What is a norm entrepreneur, and why does Microsoft act as one in cybersecurity?

An actor that actively tries to shape the rules and norms others follow. Microsoft does so to prevent state laws that threaten its business model and to establish itself as an indispensable global ordering power, with profit as the overarching motive.

Microsoft uses a three-track strategy aimed at governments, industry and citizens. Its best-known initiative is the proposed Digital Geneva Convention (DGC), a set of rules restraining state cyberattacks.

Possible explanations for why a company wants to shape state norms:

• Corporate Social Responsibility (CSR): possibly a CSR measure to win back consumer trust lost when customers learned that Microsoft had taken part in the NSA surveillance programme PRISM.
• Diplomatic ambitions: a new form of entrepreneurship that tries to influence the behaviour of states and presents the company as a diplomatic actor.

How it works: campaigns that try to spark a grassroots movement, so that citizens pressure their governments into adopting the norms. The argument is that civilians will suffer if governments don't adopt the DGC's restrictions. But the overarching motive remains revenue.

Companies also form normative alliances with other industry members, which explicitly aim to change how companies deal with vulnerabilities and to renegotiate the social contract between states and citizens. The growing politicisation of companies is traced to the post-national constellation: globalisation shifts public-private governance away from the state.

Go deeper:

• Brad Smith: The need for a Digital Geneva Convention (Microsoft, 2017) — the proposal itself, worth reading for its "we" framing.
• Wikipedia: Norm entrepreneur — the concept from international relations.
• Wikipedia: PRISM — the NSA programme whose exposure cost Microsoft trust.