Recent years have seen a mounting concern in the United States over foreign efforts to harm election security or legitimacy through cyber means, increased cyber espionage, and attacks of growing sophistication. The United States has been engaged for almost a decade in international negotiations over agreed normative constraints on such activities, but the prospects for a comprehensive international agreement appear dim.
In this report, the authors develop a renewed agenda for utilizing cyber norms to limit destabilizing behavior in cyberspace. To do so, they survey the literature on norms and norm emergence and describe the process by which norms tend to arise. They identify the common and conflicting interests that major states have in cyberspace, summarize the history of intergovernmental and private-sector initiatives on cyber norms, outline the principles governing U.S. policy on the issue since 2007, and survey current proposals for cyber norms.
Based on this analysis, the authors propose a bottom-up, “outside-in” approach to promoting cyber norms that would allow the United States to bypass current international disagreements to encourage the development of norms to constrain the most destructive and escalatory forms of cyber aggression.
This research was sponsored by the Office of the Secretary of Defense and conducted within the Cyber and Intelligence Policy Center of the RAND National Security Research Division (NSRD).
This report is part of the RAND Corporation Research report series. RAND reports present research findings and objective analysis that address the challenges facing the public and private sectors. All RAND reports undergo rigorous peer review to ensure high standards for research quality and objectivity.
This document and trademark(s) contained herein are protected by law. This representation of RAND intellectual property is provided for noncommercial use only. Unauthorized posting of this publication online is prohibited; linking directly to this product page is encouraged. Permission is required from RAND to reproduce, or reuse in another form, any of its research documents for commercial purposes. For information on reprint and reuse permissions, please visit www.rand.org/pubs/permissions.
The RAND Corporation is a nonprofit institution that helps improve policy and decisionmaking through research and analysis. RAND’s publications do not necessarily reflect the opinions of its research clients and sponsors.