Session 3-4 Transcript
(OEWG 2021-25)

Good afternoon, distinguished delegates. The fourth meeting of the third substantive session of the Open-Ended Working Group on security of, and in the use of, ICT technologies 2021-2025, established pursuant to General Assembly resolution 75/240, is now called to order. We will continue our discussions under agenda item five on the draft annual progress report, covering sections A to G of the report, in other words, the entirety of the report, and we will continue with the speakers list that we had from this morning. As I indicated before we broke for lunch, we will start with the UK, followed by Peru, the United States, Israel, and Romania, and then we’ll continue with the rest of the speakers. So I give the floor now to the UK. Please give the floor.

Thank you, Chair. Thank you for the opportunity to speak. I’ve taken the opportunity of being a bit slow to get onto the floor to listen carefully to all of our colleagues who have spoken in the last day and a half. I extend my thanks to you, Chair, and to your team for your efforts in revising and advancing the Zero Draft in such quick time last week. These comments build on my contribution on the Zero Draft. A roadmap for discussions in the OEWG will allow us to move from general statements to more detailed discussions, which is crucial if we are to make progress together, and that’s something that the UK hopes to achieve. But we take this opportunity to reflect that there remain significant differences in this room. We encourage delegations to make full use of their many cyber diplomacy skills in support of the Chair, whilst also managing expectations of what we can achieve. Chair, China helpfully said yesterday they consider that observation and implementation of our shared holistic framework is crucial, and we agree that the report must accurately reflect that. A particular point of concern for us is the vague and inconsistent reference to ICTs rather than security of, and in the use of, ICTs, or use of ICTs in the context of international peace and security. This wholly undermines our mandate and changes the nature of the report, and so we request this be standardized as a priority. As many others have, we also welcome the new language in the introduction on stakeholder modalities, regional organizations, and gender. Language referencing the need to strengthen interactions with stakeholders should apply throughout the report, not to one specific section. With regards to threats, on 7a we add our voice to those countries welcoming the inclusion of this threat context but requesting further additions. The reason we came together at the UN on ICTs in the context of international peace and security was because we judged that the use of ICTs in future conflicts between states was becoming more likely. It is no longer becoming more likely; it is here. We believe it is possible and valuable to reflect this in our report in a manner that all member states can support, and we request the following specific changes in this regard. At paragraph 1, we support the proposal to include a reference to armed conflict. At paragraph 7a, we consider that this paragraph could include wording relating to cascading critical infrastructure effects as noted by the US, hacktivism and criminal and terrorist activity as noted by Russia, the need to protect critical infrastructure as noted by Kenya, humanitarian work as noted by Switzerland, the global ICT environment as noted by China, and ransomware as supported by many in the room. To be clear, Chair, we remain against proposals to address law enforcement activity and mutual legal assistance in this forum. This position has been questioned. We consider that national positions can be legitimately nuanced. We agree that on occasion criminal activity, including the use of ransomware, may lead to implications for international peace and security, thus necessitating discussion in this group. That is different from supporting operational activity on standard law enforcement issues as part of our mandate. At 7b, we agree it would be clearer to include these proposals where they find consensus under the relevant section of the report. We are content with Australia’s suggestions on how to achieve that. We share the US’s concerns regarding the role of the OEWG and the inclusion of 7b5 and 7b4, and the EU’s concerns about 7b6 and 7b7. As India noted, we question whether the wording at 7b5 is quite correct. Our own proposal was that cooperation and assistance for encouraging the adoption of secure by design principles and good cybersecurity risk management practices, but we are happy to discuss that. We recognize that data security is part of the mandate of this group. However, we do not accept that discussion of this topic should be expanded to issues such as cross-border data flows or include a call for new standards before we have discussed anything. And my computer has just died, Chair, so… Could you open the document, Liz? Half a second. Oh, no, I’m back. It’s fine. Before we have even discussed the topic. We support Indonesia’s comments regarding the need to articulate the needs of developing states in building capacity to identify, mitigate, and respond to threats. We consider this is the core function of the capacity building section, which currently appears to be overtaken by broader capacity building initiatives to the detriment of progress on our mandate. We would support the inclusion of more language on this topic in section F. On rules, norms, and principles, we share US concerns about the language at 8c, and specifically the inclusion of the word innovation, which we are unclear on what it refers to. We request the correction of language at 8e in line with the original wording of the 2021 OEWG report, that the perspectives contained in the Chair summary be considered in future UN processes, including the open-ended working group, rather than the current wording that’s there. We note the proposal at 8a to develop common standings on technical ICT terms. However, we request its deletion from recommendation 2. We haven’t succeeded on this in aligning ourselves with our own defense department in the UK, so I don’t think we’re going to achieve it here in the UN. We share concerns about the approach to allocation of tasks to the secretariat, including in operational areas and on issues where they will quickly be overwhelmed by the volume of input. The report must clarify that any collation of inputs would be from member state or stakeholder contributions as appropriate and within existing resources. This includes at section D recommendation 4, section E paragraph 10a, and recommendation 3. We propose to delete section F recommendations 7 and 8 on this basis. In closing, Chair, I align myself with the statement of the Czech Republic yesterday morning and welcome Russia’s willingness to provide an explanation of its vetoes, preferably to all member states.

Thank you, Chair. Thank you very much, UK, for your statement and your proposals. Please do give us a written text of your comments. Peru, you have the floor, please.

Chairman, allow me to begin by thanking you for your valuable efforts and those of your team that have enabled us to have this first balanced progress report that comprehensively takes up all of the positions of the states and which will serve as a basis for our work. Moving on to the text and its six specific pillars, as our delegation, we’d like to note that in the introduction, we believe that the reference to the malicious use of ICTs by state and non-state actors is correct. We do not believe it’s appropriate to mention specific cases and the subsection B on threats as well. It’s also important to underscore the continuing nature of processes referring to the reports of the previous OEWG and the GGEs that indeed will serve as a guide for the work of this group. We recognize the role of regional and sub-regional organizations in security and the use of ICTs. We believe that’s also crucial, particularly to foster cooperation. The benefits from regional efforts should be complementary to the efforts of the United Nations, as is reflected in paragraph five. Finally, on this introductory part, we welcome the fact that the OEWG is involving stakeholders and other interested parties in a sustained and substantive manner in accordance with the modalities that we adopted yesterday. On the section on existing and potential threats, as have already been flagged by other delegations, threats have been developing and evolving and will continue to do so in this sense, but it might not be viable to have a list and the best thing would be to look at it holistically by giving a different approach. This doesn’t exclude the fact that we could refer to the ransomware attacks wherever they affect critical infrastructure for state entities or critical information infrastructure. We also need to assess whether it’s appropriate in this section to contain the proposals to address these threats or whether we should put them in a different chapter of the document. Turning now to C, on rules, norms, and principles of responsible state behavior, we support the way in which we have addressed the national survey and the information that could be provided by states on the implementation of these norms, rules, and principles. It’s important also to underscore the implementation of these norms as was flagged by the Mexican delegation, but I would also like to specify that with that, we’re not excluding the establishment of other new norms as is set out in 8B. We believe that this should be kept as is, nor does it exclude the necessity of adopting a legally binding instrument in the future. Voluntary norms and legally binding norms should always be seen as complementary and not mutually exclusive. I’d also like to say that I don’t clearly see the link that some delegations have drawn between lack of compliance with international law by some states with the possibility of establishing new binding norms. I don’t think there is a link between these two points. Turning now to international law, section D, we join in the statement made by Switzerland on behalf of a number of different states. Turning now to confidence-building measures, section E, we welcome the creation of an intergovernmental global repertory of contact points as is set out in 10A. We also believe it’s important to underscore the SG’s report on progress on ICTs in the context of international security and the UNIDIR cyber policy portal for the exchange of information and the development of confidence-building measures as is set out in 10B. On the capacity building, we note that this promotes the better understanding of the needs of developing states in order to reduce the digital divide. On this aspect, we would like to particularly underscore the cyber security maturity model. And finally, on 11E, we believe it’s important to also look at other avenues of funding for ICT and the use of ICTs with multi-donor trust funds and programs. We welcome the proposal made at the end of this on the trust fund for developing states. Thank you very much.

Thank you very much, Peru. United States, please.

