1 Introduction

This book defines “positive cyber peace” as a digital ecosystem that rests on four pillars:

These pillars merit broad support for their emphasis on justice, good governance, and diffusion of technology to bridge the so-called “digital divide.” They were developed through a global vetting process over time and in different fora, and they represent views of technologists, civil society thought leaders, and representatives of intergovernmental organizations (see Permanent Monitoring Panel on Information Security of the World Federation of Scientists, 2009; Shackelford, Reference Shackelford2014). Nevertheless, the conceptualization of cyber peace and its pillars deserves further probing. Is cyber peace really a kind of peace? International relations and global studies theories include a substantial body of literature on peace, a condition and/or a relation that is both more capacious than the pillars and, perhaps, in some ways inconsistent with them. In addition, the pillars seem to be different kinds of things. The first refers to abstractions that are instantiated in law and take form through the practices of governments. The second is a diffusion of a technology along with technical standards. The third is a preference for a certain form of governance, and the fourth once again brings up a technical issue, but then pivots to sustainability. If the pillars are supporting an edifice, they are doing so unevenly.Footnote ¹ In this chapter, I probe the ontological basis of the concept of cyber peace and uncover tensions in the meanings embedded in it.

The task begins with ontological questions about what kind of thing cyber peace is. This section draws on the definitions cyber peace advocates use to taxonomize the stated or implied assumptions about cyber peace as a condition or as a set of practices. As a condition, cyber peace is sometimes defined as a kind of peace, and at other times as something within cyberspace. Distinct modes of ontologizing cyber peace as a set of practices include cyber peace as cyber peacemaking, as maintaining the stability of information technology, and/or as cyber defense actions. The second section looks to international relations and cognate field scholarship for insight into further honing the conceptualization of cyber peace. The topics in this section include unpacking cyber as a modifier of peace, unpacking the concept of peace itself, exploring the boundaries of cyber peace by looking at how it is different from similar social things, and analyzing the implications of metaphors associated with cyber peace. The chapter concludes with a brief comment on the intent of the critique.

2 Contending Definitions

The ontological question is what kind of thing is cyber peace or would it be if it were to exist?Footnote ² Unless practitioners and scholars can come to some kind of consensus around the ontological nature of cyber peace the project risks incoherence. As cyber peace has slipped into the lexicon, beginning around 2008, the term has been used differently by the several interlocutors who draw upon it. Cyber peace is sometimes understood as a social condition or quality, sometimes as a set of practices, and sometimes as both. In this section, I interpret some core texts to tease out differences between the meanings and discuss the theoretical consequences of the differences.Footnote ³

In drawing upon a text, I do not mean to imply that my short selections are representative of everything authors think about cyber peace, or that their definition is incorrect. Instead, I use these different articulations to show the variety of ways cyber peace is imagined. Highlighting the unsettledness of the essence of cyber peace is the point of the exercise.

3 The Condition of Cyber Peace

An early use of the word “peace” in the context of cyberspace and the Internet is a 2008 forward written by the former Costa Rican president and Nobel laureate, Óscar Arias Sánchez, for the International Telecommunications Union’s (ITU) report on the ITU’s role in cybersecurity (Arias Sánchez, Reference Arias Sánchez2008). He referred to the need to promote “peace and safety in the virtual world” as “an ever more essential part of peace and safety in our everyday lives” and the urgency of creating a “global framework” to provide cybersecurity (p. 5). He implied that this safe place within cyberspace can be implemented through intergovernmental coordination around cybersecurity practices. The result would be to create the condition of feeling secure, very much along the lines of what one expects from the concept of “human security” (Paris, Reference Paris2001; United Nations Development Program, 1994). Techniques, such as the adoption of cybersecurity best practices, Arias suggested, are tools that promote this safe world, but these tools are not themselves cyber peace. In context, it seems that peace and safety are not two separate goals but rather one: Safety as peace – either as a kind of peace or perhaps as a part of peace.

Ungoverned cyberspace is dangerous because of “the pitfalls and dangers of online predators” (Arias Sánchez, Reference Arias Sánchez2008, p. 4) who inhabit it. As a state of (albeit non-) nature, it is a Hobbesian (Hobbes, Reference Hobbes1651) world of war and crime or, more precisely, the disposition toward violence which could break out at any time. This ungoverned, dangerous world of cyberspace is to be cordoned off and, perhaps, eliminated. Global coordination on cybersecurity is thus essential to promote the condition of safety.

