9th Meeting of the third session of the Open-Ended Working Group (OEWG)

Event report

The ninth meeting of the third substantive session of the Open-Ended Working Group OEWG consisted of adoption of the Final Substantive Report by the UN member states.

Opening the session the Chair of the OEWG, His Excellency Mr Jürg Lauber, Permanent Representative of Switzerland to the United Nations and other organizations in Geneva, stated that the final substantive OEWG report represents the hard work of all delegations and strikes a very delicate balance. Regarding the procedure, Lauber noted that the outcome of the OEWG now consists of a substantive report and the chair’s summary (issued under the responsibility of the chair). Lauber further informed member states that in light of COVID-19 restrictions in place at the UN Headquarters, there will be a compendium of statements in explanation of the position issued labelled as document A/AC.290/2021/INF.2, which will allow the views of delegations to be reflected in an official document.

Lauber reminded the delegations that for the purpose of adoption, all decisions needed to be taken by consensus.

The delegations all voiced that the Final Substantive Report is a delicately crafted balance reflecting the consensus after two years of discussions. The state delegations voiced appreciation for the work of the chair and his team to steer 193 contributors to a final document.

While all the delegations voiced their support for the Final Substantive Report and joined the consensus, they all also expressed that their views were not fully reflected in the text of the Final Substantive Report. Looking at the specific states, these points were highlighted:

Russia noted that this is the first time in the UN’s history and the work within its system that utilised a truly democratic and inclusive negotiation mechanism. Russia stated that the Final Substantive Report not does not make them happy, but that it is satisfactory. The main significance of the Final Substantive Report, according to Russia, is that it guides the international community towards preserving and boosting the negotiation process on ICT security under the auspices of the UN and preserves the OEWG format into the future. Russia will continue to actively advocate for their own interests and for the interests of its allies in the future negotiations on this topic.

The United States of America stated that state behaviour in cyberspace was articulated in the three consensus GGE reports of 2010, 2013, and 2015 and affirmed by the UN General Assembly in 2015. The USA continues to have reservations about the need for a new OEWG (2021–2025). The USA stated that it can not subscribe to calls for negotiating a new legally binding instrument and remains of the view that ICTs are simply not susceptible to traditional arms control arrangements. Further, the USA voiced support for making a clear affirmation that international law applies to cyberspace and that states should be further guided by a set of non-binding voluntary norms of responsible state behaviour. Furthermore, the USA stated its strong support of capacity building and confidence-building measures. As not all the important issues for the USA are reflected in the Final Substantive Report, the USA supports the two-part Chair summary.

Australia joined the consensus on the Final Substantive Report and appreciated the recognition that international law – in particular the Charter of the UN – applies in cyberspace, as well as the clarity of the relationship between binding international law and non-binding norms. In addition, Australia welcomed the recognition of health infrastructure as critical infrastructure and of the work of women delegates, and acknowledged the contributions of the multistakeholder community. Australia welcomed the careful and nuanced way that the Final Substantive Report refers to the future of regular institutional dialogue and reaffirmed its commitment to ongoing inclusive discussions under UN auspices. Australia would have preferred more on international humanitarian law and does not currently see the need for additional legally binding obligations.

The European Union delivered the statement on behalf of its member states, the candidate countries the Republic of North Macedonia, Montenegro, and Albania, and the country of the stabilisation and association process and potential candidate Bosnia and Herzegovina, as well as Georgia, the Republic of Moldova, and Ukraine. The EU stated that the Final Substantive Report is a reaffirmation of the achievements of past UN Group of Governmental Experts (GGEs) and that it would have preferred to move the needle a bit further. In the EU’s view, paragraph 80 of the Final Substantive Report does not reflect a balanced final observation accepted by all. The EU further stressed the importance of the reaffirmation that a universal cybersecurity framework can only be grounded in existing international law, including the Charter of the UN in its entirety, international humanitarian law, and human rights and fundamental freedoms – all of which apply in cyberspace. The EU was pleased that the report reaffirms the Resolution 70/237. The EU is of the opinion that PoA should serve as a basis for further work. The EU also stressed the importance of capacity building. Austria, Slovenia, Czech Republic, Sweden, Denmark, Finland, Iceland, and Norway aligned themselves with the statement of the EU.

