Session 10-3 Transcript
(OEWG 2021-25)

Good morning, distinguished delegates. The third meeting of the tenth substantive session of the Open-Ended Working Group on security of and in the use of ICTs is now called to order. The group will now begin its discussion on the topic of, and I quote, further develop the rules, norms, and principles of responsible behaviour of States and the ways for their implementation and, if necessary, to introduce changes to them for elaborate additional rules of behaviour. The floor is now open for any delegation wishing to make an intervention. And once again, I’ll make two general points. First, please do look at the guiding questions that were circulated in my letter. And second, be as specific as possible in your intervention so that I would receive and others would hear the position of delegations in terms of what could be captured in the final progress report. And I would have a good sense as to where delegations stand on this important issue. So with those general comments, the floor is now open. I invite you to press the button. I give the floor now to Colombia, to be followed by Djibouti.

Thank you, Chairman. On rules, norms, and principles, as we’ve pointed out in previous meetings, we continue to believe that we need to have sufficient flexibility and scope to address emerging technologies and cyberspace and establish rules. They need to focus on proper implementation. We have to have a space for the discussion of these rules, norms, and principles and take into account new technologies, and these must be human-centered. On the checklist for practical actions for the implementation of voluntary CBMs, we are grateful for your efforts to draft this list, and we support its adoption. We believe that in the future mechanism it could function as a platform where states would voluntarily report their progress in implementation, contributing in this way to strengthening the normative framework which is applicable in this context, and it will allow us to promote greater cooperation in implementing best practices globally. Mr. Chairman, we’ve welcomed your proposal to include in the future mechanism a group with rules, norms, and principles of responsible state behavior and state intentions. My delegation believes that this proposal is in line with what we have been saying, that the binding and voluntary frameworks are complementary in nature. However, we would not object to further inclusion of these matters to cover some of the concerns expressed by states in the past. Finally, Mr. Chairman, my delegation will speak later on about international law issues and the intention of Colombia to put forward its national position on the implementation of international law in cyberspace. We would invite you to a UNIDIR meeting at 1:15 today, which we’re hosting along with Canada. We will put forward our position and we will tell you a little bit about the development of the document, and this will be an opportunity to discuss the national positions and to draw on lessons learned and explore opportunities for greater capacity building. Thank you.

Thank you very much, Colombia, for your statement and also for your invitation to all of us here as you present your national position. And I think one of the good things about this process is that it has really encouraged everyone to reflect deeply about their own internal national positions and to share that with every member state. So I commend you, Colombia, and encourage all of you to attend this event, but also for each of you who have not yet put forward your own national positions to consider doing so. And if you are in need of partnership in order to do that, you know, do reach out to the delegations because this working group has also emerged as an important network of partners and an important community of mutual support. So I’m very happy to hear your statement, Colombia. Let’s go on with the rest of the speakers. Djibouti, to be followed by Singapore.

Thank you, Mr. Chairman. Chairman, let me begin on behalf of my delegation by congratulating you and your team on the way in which you are guiding our work, and you have done so since the beginning of this very long trip, which began in 2021 and will end in 2025. I’d like to thank the Secretariat and the interpreters for their constant support as well. We are aligned with the African position and the Arab group expressed by Nigeria and Kuwait, respectively, and I have the following to say in my national capacity. My delegation welcomes the third annual report of the working group at the eighth session, and we believe that consensus has been arrived at on a number of issues in a difficult geopolitical environment. With regard to cyber threats, this issue has been addressed sufficiently in the third report of the working group. We are all convinced that the pace at which ICT technology has improved with the use of AI means a greater potential cyber threat, and these threats take on various forms – attacks on moral and civil persons’ privacy, attacks on critical infrastructure. Just to give you those examples, modern ICT is necessary for vital sectors, and it could also be used to target potential attacks by weapons of mass destruction and autonomous weapons. If these weapons are in the hands of terrorists, it will be difficult for a state to combat the use of these – the illicit use of these weapons if they don’t have the appropriate technology. Ideologies such as Islamophobia and the manipulation of the media or social networks have created social tangents and repressive policies, and they continue to undermine trust among communities and states, and they worsen the existing geopolitical situation. Although ICTs have led to positive developments, they have been misused to serve political interests and ideologies which exacerbate geopolitical tensions. However, security and the use of ICTs is a major issue because we are facing growing cyber threats, and in order to address this, we need to bolster our technical and human capacities at the state level. That is essential. We need to have effective cooperation and sincere cooperation, in particular for developing countries. It is also important to set up programs to bolster the rules governing the use of cyber technology and raise awareness of users by setting up a collective approach under the auspices of the UN to ensure a digital environment which is safe at the national, regional, and international levels. We welcome the adoption by consensus of the implementation of a permanent mechanism within the UN on global ICT security, and we encourage further multilateralism through dialogue, trust-building, and diplomacy so that we can overcome these cyber wars. Thank you.

Thank you very much, Chief Petit, for your contribution. Singapore, to be followed by Pakistan.

Thank you, Mr. Chair. While the implementation of the existing norms remains the priority, the pace of technological advancement over the last decade requires us to continue adapting to new opportunities and challenges. Thus, we welcome forward-looking discussions on the further development of norms, focused on continued stability and the responsible use of cyberspace. At the same time, it is clear that States need to build significant capacity to implement the existing norms because, as we have highlighted before, these norms are multidimensional. Each norm has a policy, operational, technical, legal, and diplomatic aspect to it. Only after developing the capacity to implement these norms will States be in a position to identify any gaps, and if not, new norms are needed to address them. This interconnected and coordinated approach ensures that we remain both grounded in practice and forward-looking in strategy. In this regard, the ASEAN-Singapore Cyber Security Centre of Excellence in Singapore will start a new series of capacity-building workshops, titled Cyber Norms in Action – Capacity Building for Effective Norms Implementation, to further support ASEAN Member States in implementing the existing norms and identifying gaps in the current normative framework, in line with their individual national priorities. These workshops will entail sharing of best practices in the implementation of norms by States and stakeholders from other regions as well, to help ASEAN Member States to better understand how to implement the norms and to identify and deepen the necessary capacities. At the same time, the workshops will be helpful in providing feedback to the efforts by other regions. We hope also that the feedback from these workshops will feed into the norms discussions of the future UN Cyber Mechanism for States to further advance the development and implementation of norms to uphold responsible State behaviour. Thank you, Chair.

Thank you very much, Singapore, for your statement. Pakistan, to be followed by the European Union.

Thank you, Mr. Chair. Pakistan has consistently emphasized its support for the development of non-binding norms to ensure the responsible use of ICTs. We recognize the value of such norms in fostering trust, transparency, and stability in cyberspace. We maintain that while non-binding norms provide a foundation for responsible behavior, they cannot substitute for a legal framework that can ensure accountability and compliance under international law. Non-binding norms are effective during peacetime but lose their utility during crises or armed conflicts. Furthermore, the voluntary implementation of norms is left to Member States without the legal responsibility that can come with a legally binding instrument. In this regard, I would like to make the following points for appropriate reflection in the final report. First, towards our goal of making global cyberspace safe, secure, stable, and accessible, there is a need to evaluate the effectiveness of the 11 voluntary norms of responsible state behavior adopted by the GGE. For example, we have a norm on supply chain security. We should ask for the effectiveness of this norm in cases such as the horrendous pager attacks of last year that affected hundreds of civilians, where state actors militarized the ICT supply chain. Second, non-binding norms should address critical gaps in the current framework. These include, for example, timely disclosure of vulnerabilities, protection of critical infrastructure, and secure cross-border data exchanges. Third, norms should be developed that promote global cooperation in combating disinformation, hate speech, and the malicious use of artificial intelligence in cyber operations. Fourth, enhanced capacity-building initiatives to assist developing countries in implementing these norms more effectively. In conclusion, we look forward to further discussions on reviewing existing norms and developing new non-binding norms. This is important to advance our efforts towards ensuring a safe, secure, and equitable cyberspace for all. Thank you, Chair.

Thank you. Pakistan, European Union, to be followed by Japan.

Thank you, Chair. I have the honour to speak on behalf of the EU Member States, the candidate countries North Macedonia, Montenegro, Albania, Ukraine, the Republic of Moldova, Bosnia and Herzegovina, and Georgia, the EFTA country Norway, member of the European Economic Area, as well as San Marino, align themselves with this statement. Our discussions on international law within the Open-Ended Working Group (OEWG) have proven to be highly valuable and have also significantly deepened throughout the process. National and regional positions have contributed to shaping a shared understanding of how international law should be interpreted in relation to activities in cyberspace. In conjunction with the declaration recently adopted by the European Union and its member states on a common understanding of the application of international law in cyberspace, as well as the African Union’s common position on the application of international law in cyberspace, over 100 states have now individually or collectively published their positions on international law, making this a significant and encouraging milestone. The broad agreement that activities in cyberspace are regulated by international law, including in situations of armed conflict, must be reflected and articulated clearly in the Open-Ended Working Group final report. Additionally, the report should highlight the central importance of binding obligations found in the UN Charter, such as the prohibition of the threat or use of force and those on the peaceful settlement of disputes, as well as the customary principles of sovereignty and non-intervention. Additionally, it’s important to note that states continue to confront essential questions regarding the prohibition on the threat or use of force in the context of states’ use of ICTs. In our third APR, states observed that activities involving ICTs which do not violate the prohibition on the threat or use of force might, depending on the circumstances, contravene other principles of international law, such as state sovereignty or the prohibition of intervention in the internal or external affairs of states. It is crucial that we do not shy away from addressing these complex legal issues, but rather confront them head-on and in the context of the actual threat, as they are central to shaping the future understanding of how international law applies in cyberspace. States have also recognized the application of the law of state responsibility, international human rights law, and in situations of armed conflict, international humanitarian law. We would also wish for the final report to include a clear reference to IHL’s applicability in cyberspace, as well as international human rights law and state responsibility. In a similar vein, the EU strongly supports this open-ended work in deepening our understanding of the application of customary international law on state responsibility and to the activities in cyberspace. Chair, now let me turn to the future mechanism. International law will be an important part of the future mechanism’s substantive plenary discussions and is relevant also across several thematic groups. The participation of stakeholders beyond those representing member states of the UN will be essential to those discussions, as they have both expertise and responsibility. For example, international law provides for the protection of critical infrastructure, which is often owned or operated by private entities. Therefore, any discussion in the working group on critical infrastructure would inherently involve considerations of international law. We would also like to note that international law and capacity building are at the very heart of the discussions of the protection of critical infrastructure and on cooperation on cyber incidents. Similarly, discussions on stability and conflict prevention in cyberspace also require references and engagement with relevant international legal frameworks. It is so that we propose that each dedicated thematic group should have a standing item on international law and on capacity building to assess the implications. This cross-cutting approach ensures not only one, but three groups with a specific discussion on international law, as well as on capacity building, in a more operational conversation than a group merging norms and international law, which could also create confusion between the pillars, and that would be discussed in the plenary sessions. Cross-cutting dedicated groups would also give all member states the relevant information and solutions drawn from the discussions grounded in the reality of cyber challenges that all nations face through a regular debrief in the plenary. Chair, this agenda item has been one of the most challenging areas of our work over the past years. Nevertheless, in each successive annual progress report, we have been able to reach consensus, which has helped to maintain momentum and keep the conversation moving forward. Yet, all that has been discussed has not been reflected in the reports, and we would like to drive this home in the final version. A key step forward is ensuring that the final report indeed accurately and cohesively reflects the various discussions held in the room over recent years, while taking into account different levels of support received by specific proposals. We welcome your call to reflect on and build upon the progress we are making within this group on international law and avoid settling for the lowest common denominator. Thank you very much.

Thank you very much, European Union, for your statement. Japan, to be followed by Kazakhstan.

Thank you, Mr. Chair. First and foremost, regarding rules, norms, and principles of responsible behavior of States, we would like to reiterate the paramount importance of concrete actions to steadily implement existing norms, including the 11 voluntary, non-binding norms of responsible State behavior in the 2015 GGE report, which was subsequently endorsed by consensus at the General Assembly. Japan shared the view expressed in paragraph 31A of the third APR that voluntary and non-binding norms of responsible State behavior can reduce risks to international peace, security, and stability, and play an important role in enhancing predictability and reducing the risk of misperception, thus contributing to conflict prevention. In order to further accelerate action by the international community, we should focus on promoting existing norms rather than simultaneously working to identify additional norms. With regard to the voluntary checklist of practical actions, it is essential to actually use the checklist in order to identify where we are, how we go forward, and what we need. It is also beneficial when we go through the checklist to share feedback with each other and collectively learn about the lessons learned. Those discussions related to rules, norms, and principles are policy-oriented, tool-focused ones, and best suited to a policy forum such as these plenary meetings. I thank you, Mr. Chair.