Hamadoun Touré, writing in the introduction to The Quest for Cyber Peace, a joint publication of the ITU and the World Federation of Scientists (WFS), similarly seems to draw upon this Hobbesian view of ungoverned cyberspace when he writes that “[w]ithout mechanisms for ensuring peace, cities and communities of the world will be susceptible to attacks of an unprecedented and limitless variety. Such an attack could come without warning” (2011, p. 7). He continues, enumerating some of the devastating effects of such an attack. Touré’s description suggests that conditions of cyberspace could break the security provided by the sovereign state (the leviathan) to its citizens. Violence is lurking just under the surface of our cyber interactions, waiting to break out. Touré, in a policy suggestion consistent with some liberal institutionalists’ thinking in international relations, understands the potential of an international regimeFootnote ⁴ (though he does not use that term) of agreed-upon rules that would provide the condition of cyber peace in the absence of a single authoritative ruler. Arias and Touré both envision cyberspace as having a zone of lawlessness and war and a zone of safety and peace.

Henning Wegener’s (Reference Wegener and Touré2011) chapter in The Quest for Cyber Peace defines cyber peace more expansively than Touré did. More importantly, Wegener’s ontology is subtly different from the division of cyberspace into the peaceful and violent zones I associated with Arias and Touré. Wegener writes:

By identifying cyber peace as a kind of peace rather than as a carve out of cyberspace, Wegener shifts the focus away from cyberspace as the world in which cyber peace exists or happens and, instead, connects to the material reality of the geopolitical world. The distinction is illustrated in Figure 1.1. The image on the left represents the definition invoked by Arias and Touré. The image on the right represents the definition invoked by Wegener.

Figure 1.1 Different ontologies of cyber peace as conditions. On the left, both cyber peace and cyber war exist as kinds of social conditions within places of cyberspace. Cyber war is always attempting to penetrate and disrupt cyber peace. On the right, cyber peace is a subset of global peace, along with other kinds of peace.

4 Cyber Peace as Practices

Other interlocutors use the phrase “cyber peace” to refer to practices, which can range from using safer online platforms for cross-national communication to “cyber peace keeping” or “cyber policing” to engineering a robust, stable, and functional Internet. This approach is consistent with (though not intentionally drawing upon) what has been called the “practice turn” in international relations (Adler & Pouliot, Reference Adler and Pouliot2011; for example, Bigo, Reference Bigo2011; Parker & Adler-Nissen, Reference Parker and Adler-Nissen2012; Pouliot & Cornut, Reference Pouliot and Cornut2015). Practices constitute meaningful social realities because of three factors. First, it matters that human beings enact practices, because in doing so we internalize that action and it becomes a part of us. Second, there is both a shared and an individual component to practices. Individuals are agentic because they can act; the action has social relevance because others act similarly. Third, practices are constituted and reconstituted through patterned behavior; in other words, through “regularity and repetition” (Cornut, Reference Cornut2015). Since cyber peace is an aspiration rather than something that exists now, a practice theory focus could point toward emerging or potential practices and how they are accreting.

One example of this aspirational view of practices can be found in the 2008 report, “Cyber Peace Initiative: Egypt’s e-Safety Profile – ‘One Step Further Towards a Safer Online Environment’,” which defines cyber peace in terms of young people engaging in the practices of communicating and peacemaking.Footnote ⁵ According to Nevine Tewfik (Reference Tewfik2010), who summarized the findings in a presentation to the ITU, information and communications technologies (ICTs) “empower youth of any nation, through ICT, to become catalysts of change.” These practices would then result in a more peaceful condition in geophysical space. Specifically, the end result would be “to create safe and better futures for themselves and others, to address the root causes of conflict, to disseminate the culture of peace, and to create international dialogues for a harmonious world” (p. 1). The report emphasized the initiative’s efforts to promote safety of children online. An inference I draw from the presentation slides is that the dissemination of the culture of peace happens when children can engage safely with each other online. Cyberspace can be a place where children – perhaps because of their presumed openness to new ideas and relations – engage in peacemaking. Thus, the benefits of the prescribed cyber peace activities would spill over into the geophysical world.

Cyber peace is often defined as practices that maintain the stability of the Internet and connected services. (The tension between stability and peace will be discussed later.) Drawing on this definition leads advocates to argue for prescriptions of protective behaviors and proscriptions of malign behaviors to maintain the functional integrity of the global ICT infrastructure. Key to this is the connection between a stable global network of ICTs and the ability to maintain peaceful practices in the geophysical world. The WFS, for example, had been concerned with all threats to information online (“from cybercrime to cyberwarfare”), but the organization’s permanent monitoring panel on information security “was so alarmed by the potential of cyberwarfare to disrupt society and cause unnecessary harm and suffering, that it drafted the Erice Declaration on Principles of Cyber Stability and Cyber Peace” (Touré & Permanent Monitoring Panel on Information Security of the World Federation of Scientists, Reference Wegener and Touré2011, p. vii). The declaration states: “ICTs can be a means for beneficence or harm, hence also as an instrument for peace or for conflict” and advocates for “principles for achieving and maintaining cyber stability and peace” (Permanent Monitoring Panel on Information Security of the World Federation of Scientists, 2009, p. 111). These principles about how to use ICTs are, in fact, practices. By adhering to the principles and acting properly, engagements in cyberspace and ICTs promote peace in the world. The declaration seems to refer to a general condition combining life as normal without the disruptions that warlike activities cause to “national and economic security,” and life with rights, that is human and civil rights, “guaranteed under international law.”

