It takes a community to secure cyberspace
Thoughts about cybersecurity used to be shared only by technical professionals and a number of keen observers. Those times are over. Cybersecurity has now forced its way onto the desks of politicians and business executives. It weighs on the minds of people all around the world.
It is well understood that the roles and responsibilities for a secure cyberspace are shared between States and non-governmental stakeholders (stakeholders). Collaboration between States and non-governmental stakeholders is therefore an absolute necessity.
As States set out regulations and guidelines to advance public policy objectives, a wide range of the day-to-day online activities are in practice controlled by industry. Civil society plays a myriad of roles, including in monitoring and advising on State and industry practice that could be improved. The technical community holds the keystrokes that shape the digital infrastructure and academia provides independent and thought-provoking inputs in the discourse. Any discussion that excludes segments of the stakeholder community risks irrelevance. In that vein, discussions at the multilateral level, including in the United Nations Global Mechanism on developments in the field of ICTs in the context of international security and advancing responsible State behaviour in the use of ICTs (Global Mechanism), need to meaningfully engage stakeholders. This is key to inform pragmatic decisions by States and to secure buy-in from owners and operators of relevant digital infrastructure.
Against this backdrop, it will be critical to address key questions such as: How can multilateral discussions on cybersecurity better leverage the views of stakeholders? What are concrete steps that can better enable Member States (States) and stakeholders to understand each other’s priorities to make substantive progress on common objectives at the UN?
Building a space conducive to pursuing common objectives
Tracking and contributing to UN discussions is no small undertaking. To participate in formal meetings, stakeholders must undertake an accreditation process that can unfortunately be blocked by the will of a single State, with detrimental impacts for all other 192 Member States. This so-called veto has been treated as a redline by a small number of States and therefore found its way into the consensus agreement establishing the UN Global Mechanism. However, that veto applies only to formal meetings (Annex I, paragraphs 15, c) and d)).
The formal plenary meetings of the Global Mechanism are set to engage sequentially on each pillar of the Framework for Responsible State Behaviour, as the 2021-2025 UN OEWG meeting did (i.e. threats, norms, international law, confidence-building measures, and capacity building in Annex I, paragraph 5). Stakeholders have contributed to formal meetings during the OEWG years and intend to continue doing so in the Global Mechanism. While useful to take note of formal positions and to gradually build consensus through decisions, one limitation of these meetings is that, taken in isolation, each pillar discussion may appear distant from the reality lived by States and stakeholders seeking to improve cybersecurity.
In practice, States consider the Framework as a whole when they assess threats and choose prevention and mitigation measures. This is why the UN Membership established a new format for discussions within the UN Global Mechanism, in addition to retaining the pillar-by-pillar plenary discussions. That new and informal format – the Dedicated Thematic Groups (DTGs) – is intended to enable integrated discussions on specific challenges as well as on capacity building. The July consensus agreement explicitly provides for the participation of stakeholders in both DTGs in Annex I, paragraphs 7 and 8, as expert briefers and participants. Unlike plenary meetings, the agreements do not give States veto power over stakeholder participation in DTGs.
If properly set up, the DTGs should be more practical and speak more directly to matters relevant to real-world cybersecurity issues, thereby facilitating the necessary two-way discussions between States and stakeholders on shared priority issues. This matters because having discussions on real-world challenges, instead of staying at the doctrinal pillar-by-pillar level, will provide fertile ground for peer-learning and meaningful interaction between experts, the multistakeholder community, and States (e.g. at the diplomatic, technical, policy, and legal levels). For example, stakeholders could submit papers on best practices and lessons learned when it comes to addressing specific challenges such as the protection of critical infrastructure, or to accelerate capacity building through co-designing related activities.
Such input would be well placed to inform discussions in the DTGs considering their intended structure (Annex I, paragraph 8):
“Meetings of each dedicated thematic group could proceed in the following manner: (a) briefings from relevant experts drawing from a pool of experts nominated by States; (b) dedicated time for focused discussions on a rotating agenda of specific issues including lessons learned and best practice, identifying capacity-building needs and facilitating partnerships in this regard; and (c) updates and draft recommendations on possible action-oriented measures. To ensure focused discussions, the Chair of the Global Mechanism would prepare guiding questions prior to each dedicated thematic group meeting, which delegations are encouraged to address.”
