5. Why Soft Measures Are Too Soft: International Law and Norms

This chapter advances two perspectives. First, while the strategy of using international legal frameworks and norms remains the popular recourse for many analysts of cybersecurity, its limited effects must be widely acknowledged and reflected in strategic considerations. While the rule of law has strong appeal for a broad base of citizens in liberal societies, we must remember that this strategy has long proven to be too “soft” to make deterrence work. Second, democracies’ limited success in strengthening the legal and normative regime has created an environment that is not conducive to their efforts to deter hackers. It has not only enabled authoritarian states to exercise their digital power against democratic states but also allowed other stakeholders to play a role in the governance of cybersecurity.