In other words, for this declaration stability is a desired characteristic of cyberspace and peace is a desired characteristic of life in the world as a whole. However, it does not follow that stability is inherently peaceful, unless peace is tautologically defined as stability. The absence of cyber stability might harm peace and the presence of cyber stability might support peace, but the presence of stability is not itself peaceful, nor does it generate peace.Footnote ⁶ At best, we can say that peace is usually easier to attain under conditions of stability.

Another text focusing on cyber peace as a set of practices is the Cyberpeace Institute’s website. It first calls for “A Cyberspace at Peace for Everyone, Everywhere,” which seems to hint at cyber peace as a condition of global society, but the mission of the organization is defined primarily as the capacity to respond to attacks, and only secondarily as strengthening international law and the norms regarding conflictual behavior in cyberspace. Indeed, defense capacity is emphasized in the explanation that “The CyberPeace Institute will focus specifically on enhancing the stability of cyberspace by supporting the protection of civilian infrastructures from sophisticated, systemic attacks” (CyberPeace Institute – About Us, 2020). The ability to mount a swift defense in response to an attack does not create peace, it simply means that our defenses may be strong enough that the attacks do not disrupt the stability of the Internet and other information technologies.

These conceptualizations of cyber peace as collections of practices thus ontologize kinds of cyber peace, which are distinct, but comparable. By comparing them, we can see underlying tensions regarding what can be considered peaceful – Is it peace making or securitization (defense and stability)? – though, as noted in the descriptions above, no collection of practices is wholly of one type. Figure 1.2 depicts different collections of practices that have been bundled together as the definition of cyber peace. (For clarity, I have not shown overlaps.) All of these conceptualizations are proposed against a background of a regulatory regime of implementing and enforcing laws.

Figure 1.2 Cyber peace as the sum of practices in both securitized and non-securitized conceptualizations, against a shared background of implementing and enforcing a regulatory regime of laws.

5 Cyber Peace as Both Conditions and Practices

A third category blends conditions and practices, seeing the condition of cyber peace emerge as greater than the sum of its constituent parts, which are practices. In an early iteration of his work on this concept, Scott Shackelford (Reference Shackelford2014) paints this sort of hybrid picture of cyber peace. He claims that the practices of polycentric governance related to cybersecurity spill over into a positive cyber peace:

This can happen, Shackelford suggests, through a process of building up governance on limited problems, thereby proliferating the number of good governance practices. The polycentric governance model specifically rejects a top-down monocentric approach:

These interconnected, overlapping, small to medium-scale governance practices build upward in Shackelford’s model and could eventually become a thick cybersecurity regime. When the regime is thick enough, cyber peace obtains. This model relies on a securitized notion of cyber peace, despite the discussion in the text of positive cyber peace that is more far-reaching than just the absence of war. His more recent work, co-authored by Amanda Craig, expands cyber peace to include global peace-related issues and practices, including development and distributive justice. They write:

Figure 1.3 depicts this model of best practices developed from the ground up, ultimately producing a kind of cyber peace that exceeds the summation of all the different practices.

Figure 1.3 Peaceful practices and shared background emerge as cyber peace, which is greater than the sum of its parts.

The point of this exercise of categorizing different definitions of cyber peace is to say that a definitional consensus has not been reached and to remind ourselves that the ontology built into our definitions matters for how we think about what sounds like a very good goal. Moreover, ontological foundations matter for how the practitioners among us craft policies in pursuit of that goal.

6 Honing the Concept of Cyber Peace

The four parts of this section critically engage further with cyber peace, pointing to conceptual elements that could be productively honed to make a sharper point. The point here is not to provide an answer of what cyber peace is or should be but, rather, to draw upon scholarship from international relations and cognate fields to uncover contradictions and missed implications of the current usage. I begin by taking a closer look at “cyber” and “peace” and then turn to the boundaries of cyber peace as a social thing, followed by a discussion of the consequences of some of the metaphors associated with cyber peace.

7 Boundaries

The next topic is boundaries and the distinctions that create them. An argument can be made that we are witnessing the creation of cyber peace as a new social entity, a thing. Andrew Abbott (Reference Abbott1995) suggests new things emerge through a process of yoking together a series of distinctions. This is an iterative process of asking what are the characteristics of the new thing and what are not? “Boundaries come first, then entities” (p. 860). Cyber peace has yet to cohere into the sort of enduring, reproducing institution that would count as one of the Abbott’s new social entities, but we do see the setting of “proto-boundaries” that may become stable when we examine the processes of trying to name and implement cyber peace. In this section, I discuss three “points of difference” that are important for the concretization of cyber peace: Between (1) cyber peace and cyber aggression, (2) cyber peace/aggression and cyber lawfulness/crime, and (3) associating multistakeholder cyber governance with cyber peace and (implicitly) associating other forms of cyber governance with non-cyber peace.