With more meaningful participation of stakeholders, DTGs have the potential of truly moving forward on substantive issues. This would align with the priorities expressed by nearly all States at the UN.
Enabling non-governmental stakeholders to optimise their added value in the UN Global Mechanism
At the same time, for stakeholders’ participation to be as meaningful as possible, there must be efforts to 1) lower the “entry cost” to their participation; 2) improve diversity and therefore legitimacy; and 3) focus contributions on matters directly relevant to State-led discussions.
First, States and stakeholders alike should improve their understanding of each other’s priorities and challenges. A better understanding of one another’s goals facilitates the organisation of efforts in directions of common interest. UN meetings usually span 30 hours over a week, making them inaccessible for some stakeholders. States’ efforts to summarise and debrief stakeholders are useful to set out the state of play, the cruxes to overcome, and the priorities expressed by States. On the other hand, stakeholder briefings are necessary to provide concise and actionable inputs to States, drawing from in-depth research products or experience defending networks online.
States and stakeholders should encourage the Chair of the Global Mechanism and the co-facilitators of the informal dedicated thematic groups to circulate proposed discussion structures and guiding questions sufficiently in advance. Given resource constraints, timely information helps facilitate informed decisions on whether to participate or not, and support more substantive engagement. Coordination among stakeholders can also lower the entry cost as those that are more actively engaged can bring others up to speed. Another lesson learned from prior experience is the value of appointing a lead penholder. Consolidated joint statements from stakeholders can help increase impact, and are easier to sign off than multiple individual submissions.
Many of these practices are already in place. However, establishing these as regular occurrences would provide a predictable and clear framework for stakeholder and State engagement. Such a recurring format may help facilitate preparations and therefore improve the efficiency in moving common priorities forward.
In other words, briefing both ways, coordination across stakeholders, and structuring our interactions could reduce the resources required for stakeholders to participate.
Further, at the UN, legitimacy is a direct corollary to diversity. Cross-regional and cross-segment collaboration significantly improves the attention dedicated to statements or documents. The inclusion and participation of stakeholders representing all regions and levels of development is necessary for global discussions to reflect the needs and priorities of the Membership as a whole. The same is true with respect to stakeholder size, whereby small entities may have niche expertise directly relevant to matters prioritised by States.
Lowering the entry cost, in line with the above, would support diversity. Additionally, big players from the multistakeholder community could consider sponsoring training for less well-represented regions or segments of the community. They could also fund their participation at UN meetings, akin to how a number of developed States have been supporting developing States through the Women in Cyber fellowship (also mentioned in the Final Report of the OEWG in Paragraph 54, k)).
Taken together, these efforts outside of the UN Global Mechanism would help ensure that the engagement of States and stakeholders within the mechanism is most useful for all parties involved.
Finally, and this point is crucial, the added value of stakeholders’ interventions will be measured by States on the basis of their relevance to the matters under discussion. One must admit that it would be unreasonable to expect stakeholders to provide pointed interventions on each of the five pillars within a short three-minute timeframe during plenary meetings. However, States can reasonably expect topical interventions in the DTG discussions, as those should engage on best practices and lessons learned on specific challenges such as the protection of critical infrastructure – a substantive matter where stakeholders have particular experience and expertise.
A loud voice may try to stall; a chorus moves forward
A small group of States is persistently seeking to modify prior agreements and insert new constraints to prevent civil society, industry, and academia from engaging meaningfully in the UN Global Mechanism. These States advocate for tools to silence views of experts, against the interests voiced by States from all regions and levels of development. On the other hand, the majority of States support meaningful stakeholder participation as they recognise that governments are not the sole relevant actors in cyberspace. Whether the Global Mechanism will be enabled to deliver on actionable substance will depend, to a great extent, on whether middle ground States speak up to support the inclusion of the multistakeholder community.
The views in this paper are provided by the author in his personal capacity only.