In their statement, Japan voiced support of the Final Substantive Report for reaffirming the framework provided by the three consensus GGE reports, but is not satisfied with the draft in its entirety. Japan would strongly prefer to see more detailed language in the international law section, including language explicitly affirming the applicability of state responsibility – in particular on the inherent right of self-defence and international humanitarian law. In addition, Japan is not happy with language in paragraph 80 with regards to the possibility of additional legally binding obligations. That being said, the inclusion of the PoA in the recommendations is a positive according to Japan, especially as it signed on as a co-sponsor.

The Netherlands praised the Final Substantive Report for reaffirming past agreements reached in the GGEs and providing further clarity on certain already agreed-upon norms. The Netherlands welcomed the inclusion of the health sector as critical infrastructure, protecting the general availability and integrity (public core) of the internet, and the recognition of threats against electoral processes. The Netherlands wished the report could have reaffirmed the commitment of the international community to upholding human rights more clearly and to be clear on advocating for the role of other stakeholders in the field of ICT security. The Netherlands sees the PoA paving the way for a permanent, inclusive, open, transparent and consensus-driven process for the future.

In its statement, Poland expressed being content with confirming a current acquis and recognition of PoA, which is to be further developed. It also stated that the Final Substantive Report did not reflect all their wishes and beliefs, but put the need for consensus first.

New Zealand believes that the Final Substantive Report represents a fair and balanced reflection. While noting that New Zealand is not fully happy with it, the report highlighted the critical importance of the agreed framework of responsible state behaviour in cyberspace, the criticality of abiding by obligations under existing international law, and implementation of the norms of responsible behaviour, as well as the need to broaden and deepen efforts related to confidence-building. New Zealand will continue discussions on issues raised in the report in more detail within the UN and in other fora.

As many others, the United Kingdom voiced appreciation that the Final Substantive Report builds on three consensus GGE reports. While the UK would have liked to see more progress in the international law section, it noted the delicate relationship between international law and norms and welcomed paragraph 25 in this regard. The UK underscored the importance of capacity building and the role of the Global Forum on Cyber Expertise (GFCE) in this regard. The UK welcomed the reference to the PoA which needs further elaboration.

In its statement Brazil, comparing OEWG to seafaring, stated two major issues that should have been addressed by the Final Substantive Report. First, paragraph 36 should have included reference to the 2015 GGE report, especially in relation to non-exhaustive views on how international law applies to the use of ICTs by states (paragraph 28 of the 2015 GGE Report). Second, Brazil voiced its regret that the international humanitarian law was not included in the conclusions and recommendations of the Final Substantive Report. Brazil stated that it welcomed reference to the ongoing GGE in paragraph 7 of the Final Substantive Report (by means of a reference to Resolution 73/266), but was disappointed, since the current GGE should have been mentioned in the section on the development of new norms and in relation to deepening common understandings on how international law applies to state use of ICTs.

South Africa emphasised the need to ensure business continuity, access to information, e-commerce, and e-learning. It voiced the concern of developing states related to increasing sophistication of malicious ICTs, as well as the need to bridge digital and gender divides. South Africa has stated the need for implementation of existing norms and their role in identifying capacity building, and warned of strain on resources. South Africa believes in a clear mandate to the new OEWG.

China praised the OEWG process for being transparent, democratic, inclusive, and multilateral. China will continue the discussions under the new OEWG framework since it is a sustained and inclusive process within the UN. China further stated that their priority is on the formulation of the new norms and it has put forward a proposal formulating new rules on data security.

The Republic of Korea praised the Final Substantive Report for confirming the previous GGE reports as its basis and having paragraphs 7,8, and 24 retained. The Republic of Korea holds that the international law is applicable to the ICT environment and would have liked the principle of due diligence to be mentioned explicitly and is hoping current paragraph 31 will serve as the basis for future discussion in this regard. The Republic of Korea believes that producing new legally binding norms is not realistic.

Indonesia is of the view that the issues in the Final Substantive Report and those not included would be best addressed in the next OEWG.

In its statement, Mexico has noted that there were issues that should have been addressed with greater value and emphasis, such as new commitments towards free, safe, accessible, and stable cyberspace that promotes sustainable development, the importance of closing the digital divide, and the exercise and protection of human rights. Mexico has conveyed its commitment to the future work on the outcomes of this OEWG in global and regional settings.