Thank you, Chair. Good afternoon, colleagues. On international law, in paragraph 9a of the international law section, the text should distinguish between areas of existing international law that states could consider discussing in this group and the conclusions some states may at some point draw from those discussions. The clause, quote, “whether gaps in common understandings exist on how international law applies as well as the possibility of additional legally binding obligations,” unquote, in the second sentence of the paragraph should be deleted. Through our discussions of the topics in this paragraph, the OEWG should instead seek to identify areas of convergence and consensus. In paragraph 9c, we are concerned about the second sentence. We do not understand what the sentence is attempting to capture. After, quote, “inter alia,” unquote, we do not believe it’s appropriate to refer to developing a, quote, “common understanding of criteria for unlawful ICT activities by different states,” unquote. Existing international law already provides for such criteria. For example, the law of state responsibility. If this is meant to refer to domestic law provisions, then that is outside the scope of the OEWG. In addition, mutual legal assistance mechanisms address law enforcement matters, also not within the scope of the First Committee, and are different than the international law issues addressed in the OEWG. So we recommend deleting the second sentence of paragraph 9c. In the next steps section, paragraph 4, the Secretariat is charged with a new responsibility to produce a substantive report on gaps in capacities in international law. Where did this come from? What exactly is this proposing? How are states’ inputs to be solicited? Is this different from the national reports to the Secretary-General called for in 7619? Does the Secretariat have the capability to not only collate states’ views but also to produce a substantive report on this subject matter on behalf of all member states? We are not convinced that this is a feasible proposal. Instead, if there’s interest in this topic, perhaps the annual report could call for a dedicated session on the issue at the next meeting of the OEWG. On CBMs, as we have suggested for other sections, the CBM section should refer specifically to implementing the CBMs already proposed and adopted at UNGA via its consensus endorsement of the GGE and OEWG reports. The CBM section should also clearly acknowledge the existence of robust regional cyber CBMs programs, some of which have been operational for more than a decade. The current draft is silent on these programs, which is very problematic to us. Regarding the proposal for a UN-level POC directory raised in paragraph 1a, it’s hard to see the potential value for such a mechanism in an operational context within the United Nations. The UN does not have the expertise or capability to manage such a mechanism. How would it accomplish it? This proposal would seem to have quite significant permanent budgetary implications, and its attributes warrant further discussion. At the same time, many regional organizations already have well-developed POC directories that have been around for years. How would this mechanism leverage and not undermine that existing body of work? Suggesting that a UN entity be politically neutral seems strange. The UN itself is a political body. The POCs may include policy context. How would that be neutral? That phrase should be deleted. Also, we don’t understand the statement that a voluntary directory would respect state sovereignty. What is the risk that statement is trying to address? We would welcome prioritized discussions on POCs designed to cover and be inclusive of those states that are not currently members of existing multilateral organizations that are involved with CBMs. That is a very valid activity. We believe that is the appropriate way forward and think it’s premature to have language in this report that could be read as establishing a mechanism without prior discussions. In paragraph 10b, we have a few language suggestions. Rather than ICT capabilities, perhaps the text can say policies related to the use of ICT capabilities, as that is what we believe was intended with that suggestion. Rather than national lists of critical infrastructure, which could be read as suggesting we share site-specific lists, which might be national security sensitive, we should call for lists of critical infrastructure sectors, which is something the international community has encouraged in other venues. In paragraph 10c, while we could support a statement that CBMs implementation could involve stakeholder engagement, we do not view the list after inter alia as particularly relevant, nor do we understand the call for private sector points of contact in this context. We suggest deleting the text after academia. In paragraph 10e, we do not support the development of a common glossary. This has been repeated for close to 20 years. It is not a practical proposal. As others have commented, we do not have a national glossary within the U.S. government. Within the U.S. government, we have multiple depending upon which department or agency you happen to be a member of. Use of ICTs for the economic development of states is not within the mandate of this group and should be deleted from paragraph 10e. We propose deleting the first part of paragraph 2 of the next steps section on establishing the directory and instead focus this recommendation on a prioritized discussion of a global POC directory at the next session of the OEWG. Given the concerns we have raised, it is premature for this annual report to establish such a mechanism. Paragraph 3 of the next steps section raises the same concerns we have had in other sections about a new burden being placed on the Secretariat. Paragraph 5 of the next steps section appears to be adding yet another burden with a very similar scope. The Secretariat appears to be charged with new responsibilities to produce substantive reports on the operationalization of the POCs directory and technical guidelines for information sharing. We have no idea what exactly these are proposing. How are states’ inputs to be solicited? Are these different from national reports to the SG called for in 7619? Does the Secretariat have the capability to collate states’ views? Again, we are not convinced that this proposal is feasible either. We think these kinds of issues can be best addressed in a dedicated session on the POCs directory concept if that is considered appropriate and desirable. On capacity building, we do appreciate the Chair’s desire to be forward-leaning and action-oriented, but the capacity building section raises a number of issues for us. We believe we can set a productive path forward on a topic that is important to all of us with some substantive edits that first allow for further discussions on capacity building proposals and second, avoid unnecessary duplication of existing regional and global coordination of capacity building efforts. Fundamentally, we view the OEWG’s role in capacity building as relatively focused. The OEWG’s scope is to consider the issue of ICT security in the context of international security. It is not a forum to address all cybersecurity issues, nor is it an operational entity. So in the area of capacity building, the OEWG should focus on articulating how capacity building can enable more states to implement and adhere to their commitments to the framework of responsible state behavior that has been politically affirmed by all member states. While the rest of the updated draft includes the scoping language in the context of international security, the capacity building section does not. It is essential that such scoping is reflected here, particularly as we discuss the OEWG’s role in the broader cyber capacity building landscape. Rather than recommending the creation of new capacity building mechanisms, focal points, trust funds, etc., the OEWG should first prioritize discussing the merits of these proposals in the context of this group. These proposals were not raised in prior OEWG sessions, and we therefore cannot agree before discussion. It is not appropriate for such undeveloped concepts to be included in a report without adequate discussion among member states, particularly when they involve creating new UN bureaucratic entities with potential budgetary implications of unknown proportions. We are not convinced that these new mechanisms and authorities are necessary as a general matter or appropriate for the OEWG. If some member states see value in these proposals, we’re willing to discuss them. In that spirit, as we reflect on the proposals, it’s only prudent that the group acknowledge the wide range of existing programs, both within and outside the UN, that can already help states uphold their commitments to the framework. For example, the World Bank now has a cybersecurity multi-donor trust fund. As recognized throughout the report, regional organizations play a huge and protective role in facilitating and coordinating capacity building efforts. Moreover, UN entities such as the ITU and UNDP are already involved in aspects of cyber capacity building and plug into the global community through leading forums, such as the Global Forum on Cyber Expertise. It’s more productive we discuss how existing efforts can be leveraged and avoid the creation of new mechanisms that risk duplication in an already crowded space. The text in these paragraphs puts the cart before the horse. As such, we recommend the following. Paragraph 11d and paragraph 2 of the next steps section should be revised to encourage member states to use the OEWG itself to exchange views and ideas related to capacity building in the area of ICT security in the context of international security. Suggestions for new permanent mechanisms should be deleted. Text referencing in the context of international security should be added. The second sentence of paragraph 11e on a new trust fund should be deleted. A reference to the World Bank cybersecurity multi-donor trust fund should be added. Paragraph 4 of the next steps section on a new UN focal point should be deleted. We are not convinced that the OEWG website should be used as a capacity building information sharing platform as suggested by paragraph 7a. Other purpose-built platforms like the CIBL portal and the UNIDIR portal already exist and are open to all. If this proposal is retained, the scope should be clearly identified as in the context of international security. In short, given the interest on the topic, we suggest dedicated discussions on capacity building at the next OEWG meeting. Thank you, Chair.

Thank you, United States, for your statement. I now give the floor to Israel.

Good afternoon. Thank you, Mr. Chair, for giving us the floor. At this point, we wish to share our concrete positions and suggestions on the remaining sections of the revised Zero Draft Report. On Section C, Rules, Norms, and Principles for Responsible State Behavior, referring to paragraph 8b, we wish to join the U.S. Delegation’s position as well as others and say that Israel believes that a more cautious approach is warranted with respect to norms. As things currently stand, there is a lack of certainty as to the manner in which existing norms are being implemented and interpreted. The 2015 GGE norms are voluntary and non-binding and do not detract from or extend beyond international law. They are meant to signal expectations of the international community regarding appropriate state behavior. And from what we have seen thus far, their implementation has been, at best, uneven. Before embarking on a project of developing new norms, it would be more appropriate, in Israel’s view, to focus on those norms that currently exist, to assess whether and how they are being understood and applied, ensuring that there exists a common language when referring to these norms. Once this is done, we as a community can begin to consider if there is a need to clarify, enhance, or even to reconsider the original norms, only when we can assess whether there exists a need for additional norms. Moreover, the way in which this paragraph is articulated implies that the need for additional norms is a stated fact accepted by all states, despite the fact that it has been suggested only by some of them. We therefore suggest omitting this paragraph altogether. As for paragraph 8c, we wish to echo other delegations that have raised some questions for having this issue mentioned here. We are not opposing the suggestions themselves, but we don’t believe they belong to the rules norms section and should be moved to the CBMs or capacity building sections of the report. Mr. Chair, on Section D on international law, Israel welcomes the statements made by governments across the world presenting their views on the application of international law to the fields of ICT. This contributes to our mutual understanding and creates a positive starting point for discussions. We think that the current approach of encouraging states to submit their views on a voluntary basis is the most appropriate course of action for the open-ended working group to take. Going forward, we would welcome intersessional discussions in which academics and experts could be heard to provide different perspectives on some of those issues. This will assist states in formulating their positions going forward. Given that many states have already presented their views on topics such as non-intervention, proportionality, distinction, and human rights, and there is already much academic writing on these issues, we suggest that the use of the open-ended working group’s time could be best used after we have identified specific topics that could benefit from additional input of outside experts. We do not think it’s appropriate or necessary to mention any particular body or set of experts at this stage. This can be determined based on needs and relevant expertise. Furthermore, we have strong reservations regarding the reference in paragraph 9a in the phrase “additional legally binding obligations.” In Israel’s view, current international law provides the normative framework for the discussion, and the focus should be on understanding how the current framework applies rather than on creating new rules. Therefore, we suggest changing the paragraph as follows: A. The open-ended working group could convene discussions on specific topics related to international law. This may include briefings from academics and experts to provide their perspectives on this subject. A non-exhaustive list of topics proposed by states for further discussion under international law can be determined, taking into account that states have already expressed their positions on various topics of international law, and based on whether there is a need for additional discussion at this stage. Mr. Chair, as for the section on CBMs, in general, we are pleased with the way this section is crafted. We would like to emphasize, based on our experience and knowledge, the importance of creating mechanisms for information sharing in an efficient and confidential manner. Since we are dealing with sensitive information, we can suggest looking into tried and tested methods like the traffic light protocols or emulating the cybernet infrasharing system we use in our national frameworks on the global arena. In addition, we wish, as a member of the cross-regional group on CBMs, to express our satisfaction that many of the group’s practical suggestions were taken up by the Chair and were incorporated into the text of the Zero Draft Report and its revised version. Thank you, Mr. Chair, and we will be submitting to the Secretariat our suggestions for language, also in a written format.

Thank you, Israel. Romania, to be followed by Cuba. Romania, please.

Thank you, Mr. Chair. While Romania aligns itself with the statements delivered by the European Union and with the statement of the Czech Republic on the subject of multistakeholders, allow me to make some further remarks in my national capacity. Romania welcomes the proposal to adopt an annual progress report of the second Open-Ended Working Group on developments in the field of information and telecommunications in the context of international security, and we commend you, Mr. Chair, and your team’s effort for drafting the report and for endeavoring to reach consensus and set a roadmap for the next discussions in this process. Since the beginning of the work of this group, the cyber threat landscape has changed dramatically, and the report should note this evolution, as well as the difficulties that arose in the work of the group in the first year, including in agreeing on the modalities. In this sense, we align ourselves with the remarks from statements delivered by the European Union, the US, the Netherlands, the Czech Republic, Poland, Germany, and other countries, New Zealand, Ireland, Croatia, Italy, and Estonia today, in noting the unjustified and unprovoked Russian aggression against Ukraine and support the proposals to reflect the new challenges in the threat section and their impact on the security environment. Not only did we see a hardening of the OEWG process itself, but we have witnessed the use of cyber attacks in the context of an armed conflict. And as a neighboring country to Ukraine, we note concerning risks regarding collateral effects of cyber operations, potential cross-border spillover effects, increased and indiscriminate attacks by politically motivated hacker groups on governmental and private ICT infrastructure. Now more than ever, we need to adhere to the framework of responsible state behavior in cyberspace and contribute to its security and stability. We welcome the focus on practical proposals in the report and the efforts by the chair and his team to balance the content. However, clear delimitation should be given when reflecting the advancements of the group on consensual issues and the identified commonalities, while proper wording should mark the proposals made only by some states. With regards to the previous work, as a participating state to the 2021 UNGGE and in the final negotiations of the first OEWG, we underlined the importance of preserving the acquis by properly referencing the previous UN work in this field as a basis for the current OEWG. In this respect, we see it appropriate to better underline the importance of the UN framework for responsible state behavior in cyberspace. We support in this sense previous proposals made yesterday by the Netherlands, Australia, and other countries. We would like to reiterate Romania’s strong opinion that existing international law equally applies to cyberspace and that there is no need to develop international legal frameworks to distinctively address cyberspace. As such, we believe that international humanitarian law applies in the context of cyber operations carried out as part of an armed conflict, and we underline the need to specifically mention IHL in the report, noting that this mention should not be misunderstood as legitimizing the use of force between states in this domain. We welcome the presence of principles of international humanitarian law in this revised draft of the report. In reference to the regular institutional dialogue, the wording used in the report regarding the Program of Action should not in any way imply that the Program of Action should be created or defined by the OEWG, and the recommendation from the 2019-2021 OEWG should be kept as such. In this respect, the need to avoid duplication of efforts, including with other organizations, should be noted and further discussions on the subject should be welcomed. I thank you very much, Mr. Chair.

