From consent to community: common interests and shared problems

Debates over CCH arise within broader discussions about the foundations and development of international obligation. Classical international law remains organised around sovereign equality, reciprocity and consent, and treaties bind through agreement while customary rules arise from general practice accepted as law.Footnote ¹² That structure has nevertheless long accommodated norms whose justification extends beyond bilateral exchange. Simma’s account of the movement ‘from bilateralism to community interest in international law’ captures this gradual reorientation.Footnote ¹³ Sovereignty remains the organising principle, while states increasingly exercise it with regard to interests attributed to the international community. Obligations erga omnes provide one doctrinal expression of this development, since they are owed to the international community as a whole and give all states a legal interest in their protection.Footnote ¹⁴

The language of ‘common interests’ reflects the same development. It has been applied to navigation, fisheries, environmental protection, monetary stability and the integrity of transnational networks.Footnote ¹⁵ The category is broad, however, and its content may be plural, contested and difficult to identify legitimately where states and affected communities assign different priorities to the interests at stake.Footnote ¹⁶ CCH belongs within this wider body of community-oriented reasoning, but it asks a narrower set of questions. A common interest identifies a shared stake; it may leave the governance failure, allocation of burdens, responsible actors and procedures for assessing performance unspecified. CCH begins with a defined problem whose causes, effects or management are structurally interdependent. Where no state can manage the problem alone, organised cooperation is necessary even if substantive interests and policy preferences diverge. Capacity asymmetries, weak reciprocity and incentives to free-ride may then require domestic implementation, reporting, review or compliance procedures.Footnote ¹⁷

Environmental treaty practice illustrates this problem-oriented structure. The UNFCCC and the Convention on Biological Diversity identified climate change and the conservation of biological diversity as matters of common concern because cumulative activities within national jurisdiction could generate effects beyond the regulatory capacity of individual states.Footnote ¹⁸ Later instruments connected those concerns to mitigation, reporting, finance, capacity-building and review. Comparable problem-oriented arrangements outside environmental law appear in the International Health Regulations, which require notification of cross-border public-health risks, national response capacities, cooperation with WHO and reporting on implementation.Footnote ¹⁹ The relevant vocabulary developed through the Stockholm Declaration, the Brundtland Report, the Rio Declaration and General Assembly resolutions that framed environmental degradation through prevention, cooperation, shared responsibility and the interests of future generations.Footnote ²⁰ These instruments differed in legal status and did not settle the applicable obligations at once. Taken together, however, they show how common-concern language can specify a problem, organise expectations and shape institutional arrangements before detailed legal duties are consolidated.

The use of common-concern language preserved territorial sovereignty while requiring coordination in its exercise. It also distinguishes CCH from the Common Heritage of Mankind. Common heritage concerns the legal status and governance of areas or resources beyond national jurisdiction, especially the deep seabed, and is associated with non-appropriation, collective management and benefit-sharing.Footnote ²¹ CCH operates within jurisdictional boundaries. It concerns how states exercise authority when activities, omissions or regulatory choices within one jurisdiction contribute to systemic effects elsewhere.Footnote ²²

Subsequent scholarship has accordingly treated CCH as a structural principle for collective-action problems involving global commons or public goods. On this account, common-concern reasoning may inform the assessment of cooperation, domestic implementation and measures adopted within one jurisdiction that affect actors or interests elsewhere. Treaty practice and scholarship repeatedly associate CCH with a defined shared problem, transboundary or global effects, functional interdependence, differentiated capacity or contribution, and institutional arrangements for information, implementation, reporting, review and compliance.Footnote ²³ These elements are functionally connected, although they do not operate in a fixed order. Identifying a problem that no state can manage alone provides the basis for cooperation. Cooperation may generate expectations of information-sharing, assistance and negotiation, which states implement through legislation, administrative measures and public policy. Differentiation adjusts implementation expectations to differences in contribution and capacity, while reporting and review allow other states and relevant institutions to assess performance. Environmental regimes combine these mechanisms in different ways, and treaty-based procedures have not always secured consistent compliance.Footnote ²⁴

These developments support a restrained account of CCH. The concept operates through existing sources and institutions, and its distinctive contribution is to connect a specified shared problem to cooperation, domestic implementation, differentiation and review. The next subsection turns to Cottier’s account of those functions and to the claims-and-responses process through which they may enter negotiations and institutional practice.

Cottier, claims and responses

Cottier offers a systematic account of how a specified shared problem may generate legal and institutional expectations. He organises CCH around three interrelated dimensions: a duty to cooperate, an obligation to ‘do one’s homework’ through domestic implementation, and mechanisms directed toward compliance.Footnote ²⁵ The framework presupposes a defined problem, an explanation of why unilateral action is inadequate and an account of who is expected to cooperate, regulate, assist, exercise restraint or bear consequences.

