Why have countries struggled to establish comprehensive international rules for cyberspace?

Establishing comprehensive international rules for cyberspace has proven difficult because nations hold divergent views on fundamental issues, including digital sovereignty, cyber espionage, and the deployment of offensive cyber capabilities. These disagreements are compounded by significant variations in national legal systems and strategic interests.1

Several technical and ethical challenges further complicate the creation of a unified regulatory framework:

• Anonymity and Attribution: The ease with which actors can mask their identity, location, and motives makes it difficult to hold perpetrators accountable or deter future attacks, as retaliatory measures risk targeting the wrong entities.2
• Distinguishing Combatants: The low cost of entry into cyberspace allows civilians to participate in hostile activities, creating ambiguity regarding their legal status under the laws of armed conflict and the Geneva Conventions.2
• Defining Cyberwar: There is ongoing debate over whether hostile cyber activities constitute "war" or should be categorized as cybercrime, espionage, or terrorism, each of which carries different political and legal implications.3

While international efforts like the Budapest Convention and the 2024 United Nations Convention against Cybercrime aim to coordinate responses, achieving a global consensus remains a complex, ongoing challenge.14