On Friday 11 July, Convention Room 4 at UN Headquarters in New York broke into applause. The five-year mandate of the UN Open-Ended Working Group (OEWG) on safety of and in using data and communication applied sciences (ICTs) had simply concluded, and delegates celebrated the adoption of its last report by consensus.
Preliminary protection has focussed on the report’s headline achievement: the institution of a brand new everlasting mechanism to proceed multilateral discussions on accountable State behaviour in our on-line world (see e.g. right here or right here). However the OEWG’s mandate prolonged past institutional design – and considered one of its core duties was to advertise frequent understandings on how worldwide legislation applies to States’ use of ICTs.
On this publish, I provide a essential appraisal of whether or not the report lives as much as that job. Whereas I totally acknowledge the importance of constructing consensus in right now’s tense geopolitical atmosphere – and the appreciable effort made by the Chair’s group and plenty of delegations to realize that end result – I argue that, total, the report represents a missed alternative in the case of worldwide legislation. That mentioned, the OEWG course of has additionally introduced some constructive unwanted effects, detailed beneath. I conclude by charting potential future developments on this space.
At first look: Worldwide legislation within the last report
There is no such thing as a query that the difficulty of how worldwide legislation applies to ICT actions is of appreciable world significance. Our societies are actually interwoven with an omnipresent digital layer that has remodeled each side of our lives, from private communication to worldwide commerce and world safety. The report catalogues quite a few ICT-related threats to worldwide peace and safety, together with cyber operations concentrating on essential infrastructure and key establishments (paras 17 and 21), malicious exercise aimed toward undermining belief and stability overseas (paras 18 and 22), and the rising use of ICTs in armed conflicts (para. 15).
Confronted with such a fancy risk panorama, the necessity to make clear how worldwide legislation governs these actions and mitigates their results is especially urgent. This was additionally one of many core goals of the OEWG, which served because the principal – and certainly the one – world multilateral platform for dialogue of those points. Created in 2020, it was endowed with a five-year mandate that included the request ‘to proceed to review, with a view to selling frequent understandings … how worldwide legislation applies to using data and communication applied sciences by States’ (UN GA decision 75/240, OP 1).
As has grow to be customary in UN-mandated processes on ICT safety, the report features a devoted part on worldwide legislation, comprising eight numbered paragraphs (part D, paras 39–46), some subdivided additional. It’s a short learn – slightly below 4 pages in whole.
But a lot of that already restricted area is taken up with procedural points. Paras 39 and 40 define the background on how the discussions advanced and seek advice from prior reviews for a non-exhaustive record of matters that guided these exchanges. Para. 42 notes a few of the points that have been really mentioned – specifically, ‘sovereignty, State duty, due diligence, and worldwide humanitarian legislation’ – however affords no substantive engagement with any of them. The ultimate paragraphs (43–46) include suggestions for future work.
In impact, just one paragraph – para. 41 – might be learn as an try to fulfil the OEWG’s mandate to advertise frequent understandings of worldwide legislation. It comprises 5 subparagraphs (a)–(e). The query is whether or not any of them achieve doing so.
Slim pickings: Searching for frequent understandings
Paras 41(b) and 41(c) might be put aside on the outset, as they merely restate current provisions of the UN Constitution: Articles 2(3) and 33 on the peaceable settlement of disputes, and Article 2(4) prohibiting using power. The report’s use of the verb “reaffirms” is suitable – it has lengthy been agreed that the UN Constitution applies within the cyber context (see e.g. A/68/98, para. 19, courting again to 2013). Nevertheless, States couldn’t agree on something past restating these bedrock guidelines of the Constitution.
Curiously, the Chair’s zero draft, issued in Could 2025, contained a modest clarification that may have complemented para. 41(c): ‘An ICT operation could represent a use of power when its scale and results are akin to non-ICT operations rising to the extent of a use of power.’ It is a pretty uncontentious remark. If a cyber operation carried out by one State towards one other causes a prepare collision or opens a dam above a populated space, leading to destruction and lack of life, it stands to motive it might quantity to a use of power – simply as a missile strike inflicting the identical results would. This method is mirrored in quite a few nationwide positions in addition to within the frequent positions of the African Union and the European Union. Nonetheless, some delegations objected (e.g. Russia described it as ‘extraordinarily controversial’), and the sentence was in the end not retained within the last report.