Thank you. Romania. Cuba, to be followed by Iraq. Cuba, please.

Thank you, Mr. Chairman. In line with your request, I will go straight to our remarks. In our view, there is an exclusive prerogative of States to develop a common understanding on how international law is applied to the use of ICTs. In light of that, we do not believe it relevant to apply international humanitarian law to the use of ICTs in the context of international security. Therefore, this would imply accepting without any objection and without predicting its consequences the possibility of an armed conflict scenario in that context. This is something that would be truly dangerous. It would contribute to the militarization of cyberspace, and it would be a first step towards equating a cyber attack with a traditional armed attack in which the norms of international humanitarian law do indeed apply. We believe that there is a consensus in promoting the use of ICTs for peaceful means and for means towards development. Therefore, we should not be looking at the instruments applied specifically to war when we are looking at the use of cyberspace in this area. The digital capacity gap is all the greater in developing countries, particularly if we accept the applicability of international humanitarian law for the use of ICTs in the context of international security. Developing States’ capacities to prevent a cyber attack are not in any way comparable with those of the developed world. Against this backdrop, Mr. Chairman, we could not accept the draft annual report including references to development, to international humanitarian law. There is no consensus on its applicability to the sphere of information and communications technologies. Separately, on section F, capacity building, we are grateful for the inclusion of the proposal of establishing a fund for capacity building projects in ICTs. In this context, we stress the need to dedicate this to supporting developing countries. We believe that the open-ended working group could promote a better understanding of the needs of developing countries, bearing in mind the information submitted voluntarily by Member States. We are not in favor of the inclusion of references to the cybersecurity capacity maturity model as an initiative to be followed. This is due to the fact that we have still not had a discussion on this within the working group, and nor have we supported this. Any reference to this should refer to the future discussion of this in the group and the voluntary nature of its potential application. We stress that a permanent mechanism for the exchange of points of view on capacities in ICTs should be, in any case, multilateral under the auspices of the United Nations. Turning now to section G, regular institutional dialogue, we are in favor of language that does not discriminate against the various initiatives to be discussed or prepared by the open-ended working group. We are not in favor of prejudicing future debates that would focus solely on discussions of the proposed Program of Action. We reiterate that proposed amendments will be submitted in writing. Thank you very much, Chair.

Thank you for your statement. Cuba, Iraq, please.

Thank you, Mr. Chairman. Mr. Chairman, since this is the first time we take the floor, we’d like to thank you and extend our thanks and appreciation to both you and your team in reaching a consensus among the Member States and in the preparation of these recommendations that were made during our substantive discussions, with a view to reaching tangible, consensual results, and to agree on recommendations that we can base our discussions on when we look into every aspect of ICT security. My delegation would also like to reiterate what has already been said by Ms. Nakamitsu regarding the continued efforts and international dialogue in view of the increasing cyber challenges and the need for international efforts under the auspices of the United Nations to lay down the norms and legislations that would be complied with by all parties. We would like to stress the need to benefit from the important role of stakeholders in tackling potential threats in cyberspace and in the ICT sector in general, given their experience in this field. And we express our support to Paragraph 5 in the introduction regarding the empowerment and stronger participation by women. With regard to potential threats, there is a proposal to prepare a list of such potential threats and that special threats related to electronic terrorism should be given priority, as well as narratives of hatred. And we do agree with that proposal. In Paragraph C, regarding the responsible state behavior, there is a proposal to prepare a list of all the obligations of states, and we do agree with that proposal as well. In regard to the application of international law in the field of ICT, we believe that this topic deserves a thorough discussion with a view to making responsible behavior a mandatory issue. In conclusion, we reiterate our support to you and your efforts, and we look forward to a final report that would represent a good basis to continue the work of our open-ended working group in the current session. Thank you, Mr. Chairman. Thank you.

Thank you very much, Delegation of Iraq. I give the floor now to Fiji on behalf of the Pacific Islands Forum, to be followed by Brazil. Fiji, please.

Chair, Your Excellencies, I have the honor to speak on behalf of the Member States of the Pacific Island Forum, with presence here in New York. The Pacific Island Forum countries would like to offer our thanks to the Chair for your efforts to ensure the OEWG progresses its work in an inclusive and productive manner. We remain committed to working closely with you to make concrete progress towards our shared goal of maintaining peace, security, and stability in cyberspace. The capacity building section of this report is a high priority for Pacific Island Forum countries. We welcome the report’s recognition of the importance of effective coordination of capacity building efforts, the needs of developing states and the unique challenges they face, the role of stakeholders in cyber capacity building, and the importance of exchanging views and information on capacity building. Particular consideration should be given to the special circumstances of small island developing states in this regard. We believe the proposals listed under this section could be streamlined for simplicity. The proposals should also avoid duplication of existing efforts, and where relevant, clearly identify how they could work and be implemented in practice. Capacity building support should be appropriate and targeted and based on the country’s priorities and context. Support should also leverage existing mechanisms and frameworks, as this would make it easier for smaller states and smaller delegations to participate. Therefore, there is a need for a coordinated capacity building framework. And we would like the opportunity to further discuss and elaborate on what this framework should look like and to ensure it is in line with best practice. With this in mind, we strongly recommend that a coordinated capacity building framework adopt the capacity building principles outlined in the 2021 OEWG report, specifically paragraphs 54 to 67 in full. The report could also recognize organizations and entities that are already doing work in these areas and which are complementary to the work of the UN, such as regional organizations, GFCE, and UNIDIR. We propose the report include among its recommendations a full discussion of these proposals in a future session. Capacity building initiatives are of particular relevance to developing states, as they can facilitate their genuine participation in discussion on ICTs in the context of international security and enhance their ability to address vulnerabilities in the critical infrastructure. To have the greatest possible impact and in line with the sustainable development goals, capacity building initiatives should be nationally owned, sustainable, non-discriminatory, and politically neutral. We also recall that our leaders stated in the Boe Declaration that climate change is the number one security challenge for our region and that infrastructure must therefore be resilient. To implement these views into the text, we suggest actioning the following language change. Chair, we’d like to refer you to paragraph 11A, and the recommendation is to replace the last sentence with consensus language from the 2021 OEWG final report, specifically paragraph 21, which states, and I quote, “States concluded that threats may be experienced differently by states according to their levels of digitalization, capacity, ICT security, and resilience, infrastructure, and development.” Finally, we confirm the importance of considering gender and other disproportionately impacted groups as set out in the OEWG 2021 final report, and strongly support the inclusion of paragraph 11F. The Pacific Island Forum countries confirm our commitment to continue to work with the OEWG through an inclusive process, which respects the capacities of small countries and missions to engage. We look forward to working with you and all members through the period of this OEWG to tangibly improve global cybersecurity. Dinaka and I thank you. Chair, I’d also, with your indulgence, would like to make a short statement in my national capacity. Thank you. Chair, like our fellow member states, Fiji commends the Chair on your decisive leadership and the Secretariat in progressing this meeting. Fiji fully aligns with the Pacific Island Forum country statement and thanks you, Chair, for the revised draft report, which is of a strong and balanced nature. With regard to the introduction chapter, Fiji echoes the comments made by the Netherlands, Australia, Canada, Chile, New Zealand, and Croatia regarding the gender text and welcomes paragraph 5 with the amendment proposed by Australia on the full, equal, and meaningful participation and leadership of women, and paragraph 11F and the recommended next step 3 in the report. With regard to the international law chapter, Fiji, like other delegations, reaffirms that international law, in particular the UN Charter in its entirety, applies in cyberspace, that international humanitarian law applies in cyberspace, and that this in no way legitimizes cyber warfare or resorts to conflict in any domain. And Fiji welcomes the text that reflects this. For the capacity building chapter, Fiji reiterates that capacity building is a foundational pillar that enables the effective implementation of norms and enhancing common understandings. Fiji also strongly supports specific language in paragraph 11B for the OEWG to better understand the needs of the developing states with the aim to narrow the digital divide. We are of the view that only through a harmonized, predictable, targeted approach can we securely bridge the global digital divide and hope to turn the tide of these global cyber attacks. In that regard, Fiji strongly supports coordinated and sustainable capacity building initiatives, which are indeed a confidence building measure. Fiji welcomes the opportunity to be briefed by technical experts for the focused discussions as stipulated in the report and the dedicated trust fund for ICT capacity building projects for developing states or an alternative appropriate funding mechanism which is tailored to meet the needs of developing states. Chair, Fiji supports the intervention by Cameroon yesterday regarding the need for climate resilient infrastructure and indeed ensuring that our collective progress is safeguarded and that existing vulnerabilities in small island developing states and small states are not heightened or aggravated. Cyber threats, disasters, climate change, pandemics like COVID-19 have demonstrated one very valuable lesson, which is the bedrock of our negotiations this week, and that is time is of the essence. We must act now. Fiji remains committed to work with you, Chair, and members to ensure that we reach a consensus-based and action-oriented annual progress report by this Friday. Thank you.

Thank you, Fiji, for your statement. Brazil, to be followed by the Islamic Republic of Iran.

