The cyber norm panel that took place in early February at the Carnegie Endowment for International Peace sheds light on how “cyber norms” came about. States’ negotiations over international cybersecurity strategy evolved from focusing on ‘control of weaponization of information technology’ to ‘managing states’ behavior through cyber norms’. Moreover, it went from application of arms control to cyberspace to the application of international law. But the reason why states did not go for a treaty is yet to be explained.