Cybersecurity can be defined as a state where national and citizen safety is guaranteed by defending against cyber attacks or threats, thereby ensuring proper functioning of cyberspace. Cyberspace is composed of ‘information systems’ and the ‘information’ stored within them.

International discussions on cybersecurity norms have continued, showing a standoff between Western liberal democratic countries led by the United States versus Russia and China. The United States and other Western nations recognize cyberspace as a separate domain and argue that international law can be directly applied to it. Non-Western countries like Russia and China contend that cyberspace is not a separate domain, and that domestic laws of the location of systems or information should apply.

The United States adopted an active defense strategy and strengthened collaboration with the private sector, considering that a significant portion of infrastructure is owned or operated privately. The EU implemented various voluntary certification systems and mandated labeling. Japan’s active cyber defense strategy is similar to the United States’, and it established a voluntary conformity assessment system for IoT products. South Korea also adopted an offensive cyber defense strategy in 2024. However, unlike major countries, we do not have a unified cybersecurity law.

The potential application of international trade law to cybersecurity measures is as follows. Even when arguing that cybersecurity measures do not apply to like products, such actions will likely be found by the panel as violations of WTO agreements. All WTO precedents addressing national security exceptions relate to wartime or emergency situations in international relations. There is a view that for measures during peacetime to be recognized under national security exceptions, there must be subjective evidence of understanding the purpose at the time of the measure and evidence of indirect supply to military facilities. Panels can assess whether parties have made good faith judgments about measures necessary to protect their essential security interests. A similar conclusion was reached in the international investment arbitration case of Seda v. Colombia.

Implications for South Korea’s cybersecurity policy are as follows. First, self-defense cannot be exercised for cyber misuse or cyber attacks that do not reach the level of armed cyber attacks. Second, offensive defense strategies must be pursued cautiously. While there is a view that preemptive self-defense targeting imminent armed attacks is permitted under international customary law, there are controversies regarding specific criteria for determining imminence. Third, the legal principle of state responsibility for domain management or due diligence in cyberspace can be usefully applied in responding to cyber threats from North South Korea. Fourth, there is a need to establish a unified cybersecurity law.

Implications for South Korea’s trade policy are as follows. First, South Korea Government must continuously observe cybersecurity measures introduced by major countries to minimize negative impacts on our export companies. Second, the government should support our companies to gain a competitive advantage regarding cybersecurity labels and certifications when competing with third countries in markets like the United States or EU. Third, when implementing cybersecurity measures, precise institutional design and operation are necessary to avoid conflicting with trade norms. Fourth, even when a country claims national security exceptions in trade agreements, review will be conducted in accordance with the principle of good faith.

국문요약

제1장 서론
1. 연구 배경 및 필요성
2. 연구 목적과 범위

제2장 사이버안보 개념과 국제적 논의
1. 사이버안보의 개념
2. 사이버안보 규범에 관한 국제적 논의
3. 사이버안보 분야의 주요 쟁점
4. 소결

제3장 주요국의 사이버안보 정책
1. 미국
2. EU
3. 일본
4. 한국
5. 소결

제4장 사이버안보 조치와 국제통상법
1. 사이버안보 조치에 적용될 수 있는 통상협정
2. 안보 예외 규정
3. 소결

제5장 결론
1. 연구 내용 요약
2. 정책적 시사점

참고문헌

Executive Summary