Cooperation is the most readily transferable dimension. It encompasses consultation, information-sharing, transparency concerning domestic measures and good-faith participation in negotiations, while treaty practice also connects cooperation to reporting, financial assistance and technical support.Footnote ²⁶ Cottier’s account reaches beyond episodic diplomacy and may entail regulatory convergence, coordination among administrative authorities and judicial assistance where fragmented domestic action would undermine the shared objective. Capacity-building is integral to that structure. Where states possess markedly different expertise, resources or authority over relevant firms and infrastructure, formally equal commitments may leave less-capable states unable to meet the shared objective. Common-concern reasoning therefore brings differentiated responsibilities and the capacity to contribute into the allocation of cooperative expectations, without treating capacity as a substitute for the applicable rules on responsibility.Footnote ²⁷

The second dimension concerns domestic implementation. It expects states to translate common commitments into legislation, administration and policy capable of preventing or reducing the specified risk. In environmental law, this dimension overlaps with due diligence, which requires reasonable and appropriate measures rather than a guaranteed result. Corfu Channel, Pulp Mills, the ITLOS Seabed Advisory Opinion and the ILC’s work on prevention illustrate the broader law of obligations of conduct.Footnote ²⁸ Cottier also recognises that domestic measures may affect actors and interests abroad. His formulation therefore raises questions about how a state regulates activities within its jurisdiction when their consequences are experienced elsewhere, and what safeguards apply when domestic implementation has extraterritorial effects.Footnote ²⁹ CCH does not replace the rules on jurisdiction or due diligence. It explains why domestic implementation becomes relevant to other states where activities, omissions or regulatory choices within one jurisdiction affect a problem that no state can manage alone.

Compliance is the most demanding and controversial dimension. Shared problems often lack the immediate reciprocity that supports performance in bilateral relations, and incentives to free-ride may be substantial. Cottier accordingly considers reporting, review, incentives and, in more contested formulations, collective responses associated with Articles 48 and 54 of the Articles on State Responsibility.Footnote ³⁰ His discussion of a possible right, and more tentatively a duty, to act on behalf of community interests illustrates the distance between the cooperative core of CCH and its strongest enforcement claims. Those claims cannot be generalised without regard to the applicable treaty, jurisdictional basis, conditions for countermeasures or institutional authorisation. They nevertheless expose an institutional problem. Cooperation and domestic implementation remain fragile unless standards, information and procedures allow performance to be assessed and challenged.

CCH may also influence negotiations before states have agreed on detailed obligations. A common-concern claim can identify an object of coordination, explain why unilateral action is insufficient and propose expectations concerning cooperation, domestic measures, assistance, review or restraint. Responses may contest the scope of the problem, the allocation of burdens, the forum or the safeguards governing measures that affect actors beyond the regulating state. Through claims, resistance and reformulation, CCH can help organise international law formation without becoming an independent source of obligation.Footnote ³¹ Environmental law provides the clearest illustration, because prevention, cooperation and concern for future generations appeared in declaratory instruments before they were translated into more precise treaty arrangements.Footnote ³²

The choice of forum is itself part of this formative process. A claim may be directed to a treaty conference, the General Assembly, a specialised organisation, a technical body or a multi-stakeholder process, and the institutional setting will shape participation, expertise and the legal form of any outcome. Common-concern reasoning does not dictate which forum is legitimate. It requires the claimant to explain why the chosen setting can represent affected interests, engage actors with relevant capacity and connect deliberation to implementation and review.Footnote ³³ This feature is especially important in cyberspace, where authority is distributed across intergovernmental, technical and private institutions.

Common-concern reasoning in cyberspace should therefore be evaluated by its role in negotiations as well as by treaty designations. No treaty currently designates cyber stability as a common concern, yet the concept can frame negotiations over incident notification, vulnerability coordination, capacity-building, domestic cybersecurity systems, reporting, review and the role of private infrastructure providers.Footnote ³⁴ Unlike the vocabulary of global public goods, CCH places under-provision within legal arguments about sovereignty, implementation and institutional responsibility. Any resulting duties would still require an applicable source of international law.

Limits, sources and safeguards

Keeping that role within legal limits requires clear criteria for identifying the problems to which CCH applies and for allocating expectations among relevant actors. The concept has been criticised for indeterminacy because designation alone does not specify obligations, allocate burdens or supply institutions for implementation and enforcement.Footnote ³⁵ If every important transboundary issue is described as a common concern, the category loses analytical value.Footnote ³⁶ The threshold must therefore be problem-specific. A plausible claim should identify the object of concern, the seriousness and systemic character of the risk, the shared exposure or dependence that makes isolated action inadequate, and the basis on which differentiated expectations are allocated.