A basic distinction is between the common sense understanding of what constitutes cyber peace versus cyber aggression. The case of the 2007 cyberattack against Estonia is a clear example of cyber aggression. A more complicated case is Stuxnet, the malicious computer worm discovered in 2010, which was deployed against computer equipment used in the Iranian nuclear program. One interpretation of the Stuxnet operation would name it cyber aggression. A different interpretation would find the use of this cyber weapon de-escalatory when considered in its broader geopolitical context. Stuxnet decreased the rapid ramping up of Iran’s ability to develop nuclear arms, which made an attack with full military force unnecessary. On the one hand, information technology was used for a hostile purpose. On the other, the targeted cyber attack removed a significant threat with apparently no loss of life (though the spread of the worm through networks resulted in monetary losses). Perhaps in this case it makes sense to think of the possibility that Stuxnet was actually consistent with cyber peace. (See also Brandon Valeriano and Benjamin Jensen’s assessment of the potential de-escalatory function of cyber operations in Chapter 4 of this volume.)

But is it possible to thread that needle – to use low-intensity, carefully targeted cyber operations (limiting their harmful consequences) to avoid more hostile interventions – as a matter of strategy? And if so, do such actions promote cyber peace? The 2018 United States Department of Defense cyber strategy tries to do this with its “defend forward” approach to cyber security, and by “continuously engaging” adversaries (United States Cyber Command, 2018, pp. 4, 6). The implicit analogy to nuclear deterrence likely conditions decision makers’ expectations, in my view. As Jason Healey explains, proponents of the strategy seek stability through aggressiveness. They assert that “over time adversaries will scale back the aggression and intensity of their operations in the face of US strength, robustly and persistently applied” (2019, p. 2). But Healey is cautious – noting the risk of negative outcomes – as persistent engagement could produce an escalatory cycle. In short, further characterizing the nature of cyber peace requires achieving greater clarity in differentiating between the kinds of cyber aggression that promote more peaceful outcomes rather than less.

The second point of distinction creates a boundary between problems that involve criminal violations versus those that rise to the level of aggressive breaches of cyber peace. Unlike cyber aggression, cybercrime, I suggest, is not the opposite of cyber peace. The scams, frauds, thefts, revenge porn postings, and pirated software that are everyday cybercrimes seem to me to be very bad sorts of things, but as policy problems they generally fall into the category of not lawful, rather than not peaceful. A society can be peaceful or cyber peaceful even in the presence of some crime; all societies have at least some crime. Countering cybercrime requires cyber law enforcement and international collaboration to deal with transnational crimes. Countering cyber aggression requires efforts toward (re)building cyber peace. These might include diplomacy, deterrence, or – the less peaceful alternative – aggression in return. Automatically folding cybercrime into the category of things that threaten cyber peace risks diluting the meaningfulness of cyber peace.

A caveat must be added, however. The boundary between cybercrime and cyber aggression is complicated by what Marietje Schaake describes as “the ease with which malign actors with geopolitical or criminal goals can take advantage of vulnerabilities across the digital world” (2020, emphasis added). The “or” should be understood as inclusive: “and/or.” Cybercrimes can be used to attain geopolitical goals (acts of cyber aggression), criminal goals, or both. The 2017 “WannaCry” ransomware attack, attributed to North Korea, provides an example of both cyber aggression and cybercrime. Initially, WannaCry was assumed to be the work of an ordinary criminal, but once North Korea’s involvement became apparent, the evident geopolitical aim and the attack’s aggressiveness became more important. We would sort WannaCry and similar aggressive actions in the category of “threats” to cyber peace rather than into the category of (only) “not lawful.”

Yet cybercrimes can, paradoxically, be tools for cyber peace too. Cybercrimes involving activities in support of human rights provide oppressed individuals and groups opportunities to fight back against their oppressors. Circumventing repressive surveillance technology might be an example of this. In that case, breaking the law could, arguably, be an example of cyber peace rather than a difference from it.