Paras 41(a) and 41(d) on sovereignty and non-intervention are equally restricted. They restate language from a report adopted in 2021 by one of many predecessors of the present OEWG, the Sixth Group of Governmental Consultants or GGE (see A/76/135, para. 71(b) and (c), respectively).
Para. 41(a) addresses sovereignty and sovereign equality – ideas that lie on the coronary heart of debates on worldwide legislation within the cyber context. Related questions vary from the basic (is sovereignty a standalone rule that could be violated by cyber conduct, or solely a guideline from which different guidelines movement?) to the extremely sensible (are cyber actions equivalent to utilizing ICTs to spy on different States, interfering with overseas elections, or conducting cyber forensics overseas with out the affected State’s consent in keeping with the respect for different States’ sovereignty?). Regrettably, the report sidesteps all of those questions and limits itself to generalities equivalent to restating that ‘[e]xisting obligations below worldwide legislation are relevant to States’ ICT-related exercise’.
Para. 41(d) pertains to the precept of non-intervention. It reaffirms that ‘States should not intervene straight or not directly within the inside affairs of one other State, together with via ICTs’. Once more, this restates that the prohibition applies within the cyber context (utilizing the 2021 language) with out clarifying how. The basic two components of intervention – interference within the domaine réservé and coercion – elevate complicated questions within the digital area. As an illustration, how ought to the coerciveness of cyber operations be assessed: by intent, impact, or one other metric? The report doesn’t say.
Solely para. 41(e) introduces language that was newly developed inside this OEWG. It reads: ‘[States a]dditionally highlighted that conduct utilizing ICTs that doesn’t quantity to a violation of the prohibition on the risk or use of power could, relying on the circumstances, be opposite to different rules of worldwide legislation, equivalent to State sovereignty or the prohibition on intervention within the inside or exterior affairs of States.’ Whereas correct, the sentence is actually a truism: it goes with out saying that conduct that doesn’t violate rule X could, ‘relying on the circumstances’, be opposite to rules Y or Z. Nevertheless, the report doesn’t make clear what these circumstances is likely to be, nor does it provide any concrete examples, ICT-related or in any other case.
General, the report’s contribution to figuring out frequent understandings of how worldwide legislation applies to ICTs may be very modest. It reaffirms a handful of Constitution provisions, restates some (however not all) of the beforehand agreed language, and introduces a legally cautious – and conceptually imprecise – remark. Frequent understandings, not to mention progress, on key matters equivalent to the applying of worldwide humanitarian legislation (IHL) or worldwide human rights legislation are solely lacking. The chance to maneuver the dialogue ahead was not taken.
Zooming out: Understanding the report’s end result
One factor is obvious: the self-love of the report’s engagement with worldwide legislation doesn’t replicate the extent of debate and understanding amongst States. Over the previous decade, a number of States – 35 on the time of writing, in line with the Cyber Legislation Toolkit database – have issued detailed nationwide positions on how worldwide legislation applies to cyber actions. In 2024 alone, the African Union and the European Union – collectively representing 82 States – printed regional positions on the identical matter.
Furthermore, as I mentioned on this weblog beforehand, in October 2024 States adopted by consensus an ICT decision on the Worldwide Convention of the Crimson Cross and Crimson Crescent, constructing frequent understandings on the protections afforded by IHL towards the dangers arising from ICT actions throughout armed conflicts. And throughout the OEWG itself, two cross-regional teams of States submitted detailed working papers on these themes: one on the applying of IHL to using ICTs throughout armed conflicts, and one other on areas of convergence within the software of worldwide legislation to using ICTs, supported by 13 and 21 States respectively.
Because the European Union consultant noticed throughout the last session in New York, taken collectively, these developments imply that ‘over 100 Member States have now individually, or as a collective, printed their place and views on the applying of worldwide legislation’. A lot of this progress can in reality be traced to the OEWG and its predecessors. The sixth GGE and the primary OEWG actively inspired States to develop and publish nationwide positions, serving to to lift the profile of this follow and elevate it to a coverage precedence. The working papers talked about above have been drafted particularly to assist and deepen the discussions on the OEWG – they usually did so, even when they weren’t in the end included into the ultimate textual content.
