NORM “State and non-state actors should not commandeer others’ ICT resources for use as botnets or for similar purposes.” BACKGROUND Internet-connected devices are becoming integral to people’s lives globally. We are surrounded by devices with a multiplicity of computational, networking, sensing and actuating capabilities. Thermostats, televisions, medical devices, alarm clocks and automobiles have computing, storage and network capacity that can be appropriated and abused. Exploits of vulnerabilities in their underlying code can lead to physical safety issues for the individuals using the device: a device working outside of its design parameters could catch fire or create other unsafe conditions, such as unexpectedly unlocked doors, video broadcast from the interior of a house or cause (medical) equipment to fail. We refer to botnets when software agents are installed, en masse and without consent, to use the devices’ computational, storage or network resources. Those botnets can then be used to exercise direct effects on a different targeted system that can include impacting the end-targets’ data confidentiality, availability and integrity. Therefore, a potentially uninvolved “third party” device, and its owner/operator, are made party to a malicious cyber activity without their knowledge. The compromise of devices to install malicious software agents not only weakens the defense of the device from other attacks — for instance from criminals — or infringes on the devices’ normal functioning, but also casts the owner/operator as potentially culpable for damages inflicted on the endtarget. This is particularly acute for cases where the compromise of the device might inadvertently cast the device and its owner/operator as an unwitting belligerent in interstate hostilities, and therefore invite reprisals or liability. As we become reliant on technology in our personal environment, and more and more connected devices enter the market, the exploitation of consumer devices and their use as botnets increasingly undermines trust and destabilizes society. The Commission recognizes that there are cases — for instance for law enforcement purposes — in which authorized state actors may find it necessary to install software agents on devices of a specifically targeted individual adversary, or a group of adversaries. However, state and non-state actors should not commandeer civilian devices of the general public (en masse) to facilitate or directly execute offensive cyber operations, irrespective of motivation. 10 10 This norm is complementary to the previous proposed norm for state and non-state actors to avoid tampering with products prior to their release, which focuses on supply chain aspects, while this norm looks at already deployed devices. GLOBAL COMMISSION ON THE STABILITY OF CYBERSPACE NOVEMBER 2018 11