The Diffusion of Cyber Norms: Technospheres, Sovereignty, and Power

Why have the Chinese and Russian internet sovereignty norms diffused successfully to some countries - thereby undermining the previously dominant US norm of internet freedom - and what are the implications of successful international diffusion of information controls for understandings of sovereignty in International Relations?

Starting in the 1980s, internet freedom swept through the world and soon became the leading global cyber norm. This rise was propelled by US goals of increasing economic power and spreading democracy. Many countries that imported internet technologies, saw the economic benefits of the technologies, but with the import of the internet they also adopted loose market and content regulations. However, in the 2000s, the eruption of protests in the Middle East, Latin America, Africa, and across Asia, powered through internet-connected devices, increased the regime threat perception of authoritarian- leaning leaders. As a result, they started importing technology/techniques associated with internet sovereignty from China and Russia, who had, early-on, built up their information control capabilities. Beijing and Moscow, for their part, have actively promoted internet sovereignty diffusion to geographical areas that they conceived as their spheres of influence - the Commonwealth of Independent States for Russia and the Belt and Road Initiative for China.

This thesis makes several main contributions. It builds a framework to distinguish the three cyber norms it studies: internet freedom, and the Chinese and Russian variants of internet sovereignty. This thesis also devises a neoclassical realist framework of International Relations, which focusses on explanatory variables at the unit level (perception underlying export/import) to explain the international expansion of internet freedom/sovereignty. Additionally, it updates the term of sovereignty to the digital age. Namely, with the diffusion of internet freedom/sovereignty norms, technological spheres of influence emerged, in which the US, China, and Russia have weakened countries' Westphalian sovereignty and shaped their domestic and interdependence sovereignty.

This research comes under the EPSRC Cyber Security theme and social science

It is part of the nature of Cyber Security - and a key reason for the urgency in developing new research approaches - that it now is a concern of every section of society, and so the successful CDT will have a very broad impact indeed. We will ensure impact for:

* The IT industry; vendors of hardware and software, and within this the IT Security industry;

* High value/high assurance sectors such as banking, bio-medical domains, and critical infrastructure, and more generally the CISO community across many industries;

* The mobile systems community, mobile service providers, handset and platform manufacturers, those developing the technologies of the internet of things, and smart cities;

* Defence sector, MoD/DSTL in particular, defence contractors, and the intelligence community;

* The public sector more generally, in its own activities and in increasingly important electronic engagement with the citizen;

* The not-for-profit sector, education, charities, and NGOs - many of whom work in highly contended contexts, but do not always have access to high-grade cyber defensive skills.

Impact in each of these will be achieved in fresh elaborations of threat and risk models; by developing new fundamental design approaches; through new methods of evaluation, incorporating usability criteria, privacy, and other societal concerns; and by developing prototype and proof-of-concept solutions exhibiting these characteristics. These impacts will retain focus through the way that the educational and research programme is structured - so that the academic and theoretical components are directed towards practical and anticipated problems motivated by the sectors listed here.