Why, then, did this wealth of engagement fail to translate right into a extra substantial report? One key motive lies within the enduring divide between States on whether or not a brand new binding authorized instrument is required on this space. For a lot of States – predominantly however not solely Western – current worldwide legislation is taken into account enough. These States subsequently opposed any suggestion of a future ‘Our on-line world Treaty’. For others – significantly Russia, China, and aligned States – the negotiation of such a treaty stays a central goal, and regard the event of frequent understandings on how worldwide legislation applies to ICTs as doubtlessly undermining that goal.
The ensuing compromise glad neither camp. So as to obtain consensus – a structural requirement of the OEWG course of that successfully gave every State a veto – successive drafts noticed the textual content pared again considerably. As famous, the report is subsequently skinny on frequent understandings – nevertheless it additionally avoids mentioning a future binding authorized instrument, besides to ‘not[e] the potential for future elaboration of extra binding obligations’ (para. 43(e)). That is regrettable as a result of – as Talita Dias has noticed – these two pathways should not essentially mutually unique, and framing them as a ‘binary alternative’ is unduly reductive.
Wanting forward: Future developments
The report comprises three forward-looking suggestions regarding worldwide legislation (paras 44–46). The primary is that States ought to ‘proceed discussions on the future everlasting mechanism on how worldwide legislation applies in using ICTs’ (para. 44). At current, the potential of the mechanism to realize a lot progress appears quite low. It’s because the OEWG was unable to agree on together with a devoted thematic group on worldwide legislation throughout the new mechanism, regardless of its look in earlier drafts. Whereas the mechanism is predicted to incorporate worldwide legislation in its substantive plenary classes (see para. 5 of Annex I to the report), the structural and political divides that restricted the OEWG are more likely to re-emerge.
This makes the opposite two suggestions all of the extra vital. The second encourages States ‘to proceed to voluntarily share their nationwide views and positions’ on how worldwide legislation applies within the cyber context (para. 45). Our collective understanding of worldwide legislation on this space – together with the place convergences and divergences lie – will proceed to evolve by way of the gradual accumulation and evaluation of such positions. Latest examples of this sort of evaluation embody the 2024 speech by US State Division Authorized Adviser Richard Visek; the chapter on ‘Substance’ within the 2025 Handbook on Creating a Nationwide Place on Worldwide Legislation and Cyber Actions (to which I contributed as a co-author); the ICT workstream of the ICRC’s ongoing world initiative on IHL; and the forthcoming Tallinn Guide 3.0. Notably, the identical paragraph of the report additionally requests the UN Secretariat to publish these nationwide positions on the web site of the brand new everlasting mechanism, thereby complementing current platforms such because the Cyber Legislation Toolkit and UNIDIR’s Cyber Coverage Portal.
The third advice highlights the necessity for continued capacity-building (para. 46). That is intently tied to the second: to successfully develop nationwide views on complicated issues equivalent to the applying of worldwide legislation to cyber actions, States should have entry to the mandatory authorized and technical experience. Efforts to stage the taking part in area are thus important to making sure that the worldwide dialogue on worldwide legislation within the cyber context is inclusive and consultant. Sensible sources – equivalent to the brand new Handbook or UNIDIR’s earlier compendium of fine practices – can assist inform and assist these efforts.
Conclusion
Finally, the OEWG report displays a missed alternative to advance the discussions on worldwide legislation and cyber actions. It falls wanting the group’s mandate to advertise frequent understandings on how worldwide legislation applies on this context. Nonetheless, the method has yielded beneficial unwanted effects, equivalent to serving to to solidify the now widespread follow of growing and publishing nationwide positions. Its most tangible success is the endorsement of a transition to a single-track everlasting mechanism for future discussions. Whether or not worldwide legislation will occupy a extra outstanding place in that subsequent chapter of multilateral engagement stays to be seen.
Cowl picture: OEWG, by Kubo Mačák
