Cyber Peace & Security Monitor, Vol. 2, No. 1

Building on—and establishing—foundations
3 June 2021

Allison Pytlak

Momentum on international cyber security issues within the United Nations may finally be building. In March 2021, the UN’s first ever open-ended working group (OEWG) on information and communications technologies (ICTs) adopted a substantive outcome report by consensus, a result that many felt was out of reach given the Group’s acrimonious establishment in 2018. While not all came away completely happy with the final report, and concessions were made, most heralded it as a win for diplomacy and multilateralism. Last week, the UN’s sixth Group of Governmental Experts (GGE) on responsible state behaviour also agreed to a substantive outcome report by consensus, a result that eluded the previous GGE.

In this context, states convened on 1 June 2021 in a hybrid format for an organisational session of the UN’s new open-ended working group (OEWG) on “security of and in the use of information and communications technologies.” This is the UN’s second such OEWG and it too was established amid some controversy[1] by resolution A/RES/75/240 in 2020.

The organisational session was convened to discuss, and where possible take decisions on, key procedural issues and organisation of the Group’s work which will commence later this year through to 2025. It was opened by the High Representative for Disarmament Affairs, Izumi Nakamitsu. An overwhelming message from the session was the importance of building on the foundations of past agreements, even while taking decisions that will establish new foundations for this new OEWG.

A few key decisions were taken, but others will require longer consultation over the coming months. While these are largely issues of procedure, some correspond with issues of substance—and, particularly when in relation to matters of agenda and mandate, the ghosts of disagreements past may still be creeping around.

Through general statements, states outlined their views on organisational matters, as summarised non-exhaustively below. Some interventions reacted to suggestions made in a concept paper prepared by Russia in advance of this organisational session as well as summarised in Russia’s statement.

Agreed decisions

Chairperson, decision-making, dates

Ambassador Burhan Gafoor of Singapore was confirmed as the Chairperson of the OEWG by an acclamation process. In a brief statement, he said that the Group is “fortunate to have a very strong foundation to build upon,” in reference to the consensus report adopted by the previous OEWG in March 2021 and that adopted by the sixth GGE on state behaviour in cyberspace. Amb. Gafoor also stressed that his door will always be open to delegations, and that he is committed to continuing discussions in an inclusive and transparent manner. However, he noted to states that while he can guide the process, it is “ultimately your process and the outcome is for you to shape collectively and constructively.” He and many delegations paid tribute to the work undertaken by the Chair of the first OEWG, Ambassador Lauber of Switzerland.

It was also decided that the Group would be guided by the rules of the procedure of the UN General Assembly’s Main Committees except in the area of decision-making. Whereas the UNGA Committees can take decisions by vote—indeed, the resolution establishing the OEWG was adopted by a vote, including on specific of its paragraphs—the OEWG will only take decisions by consensus, as indicated in A/RES/75/240. Most delegations reinforced the importance of consensus-based decision-making, although Mexico highlighted that consensus must be seen as a means to reach decisions, and not an end in itself.

A first substantive session has been tentatively scheduled for 13–17 December 2021.

Outstanding decisions

Structure and agenda

Resolution 75/240 provides for the establishment of thematic sub-groups “as the Member States deem necessary, with a view to fulfilling its mandate and facilitating the exchange of views among States on specific issues related to its mandate.”

This suggestion was further developed in the Russian concept paper for the OEWG. The paper was disseminated to states a few weeks before the session, updated and re-shared for 1 June, presumably to act as a basis for discussion. Russia was the lead sponsor of the resolution establishing this OEWG. The paper describes the creation of five groups as well what their thematic areas of focus could be, the level of priority of each, objectives, and who could participate.[2] The concept paper does not exclude the possibility of some states creating a separate subgroup on humanitarian aspects of information security (with participation of NGOs and academia) such as sustainable development, human rights, gender issues, etc., which Russia describes as not “directly related to the competence of the UNGA First Committee.”

These five thematic areas roughly correspond with the six thematic areas of focus/agenda items of the first OEWG (two of them have been somewhat merged together in the Russian paper) but their descriptions in the concept paper bring in some new elements or elevate others, which are concerning to some delegations (i.e. the explicit reference to data security as a threat to be considered; and references to potential future legally-binding norms). The first OEWG also treated all topics equally and without prioritisation. Striking a balance between the language of the resolution and building on the first OEWG’s methods of work and outcomes seems likely to be a challenge in the coming months, as states define agenda items and the programme of work.