Community-oriented reasoning leaves the consent-based structure of international law intact. Simma’s movement is incremental, and CCH remains distinct from obligations erga omnes and peremptory norms, whose legal consequences are more clearly established. Binding duties still require recognised sources.Footnote ³⁷ Unilateral measures remain governed by the applicable rules on jurisdiction, proportionality, non-discrimination and the protection of affected foreign interests.Footnote ³⁸ Allocation must also be specified because an appeal to humanity that obscures burdens, capacities and affected interests can reproduce existing inequalities.Footnote ³⁹ Accordingly, CCH may organise legal arguments about a specified shared problem, but it cannot displace the rules governing sources, jurisdiction or responsibility, or supply general authority to regulate in the name of humanity.

These limits define the account applied below. CCH identifies a shared problem, structures claims for cooperation and domestic implementation, and highlights the institutions needed to assess performance. Section ‘Why cyberspace tests common-concern reasoning’ examines whether cyberspace presents the relevant form of interdependence.

Architecture, territory and layered interdependence

The relevance of CCH does not depend on treating cyberspace as legally separate from territorial jurisdiction. Digital activity is anchored in physical infrastructure, firms, users and public authorities located within states, while routing, cloud services and software dependencies connect several jurisdictions.Footnote ⁴⁰ Cables, data centres, satellites and devices remain subject to territorial law; the services built on them are often operated across borders.Footnote ⁴¹

Layered accounts of cyberspace help to explain this coexistence of territory and interdependence. The physical layer carries signals; the logical layer comprises code, protocols, addressing and routing; social or application layers support communication, commerce, administration and the exercise of rights.Footnote ⁴² Authority is distributed differently across those layers. Territorial law applies most directly to physical assets and locally established firms, while code, platform design and technical standards may govern conduct across borders from another jurisdiction.Footnote ⁴³ A single digital service may therefore depend on infrastructure, software and organisations in several states, producing concurrent regulatory claims without giving any one state complete control.

The social and application layers also prevent the structural analysis from being reduced to network engineering. Communication, association, access to information, public administration and commercial exchange occur through architectures that are designed and moderated by public and private actors. Choices made at the logical layer – identity protocols, interoperability, encryption or application interfaces – can determine what is possible at the social layer, while platform rules and algorithms further shape participation and visibility.Footnote ⁴⁴ The same infrastructure can therefore be relevant to security, economic dependence and rights, even though the governing legal standards differ. This overlap explains both the attraction and the danger of broad common-concern language. A shared technical substrate does not eliminate the need to distinguish the legal problem under examination.

The analogy with environmental interdependence is structural. Environmental harms are typically cumulative and physical,Footnote ⁴⁵ whereas digital disruption may be rapid, informational, technically opaque and privately mediated.Footnote ⁴⁶ The relevant similarity is that decisions taken within one jurisdiction can affect infrastructures and users elsewhere while no state controls all of the systems on which its own security depends. Section ‘From structural similarity to legal consequence’ returns to the material differences when defining the threshold and consequences of the test case.

Transboundary effects, collective action and regulatory fragmentation

Domestic digital policy readily becomes transnational governance. Surveillance practices, content restrictions, data-localisation rules and platform obligations may affect persons and companies abroad, while cyber operations can traverse intermediary infrastructure in several states before producing effects at the target.Footnote ⁴⁷ Platform-enabled influence campaigns and cross-border data exploitation show that digital externalities extend beyond network security to political participation and public discourse.Footnote ⁴⁸ Because the technical route and legal location of conduct do not necessarily coincide, territorial regulation may externalise risks or costs even when the measure is formally domestic.

Attribution also weakens reciprocal enforcement. Technical indicators can be manipulated, operations may be routed through compromised systems, and legal attribution to a state demands more than technical confidence about a likely actor.Footnote ⁴⁹ Unilateral investment cannot secure shared routing, software, cloud or incident-response dependencies, while states and firms have uneven incentives to disclose incidents, remedy vulnerabilities or restrain useful capabilities.Footnote ⁵⁰ The wider governance structure is a regime complex of treaty rules, voluntary norms, technical practices, market regulation and informal diplomacy.Footnote ⁵¹ Strategic rivalry, rapid technical change and reliance on non-state expertise help sustain that informality. High-impact incidents such as WannaCry show how vulnerabilities in widely used systems can cross borders and disrupt public services within hours.Footnote ⁵² The UN cyber process nevertheless articulates expectations of responsible behaviour, cooperation, confidence-building and capacity-building.Footnote ⁵³ Cyberspace therefore has extensive norms and cooperative practices, but these are not consistently connected through a comprehensive international framework for monitoring, review and responsibility.

