AI-generated from sources
The clash of cyber doctrines: Sovereignty, deterrence, and the fractured global architecture
In Brief
- Global cyberspace governance is defined by an ideological schism: Western deterrence (NATO/US) views the internet as a global commons, while the state-centric model (China/Russia) demands absolute network sovereignty.
- The Deterrence Doctrine emphasizes collective security, offensive capabilities, and projecting power to impose 'unacceptable costs' on adversaries who violate established norms.
- The Network Sovereignty model asserts the inalienable right of a state to govern its own digital space through comprehensive 'law-based governance,' rejecting all forms of external interference.
- This irreconcilable divide prevents the formation of a global legal consensus, institutionalizing geopolitical tension and risking a fragmented 'splinternet' governed by power politics.
Main authors
The global architecture of cyberspace is fractured by a fundamental ideological conflict. This schism pits two irreconcilable doctrines against each other: a Western model predicated on collective security and offensive deterrence, and a state-centric model championing absolute network sovereignty and the principle of non-interference. At its core, this is a debate over the very nature of power, territory, and law in a borderless digital domain [1]. While one perspective views the internet as a global commons where malign activities must be actively countered, often preemptively, the other sees it as an extension of national territory, subject to the inviolable right of a state to govern its own digital space as it sees fit [2, 3].
This conceptual divide is not merely academic; it shapes national security strategies, international alliances, and the technological development of the internet itself. The United States and its allies, particularly within NATO, emphasize the development of robust cyber capabilities, both defensive and offensive, to deter aggression and impose costs on adversaries [4, 5]. In contrast, nations like China are constructing a comprehensive legal and technological framework designed to enforce a principle of 'cyber sovereignty,' managing the internet within their borders through law-based governance [6, 7, 8]. This approach prioritizes state control and social order, viewing the digital realm as a space to be managed, not a frontier to be defended through mutual threat [9, 10].
The central tension arises from these competing visions of order. Is global cyber stability best achieved through a balance of power, where credible threats of retaliation maintain peace, or through a system where each state exercises supreme authority over its own networks, cooperating on terms that respect national autonomy? [11]. This global impasse raises critical questions about the future of international cooperation, the potential for a technologically balkanized world, and whether a universal legal framework for cyberspace is even possible when its most powerful actors operate from opposing first principles [12, 13].
The fortress model: Law-based governance and cyber sovereignty
The doctrine of cyber sovereignty is a direct transposition of traditional principles of state power into the digital age . This model posits that each nation possesses the inalienable right to govern its own network infrastructure and information environment, free from external interference [14]. China has emerged as the foremost proponent of this view, systematically constructing what it terms a 'law-based cyberspace governance' system [15]. This involves creating and enforcing a comprehensive legal code for the internet, covering everything from the regulation of new technologies like algorithms and blockchain to establishing judicial processes specifically for online disputes . The explicit goal is to ensure the internet is not an 'extrajudicial place,' but a domain where the rights and obligations of all parties are clearly defined and enforced by the state .
Underpinning this legal architecture is a vision of cyberspace where order is the prerequisite for freedom . The state's role is to cultivate a 'sound cyber order' that safeguards citizens' rights while simultaneously punishing a growing list of new, internet-enabled crimes [16]. This project is directly linked to national development and security ambitions, including the creation of world-leading network infrastructure and achieving independent innovation capacity [17]. By managing the internet in accordance with its own laws and developmental path, the state seeks to protect its sovereignty, security, and development interests against perceived external threats, including what it describes as cyber attacks and theft carried out by other nations [18].
This state-centric model extends to international relations, where China advocates for a 'community with a shared future in cyberspace' based on mutual respect for network sovereignty [19, 20]. International cooperation is encouraged, but on the condition that it proceeds through dialogue and consultation aimed at creating a 'fairer and more rational' global governance system that reflects the interests of all countries, rather than a single, dominant model . This framework explicitly opposes the division of the internet or the use of technological strength to undermine other countries' supply chains, framing such actions as a form of hegemony [21]. The Chinese approach, therefore, is to build a fortified, legally coherent national cyberspace that can then engage with the world on its own terms [22].
The deterrence doctrine: Collective security and offensive capability
In stark contrast to the principle of inviolable network sovereignty stands the Western doctrine of cyber deterrence, which is built on the premise of projecting strength to prevent hostile acts. This approach, championed by the United States and its NATO allies, treats cyberspace as a domain of strategic competition where aggression must be met with a credible threat of retaliation . The central logic is not to wall off a national network, but to maintain the capability to impose 'unacceptable costs' on adversaries who might contemplate a large-scale cyber attack . This posture is inherently proactive and interventionist, extending beyond national borders to counter threats wherever they may originate.