Russia, Cuba, Iran, China, and Indonesia urged adherence to the mandate of A/RES/75/240. Pakistan said the establishment of sub-groups would be helpful in fulfilling the OEWG’s mandate, while China said the sub-groups should be in conformity with the mandate.

Egypt expressed that it views the topics relating to setting new norms, rules, and principles; implemented agreed ones; capacity-building; and regular institutional dialogue as the most important for protecting against an arms race in this domain and preventing militarisation.

Australia and Canada said they expect discussions to reflect the broad themes that were agreed to in the first OEWG consensus report. New Zealand articulated that the existing framework agreed has four elements—law, norms, confidence-building measures (CBMs), and capacity-building—and that its integrity and cohesion must be respected in its entirety. The United Kingdom (UK) echoed this point, stating that new elements should not be introduced to the discussion without consensus agreement; Brazil associated with this point.

The UK also referred to the title of this second OEWG, which differs from the first OEWG, and stated that if the discussion is to expand to include the regulation of ICTs (as the title somewhat implies) then it must be placed in the context of state behaviour. The regulation of technology companies should remain in other appropriate fora.

Egypt, Switzerland, and Norway emphasised the interlinked nature of the OEWG agenda items.

India did not support the idea of sub-groups and urged focusing on themes/chapter headings agreed in first OEWG report, which were also referenced by Republic of Korea, Poland, and France.

South Africa spoke of the six topics of the first OEWG, which were also described by Thailand, and Ecuador urged not censuring some of the issues that were put on the table in that Group.

Indonesia urged focusing on how to structure interrelated agenda items in a way to address them coherently, and to carefully consider the creation of sub-groups in order to prevent a proliferation of discussion. Their priorities should focus on the mandate set out in A/RES/75/240.

France and Ecuador expressed reservations about the sub-group proposal. Argentina said that the proposal is in principle a valid one but the sub-groups should contribute to discussion, and not create obstacles or siloes.

Canada, Switzerland, and India urged equal status for sub-groups, if established. Brazil would hope to work out the details of the sub-groups in a way to avoid treating topics in a rigid and inefficient way. It is not comfortable with a separate group on issues like gender and human rights, noting these topics should not be dealt with in a “peripheral” manner or sidelined.

Iran encouraged moving ahead with adopting decisions to elect officers to guide the process of forming sub-groups and developing the programme of work. Iran, Venezuela, Cuba, and Nicaragua support the suggestion in the concept paper to elect two co-chairs per sub-working group, with one chair from a developing country and the other from a developed country. Other states, such as the UK, India, and Ecuador, would prefer to have just one chairperson for simplicity or to enable coordination across sub-groups.

All delegations were supportive of sub-groups meeting in a sequential or consecutive manner, and not in parallel with one another, if established. The Philippines urged avoiding overlap with other meetings in the disarmament calendar.

Iran noted that issues with obtaining travel visas are a reason to hold meetings in more accessible venues than New York.

Format

The main point of discussion about format concerned the possibility of hybrid or virtual meetings, in light of the on-going COVID-19 pandemic.

Egypt encouraged that the format of any sessions that will take decisions be agreed on in advance and to allow for at least one meeting per session to be convened in person, for the adoption of documents. Iran prefers formal decisions be adopted through physical meetings.

Iran, Cuba, and Nicaragua expressed preference for meetings that utilise a rolling, text-based, paragraph-by-paragraph negotiation format.

The UK, Mexico, and Costa Rica encouraged considering hybrid meetings for a while longer. Indonesia noted that this allows for delegates from capitals to participate.

A few delegations such as Malaysia and Costa Rica highlighted that the informal, intersessional meetings that were convened in the course of the first OEWG to maintain momentum amid the pandemic were helpful and should be continued.

Civil society participation

One of the more contentious issues appears to be the participation of civil society. During the first OEWG, civil society participation in formal sessions was limited to organisations with ECOSOC status—something which is highly unusual in meetings stemming from the UNGA First Committee. There was one multi-stakeholder meeting held in December 2019 that was open to any interested groups because it was held under informal status; and some member states co-organised other informal opportunities with civil society actors, to hear views and inputs at key junctures in the process. Those events were successful and well-attended but had to be separately organised on the margins of the OEWG.

