11 are hacktivist groups such as Anonymous and Lulzsec that seek notoriety. However, cybersecurity and national security strategists are extremely concerned about targeted compromises or ‘Advanced Persistent Threats (APTs). McAfee describes APTs as: “More insidious and occur largely without public disclosures. They present a far greater threat to companies and governments, as the adversary is tenaciously persistent in achieving their objectives. The key to these intrusions is that the adversary is motivated by a massive hunger for secrets and intellectual property; this is different from the immediate financial gratification that drives much of cybercrime, another serious but more manageable threat (Alperovitch 2011).” 12 Independent researchers have identified attacks similar to the McAfee discovery that targeted high value diplomatic, political, economic and military targets. In common with 13 McAfee, victims included governments, businesses and international organisations . As expected, researchers were unable to attribute the attacks to a particular actor. 2.3 CYBERSECURITY: A GLOBAL CHALLENGE Policy makers are only waking up to the challenges of cyberspace (Drew and Snow 2006). In contrast to land, air, sea and space, cyberspace poses the following unique difficulties. First, due to the global reach of ubiquitous networks, threat actors can launch distressing attacks far from victims and often in jurisdictions with weak laws and/or no enforcement. Second, fast connection speeds give victims little time to defend against attacks. Thus, at best, States and organisations only know about an attack when it is process. At worst, victims do not discover the compromise of their critical systems. 14 Indeed, a report from a major security company alleged that many of the 72 States and public and private sectors organisations subjected to a five-year campaign of cyber attacks were unaware of the targeted compromises. Third, whereas States pursue national interests through a rules-based international system, cyberspace does not have accepted norms and principles of proportionality. Indeed, whilst a country typically requires the approval of the United Nations to participate in the activities of the community of nations, any actor can setup in cyberspace and do whatever they please. Actors such organised criminals, insurgents and terrorists do not worry about norms and do not fear retaliation chiefly due to the difficulty of attributing an attack to a given actor. The lack of accepted norms in cyberspace is reducing confidence in the use of ICTs. Indeed, the United Nations Resolutions that we discuss in section 3 show that cybersecurity has been a concern of the international community for many years. 11 Hacktivism (a portmanteau of hack and activism) is the use of computers and computer networks as a means of protest to promote political ends, according to Wikipedia, the online encyclopaedia. 12 GhostNet report here: http://www.infowar-monitor.net/2009/09/tracking-ghostnet-investigating-a-cyber-espionage-network/ 13 Shadows Report: http://www.infowar-monitor.net/2010/04/shadows-in-the-cloud-an-investigation-into-cyber-espionage-2-0/ 14 The “Operation Shady RAT” report is here: http://www.mcafee.com/us/resources/white-papers/wp-operation-shady-rat.pdf 14