Thank you, Japan, for your statement. Kazakhstan, to be followed by the United States.

Thank you, Chair, for giving the floor. Kazakhstan reaffirms its commitment to strengthening cyber norm implementation and advancing the voluntary checklist as a practical tool for enhancing cyber posture. Recognizing increasingly sophisticated cyber threats, Kazakhstan advocates for a norm on zero trust approach, ensuring continuous verification and strict access controls. Combined with the defense in depth principle, this enhances resilience through multiple security layers, translating voluntary commitments into action. We believe that prioritizing the enhancement and practical implementation of existing norms is more effective than introducing additional new ones. Under norm C, Kazakhstan supports a structured real-time incident response mechanism. The global PLC directory should serve as a rapid response tool, enabling immediate coordination to mitigate cyber threats, including zero-day vulnerabilities. Regional coordination centers integrating national CSIRTs and CSIRT teams will improve cross-border cooperation. With over 40 active CSIRTs, Kazakhstan engaged with international partners to strengthen incident response. Regarding norms F and G on CI and CII protection, Kazakhstan emphasizes committing to cybersecurity exercises. Red team and blue team simulations might test preparedness against threats. Additionally, sector-specific cybersecurity frameworks aligned with ISO and NIST standards should ensure comprehensive threat modeling and risk assessment. A risk-based regulatory approach should be promoted for CI operators, integrating regulatory sandboxes to test policies before full-scale implementation. Security by design and privacy by design should be foundational in cyberspace. Security must be implemented into ICT infrastructure from the outset. Ethical hacker programs should support vulnerability management, identifying security flaws before exploitation. Kazakhstan actively promotes a public-private bug bounty platform, demonstrating proactive cybersecurity. AI-driven security solutions require clear governance frameworks to prevent unintended risks. Robust identity and access management help to control system access based on least privilege. States should enforce data minimization strategies, collecting only essential information to reduce risk exposure, including cross-border data exchange. Kazakhstan views the voluntary checklist as a living document, evolving with cyber threats. It should integrate best practices for threat sharing, incident response, and public-private collaboration. We encourage deeper engagement with academia and industry to foster cybersecurity innovation, recognizing multistakeholder cooperation as a key to global resilience. By advancing cyber norm implementation, Kazakhstan strengthens international cooperation through CBMs. Enhancing cyber resilience at national and regional levels will mitigate state-sponsored and non-state cyber threats, contributing to a secure, stable, and rules-based cyberspace. I thank you.

Thank you very much, Kazakhstan, for your statement. United States, to be followed by El Salvador.

Thank you, Chair. Chair, you and Member States have advanced the framework through over 10 years of consensus endorsements of the GGE and the OEWG reports, which include a robust set of 11 peacetime norms. These reports were endorsed by consensus by the General Assembly, which called on all States to be guided in their actions by their recommendations. Eight of the 11 cyber norms describe best practices and positive commitments that, if undertaken, benefit not only Internet users within the implementing State, but all Member States by improving stability and security of their ICT environment. To further that goal, we recommend the 2021 GGE report’s explanatory text on the consensus norms be included as is in the final OEWG report, so that the future mechanism can build upon this existing foundation to further common understanding and guidance on how to implement the consensus norms. Chair, we continue to hear some States point to the voluntary non-binding character of the 11 norms and suggest that new binding norms are necessary. We would like to remind those States that we already have binding rules that apply in this context. As UN Member States have repeatedly confirmed by consensus, existing international obligations apply to State conduct in cyberspace. These non-binding norms are intended to complement, not replace, these obligations. Legally binding instruments are highly resource-intensive to negotiate. Engaging in such an exercise would be a significant distraction with an uncertain outcome. States can more effectively address evolving cyber threats by examining how the consensus norms and confidence-building measures can be actioned. The dedicated thematic groups in the future mechanism will be particularly valuable, given their issue-oriented and practical approach that can drive outcomes. Stakeholder participation will also be critical to developing implementable solutions, given the unique expertise they bring to the dedicated thematic groups. The strong and consistent support of the norms by the UN General Assembly underscores the unity of will among Member States to act responsibly in cyberspace. Thank you.

Thank you, United States, for your contribution. El Salvador, to be followed by the Islamic Republic of Iran.

Mr. Chairman, 2025 is the 10th anniversary of the 11 responsible norms in cyberspace. My country reaffirms the fact that norms, the applicability of international law, and the development of cyber capacities as well as CBMs are the UN framework on responsible behavior of states in cyberspace. This framework is the founding structure which should guide the behavior of states in their cyber activities. However, 27 years after the UN began to address ICT security in Resolution 53-70, this enables us to see how far we’ve come and what the future of these norms is. While we believe that the Chairman’s proposal on the list of practical actions is a key step for moving forward in implementing these norms, we also believe it is necessary to go through further thought and discussion as to what norms these should be. The current world is much more digitalized than it was a decade ago, and the landscape of cybersecurity has radically changed. As El Salvador has said in previous sessions, the intersection between emerging technologies such as AI and quantum computing have meant a greater potential threat, which not just – don’t just impact international peace and security, but they also pose significant challenges at the national level. In light of recent discussions in the UN forum, in particular the last session that was held, it’s important to point out that a number of states, including my delegation, have proposed qualifying existing norms and exploring the adoption of new norms. El Salvador is a firm defender of a robust implementation of the current framework. However, looking at its structure should not be seen as an exclusive proposal, but rather an exercise in ongoing reflection, in particular in view of discussions on the future permanent mechanism. We therefore reiterate our proposal put forward at previous sessions to update norm E on the right to privacy in the digital era. We suggest having a focused approach on personal data throughout the lifecycle, allowing for the adoption of protection laws on data which address the misuse or illegal use of their data. We also believe it is relevant to include principles such as minimizing the collection of personal data, greater transparency on their use, and the implementation of security measures in processing this information, and accountability and corrective measures if errors are made. We believe that we should look at the updating of other norms to align them with the use of emerging technologies such as AI. Finally, Mr. Chairman, we would like to underscore the importance of international cooperation, bolstering capacity building, and ensuring transparency – or rather – sorry, says the speaker – the transfer of technology as key pillars for the effective implementation of norms. In particular, we recognize the Women in Cyber program, which is a platform to improve the technical know-how of women in the diplomatic sphere when discussing cyber issues in an international context. Thank you.

Thank you very much, Salvador, for your contribution. Islamic Republic of Iran, to be followed by Albania.

Mr. Chair, my delegation has consistently emphasized that the broad and inclusive participation of all nations in the development of comprehensive, universally accepted international norms and regulations achieved through consensus is crucial for their effective implementation. Additionally, it is important to acknowledge that a uniform approach to implementing norms is not practical. Each nation has unique circumstances, and developing countries often lack the same technical and technological resources as developed ones. While responsibilities are shared, they must be adopted to reflect these differences. During this process, many states have proposed new ideas, including new norms and rules that have merit for further consideration, and the OEWG should base its work on these proposals. My delegation has submitted a full list of its proposed norms to the group. Among those, we believe the concerns with regard to data security, cross-border data flows, as well as the availability of a secure supply chain are crucial and need to be addressed and regulated in terms of new norms and rules. Concerning the voluntary checklist of practical actions attached to the third APR, Iran recognized the need for substantial enhancement to the proposed checklist to foster broad consensus. As stated before, this document is based entirely on the recommendations of the 2021 GGE report, a process in which the majority of the OEWG members did not participate. Further, the state’s proposals on new norms as put forward and reflected in the 2019 OEWG Chair’s Summary are ignored. Many of the terms used in the checklist are ambiguous, open to interpretation, or unnecessary. Additionally, there are legitimate concerns about the approach of linking the implementation of capacity-building commitments to the fulfillment of checklists, which is counterproductive and unhelpful. We believe it would be reasonable to delay negotiations on this document until discussions take place within the framework of the permanent mechanism and until states agree on a method for establishing a comprehensive list of norms. Meanwhile, to fulfill the OEWG’s mandate before 2025, we recall our proposal for you, Excellency, as the Chair of the Group, to draft an initial document incorporating all proposed rules, norms, and principles as a basis for future discussion. This task has been taken in by the Chair of the 2019 OEWG as well. In this regard, we propose the establishment of a dedicated thematic group within the future permanent mechanism to address that outstanding mandate of the OEWG, namely to introduce change to current norms or elaborate additional rules of behavior as established in Resolution 75-240. In conclusion, we are ready to collaborate with all Member States to develop global ICT governance rules that are inclusive, representative, and respectful of all interests of the countries. I thank you, Mr. Chair.

Thank you, Islamic Republic of Iran, for your contribution. Albania, to be followed by Mauritius.

Thank you, Chair. Albania fully aligns with the European Union’s statement. Since its founding in 1945, the United Nations has stood as a bedrock of the international rules-based order, guiding nations towards peace, security, and sustainable development. While the world has evolved in extraordinary ways, the fundamental principles embedded in the UN Charter remain as relevant today as they were at their inception. At the heart of the UN Charter lies the principle that all states, regardless of size, power, or wealth, possess equal rights and responsibilities under international laws. Respect for national sovereignty is the foundation of peaceful coexistence. However, in an era marked by rapid technological advancements and emerging threats, states must not only uphold their sovereignty but also embrace cooperation to address the complex challenges of the digital age. Albania reaffirms its steadfast commitment to advancing global cybersecurity norms, fostering international cooperation, and enhancing resilience against cyber threats. As cyberspace becomes an increasingly contested domain, it is imperative that we further develop the rules, norms, and principles of responsible state behavior while ensuring their effective implementation. Where necessary, we must adapt existing frameworks and establish new mechanisms to address emerging risks and vulnerabilities. Albania remains a dedicated participant in global security initiatives, particularly through its engagement in the Open-Ended Working Group, actively contributing to the development of universally accepted norms of responsible state behavior in cyberspace. The implementation of UN norms reinforces state accountability, the protection of critical infrastructures, and international collaboration to counter cyber threats. Recognizing the ever-evolving cyber threat landscape, Albania has taken important steps to fortify its legal and institutional frameworks, aligning with the EU and UN cybersecurity standards. Key initiatives include the adoption of the new cybersecurity law in May 2024, in line with the NIS2 directive, expanding protections for 289 critical infrastructure entities through a newly developed impact-based methodology, and deepening cooperation with NATO, the EU, and the UN, including Albania’s firm stance against state-sponsored cyber attacks. Notably, Albania has consistently raised concerns over malicious cyber operations targeting national security, exemplified by the collective NATO response following the state-sponsored cyber attack on February 1st, 2024, advocating for accountability mechanisms to deter violations of established cyber norms. Albania remains aligned with the EU, US, and NATO policies on countering cyber aggression, as evidenced by coordinated responses to cyber threats against sovereign states. As cyber threats grow in complexity and scale, Albania supports ongoing discussions to enhance enforcement mechanisms within existing frameworks to ensure compliance with international cyber norms, develop new binding agreements that hold states accountable for malicious cyber activities, and strengthen confidence-building measures to promote trust and cooperation in cyber diplomacy. In 2024, Albania undertook two significant initiatives, joining the Hybrid Center of Excellence as its 35th member, reaffirming its commitment to countering hybrid threats, cybercrime, and disinformation, and establishing a special parliamentary commission to combat disinformation and foreign interference, addressing the increasing influence of information operations that seek to undermine public trust in democratic institutions. Albania’s experience in the cyber domain has been shaped by sophisticated state-sponsored cyber attacks over the past two years. We have encountered cyber operations ranging from destructive attacks to espionage campaigns and information campaigns as well. These experiences have underscored the fundamental truth: resilience in cyberspace can only be achieved through close international cooperation. Transparency is a cornerstone of this process. Furthermore, in line with our unwavering commitment to transparency and responsible state behavior, Albania publicly releases a comprehensive report on 2022 destructive cyber attacks. This decision reflects not only our dedication to openness and accountability but also our resolve to share insights that can strengthen collective cybersecurity resilience. By sharing our experiences, we aim to foster trust, enhance international cooperation, and contribute to global efforts to combat cyber threats. The United Nations was built on the principles of peace, equality, cooperation, and respect for international laws. In today’s interconnected world, these values must guide our approach to cybersecurity and the broader digital domain. To uphold these principles, states must engage in multilateral diplomacy, respect sovereignty, promote human rights, and contribute to global security and development. As UN Secretary-General António Guterres has rightly stated, the United Nations must remain true to its founding principles to uphold human dignity, equality, and the sovereignty of nations while promoting peace and cooperation in an increasingly complex and interdependent world. Albania stands firmly committed to this mission, and we call upon the international community to work together to strengthen cybersecurity, reinforce accountability, and ensure a safer, more resilient digital future for all. Thank you.

