Deviation from the Norms: The Necessity and Challenges of a Norms-based Approach to Digital Offense

One of the few areas in which the tech and policy communities generally agree is the need for norms to guide acceptable behavior in the digital domain. Given the increasingly vocal demand for—and noted cases of—greater retaliatory capabilities within the private sector, this is a necessary discussion and directly impacts security and privacy. With everything from cyber militias to full-fledged hacking back capabilities entering the discourse, there is a significant need for policy innovation and creativity that can set the foundation for the broader establishment of global norms. However, there are significant hurdles to norm implementation and a clear lack of comprehension of those factors that impact norm diffusion, including the technical difficulty of verification, outdated policies, as well as collective action problems and expected utility challenges. Despite these hurdles, the US must continue to attempt to shape global digital norms. Otherwise, other states will fill that void. And to get it right, tech community collaboration is required to avoid another Wassenaar situation. This presentation will discuss the opportunities and challenges of norm diffusion, while embedding the discussion in the recent discourse on offense-based behavior, which has significant implications for both security and privacy.