This doctrine is operationalized through a dual focus on defensive resilience and offensive power [23]. The strategy involves not only hardening critical infrastructure against attack but also actively 'developing offensive cyber capabilities and specific plans' to hold at risk the assets most valued by potential adversaries . U.S. law explicitly authorizes the development of civilian and military units for 'offensive and defensive cyber and information warfare' . This posture is deemed necessary to counter the 'malign influence activities' of state actors, which are seen as a threat not only to security interests but to the very integrity of Western democratic institutions [24].
Alliances are the cornerstone of this strategic vision. The European Deterrence Initiative (EDI) and the broader NATO framework are designed to coordinate defense investments and enhance interoperability among allies . This collective security model is justified as a defense of shared values, including democracy, individual liberty, and the rule of law [25]. The premise is that a strong, unified alliance is the most effective guarantor of peace and stability [26]. This collaborative, forward-leaning defense posture directly challenges the core tenets of network sovereignty, which views any form of external interference in a nation's internal affairs as illegitimate .
The very definition of a cyber 'attack' within this framework is broad, encompassing any attempt to 'degrade, destroy, disrupt, manipulate, or otherwise detrimentally affect' a system or network [27]. Cyber actors are analyzed based on their methods for targeting, gaining unauthorized access, and exploiting system vulnerabilities [28, 29, 30]. The focus is on the action and its effect, not the physical location of the actor, reflecting a worldview in which digital borders are porous and threats are transnational, requiring a global, rather than purely national, response .
An irreconcilable divide on sovereignty and law
The conflict between deterrence and network sovereignty is ultimately a clash of foundational beliefs about the nature of law and power. The Western deterrence model operates on a principle of coercion by law—or by arms if necessary—applied to actors who violate established norms, regardless of where they are located [31]. The network sovereignty model, conversely, is rooted in the Westphalian concept of non-interference, where the highest authority is the state itself within its own territory, a principle it seeks to extend into the digital realm . This creates a 'clashing sovereignty' dilemma, where one government's perceived right to defend its interests through intervention conflicts with another's right to govern its own affairs without interference .
This impasse is evident in competing visions for the internet's future. Early digital utopianism envisioned cyberspace as a new social space, naturally independent of the 'tyrannies' of traditional governments . However, this ideal has given way to the reality that cyberspace is not a separate jurisdiction and that national laws do apply online [32]. The question is no longer if law applies, but whose law and how. The doctrine of network sovereignty answers this by asserting the primacy of national law within a country's digital borders . The deterrence doctrine implicitly asserts the primacy of international norms and security interests, which can justify overriding national sovereignty in response to significant threats .
This divergence prevents the formation of a global consensus on cyber governance. China calls for international cooperation to formulate rules, but based on principles of 'shared benefits' and respect for different management models . The U.S. and its allies also seek cooperation, but to uphold a specific set of values and defend against actions they define as malign . One side views building digital walls as a legitimate exercise of sovereignty, while the other sees such 'decoupling' as a violation of market principles and a threat to the global economy . Without a shared understanding of what constitutes a legitimate exercise of power in cyberspace, the domain remains a contested space governed by power politics rather than a universally accepted rule of law [33, 34].
The international community is thus left with two fundamentally opposed paradigms for cyber governance. One vision, rooted in the principle of network sovereignty, treats the digital world as a mosaic of national territories, each governed by its own laws and protected by a shield of non-interference [35]. Security is achieved through state control and the orderly management of information and infrastructure . The other vision, based on a doctrine of collective deterrence, views cyberspace as a global strategic domain where threats must be actively neutralized through a combination of defensive fortification and the credible threat of offensive action . Security in this model depends on a balance of power and the willingness to project it beyond one's borders.
This schism does more than fuel geopolitical tension; it actively shapes the future architecture of the internet. The continued divergence risks institutionalizing a 'digital divide' that is not merely economic, but ideological and legal [36]. The result may not be a single, global cyberspace, but a fragmented 'splinternet,' where competing legal regimes and security blocs operate under different rules. The central challenge for the international community is whether these clashing conceptions of sovereignty can find a mode of coexistence, or if the digital realm is destined to become a permanent frontier of conflict, where the only governing principle is the strength of each actor to enforce its will .
