Developing collaborative and cohesive cybersecurity legal principles

Legal discussions about combatting global cyber threats often focus on international cybercrime arrangements or the application of the law of war to cyberspace. While these discussions are vital, policy-makers and scholars have not devoted adequate attention to creating a global legal framework to bolster the defenses of public and private infrastructure. Due to the interconnected nature of cyberspace and the cross-border impacts of attacks, inadequate security in one country could harm another. To build cyber strategies that rely in part on defense and deterrence by denial, governments should also focus both on the security of their systems and those of the private sector. Industry has been the target of some of the most destructive cyberattacks worldwide. Guiding international principles for a cyber security legal framework would help nations to build effective laws that reduce the likelihood of successful attacks, and increase resilience after attacks occur. Moreover, international collaboration on cybersecurity laws provides multinational companies with a more coherent legal framework. A patchwork of hundreds of different international security requirements is not only burdensome for companies, but it increases the potential for vulnerabilities, particularly if the company operates in countries with less stringent cybersecurity requirements. This paper sets out the need for nations to discuss common legal principles for promoting and regulating cybersecurity, similar to the privacy principles articulated in the Organization for Economic Cooperation and Development's Fair Information Practices in 1980. As a starting point for discussion, this paper suggests four goals of common international principles for cybersecurity law: (1) modernization of cybersecurity laws; (2) uniformity of legal requirements; (3) coordination of cooperative incentives and coercive regulations; and (4) supply chain security. Although cybersecurity laws will always vary, international coordination could improve their efficacy by providing some degree of consistency. A dialogue also could help policy-makers learn from other nations' cybersecurity successes and failures.