Cyber sanctions can be considered as an extension of the economic sanctions’ regimes. Thus, although the use of cyber sanctions and its introduction in the international relations is relatively new, the historical background of the sanctions goes deeper in the historical trajectory. First economic sanctions were used during the times of Ancient Greece, which is known as the Megarian Decree issued by the Athenian for the undesired trade behaviors of the Megarians. Later on, the economic sanctions between these two city-states because of the Megarian Decree led to the Peloponnesian War, which was fought between the Athenians and Spartans.^[2] Historical records show that economic power is important for the military power, and, thus, the influence of economic sanctions in world politics increased dramatically with the technological improvements since the industrial revolution that started in the 18th century. Especially with the dissolution of the Union of Soviet Socialist Republics (USSR), the use of economic sanctions increased exponentially and became the most important foreign policy instruments since the beginning of the 21st century.^[3]

It is important to understand the concept of economic sanctions before examining cyber sanctions because cyber sanctions are the extension of economic sanctions, and the goal of the both instruments is to use economic/financial instruments to change the target state's undesired behaviors. According to David Baldwin, economic sanctions are the options that have dynamic nature, meaning that they can escalate to interstate wars or deescalate to diplomatic negotiations.^[4] Thus, we can categorize economic sanctions as choice of options between the use military or negotiations. In the first category, the conflicting parties confront in the war theater, and in the second category the conflicting parties meet at the tables. However, when it comes to the economic sanctions, there is no need for the conflicting parties to meet with one another. These kinds of situations are seen when there are enduring rivalries between countries. For example, the relations between the USSR, later Russia, and the Western countries, especially the United States. Also, the relations between the US and North Korea can be another example for the use of economic sanctions for many decades. Scholars usually argue that economic sanctions are not effective when it comes to change the target state behaviors.^[5][6][7] However some argue that economic sanctions work at the threatening stage rather than imposition.^[8] Others argued that sanctions work when they are used selectively rather than comprehensively.^[9] According to Peterson Institute's international economics scholar Hufbauer et al., the implications of the economic sanctions should not be underestimated because, given the results of their datasets, almost 30% of all economic sanctions economic sanctions cases since the Second World War worked successfully.^[10] As can be seen from these arguments, we have no consensus on the effectiveness of economic sanctions in the scholarly world.^[11]

The experts have different ideas on the effectiveness of economic sanctions. This might be one of the main reasons why policymakers are skeptical for using economic sanctions for the issues related to malicious cyber activities. However, the trend shows that states are enacting some bills that consider the use of economic sanctions for cyber conflicts at the international level. The need for stability in the cyberspace requires regulations both at domestic and international levels.^[1] We can consider the legal basis for the use of sanctions for cyber activities under the United Nations Charter's Article 2.4 where it is stated that:

“All Members shall refrain in their international relations from the threat or use of force against the territorial integrity or political independence of any state, or in any other manner inconsistent with the Purposes of the United Nations.”

Under the light of the UN Charter, many actors in the international system, including the European Union as an international organization, and the major EU member countries, and the United States, have already taken steps using proactive and reactive financial and economic sanctions that can even escalate to the application of military options.

Case 1 edit

The first cyber-related sanctions in the history was used the European Union in 2017 against six identified individuals who involved in malicious cyber actions against some EU institutions and especially against the Organization for the Prohibition of Chemical Weapons, which is an international organization founded in 1997. The EU's response included targeted sanctions, such as asset freezes and travel ban for these six individuals.^[12]

Case 2 edit

After detecting malign cyber activities, aiming to manipulate the U.S. industrial systems by using the Triton malware, of some Russian individuals and the relationship between these individuals and the Russian government, the United States Secretary of State released a press statement in October, 2020, that mentioned economic sanctions were imposed economic sanctions under the Section 224 of the Countering America's Adversaries Through Sanctions Act.^[13]

United States edit

The developments on legalizing the cyber sanctions in the United States are promising that we might see enactment of more bills focusing on cyber issues at the international level. As of now, there are two executive orders (Executive Order 13694^[14] and Executive Order 13757^[15]) that explains how malicious cyber activities will be replied with the use of economic sanctions and other measures.^[16] The authority of the Treasury's Office of Foreign Assets Control (OFAC) is responsible for the initiation and outcomes of the economic sanctions related to cyber-related activities.

