November 5, 2014
pdfRead the Report (PDF)
Confidence-building measures (CBMs) are an instrument of interstate relations aimed to strengthen international peace and security by reducing and eliminating the causes of mistrust, fear, misunderstanding, and miscalculations that states have about the military activities of other states.

The anonymous and complex nature of the Internet and the potency, low cost, and deniability of cyber operations make them potentially counterproductive to building trust. CBMs, as confidence and trust-building concepts, are particularly suitable for cyberspace. However, the application of these measures have yet to be extensively applied in cyberspace. Because cyberspace is predominantly dominated not by the actions of states but nonstate actors, CBMs for cyberspace must thus be inclusive of all stakeholders active in cyberspace. They must reduce risk and support trust by either building on preexisting concepts and mechanisms from other domains of international relations or by creating unique bottom-up approaches.

Confidence-Building Measures in Cyberspace: A Multistakeholder Approach for Stability and Security, a new Cyber Statecraft Initiative report from the Atlantic Council's Brent Scowcroft Center on International Security, analyzes different ways to involve private-sector actors and build confidence without extensive legal or political action by states. Authors Jason Healey, John C. Mallery, Klara Tothova Jordan, and Nathaniel V. Youd recommend four types of CBMs--collaboration, crisis management, restraint, and engagement measures--which can be established to mitigate potentially escalatory effects of activities in cyberspace. The measures proposed in this report suggest a multistakeholder-centric approach to leverage all possible stakeholders to improve overall Internet resilience and decrease the chances of miscalculation, mistrust, and misunderstanding.

This report is the result of discussions among participants at the NATO Advanced Research Workshop on Confidence-Building Measures in Cyberspace conducted in March 2014, in Stockholm, Sweden.