Cyber diplomacy: defining the opportunities for cybersecurity and risks from Artificial Intelligence, IoT, Blockchains, and Quantum Computing

Figures & data

Table 1. Key aspects of cyber diplomacy.

Component	Description of activity
International Cooperation	Collaboration amongst nations to address common cyber threats and challenges. Establishing norms and agreements for cyberspace.
Conflict Resolution	Seeking peaceful resolutions to cyber incidents and disputes through diplomatic channels and negotiations.
Cybersecurity Governance	Shaping international cyber governance, including the development and implementation of cyber laws, treaties, and regulations.
Confidence Building Measures	Establishing agreements to build trust, reduce suspicion, and enhance transparency in cyber activities.
Attribution and Accountability	Addressing the issue of identifying the true source of cyberattacks and holding malicious actors accountable.
Public-Private Partnerships	Encouraging collaboration between governments and private companies to effectively tackle cyber threats.
Capacity Building	Promoting cybersecurity capabilities in less developed countries through technology transfer, training, and knowledge sharing.
Digital Rights and Freedoms	Balancing national security with individual rights in cyberspace, including issues of privacy, freedom of expression, and governance.

Table 2. Summary of Cyber functions related to Cyber Diplomacy.

Concept	Description
Cybersecurity	Protecting systems and data from cyber threats. Focuses on technical measures for security.
Cyberwarfare	Use of cyber capabilities for military objectives. Part of information warfare.
Cyber Espionage	Legal principles governing state behaviour in cyberspace.
Digital Diplomacy	Using digital tech for diplomatic engagement and outreach.
Information Warfare	Using tech to influence opinions and perceptions of populations.
Cyber Norms	Agreed principles and rules governing state behaviour in cyberspace.
Cybercrime	Criminal activities through digital means. Includes hacking and online fraud.

Figure 1. How the digital realm is influencing international relations.

Table 3. Summary table of various international cyber laws and treaties related to cyber diplomacy.

Treaty/Agreement	Description
United Nations Group of Governmental Experts (UN GGE) Reports [7]	The UN GGE has published several reports that provide guidelines and recommendations on responsible state behaviour in cyberspace. These reports highlight the importance of adhering to international law and norms in cyberspace.
Tallinn Manual [8]	The Tallinn Manual is a comprehensive analysis of how international law applies to cyber operations. It was prepared by experts and provides guidance on issues like sovereignty, self-defence, and the law of armed conflict as they relate to cyberspace.
Convention on Cybercrime (Budapest Convention) [9]	The Budapest Convention is the first international treaty addressing cybercrime. It aims to harmonise national laws, improve international cooperation, and enhance capabilities for investigating and prosecuting cybercrime.
United Nations Convention on the Law of the Sea (UNCLOS) [10]	While not specifically focused on cyberspace, UNCLOS includes provisions related to the use of information and communication technologies in maritime operations.
Joint Comprehensive Plan of Action (JCPOA) [11]	This agreement, also known as the Iran Nuclear Deal, includes provisions relating to cybersecurity in the context of nuclear facilities.
European Union General Data Protection Regulation (GDPR) [12,13]	Though not exclusively a cyber treaty, GDPR regulates the protection and privacy of personal data in the EU and has extraterritorial reach for companies handling EU citizens’ data.
Wassenaar Arrangement [14]	This is not a treaty but an export control regime that regulates the trade of conventional arms and dual-use goods and technologies, including certain cybersecurity-related items.
Organisation of American States (OAS) Cybersecurity Program [15]	The OAS has a cybersecurity program that aims to promote regional cooperation and capacity-building efforts to address cyber threats in the Americas.
African Union Convention on Cyber Security and Personal Data Protection [16]	Adopted in 2014, this treaty aims to harmonise cybersecurity and data protection efforts across African countries.
United Nations Convention Against Transnational Organised Crime (Palermo Convention) [17]	Does not specifically address cybercrime but includes provisions that are relevant to the investigation and prosecution of cybercrimes committed by organised criminal groups. Requires state parties to criminalise the use of computers for money laundering and to cooperate in investigating and prosecuting these offenses.
Convention on the Rights of the Child (CRC) [18]	Protects the rights of children, including their right to privacy. Article 34 of the CRC prohibits the sexual exploitation of children, including child pornography. The CRC has been ratified by 196 countries, making it one of the most widely ratified human rights treaties.
Optional Protocol to the Convention on the Rights of the Child on the Sale of Children, Child Prostitution and Child Pornography [19]	Supplements the CRC by prohibiting the sale of children, child prostitution, and child pornography. Requires state parties to take measures to protect children from these practices.