European Union edit

The European Union Council has adopted several conclusions on the implementations of collective cyber security in the region. These conclusions also included detailed strategies envisioning the contingency plans and coordinating the responses against malicious cyber activities targeting the EU member countries. The EU Council's conclusions stress the inevitable cyber chaos that can diffuse all over the world if a collective action is not achieved in this regard. Moreover, the creation of a network of security operation centers in the EU served the goal of envisioning the possible signals of the cyber attacks against the EU. Currently, the EU Council is working on enhancing collective cyber response focusing on sanctioning the target by creating a new entity, which is called “cyber intelligence working group.”^[17][18] Although there are steps taken in using economic sanctions for cyber-related attacks against the EU, these measures are not completed yet, and the member countries have different opinions on the response strategies. The development of the events show that we will see a consensus on strategies for using economic sanctions in the near future.

Economic sanctions are flexible tools that can be used for many different purposes in many ways. These characteristics of economic sanctions make their use as a viable option for the increasing threats of malicious cyber activities both at intranational and international levels. The development of events show that developed countries, especially the United States and the European Union member countries, are taking serious measures that might enable use of economic sanctions unilaterally and internationally. Unilateral cyber-related sanction are sanctions episodes where the sanctioning state is only one state. Today, we have examples for unilateral cyber-related sanctions. However, it is very rare to see multilateral cyber-related sanctions, where the senders can be either more than one state; or else, there is an international organization, such as the UN or EU, imposing cyber-related sanctions. As can be seen from the European Union Council's conclusions on the common economic sanctions strategies against cyber-attacks, the consensus on using sanctions at the international level looks difficult to achieve. However, we might see that countries can be more willing to cooperate in the future because the level of cyber threats is increasing exponentially every day beyond the international borders. As a result, countries might begin to include cyber commands-as seen in the United States, within their military structures considering the increasing possibility that cyber-related sanctions can escalate to the use of military options.

• Office of Foreign Assets Control
• US Cyber Command
• European Union Agency for Cybersecurity (ENISA)
• Cybersecurity & Infrastructure Security Agency (CISA)

• Benatar, M., & Gombeer, K. (2011, May). Cyber sanctions: exploring a blind spot in the current legal debate. In ESIL 2011 4th Research Forum.
• Iftimie, I. A. (2020). Cyber Sanctions: Weaponising the Embargo of Flagged Data in a Fragmented Internet. Journal of Information Warfare, 19(1), 48-IV.
• Iftimie, I. (2019, July). Cyber Sanctions: The Embargo of Flagged Data in a Geo-Cultural Internet. In European Conference on Cyber Warfare and Security (pp. 668-XIV). Academic Conferences International Limited.
• Miadzvetskaya, Y. (2021). Cyber sanctions: towards a European Union cyber intelligence service?. College of Europe Policy Brief series (CEPOB).
• Moret, E., & Pawlak, P. (2017). The EU Cyber Diplomacy Toolbox: towards a cyber sanctions regime?. European Union Institute for Security Studies (EUISS).
• O’Connell, M. E. (2012). Cyber security without cyber war. Journal of Conflict and Security Law, 17(2), 187–209.
• Peters, M. (2017). Cyber Enhanced Sanction Strategies: Do Options Exist?. Journal of Law & Cyber Warfare, 6(1), 95-154.

• Cyberspace
• Cybercrime
• Cyberterrorism
• Cyberattack
• Cybersecurity
• Cyberwarfare