CSBMs for the Cyber Realm

Abstract

Armed forces of many countries are preparing cyber warfare. Without limitations there is an arms race with a strong danger of escalation. As with other destabilizing weapon systems, arms control is advisable, but this meets difficulties. Cyber weapons are not as tangible and countable as tanks or combat aircraft. As long as cyber arms control is not in place, confidence (and security) building measures (C(S)BMs) can act as first steps in reducing threat perceptions and damping escalation. States have started considering CBMs, e.g., in the UN. The strongest measures are recommended in the Organization for Security and Co-operation in Europe (OSCE). These voluntary measures do not mention cyber forces explicitly, but they are included. The OSCE has a wealth of experience with CSBMs in the traditional military domains. Several of these measures could be transferred to the cyber realm, e.g., exchanges about the force structure and about policy and doctrines, contacts and visits, prior notification of exercises, inspections, and evaluation visits. With or without formal CSBMs, an international monitoring system for cyberspace would be useful. It would provide threat detection and attack early warning, support in emergencies, and reporting of vulnerabilities. Such an infrastructure would foster information sharing and collaboration toward acceptable norms for state behavior in the cyber sphere.