Functional dependence, the public core and capacity asymmetries

Cyberspace is especially relevant to common-concern analysis because interdependence is infrastructural rather than merely transactional. States, public institutions, firms and individuals depend on common protocols, routing arrangements, software components, cloud services and incident-response networks. The concept of the public core of the Internet identifies a narrower set of functions and resources, including naming and numbering systems, routing, root-zone operations, key protocols and transmission infrastructures, whose integrity supports a globally interoperable network.Footnote ⁵⁴ Protection of that core recognises shared dependence without converting the Internet into collective property. Dependence is often cascading. A public authority may rely on a domestic contractor that depends on a foreign cloud provider, a shared authentication service, open-source components and undersea connectivity.Footnote ⁵⁵ Failure at one layer can propagate through the others, while contractual and technical complexity may obscure which actor possesses the information or capacity needed to respond.Footnote ⁵⁶ Concentrated control over cloud, platform and network infrastructures further shapes exposure and remedial options.Footnote ⁵⁷

Dependence is also uneven. A limited number of states and firms host or regulate infrastructures, standards and services on which others rely, while many states possess less technical expertise, incident-response capacity or bargaining power.Footnote ⁵⁸ Differences in connectivity, administrative resources and access to trusted information-sharing networks shape both exposure and the capacity to influence remedies.Footnote ⁵⁹ This resembles differentiation in environmental governance, although the relevant variables are tied more directly to technological capacity, market concentration and control over infrastructural chokepoints than to historical emissions.

Territorial jurisdiction remains the legal basis for regulating infrastructure, persons and firms, but it cannot by itself secure systems that depend on decisions taken abroad. Existing rules on cooperation, due diligence and jurisdiction address parts of those relationships. The evidence therefore supports inquiry into specified digital problems rather than classification of cyberspace as a whole. Section ‘From structural similarity to legal consequence’ turns to serious disruption to shared ICT infrastructures and services.

Specifying the problem and its threshold

The structural comparison becomes legally useful only after the relevant digital problem is specified. Cyberspace includes infrastructure security, cybercrime, military operations, domain-name coordination, data protection, platform governance, online speech, artificial intelligence, competition and digital trade.Footnote ⁶⁰ These fields share technologies but differ in governing instruments, normative conflicts and allocations of authority. A domain-wide designation would obscure the shared risk, the limits of unilateral action, the actors with relevant capacity or control and the basis for allocating burdens.

The article focuses on serious disruption to shared ICT infrastructures and services. The test case is narrower than cybersecurity in the broad sense and overlaps with the policy vocabulary of cyber stability. It includes threats to the public core, including routing, naming and numbering functions,Footnote ⁶¹ and extends to widely used software components, cloud and authentication services, critical-infrastructure networks and incident-response dependencies whose failure can impair public functions, economic activity, international cooperation or rights across jurisdictions.Footnote ⁶²

A plausible common-concern claim in this setting requires a sufficiently defined object, a serious systemic risk, shared exposure or dependence, evidence that isolated state action cannot manage the problem, and a defensible account of allocation.Footnote ⁶³ These requirements distinguish the test case from neighbouring issues that may be equally serious but demand different legal frameworks. Online child sexual exploitation is principally governed through criminal law, child-rights instruments and mutual legal assistance; domain-name coordination relies heavily on technical and multi-stakeholder institutions; and online speech, privacy and AI-enabled services raise distinct questions of rights, constitutional pluralism and risk regulation.Footnote ⁶⁴

The relevant threshold concerns the structure of the governance problem. It does not require cyber harm to take the same material form as environmental harm. Climate change and biodiversity loss involve cumulative and often irreversible physical processes. Cyber disruption may spread rapidly, affect data or system functionality, and be difficult to attribute; its direct technical effects may sometimes be reversible.Footnote ⁶⁵ The present inquiry asks whether vulnerabilities or failures can propagate across jurisdictions, whether one actor’s security depends on infrastructures or decisions controlled by others, and whether unilateral measures are structurally incapable of managing the resulting risk. Serious disruption to shared ICT infrastructures satisfies those conditions strongly enough to test the legal contribution of CCH. The methodological choice leaves the legal status of cyber stability open and does not rank other digital harms.

Cooperation, capacity and domestic implementation

The first legal contribution of a CCH lens is to foreground cooperation before a dispute is reduced to attribution and breach. Incident notification, information-sharing, vulnerability coordination, mutual assistance and technical support are means of managing shared dependence.Footnote ⁶⁶ Existing regimes address these functions separately through voluntary confidence-building, technical risk management, due diligence and domestic regulation.Footnote ⁶⁷ CCH links them to a defined structure of shared exposure and asks how cooperative functions should be allocated across states and institutions under existing instruments, duties of conduct and institutional practice.

Consider a serious vulnerability in software used by hospitals, local authorities and emergency services in several states. The vendor may be private, relevant infrastructure may be distributed and the origin of exploitation may remain uncertain. A conventional responsibility inquiry may therefore produce no immediate answer. Common-concern reasoning begins with earlier questions. Which authorities, providers and technical bodies possessed relevant knowledge? What channels existed for notification and coordinated disclosure? Which actors could mitigate the risk, and was assistance reasonably available to states with limited incident-response capacity?Footnote ⁶⁸

Capacity-building is central to that inquiry because cyber dependence is asymmetrical. Some states host firms whose security practices have global effects, possess mature computer-security incident response teams or participate in trusted information-sharing networks. Others rely heavily on foreign cloud services, imported software or a small number of cable routes. A cooperative response that ignores those disparities may leave the shared system vulnerable even if every state is formally subject to the same expectation. Assistance, training, institutional support and participation in incident-response networks therefore form part of the allocation problem.Footnote ⁶⁹

