Cyber Diplomacy, International Norms, and Deterrence
The international frame
This domain covers how states behave in cyberspace and the rules they have agreed to. Know the UN frameworks: the Group of Governmental Experts (GGE) and Open-Ended Working Group (OEWG) produced voluntary norms of responsible state behavior. Key norms: states should not knowingly allow their territory to be used for internationally wrongful acts, should not attack critical infrastructure, should respect supply-chain integrity, and should respond to requests for assistance.
Understand international law applicability: the UN Charter (sovereignty, prohibition on use of force, self-defense under Article 51), international humanitarian law (distinction, proportionality, precaution), and due diligence. A trap is treating these norms as binding treaties - most are voluntary and politically, not legally, enforceable.
Deterrence has layers: denial (make attacks fail), punishment (cost imposition via sanctions, indictments, or counter-operations), and normative (naming and shaming). Attribution underpins all of them - technical, all-source, and public attribution carry different confidence and political weight. Expect questions distinguishing espionage (generally tolerated), crime (enforcement matter), and armed attack (may trigger self-defense).
Confidence-building measures (hotlines, transparency, exercises) reduce miscalculation. Rules of the road and responsible state behavior are the diplomatic vocabulary.
Rule of thumb: Voluntary norms shape expectations; binding law constrains force. When a question asks whether a norm is enforceable, the answer is usually no unless it reflects customary or treaty law.