India has proposed a new Global Cyber Security Cooperation Portal (GCSCP) driven by, and for, UN member states. Its intention is that this portal should contain information on, and make a positive contribution to, international cyber security capacity building (CCB). This article describes how applying the UN’s own principles can help achieve the benefits of a new portal while removing the risks.
The proposal for a new portal supporting CCB was presented by India within the UN’s Open-Ended Working Group on security of and in the use of information and communications technologies 2021-2025 (OEWG). On 12 July 2024, UN member states agreed through the OEWG’s Annual Progress Report that the UN Secretariat should prepare a report on the GCSP – also referred to as the Global ICT Security Cooperation and Capacity-Building Portal – by March 2025.
Because there are already excellent portals serving the CCB community there is a risk that the GCSP could duplicate or cut across what already exists. There is also a risk that information on CCB that implementers and stakeholders need to coordinate and inform their work will be put on a site only governments can access.
However, these risks can be managed, and the positive potential of the portal realised, if the UN OEWG applies the principles for CCB it agreed in 2021.
There are three UN OEWG principles that are especially relevant and useful in this regard:
- Principle 3: Capacity-building activities should be evidence-based, politically neutral, transparent, accountable and without conditions.
- Principle 9: The confidentiality of national policies and plans should be protected and respected by all partners.
- Principle 7: As capacity-building activities should be tailored to specific needs and contexts, all parties are active partners with shared but differentiated responsibilities, including to collaborate in the design, execution, monitoring and evaluation of capacity-building activities.
Transparency and Accountability
Principle 3 calls for capacity building activity to be transparent and accountable. That means that it should be visible. Other states, stakeholders and observers should be able to easily find basic information on what international cyber capacity building activity is occurring. This is one of the ways in which confidence is built and activity coordinated.
What might this look like in practice? In the international development field countries agreed to apply the principles of transparency and accountability by publicly sharing details of their activities each year in a set format. As a newer field without the reporting structures of international development the funders of cyber capacity building activities could agree that every project will have a website or a section on a website with basic descriptive information.
Where can portals add value? If every project had a description on a website it would be a fairly simple exercise for any portal or report to collate and present that information. There is no need for the information to be placed on a password-protected site. Furthermore, it would be antithetical to the transparency and accountability for the information to not be easily accessible by all. If, for example, capacity building implementers and non-state donors cannot access the information then they are unable to use it to coordinate or deconflict.
Where should this project information be made available? What countries have requested in the OEWG is that project information be easy to find. The goal should be that wherever they are working online project information should be ‘one click away’. They might be using a search engine, an AI assistant like ChatGPT or a website like UNIDIR’s Cyber Policy Portal. Whichever they use the information should be a click away. The ‘one click away’ goal is to serve users on any of these sites and more: bring the information to the user, not the user to the information.
The Cybil Portal is already working towards to this goal. The information it holds on nearly a thousand projects can be accessed from UNIDIRs Cyber Policy Portal, any search engine or ChatGPT. Any new portal should be able to access that information too through a similar agreement that as was reached with UNIDIR.
If states, not-state donors and their implementers publish project information with some basic common information (e.g. start date; end date; objective) then the goal becomes much easier to reach and all in CCB benefit.
Confidentiality of national policies and plans
Principle 9 calls for the confidentiality of national policies and plans to be protected. From this we can see that the OEWG’s principles make an important distinction between capacity building activity, which should be transparent (see Principle 3), and national plans, which might be confidential. Confidential plans might include national requests or offers for capacity building.
Because requests or offers for capacity building might be sensitive there is a potential role for a password-protected portal where governments can share such information. Of course, if the request or offer is not sensitive there should be no reason not to apply the principle of transparency, so share the information where it can be seen by non-state donors, implementers and stakeholders. From a results-focused perspective (principle 2) sharing requests and offers widely is more likely to lead to making a match between demand and supply. It also assists coordination when all actors can see what activities might be coming in the future, because the prior requests, offers and plans have been made known.
Partnership
Principle 7 calls for collaboration within CCB and partnerships in which all parties can play an active role. Work has been underway for several years to build collaboration among portals supporting CCB. This includes coordination meetings at two IGFs and a partnership agreement between Cybil and UNIDIR’s Cyber Policy Portal so that the latter can display project information collected by the former in a way that benefits both sites.
Importantly, there is currently no duplication among the most commonly used portals. Most prominently: UNIDIR’s Cyber Policy Portal contains information on national strategies, laws and structures; the Cybil Portal contains information on CCB projects and resources; and several organisations (including ITU) provide their own data on national capacity.
Furthermore, the OEWG Annual Report 2024 agrees that “the portal could be harmonized with existing and related online portals” (Final Draft APR, para 50c).
The idea of consolidating all information useful to CCB has been considered before with the conclusion that it would not be feasible to merge the staff and funding behind the various portals into a single entity, because each portal is tied into the wider work of the organisation that runs it. The best results-focused solution was therefore to maximise collaboration between portals and signpost users to the information they seek wherever it is held within the portal network. When working well this should mean the information users want is always just ‘one click away’.
Conclusion
India has correctly identified a need for countries and capacity builders more widely to have access to better information on activities, requests and offers for support. Applying the OEWG’s principles of transparency and confidentiality of national plans shows we should make information on CCB activity as easily and universally accessible as possible while respecting the confidentiality of requests or offers where states request it. Any new UN portal could apply the OEWG’s principles by having some sections that are open to all and others behind password protection for confidential policies and plans.
Importantly, the information any portal can provide is only as good as the information that states and other CCB actors submit or make available to all on their own websites. Establishing the practice that all donors have websites containing information on their CCB activities would make the greatest difference to users’ ability to find CCB information, whether directly or via a portal.
Initiatives and inter-portal collaborations are already underway to achieve the aim that CCB information is just ‘one click away’ regardless of which portal a user is on. Furthermore, in the spirit of partnership principle 7 – “all parties are active partners with shared but differentiated responsibilities” – and to avoid duplication, any new portal should seek to join the existing Cybil-UNIDIR partnership to share information and create the best user experience possible
Leave a Reply