Canada raised this issue early on in the organisational session, describing how the process put in place during the first OEWG resulted in a narrow focus on who was able to participate and that many relevant actors and groups were excluded. It noted that some other General Assembly processes have found more flexible approaches and encourages that this next OEWG adopt an approach that is more transparent, in which objections to specific organisations be discussed openly, for example, which the UK supported. The UK expressed that when a state vetoes the participation of a stakeholder, that decision should be explained and debated. Switzerland pointed to the recently agreed modalities for civil society participation in the cybercrime treaty process as a possible model.

Canada said that it has language and textual suggestions on this point, based on other processes. Mexico, the UK, the Czech Republic, Colombia, Brazil, Ecuador, and France expressed interest in receiving this language. Ecuador said it would like to see more than a repeat of the 2019 multi-stakeholder session.

Many delegations, including Chile, Costa Rica, Poland, the EU, Estonia, and France, among others, spoke positively of the involvement of civil society and non-governmental stakeholders, with some mentioning NGOs, academia, the technical community, and industry and the varied role that these actors play in relation to ICTs and cyber space. Ireland highlighted that no single stakeholder acting alone can tackle the many challenges faced in cyber space. The Czech Republic described the significant number of working papers submitted by civil society to the first OEWG, but that very few had ECOSOC status and that those groups face barriers to participation; a point echoed by Switzerland. Mexico noted the absence of civil society in the organisational session. Norway connected participation with issues of transparency. Argentina noted that while the first OEWG did allow for some participation, states must foster greater participation and that the OEWG report notes the crucial role of stakeholders.

Russia, Iran, Cuba, Nicaragua, Suriname, and India expressed preference for using the same modalities for civil society participation as in the first OEWG. Russia said that moving beyond the list of non-governmental organisations with ECOSOC status would lead to unnecessary arguments about who should be invited, which might undermine substantive discussions. Indonesia also supported this approach but suggested that opportunities be given for stakeholders to make submissions or engage informally.

Reports

There was limited discussion about OEWG reports. OP1 of A/RES/75/240 calls on states to submit annual progress reports and a final report on the results of its work to the General Assembly at its eightieth session (in 2025). Mexico promoted the idea of reporting annually on progress, “in order to set more tangible goals in a timely fashion, and that are action oriented.” Egypt felt these will be helpful for taking stock of progress. It was generally agreed that more discussion is needed on the reports.

Other

Linked to the discussion about agenda items and mandate, many delegations stressed the importance of building on the existing acquis, which is the term that has come to refer to the collective outputs of the relevant UN GGEs and the first OEWG. In this context, it is evident that there are still some divergent views on the subject of the OEWG developing new norms or legally-binding measures, in line with pre-existing state positions on this topic.

Canada highlighted that the first OEWG report advanced the meaningful participation of women in cyber security and diplomacy. It said that it will be important to mainstream gender considerations and to build on the work already done on this topic during the first OEWG. Mexico urged closing the gender gap in ICTs.

Several delegations welcomed the adoption of sixth GGE’s consensus report, although Ecuador noted that not all states had yet seen the text of the report because the GGE was limited in number and closed.

Reference was made to the proposal for a cyber programme of action (PoA), which was first tabled in 2020 and now has more than 50 co-sponsors. Discussions on the scope and process for establishing a cyber PoA are on-going among its supporters, and reference to the PoA in the first OEWG’s final report was an issue of contention. If it is established, it would constitute another track of work—and a more binding commitment—on many of the same issues the OEWG will address.

The EU, Estonia, and Poland noted the benefits of a potential PoA. The UK would see it being discussed in the context of the OEWG’s thematic track on regular institutional dialogue; Korea hopes to elevate the PoA’s standing and elaborate it further. Switzerland, Ecuador, and France stressed complementarity between processes.

[1] It was felt by some states that establishing a second OEWG before the first one concluded its work would be premature or prejudge results. The final edition of our 2020 First Committee Monitor has a full report that describes the dynamics around this resolution, including reactions and voting results, and the three other cyber-related resolutions adopted.

[2] They are: 1) On the study of threats, development and implementation of rules of responsible behaviour of States (in the context of the agenda of the UNGA First Committee – international peace and security); 2) On the applicability of international law to the use of ICTs; 3) On confidence-building measures; 4) on capacity-building; and 5) on regular institutional dialogue. Group one would be the “priority” group, and the others considered “subsidiary sub-groups”.

[PDF] ()