Third, the cyber peace pillar on multistakeholder collaboration assumes a distinction between cyber peace and non-cyber peace in terms of forms of governance. The definition of cyber peace includes a strong preference for developing “governance mechanisms by fostering multistakeholder collaboration” (Shackelford, Reference Shackelford2016). Shackelford sees bottom-up multistakeholder governance as a form of polycentricity and as good in itself. But both polycentricity and multistakeholderism are problematic points of distinction for what is or is not cyber peaceful. Michael McGinnis and Elinor Ostrom (Reference McGinnis and Ostrom2012, p. 17), commenting on a classic article by Vincent Ostrom, Charles Tiebout, and Robert Warren (Reference Ostrom, Tiebout and Warren1961), call attention to how the authors:

A multistakeholder form of polycentric governance, however, involves not just citizens and officials negotiating solutions, but firms and other private actors as well, which potentially skews that political nature because the resources the different stakeholders have to draw upon in their negotiations can differ by orders of magnitude. As Michael McGinnis, Elizabeth Baldwin, and Andreas Thiel (Reference McGinnis, Baldwin and Thiel2020) explain, polycentric governance can come to suffer from dysfunction because of structural forms that allow some groups to have outsized control over decision-making processes. And this is certainly true for a cyberspace governance organization like the Internet Corporation for Assigned Names and Numbers (ICANN), where the industry interests have significantly more say in outcomes than users. Furthermore, whereas polycentric governance evolves organically out of efforts to solve problems of different but related sorts, multistakeholderism is designed into the governance plan from its initiation, as was clearly the case with ICANN.

Moreover, as Kavi Joseph Abraham (Reference Abraham2017) explains, stakeholderism is actually not about creating better forms of democratic governance. Rather, its origin story can be traced to “systems thinking” in engineering and related management practices that emphasized the need for control of complexity. Complex systems, as engineers came to understand, involved multiple inputs, feedback loops, contingencies, outputs, etc. Controlling such systems required coordination of all those factors. That idea of coordinating all inputs into processes spilled over into the academic field of business management, where the firm came to be seen as a complex system. Control involved the coordination of material inputs plus the coordinated activity and decision-making of people – workers, managers, customers, shareholders, suppliers, communities affected by effluents from the firm’s factory, etc. Groups that had a role to play were thus identified as “stakeholders,” but unlike the assumed equality of citizens in a democracy, there was never any assumption that stakeholders should be equal or equivalent. Managing is about dealing with complexity, not about governing while protecting rights. We should not assume that multistakeholderism is uniquely suited to be the governance form for cyber peace.

8 Metaphors

Finally, I raise the issue of metaphors and how they enable and limit thinking in some way (Cienki & Yanow, Reference Cienki and Yanow2013; Lakoff & Johnson, Reference Lakoff and Johnson1980). First, is cyber peace the right metaphor that describes the sought-after goal? How would cyber peace be different from cyber order, cyber community, or cyber health? Given that much of the activity that goes on in cyberspace is commercial and given that commercial transactions are generally competitive rather than peaceful, does it make sense to talk about cyber peace when the goal is not friendly relations but, rather, a competitive market in which exchange can happen without the disruption of crime? How is cyber peace distinct from a well-functioning cyber market? Yet another alternative would be to rethink the marketization of cyberspace and to imagine instead a regulated utility and the provision of cyber services to the global public.

Moreover, by invoking peace in the context of what is often intended to be best practices of cyber security to maintain a stable Internet we fall prey to “inadvertent complicity” (Alker, Reference Alker1999, p. 3), distracting attention from real violence. Overusing the peace metaphor flattens the differences between deeply consequential and ethically crucial peacemaking in the world, and getting people to use better passwords. We can see this flattening dynamic even when considering initiatives promising to save lives (anti-cyberbullying initiatives as a cyber peace practice, for example). I think cyberbullying is truly awful, and in the United States, it is a crime. It is often also a mental health challenge, both for the bully and bullied. It’s a social pathology and a behavioral problem. It is also a cyber governance issue, as E. Nicole Thornton and I discussed in an article on the difficulties faced by owners of social media websites trying to prevent hijacking of their sites by bullies (Marlin-Bennett & Thornton, Reference Marlin-Bennett and Thornton2012). But is it useful to think of cyberbullying as a violation of cyber peace? (And doesn’t doing so give the bully too much power?) Cyber peace becomes hyperbole, notwithstanding the well-meaning campaigns such as that of the Cyber Peace Foundation (CyberPeace Corps, 2018). Peace is a strong word. By invoking peace (and war by implication), context and historicity can be washed away, obscuring the difference between cyberbullying and Russian cyber election disruptions that threaten to do grave harm to democracies.

9 A Final Thought

In the oft-cited special issue of International Organization on international regimes, the final article was written by Susan Strange (Reference Strange1982). The title was “Cave! hic dragones: a critique of regime analysis.” A note in smaller type at the bottom of the page reads “The title translates as ‘Beware! here be dragons!’ -an inscription often found on pre-Columbian maps of the world beyond Europe.” The article, she explains in the first paragraph, does not ask “what makes regimes and how they affect behavior, it seeks to raise more fundamental questions about the questions.” Her intent, instead, was to ask whether the regime concept is at all a useful advance for international political economy and world politics scholarship. She famously decided that the concept of the international regime was a bad idea for seven reasons (five main and two indirect). She was wrong. The concept of the international regime has endured and is widely accepted, and it has been useful. But I do not think that the concept of an international regime would have been nearly as well integrated into our scholarly lexicon now if it had not been for Strange’s intervention. Over the subsequent years, proponents of the regime concept had to work to improve the concept to counter her claims, which were really quite fair, if expressed bluntly.