Thank you, Chair. On international law, we appreciate the division of the discussion into topics, not into groups. We want to participate in all the topics, and this division is crucial for building common understanding. If we keep doing just generic sessions on international law, I’m afraid we won’t get to the point of building this common understanding. In doing so, we believe that we need to increase synergy between this discussion and Sixth Committee discussions and also acknowledge the role of the International Law Commission, as your report did, your draft. One of the components of international law is international humanitarian law. Brazil supports the statement just delivered by Switzerland on behalf of a group of countries and would like to add to paragraph 9a, actually to reiterate the idea that discussing international humanitarian law is not about militarizing cyberspace. To the contrary, we would prefer cyberspace not to be used as an offensive capability, but if and when it is used, we need to have some boundaries, and this is what international humanitarian law is about. It applies in the context of armed conflicts. We agree that international humanitarian law is broader than its principles, and also we believe that ICRC does not need to be necessarily mentioned in the report to be acknowledged for what it is, which is a relevant actor. This group remains intergovernmental, but we believe that briefings with experts, and particularly an expert organization that has a standing invitation to participate as an observer in the work of the GA, are welcome. On CBMs, we think we need to start with implementing the current CBMs and also the implementations of the previous reports. We subscribe to the proposals and the joint paper by a cross-regional group of countries, and we would like to attribute priority for agreeing at this stage to the focal point chair. We believe that this topic has been discussed for a while now. It is a low-hanging fruit. It is a constructive proposal, has the support of most member states, and it’s time for us to have a concrete deliverable in this group, and we believe this is the proper deliverable to move forward with this year. Differently from the proposals on capacity building that I will comment on in a second, we believe that the focal point has sufficient critical mass, and for a developing country like my own, we appreciate the engagement on CBMs at the regional level, but we also don’t necessarily have proper bilateral contacts on cyber matters with every other country. So regional organizations have a limit on what they can provide to us when we need to discuss topics quickly across the globe, and the UN is the organization to provide this quick contact with our counterparts that we may not have through regional CBMs and also through bilateral channels. So we believe this has great and immediate value. Institutional design is important. My own country has a lot of questions on how communications would work, what would be the job description, but we think that this can be refined after we decide on moving forward with the focal point directory. On capacity building, we support South Africa’s request to mention the principles of paragraph 56 of the final report of the first OEWG. We spoke about this in the last session, and we continue to encourage providers of capacity building to contextualize their efforts in the national and regional realities of the receiving countries. We think capacity building should not be used as geopolitical tools, and this is particularly crucial on capacity building in international law. Countries have different legal systems and traditions and perspectives on how it applies to cyberspace, and one cannot expect all of us to align to some perspectives, particularly considering topics that we may not necessarily agree with all the time, such as the use of force at the international level. So providers of capacity building in international law have the additional responsibility to reflect properly this diversity of views and also to give space for receiving countries to build their own assessments. One point is capacity building on what? This group must discuss capacity building on its mandate, which is international security. At its core, there are the norms of responsible behavior. So we agree with the notion that capacity building here is not about all things digital and not even on all things cyber. Capacity building for this group is about building the institutional strength necessary to enable responsible behavior as per consolidated in the norms. Of course, many countries don’t even have a CERT. So we need to be mindful that this, depending on the context, will require additional support for developing countries to build basic capabilities without which we can’t discuss the implementation of norms. But we also need to keep in mind what we are doing this work for, which is moving forward with preventing the military use of cyberspace. We support the mentioning of 11B of the digital divide that was just also repeated by Fiji. We appreciate this, Chair, because for a developing country, cyber capacity building will always happen in the context of our own challenges of digital transformation. So we cannot lose this. The group needs to be mindful of this backdrop, but it’s not the task of the group to solve the digital divide itself. But we need to have this as a contextual approach. In 11B and recommendation 5, we believe that we should refer to the cybersecurity capacity maturity model as one of the possible assessments that can be used. So the proposal would be to say assessments such as the cybersecurity capacity maturity model. Our country performed this assessment. It’s very useful. We are very grateful for this tool, which is one among other tools that we can use and also create. We expect developing countries themselves, as they build capacities, should be able also to develop their own assessments. And this is different from the survey on implementation because the maturity model assesses and also proposes recommendations. And the survey on implementation is more like a picture of the state of implementation. So we don’t think that they are at the same level as an instrument. In 11C, we appreciate coordination and synergy. We are concerned to share with many surveys, questionnaires, and websites. So we think this should be integrated, not to become a burden, particularly to smaller countries, to keep doing reporting instead of applying their own policies. But of course, in doing this synergy, we need to take an approach that is informed by what we already have. And the cyber policy portal is an example. We need to avoid building new platforms that can have decreasing participation and lose value. So platforms should be user-friendly and useful for countries. Otherwise, they will not have value, and the credibility of the exercise will be undermined. And we take note of India’s proposal in this regard. And finally, on the role of the UN, we think that the UN has a role in capacity building. We would not like to understate this role, saying that the UN has no role. This is not true. We appreciate multilateral solutions because of their legitimacy. But we don’t want also to overstate its role, saying the UN is the epicenter that will monitor gaps and needs across the globe, because this is not consistent with the reality of capacity building, which is mostly bilateral and regional. So our proposal would be to rephrase 11D and to delete recommendations 4 and 7 in order to consolidate the notion that we need to keep discussing how—let me rephrase—we need states to continue considering how to strengthen capacity building for cybersecurity, a collaborative effort to which the UN contributes in dialogue with other stakeholders. So we would prefer a broader mandate that allows this group to keep considering this subject without already establishing a focal point. Therefore, we don’t see the need for recommendations 4 and 7 at this stage. Thank you, Chair.

Thank you, Brazil, for your statement. Islamic Republic of Iran, to be followed by Netherlands.

Thank you so much, Mr. Chairman, for giving me the floor. I have already covered the norms; therefore, I start our proposal regarding international law. We have already suggested that the phrase “concrete and action-oriented proposals” also applies in this regard in the part of international law to paragraph 9. In paragraph 9(a), we welcome the reference to the International Law Commission. We believe that OEWG could benefit from the expertise of this commission, which is responsible for helping develop and codify international law. We welcome the non-exhaustive list of topics proposed in paragraph 9(a) for further discussion on international law, especially the reference to the possibility of additional legally binding obligations. We also believe that the following topics, which have been proposed by some states during the first and second substantive sessions, could also include non-aggression, the prohibition of the threat of use of force in any manner inconsistent with the purposes of the United Nations, territorial sovereignty and national jurisdiction of states, responsibility of private sectors and platforms with extraterritorial impact, and ICT domain as a common heritage of mankind. In this part of 9(a), we also prefer to delete any specific reference to due diligence. Exchanges of best practices on international law are premature at this stage, and therefore we propose to delete it in paragraph 9(c). Regarding the recommended next steps for international law, my delegation welcomes the recommended next step on international law and would like to propose only a minor amendment in the last line of paragraph 2 to replace “briefings from experts” with “briefings from relevant bodies within the United Nations, such as the International Law Commission.” On the confidence-building measures section of the annual progress report, Mr. Chairman, what we have already suggested regarding the phrases “action-oriented” and “concrete” also applies in paragraph 10 in this section. In paragraph 10(a), we are of the view that since there is no urgency at the policy level of ICT, providing points of contact at the diplomatic and technical levels may be sufficient, and therefore there is no need to refer to POCs at the policy level in this paragraph. In paragraph 10(c), respecting national system mechanisms and priorities should be ensured in any engagement with stakeholders on aspects of confidence-building measures. We also believe that only those stakeholders can engage on capacity-building aspects whose accreditation has already been approved by states and on a non-objection basis according to the agreed modalities. Regarding the points of contact in the private sector, which have been mentioned in the last part of subparagraph 10(c), it could be established separately and not within the same POCs of states. The list of new CBMs in paragraph 10(e) could be extended to include issues such as guaranteeing equal rights and responsibilities of states in internet governance and establishing relevant transparent multilateral mechanisms and corporate social responsibility and accountability of private sectors and platforms with extraterritorial impact. In the same paragraph 10(e), we suggest using “development of a glossary of basic terms” instead of “development of common understanding on a glossary of basic terms.” As my delegation stated in subparagraph 8(c), the same coordinated disclosure of vulnerabilities needs more clarification. Regarding the recommended next step for capacity building, in paragraph 1, we prefer to use the same language from the mandate of the OEWG in UN GA resolution 75/240. In paragraph 3, instead of requesting the UN Secretary to collate best practices on the operationalization of POCs and produce a report with options for the operationalization of such a directory, we propose to request the Secretary to compile them and produce a report about those best practices for consideration at the fourth session of the OEWG. Also, in paragraph 5, we prefer to request the UN Secretary to compile instead of collate all submitted information for discussion at the fourth session. We welcome the idea of convening an intersessional meeting in paragraph 6, but this meeting should discuss all topics listed in paragraph 10(e) above and should not be limited to those four topics which are currently listed in this paragraph. Different statuses of states and stakeholders need to be respected and reflected in paragraph 6. Therefore, we propose to modify the first line of this paragraph as follows: “The OEWG chair is requested to convene an intersessional meeting with the states and with the participation of, as appropriate, interested, accredited stakeholders.” We welcome the voluntary sharing of relevant information and lessons by states, but according to paragraph 50 of the 2021 OEWG report, this could not be limited to what is currently listed in paragraph 7. Also, states could voluntarily share that information and lessons in their chosen format and fora, which the UNIDIR Cyber Policy Portal could be one of them. Mr. Chairman, on capacity building, I beg your indulgence as you have ordered to follow all the items. I have to continue on the capacity-building section. What we have already suggested on the phrase “concrete and action-oriented” also applies to paragraph 11. Due to the fact that OEWG is a negotiation process, it cannot take any implementation role as such further in capacity-building coordination identified in paragraph 11(c). Instead, in this regard, we propose that the OEWG use the potentials of the International Telecommunication Union (ITU), which is the United Nations Specialized Agency for Information and Communication Technologies (ICTs), to further capacity-building coordination. We are of the view that this crucial role should not be limited to encouraging coordination between online portals, consolidating and compiling a calendar of capacity-building programs, developing a list of regional and sub-regional centers for excellence in ICTs, but it also should include encouraging and facilitating fair and non-discriminatory access of all states to ICT-related products, services, equipment, networks, science, and technologies. There is also a need to guarantee that the states and companies refrain from measures hindering the states’ access to the benefits of ICTs. We welcome the idea of establishing a permanent mechanism of capacity building for ICTs in paragraph 11(d), but this important mechanism, which is fundamental to enabling developing countries in the ICT domain, should not be just for exchanging views and ideas related to capacity building in ICTs. It should also include cybersecurity training, education, transfer of technology, technical assistance, and financial support, and should be established within the UN to be inclusive and comprehensive. We suggest some minor adjustments to paragraph 11(g) in order to reflect that any coordination and cooperation with stakeholders within the OEWG could be done with those which have been accredited by states according to the agreed modalities and without prejudice to the corporate social responsibility and accountability of stakeholders. On the recommended next step of capacity building, like previous sections, on recommended next steps, we prefer to use the agreed language of the mandate of the OEWG in UN GA resolution 75/240 in paragraph 1. In subparagraph 2, item (a), we are of the view that funding of ICT capacity building should not be done only through potential coordination and integration with larger development programs and multi-donor trust funds, but this important task needs to be dedicated to a trust fund. In line item (b) of this paragraph, as we explained in paragraph 11(d) above, the proposed permanent mechanism for capacity building for ICT could not be limited to exchanging views and ideas. It should include cybersecurity training and education, transfer of technology, technical assistance, and financial support, which are fundamental to enabling developing countries in the ICT domain. Also, the permanent mechanism for capacity building must be established within the UN to be inclusive and comprehensive. Experts could be invited to make presentations on those topics, but it should be done on a non-objection basis. In paragraph 7, instead of inviting interested stakeholders to submit their offers in support of international capacity-building efforts, we prefer to invite them to submit their offers in support of the permanent mechanism for capacity building in ICT and the dedicated trust fund for ICT capacity-building projects proposed in paragraph 7(d) and 7(e), respectively. Those offers could be extended to include technical assistance and technology transfer in addition to information, data, experience, and training. We also prefer that those offers be compiled by the UN Secretary. Mr. Chairman, on regular institutional dialogue, I beg your indulgence on this area. Our suggestion about the phrase “concrete and action-oriented proposal” also applies to paragraph 12 of the annual progress report. We propose an additional subparagraph in this section to reaffirm that future regular institutional dialogue should not duplicate existing UN mandates, efforts, and activities focusing on the digital dimensions of other issues. In subparagraph 12(a), it should be highlighted that the OEWG will remain the only negotiating mechanism within the UN on the security of and in the use of ICTs. We are not comfortable saying that each OEWG session should build incrementally on the previous one because we think it could modify the mandate of the group, which is not acceptable. Instead, we propose to say that acknowledging “nothing is agreed until everything is agreed,” each OEWG session should build on the previous one to reach a final report on the result of its work to the GA at the 80th session. The recommended next step in this regard is that our suggestion about using the agreed language of the mandate of the OEWG in the UN resolution 75/240 also applies to paragraph 1. In order to reflect the agreed recommendations of the 2021 OEWG report, the current OEWG should recommend in paragraph 2 that states engage in focused discussion on the elaboration of the future format for regular institutional dialogue, building upon the variety of proposals made for advancing responsible state behavior and ICTs, including through a voluntary Program of Action. States should also engage in focused discussion at the fourth and fifth sessions of the OEWG on the scope, content, and timeframe for the establishment of the Program of Action. I thank you, Mr. Chairman.