Thank you very much, Albania, for your statement. The next speaker is Mauritius, to be followed by the Russian Federation.

Good morning, Chair and colleagues. The discussion on norms of responsible state behavior in cyberspace remains a cornerstone of the work of the Open-Ended Working Group. As cyber threats continue to grow in complexity and scale, the establishment, reinforcement, and implementation of norms have become essential to maintaining international stability and security in the digital realm. The OEWG has reaffirmed that voluntary, non-binding norms provide a practical and effective framework for guiding state conduct and mitigating cyber risks, even as discussions continue on their refinement and operationalization. While there is broad consensus on their value, practical steps to integrate them into national policies and international cooperation mechanisms tend to remain a challenge in small and developing states. These nations often lack the resources and technical expertise to implement cyber norms effectively, making them more vulnerable to cyber threats. Mauritius thus encourages states that require support in that area to capitalize on the self-explanatory checklist of practical actions that will guide them in their implementation process. Alternatively, there is a need for sustained investment in capacity building initiatives, including knowledge sharing, training programs, and international partnerships that equip all states with the tools necessary to defend against cyber threats. Mauritius firmly believes that the OEWG must continue to prioritize inclusive approaches that ensure no country is left behind in the global effort to enhance cybersecurity. Chair, in previous discussions, some member states have called for new norms to address emerging threats. Mauritius is of the opinion that the rapid advancement of technology, including artificial intelligence and quantum computing, presents new challenges that may require a slight adaptation of the existing normative framework, taking into consideration technology neutrality. Looking ahead, the OEWG must build upon its progress by fostering continued dialogue, strengthening methods for norm implementation, and enhancing international cooperation. Mauritius commends the establishment of the future permanent mechanism on cybersecurity under the auspices of the United Nations. We strongly believe it is a positive step towards ensuring that discussions on cyber stability, including on rules, norms, and principles of responsible state behavior, remain ongoing. By reinforcing commitments to responsible state behavior, promoting inclusivity in capacity building efforts, and adapting to new challenges, we can work together to shape a cyberspace that is secure, stable, and beneficial to all nations. I thank you, Chair.

Thank you, Mariusz, for your contribution. Russian Federation, to be followed by the Republic of Korea.

Mr. Chair, in accordance with the mandate enshrined in UNGA resolution number 79-237 of the Pekin Census, the succeeding body of the OEWG will continue to develop the framework for responsible behavior of states in the area of international information security. Realizing this goal will require two equally important components – the implementation of voluntary rules and the development of new norms, including legally binding norms. We believe that the second part of this important formula should not be overlooked when drafting the final report of the OEWG. We believe it is impossible to ensure peaceful use of information and communication technologies by states through political commitments alone without formalizing them into legally binding norms. This conclusion is based on the Russian experience of implementing the relevant provisions in our national legislation. To illustrate this fact, we distributed at the ninth session of the OEWG a thematic review of the compliance of the laws and regulations as well as the doctrine of the Russian Federation with the voluntary rules of behavior. We call on other countries to follow our example, which may serve as a guidance for states that need capacity building in this area. We’ve been sharing our experience and stand ready to further assist in providing our colleagues with information on legislative and law enforcement practices. The key goal of the universal international legal instrument in the ICT field should be the establishment of mechanisms to prevent and to peacefully settle conflicts in the information space. This is especially in demand in the context of the Pager incident in Lebanon, which demonstrated the vulnerability of supply chains to organized malicious activities via the use of ICTs. The relevant provisions are included in the concept of a UN convention on international information security submitted as an official document of the 77th session of the General Assembly, which remains relevant. This initiative builds upon the fundamental principles of the UN Charter, including the prohibition of infringing upon the sovereignty of states and interfering in their internal affairs. This document may serve as a starting point for the establishment of a fair international legal regime in the field of international information security. Thank you for your attention.

Thank you, Russian Federation. Republic of Korea, to be followed by Indonesia.

Thank you, Chair. The 11 voluntary non-binding norms currently reflected in the 3rd Annual Progress Report and specified in the 2015 UNGA Adopted GGE report are widely recognized and remain highly relevant in addressing emerging threats. As the deadline to adopt the final report approaches, we believe that establishing new norms is unnecessary. This relevance is particularly evident in discussions on emerging technologies. The OEWG has acknowledged that technology itself is neutral while expressing concerns about its malicious usage. In this context, strengthening the application of existing norms would be more effective than creating technology-specific norms every time there is a breakthrough. For example, if a specific non-state actor were to use AI to attack the critical infrastructure of another country, states should recall norms C, F, and H and not condone such illegal activities. As the 11 norms are structured quite comprehensively, they remain robust and well-suited to addressing emerging threats in the rapidly evolving cyber landscape. To reinforce the implementation of the 11 norms, we would like to remind that Annex A of the 3rd APR provides a living non-exhaustive checklist that offers practical guidance for states to translate commitments into action. In line with the implementation of Norm G, which calls for taking appropriate measures to protect critical infrastructure from ICT threats, we consider it crucial to emphasize the importance of cyber resilience. It could also be helpful to increase the cost of attacks for malicious cyber actors. Thank you.

Thank you, Republic of Korea, for your contribution. Indonesia to be followed by Malaysia.

Thank you, Mr. Chair. Indonesia reaffirms its commitment to the 11 norms of responsible state behaviour in cyberspace, and we have aligned these 11 cyber norms into our National Cyber Security Strategy, established through Regulation 5 of 2024. This strategy serves as our national blueprint to enhance our cyber security resilience, to ensure a safe, secure, and inclusive digital environment. With this strategy as a foundation, our National Cyber Security Agency ensures the effectiveness of Indonesia’s National Cyber Security Incident Response, through the establishment and reinforcement of the National Cyber Incident Response Team, Cyber Crisis Contingency Planning and Simulations, Information Sharing and Analysis Centre, and Voluntary Vulnerability Identification Protection Programme. These initiatives not only demonstrate our commitment to mitigating cyber threats but also highlight the importance of capacity-building programmes as a cornerstone of cyber security resilience. Mr. Chair, Indonesia believes that the 11 cyber norms must remain the guiding principles, underpinning the future permanent mechanism. It is essential to advance the implementation at the global, regional, and national levels, to effectively address emerging and future cyber threats. To support this effort, Indonesia underscores the urgency of capacity-building programmes that equip states with the necessary tools and expertise to enhance cyber security preparedness. We also emphasize the potential role of a voluntary checklist of practical actions, to be embedded within the Global ICT Security Cooperation and Capacity-Building Portal, and to assist member states in tracking and operationalising the 11 cyber norms. By serving as a practical guide, this voluntary checklist not only helps streamline national implementation efforts but also strengthens the Portal’s role as the primary platform for confidence-building measures, dialogue, and cooperation among member states. Therefore, we look forward to the emphasis on capacity-building, as also voiced by our delegations from Singapore and Mauritius, among others, and the importance of assistance to national implementation efforts of the norms for those to be appropriately reflected in the recommendation of the Final Progress Report. Indonesia encourages all member states to continue engaging in an open dialogue, seeking common ground, and exploring consensus-driven solutions, not only on the norms, including the potential new norms that reflect the evolving cyber landscape, including a legally binding norm. We look forward to constructive exchanges that will advance these efforts to ensure an inclusive, effective, and forward-looking process. Thank you, Mr. Chair.

Thank you very much, Indonesia, for your contribution. Malaysia, to be followed by the Democratic Republic of the Congo.

Mr. Chair, Malaysia welcomes the Voluntary Checklist of Practical Action for the Implementation of Voluntary, Non-Binding Norms of Responsible State Behaviour in the Use of ICTs as referenced in Annex A, 3rd APR of the OEWG. Paragraph 3 of Annex A indicates that the implementation of Voluntary, Non-Binding Norms as a whole may require States to take some common practical actions. In this connection, ASEAN has selected two specific practical actions to guide the implementation of norms and promote stability in cyberspace at the regional level. First, the development of the Regional Action Plan metrics on the implementation of Norms of Responsible State Behaviour in cyberspace as recommended by the 2015 GGE report. These metrics consolidate key initiatives by cybersecurity-related ASEAN sectoral bodies and working groups, supporting the implementation of the cyber norms and enhancing the capacity of ASEAN Member States to uphold them. Second, the development of the ASEAN Norm Implementation Checklist to provide actionable steps for all States to consider, including small States with limited capacities. States do not need to implement every step but should consider the suggested action in line with their respective national priorities and capacity. These checklists organize the steps for each norm into five pillars, which are policy, operational, technical, legal, and diplomatic, as mentioned by Singapore earlier, to clarify how various domestic agencies can contribute to norm implementation. The ASEAN Norm Implementation Checklist was endorsed at the 5th ASEAN Cybersecurity Coordinating Committee and noted by the 5th ASEAN Digital Ministers’ Meeting last January. Malaysia thanks Singapore for the introduction of the Cyber Norms in Action Workshop series to raise ASEAN Member States’ understanding of how to implement the norms and to identify and deepen the necessary capacities. Malaysia joined others to emphasize the importance of capacity building in the implementation of norms. As is the case with the OEWG’s Voluntary Checklist of Practical Actions, the ASEAN Norm Implementation Checklist is a living document. States may choose to undertake particular steps as appropriate to their national context. Chair, you asked whether the OEWG’s Voluntary Checklist of Practical Action needs further improvement. Malaysia believes the checklist serves as a strong foundation and a good starting point to guide the implementation of voluntary, non-binding norms, much like steps in our journey toward establishing the UN Global POC and the Global CDNs. In this regard, Malaysia supports the checklist and hopes States will be able to reach consensus in the final report. This document may guide focused discussion in future permanent mechanisms by adding actionable steps and fostering common understanding, as it is a living document. Moreover, Malaysia emphasizes that implementing existing norms and developing new ones are not mutually exclusive processes. They can proceed in tandem. We should remain open to discussion on the possibility of new norms. Thank you, Chair.

Thank you very much, Malaysia, for your contribution. DRC, to be followed by Cuba.

Mr. Chair, first and foremost, allow me to echo other delegations in commending your leadership and your commitment, as well as to congratulate you and your team for your tireless and continuing efforts since the outset and up until now. You can count on the support of the DRC as we continue these discussions until the very end of the process. We here would also like to thank the Secretariat for its support and its unwavering efforts to provide us with the various tools it has put at our disposition. The DRC lends itself to the statement made by Nigeria on behalf of the African Group and makes the following statements in its national capacity. Mr. Chair, for five years, from 21 to 25, the OEWG on ICTs has made significant strides, and we can list, for example, the adoption by consensus of three annual progress reports, the establishment of the global points of contact directory, as well as the holding of its first meeting. This proves that delegations place great importance on this process. In light of these positive points, my delegation hopes that this will toward consensus will continue to drive us and allow us to adopt by consensus the outcome report of our OEWG in July of this year. Mr. Chair, my delegation takes note of the chair’s discussion paper as well as its recommendations regarding the modality participation of stakeholders and the proposed thematic groups. We believe that this is an excellent foundation for in-depth exchanges in order to reconcile differing points of view and allow for a smooth transition from the current working group to the future permanent mechanism after July 2025. As this 10th session takes place, challenges to international peace and security stemming from the use of ICTs continue to grow. Incidents of malicious use of ICTs by state and non-state actors are being documented increasingly frequently. There also is concern about the rapid development of AI. These varying forms of threats in cyberspace are not only harmful but also hinder the capacity of countries, especially developing countries, to pursue development. That is why my delegation believes that these growing and evolving threats must continue to be the focus of discussions in one of the future permanent mechanisms or thematic groups. Mr. Chair, as we’re speaking about responsible behavior of states, there unfortunately are some states that are notorious in this area for attacking critical infrastructure in other countries, and that is the case in the DRC, which is suffering attacks from the terrorist M23 movement supported by the Rwandan Defense Forces in the east of my country, where information systems have been attacked. There have been serious incidents of jamming and GPS spoofing that have been documented. These have caused disruptions in the functioning of our services, entailing risks of aircraft accidents and crashes. This not only undermines protection of civilians, but it also jeopardizes the safety and security of the UN mission in the DRC. To this day, the Goma Airport remains closed. It cannot be used to evacuate the wounded or support humanitarian efforts. Mr. Chair, my delegation welcomes the documents proposed by the Secretariat on the Global ICT Security Cooperation and Capacity Building Portal. We believe that this portal will effectively address our collective need for a global platform used for sharing information on existing and emerging cyber threats. We hope that this portal will be based on mutual trust and commitment, and that it will serve as a communication channel, a safe channel for providing reliable, timely, and accurate information on ICT threats through an information repository. This portal can also help to bolster confidence and transparency between member states through sharing data on incidents, mitigation strategies, and effective interventions, as well as facilitating discussions on threats facing specific critical infrastructure, especially in the healthcare, energy, and finance sectors. It will also, we hope, strengthen collective efforts to anticipate and coordinate responses to these threats. In closing, Mr. Chair, my delegation would like to reaffirm its support and encourage all delegations to continue to strive to reach the necessary consensus for the establishment of the future permanent mechanism so discussions can continue in an open, inclusive, and sustainable way. Together, let’s work to build an open, free, and safe cyberspace for all. Thank you.