Table 4. Summary of strategies for handling cyber incidents and crises.

Strategy	Description
Preparation and Planning	Proactively prepare and develop a comprehensive incident response plan that outlines roles, responsibilities, and procedures for different stakeholders. Conduct regular cyber incident response drills and simulations to ensure readiness.
Incident Identification and Assessment	Establish robust monitoring and detection systems to identify cyber incidents promptly. Monitor network traffic, conduct log analysis, and use intrusion detection systems to detect suspicious activities. Rapidly assess the scope and severity of the incident to determine the appropriate response.
Containment and Mitigation	Take immediate action to contain the incident’s impact and prevent further damage. Isolate affected systems, shut down compromised accounts, or disconnect from the network if necessary. Implement mitigation measures to limit the attacker’s access and control.
Forensics and Investigation	Conduct thorough forensic analysis to understand the attack vectors, identify the extent of the breach, and preserve evidence for potential legal proceedings. Engage cybersecurity experts and law enforcement, if required, to investigate the incident thoroughly.
Communication and Reporting	Maintain clear and transparent communication during the cyber incident or crisis. Notify relevant stakeholders, including customers, partners, employees, and regulatory authorities, about the incident promptly. Maintain open lines of communication throughout the incident response process.
Coordination and Collaboration	Establish a centralised incident response team that includes representatives from IT, legal, communications, and senior management. Collaborate with external partners, such as law enforcement agencies or cybersecurity firms, as needed.
Recovery and Remediation	Develop a recovery plan to restore affected systems and services to normal operations. Prioritise critical systems and data for restoration. Conduct post-incident reviews to identify lessons learned and implement necessary security improvements.
Public Relations and Reputation Management	Have a well-defined public relations and reputation management strategy to address media inquiries and maintain stakeholders’ trust. Cyber incidents can significantly impact an organisation’s reputation.
Legal and Regulatory Compliance	Ensure compliance with applicable laws and regulations while handling cyber incidents. Report incidents to regulatory authorities as required and cooperate with law enforcement during investigations.
Continuous Improvement	Analyse the incident response process after resolving a cyber incident to identify areas for improvement. Use the lessons learned to update incident response plans, security measures, and training programs for staff.

Table 5. International efforts to standardise handling cyber incidents and crises.

Standard/Guideline	Description
ISO/IEC 27,035 [20]	This standard, published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC), provides guidance on the processes and principles for incident management, including planning, detection, reporting, assessment, and response.
NIST Special Publication 800–61 Revision 2 [21]	Published by the National Institute of Standards and Technology (NIST) in the United States, this document offers guidelines for Computer Security Incident Handling, including preparation, detection, analysis, containment, eradication, recovery, and post-incident activities.
ENISA Incident Handling Guide [22]	The European Union Agency for Cybersecurity (ENISA) has developed a comprehensive guide on incident handling, which provides practical advice and recommendations to support incident response efforts.
FIRST Incident Handling Standards [23]	The Forum of Incident Response and Security Teams (FIRST) has developed a set of guidelines and standards for incident response to facilitate global collaboration and consistency in cyber incident handling.
OASIS Cyber Threat Intelligence (CTI) Technical Committee [24]	OASIS (Organization for the Advancement of Structured Information Standards) has established the CTI Technical Committee to develop standards for sharing cyber threat intelligence, which is a critical aspect of incident response.
CIS Controls [25]	The Center for Internet Security (CIS) has developed a set of best practices known as the CIS Controls, which includes specific recommendations for incident response and management.
CERT Coordination Center (CERT/CC) Incident Response Handbook [26,27]	The CERT/CC at Carnegie Mellon University provides a comprehensive handbook on incident response, outlining a structured approach for handling cyber incidents.
ITU-T X.1500 Series [28]	The International Telecommunication Union (ITU) has developed the X.1500 series of standards, which focuses on the management of cybersecurity incidents and includes guidelines for incident detection, reporting, and handling.
ICANN Incident Response Plan [29]	The Internet Corporation for Assigned Names and Numbers (ICANN) has an incident response plan to address security incidents related to the internet’s domain name system (DNS).