Thank you, Iran. Kenya, to be followed by Kazakhstan. Kenya, please.

Thank you, Chair. On rules, norms, and principles of responsible states’ behavior, as per paragraph 8D of the Annual Progress Report, Kenya recognizes the initiatives by states and regional groups in conducting norm implementation checklist workshops, for example, the just concluded workshop led by Singapore. On our part, Kenya, in partnership with the ICT for Peace and UNODA, has conducted capacity building workshops on cyber security policy and diplomacy for the East Africa community countries both here in New York and in Nairobi. Kenya encourages the continuation of such efforts by states and regional groups in promoting responsible state behavior. In addition, we propose the setting up of OEWG workgroups to share best practices, especially on how the existing rules, norms, and principles can be contextualized and translated to national policies as a means to facilitate the implementation of the agreed normative framework. On international law, Chair, Kenya affirms the importance of the recommendation in paragraph 9A for a common understanding of the applicability of international law as reflected in the current draft report. In particular, we would like to emphasize recognition of state efforts to establish national legal mechanisms in the area of cyber security in alignment with the UN Charter and other agreed mechanisms. Kenya further supports the observations contained in the draft annual progress report on paragraph 9C on capacity building in regard to international law. What is critical is to have concrete recommendations on how to foster common interpretation of the law and sharing of good practices on how the provisions of the law apply in the use of ICT in complementarity with states’ national legal frameworks. On confidence building measures, Chair, on paragraph 10C, Kenya notes that it is important for confidence building measures to be inclusive of all relevant stakeholders involved in cyberspace in relation to sharing best practices and what has been working in the area of confidence building. We believe that CBMs, including with social media companies, can facilitate collaboration between states and stakeholders on strategies and policies in cyberspace, which will enable solving some of the challenges encountered in cyberspace. Kenya recommends the addition of the word “shared” in paragraph 10A to read “shared global intergovernmental directory.” On capacity building, Kenya appreciates the continued consensus around this thematic theme. We particularly note the zero draft report’s recognition of the need to have focused discussions on the gender dimensions of ICT security and the sharing of best practices on how to action this in ICT-related projects. This is a valuable recommendation, particularly when operationalized in line with national priorities. As previously mentioned, Kenya also adds enhanced capacity building in the area of ensuring the safety of children and vulnerable groups, including visually, mentally, and physically impaired persons online. Kenya further reaffirms that states, on a voluntary basis, should ensure their capacity needs, including through the national survey of implementation and/or cyber security capacity maturity model. This, we believe, will contribute to a better understanding of developing states and identify what is needed to narrow the persistent digital divide and lead to more effective and meaningful coordination in capacity building. We would like to underscore that capacity building needs to focus on enhanced partnerships that leverage local capacity, i.e., peer-to-peer capacity building. Emphasis should also be on cooperation among or between states, including South-South and triangular cooperation, and in recognition that states are at different levels of implementing and domesticating the existing norms, rules, and principles in the area of ICT. On regular institutional dialogue, Kenya appreciates the recommendations in the revised draft report. Kenya further notes that public-private sector partnerships, sub-regional and regional bodies are also critical in the creation of awareness and a common understanding through regular institutional dialogues. I thank you, Chair.

Thank you, Kenya. Kazakhstan to be followed by the Russian Federation. Kazakhstan, please.

Chair, thank you for the opportunity to speak. I would also like to thank you for your efforts in preparing the document we are currently working on. We would like to briefly touch on Chapter E, Confidence-Building Measures. Kazakhstan generally supports the initiative to create a global register of contact persons on ICT issues under the auspices of the UN at the level of foreign policy, authorized technical department for operational interaction indicated in Paragraph E of Chapter A CBM. Also, Kazakhstan considers it important to exchange information on the adopted strategies and the documents in the field of cyber security. For its part, we are ready to provide the adopted legislative acts and the concepts in the field of cyber security indicated in Paragraph B of Chapter E, Confidence-Building Measures. In turn, Kazakhstan intends to send information to the UN about the efforts being made at the national level to strengthen information security and to promote international cooperation in this area. We also generally support the proposed initiatives in Chapter D, International Law, and Chapter F, Capacity Building. Thank you.

Thank you, Kazakhstan. Russian Federation, please, to be followed by Finland. Russian Federation.

Mr. Chairman, colleagues, with regard to international law, we believe one of the most important tasks of this group is to achieve a universal understanding of how international law is applied to ICTs and ICT security by states. Most states do not share the view of the full and automatic applicability of existing international law provisions to ICT. There’s a need to adapt and gradually develop international law, taking into account the specificity of these technologies. Priorities in terms of this work should be to form a universal and fair international law regime regulating cyberspace based on binding legal instruments. The intermediate report of the group could form a basis for future negotiations on this. At the same time, the draft before us requires further work to ensure that the interests of all states are taken on board. It’s important to focus our work, on the one hand, on how specific principles of international law are applied in the ICT area. Secondly, what gaps and lacunae exist in the existing international law and what relations among states are not regulated in this sphere. Specifically, we could discuss the practical implementation of the international legal principle of cooperation among states in the ICT sphere, and we could develop specific algorithms for points of contact whose creation is recommended in the first group’s report. Taking into account the difficulties that delegations face in agreeing on a document here at the UN and multilaterally and regionally as well, I think it’s important to also develop universal terminology in the ICT area. The change of national positions and approaches in terms of the international legal regulation of the use of ICT can and must be organized by the working group itself. We see no need to transfer this to another body outside the group, such as UNIDIR. The 2021 report states clearly that international humanitarian law is applied only in situations of armed conflicts. The international community has not reached consensus as to how to qualify malicious use of ICT and whether or not to refer to it as armed aggression. Therefore, there’s no legal grounds for applying this to ICT. In this situation, the matter should be further studied as to when and how international humanitarian law can and should apply to the use of ICTs by states, and this should be enshrined in a legally binding document. With regard to confidence-building measures, we believe that developing confidence-building measures and preventing conflicts among states would be helped by a global mechanism of interstate interaction in preventing computer-related incidents. Specifically, that would involve exchange of information on national strategies, legislation, and existing organizational structures through authorized state representatives in charge of information security. Yesterday, we submitted to the chair a practical proposal by Russia to develop a mechanism for cooperation between authorized state bodies, specifically National Computer Incident Response Teams, and a registry of points of contact should be set up. This was recommended by the first group, paragraph 51, and the GGE report of 21, paragraph 78. The registry of points of contact could include national agencies of UN member states authorized to prevent, counteract, and eliminate computer attacks and to set up bilateral and multilateral contacts in the sphere of information security. Setting up such points of contact within the UN framework could promote exchange of experience among national authorities, reducing tensions in cases where computer incidents are misapprehended or misinterpreted. Section E of the draft report specifically, in paragraph 6A, we suggest emphasizing the need for points of contact that would have the relevant competency in the countries involved. It’s not clear why ICTs are being classified as diplomatic and political. Within this muddies the waters. Points of contact should be qualified as diplomatic and technical. Exchange of information on good practices to operationalize the register of points of contact could be done within the framework of OEWG itself, not by the United Nations Institute of Disarmament Research. We proceed from the understanding that confidence-building measures are voluntary and are implemented between states. Paragraph 6 of the recommendations should highlight the need to discuss not so much confidence-building measures as specific technical aspects of information security, the integrity of supply chains, preventing malicious use of programs and technical tools of ICT, preventing malicious work, and exchange of information on existing and emerging threats. We’ll also add to this voluntary exchange not only of white papers but national legislation texts in the ICT sphere. Such exchange could also lead to an exchange of views on national legislation within OEWG. In capacity-building, it is important that the OEWG be made as pragmatic and practical as possible so that the upshot of its work should be applicable recommendations and programs of assistance. Building on the recommendations of the first group, we should further develop universal principles for capacity-building assistance. Russia attaches particular importance to this. We believe that in the OEWG, this should be highlighted as a priority subject. The group has potential – colossal potential in terms of bringing our efforts together and improving the protection of those who are the most vulnerable, and on the whole, strengthen information security on a global scale. We see the training of information security personnel as key. Russia is training such specialists from different countries around the world, and we are helping foreign students apply and enroll in such training programs in such areas as computer security information, security of ICT systems, security of information technologies in the law enforcement area. We are happy to receive applications from foreign candidates. We believe that the UN should coordinate all international efforts in terms of capacity-building. Before we talk about creating a separate mechanism for exchange of views in the capacity-building area, we should further discuss the expediency of creating such a unit. It would be more useful, more expedient, in our view, to focus on overcoming the digital divide and set up an assistance fund for that purpose. We welcome the provision highlighting such a mechanism in the draft report in Section F. Specific modalities could be developed later on. It would be of paramount significance if we are to assist countries on a fair and a depoliticized basis, particularly to developing countries that are struggling to overcome the digital gap. Capacity-building could include other interested stakeholders, such as the business community, academia, and non-governmental subjects. We should also work to develop a code of responsible conduct for companies in the cyberspace. And in addition to donor contributions by states and charitable institutions, part of the income of the ICT developers who make hundreds of billions of dollars selling sometimes the personal data of citizens, they should be also contributing and share some of their revenues to promote the development of Asia Pacific, African, and Latin American countries and protect their cybersecurity. Following the recommendations of the consensus-based report of the first OEWG, in that we should avoid duplication of ICT security work, we believe OEWG should remain a unique mechanism for this work within the United Nations framework, and this should be specifically mentioned in the draft report based on paragraph 43 of the chairman’s summary of the first OEWG. Inter-institutional dialogue should be pursued through continued work of OEWG or maybe turning it into a permanent standing mechanism. This is something that states should address at a later stage. We support the proposal in the draft report that we should discuss the scope, contents, and other elements of a Program of Action, and we hope that further work in this regard will proceed in a transparent fashion. We think it’s fair to discuss any initiatives put forward by states with a view to strengthening ICT security on an equitable basis without highlighting one or another as a priority. We note the concept of ensuring international information security, a code of conduct, global initiative for data security, finally, and the regular inter-institutional dialogue. We think it would be appropriate to continue studying exchange of experience between OEWG and regional organizations with the understanding that the United Nations is the leading body in terms of promoting ICT security. We think that this type of cooperation or interaction could be organized within the framework of regional consultations, special regional sessions attended by representatives of regional organizations. The positive experience of cooperation in this area will be shared by representatives of the Advisory Coordination Center under OEWG on the subject of computer incident responses. I don’t think such meetings should be linked to the last substantive session of the group at the end of the year, when states are focused on agreeing on the report. We would also like to comment on the statements by Switzerland, Ireland, Chile, and UK in terms of blocking applications by NGOs. States have the sovereign right to work in this area, and Russia has acted strictly in accordance with the modalities for members of the group. According to these modalities, member states of the United Nations voluntarily informed the chairman as to declined NGO applications and the reasons for it. States are not obliged to do that. This is voluntary. As the head of the Russian delegation stated yesterday, our country proceeded from the issue of appropriateness and relevancy in terms of the OEWG mandate and the need to depoliticize the process. With regard to all NGOs that we have questioned as to their appropriateness, under these criteria, Russia has enough rationale to provide. If some states continue to harbor doubts as to Russia’s motivation, please put your questions to us through diplomatic channels. In terms of ensuring the efficient work of OEWG, full-fledged participation of states and state authorities under the auspices of the United Nations is of paramount importance. Please note that noncompliance by U.S. and Switzerland in that regard would have specific objections in terms of visa denials for Russian experts who were going to attend ICT security meetings in Geneva. This is discriminatory practice, preventing state representatives from attending UN meetings under fabricated pretexts or excuses. Finally, we call on all participants in this discussion to refrain from unceremoniously accusing Russia of aggression. In any state, if it has concerns, it can always apply to the relevant Russian authorities, whether it’s questions or doubts. Other than that, some countries choose to make unfounded accusations here while they themselves are building up an aggressive, offensive cyber potential. Suffice it to recall the Lock Shield project based in Estonia under the NATO auspices. It is no secret that they’re working on aggressive use of ICT, and for the first time, they invited Ukraine to participate in a training exercise, whereas Ukraine is not a member of the alliance. Please stop distorting facts regarding the real perpetrators of malicious work in the ICT sphere. Thank you very much.