I do not have as negative an opinion of cyber peace as Strange did of international regimes, but her charge that the concept of international regimes was “imprecise and woolly” seems to fit the concept of cyber peace, as well. By analyzing the different meanings ascribed to cyber peace, I hope to do what Strange, intentionally or not, did for regimes theory: Make it better.

Introduction

The Chinese government has reportedly detained over a million Muslims in the northwestern region of Xinjiang (Maizland, Reference Maizland2019). The detainees, predominantly of the Uighur ethnic group, are being held in reeducation camps where they are forced to pledge loyalty to the Communist Party of China, renounce Islam, and learn Mandarin (Maizland, Reference Maizland2019). Officials in China purport that these camps are not only used for vocational training, but also cite the need to quell the influence of violent extremism in the Xinjiang population (Maizland, Reference Maizland2019). There are reports of prison-like conditions in these camps, including extensive surveillance, torture (Wen & Auyezov, Reference Wen and Auyezov2018), and even forced sterilization (Associated Press, 2020). The Uighur population is also under extensive surveillance outside of these detention facilities. Alleged monitoring has included location surveillance through messaging apps such as WeChat, facial recognition technology used at police checkpoints, as well as biometric monitoring (Cockerell, Reference Cockerell2019). These technologies are being used by the Communist Party as new digital tools for monitoring and controlling populations deemed threatening to the Chinese state.

Modern digital information and telecommunication technologies (ICTs) have changed the ways in which states and their citizens interact on a variety of fronts, including the provision of goods and services and the production of information and misinformation. As the case of the Uighur population in China suggests, ICTs have also changed the ways in which states address threats from their population. While these kinds of overt, blatant abuses carried out by authoritarian states against ethnic or religious minorities tend to capture much attention, the use of digital technologies for repression is by no means limited to authoritarian states (Dragu & Lupu, Reference Dragu and Lupu2020). New technologies are shifting the ways in which all states, democratic as well as authoritarian, repress.

While improvements in technology have often been associated with liberation, digital technologies in the hands of governments willing to repress can be a major threat to respect for human rights and freedoms worldwide and, as such, they are a danger to cyber peace. As defined in the Introduction to this volume, a positive cyber peace necessitates respect for human rights and freedoms and the spread of Internet access. These characteristics are threatened by domestic digital repression, which often includes intentionally limiting access to the Internet and cellular communications, and can both constitute and facilitate violations of human rights and freedoms. Our chapter focuses on the changing nature of repression through digital technologies as a risk to cyber peace. Differing from other contributions to this volume (see Chenou & Aranzales, Chapter 5), we explore the domestic side of the interaction between digital technologies and cyber peace. Digital technologies are transforming repression, but we still know very little about this transformation and its long-term impact on state behavior. We believe, however, that understanding the ways in which these technologies are reshaping state power and its relationship to its citizens is necessary to build a more peaceful and freer digital and analog world.

In this chapter, we provide a conceptual map of the ways in which ICTs impact state repression. This mapping exercise seeks to identify some initial sites of influence in order to further theorize and empirically evaluate the effects of ICTs on our current understandings of state repression. We begin by outlining a conceptual definition of digital repression informed by the extant literature on state repression. We then derive four constituent components of state repression and trace the impact of ICTs on each of our four components.Footnote ¹ In conclusion, we discuss how our findings may inform or upend existing theories in the study of state repressive behavior.

1 Repression and Digital Repression

State repression refers to the actual or threatened use of physical violence against an individual or organization within a state for the purpose of imposing costs on the target and deterring specific activities believed or perceived to be threatening to the government (Goldstein, Reference Goldstein1978, p. xxvii). Traditional modes of repression have been conceptualized based on their impact on the physical integrity of groups or individuals, or as restrictions on individual or group civil liberties. Physical integrity violations refer to violations of a person’s physical being such as enforced disappearances, torture, or extrajudicial killings. Civil liberties violations include restrictions on press freedoms and information, and freedoms of association, movement, or religious practice.

