False Comfort from Nuclear Analogies : How International Trade Restrictions Apply to Cyberspace

Abstract

This thesis evaluates the international legal framework of trade restrictions in the context of cyberspace. Certain cyber goods are recognized as dual-use goods based on their potential military applications. Thereby, the existing legal framework for governing the trade of sensitive goods is extended analogically to apply to cyber goods. The first research question presented in this paper is whether international law includes a legal basis for using trade policy as a measure for security governance in cyberspace. To answer this research question, the paper evaluates how security interests are regarded in trade policy. This evaluation is conducted by analysing the nature of security interests with the constructivist method and reviewing the General Agreement on Tariffs and Trade with the de lege lata approach. The second research question evaluates whether trade policy is a suitable model for governing threats in the cyberspace. This research question covers the evaluation of existing non-proliferation focused trade policies, mainly the Wassenaar Arrangement, and grounds for applying the same approach to cyber goods. This evaluation also includes observing the nature of cyber goods and the cyber goods industry with a socio-legal method. Dual-use nuclear goods are used as a reference point in a comparison between cyber goods and conventional dual-use goods.

The purpose of the thesis is to examine the implications of applying trade policy as a security measure in cyberspace. The choice of extending an existing legal framework instead of establishing a separate framework specifically for cyberspace may have a broader impact on the legal status of cyberspace. The paper evaluates whether the current legal approach to governing dual-use cyber goods takes into account the nature of cyberspace in an adequate manner.

This paper concludes that international trade law provides a legal basis for imposing trade restrictions for cyber goods based on security interests. However, the analogical extension of the non-proliferation focused trade policy framework does not fully adapt to the nature of cyber goods and the cyber goods industry. Thereby, the current model for the governance of dual-use cyber goods may result in negative effects in the industry by restricting trade without providing equivalent benefit in the form of decreasing cyber risks. The possible solutions proposed based on the research conducted in this paper include incorporating views and practices of private sector stakeholders as an essential input in any regulation related to cyberspace, establishing a separate cyber convention for properly defining the legal status of cyberspace, and promoting global initiatives for cyber resilience.