I thank the Russian Federation for its statement. I now give the floor to Finland, to be followed by Costa Rica. Finland, please.

Thank you, Chair. Finland fully aligns itself with the statements by the European Union and the statement by the Czech Republic on stakeholder participation delivered yesterday and wishes to make a few additional remarks in our national capacity. To begin with, Chair, we welcome the revised draft report and see that it provides a good start for further discussion on the first annual progress report of the OEWG. With regard to threats, Russia’s invasion of Ukraine has profoundly changed the security environment in Europe and thus affects our discussions here in the OEWG. This invasion is a grave breach of international law and a violation of the United Nations Charter and needs to be reflected in the section regarding the existing and potential threats landscape. Regarding Section C on rules, norms, and principles of responsible state behavior, like several delegations before me, we attach great importance to the annual progress report clearly reaffirming the existing acquis on international law as well as rules, norms, and principles. There should be no confusion about the repeated consensus support for the UN framework of responsible state behavior in cyberspace. It is of utmost importance not to give an impression that adhering to international legal obligations would be voluntary for states. We therefore see that paragraph 8 in the draft report should contain a clear reference to the existing norms of responsible state behavior as agreed by all UN member states. These should serve as a basis for further work and our discussions in this working group. We are also firmly of the view that the key focus and priority of the current OEWG should be given to furthering the outcome and understanding and the concrete implementation of the already existing norms of responsible state behavior. We therefore support the proposal made earlier to merge the two recommendations 2 and 3 in order to combine providing norms guidance and exchanging best practices as regards the implementation with a view to enhancing our common understanding. In this vein, we welcome working papers by interested stakeholders such as the International Committee of the Red Cross to facilitate more focused and in-depth exchange of views at this working group. This could prove instrumental in our common endeavor to advance effective implementation of rules, norms, and principles. We also welcome voluntary reporting on national implementation of rules, norms, and principles of responsible state behavior as a useful tool in our efforts to enhance transparency and common understanding. Now regarding Section D on international law, our delegation is of the view that also here the acquis must serve as the starting point for the work of this working group. Consequently, we do not see any legal gaps that will need to be filled at the moment with additional legally binding obligations. The key focus should be on further developing common understandings on how international law, including international humanitarian law, applies in the cyber context and in the use of ICTs in the context of international peace and security. In this regard, we would like to express our full support for the statement delivered by Switzerland earlier on behalf of a group of states. Moreover, convening focused discussions on specific topics related to international law would serve well our common purpose in this regard. Such discussions are being facilitated by the efforts of many states that have shared voluntarily their national views and assessments on international law in the cyber context. My delegation takes this opportunity to encourage all remaining states to share their positions and practices. Now on capacity building, the revised draft report contains several recommendations that provide, in our view, a good basis for further elaboration. As stated in Section F and Recommendation 2 of the draft report, we share the view that states need to engage in focused discussions in order to enhance coordination and integration of cyber capacity building issues with larger development programs and multi-donor trust funds. It has become increasingly clear that a coordinated effort at the global level is needed to better ensure complementarity, sustainability, and reduction of unnecessary duplications in cyber capacity building efforts in the context of international peace and security. At the same time, however, we remain yet to be convinced of the added value of creating a permanent mechanism to this end. More systematic coordination within the existing avenues would suffice, in our view, to achieve the same effect. We need to avoid creating duplication and instead focus on strengthening complementarity between existing processes and mechanisms, both on the international and regional levels. Many of the existing platforms within the United Nations system need to be better utilized to share national practices on capacity building, as well as to share lessons learned, experiences of capacity building support, and to support the mobilization of resources and pairing of available resources with the demand for capacity building assistance. In this regard, we see great value in the Program of Action as an action-oriented basis to advance coordination, sustainability, and coherence in our common capacity building efforts. There is a clear need for a further broad-based regular dialogue between relevant stakeholders in order to foster a better understanding of the opportunities and challenges related to cyber capacity building. Against this backdrop, we are supportive of the recommendation to arrange regular, multistakeholder-based discussions as part of the work program of this working group for stimulating exchanges of views on best practices and lessons learned on public-private partnerships in the cyber realm. Correspondingly, we see great merit in engaging in focused discussions on the gender dimensions of the use of ICTs and the good practices on ways and means for incorporating gender dimensions in the use of ICT in the context of peace and security. For us, it is also of utmost importance to keep the reference to narrowing the gender-divisional divide and gender parity in paragraph 5 of the report. In our view, regular, broad-based interactive dialogues as part of the agenda item of this working group provide valuable insights that could serve to achieve the overarching goals of this working group. I thank you, Chair.

Thank you, Finland, for your statement. I now give the floor to Costa Rica, to be followed by Germany. Costa Rica, please.

Thank you, Mr. Chairman. Allow me to refer to three points in the document set out. Firstly, on section C, rules, norms, and principles of responsible state behavior. Firstly, we believe in the value of the National Implementation Survey and the report of the Secretary-General as instruments to strengthen trust and help states to identify the challenges in capacity building. We also support and we call on the group to work on these initiatives, particularly those countries with less relative development in digital areas. Secondly, Costa Rica welcomes the recommendations for states to continue to share working papers and practices on the implementation of norms. We find value in paragraph 8E on the recommendations of the 2021 Chair’s Summary in order to further develop the list of proposals. We need to be sure, Chairman, that what we are discussing here is relevant also within our countries. The centers of excellence in cyber capacity and courses for technical and diplomatic cyber-related issues are fundamental in our countries. In addition to these exchanges of experts, this group might also consider supporting a parliamentary exchange where national legislators can understand how normative frameworks and international law apply to national policies to integrate them into national discussions. One of these is the reporting on vulnerabilities as is reflected in the UNGGE norm 13GJ or in how to interrelate this with the private sector. Now to turn to the section on international law, I’d like to begin by stressing that the consensus reports of the 2021 OEWG and the GGE recognized the following: that international law and, in particular, the Charter of the United Nations is applicable and essential in maintaining peace and stability and in promoting an open, secure, stable, accessible, and peaceful ICT environment. This is better reflected in paragraph 34 of the 2021 OEWG report, as I said earlier, and paragraph 69 of the GGE, as well as in paragraph 1 of the draft report that we are looking at today. In this sense, Chair, Costa Rica would like to make the following points. Firstly, we regret the deletion of the reference to the International Committee of the Red Cross in paragraph 9A. On this note, we would like to propose the addition of the phrase “entities having received a standing invitation to participate as observers in the work of the General Assembly.” That would come after the reference to the International Law Commission. Just to clarify, and if you’ll allow, I’ll read it in English. Development of common understanding on international law remains the exclusive prerogative of states. It was proposed that discussions of the open-ended working group could benefit from briefings, as appropriate, by experts from the UN, such as the International Law Commission, and now the added text, “entities having received a standing invitation to participate as observers in the work of the General Assembly,” and then the paragraph remains, “as well as interested stakeholders, including businesses, non-governmental organizations, and academia.” And this is also a resolution that has been previously adopted that we will also share with the Secretariat. Secondly, Costa Rica welcomes the explicit reference to international humanitarian law in paragraph 9A, as well as this draft progress report in light of our collective concern at the growing use of ICTs for military purposes. Costa Rica believes that we need to work more to achieve a common understanding on how and when international humanitarian law applies to the use of ICTs by states, under the understanding that such discussions by no means legitimate or encourage the use of force or armed conflict. Within its five-year mandate, Costa Rica reiterates its recommendation that the OEWG should dedicate sessions or establish subgroups to study specific issues of international law, such as, for instance, the protection of human rights in the use of information and communication technologies by states, or to establish a discussion as to when the established legal principles of international humanitarian law apply to the use of ICTs during armed conflict. We think that dedicating entire sessions to specific issues will help us a great deal in preparing sessions and also to benefit from the right experts on the various matters. Third, Costa Rica welcomes the inclusion of the UNIDIR cyber policy portal in point 9B. We believe that sharing specific national views on how international law applies in cyberspace further cements our verbal commitments while also improving mutual understanding between states. Fourth, on the involvement of private stakeholders and private sector entities in carrying out cyber defense activities in the context of recent conflicts, this raises concerns for us and also many other delegations as to whether and how the involvement of these actors is in line with international law in the way in which they do this. It might be useful to look closely at how these private sector actors are involved in cyber defense work and how international law also applies to such arrangements. Therefore, we recommend including a specific item on this matter. Fifth, turning to the importance of capacity building and exchanges with regional organizations, as we mentioned yesterday, Costa Rica would like to point to the excellent work done in the Inter-American Juridical Committee of the Organization of American States. This has already been mentioned by other GRULAC colleagues. This committee has facilitated the exchange and analysis of states’ views on international law, including international humanitarian law, involving expert briefers, and we believe that these practices could easily be repeated within our working group. Finally, Chair, I’d like to refer to the section on confidence-building measures. We welcome and are pleased to see your textual proposals for a global intergovernmental points of contact directory at the United Nations. This is clearly reflected in the text at point 10A. We also welcome the inclusion of a reference to points of contact and also relations with non-state actors. As I was saying, the creation of points of contact in the private sector, this is reflected in point 10C. Also, in the previous point, 10B, here we welcome the reference to the UNIDIR cyber policy portal. As we said previously, we believe that the portal is a vehicle or a platform that helps us as states to share information and lessons learned. It also helps us to be able to self-assess our performance in the cyber domain. Finally, we’d like to refer to point 10E on new measures for public-private partnerships. We believe that these increase the mutual understanding of cyber threats, they enhance contingency planning, they improve the legal framework, and they facilitate cybersecurity collaboration, generally speaking. Thank you very much.

