Disarmament and cyber-weapons --- Ioniarimalala, valid point. Cyber-weapons (if there is such a thing) are not tangible: they may be in form of malicious code, identified vulnerabilities in software, but also in form of abusing legit features of software and hardware. This is really hard to inspect - there is no way one can count these 'weapons' the way we can record and count missiles, or control how they cross borders (again, if there is such a thing in cyberspace).

In addition, as you observe, human capabilities and skills are an equally important component of cyber-capabilities. There are attacks which don't require any single tool - and are based only on social engineering techniques that allow the attacker to take over the credentials (username and password) to a certain service; consequences, however, may be grave.

There are, however, certain options to monitor (if not control) offensive capabilities of states, such as demanding for transparency on how discovered vulnerabilities are used, in what cases certain 'weapons' can be used, against what targets and in what circumstances, etc.

We will discuss this in details in module 6.

Source author: Vladimir Radunovic vladar@diplomacy.edu