Euroviews. Don’t sanction cyberweapons — sanction how they’re used

Cyberspace, encompassing the internet and other connected digital technologies, offers tremendous benefits but also poses significant risks as a military domain. This necessitates the existence of increased cybersecurity and cyber diplomacy.

The discussion and regulation of the militarisation of cyberspace have gained relevance due to greater uses in modern conflicts. The war in Ukraine is an example of an open military conflict also occurring in cyberspace.

Historically, arms control has been vital in preventing military escalation. Yet, creating applicable and verifiable measures for cyber arms control is challenging due to the unique nature of cyberspace.

A recent analysis conducted with colleagues from Technical University Darmstadt highlights several key obstacles:

A fundamental challenge for establishing arms control in cyberspace is the lack of clear, uniform definitions of key terms. This is especially relevant since the conventional definition of a weapon does not truly relate to the characteristic of a cyberattack used as a “cyberweapon”.

Cyberweapons tend to be data and knowledge that are capable of being conceived and executed to compromise the integrity, availability, or confidentiality of an IT system without the owner's consent.

Thus, some experts we spoke with debated that the concept of a cyberweapon itself does not exist since a weapon suggests some sort of kinetic, physical use. Cyberattacks exploit vulnerabilities in technology and can lead to real-world physical problems, but does that mean the trigger was a cyber ‘weapon’?

This ambiguity makes it difficult to establish what would be controlled under a cyber arms treaty.

Many everyday technologies, like computers and USB sticks, have both civilian and