Thank you very much, DRC, for your statement. Cuba to be followed by Mozambique.

Mr. Chairman, we reaffirm the importance of this working group in promoting a normative framework to guarantee security and the peaceful use of ICTs. As is well known, we believe that non-binding norms, while they may be useful in some contexts, are not sufficient to address the growing challenges and threats in cyberspace. Their voluntary nature limits their usefulness because they do not ensure a truly coordinated and effective response to cyber threats impacting states, and at the same time, their non-binding nature means that there are no consequences for non-compliance and no mechanisms for implementation and oversight, making it possible impartially and objectively to determine the origin of the incidents, and this leaves the door open for politicization. All of that, together with a lack of clear definitions or common terminology, will simply extend the status quo and namely follow the wishes of the great powers. We recall that rules, norms, and principles previously drafted by the GGE, that during those discussions not all member states participated, and that these norms, rules, and principles are not universally accepted, and therefore, while establishing a checklist, a voluntary checklist for practical actions could be useful domestically for some states who decide to use this approach, it cannot be seen as the sole global standard for implementing specific norms, much less should it be used to classify or assess the performance of states and whether or not they comply with these voluntary norms of so-called good behavior, because this concept could be manipulated for political interests and in political contexts. Every country has its specificities, and in general, developing countries do not have the same technical and technological conditions as developed countries. Globally, we believe we should not be duplicating efforts to measure this commitment and the preparation of countries in cybersecurity, and we should not just be using the ITU cybersecurity index, regardless of whether or not these methods could be improved upon. We believe that the final report of this group should include clear recommendations for the drafting of rules, norms, and principles that are legally binding. These norms need to refer to preventing militarization of cyberspace, promoting international cooperation, reducing technological gaps, and the peaceful settlement of disputes in the cyber landscape. We believe the final report must include a roadmap for moving forward on negotiating a legally binding instrument and set up obligations on states. It should also have a standing follow-up mechanism. Russia’s initiative, which proposes the drafting of a future international convention on security and the use of ICTs, could be a useful tool to guide the international community’s efforts in this direction so that we can set a more robust and effective global normative framework. These global norms must be inclusive, transparent, and universal, and they must reflect the needs and the concerns of all states, regardless of their level of technological development. Only in this way can we ensure that we have a safe cyberspace for everyone. Thank you.

Thank you very much, Cuba, for your contribution. Mozambique, to be followed by the United Kingdom.

Thank you, Mr. Chair, for giving us the floor. In general, the Mozambique delegation aligns itself with the general statement made by representatives of the AFR group and with the view expressed by many other member states before us, and would like to highlight the following points. Mozambique strongly supports the consistent application of UNGGE norms, ensuring that states refrain from cyber activities that would harm critical infrastructure, and reaffirming that international laws apply to cyberspace. As mentioned by Singapore, Albania, Malaysia, and others, cyber threats are evolving and norms and rules must adapt accordingly. But most importantly, implementation is key. We believe that stronger cooperation, capacity building, and joint response mechanisms are crucial in tackling cross-border cyber threats effectively. At the same time, states must respect each other’s sovereignty when addressing these threats. That means working in close cooperation and coordination with relevant authorities of affected states to ensure that responses are effective and respectful of national jurisdiction. We also cannot overlook the importance of accountability and transparency. Regular reporting and peer review mechanisms will not only strengthen trust but also enhance resilience in cyberspace. Mr. Chair, Mozambique remains fully committed to working towards a secure, resilient, and inclusive digital future for all. I thank you.

Thank you very much, Mosambi. United Kingdom, to be followed by the Kingdom of the Netherlands.

Thank you, Chair. I’d like to begin by reiterating the United Kingdom’s commitment to working with you towards a positive conclusion of this OEWG. This year marks a decade since the UN General Assembly adopted the 2015 report of the GGE, containing the 11 voluntary and non-binding norms of responsible state behaviour. This was a remarkable and important achievement. Reading the list of norms today, it is clear that they continue to provide an impressive articulation of the collective expectations of states in relation to a range of international cyber behaviours. When combined with international law and the other pillars of the consensus framework, the norms provide the basis for stability in cyberspace. Norms implementation and guidance, such as that contained in Annex A of the third annual progress report of this OEWG, has an important role to play. My delegation takes the opportunity to congratulate ASEAN nations on the endorsed ASEAN norms checklist. Monitoring implementation of the norms, including via voluntary updates by states, will be an important way of assessing progress under the future mechanism and can help states to further their understanding of best practice. In this context, we would like to draw attention once again to the proposals made by my delegation and supported by a number of states in December for an additional voluntary practical action under Norm I to safeguard against the potential for the illegitimate and malicious use of commercially available ICT intrusion capabilities. We would also like to highlight the proposals for Annex A, made in a non-paper by Australia, Chile, Colombia, Fiji, and the United Kingdom, in relation to gender equality and the future permanent mechanism. The UK recognises the important contributions of women and the value of encouraging diversity to national and international cybersecurity, including here at this OEWG. We should seek to maintain this momentum under the future permanent mechanism. Chair, my delegation will use the remainder of this statement to consider the treatment of norms in a flexible Program of Action with reference to some of your guiding questions. We judge that all 11 norms can be captured within the themes of cooperation, resilience, and stability. For example, norms A, D, and H are relevant to cooperation, norms G and J are relevant to resilience, and norms B, C, E, F, I, and K are relevant to stability. How could the treatment of norms work in practice under these three themes? We would like to offer the following potential example. Several of the norms in CBMs address the value of information sharing, including information sharing on threats and vulnerabilities and information sharing in relation to incidents. The topic of information sharing could be subject to deeper discussions within a dedicated thematic group on cooperation. This might begin with expert briefings on available cyber information sharing platforms and an exploration of the gaps in international information sharing on threats and vulnerabilities. Subsequently, the Secretariat could present to States on the latest progress in the implementation of the POC directory. These opening briefings would set the scene for a State-led discussion. Guiding questions for States could invite reflections on good practice, as well as gaps and areas for improvement. In doing so, States may frame their remarks in the context of voluntary norms or CBM implementation. Any emerging next steps among States could then be discussed further in the dedicated plenary session or even taken forward in the agenda of the global round table on capacity building. In this way, capacity building organizations would be able to better understand and respond to the demands of States, and Member States’ access to information sharing capabilities would be enhanced. All of this activity would also contribute to the implementation of specific norms. Chair, in conclusion, this is just one possible example of how we could use cross-cutting discussions to apply the consensus UN framework in a practical way. There are, of course, other topics that could be considered under the themes of cooperation, resilience, and stability, while still respecting the consensus framework. Thank you.

Thank you very much, UK, for the statement. Kingdom of the Netherlands, to be followed by Italy.

Thank you, Chair. The Kingdom of the Netherlands aligns itself with a statement delivered by the European Union, and I would like to add the following in our national capacity. The 11 voluntary non-binding norms of responsible state behavior in the use of ICTs play an important role in reducing risk to international peace and security. These norms reflect the expectations and standards of the international community and allow the international community to assess the activities of states. International law, complemented by these norms, provides a comprehensive framework capable of guiding states’ behavior responsibly, if implemented and adhered to. This is why it is our view that our focus at this point should be on the implementation of existing norms before we look towards the development of new norms. Chair, to further support the implementation of the norms, the Netherlands believes the voluntary checklist in Annex A of the Third Annual Progress Report represents a positive step forward. It makes valuable use of the norms guidance from the 2021 GGE report and can serve as an effective capacity building tool for states. We agree with others that the checklist could be updated periodically as a living document, including in a future mechanism. At the same time, the Netherlands would encourage the adoption of the initial checklist in the final report of July 2025. This will provide a firm consensus baseline for states to be able to support and continue surveying their national implementation efforts and take concrete action to further implement the norms going into the future mechanism. Chair, my delegation further supports the proposal put forward in the paper of Australia, Chile, Colombia, Fiji, and the United Kingdom to mainstream gender equality within the norms implementation checklist. The Netherlands is one of the co-sponsors of the paper, as we believe this is a crucial step towards ensuring an inclusive and effective approach to norms implementation. As the checklist serves as a capacity building tool, the paper also represents an effort to implement gender-responsive capacity building commitments, as we agreed in the second APR. Finally, Chair, the 11 voluntary non-binding norms continue to be a key component of our cumulative and evolving framework for responsible state behavior and use of ICTs, and we reiterate our commitment to the current normative framework. I thank you, Chair.

Thank you very much, Evelyn, for your contribution. Italy, to be followed by Canada.

Thank you, Mr. Chair, for giving me the floor. Italy fully aligns with the statement delivered by the European Union. We support the concrete implementation of the UN Framework on Responsible State Behaviour in cyberspace. In our national capacity, we would like to focus on the protection of critical infrastructures and supply chain integrity, by also sharing some practical examples in the implementation of such norms. Cyber attacks on critical infrastructures are increasing, often involving state and non-state actors, posing a serious threat to international security. According to the data gathered by the Italian National Security Authority, the most hit sectors are public transport, central public administration, and financial services. Particular attention should also be paid to the healthcare sector, which, although not the most affected in terms of cyber events, stands out for the severity of the impacts, with significant effects on operations and confidentiality, as well as on the sensitivity of exfiltrated data. To address this, we believe in strengthening accountability mechanisms to foster mutual responsibility among states. National measures, such as dedicated cyber security agencies and CSIRTs, are also essential for detecting, defending against, and responding to cyber threats. The private sector, which manages much of the critical infrastructures, plays a crucial role in enhancing cyber security. Public-private partnership and increased stakeholder awareness are key to building stronger cyber resilience. In 2019, Italy established a national cyber security perimeter, ensuring the security of essential networks and services. Entities within this perimeter must adopt strict security measures and assess supply chain dependencies. These efforts align with the EU regulatory framework, including the NIS2 Directive, which imposes strict incident reporting and risk management requirements, overseen by the National Cyber Security Agency. The NIS2 Directive also established the so-called EU Cyclone Network, a cooperative framework comprising the national authorities of EU member states responsible for managing large-scale cyber crises. This network serves as a key example of interstate cooperation in responding to cyber security incidents and strengthening critical infrastructure. Mr. Chair, supply chain security is a very important principle and one of the objectives member states committed to achieve with the Global Digital Compact. However, ensuring safety and integrity of all products can be a very complex task to achieve. We encourage the adoption of specific frameworks for the assessment of supply chain security of ICT products, based on guidelines and best practices and adherence to international standards, such as ISO. Software bills of materials, formal records containing the details and supply chain relationships of various components used in building software, are also key, as they provide visibility into software dependencies and strengthen supply chain security. We consider that the establishment of national security evaluation and certification standards and adoption of cyber security certification schemes could also represent useful measures to implement. Finally, Italy stresses the importance of fully implementing existing norms before introducing new ones. Further regulatory developments should build on concrete progress in applying the current framework. Thank you, Chair.