Thank you very much, Costa Rica, for your statement. Germany, to be followed by Latvia, please.

Germany is fully aligned with the statement of the EU. Germany also fully supports the statement on international law delivered by Switzerland, including the concrete proposal of reintroducing the International Committee of the Red Cross as a key organization with which Member States could convene discussions on specific topics of international law. Germany further would like to suggest an amendment on the first point under recommended next steps in the international law section, which would read as follows: States continue exchanging views at the Open-Ended Working Group on how international law applies in the use of ICTs, and now, in addition, with a view to further developing common understandings based on the consensus established with regard to relevant international law topics during previous sessions. In doing so, States aim at explaining and substantiating their positions by having recourse to the established methods of interpretation of international law. As a member of the Open and Formal Cross-Regional Group to advance CBMs within the Open-Ended Working Group, Germany believes that this group should now pursue the operationalization of CBMs in a focused manner. Germany sees the current draft as a very good basis for showing a clear and action-oriented way forward by proposing the establishment of a global points of contact directory as a platform to contribute to international peace and stability in cyberspace. The idea of establishing such a points of contact directory has been advanced throughout the process of past GGEs and the last Open-Ended Working Group, and has been included in consensus reports going back to the 2013 GGE. It is our conviction that now is the right moment to implement this proposal. However, if implementation seems premature to some delegations, the report should reaffirm ongoing and action-oriented consideration of this proposal by the Open-Ended Working Group. The global directory would, for the first time, allow all UN Member States to communicate cyber matters by dedicated points of contact to build trust among States at a time of heightened tensions and instability in cyberspace. As a global directory, the points of contact network would offer the first opportunity for UN Member States, which are not members of regional mechanisms, to actively engage in exchange of information on cyber matters outside the sessions of this Open-Ended Working Group. The exact modalities of implementation still need to be worked out. The joint working paper submitted by the Informal Confidence Builders Group earlier this month provides some answers. While elaborating this proposal, it will be very instructive to consider how the positive examples from regional organizations can be leveraged and built upon for CBMs on the global level, as has also been suggested this morning by Chile and Croatia. Germany, as well as the members of the Informal Cross-Regional Group, are also dedicated to enhancing the work on operationalizing CBMs during the upcoming inter-sessional period by contributing to the organization of an inter-sessional event jointly with other interested partners, noting that such an event could be designed to also cover other action-oriented proposals on the agenda of the Open-Ended Working Group. On cyber capacity building, it is Germany’s view that we should build upon existing institutional structures and bring in the expertise of all stakeholders, including UN and other multilateral organizations, as well as civil society actors, such as the Global Forum on Cyber Expertise, when it comes to detailed coordination of activities. Germany considers the role of the Open-Ended Working Group in setting the framework for cyber capacity building and suggests elaborating on concrete proposals how this can best be achieved during the upcoming sessions of the inter-sessional period. One key aspect that Germany would like to mention is the need to step up efforts of including women professionals in cyber capacity building. This is a point that could be added to Para 11F of the recommended next steps. As cyber capacity building plays a key role for the sustainable development of States and for achieving the 17 Global Sustainable Development Goals, it is essential to build stronger linkages between the cybersecurity and the development communities. We therefore support the reference in the revised draft to better integrate ICT capacity building efforts in the 2030 agenda and would suggest adding ICT security capacity building to differentiate the specific aspect of cybersecurity from the broader digital development agenda. Germany would also like to alert you to a side event taking place at lunchtime tomorrow, where Germany and a group of partners, including UN Member States, the World Bank, the Global Forum on Cyber Expertise, the World Economic Forum, and the Cyber Peace Institute will be presenting plans to hold a global conference on cyber capacity building in early 2023 to advance the central theme of cyber resilience for development. Thank you.

Thank you, Germany, for the statement. Latvia to be followed by Denmark. Latvia, please.

Mr. Chair, that aligns itself with the statement by the European Union as well as the statement by the Czech Republic on stakeholder participation. As this is the first time my delegation takes the floor, I would like to use this opportunity to thank you, Mr. Chair, and your team for tireless efforts leading the work of the Working Group and preparing the draft annual progress report. This intervention will focus on the section on international law. Mr. Chair, Latvia underlines the need to strengthen common understanding and support for further implementation of existing international norms and rules in cyberspace, as it has been endorsed by UNGA on multiple occasions. In addition to several topics mentioned in the draft report, we would like to highlight the importance of freedom of expression as a key element of international humanitarian law. We believe the report should stress the notion that OEWG is focusing its work on understanding how international law applies to cyberspace. In this regard, we support the idea expressed in point 9b regarding potential briefing by the ILC and other bodies and would welcome a clearer focus on the issue of application of international law within such briefings. We would also like to see ICRC mentioned among the potential briefers. At the same time, we remain skeptical about notions of potential development of new additional binding obligations. We have repeatedly witnessed that the issue is not the lack of international norms, but their violation by certain actors. Russia’s unprovoked aggression against Ukraine, including in cyberspace, is among the most visible recent examples in this regard, and we condemn it in the strongest terms. Therefore, we believe that the international community, including this OEWG, should redouble its efforts in promoting adherence to established international norms, including the UN Charter. I thank you.

Thank you, that’s the end of your statement. Denmark to be followed by Senegal. Denmark, please.

Mr. Chair, thank you. Thank you for convening this session, and thank you for your tireless commitment to the OEWG process. It is a pleasure to be here, and I look forward to our discussions over the next few days. Let me start by saying that Denmark fully aligns itself with statements put forward by the European Union, as well as yesterday’s statement from the Czech Republic and Canada on multistakeholder participation. Like several other states, we once again call on Russia to stop its use of cyberattacks against Ukraine, respect international law, and adhere to the norms of responsible state behavior in cyberspace that we have agreed on in this very forum. For years, we have seen how Ukraine has served as Russia’s playground for cyberattacks, sometimes with major consequences and spillover effects that threaten the security, stability, and prosperity of our societies. This was recently seen with the attack against Viasat, which Denmark, along with many other states in this room, has attributed to Russia. It is also unfortunate, but not surprising, that Microsoft was blocked from attending this session. We have appreciated their and other private companies’ reporting on the ongoing cyber campaign against Ukraine. Mr. Chair, Denmark strongly supports the Open-Ended Working Group as a forum to share views on the threat landscape. Therefore, we would like to include more substantive language about the threats in Section B, including a specific reference to ransomware, as already suggested by several states. We are also open to the suggestion from the U.S. to include threats from emerging and disruptive technologies. Furthermore, Denmark would like to see stronger language on multistakeholders, recognizing the important role and expert knowledge of non-state actors in relevant paragraphs, including B, existing and potential threats, and C, rules, norms, and principles of responsible state behavior. We welcome the international law section and appreciate the action-oriented approach. Like several other countries, we would like to see a reference to international humanitarian law. Furthermore, and like suggested by Finland, we would like to see the report acknowledging that the Open-Ended Working Group benefits from briefings by experts, by mentioning the International Committee of the Red Cross specifically. We also find Section F on capacity building as an acceptable section, but the language on other stakeholders could be further strengthened. Thank you, Mr. Chair.

Thank you. Denmark. The floor is now for Senegal, to be followed by the Czech Republic. Senegal, please.

Thank you very much, Mr. Chairman. Let me start by taking advantage of the fact that this is the first time I speak and expressing our appreciation of your remarkable leadership of our work and pledge every support on the part of my delegation for the success of this session. My delegation welcomes and supports the recommendations contained in the draft report before us in terms of applying international law and confidence-building measures to cyberspace. That’s a good basis for further work. Regarding international law in cyberspace, we have three comments to make. First, as Switzerland emphasized this morning on behalf of the interregional group for promoting international humanitarian law in cyberspace, international humanitarian law should be applied to all cyber activities conducted in armed conflicts, applying the principles of distinction, humanity, and proportionality. But I would like the language of paragraph 9 to clearly mention the fact that international humanitarian law applies as a whole, not just through these fundamental principles. We would also like to reaffirm the fact that the use of international humanitarian law should not in any way be interpreted as legitimizing war in cyberspace. Second, with regard to the third recommendation, we support it. It invites member states to share views and positions regarding the application of international law. This would be not just a confidence-building measure, but a way to reduce misperceptions or misunderstandings among states, also a way to promote better understanding of the way international law is applied in cyberspace. In the same vein, we would like to make sure that relevant international institutions and their expertise be mentioned, such as the International Law Commission. Thirdly, we support the recommendation inviting the Secretary to prepare an information document on the needs, opportunities, and lacunae in capacities regarding international law as it applies to ICT. With regard to confidence-building measures, we have also a comment to make. It would be useful to take into account the technical difficulties faced by certain countries in setting up their points of contact and in sharing information. This has been mentioned by various instruments. With regard to other reports, it should be in ours as well. Thank you.

Thank you, Senegal. Czech Republic, to be followed by the Netherlands. Czech Republic, please.

Thank you, Mr. Chair. The Czech Republic aligns itself with the EU statement and wishes to highlight the following. Mr. Chair, the Czech Republic wishes to thank you once again for drafting such a concrete and action-oriented annual progress report. We see the adoption of the report at the end of this week as an important step on our five-year journey. Its adoption will mean that we are able to reach consensus within the group, which is the first step towards making our journey a success and will facilitate further progress. The annual report can serve as a base on which we can build further. On the part of international law and its applicability to cyberspace, we welcome the inclusion of the proposal for more in-depth discussion on selected international law topics to build common understanding and consensus that the Czech Republic repeatedly proposed. In this regard, we strongly support the working paper submitted by Canada and Switzerland, which outlines an appropriate agenda for our discussions on international law. We also welcome the support for briefings by experts as well as interested stakeholders, but recommend not to limit the scope and backgrounds of experts and interested stakeholders by listing them out in the report. We also support the initiative on sharing of national views on how international law applies in the use of ICTs and capacity building efforts on international law. The Czech Republic wishes to highlight its strong support for the inclusion in the revised draft report of a direct reference to international humanitarian law as one of the specific topics on which the OEWG could convene a discussion and that a discussion on its applicability is encouraged. To further elaborate on this, we would like to propose that future discussion is not limited to the basic principles but includes all aspects of international humanitarian law. In this regard, we would like to express our full alignment with Switzerland’s joint statement on international humanitarian law in cyberspace. Mr. Chair, distinguished delegates, colleagues, in recent months we have witnessed the increasing use of ICTs by state and non-state actors in armed conflicts, and therefore more than ever we see the need to effectively implement and comply with the existing rules and principles of IHL. The Czech Republic believes that our work on the applicability of IHL to ICT operations during armed conflicts needs to be advanced because, as we mentioned at the last OEWG in March, military cyber operations are no longer something abstract and unimaginable. Given that the GGE 2021 report confirmed the applicability of IHL in cyberspace, we should now build on it and further develop it by engaging in a discussion on IHL and its principles that will allow us to develop common understandings on how best to protect civilians and civilian objects, especially critical infrastructure, and to reach a better understanding of what activities are prohibited or unacceptable during armed conflict. This can also help deepen our understanding of the fundamental principles of proportionality, distinction, humanity, and necessity in this context. Given the number of cyber attacks against Ukraine originating from the territory of the Russian Federation, we also see a need for a deeper discussion within the OEWG on the duty of due diligence, which calls on states to take practical steps to ensure that their territory is not used for malicious cyber activities. We also share the view of our colleagues regarding the deletion of the reference to mutual legal assistance, which in our view falls under the Cyber Crime Committee. Mr. Chair, in conclusion, let me reiterate the Czech Republic’s commitment to comply with all principles and rules of international law in cyberspace, including sovereignty, due diligence, international humanitarian law, and international human rights law.