Figure 2. Mapping the requirements for national cybersecurity strategies.

Figure 3. Regional cyber initiatives.

Table 6. Comparison of the differences between the three regional initiatives, ASEAN CERT, ENISA, and OAS.

Organisation	Regional Focus	Mandate and Activities	Membership and Governance	Geopolitical Context
ASEAN CERT	Association of Southeast Asian Nations (ASEAN)	Fostering collaboration among ASEAN member states in sharing information, capacity building, and coordination of national CERTs.	Limited to ASEAN member states; Operates under the governance of the ASEAN community.	Addressing cybersecurity challenges specific to the ASEAN region.
ENISA	European Union (EU)	Providing support and expertise to the European Commission and EU member states on network and information security. EU member states; Operates under the governance of the European Commission.	Addressing network and information security concerns within the EU; Promoting cybersecurity cooperation among EU member states.
OAS	Americas (North, Central, South America, and Caribbean)	Initiatives related to cybersecurity, including the Inter-American Committee against Terrorism (CICTE) and a cybersecurity working group.	Comprises 35 member states from the Americas; Operates under the governance of its member states.	Addressing cybersecurity challenges in the diverse geopolitical context of the Americas.

Figure 4. Review of three global cyber initiatives.

Figure 5. Areas of cyber diplomacy that benefit from public-private partnerships.

Figure 6. Ongoing efforts to promote intelligence cooperation.

Figure 7. Cyber diplomacy challenges and roadblocks.

Figure 8. Cyber diplomacy challenges and roadblocks.

Figure 9. Summary of strategies and approaches for overcoming geopolitical tensions in cyber negotiations.

Figure 10. Integration of technologies in cyber diplomacy with emphasis on international cooperation.

Table 7. The impact of AI on cyber diplomacy.

Impact	Description
Threat intelligence	AI can be used to collect and analyse large amounts of data to identify and track cyber threats. This information can then be used to develop more effective strategies for preventing and responding to cyber-attacks.
Negotiation	AI can be used to help diplomats negotiate cyber security agreements. For example, AI can be used to identify areas of common ground and to develop compromise solutions.
Disarmament	AI can be used to help countries develop and implement disarmament agreements. For example, AI can be used to monitor compliance with agreements and to detect violations.
Conflict resolution	AI can be used to help countries resolve cyber conflicts. For example, AI can be used to mediate negotiations and to develop peace agreements.
Benefits	Increased efficiency Improved decision-making Enhanced creativity

Figure 11. Cyber diplomacy and the challenges of quantum computing.

Figure 12. Impact of IoT on cyber diplomacy.

Figure 13. Blockchain technology’s transformative impact on cyber diplomacy.

Figure 14. Theoretical framework for integrating cyber diplomacy with emerging technologies.

Table 8. Summary table comparing cyber diplomacy and traditional diplomacy.

Aspect	Cyber Diplomacy	Traditional Diplomacy
Scope of Focus	Cyberspace, cybersecurity, internet governance	Political, economic, social, security issues
Communication Channels	Virtual meetings, secure messaging platforms, cyber channels	Face-to-face meetings, formal diplomatic communications
Focus on Technology	Central focus on cyber technologies and their impact	May involve discussions on technology-related issues
Security Concerns	Directly vulnerable to cyber threats during engagements	Susceptible to security risks, may not involve cyber threats
Multilateral and Bilateral Approaches	Multilateral and bilateral efforts in developing international norms	Common in both multilateral and bilateral approaches
Role of Diplomats	Specialised in cyber issues and cyber policy	Handle a wide range of diplomatic tasks
Time and Speed	Requires rapid response and swift actions	Negotiations and processes may take time

United Nations. Group of governmental experts on developments in the field of information and telecommunications in the context of international security: note/: by the secretary-general. UN; 2015 Jul. [cited 2023 Jul. 24. [Online]. Available: https://digitallibrary.un.org/record/799853

 Google Scholar

CCDCOE. The Tallinn Manual. 2013 [cited 2023 Jul 24]. [Online]. Available: https://ccdcoe.org/research/tallinn-manual/

 Google Scholar

Council of Europe. Budapest Convention - Cybercrime. 2001 [cited 2023 Jul 25]. [Online]. Available: https://www.coe.int/en/web/cybercrime/the-budapest-convention

 Google Scholar

United Nations. United Nations convention on the law of the sea. [cited 2023 Jul 24]. [Online]. Available: https://www.imo.org/en/ourwork/legal/pages/unitednationsconventiononthelawofthesea.aspx.