Thank you very much, Italy, for your contribution. Canada, to be followed by China.

Thank you, Chair. As the UK noted, we mark the 10th anniversary of the UN norms, first established within a GGE but subsequently adopted by all UN member states. These norms, combined with the remaining framework, including the applicability of international law, have served us well and have proven adaptable to a changing cyber environment. Yet we recognize that work still remains on the implementation of the norms, and our short-term efforts are best invested on that front. In a future mechanism, dedicated cross-cutting thematic groups should enable us to address practical policy challenges. This may identify gaps in norms implementation, and we must then seek solutions to the gaps. These solutions may include additional guidance on norms implementation, but potentially new norms, and certainly capacity building activities. As a leader on norms implementation, ASEAN’s regional experience can be an excellent example for us in this regard at the UN level. When it comes to our work for these last miles of the OEWG, we want to focus our attention today on our immediate priority, crossing the finish line as a group. We need to take time to discuss how the future thematic groups will help us dive deeper on addressing policy challenges, including norms. It is well established that non-binding norms are distinct and independent from binding international law. This is why they are dealt with separately in the OEWG, and why the plenaries of a future mechanism should include time to discuss norms and time to discuss international law. Within dedicated thematic groups, there is space to discuss all of the elements of the OEWG together. We have a solid long-standing acquis, including guidance on how to implement existing norms. Now we must make use of that acquis. Your voluntary checklist contributes to this work and should be reflected and further elaborated in the final report. Turning to how we could address norms in a future mechanism, the thematic group on resilience and critical infrastructure could clearly have a role in looking at norm G on appropriate measures to protect critical infrastructure. Your checklist identifies practical actions to implement this norm, and these track our previous agreements in the General Assembly Resolution 58-199 and in the 2021 GGE report adopted by consensus. However, none of these actions have been discussed in any depth in plenary over the last years. Mentioning the text of a given norm or action only moves us forward so much. If we want to walk faster in order to eventually run, we need a theme and we need time to practice. We also need to understand what specific capacity building activities are needed to implement the norm and such discussions will be possible in the thematic group format. For example, in Canada, a large segment of the ICT systems that form part of our public service delivery is owned and operated by non-governmental stakeholders. We could share best practices in working with these stakeholders. We could detail how we set up a plan to respond quickly and in a coordinated way across the various governmental and non-governmental actors. A thematic group would allow us to elaborate on the design and functioning of this plan beyond the short mention of its existence today. Of course, such discussions would not be fit for purpose if stakeholders were excluded. Not involving our stakeholders would be the equivalent of trying to use only our brain and not our legs when going for a run. As such, we need certainty and clarity on how stakeholders will contribute to thematic groups. To make a similar point very quickly on how the participation of stakeholders is not only extremely useful but also necessary for our second thematic group on cooperation in the event of cyber incidents. A key element of cooperation is the responsible reporting of vulnerabilities to each other alongside related remedies. Yet the participation of the top world expert organization on this issue, FIRST, has been vetoed by two states. The future mechanism, including thematic groups, must enable the participation of a stakeholder such as FIRST. In a future mechanism, if certain states want to prevent all other states from hearing from experts and benefit from their associated capacity building, they should have to explain why. Other states should have the opportunity to explain why they wish to include them and the group must, if we need to, take a decision on the basis of these arguments. Thank you, Mr. Chair.

Thank you, Canada, for your statement. China, to be followed by Poland.

Thank you, Chair. With regard to the norms, it is an important pillar of the framework. China believes that under this agenda item, the following elements should be reflected in the final report. First, we must reaffirm full compliance with and implementation of the framework of responsible state behavior in cyberspace. The previous APRs all mentioned that. We hope that in the final report it will be reaffirmed. Second, data security is an important element of the OEWG’s mandated discussions, and a prominent issue in the current cyber and digital space. The final report should make it clear that the Working Group and the future mechanism will have in-depth discussions on the development of universal, non-discriminatory international norms on data security, and that issues such as data storage, cross-border data flow, and data security related to AI can be topics of subsequent discussions. Thirdly, specific measures should be taken to promote the development and implementation of globally interoperable common norms and standards for supply chain security, which is of common concern, so as to ensure an open, safe, and stable global supply chain for IT products and services. Fourthly, we must further prioritize the protection of critical infrastructure. It must be emphasized that states should not use ICTs to undermine the critical infrastructure of other states, destroy or steal important data on the critical infrastructure of other states, or spread disinformation about certain states. There’s a need to make further targeted recommendations on how to enhance the protection of critical infrastructure. Fifthly, cybersecurity traceability is an important element of the norms. Considering the continued prominence of online disinformation, we encourage member states to actively consider the establishment of an authoritative and impartial mechanism of multilateral cooperation for traceability under the UN framework. Sixthly, we commend the efforts to develop the list of actions for responsible state behaviors. The final report should make it clear that the implementation of the list is voluntary and based on existing consensus, and that it does not include nonconsensual elements or elements outside the UN information security process. Lastly, some delegates mentioned that the existing norms are complete and there’s no need to develop additional norms. Obviously, the existing norms do not include data security and many of the recommendations that the Chinese delegation mentioned. It should be pointed out that the 2015 GGE report is the foundation for the current framework, which is based on broad consensus. And the 2015 report specifically specifies that, I quote, attributes of ICTs. China believes that disapproving of the consensus made in the 2015 report is about disapproving the GGE report itself. Additionally, if there’s no need, why would member states agree that the existing OEWG mandate includes the development of new norms? Given that, we hope that all parties can fully and completely implement the norms so as to contribute to the improvement of the norms. Thank you.

Thank you very much, China, for your contribution. Portugal, to be followed by Thailand.

Mr. Chairman, Portugal aligns fully with your statement but would like to emphasize a few points on due diligence, which we believe could easily become ready for universal implementation. As we repeatedly underlined, among the 11 non-binding norms of responsible state behavior in cyberspace, endorsed by the UN General Assembly since 2015, due diligence is, in our view, one of the most deserving of a further layer of common understanding. The growing use of proxies by hackers, including official proxies, is very worrying and can precipitate the use of unjustified countermeasures, which will be especially dangerous in the context of an armed conflict. Thus, before resorting to cyber weapons to retaliate against malicious operations launched from the territory of another state, namely when apparently originated in a device belonging to a government agency, this state should be immediately called upon by the victim, through the POC directory which you have successfully facilitated, to confirm if digital devices on its territory have indeed been manipulated. The state should take all measures within the limits of its technological capability in order to avoid the use of devices on its territory, and in case it took them but devices were still used, it can be called to conduct an investigation and to share its results with the third state, as opposed to merely replying that it was unaware of the attack and of its authors. The cyber diligence duty also encompasses the obligation to take into account the known risks that those operations may take place in the future, and thus it is violated when a state, knowing that devices on its territory can be used against the critical infrastructure or the rights and freedoms of the citizens of another state, does not act within the limits of its technological capabilities to avoid it. In sum, Mr. Chairman, the cyber diligence obligation requires that states be vigilant and guarantee the security of the ICT networks existing on their territories, whose devices can be intruded and abused to launch attacks against other states. In this regard, the norms checklist which you have timely put forward will be an indispensable tool to be used in the framework of the future permanent mechanism for regular institutional dialogue to monitor the implementation of the duty of cyber diligence. The cross-cutting working group on cooperation and stability proposed by France as one of the three main expert legs of the Program of Action on responsible state behavior in cyberspace will as well be the right place to have a meaningful pragmatic discussion on a further layer of understanding on due diligence and the practical ways and means necessary for its wide implementation. Though the technical obstacles are many and hard to overcome, we should not desist from agreeing on a set of standards that increase the attractiveness of due diligence as a means to afford a pause before precipitating a crisis generated by an unlawful act against a critical infrastructure. Thank you, Mr. Chairman.

Thank you very much, Portugal, for your statement. Thailand, to be followed by South Africa.

Mr. Chair, since this is the first time Thailand is taking the floor, we would like to extend our appreciation to you and your team for the dedication and hard work which has resulted in the success of this framework. Thailand believes that in the spirit of consensus and under your guidance, we will achieve the results throughout the course of this week, which will lay a strong foundation for our future work. Mr. Chair, Thailand would like to highlight a few points in the discussion on the topics of rules, norms, and principles of responsible state behaviour as follows. Firstly, Thailand reaffirms the importance of the 11 voluntary non-binding norms of responsible state behaviour. Together with international law, these norms significantly contribute to the maintenance of international peace and security. Secondly, Thailand believes that these norms serve as confidence-building measures among states. Therefore, we encourage regional organizations and frameworks to adopt and implement these norms where appropriate, as part of the global confidence-building efforts. ASEAN, as the first regional organization to have subscribed principles to these norms, has recently adopted the ASEAN Norms Implementation Checklist, which identifies practical steps in five pillars – policy, operation, technical, legal, and diplomacy – to assist ASEAN member states in their implementation of such norms. Thirdly, it is essential to promote the adoption and implementation of such norms at the national level. Thailand is currently working on developing our 2028-2032 National Policy and Action Plan on Cybersecurity. This plan, to be guided by the ASEAN Norms Implementation Checklist and the OEWG Voluntary Checklist of Practical Actions, will explore how to effectively implement the norms at the national level. This includes awareness-raising of such norms among the public sector as well as the relevant stakeholders. Lastly, norms implementation efforts will not be possible without capacity-building efforts and support of the new permanent mechanism. Last month, Thailand and the UNIDIR co-hosted the regional workshop on international laws, norms, and cyberspace for Southeast Asian states. We believe that our new permanent mechanism must not only serve as a platform for states to discuss these norms, but also as an action-oriented mechanism to assist states to translate these norms into practice. We support the proposal of certain member states that the future mechanism should assist states on a voluntary and needs-based basis in identifying capacity-building needs in the application of norms. We will continue to discuss these issues under a relevant agenda. Thank you, Mr. Chair.

Thank you very much, Thailand, for your contribution. South Africa to be followed by Australia.

Thank you, Chairperson. South Africa believes that implementation of existing norms contributes to a better understanding of the gaps in existing norms, if any, thus informing the need for new or additional norms to be developed. As such, we believe that implementation of the existing norms should continue in the permanent mechanism, while the possibility of developing additional norms is left open. Working from that perspective will inform Member States of any gaps and assistance needed to build the requisite capacity. It will also allow the international community to organically identify new areas where norms could be developed in the future. The third APR has reiterated increasing concern that threats in the use of ICTs in the context of international security have intensified and evolved significantly in a geopolitical environment that remains challenging. It has become very clear from the Threats section of the 1st, 2nd, and 3rd Annual Progress Reports that while incidents involving the malicious use of ICTs manifest themselves differently across regions, their effects can also be global. Despite the many benefits emerging technologies such as AI bring, the associated risks exacerbate existing vulnerabilities. Thus, our delegation believes that in these cases, the discussion on the development of additional norms to complement existing norms on threats to ICT security should be left open for Member States to attend to when it becomes necessary. South Africa believes that the cumulative and evolving framework on ICT security, which includes the 11 agreed norms and 8 confidence-building measures adopted by the OEWG, should allow for voluntary implementation by Member States to avoid overburdening developing countries. We also welcome discussion on the Voluntary Checklist for implementation of norms, and we believe that agreement on the checklist in its current form should be on the understanding that Member States will continue to use it as a guiding tool and report on its implementation on a voluntary basis. Before we conclude, Chairperson, South Africa believes that not only is gender equality crucial to international peace and security, it is crucial to all multilateral matters. South Africa can therefore support the proposals by the working paper drafted by Australia, Chile, Colombia, Fiji, and the United Kingdom to include gender mainstreaming in the Voluntary Checklist of norms implementation. I thank you. Thank you.

Thank you very much, South Africa. Australia, to be followed by Vietnam.

