrella of a globally recognized attribution mechanism. Attribution alone would not solve all challenges. Questions regarding standards of evidence and political interpretation, as well as access to sensitive or classified data, would remain contested. Nevertheless, attribution represents one of the most realistic avenues for practical cyber verification.

The Path to Cyberspace Regulation

Cyberspace regulation is unlikely to begin with comprehensive disarmament treaties comparable to the CWC. Instead, progress will probably emerge through informal norms, i.e., soft law practices, comprehensive norm-building processes, and incremental governance mechanisms. However, soft law instruments and norm building are important prerequisites for potential future binding AC agreements. More and more research indicates shifts in the effectiveness of weapons regulations, suggesting that emerging disruptive technologies, in particular, might be better regulated by a combination of institutionalized regulation and informal norms (see, e.g., Schliebs & Vohs). Existing initiatives, such as UN expert groups, codes of conduct, and national responsible state behavior norms, already contribute to this process. Ultimately, the comparison with chemical weapons disarmament demonstrates that some of its elements could be applied to the regulation of cyberspace, but this would require long-term norm development, political will, and institutional trust. Cyber AC is therefore likely to develop incrementally, through a combination of behavioral norms, attribution practices, and international cooperation mechanisms, rather than through the immediate adoption of comprehensive bans. The next steps to advance this process could, therefore, involve integrating existing approaches to cyber attribution by incorporating the perspectives and practices of governments, the private sector, and nongovernmental organizations. Here, an agreed set of standardized norms and practices focusing on the context of use of cyber technologies against the backdrop of the GPC could be promising, with the goal of establishing an independent attribution mechanism.