Domestic implementation is the inward-facing counterpart of cooperation. National incident-response teams, critical-infrastructure protection, reporting requirements, coordinated vulnerability disclosure, secure procurement, software supply-chain standards and cloud-security rules determine whether international commitments can reduce systemic risk in practice.Footnote ⁷⁰ The ‘homework’ dimension also requires institutional competence. Domestic law must assign responsibility among regulators, response teams and sectoral authorities; firms need channels for disclosure and remediation; and public procurement should not reinforce insecure dependencies.Footnote ⁷¹ CCH does not require identical legislation. It asks whether domestic systems can reasonably prevent or mitigate foreseeable transboundary effects, share information with affected actors and avoid shifting unmanaged risks to jurisdictions with less capacity.

This perspective requires states to consider external effects when designing domestic cybersecurity rules. States retain choices about institutional design, priorities and enforcement, but measures affecting shared infrastructures should be evaluated in light of foreign users, affected regulators and capacity asymmetries.Footnote ⁷² Cooperation establishes the channels through which the shared problem is managed, while domestic law supplies many of the preventive and remedial measures.

From shared risk to responsibility

CCH leaves the rules governing attribution, breach and legal consequences unchanged. Those matters remain governed by state responsibility, jurisdiction, applicable treaty and customary rules and, where individuals are affected, human rights law.Footnote ⁷³ Its contribution is to organise the questions that arise earlier. They concern who knew or should have known of the risk, who controlled relevant infrastructure, who possessed the capacity to act and which institutions were positioned to coordinate prevention or response.

Due diligence provides the clearest doctrinal bridge. International law recognises obligations of conduct requiring reasonable measures to prevent foreseeable harm in defined circumstances, as reflected in Corfu Channel, Pulp Mills, the ITLOS Seabed Advisory Opinion and the ILC’s prevention articles.Footnote ⁷⁴ Whether a general due diligence obligation applies to cyber operations, and with what content, remains contested.Footnote ⁷⁵ Common-concern reasoning cannot resolve that controversy by assertion. It can, however, explain why the relevance of knowledge, control and capacity becomes more pronounced where a state or regulated actor can reduce a serious risk to infrastructures on which others depend.

Allocation should consider control over infrastructure, technical capacity, contribution to risk, benefit from interdependence, institutional role and the ability to prevent or mitigate harm.Footnote ⁷⁶ These factors indicate where preventive, cooperative or regulatory expectations may reasonably be concentrated without changing the legal tests for attribution or breach. They are especially relevant to distributed operations, globally used software components and concentrated cloud services.Footnote ⁷⁷ An affected state may possess less information and leverage than the provider, regulator or technical body capable of remedying the vulnerability. Private control of logs, architecture and vulnerability information can determine whether public authorities can investigate, warn affected parties or discharge their own duties.Footnote ⁷⁸

A CCH analysis therefore adds a preliminary stage to responsibility analysis. Before attribution, breach and legal consequences are assessed, it asks whether states and relevant institutions took reasonable steps to cooperate, implement preventive measures, consider affected interests and assist less-capable states.Footnote ⁷⁹ The inquiry creates no strict liability for cyber instability; it prevents the absence of an immediately attributable wrongful act from obscuring governance failures that increased the risk or severity of disruption.

Domestic and regional regulation with cross-border effects

Domestic and regional digital regulation can strengthen shared resilience, but it can also project contested choices beyond the adopting jurisdiction. Large markets and control over key firms allow cybersecurity, data, platform and product rules to influence foreign companies and users even when formally enacted as internal law.Footnote ⁸⁰ Measures such as incident-reporting duties, product-security requirements and cloud standards may reduce systemic risk; data localisation, surveillance mandates, encryption restrictions and content rules may also impose costs or conflicts on other legal orders.Footnote ⁸¹

A state that invokes shared digital risk to justify measures affecting actors abroad must satisfy the applicable limits of international law. Relevant considerations include a plausible jurisdictional connection, proportionality to the defined risk, non-discrimination, avoidance of disguised protectionism, respect for affected foreign interests, recognition of equivalent approaches where appropriate and sensitivity to capacity asymmetries.Footnote ⁸² Where two jurisdictions pursue comparable security outcomes through different institutional designs, coordination or equivalence may be preferable to extraterritorial replication of one model. CCH cannot justify generalised surveillance, compulsory control of platforms or coercive responses to alleged cyber operations.Footnote ⁸³ It therefore requires states to justify the cross-border effects of their measures under existing rules and supplies no authority for unilateral dominance.