Thank you, Chair. I was reminded by the United Kingdom yesterday and by several others this morning that 2025 marks the 10-year anniversary of our norms and the adoption of our norms. And I think it behooves us not only to reflect upon the progress that we’ve made since then, but also on the process by which those norms were agreed. When we really look at the text of the context of our norms, we can see that they’re not revolutionary in content. They’re things that most countries were already doing to some extent in 2015. And this is because the norms were developed from the bottom up. The GGE looked at what states were already doing to promote peace and stability inside a space, and they spent two years collecting that best practice into the norms that we have before us. During that negotiation, some GGE member states had national priorities that they were keen to include in the norms, but the process through which the norms were negotiated meant that those national priorities needed to be first identified in evidence of existing conduct and practice across a large number of states. It was bottom up, not top down. And then in 2019, when 193 member states came together in our first OEWG, for the first time we looked as a group at the collected work of the GGEs. And as a group, we carefully assessed the norms that were developed in 2015 by the GGE and their relevance and their value. And we decided by consensus in 2021 that the 2015 agreed norms form a fundamental pillar of our framework. When this group discusses what next when it comes to norms, we can’t ignore that some countries think new norms are appropriate. Though I can’t help but note that a small number of those countries calling for new norms and obligations are the same countries that oppose frameworks of accountability for existing expectations and obligations. But whether new norms are needed or not, and as you know, Australia has not yet been convinced that new norms are necessary, how we evolve our framework should reflect the careful and evidence-based process that has brought our framework about. Australia would consider a rushed exercise to insert new norms that are potentially untested into our framework in the next four months and I think 21 days. It doesn’t provide the respect that we owe to our work in our framework. But what we can do in the next four months, in Australia’s opinion, is threefold. First, we can work to improve and adopt our proposed checklist for implementation. Australia welcomes new proposals to help us all in our guidance on implementation of the norms. A proposal that Australia is strongly supportive of is to add additional guidance on how gender mainstreaming can be incorporated into norms implementation. And we do encourage countries to consider the proposals for gender mainstreaming in the working paper that was drafted by Australia, Chile, Colombia, Fiji, and the United Kingdom and co-sponsored at this point in time by Belgium, Canada, Cyprus, Czech Republic, Finland, Germany, Ireland, Japan, Kiribati, Latvia, Lithuania, Malta, Mexico, Moldova, Netherlands, Norway, Papua New Guinea, Spain, and Uruguay. We want to work with all states on all the proposals that we have for this checklist and also any potential issues that states have applied because we think it’s really important that we’ve put a lot of work into this checklist and that we adopt it in July. Secondly, we need to ensure that the design of our future mechanism effectively and practically takes our norms forward in an evolutionary capacity, reaffirming what we’ve already agreed in our framework and providing a forum that translates these norms into practice. And Australia has been very attracted by the proposals put forward on how to meaningfully do this this morning by the United Kingdom, Malaysia, Albania, Thailand, Canada, and several others. Thirdly and finally, in the four months we have left, we can continue our own homework on increasing awareness and understanding of the norms in our own systems. While I have absolutely no doubt that every single person in this room could recite all 11 norms verbatim if we are tested, I have a confession to make. My cyber security agencies, my cyber capacity building officers, and even my cyber ambassador will probably all fail that test. More capacity building across regions, between countries, within countries, between our internal agencies is needed because while many of our cyber security agencies and other government agencies are already implementing our norms, some of them don’t know it. We have a lot of homework already, both in this room and at home, to accomplish in the next four months, so we’d like to concentrate on that. Thank you.

Thank you very much, Australia, for your contribution. Vietnam to be followed by Vanuatu.

The OEWG reaffirms the important role of financially non-binding norms and responsible state behavior in mitigating threats to international peace and security, promoting stability, and fostering trust among states. They serve as essential guidelines reflecting the expected standards of conduct by international communities in the use of ICTs and endorsed by ASEAN leaders in its 2018 Statement. Accordingly, the Checklist for the Implementation of Voluntary Non-Binding Norms should be considered a living document, subject to continuous discussion and refinement in future mechanisms. Nevertheless, we recognize that the implementation of norms represents a significant challenge, including the technical gaps between states. In many cases, states lack the necessary capacity, resources, or a shared understanding and prioritization of cybersecurity norms. These challenges highlight the critical role of capacity building, technical assistance, and international cooperation, including technology transfer and technical support in ensuring the effective implementation of norms, particularly for developing countries. Mr. Chair, with a view to promoting the multilateral platform for continued discussion, Vietnam supports the establishment of dedicated family groups within the future permitting mechanisms to focus on the rules, norms, and principles of responsible state behavior as well as international law. The future mechanisms should work with the UN members to establish a clear framework of enforcement norms for action in cyberspace, moving beyond the voluntary norms of the United Nations Group of Governmental Experts. Along this line, these delegations strongly support the inclusion of international law into the discussion on norms, rules, and principles. Mr. Chair, in terms of substantive norms and principles, given the rapid development and expansion in the digital landscape in both international and national contexts, Vietnam is aligned with the establishment of new norms that keep pace with the emergence of disabling technologies and address the widening digital divide reality. This demonstrates the commitment of the international community as a whole to strengthen the legal and normative frameworks that govern cyberspace. In this context, we emphasize the principle of common but differentiated responsibility for cybersecurity cooperation as a new manifestation of good faith and solidarity principles. It is essential to ensure that the new norms are inclusive and adaptable to the diverse technological and economic conditions of different countries. I thank you for your kind attention.

Thank you very much, Vietnam. I give the floor now to Vanuatu, to be followed by Switzerland.

Mr. Chair, Vanuatu strongly supports the continued development and implementation of voluntary, non-binding norms for responsible state behavior in cyberspace. These norms play a vital role in reducing risk, preventing conflicts, and ensuring that cyberspace remains stable and secure for all. However, for norms to be effective, they must be actionable and inclusive, providing clear guidance to all states, regardless of size or technical capacity, so they can implement them. As a small island developing state, Vanuatu emphasizes that norms must also account for the unique vulnerabilities of developing countries, particularly in ensuring the security and resilience of critical infrastructure and essential services. In line with Vanuatu’s National Cybersecurity Strategy 2030, we are working to enhance national cybersecurity frameworks, strengthen public-private cooperation, and improve incident response mechanisms, efforts that align directly with existing UN norms on protecting critical infrastructure, ensuring supply chain security, and fostering international cooperation. To move forward, Vanuatu calls for a greater focus on the implementation of agreed norms, particularly through capacity building support for developing states. Norms must not remain aspirational statements. They must be translated into practical measures that enhance national and regional cyber resilience. As discussions on a future mechanism continue, we emphasize that norms development should remain an inclusive and transparent process, ensuring that all states, not just those with advanced cyber capabilities, have a voice in shaping the future of responsible state behavior in cyberspace. Thank you, Mr. Chair.

Thank you, Vanuatu, for your statement. Switzerland, to be followed by Saudi Arabia.

Thank you, Mr. Chair. Switzerland is of the opinion that before developing new voluntary norms, we should focus on the implementation of the existing ones. The argument that the norms are only voluntary, which is why we need new binding obligations or norms, is not convincing in our view. Firstly, we already have binding norms, as also the U.S. delegation mentioned earlier. States agreed that existing international law is applicable to cyberspace. Secondly, the voluntary norms were confirmed and adopted by all states by consensus, including by adopting General Assembly resolution 76/19. States stressed that such norms reflect expectations and standards of the international community regarding the behavior of states in the reuse of ICTs. This does not exclude that we could develop new norms over time where useful or needed. However, in our view, many of the proposed new norms can be subsumed under the existing ones. From our point of view, this does not contradict the discussions about the rapidly changing threat landscape we had yesterday. The 11 voluntary norms are formulated in general terms and offer flexibility so that they can also be applied to new developments. Yesterday, many states referred to the increasing intensity of ransomware attacks and state-sponsored cyberattacks against critical infrastructures. We therefore see merit in focusing on norms referred to in C, F, G, and H, calling for the protection of all critical infrastructures supporting essential services to the public, in particular medical and healthcare facilities, as well as cooperation between states for this purpose. The Portuguese delegation has very well explained the importance of the principle of due diligence in this regard. With regards to ransomware attacks, it is important that states do not serve as safe havens for criminal groups and take measures against them. Chair, like other delegations, we see the proposal for a checklist as an important step that we took in the last APR. It is a useful instrument for states and their efforts to implement the voluntary norms and can serve as a capacity-building tool. Switzerland believes that cooperation with non-governmental stakeholders is essential for the implementation of the voluntary norms. For that reason, Switzerland has established the Geneva Dialogue on Responsible Behavior in Cyberspace. The dialogue analyzes and maps the roles and responsibilities of various actors in ensuring the security and stability of cyberspace. The Geneva Manual is a product of this dialogue. The inaugural edition of the manual focuses on two norms related to supply chain security and reporting of ICT vulnerabilities. In the coming years, the dialogue will continue discussing the implementation of other norms to expand the manual. Based on this experience, we are firmly convinced that broad and meaningful participation of stakeholders in the future permit mechanism is not only necessary but also to the advantage of all states. Like Canada, we believe that we need modalities that allow us to do just that without a single country being able to veto it. Thank you, Chair.

Thank you, Switzerland, for your statement. Saudi Arabia, to be followed by Egypt.

Thank you, Mr. Chairperson. The Kingdom of Saudi Arabia reaffirms and supports the statement of the Arab Group. Allow me to add the following in our national capacity. Mr. Chairperson, at the outset, we thank you for your efforts in managing the work of the Working Group, and we reaffirm the need to build on what was achieved in the work of this Working Group and the permanent mechanism that will be established. Furthermore, the Kingdom of Saudi Arabia believes in the importance of international cooperation when it comes to cybersecurity. We need to continue in our discussions in this regard. We also need concerted efforts. Therefore, we established a Center for Cybersecurity in 2023. This institute is to support cybersecurity at the national level and to support international cooperation, economic and social development in this regard, and to keep up with international efforts when it comes to cybersecurity. This institute will also work with the Saudi mission here in New York in order to organize an event on the sidelines of this session. Today, at 1 p.m. – 1:05 p.m., this event will include a dialogue with His Excellency Mr. Englis, the former head of the Cybersecurity Office here in the U.S., entitled, Joint Effort in Cybersecurity, Changing Challenges into Opportunities. In this regard, I would like to invite everyone to attend this event and to have lunch with us on the fourth floor of this building. Thank you, Mr. Chairperson.

Thank you very much, Saudi Arabia, for your statement, as well as for your invitation to your side event. Egypt to be followed by France, please.

Thank you, Mr. Chair, and I took the floor to share an update with you on the floor. Egypt and Germany were engaged over the past two weeks in a capacity-building program for the African diplomats at the level of New York. I personally found this capacity-building program very useful, the last session of which was held yesterday. It was a simulation exercise for a real-life incident of a threat against a critical infrastructure. The discussions that took place in the simulation exercise resemble the discussions that will take place in the thematic group to be formed over threats and how to deal with them. And I would like to share those four takeaways from this simulation exercise. First, the theoretical discussions that take place here, I guess, will be so different from the practical discussions that will take place in the thematic working groups to be established. Second, analyzing the real incidents yesterday made it clear that the norms we have are very useful because they actually reflect principles that nobody could oppose, like due diligence, cooperation, sharing information, and, as well, accountability. That said, having cross-cutting discussions and scenario-based deliberations proved to be very useful and necessary, but they are not sufficient. Mr. Chair, the discussions that we had yesterday generated so many questions that I believe would be difficult to be addressed in one thematic group. I will be sharing Egypt’s position on the thematic groups in the relevant agenda item. However, I would like to conclude my remarks by this. Egypt believes that it’s important to have an open mind and adopt a flexible approach until we engage in the real discussions in our future permanent mechanism. And I believe when we have those real discussions, we’ll find out that we need more norms and different types of norms, some binding and some voluntary. I believe, as well, we will need more communication mechanisms to the current existing norms and maybe instruments. So at the end, I guess it might be appropriate not to preempt the discussions and, more importantly, not to make them more skewed to certain threats because it might give the impression that, yes, all threats are equal, but maybe some threats are more equal than others. This is counterproductive. So, again, let’s have an open mind and be flexible because things might change when we have real discussions on certain incidents in our real life. Thank you so much, Chair.

Thank you very much, Egypt, for your statement, and thank you also for updating the working group here about your partnership with Germany in terms of the capacity building exercise that was convened for African Union diplomats. And I think, as I’ve said at the beginning of this morning, this working group has led to so many productive partnerships across regions, across continents. That in itself is a very important outcome of this process, beyond the outcomes we might have on a piece of paper. So very happy to hear that, and there is no doubt many other partnerships that are occurring, not just here at the UN but also bilaterally, regionally. All this is something that we must continue to encourage. And I, of course, echo what you said, Egypt, about keeping an open mind and being flexible. That is very important for the work of the UN, not just for this working group, but across the board, because ultimately the world, as we know it, is shifting under our feet. It is not an exaggeration to say that. And therefore, it’s important that we have an open mind, be flexible, and respond to the needs and respond to the situation as it evolves, which is why we have a cumulative and evolving framework. Even as we accumulate or accumulate, we need to evolve as a community and as a working group in terms of what we need to do. So thank you very much once again, Egypt, for sharing with us your experience with that partnership with Germany. France to be followed by Kuwait.

