Waiting for Attribution in Cyberspace: A Tragicomedy

With apologies to Samuel Beckett.

ACT I.

An office conference room. New York City. November afternoon.

Melian, sitting alone at a well-polished conference table, is drifting in and out of sleep. His office chair seesaws dangerously backwards. Enter Norm.

Norm: I’m looking for purpose.

Melian: [snaps awake] Huh? Yes, aren’t we all.

Norm: To exist.

Melian: I don’t follow you, Norm.

Norm: Sure, I help guide appropriate State behavior, but I feel downright invisible when States don’t observe me.

Melian: Nothing to be done, I suppose.

Norm: My parents, the UN Group of Governmental Experts, always told me and my siblings – there are 11 of us– that we’d grow up and change the world. Create an open, secure, and peaceful cyberspace.

Melian: My parents just told me to get a job.

Norm: Don’t joke. [Pause.] I’m rather sensitive.

Melian: Perhaps that’s why some States ignore you.

Norm: I don’t follow your logic, Melian.

Melian: Like people, States choose to either observe norms or ignore them based on self-interests and risk preferences.

Norm: [panicking]I can’t breathe, quick! [Pause.] Open that window!

Melian: [effortlessly opens window] Not surprised. There’s little oxygen for norms in poorly governed environments.

Norm: [gasps for air] Maybe…I…need…

Melian: [chuckling] Easy now. Take deep breaths.

Norm: [panting] …need to re-invent myself, eh?

Melian: Being ignored doesn’t mean States don’t understand responsible state behavior in cyberspace. I ignore stop signs, but never said I was a good driver.

Norm: [starting to sweat] I swear it’s getting warmer in this room. I need to lay down.

Melian: [pours glass of water] Drink this.

Norm: [drinks greedily] I thought 2021 would be a better year.

Melian: Thankfully, time passes.

Norm: We were so hopeful last March when the UN Open-Ended Working Group agreed to endorse all 11 of us voluntary, non-binding norms of responsible state behavior.

Melian: [waves newspaper headline in Norm’s face] And yet, here we are.

Norm: Something should be done.

Melian: Grow a beard?

Norm: Be serious.

Melian: [winces] I’m trying. But it hurts.

Norm: Something must be done when some States deliberately choose to ignore us.

Melian: Eh, they probably won’t change unless they think the risks outweigh the benefits.

Norm: How irresponsible.

Melian: Rational self-interest.

Norm: Then I don’t need to re-invent my public image.

Melian: But you could use a bath.

Norm: [wipes sweat from brow] Getting down to the real issue: it’s determining what to do when States consciously ignore me and my siblings.

Melian: Sure, that too. And understanding how to best impose consequences for failing to observe norms to promote accountability.

Norm: [excitedly] Yes! And encourage more norms-observing States. A normative framework exists! [pause] I – we – exist!

Melian: So I’m told.

Norm: [puts down glass seriously] But we haven’t talked about proportional responses to events in cyberspace.

Melian: [looks at clock on wall] Strange. He should have been here by now...

Norm: Who?

Melian: Mr. Attribution. He’s in the business of attributing hostile cyber acts to actors.

Norm: Sounds political. Perhaps he can help us.

Melian: Perhaps.

Norm: All this talk of imposing consequences has me worried about escalating an “arms race” in cyberspace.

Melian: [groans] Not this again.

Norm: Hear me out this time!

Melian: There’s never been a single cyber incident that caused conflict escalation. Zero.

Norm: But every action carries a degree of risk. Also, I was raised very strictly to believe in cyber deterrence.

Melian: [holds head] I’m getting a migraine.

Norm: I prefer consequences to be diplomatic – like censures, or legal indictments. Or economic sanctions. Maybe a use of force if the circumstances call for it.

Melian: [exasperated] I thought you wanted to be observed!

Norm: [indignantly] I do! Peacefully.

Melian: Communicating the range of consequences to States is just as important as accompany it with action when violated.

Norm: Life is too hard.

Melian: If States don’t observe you, Norm, or take you credibly, that’s just as harmful and destabilizing on international relations.

Norm: [sighs heavily] Perhaps Mr. Attribution will know what to do.

Melian: Perhaps. Let’s wait.

Norm: Perhaps. Let’s see.

Curtain.

Zhanna L. Malekos Smith, JD, is a senior associate with the Strategic Technologies Program at the Center for Strategic and International Studies (CSIS) in Washington, D.C., and an assistant professor in the Department of Systems Engineering at the U.S. Military Academy at West Point.

All views, positions, and conclusions expressed in this publication are those of the author and not that of CSIS, the Department of Defense, or the U.S. government.