All states repress, albeit in different ways and for different reasons (Davenport, Reference Davenport2007). Most scholars of state repression view the decision to repress as a rational calculus taken by political authorities when the costs of repression are weighed against its potential benefits (e.g., Dahl, Reference Dahl1966; Goldstein, Reference Goldstein1978; Davenport, Reference Davenport2005). When the benefits of repression outweigh the costs, then states are likely to repress. The expected benefits of using repression are “the elimination of the threat confronted and the increased chance of political survival for leaders, policies, and existing political-economic relations” (Davenport, Reference Davenport2005, p. 122). In addition, repression may demonstrate strength and deter subsequent threats. Traditional costs of repression, on the other end of the equation, include logistical and monetary costs, as well as potential political costs. The literature on the dissent–repression nexus suggests that while repression may neutralize a threat in the short term, it has the potential to yield to more dissent in the longer term because of a backlash effect to state policies (Rasler, Reference Rasler1996; Koopmans, Reference Koopmans1997; Moore, Reference Moore1998; Carey, Reference Carey2006). Democratic leaders who use particularly violent forms of repression may be penalized by voters (Davenport, Reference Davenport2005). Furthermore, leaders may suffer external political costs; for example, the international community may sanction leaders for excessive use of force against their civilian populations, or for behaviors that violate international human rights norms (Nielsen, Reference Nielsen2013).

The advent of modern digital technologies has ushered in new forms of digital repression. Digital repression is the “coercive use of information and communication technologies by the state to exert control over potential and existing challenges and challengers” (Shackelford et al., in this volume, Introduction). Digital repression includes a range of tactics through which states use digital technologies to monitor and restrict the actions of their citizens. These tactics include, but are not limited to, digital surveillance, advanced biometric monitoring, misinformation campaigns, and state-based hacking (Feldstein, Reference Feldstein2019). Modes of digital repression map onto the two modes of traditional repression mentioned above, physical integrity and civil liberties violations. Digital repression, while not directly a physical integrity violation, can facilitate or lead to such types of violations. For example, the data gathered by the Chinese state about the Uighur population has aided the government in locating and physically detaining large numbers of Uighurs. Digital repression can constitute both a civil liberties violation in and of itself, and facilitate the violation of civil liberties. For example, by limiting individual access to information and communication, the state violates the rights of citizens to access information. Alternatively, by closely monitoring the digital communications of social movements, states can deter or more easily break up political gatherings and protests. While states regularly gather and rely upon information about their citizens to conduct the work of governing, digital repression entails the use of that information for coercive control over individuals or groups that the state perceives as threatening.

As with traditional forms of repression, the use of digital repression can be seen in terms of a cost–benefit calculus on the part of the state. Yet, in the case of digital repression, this calculus is not well understood. Digital technologies impact the ways in which states identify and respond to threats, as well as the resources needed to do so. New technologies also impact the ways in which challengers, citizens, and the international community will experience and respond to the state’s behavior, in turn, affecting the costs and benefits of using digital repressive strategies. For example, the costs of digitally monitoring social movement participation through social media may have large upstart costs in terms of infrastructure and expertise. Yet, those initial costs may be offset over future threats. In certain circumstances, digital repression may reduce audience costs associated with traditional forms of repressionFootnote ² as these newer forms of repressive behavior may be easier to disguise. Alternatively, if digital repression is hidden from the public, it may be less likely to deter future threats, as challengers may not fully understand the levels of risk involved in challenging the state. In sum, it is likely that digital repression is shifting the cost–benefit analysis of state repression. However, we have yet to adequately theorize how this analysis might differ from, and relate to, a cost–benefit analysis of the use of traditional state repression.

Before we map how ICTs are reshaping state repression, we first place some scope conditions on the set of technologies that are relevant for our inquiry. Within the last decade, scholars have begun to develop frameworks and explore empirical patterns related to digital repression in a still nascent literature.Footnote ³ This work has examined a wide range of technologies, strategies, and platforms, including Internet outages (Howard et al., Reference Howard, Agarwal and Hussain2011), social media use (Gohdes, Reference Gohdes2015), and surveillance technologies (Qiang, Reference Qiang2019). Building on this work, we focus on the technological developments that facilitate two kinds of activities: (1) access to new and potentially diverse sources of information and (2) near instantaneous communication among individual users. While neither of these activities is a fundamentally new use of technology, the volume of information available, the number of individuals that can access and communicate information, and the speed at which exchanges can occur are new. Therefore, we are interested in ICTs that combine cellular technology, the Internet and its infrastructure, the software and algorithms that allow for large-scale data processing, and the devices that facilitate access to the Internet (e.g., computers and smart phones).Footnote ⁴

As Shackelford and Kastelic (Reference Shackelford and Kastelic2015) detail, as states have sought to protect critical national infrastructure from cyber threats, they have pursued more comprehensive state-centric strategies for governing the Internet. This has led to the creation of national agencies and organizations whose purpose is to monitor communication and gather data and information about foreign as well as domestic ICT users. This is true for both democracies and autocracies. But whereas we tend to associate democracies with robust legal protections and strong oversight institutions (especially with respect to the private sector), we do not need to travel far to find cases of democracies with timid approaches to oversight and protection of individual rights – the obvious example is the US government’s reluctance to reign in technology giants such as Apple or Facebook. Once governments gather information about users, they can engage in two kinds of activities that may lead to violations of citizen’s rights through either physical integrity or civil liberties violations. First, states can monitor and surveil perceived existing or potential threats. Second, states can limit access to ICTs or specific ICT content for individuals or groups perceived to present a threat to the state. The monitoring of threats and restrictions on threatening behavior are not new behaviors for states. However, digital technologies provide new opportunities for states to exercise control.

