Over the past three decades, cyberspace – a digital realm shaped by both technological and social dynamics – has evolved into a domain where a wide range of human activities now take place. These activities are marked by their anonymity, which complicates attribution, and their instantaneity, which challenges timely regulation. To address these challenges, states focus on two approaches: applying existing laws and creating new ones. While there is a general consensus that cyberspace should be governed by the rule of law, including international law, the application of existing legal frameworks to cyberspace remains an evolving challenge both in terms of state practice and academic discourse. At the same time, the international community has consistently sought to develop new norms to promote good governance in cyberspace.

Against this backdrop, states – especially those with advanced cyber capabilities – are engaging in a competitive game of norm-making, striving to exert influence in shaping international rules to govern cyberspace. As part of this process, states often categorise each other by trying to highlight their counterparts’ most distinct characteristics. While such labelling is common in diplomatic interactions, it is particularly problematic in the context of international cyber norm-making. Labels reflect and reinforce stereotypes, which often oversimplify the complexities of states’ behavioural patterns in cyberspace and their underlying logic. States are thus roughly grouped by opposing indicators, such as those viewing cyberspace as a global commons versus sovereign territory, those advocating for an interconnected free Internet versus a fragmented “splinternet”, or those favouring multistakeholderism versus multilateralism as the dominant approach to the governance of cyberspace. Once established, these stereotypes are difficult to dismantle and can lead to distorted perceptions that obstruct constructive dialogue.

This GCSP Policy Brief aims to identify the potential security challenges posed by stereotyping in international cyber norm-making processes. It then illustrates the policy implications of this problem and offers policy recommendations.