UNGGE Norms on Responsible State Behavior in Cyberspace

          In today's interconnected world, the use of Information and Communication Technologies (ICTs) has become central to the functioning of global society. However, the increasing reliance on these technologies also raises concerns about their potential misuse, leading to risks to international peace and security. To address these challenges, the United Nations Group of Governmental Experts (UNGGE) has, since its inception in 2004, worked to develop a set of norms that guide responsible state behavior in cyberspace. These norms, first articulated in 2013 and further expanded in 2015, aim to promote stability and cooperation among states while mitigating the risks of malicious activities in the digital space.

          The timeline of the UNGGE’s development reflects the growing recognition of cybersecurity as a global issue:

    2004: The UN General Assembly established the first Group of Governmental Experts (GGE) on Developments in the Field of Information and Telecommunications in the Context of International Security.

    2010: The second GGE session produced its first substantive report, emphasizing international cooperation in cyberspace.

    2013: A breakthrough in the GGE process led to the recognition that international law applies to cyberspace, laying the foundation for future norms.

    2015: The GGE released its most comprehensive report, outlining 11 voluntary, non-binding norms to guide responsible state behavior.

    2019-2021: The latest GGE report reaffirmed these norms and provided recommendations for their implementation.

          The UNGGE norms are non-binding, yet they provide a crucial framework for how states should act to ensure the responsible use of ICTs. They emphasize cooperation, respect for sovereignty, human rights protection, and the prevention of ICT-related threats, offering a foundation for global cyber governance. As cyber threats continue to evolve, these norms play a vital role in promoting a secure and stable international ICT environment, ensuring that states act responsibly to protect critical infrastructure, exchange information, and mitigate risks in the event of cyber incidents.

Norm (A)

          Consistent with the purposes of the United Nations, including to maintain international peace and security, States should cooperate in developing and applying measures to increase stability and security in the use of ICTs and to prevent ICT practices that are acknowledged to be harmful or that may pose threats to international peace and security.

Norm (B)

          In case of ICT incidents, States should consider all relevant information, including the larger context of the event, the challenges of attribution in the ICT environment and the nature and extent of the consequences.

Norm (C)

          States should not knowingly allow their territory to be used for internationally wrongful acts using ICTs.

Norm (D)

          States should consider how best to cooperate to exchange information, assist each other, prosecute terrorist and criminal use of ICTs and implement other cooperative measures to address such threats. States may need to consider whether new measures need to be developed in this respect.

Norm (E)

          States, in ensuring the secure use of ICTs, should respect Human Rights Council resolutions 20/8 and 26/13 on the promotion, protection and enjoyment of human rights on the Internet, as well as General Assembly resolutions 68/167 and 69/166 on the right to privacy in the digital age, to guarantee full respect for human rights, including the right to freedom of expression.

Norm (F)

          A State should not conduct or knowingly support ICT activity contrary to its obligations under international law that intentionally damages critical infrastructure or otherwise impairs the use and operation of critical infrastructure to provide services to the public.

Norm (G)

          States should take appropriate measures to protect their critical infrastructure from ICT threats, taking into account General Assembly resolution 58/199.

Norm (H)

          States should respond to appropriate requests for assistance by another State whose critical infrastructure is subject to malicious ICT acts. States should also respond to appropriate requests to mitigate malicious ICT activity aimed at the critical infrastructure of another State emanating from their territory, taking into account due regard for sovereignty.

Norm (I)

          States should take reasonable steps to ensure the integrity of the supply chain so that end users can have confidence in the security of ICT products. States should seek to prevent the proliferation of malicious ICT tools and techniques and the use of harmful hidden functions.

Norm (J)

          States should encourage responsible reporting of ICT vulnerabilities and share associated information on available remedies to such vulnerabilities to limit and possibly eliminate potential threats to ICTs and ICT-dependent infrastructure.

Norm (K)

          States should not conduct or knowingly support activity to harm the information systems of the authorized emergency response teams (sometimes known as computer emergency response teams or cybersecurity incident response teams) of another State.