Switzerland stated it was pleased with reaffirmation of the acquis, with the clarification of the relationship between international law and norms, and welcomed the recommendation to further elaborate the PoA. It would have wanted to see international humanitarian law included in the report. Switzerland pointed out that it does not agree with the mention of the possibility of additional legally binding obligations in paragraph 80 but was ready to accept that language in the spirit of consensus. Switzerland was clear about the importance of a multistakeholder approach, as well as the rule of law in cyberspace. Switzerland has stated it will continue to participate constructively in ongoing and future discussions.

In Singapore’s view, the Final Substantive Report reaffirmed the existing acquis laid out in Resolution 70/237, and addressed many of the concerns articulated by member states of the Non-Aligned Movement (NAM). Singapore pointed out the issue of supply chain security and acknowledged that not all elements proposed by member states have been taken in. With regard to binding obligations under international law, Singapore does not consider voluntary norms and confidence-building measures to be legally binding, although it acknowledges the prerogative of states that wish to consider themselves bound to these voluntary instruments.

Egypt pointed to concerns regarding a few notions contained in the report that did not reflect some of the demands and concrete proposals that had been put forward, especially on the weaponisation of ICTs and on the need to consider legally binding obligations.

In their statement, Estonia pointed out that some parts in the final text could have been expressed more clearly, such as the applicability of international humanitarian law or the human rights impact stemming from the misuse of cyberspace. Estonia stated that reaffirmation of a universal cybersecurity framework could only be grounded in existing international law, including the Charter of the UN in its entirety, customary international law, human rights law, and international humanitarian law. According to Estonia, it is imperative that states deepen the common understanding on how existing international law applies in cyberspace, and the delegation encouraged states to develop and share the national positions. Further, Estonia stated that a new binding instrument would not make cyberspace more secure and stable, and legal applications described in existing international law provide a sufficient framework for state conduct in cyberspace. In Estonia’s perspective, norms provide additional and specific guidance on what constitutes responsible state behaviour in the use of ICTs and it therefore supports proposals to survey and support the implementation of the 11 voluntary non-binding norms from the 2015 GGE consensus report. Estonia voiced its support for the PoA as an opportunity to develop a joint and action-oriented process that builds on previous outcomes.

Liechtenstein stated that there is a discrepancy between the content of the intergovernmental discussions and the substantive results of the OEWG. According to Lichtenstein, it is rooted in the format of this process and its decision-making modalities and that the intragovernmental mandate for the next OEWG would be even more affected by these flaws. It has stated that the process may have outlived its purpose, and that Liechtenstein will reconsider its participation in the next OEWG. According to Lichtenstein, the report falls short in a number of ways; specifically it fails to adequately reflect the fact that cyberspace is governed by international law, including the UN Charter in its entirety, international human rights law, and international humanitarian law. Lichtenstein pointed out that the OEWG benefited from expert opinions on humanitarian consequences of cyberattacks, in particular from the International Committee of the Red Cross. In Lichtenstein’s opinion, the failure to adequately reflect the applicability of international humanitarian law in cyberspace in its report undermines the credibility of OEWG’s effort. In addition, there is a lack of mention of accountability for violations of international law in cyberspace and challenges of attribution. Lichtenstein sees no need to elaborate additional legal obligations in particular as long as our discussions on how to apply existing international law does not advance. Liechtenstein will re-evaluate its future engagement in the framework of OEWG.

Cuba spoke in its national capacity and as a member of the non-aligned movement underscoring that the presented Final Substantive Report does not cover all of their aspirations and proposals. Cuba stated that it gives great priority to the development of new norms with binding commitments. Further, Cuba was concerned with excessive reaffirmation of Resolution 70/237 and was disappointed with the deletion of the only explicit reference to the principles and purposes of the UN Charter. Cuba would also have liked to have seen in the Final Substantive Report explicit reference to unilateral coercive measures. Cuba recognised the inclusion of legally binding obligations in paragraph 80, but would have liked to have them in the section on international law. Speaking from the perspective of the non-aligned movement, Cuba stressed the importance of expanding capacity building. Cuba sees further discussions in the new OEWG and considers it essential to resume paragraph-by-paragraph negotiations.

The final speaker, India reiterated its concerns shared during discussions about placement of the section on norms, rules, and principles ahead of the section on international law. It stated that current paragraph 77 paves the way for furthering the discussion on the PoA, including under the new OEWG, including with regards to further elaboration of rules, norms, and principles of responsible behaviour of states in cyberspace. India has reiterated the importance of secure supply chains. Concluding, India shared its disappointment for not having an opportunity to debate language proposals and nuances in the Final Substantive Report.