How businesses can promote cyber peace

Multifaceted cyber threats are increasingly impacting the bottom lines of firms, and spilling over into larger issues of geopolitical importance, including international security.1 Firms, and in particular their managers and boards of directors, are at the epicenter of this storm, but so far surveys have revealed that few businesses are taking the necessary steps to safeguard their private data and enhance cybersecurity.2 This state of affairs has ramifications beyond these company's networks. As Howard A. Schmidt, the former U.S. Cybersecurity Coordinator, stated: "[W]hile there is a cost to doing more to improve cybersecurity, there is a bigger cost if we do not and that cost is measured not only in dollars, but in national security and public safety."3 There is a rich literature on how the private sector can contribute to general peace-building and the promotion of human rights, but so far this perspective has not been fully explored in ongoing debates about promoting cyber peace.4 This article addresses this omission by reviewing the positive role that businesses can play in conflict dynamics, such as fostering communications between antagonists and acting as norm entrepreneurs in identifying and instilling best practices, and applying these findings to the cybersecurity context. Given the slow progress of both U.S. Congressional and multilateral cybersecurity policymaking, the time is ripe for a fresh perspective on how firms can help to proactively foster cyber peace in a world that is increasingly engaging in cyber conflict.