Negotiation, claims and the compliance gap

The final consequence concerns international law formation. Once serious disruption to shared ICT infrastructures is identified as the problem, CCH can frame claims about incident notification, vulnerability coordination, assistance, domestic preparedness and the participation of infrastructure providers. Other actors can respond by challenging the scope of the problem, the allocation of burdens, the institution chosen to address it or the safeguards attached to proposed measures.Footnote ⁸⁴ This process makes disagreement more precise and can guide the design of future instruments without assuming that the common-concern label itself settles the outcome.

The design implications are concrete. Negotiations may address protected channels for sharing sensitive incident information, minimum capabilities for national response teams, assistance for states with limited resources, reporting on domestic implementation, procedures for coordinated disclosure, expectations of secure-by-design practices and arrangements for engaging private providers.Footnote ⁸⁵ A hypothetical agreement concerning severe cross-border disruption could, for example, combine notification thresholds, mutual-assistance procedures, confidentiality safeguards, national contact points and a review mechanism, while leaving attribution and countermeasures to the ordinary law. Each proposal would still require an appropriate legal basis and institutional form. CCH contributes by connecting those otherwise separate matters to a specified structure of shared dependence.

The compliance stage presents the greatest difficulty. Cooperation and domestic implementation can draw on existing processes and obligations of conduct. Effective compliance arrangements require clear standards, reliable information, procedures for reviewing performance and contesting allegations, and appropriate responses to non-compliance.Footnote ⁸⁶ Cyberspace currently lacks that combination at the international level. Its absence shifts the inquiry to the dispersed institutions that already perform parts of these functions.

Political framing and the UN cyber process

Environmental common concern consolidated gradually as transboundary harm was framed through prevention, cooperation, differentiation and responsibility to future generations. Cyber risk is more often articulated through national security, strategic stability and geopolitical competition.Footnote ⁸⁸ Cooperation remains possible, although that framing affects the willingness of states to share information, accept review or separate common infrastructural interests from strategic advantage.

The UN Group of Governmental Experts and Open-ended Working Group processes provide the clearest intergovernmental foothold. Successive reports reaffirm the applicability of international law, articulate voluntary norms of responsible behaviour and endorse confidence-building, capacity-building and cooperation.Footnote ⁸⁹ They supply a shared diplomatic vocabulary and establish that certain ICT risks cannot be managed through domestic control alone. The processes also have clear limits. They support voluntary reporting and information-sharing, but do not provide a compulsory system for independently determining breach, resolving contested attribution or attaching legal consequences to non-compliance.Footnote ⁹⁰

A CCH lens does not convert voluntary norms into binding rules. It identifies the institutional requirements for more reliable expectations, including clearer standards, reporting or peer review, protected channels for sensitive information, procedures for contesting allegations and assistance calibrated to differences in technical capacity. The UN process therefore institutionalises cooperation more successfully than compliance and reveals where further legal and institutional work is required.Footnote ⁹¹

Additional enforcement powers alone would not solve the problem. Monitoring cyber conduct is difficult because states may be unwilling to reveal capabilities or incident data, attribution remains probabilistic and public accusations can intensify strategic conflict.Footnote ⁹² A credible review architecture would therefore need rules on confidentiality, evidence, participation and contestation as well as substantive standards. Capacity-building would also need to be integrated with review so that an assessment of inadequate implementation distinguishes unwillingness from a genuine lack of technical or administrative resources.Footnote ⁹³ These conditions help explain why the compliance dimension of CCH is institutionally demanding in the cyber field.

Deliberative, technical and expert institutions

The Internet Governance Forum exemplifies deliberative governance. Established through the World Summit on the Information Society (WSIS) process without decision-making authority, it creates space for agenda-setting, policy exchange and participation across governmental, private-sector, civil-society and technical communities.Footnote ⁹⁴ Scholarship on multi-stakeholderism emphasises both the practical value of such participation and the uncertainty surrounding representation, authority and accountability.Footnote ⁹⁵ The Global Digital Compact performs a related agenda-setting function by framing connectivity, human rights, data governance, online safety, artificial intelligence and capacity-building as matters requiring global cooperation.Footnote ⁹⁶

Technical governance supplies a different form of institutionalisation. Naming, numbering, routing, standards and incident response are coordinated through specialised organisations, private-law arrangements and expert communities rather than a single treaty hierarchy. ICANN and the institutions surrounding the Domain Name System (DNS) and number-resource system illustrate how globally consequential coordination can be achieved through corporate, contractual and multi-stakeholder forms.Footnote ⁹⁷ The public-core example shows that common functions can be stabilised through these hybrid arrangements, although questions remain about participation, reason-giving, review and connection to state responsibility.Footnote ⁹⁸ Common-concern reasoning should work alongside technical governance and should not assume that intergovernmental institutions can replace it.

The Tallinn Manual project performs a different function. It maps how rules on sovereignty, jurisdiction, due diligence, non-intervention, force, attribution and armed conflict may apply to cyber operations.Footnote ⁹⁹ Its authority derives from expertise rather than inter-state consent. It clarifies legal arguments and exposes disagreement, but cannot settle contested rules or create a compliance architecture.Footnote ¹⁰⁰ Doctrinal elaboration, institutional cooperation and political agreement therefore perform different functions even when they address the same digital risk.

