The chapter examines the distinction between public and private cyberattacks and responses to them in domestic law (e.g. application of criminal law) and international law (e.g. self-defence and countermeasures). After describing the different purposes, nature, and effects of cyberattacks committed by public and private actors, it argues that the determination of whether a particular cyberattack is of a public or private nature should define how states respond to cybersecurity risks. It then argues that the existing domestic and international law frameworks regulating cyberattacks suffer from serious limitations and proposes a holistic approach for responding to cyberattacks, taking into account the difference between public and private cyberattacks.

The chapter begins by giving an overview of the background against which efforts to agree on international norms regulating cybersecurity take place. It highlights intensifying cyberthreats, increasing geopolitical tensions, and the rise of China, as well as a backlash against economic globalisation, which call for a reassessment of cybersecurity governance. It then summarises the main aims of the book, which examines cybersecurity challenges, governance responses to them, and their limitations, engaging an interdisciplinary approach combining legal and international relations disciplines. It builds on the fundamental premise that cybersecurity challenges require a widely agreed-upon set of international norms. it examines the current political and legal contexts of cybersecurity governance and highlights the divide between two contrasting models of cybergovernance: state-oriented and market-oriented. The chapter then offers a brief overview of all chapters of the book.

The chapter analyses existing regional cybersecurity treaties to highlight the differences in these treaties that reflect the divide between the state-oriented and market-oriented models of internet governance, and to find possible areas of convergence that may pave the way towards global co-operation. It also discusses the role and limitations of the private sector, including IT industries, technical experts, and civil societies, in cybersecurity governance. Realistic scenarios of future global cybersecurity governance would envision expanding and strengthening regional co-operation and co-operation between like-minded states. However, reaching a consensus on particular cybersecurity issues will not automatically result in effective cybersecurity governance. Fundamental differences in the levels of cyber-preparedness and the ability of states to combat cybercrimes will create a living space for cybercriminals and other malign actors to engage in illegal activities. Continuous efforts to support states with less cybercapacity, including through strengthening education, technical skills, and material resources should accompany any attempts to create cybersecurity governance norms.