Beyond Naming and Shaming: Accusations and International Law in Cybersecurity

Accusations of bad state behaviour in cyberspace are proliferating, yet this increase in naming has not obviously produced much shame. Accused states uniformly deny the accusation or decline to comment, without changing behaviour. For international lawyers, the problem is compounded by the absence of international law in these charges. States are not invoking international law when they complain of other states' behaviour, suggesting the law is weak - or worse, irrelevant - in holding states accountable for their cyber operations. In lieu of 'naming and shaming', we introduce and examine the broader concept of 'accusation' as a social, political and leal practice with diverse uses in cyberspace and beyond. Accusers must make strategic choices about how they frame their accusations, and we unpack various elements accusers may manipulate to their advantage. Accusations also have many purposes. They may seek to 'name and shame' an accused into conforming to certain behavioural expectations, but they may also aim at defensive or deterrent effects on both the accused and, crucially, on third parties. Particularly important, accusations may play a constitutive role, constructing new norms, including customary international law, within the international community. In short, accusations offer states and other stakeholders a menu of strategic options beyond those identified by the extant literature on naming and shaming.