Mr. Chairman, the delegation wants to start with a statement made by the European Union and would like to make the following remarks in its national capacity. This year we are celebrating 10 years of norms for responsible behavior in cyberspace. I am fortunate to have participated personally in the 2015 GGE negotiations and to have followed the subject closely for 10 years. In this regard, I would like to share with the rest of the group my observations as a norms veteran, so to speak. Yes, it is a thing. On the one hand, I can only welcome the fact that the continued discussion on norms over the past 10 years has led to an improvement in the common understanding of them by states. I also note the efforts made at the national and regional levels to advance their implementation. On the other hand, I can only measure the distance that remains to be covered to achieve a satisfactory level of implementation. Our compass in this regard should be a sustainable strengthening of cyber resilience at the global level. Unfortunately, this is not the direction we are taking collectively. Faced with this distance to be covered when it comes to implementation, my delegation believes that our priority should not be the creation of new norms, which risk casting doubt on the credibility of our work. This is why our priority remains to implement these norms in all of their dimensions at the political level as well as the technical level, which the Singapore delegation highlighted so usefully. We’ve listened to the many delegations that have proposed avenues for reflection on the treatment of norms in the future mechanism. Echoing these proposals, we propose that norms continue to be discussed within the norms, rules, and principles pillar of the plenary of the future Program of Action. However, this first level of discussions must be complemented by a problem-solving approach aimed at the concrete problems that states face in implementing norms. To achieve this, over the next 10 years and beyond, discussions within the dedicated thematic groups on resilience, cooperation, and stability could therefore be organized in three stages. Firstly, a briefing by experts on the topic. Secondly, discussions on the normative framework, including norms and good practices related to their implementation. And thirdly, exchanges on the needs of states and capacity-building solutions. Finally, France supports the United Kingdom’s proposal on Norm 13, Roman numeral I, or 13i, which covers the nonproliferation of malicious tools. The proposed additional voluntary action would be very relevant, and we are counting on its addition to the checklist in July. Thank you.

Thank you very much, France, for your statement. Kuwait, to be followed by Nicaragua, please.

Mr. Chairperson, the State of Kuwait is delivering this statement on behalf of the Arab Group when it comes to the responsible state behavior and the application of international law. The Arab Group commends the importance of trust-building measures so that we can guarantee cooperation between countries and bring opinions together to reduce tensions and de-escalate any situation in cyberspace. We believe that building confidence will allow us to build on the current norms. We do not believe we need additional norms, rules, and principles through binding instruments. The group welcomes the consensual agreement of cybersecurity norms, and this is the first step that was adopted through the working group. We look forward to the adoption of the voluntary checklist in a way that would respect the voluntary exchange of data. We believe it is important to have further discussions and dialogue at the bilateral, regional, and sub-regional levels on how international law will apply to cyberspace. We believe that we need further discussions in this regard, and we encourage countries to hold workshops and training for their contact groups so that we can exchange expertise and best practices. We also need to look at how we can benefit from confidence-building measures that are drafted at the regional and sub-regional levels in case there is no consensus at the UN level. Thank you.

Thank you very much, Kuwait. I give the floor now to Nicaragua, to be followed by New Zealand.

Thank you, Mr. Chairman. One of the priorities of our group must be to draft an appropriate and modern normative framework to regulate threats and challenges in the security landscape and the use of ICTs. It has been established that although existing voluntary and non-binding norms of behavior are a positive step for effectively regulating the use of ICTs, they are not enough, nor do they guarantee an effective response to these threats. For that reason, since this group was established, we have called for an international, legally binding instrument to regulate behavior. This is our ultimate goal. Our delegation endorses the initiative of a UN Convention on International Information Security, put forward by the Russian Federation as a starting point for establishing an effective international legal framework in the area of international information security. The purpose of these norms is to guarantee an environment for international cooperation and understanding to benefit everyone equally, while respecting the purposes and principles of the UN Charter. It is vital to adopt legally binding norms that prevent the militarization and politicization of cyberspace, that aim to promote international cooperation and the peaceful settlement of disputes in cyberspace. These norms must also bear in mind the different conditions and responsibilities that exist in the development and technological know-how between developed and developing countries, reflecting the needs and concerns of all of our states on an equal footing. Thank you.

Thank you very much, Nicaragua. New Zealand to be followed by Brazil.

Thank you, Chair. We have consistently maintained that the existing framework for responsible state behavior, fully implemented, provides a solid foundation for states to collaborate in maintaining a stable and peaceful cyberspace. We acknowledge that there is a desire among some to explore new norms. We understand, in most cases, this is based on a genuine wish to enhance the current framework and address potential gaps, particularly in light of rapidly developing technology. However, we believe it remains beneficial to first undergo a period of consolidation and informed assessment through the implementation of existing norms. As Switzerland noted, this does not equate to, and should not be viewed as, dismissing the idea of developing new norms over time. We acknowledge and understand the concerns regarding emerging, evolving, and new threats and their impact on norm development. Nevertheless, there are practical reasons for adopting a deliberate approach. This includes making the best use of our limited resources and avoiding the pursuit of initiatives that may duplicate existing norms or fail to significantly improve the current framework. By taking a deliberate and evidence-based approach, we can more effectively identify and address potential gaps, if any. Australia gave a good history of how the current norms were developed, with a well-informed, bottom-up approach which led to a durable consensus outcome. And, Chair, looking ahead to a future mechanism, a permanent mechanism, we believe the same principle applies. Such a mechanism should prioritize the implementation of the current framework, enabling us to better understand what additional measures, if any, are necessary. As noted in our previous statement on threats, we think it could be possible to streamline the proposal for dedicated thematic working groups, including by weaving the discussion around rules, norms, and principles of responsible behavior of states into the other proposed groups on resilience, cooperation, and stability. We support the comments by the United Kingdom and France, who in their interventions gave some very useful examples of how this might work in practice. We think this approach would provide states with specific, practical contexts to discuss issues around rules and norms, and that would complement the more general plenary discussions that would continue to take place under a future mechanism. We believe this approach has the potential to enhance our discussions around implementation of the current framework, and which could also help states in identifying where any gaps may exist, if applicable. Thank you, Chair.

Thank you, New Zealand, for your contribution. Brazil, to be followed by Tonga.

Thank you very much, Mr. Chair. My delegation thanks you and your team for your work in guiding our debates on this issue. Brazil is a staunch supporter of the acquis of previous UN processes on ICTs and international security, particularly the voluntary norms of responsible state behavior, which, as many delegations have already reminded us, are reaching their 10th anniversary this year. Their continued relevance after a decade of exponentially accelerating technological innovation is a testament to how well they were drafted, by focusing on behavior rather than on specific technologies. The norms have guided us in the establishing of our national norms and policies to secure our critical infrastructures and critical information infrastructures. In this regard, we welcome efforts to facilitate their implementation, including the Voluntary Checklist of Practical Actions you drafted, which was included as an annex to the third annual progress report. We support the proposal made by other delegations that it be included as an annex to our final report, with the acknowledgment that it is a living document and will be updated as necessary. The promotion of gender equality is a key component to the adequate implementation of the norms. Promoting the inclusion of women in the cybersecurity workforce, as well as having policies that address the differentiated impact of cyber threats to women and other vulnerable groups in our society, is an important component of our new National Cybersecurity Strategy, which is expected to be published in the coming months. In this regard, we can support the proposals contained in the working paper presented by the United Kingdom with a number of other delegations to mainstream a gender perspective to norms implementation. Mr. Chair, we have heard throughout our debates the arguments for advancing the implementation of the existing norms and for the adoption of new ones. In our view, those positions are not in any way mutually exclusive, and our future mechanism must allow for both. Any efforts aimed at eventually developing new norms of behavior in the cyber domain must be inclusive and therefore take place within the UN, where the needs of all countries are duly taken into account. The truth of the matter is that there are many initiatives currently underway outside of our multilateral process that aim to shape state behavior in areas that clearly fall within the purview of this OEWG and the future permanent mechanism. Finally, my delegation would like to stress that in light of the complementarity between hard law and soft law, we appreciate your inclusion in the RID discussion paper of our proposal on a thematic group on international law and on norms, rules, and principles. As we mentioned at the February 6th Town Hall, debating them in an integrated manner does not in any way grant them equivalent legal status, but simply recognizes their complementary nature. The working group could discuss them under separate agenda items to highlight their distinction, but discussions on one of these items must not ignore the existing body of work of the other. In any case, we will continue to work constructively with other delegations to reach a consensus solution to this issue. I thank you.

Thank you very much, Brazil, for your contribution. Tonga to be followed by Fiji.

Thank you, Chair. Tonga is pleased to deliver this statement on behalf of the Pacific Island Forum members represented here in New York. As it is our first time to take the floor, we wish to thank the Chair and the Secretariat for the continuous great work and for the development of the implementation checklist. The Pacific Island Forum members reaffirm the importance of implementing existing agreed norms of responsible states’ behavior in cyberspace. By promoting adherence to international law and norms in cyberspace, we can promote an open, secure, stable, accessible, and peaceful ICT environment. The norms are fundamental to reflect the expectations of the international community and support international peace, security, and stability. We reiterate that these norms are intrinsically interrelated with international law and do not seek to limit or prohibit actions that are otherwise consistent with international law. We would like to reiterate our thanks to the Chair and your team for developing an implementation checklist to bolster the implementation of the norms. We see the checklist as a useful and practical guidance tool that builds our understanding of the norms and enables all states to achieve greater implementation of our framework of responsible state behavior in cyberspace. However, we draw attention to the gaps in awareness and both the implementation and operationalization of existing norms. The Pacific community is diverse, and there is no one-size-fits-all approach for the implementation of the norms. We encourage all states and relevant stakeholders to continue to share ongoing guidance and best practices provided by the OEWG. To support the implementation of the norms, we propose that the OEWG’s final report could also encourage targeted capacity-building programs to address challenges to implementation and gaps in capacity that are identified, provided an evidence base which has been provided by the state itself. We encourage the OEWG to continue to build upon the norms implementation checklist to provide consolidated and consensus guidance for all states. As a meaningful way forward, states should also continue to share their own experiences on implementing norms because this provides a way to help others understand how we interpret the norms. We consider the full mainstreaming of the norms to be a precursor to a conversation on any gaps and possible identification of additional voluntary non-binding norms that might advance our framework of responsible states’ behavior. The Pacific Island Forum members here in New York remain committed to working with all member states in the OEWG and multistakeholder partners to further progress our work on the implementation of our existing norms. Before we end, we beg your indulgence, Chair, that we will be coming back at a later stage of the day to share some of our sentiments on threats. Thank you, Chair. Thank you.

Thank you very much, Tonga, for the statement. Fiji, to be followed by Kenya.