Regional and domestic regulation

Regional and domestic regimes provide forms of specificity that global cyber processes often lack. The EU’s NIS2 Directive, Digital Services Act, AI Act, Cyber Resilience Act and Cyber Solidarity Act translate selected risks into duties concerning critical entities, incident reporting, product security, platform risk, transparency, preparedness and coordinated response.Footnote ¹⁰¹ These measures demonstrate that states and regional organisations possess substantial regulatory tools and are not waiting for a comprehensive international cyber treaty. They also provide laboratories for operationalising reporting, risk assessment, secure design and institutional cooperation. The Cyber Solidarity Act is particularly relevant to the cooperative dimension because it establishes mechanisms for preparedness, an EU-level cybersecurity reserve and mutual assistance in significant incidents, although it remains a regional instrument rather than a global allocation framework.Footnote ¹⁰²

Comparable operational measures also exist at the national level. National cybersecurity strategies, procurement policies, secure-by-design initiatives and sectoral incident-reporting rules increasingly articulate preventive expectations for public bodies and private providers.Footnote ¹⁰³ These measures confirm the importance of the homework dimension, but they also produce a patchwork of definitions, reporting thresholds and institutional competences. Cross-border providers may face overlapping obligations, while states with smaller markets or limited administrative capacity may become rule-takers rather than co-authors of the relevant standards.

Their contribution is nevertheless partial. Domestic and regional rules are adopted under particular jurisdictional, constitutional and market conditions. Their outward effects may improve global resilience, but they may also project local preferences, create conflicting duties or impose compliance costs on actors and states that had little role in designing the regime.Footnote ¹⁰⁴ Such instruments specify obligations and enforcement within defined jurisdictions; they do not by themselves supply a shared account of transboundary allocation, equivalent standards, foreign interests or capacity-sensitive assistance. CCH is productive alongside these regimes when it connects domestic specificity to broader cooperation and review.

Connecting dispersed institutions and the conditions for crystallisation

Taken together, existing arrangements distribute relevant functions across different institutions. The UN process supplies cooperation without robust compliance; deliberative forums widen participation without determining breach; technical bodies coordinate essential functions without fitting easily into state-centred accountability; expert restatements clarify doctrine without settling state disagreement; and regional regulation provides specificity without a shared allocation of transboundary risk. The practical problem is that these functions are not connected through common procedures for allocation, review and accountability.Footnote ¹⁰⁵

In this article, institutional crystallisation occurs when these functions are connected through durable rules and procedures; it does not imply automatic customary law or a single comprehensive treaty. Environmental regimes acquired greater durability through reporting, differentiation, review and compliance procedures despite uneven implementation.Footnote ¹⁰⁶ In cyberspace, consolidation would require a specified problem, sustained political support, differentiated capacity, domestic implementation, reliable information, contestation procedures and institutions capable of engaging private and technical sites of control. It therefore depends on rules allocating responsibility and procedures supporting review and accountability.Footnote ¹⁰⁷

Where operational control lies

Environmental governance also addresses extensive private conduct. Industrial emitters, extractive corporations, energy producers, financial actors and global supply chains are central to environmental harm. The field has developed corporate-accountability mechanisms, including due-diligence guidance, disclosure expectations and business-and-human-rights frameworks.Footnote ¹⁰⁹ Yet environmental common concern consolidated primarily through state-negotiated treaties, domestic implementation and intergovernmental reporting and review.Footnote ¹¹⁰ Corporate obligations therefore remain largely mediated through state commitments and domestic regulation. In cyberspace, the same firm may operate infrastructure, set technical conditions, possess incident evidence and enforce rules across jurisdictions. The location of operational control differs even though private actors are important in both fields.

In cyberspace, private and technical actors often constitute elements of the governance architecture itself. They design and operate cloud systems, software ecosystems, operating systems, submarine networks, content-delivery services, authentication systems, platforms and algorithmic architectures.Footnote ¹¹¹ The UN Road Map for Digital Cooperation and the Human Rights Council’s work on technology companies recognise that global digital governance cannot be understood through intergovernmental action alone.Footnote ¹¹² Concentration at these layers gives a limited number of firms control over chokepoints on which states, public institutions and users depend. Such network power affects which risks become visible, which remedies are feasible, how incidents are disclosed and how regulatory choices are implemented across borders.Footnote ¹¹³ Any CCH-based arrangement must therefore account for the firms and technical bodies that hold the information and operational control needed to prevent and remedy disruption.

Privately mediated security, public functions and rights

The resilience of public administration, hospitals, financial systems, logistics and emergency communications may depend on concentrated cloud infrastructure, proprietary software, identity services and private incident-response arrangements.Footnote ¹¹⁴ Provider decisions about architecture, patching, access, continuity and disclosure may affect several states before public authorities obtain comparable information or practical leverage.Footnote ¹¹⁵ States may therefore retain legal duties even when private providers hold the information and operational control needed to prevent or remedy disruption.