2 The Impact of ICTs on State Repression

We argue that state repression requires four specific components to function effectively. First, a state must have the ability to identify a threat. Second, the state must have the tactical expertise to address the threat. Third, a state must be able to compel responsive repressive agents to address a threat in a specified way. And fourth, the state must have a physical infrastructure of repression that facilitates addressing the threat, or at least does not make addressing the threat prohibitively costly. Below we discuss these components of repression and conceptualize the potential impacts of ICTs on each.

3 New Thoughts on Digital State Repression and Cyber Peace

States repress when the benefits of repression outweigh its costs. But when states repress using digital tools, how does this calculus change? How do digital forms of repression coexist with, or substitute for traditional forms of repression? And how does the combination of traditional and digital forms of repression affect the goal of cyber peace?

These are some of the questions we need to address in order to tackle the complex interactions among domestic state repression, digital technologies, and cyber peace. This chapter does not provide comprehensive answers, but it begins to unpack these interactions. In particular, our contribution is twofold. First, we break down repression into four constituent components, facilitating a conceptualization of repressive actions that cuts across the traditional/digital divide. This framework provides a useful workhorse for advancing research on the empirical patterns of repression. Second, we use this mapping to begin to explore the complex ways in which digital repression can impact each of the four components.

The value of our mapping exercise for scholars and practitioners in the field of cyber peace and cybersecurity emerges most poignantly in the reflections we offer about the tradeoffs between domestic and international security. For example, an Internet architecture that has a single point of control allows for governments to easily control access to the Internet and monitor data traveling over the network, but it also presents a vulnerability to foreign actors who only need to obtain control of, or infiltrate that point of control in order to gain access to domestic networks. This was in fact the case with Iran which, as noted earlier, had a single point of control until 2011. However, in recognition of the potential vulnerabilities to foreign intrusions that this created, Iran has since sought to add complexity to its digital infrastructure (Salamatian et al., Reference Salamatian, Douzet, Limonier and Salamatian2019). But, as a result, it also had to acquire greater expertise to manage this complexity, developing a broader range of tools to monitor users and control access (Kottasová and Mazloumsaki, Reference Kottasová and Mazloumsaki2019). Another issue concerns strategic interdependencies: States may need to rely on international collaborations to carry out repression within their own borders. This problem is particularly acute given the fact that servers are often housed in data centers outside the country in which most of their users reside.

Our contribution also suggests that some of the core insights in the literature on repression need reconsideration. For example, the literature on repression suggests that while all regime types repress, democracies repress less than autocracies (Davenport, Reference Davenport2007). However, this may not be true in the case of digital repression. Given the importance of the audience costs that we tend to associate with democratic regimes, we might expect democracies to invest and engage more in forms of repression that are more difficult to detect and observe. Perhaps, more interestingly, the existing literature suggests that democracies and autocracies differ with respect to the way they use information, and such differences expose them to different threats (Farrell & Schneier, Reference Farrell and Schneier2018). This difference may shape the cost–benefit analysis of engaging in certain forms of digital or traditional repression in distinct, regime-specific ways.

Moreover, the repression literature further suggests that under certain conditions state repression may increase rather than eliminate dissent. The dissent–repression nexus may require reexamination in light of how ICTs are reshaping repression. The addition of a new menu of repressive tactics that can be used in conjunction with, or in place of, traditional forms of repression may lead the state to more effectively mitigate or eliminate threats in ways that make them less likely to resurface or produce backlash. This is in part because of the addition of more covert forms of repression that might be less observable and generate fewer grievances down the line.

Finally, the literature suggests that repression requires high levels of state capacity. However, when states repress through computers, and not police and tanks, repression may rely on sectors and skills that we do not currently measure or think of as relevant dimensions of state capacity. In particular, taking a more granular, multidimensional approach to state capacity, with particular attention to the specific capacity to repress, may shed new light on the relationship between generalized state capacity for repression and state capacity for digital repression.

These observations also yield a distinct, methodological question: If digital repression makes preemptive repression more effective, how can we continue to effectively measure repression since we will have many more unobservable cases in which repression preempted the emergence of an observable threat? Although we do not venture to answer this question, we hope that our chapter offers a starting point for a comprehensive analysis of repression in its traditional as well as digital forms.

The ability of states to violate the political and civil liberties of their populations through digital technologies is a direct threat to cyber peace. While often overlooked in our more internationalized discussion of cyber warfare, how states use and misuse digital technologies to monitor and control their populations is a subject that requires much more attention both because it can shape and be shaped by internationalized cyber warfare, and also because it is an important empirical and normative concern in and of itself.