Thank you, Chair. Chair, Fiji aligns itself with the statement delivered by Tonga on behalf of the Pacific Islands Forum members and would like to deliver the following remarks in our national capacity. Fiji reaffirms its commitment to the evolving framework for responsible state behavior in the use of ICTs. We recognize that voluntary non-binding norms play a crucial role in enhancing international peace, security, and stability, and thank you, Chair, for the voluntary checklist as the next in our third APR. Chair, Fiji notes that for the 11 voluntary norms for responsible state behavior in cyberspace, the journey from agreement to implementation is complex and multifaceted. Therefore, priority in information sharing on how nations or regions are implementing the voluntary checklist for the 11 voluntary norms is welcomed. On that note, we also thank the ASEAN regional group for sharing the ASEAN checklist for the implementation of the norms of responsible state behavior in cyberspace. This provides further information on how it is implemented as a region and at different levels: operational, legal, technical, and so on. Chair, Fiji is in the process of designating our CI and CII and in standing up our national CERT and therefore welcomes support in this regard. We cannot protect what we cannot designate. Strengthening cooperation, sharing best practices, and capacity building remain key priorities in ensuring resilience against cyber threats. Fiji supports inclusive and adaptive approaches that reflect national and regional specificities, recognizing that no one-size-fits-all model exists. Furthermore, we highlight the criticality of embedding gender into the implementation of the 11 non-binding norms. As spotlighted in yesterday’s side event on gender and cyber norms, bridging policy and practice, there remains a significant gap between policy commitments and their operationalization, particularly in ensuring that cybersecurity measures are inclusive, adaptive, and aligned with human rights principles. Acknowledging this reality, Fiji finds value in the efforts to build gender-responsive cybersecurity policies, develop gender-sensitive technical standards, and ensure the collection of gender-disaggregated data to better understand cybersecurity impacts across different groups. We also refer to the working paper by Australia, Chile, Colombia, my country, and the United Kingdom, co-sponsored by 28 countries and supported by a number of other states. We encourage delegations to review the proposals in the cross-regional paper and would like to see these proposals in our upcoming final report. Fiji reaffirms our commitment to gender mainstreaming in policy and legislative frameworks, including in national cybersecurity strategies, to ensure a more inclusive approach. This commitment is cemented in Fiji’s national development plan 2025 to 2029 and vision 2050. We are also in the process of drafting our national cybersecurity strategy and finalizing our national digital strategy, whereby gender mainstreaming is a key cross-cutting pillar. Finally, Chair, Fiji encourages continued dialogue, cooperation, and tailored capacity building efforts to translate commitments into tangible outcomes that promote international security, stability, peace, and gender equality in the digital age. Thank you, Chair.

Thank you very much, Fiji, for your contribution. Kenya, to be followed by Israel.

Thank you, Chair. This is the first time Kenya is taking the floor. Kenya commends you, Chair, for your team and your continued leadership and efforts in facilitating this OEWG process with an action-oriented program of work. I also thank the UK Government and GFCE in facilitating our participation in the Women in Cyber Training Forum and this particular session. Kenya is dedicated to the implementation of the existing norms and how they can be applied. Understanding the norms is a precursor to identifying gaps and, if necessary, possible identification of additional non-binding norms that may contribute to responsible state behavior. Kenya welcomes the Voluntary Norms Checklist as provided in the third APR and will prioritize furthering this work with your guiding questions. We encourage the availing of practical tools and mechanisms to enable states in the implementation efforts. The checklist actually points to the work that has been done by this group and its predecessors with the 2021 GGE report in providing direction on the implementation of the voluntary non-binding norms. The checklist is useful in collating national adoption of the norms, sharing of best practices and information, and identifying challenges that impede implementation. This will aid in tailoring capacity-building programs to aid in addressing the challenges or gaps as identified by states. The implementation of norms, however, remains a challenge due to the varying degree of technical know-how of states. Norm C, for example, requires that states should not knowingly allow their territory to be used for internationally wrongful acts. To implement this norm, a country requires necessary tools and skills. Norm F and G underline the importance of the protection of critical infrastructure and critical information infrastructure. To protect critical infrastructure and critical information infrastructure, a nation must have appropriate tools, skills, national policies, and laws. An integral part of the implementation of the norms of responsible state behavior is not only in sharing common understandings but also an opportunity to assess inwardly on appropriate actions each of us should take towards full implementation. As we wind up this OEWG process and move to the future permanent mechanism, we reiterate that capacity-building of states, especially technical capacity, to enable implementation of the voluntary non-binding norms should be discussed and implemented. Kenya applauds various initiatives by multiple stakeholders in advancing understanding and implementation of the norms. I thank you, Chair.

Thank you very much. Kenya. Israel, to be followed by the European Union, which is the last speaker. Israel, please.

Thank you, Chair. Thank you for giving us the floor to comment on the important issue of the normative framework. I will do my best to be very concise. Since 2015, the norms have been taking much of our discussions, and rightly so. With some Member States calling for new or revised norms, Israel at this point remains very skeptical of the need for further development of the norms we have, when in reality the basic norms of responsible state behavior in cyberspace are being flouted by certain states, as we have elaborated yesterday when discussing the existing and potential threats. Israel believes that a more cautious approach with respect to norms is required. As things currently stand, there is still a lack of certainty as to the manner in which existing norms and rules are implemented and understood by states. Let us also recall that the 2015 GGE norms and rules and principles that many delegations reminded us this week we are marking soon 10 years since their adoption, are voluntary and non-binding in nature, and do not detract from or extend beyond international law. Thus, norms are intended to signal expectations of the international community regarding appropriate state behavior, and from what we have seen thus far, their implementation has been, at best, short and uneven. In order to ensure the relevancy and efficiency of our hard work so far, we should strive for a better track record before further development of new norms. As for the future mechanism is concerned, we are of the view that the international law and norms pillars of our plenary discussions can be best related also in the two or three cross-cutting dedicated thematical working groups, as the French suggestion elaborates. And through the deliberations on matters like building better global resilience, best practices to protect our critical infrastructure and services, or dealing with international cooperation in the event of major cyber attacks, if done cautiously by recalling the appropriate focus on achieving compliance with norms before rushing to further development of the normative or legal frameworks, integration of these important pillars, norms, and international law into the future dedicated working groups discussions may help the cross-cutting working groups be more effective, operational, and relevant. To conclude, Mr. Chair, we wish to restate that at this point in time, there is no need, in our opinion, to develop or elaborate any new norms, nor do we see now a need for developing any legally binding instruments. Thank you.

Thank you, Israel, for your contribution. European Union, please.

Thank you, Chair, for allowing me the floor again to actually deliver our statement on norms. You have heard my colleagues align with the EU statement on norms. However, I must admit, as you have noticed, that by mistake I delivered earlier this session our statement on international law. What can I say, barely being an object of human intelligence? But thank you for allowing me to respond to the evolving situation and step in again at this time, after my EU member states allowing me to emphasize their statements. I will try to keep it brief, and please know that we will publish all our statements, including on norms, as well as international law, on the UN website, including also the alignment of partners. Chair, on norms, as a meaningful way forward, we should continue sharing our experiences in the implementation of norms. It helps us to understand how we can enhance and review the implementation efforts and promote continued exchanges of experiences and best practices, including on a new mechanism. The EU is working on a non-exhaustive list of examples regarding the steps taken by EU member states and the EU in the implementation of the 11 agreed norms, including through the work of the EU cybersecurity agencies on the revised network and information security directive, or by the EU cybercrime center and its work to combat cybercrime. Chair, we see the norms checklist as a valuable tool to take our work forward in the current formats. We acknowledge the efforts to capture the detailed and useful information on the norms section of the UNGGE 21 report, but agree that more can be done. For example, by including certain elements such as working with the private sector to protect critical infrastructure, considering their role in this context. The voluntary checklist should be treated as a living document and serve as the primary reference as states continue to implement the framework. An initial version of the checklist could be adopted and attached to the final Open-Ended Working Group report, and this would ensure that states have a clear starting point to survey implementation efforts. In the future Program of Action, with its emphasis on concrete implementation and related needs to capacity building, we could have an ideal platform to further develop the voluntary checklist. We also welcome the idea by Kuwait on the online portal to support and track the implementation of the 11 norms of responsible state behavior. Furthermore, we suggest looking at other examples of norms implementation guidelines, for example, projects by UNIDIR, Oxford, and others to provide further guidance on minimum baselines for norms implementation by states. Such efforts could also be incorporated in the norms checklist. Chair, despite me reading the international law statement under the norms section, let me emphasize that for the EU and its member states, it’s crucial not to conflate the discussion on binding international law and cyberspace, to which all states are bound to comply, with the discussions on norms of responsible state behavior. While these discussions should be viewed as complementary, they should, in our view, be treated also as two distinct elements. The cross-cutting dedicated thematic groups that we propose should allow for both sufficient time and space to discuss how international law and norms applying to cyberspace can be applied to specific cyber challenges, as also is for the other elements of the pillars. To take one example, international law prohibits the use of ICTs, including ransomware, to intervene coercively in the internal or external affairs of other states. Additionally, the norms and confidence-building measures both provide normative and practical guidance on how states subject to an attack can, for instance, seek assistance from others in the event of a ransomware attack. We should not forget that voluntary norms do not exist in isolation, but they sit alongside the obligations established by international law. While norms are voluntary and non-binding, the law itself is actually binding. Chair, the EU is committed to mainstreaming the norms we have agreed upon and will continue to raise awareness of them across governments and beyond the UN. We are dedicated to advancing the implementation at domestic and regional as well as state levels and will continue to contribute to this. Thank you very much. Thank you.

Thank you very much, European Union. I know that the EU is always ahead of the curve, so you’ve actually made your statement on international law and norms. So yes, thank you for that statement on norms. Friends, we have about 10 minutes or less before we wrap up this part of our agenda and move on to international law, which we will do this afternoon. Not sure I can really give you a summary of the discussions. You have all heard yourselves. It is quite clear that we have all become non-veterans. Some of us have listened to these discussions for over 10 years. The norms are 10 years old, but in some ways, they are timeless. They continue to be very, very important in terms of the guidance it offers for responsible state behavior. While the diplomats have become older, the norms remain timeless. And I think everyone agrees that it’s really important that we continue to support the implementation of the norms. I think on that part, I don’t think there is agreement. No one is objecting to norms implementation. So there is some degree of commonality with regard to the implementation of norms. I think all of us at the same time want the normative framework to be implemented and to raise the awareness of it, raise the understanding of it. And we also all accept that it’s cumulative and evolving. It will evolve through various ways, through norm guidance, through explanatory text. And then, of course, in that 2015 report, we also acknowledged and continue to acknowledge in our annual progress reports that new norms could be developed over time. So in some ways, it has become the norm in this working group to talk about developing new norms. But ultimately, it’s a question of finding consensus as to how we want to take further steps as we transition to a permanent, future permanent mechanism. I think that’s where we are at a crossroads because we are transitioning from this working group, hopefully to a future permanent mechanism, and how do we want to evolve this discussion on the development of additional norms. We also have to acknowledge that in the course of the work on this working group over the last few years, some additional proposals and ideas have been put forward. It’s there on the table. The discussions are continuing. It is bottom-up. No one is imposing any norms from the top. The discussions are continuing. And it’s incumbent on all of us to see if we can find common ground and build common ground. So in that context, it is cumulative and evolving in an inclusive, transparent, and open-ended way because this is the open-ended working group. So we need to reflect carefully on how this will be captured in the final draft so that our work in the future permanent mechanism doesn’t start again in 2015. I think that’s important, that we continue the work that has been done over the last 10 years. We transition into a future permanent mechanism and how do we build and continue this discussion on norms implementation as well as the question of potential future permanent mechanisms. How do we continue that discussion into and beyond 2025? And we should do it in a way that recognizes the discussions that have come thus far as opposed to going back to 2015, in which case we will not do justice to the discussions, not just in this working group, but over the last 10 years. The question of the voluntary checklist, I think a lot of you have mentioned it. Again, it is a way of providing additional guidance on norms implementation, but it can also help in many other ways in terms of capacity building, in terms of practical application in the context of a simulation exercise, for example. So I’d like you to reflect on that. I think it is a living document, as many of you said, so it’s not cast in stone. And I think we need to see how we can capture the discussions on the voluntary checklist this year, but also over the last year. I mean, the final point I would say is the point that some of you had made, which is that we need to keep an open mind. And I would also suggest that we should not look at this discussion as a zero-sum discussion where we can try and define in a very black-and-white way as to where we are. It is an evolving discussion. We have had over the 10 past years, we need to capture that discussion. We need to reflect some of the ideas and proposals that have been expressed over the last few years, and we have to do it in a way that commands consensus. So that is our challenge for the final progress report. I won’t say anything more at this stage, but I do invite all of you to keep an open mind as we transition to the next discussion this afternoon, which is international law. In some ways, the two topics are distinct and separate. A lot of you have said that. I think no one disagrees with that. In fact, that too was a common point that came up in the town hall and here, the need to separate the discussions on international law as well as on norms, or rather how the two are two distinct concepts. But I think we can all have that conceptual distinction in our mind, even as we discuss the issue in a broader context. Because a lot of you, while we were talking about norms, were talking about international law. And while we will be talking about international law this afternoon, we will no doubt be going back to the relationship with norms. So again, it is not zero-sum, but to keep an open mind, and we’ll come to the discussions on international law starting this afternoon at 3 p.m. But thank you very much for the positive and constructive tone for the discussions this morning, and I wish you a pleasant lunch. The meeting is adjourned.