 Google Scholar

JCPOA. What is the Iran nuclear deal? | council on foreign relations. [cited 2023 Jul 24]. [Online]. Available: https://www.cfr.org/backgrounder/what-iran-nuclear-deal.

 Google Scholar

GDPR. What is GDPR, the EU’s new data protection law? - GDPR.Eu. [cited 2023 Jul 7]. [Online]. Available: https://gdpr.eu/what-is-gdpr/

 Google Scholar

ICO. Information Commissioner’s Office (ICO): the UK GDPR,” UK GDPR guidance and resources. [cited 2023 Jul 8]. [Online]. Available: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/a-guide-to-lawful-basis/lawful-basis-for-processing/consent/

 Google Scholar

NTI. Wassenaar Arrangement. [cited Jul 2023 24]. [Online]. Available: https://www.nti.org/education-center/treaties-and-regimes/wassenaar-arrangement/.

 Google Scholar

OAS. Organization of American States: cybersecurity program. Aug. 2009.

 Google Scholar

African Union. African Union convention on cyber security and personal data protection | African union. [cited 2023 Jul 24]. [Online]. Available: https://au.int/en/treaties/african-union-convention-cyber-security-and-personal-data-protection.

 Google Scholar

United Nations. United Nations convention against transnational organized crime. [cited 2023 Jul 24]. [Online]. Available: https://www.unodc.org/unodc/en/organized-crime/intro/UNTOC.html.

 Google Scholar

United Nations. Convention on the rights of the child | OHCHR. [cited 2023 Jul 24]. [Online]. Available: https://www.ohchr.org/en/instruments-mechanisms/instruments/convention-rights-child.

 Google Scholar

United Nations. Optional protocol to the convention on the rights of the child on the sale of children, child prostitution and child pornography | OHCHR. [cited 2023 Jul 24]. [Online]. Available: https://www.ohchr.org/en/instruments-mechanisms/instruments/optional-protocol-convention-rights-child-sale-children-child.

 Google Scholar

ISO. ISO/IEC 27035-1: 2016 - information technology — security techniques — information security incident management — part 1: principles of incident management. [cited 2023 Jul 24]. [Online]. Available: https://www.iso.org/standard/60803.html.

 Google Scholar

NIST. SP 800-61 Rev. 2, Computer Security Incident Handling Guide | CSRC. [cited 2023 Jul 24]. [Online]. Available: https://csrc.nist.gov/pubs/sp/800/61/r2/final.

 Google Scholar

ENISA. Good Practice Guide for Incident Management — ENISA. [cited 2023 Jul 24]. [Online]. Available: https://www.enisa.europa.eu/publications/good-practice-guide-for-incident-management.

 Google Scholar

FIRST. Standards. [cited 2023 Jul 24]. [Online]. Available: https://www.first.org/standards/

 Google Scholar

OASIS. OASIS cyber threat intelligence (CTI) TC | OASIS. [cited 2023 Jul 24]. [Online]. Available: https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=cti.

 Google Scholar

CIS. CIS Critical Security Controls. [cited 2023 Jul 24]. [Online]. Available: https://www.cisecurity.org/controls.

 Google Scholar

West-Brown MJ, Stikvoort D, Kossakowski K-P, Killcrece G, Ruefle R, Zajicek M. Handbook for computer security incident response teams (CSIRTs). Carnegie Mellon University, Software Engineering Institute; 2003.

 Google Scholar

Cichonski P, Millar T, Grance T, et al. Computer security incident handling guide recommendations of the national institute of standards and technology. doi: 10.6028/NIST.SP.800-61r2.

 Google Scholar

ITU-T X.1500 Series. X.1500: overview of cybersecurity information exchange. [cited 2023 Jul 24]. [Online]. Available: https://www.itu.int/rec/T-REC-X.1500.

 Google Scholar

ICANN. ICANN Computer Incident Response Team - ICANN. [cited 2023 Jul 24]. [Online]. Available: https://www.icann.org/resources/pages/cirt-2012-02-25-en.

 Google Scholar