Private control also affects the enjoyment of fundamental rights. Freedom of expression, privacy and access to information are protected through public law and continue to generate state duties to respect, protect and provide remedies.Footnote ¹¹⁶ Platform rules, moderation systems, recommender and advertising architectures, identity systems and data-processing practices mediate the practical exercise of those rights. At scale, algorithmic design and private enforcement determine visibility, access and the conditions of participation.Footnote ¹¹⁷ This feature differs from many environmental regimes because private actors directly operate the infrastructures through which security, public functions and rights are realised.

The distribution of authority also complicates remedy. An individual or public institution affected by a platform or infrastructure decision may confront contractual terms, automated procedures, fragmented corporate entities and several potentially competent regulators. Domestic courts and regulators remain essential, but effective redress may depend on access to information held by the provider, internal complaint systems and cooperation across jurisdictions.Footnote ¹¹⁸ A CCH analysis of infrastructure cannot resolve every rights dispute, yet it should recognise that accountability for shared resilience and accountability for rights often depend on the same private architectures.

State duties and private sites of control

States remain the primary legal addressees under public international law. CCH itself imposes no general international obligations on cloud providers, platforms, software vendors or technical coordination bodies.Footnote ¹¹⁹ Its immediate legal significance lies in organising how states cooperate, regulate private actors and exercise domestic authority when privately operated infrastructures generate or manage shared systemic risks.

States retain several instruments, including incident-reporting and critical-infrastructure duties, secure procurement, coordinated vulnerability disclosure, product-security requirements, competition enforcement, platform risk regulation, human-rights protection and cooperation with technical organisations.Footnote ¹²⁰ Competition and market regulation are especially relevant where concentration creates dependency or permits a provider to set infrastructural conditions across jurisdictions.Footnote ¹²¹ When these measures address foreseeable risks to shared infrastructures, states should coordinate them with affected jurisdictions and apply the jurisdictional and proportionality safeguards developed in Section ‘From structural similarity to legal consequence’.

State action is inadequate if it assumes that public authorities hold all relevant information or leverage. A provider headquartered in one jurisdiction may operate infrastructure and dependencies across many others; a software vendor may leave vulnerabilities affecting public systems worldwide; and a technical body may make globally consequential coordination decisions without treaty consent.Footnote ¹²² CCH therefore directs states to regulate and coordinate with actors that control infrastructure, information or remediation. It does not create legal personality or duties for every such actor. If they remain outside reporting, review and accountability procedures, CCH identifies the gap but cannot supply the missing duties or remedies.Footnote ¹²³

Hybrid institutionalisation and accountability

Hybrid institutionalisation connects inter-state commitments with domestic regulation, technical standards, private governance and public accountability.Footnote ¹²⁴ It may include public-private incident-response networks, protected information-sharing channels, capacity-building partnerships, participation by affected states and civil society in standards-setting, mandatory incident and vulnerability reporting, secure-software procurement, independent audits, human-rights due diligence and procedures for contesting private decisions.Footnote ¹²⁵ The combination will vary by sector, but cooperation, implementation and review must reach actors with operational knowledge and control.

A serious cloud-service disruption affecting hospitals or public administration in several states illustrates the point. Inter-state notification and technical assistance would be insufficient on their own. Effective governance would also require reviewable procedures concerning the provider’s risk management, incident disclosure, continuity arrangements, remediation and cooperation with affected authorities.Footnote ¹²⁶ Their scope would remain limited to the specified concern, and other digital harms would continue to be governed through their applicable legal frameworks. The procedures would translate common-concern reasoning into institutions capable of addressing the actors through whom cyber stability is maintained.

Institutional plurality can distribute experimentation and expertise across states, regional organisations, technical communities and private actors. Separate centres of authority must nevertheless communicate, recognise affected interests and remain subject to public standards.Footnote ¹²⁷ The purpose of hybrid institutionalisation is to connect those centres while allowing different domestic regulatory models and technical practices. Common procedures for notification, assistance, transparency or review can provide that connection.

Hybrid arrangements require public safeguards. Infrastructure providers should not define the public interest unilaterally. Technical decision-making should be subject to transparency, reason-giving, participation and review, and less-capable states or users should receive assistance where common standards impose disproportionate costs.Footnote ¹²⁸ The UN Guiding Principles and the B-Tech project provide useful accountability tools, including risk-based due diligence, grievance mechanisms and access to remedy.Footnote ¹²⁹ These tools do not determine the public authority or international allocation required for cyber stability. States remain responsible for creating and enforcing the arrangements, while providers and technical bodies would be subject to reporting, due-diligence and review procedures. The viability of CCH in cyberspace therefore depends on institutions that reach actors holding relevant information and operational control.