For over a decade, we have heard alarming statements about the spread of cyber weapons from senior policymakers and experts. Yet, the dynamics of cyber proliferation are still under-studied and under-theorized. This study offers a theoretical and empirical account of what causes the spread and restraint of cyber weapons and argues that the world is not at the brink of mass cyber proliferation. Whilst almost forty states are exploring and pursuing the development of cyber weapons, I indicate that only few have so far acquired a meaningful capability. This is due both to supply and demand factors. On the supply-side, most states have a latent capacity to develop relatively simple offensive cyber capabilities, but are unable to develop sophisticated cyber weapons. Moreover, the incentives for knowledge transfer and thus exporting offensive cyber capabilities between states are weak. On the demand-side, I show that national security considerations do not provide the best explanation of variance. Instead, domestic politics and prestige considerations are paramount. Moreover, and unlike nuclear proliferation, I argue that it is not the possession of cyber weapons but the intention of possession signalled through visible initiatives which matters. Ultimately, I note that cyber weapons can have strategic value - but only under certain conditions.

Technology tends to evolve over time, leading over things to evolve with it. One example may be the evolution of weapons with technological advancement. When these weapons change, it changes how war is conducted. This paper seeks to delve into the specifics of this phenomena. With technological advancement, the world has seen new threats such as lethal autonomous weapons (LAWs) and cyber weapons. New weapons have been, at times, too threatening. They have created so much stigma around themselves the international community ultimately decided against their use. These weapons may then receive a weapon taboo, discouraging their use. This paper seeks to analyze whether the aforementioned emerging technology weapons – LAWs and cyber weapons – may deserve a taboo. The paper will utilize case studies by examining weapons which were previously given a taboo. By determining why other weapons - specifically chemical and biological weapons (CBWs) and nuclear weapons - received a taboo, this paper will determine whether LAWs and cyber weapons also meet the criteria.

In 2010, the discovery of the malicious computer worm Stuxnet shocked the world by its sophistication and unpredictability. Stuxnet was deemed as the world’s first cyber weapon and started discussions concerning offensive cyber operations – often called “cyber warfare” – globally. Due to Stuxnet, rapid digitalisation and evolving technology, it became vital for decision makers in the US to consider formal norms such as laws, agreements, and policy decisions regarding cyber security. Yet, to obtain a holistic understanding of cyber security, this thesis uses constructivism as its theoretical framework to understand changing informal norms and social factors including the ideas and morals of the US society regarding offensive cyber operations. This thesis critically analyses the discourse of three of the largest US newspapers by circulation: the New York Times, the Washington Post and The Wall Street Journal. A significant shift was discovered in the US media’s publications and in informal norms regarding offensive cyber operations and the use of cyber weapons in just one decade, by comparing the discourses relating to Stuxnet in 2010 and the US presidential election in 2020. This thesis concludes that it is equally important to consider ideas and morals when researching a technical field such as cyber security by arguing that informal norms guide the choices actors make when developing formal norms at the international level. The findings of this thesis are intended to provoke a normative, urgent, and focused discussion about cyber security. The findings are also intended to shift attention to how language is used in discussions about the cyber sphere, offensive cyber operations and cyber weapons as components of the traditional battlefield.