Is the international law of cyber security in crisis?

Several indicators suggest that the international law of cyber security is in the midst of a crisis. First, proposals of internationally binding treaties by the leading stakeholders, including Russia and China, have been met with little enthusiasm by other states, and are generally seen as having limited prospects of success. Second, states are extremely reluctant to commit themselves to specific interpretations of the controversial legal questions and thus to express their opinio juris. Third, instead of interpreting or developing rules, state representatives seek refuge in the vacuous term `norms'. This paper argues that the reluctance of states to engage themselves in international law-making has generated a power vacuum, lending credence to claims that international law fails in addressing modern challenges posed by the rapid development of information and communication technologies. In response, a number of non-state-driven norm-making initiatives have sought to fill this vacuum, such as Microsoft's cyber norms proposal or the Tallinn Manual project. The paper then contends that this emerging body of non-binding norms presents states with a critical window of opportunity to reclaim a central law-making position, similarly to historical precedents including the development of legal regimes for Antarctica and nuclear safety. Whether the supposed crisis of international law will lead to the demise of inter-state governance of cyberspace or the recalibration of legal approaches will thus be decided in the near future. States should assume a central role in the process if they want to ensure that the existing power vacuum is not exploited in a way that would upset their ability to achieve their strategic and political goals.