The unexpected norm-setters: Intelligence agencies in cyberspace

ABSTRACT

By implementing novel intelligence techniques in cyberspace, security and intelligence agencies have become major actors in the cybersecurity landscape. As they no longer just passively gather information for their governments but conduct both defense and offense operations in cyberspace, they signal international actors that their conduct is at least tolerable, even if not officially acceptable. Thereby, the intelligence agencies generate norms for the rest of the international community. Yet, they remain under the international regulation radar for being sub-state entities. Consequently, the main argument of this article is the following: To prevent the hollowing-out of cyber regulation efforts, the norm-setting role of intelligence actors should be taken into account when designing cyber norms.

KEYWORDS:

• Global cyber norms
• intelligence agencies
• norm-setters
• norm development
• cybersecurity policy
• regulation

Acknowledgements

This paper builds upon the conference paper “Intelligence agencies as international norm-setters,” presented on September 25, 2018, at the State of the Art of Cybersecurity and Cyberconflict Research Conference organized by ETH in Zurich.

Disclosure statement

No potential conflict of interest was reported by the author.

Notes on contributor

Ilina Georgieva is a Ph.D. candidate of The Hague Program for Cyber Norms. In her research, she is focusing on the capacity of intelligence agencies to propagate cyber norms by means of their conduct in cyberspace, and to thus shape the international community's perception of what is normal in cyberspace. For that purpose she investigates the agencies’ normative power by looking into their practice of foreign bulk data collection. Prior to joining the Institute of Security and Global Affairs, Georgieva served as a researcher on the Sweetie 2.0 Project at eLaw, the Center for Law and Digital Technologies at Leiden University. Her research encompassed a comparative legal study concerning the trans-border investigation of webcam child sex tourism. While at eLaw, she also co-authored a comparative study on data protection policies in eight different EU jurisdictions.

ORCID

Ilina Georgieva http://orcid.org/0000-0002-3747-191X

Notes

1 Of course, when it comes to diplomatic risks, intelligence operations are closely coordinated with the respective foreign affairs authorities. This, however, is often not the case with cyber operations, in which the agencies have a large margin of appreciation.