Comparative Analysis of Cyber Diplomacy in Small States and Neighbors

Thesis Abstract

This study addresses the growing gap in understanding how small states formulate and implement cyber diplomacy in regional networks, focusing on the comparative dynamics between small states and their larger neighbors to reveal how power asymmetries, institutional capacity, and strategic culture shape cybersecurity diplomacy, information-sharing arrangements, and normative leadership in cyberspace. The aim is to assess how small states leverage diplomacy to secure digital sovereignty, foster regional cyber resilience, and influence international norms, while examining the influence of neighboring regional powers on policy choices and outcomes. The specific objectives are (1) to map the cyber diplomacy architectures of three representative small states and their immediate neighbors; (2) to analyze how domestic institutions, economic constraints, and security perceptions condition policy formation and international engagement; (3) to evaluate the effectiveness of regional information-sharing and incident-response collaborations; (4) to test the applicability of constructivist and liberal-institutionalist theoretical lenses in explaining policy choices and outcomes; and (5) to derive actionable policy recommendations for enhancing small-state cyber resilience and regional leadership. The research adopts a comparative cross-national design centered on three case pairs Iceland–Norway, Slovenia–Austria, and Latvia–Estonia. A mixed-methods approach integrates qualitative and quantitative strands unit-level qualitative case studies complemented by a multi-case cross-comparative matrix and a quantitative survey administered to 120 policymakers, diplomats, and cyber security officials across the six cases. Data collection employs semi-structured interviews (n=60) with senior officials, policymakers, and researchers; document analysis of national cyber strategies, legislative records, and regional agreements; and a survey instrument measuring factors such as perceived bargaining power, institutional capacity, trust in regional mechanisms, and normative commitments. Validity is ensured through triangulation, member-checks, and pilot testing of interview protocols; reliability is enhanced via standardized coding schemes and intercoder reliability checks (Cohen’s kappa > 0.80). The data analysis proceeds through thematic analysis for interview and document data, complemented by regression analysis to identify relationships between capacity indicators and diplomatic outcomes, and network analysis to map regional information-sharing linkages. Key expected findings include (a) small states rely on targeted diplomatic leverage—such as niche capabilities, rapid incident-response commitments, and active participation in regional fora—to compensate for limited resources; (b) regional neighbors exert significant influence on small-state cyber diplomacy through conditional access to markets, security guarantees, and shared threat intelligence ecosystems; (c) successful cyber diplomacy correlates with robust domestic governance structures, interoperable legal frameworks, and active participation in regional norms-building initiatives; (d) constructs from liberal-institutionalist theory (international regime effectiveness, reciprocity, and institutional confidence) and constructivist insights (norm diffusion, state identity, and legitimacy) together explain observed policy convergence and divergence among cases. The analysis anticipates identifying a typology of small-state cyber diplomacy strategies ranging from insular resilience-building to outward regional leadership. The study contributes to knowledge by clarifying the mechanisms through which small states influence cyber governance at the regional level, linking domestic capacities to international bargaining power, and empirically testing theoretical propositions about how regional dynamics shape cyber diplomacy. It offers a practical framework for small-state policymakers to align national cyber resilience, regional cooperation commitments, and norm entrepreneurship with strategic objectives. The expected conclusion points to a model of cyber diplomacy whereby small states maximize influence through selective collaboration, credible incident-response commitments, and sustained normative leadership in regional cyberspace governance. Policy recommendations include establishing formal regional cyber incident-sharing agreements with clear data-use protocols, investing in interoperable digital forensics capabilities, and prioritizing capacity-building programs that align domestic institutions with regional security architectures, alongside targeted diplomatic endeavors to cultivate trustworthy alliances and influence over international cyber norms.