Thank you. Thank you, Czech Republic. I give the floor now to The Netherlands, to be followed by Argentina. Netherlands, please.

Thank you, Chair. In my intervention, I will address the remaining sections. First of all, we align ourselves with a text proposal in the threat section by Australia on behalf of a group of countries, including the Netherlands. Section 6, section C, sorry, on norms. We believe on paragraph 8a, it could potentially be useful to exchange understandings of technical ICT terms. However, since technical ICT terms are subject to specific contexts of each state or region, it may not be a fruitful exercise to attempt to have common understandings. We therefore propose that states could share national understandings of ICT terms for the purpose of transparency. So the end of 8a would read then, “as well as sharing national understandings of technical ICT terms for the purpose of transparency.” We would like to propose to make the same edit to the reference to the technical ICT terms in recommendation 2 of this section. The Netherlands welcomes the reference to the further guidance on norms implementation, as mentioned in the draft annual progress report in section C, paragraph 8a. However, as a logical first step, the recommendations with regards to rules, norms, and principles of responsible state behavior should begin with a clear recommendation for states to implement the existing norms, endorsed by consensus, while taking into account the additional guidance on norms developed by the 2021 GGE and endorsed by the General Assembly. So in section C, under recommended next steps, we suggest as a new first paragraph, “States continue the implementation of the voluntary non-binding norms of responsible state behavior in the use of ICTs in accordance with General Assembly resolution 76/19, that calls upon states to be guided in their use of ICTs by the 2021 report of the open-ended working group and the 2021 report of the group of governmental experts.” On section D, international law, the Netherlands attaches great value to the consensus agreement that international law, in particular the UN Charter, applies to cyberspace. A lot of work has been done by previous groups to reach common understandings of how international law applies. We welcome the report’s non-exhaustive list of topics of existing international law that the open-ended working group could further discuss. There is still a long way ahead of us in further sharing national views and building common understandings around this issue. We believe that should be our aim. In response to your requests for concrete proposals, Chair, I would like to bring to your attention that we are working on a text proposal for this section, but we are waiting to hear everyone’s views first. On section E, CBMs, the Netherlands is part of an informal, open, cross-regional group to advance CBMs through the work of the open-ended working group, and we fully support the points made by Germany on this. Paragraph 10a to c, the Netherlands welcomes the inclusion of concrete suggestions in the draft annual progress report to advance CBMs, including a global POC directory, and that has been in the open-ended working group and GGE reports going back to the 2013 GGE. To avoid unnecessary burdens on member states, we encourage states to nominate to this directory POCs that have already been assigned as POCs in the context of existing regional or sub-regional frameworks where applicable. Chair, I would like to now move to section F, capacity building. We believe we need to be consistent throughout the capacity building section that we are referring to capacity building within the scope of security in the use of ICTs. On paragraph 11b, the first sentence, we would like to see the GFCE civil portal, a knowledge portal for cyber capacity building, added to the list in this paragraph. The civil portal is a very effective instrument that maps capacity building activities and which one can use to explore what is already available. Paragraph 11c, the Netherlands would furthermore like to suggest to emphasize in this paragraph the effectiveness of taking full advantage of already existing and efficient capacity building programs in mapping exercises and avoiding duplication in this way. On recommendation four of the capacity building section, that refers to a UN secretariat focal point for capacity building. The Netherlands suggests that the recommendation proposes this as part of a future discussion on capacity building, taking into account other relevant proposals and initiatives. So the concrete proposal would be, “States engage in focused discussions on the possible role of the UN secretariat in capacity building on security in the use of ICTs, taking into account the role of other stakeholders, as well as other relevant initiatives, including the POA initiative.” On recommendation seven, the Netherlands would like to see a reference in this paragraph to useful and existing platforms such as the UNIDIR civil policy portal and the GFCE civil portal. Information on these platforms should also be made available on the open-ended working group website. Section G on the regular institutional dialogue. We support the comments made by France on the Program of Action. Paragraph 12a, we would like to delete the reference to the open-ended working group being a negotiation mechanism. This is not in line with our mandate contained in resolution 75/240. Paragraph 12b, the Netherlands welcomes a concrete reference to the POA in this section of the report. We would like to see more clearly that the POA would be a mechanism to support the capacities of states in implementing commitments in their use of ICTs in the context of international security. Thank you very much, Chair.

Thank you, Netherlands, for your statement. Argentina, please, to be followed by Mexico.

Thank you very much, Mr. Chair. In yesterday’s meeting, Argentina set out its general views on the first revision of the draft report and on the process of the OEWG. In order to continue to contribute to a dynamic dialogue that would then help to foster the necessary consensus to meet the need of having a consolidated report at the end of this week, we will be brief and concise. On the international law section, we believe that the question of the application of international law in cyberspace is of crucial importance since it pertains to predictability, transparency, and international stability. It’s crucial that each state can reflect and explain how it understands that international law applies in cyberspace and how each state is applying the norms of responsible state behavior recommended by the successive reports of the GGE and adopted by consensus in the General Assembly. On paragraph 9A, Argentina will support wording that seeks to ensure that the list of topics proposed for the debate remains open. No topic should be prioritized over another, and experts’ participation should be agreed among the members of the group. In this sense, we welcome the reference to the International Law Commission. This will grant greater substance to the analysis of substantive aspects of international law. Turning now to the section on confidence-building measures for states, Argentina is a firm proponent of the adoption of transparency and confidence-building measures because these increase cooperation, predictability, and stability among states in cyberspace. In an unstable world with a gradual increase in various types of cyber incidents, any type of discussion to consolidate the expansion of measures of mutual confidence would without doubt contribute to fostering security and stability in cyberspace. Therefore, at a national and regional level, we support the development of cybersecurity policies and activities to contribute to consolidating an open, secure, stable, accessible, and peaceful environment. We support the flexible language as is proposed in paragraph 10B. This bears in mind both the challenge of maintaining confidentiality and some information that’s managed by states. This is a concept that was reflected in the first OEWG report, as well as the preference of some developing countries to work in concentric circles through regional and intra-regional mechanisms and organizations to then share their views in the multilateral world. We advocate continuing with the development of the UNIDIR cyber policy portal or continuing with the national contacts point list. These are some activities that we should continue to work on in this context. We note that enhancing the portal would contribute to promoting greater trust and transparency among states. Working on its content and linguistic accessibility would help in bringing down barriers and overcoming asymmetries. Turning now to the capacity-building section, Argentina believes that capacity building is key for developing countries, bearing in mind existing asymmetries in the international law regarding the digital capacities of states, and my country has already spoken on this. We believe there is a direct link between capacities and levels of vulnerability that in critical infrastructure and in critical information infrastructure is faced with in potential cyberspace incidents. Capacity building should help to train human resources, generate public policies, and strengthen institutions so as to prepare states to prevent or mitigate the impact of incidents caused by the malicious use of ICTs. In this context, so that capacity building can be effective, we need to bear in mind the specific characteristics of each state, and to do so, diagnostic tools are particularly important. Tools such as the national survey would contribute to directing capacity-building activities in line with the principles of transparency and neutrality. As we mentioned yesterday, we believe that regional mechanisms and organizations have much added value here because they bring together similar countries of similar capacities and perspectives. They have therefore experience in designing training tools. For instance, one example of this is the South School on Internet Governance. This aims to train young students and professionals from Latin America and the Caribbean in understanding the importance of internet governance and cybersecurity in the future of the internet and development in the region. In line with comments already made over the last few days by countries such as Mexico, Brazil, France, South Africa, Uruguay, Kenya, and others, Argentina will support language that affords greater relevance to the action and participation of regional and intra-regional organizations and mechanisms. We also support the comments of Chile, Canada, and many others. And by members of the international community in the gender perspective, we believe that this is something that is crucial. It cuts across our development agenda in our country. Therefore, we are grateful, Chair, for the inclusion of paragraph 11F. In line with what is suggested in paragraph 7 on next steps, we would like to update the international community in a timely manner and in a format agreed by the international community on the initiatives that Argentina is undertaking here. One example of this is the Gender in Technology Center. This focuses on activities and programs that foster the gender perspective in ICTs. Turning now to the institutional dialogue section, Argentina supports reports drawn up to assess the Program of Action. This aims to set out a roadmap for the work in security in the use of ICTs after 2025. The POA aspires to provide a platform and a mechanism for regular institutional dialogue on cybersecurity. It would continue in time and provide a framework for multiple processes with various levels of ambition as appropriate to the topic. It would avoid divisions, polarization, and would gear its work to the implementation of consensuses on the use of ICTs, particularly where it pertains to voluntary norms contained in the reference framework. Thank you very much.

Thank you very much, Argentina. The floor is now to Mexico, please.

Thank you very much, Chairman, and a very good afternoon to all of you. Mr. Chairman, following your guidance, Mexico will now refer to Sections D, E, and F. But before that, Chair, allow me to reiterate something obvious but necessary. We have before us an annual progress report, a draft annual progress report. It’s not the final report, nor is it a new resolution with new mandates. I’m saying this, Chair, because many very important ideas and specific initiatives have been mentioned over the last two days of hard work. However, the Mexican delegation believes that it is not necessary to exhaust in this document all of the value of these initiatives and new proposals that have been flagged over the last two days. On the section of international law, Chairman, Mexico welcomes the text here. We confirm that the starting point of this section is the reaffirmation to all states that international law is applicable to cyberspace and the progress made in prior reports, both by the GGE and the prior open-ended working group. In paragraph 9A, Chairman, we believe that it would be helpful to add when we refer to the briefings that could be provided by experts, including those even from the International Law Commission, we believe that it would be important to add the following: during intersessional work. The aim of this addition, Chair, is that this type of briefing should not only be included in formal sessions but also in the intersessional period where we also have to work hard. In paragraph 9B, Chairman, the Mexican delegation welcomes the invitation to share views on the implementation and the application of international law and the fact that this remains open. Indeed, this is in line with the invitation that we read in the last, the final report of the Group of Governmental Experts, the last one. On paragraph 9C, Chairman, the Mexican delegation believes that the paragraph should begin: for further understanding and applicability of international law, efforts on international law could be strengthened through workshops and training courses, etc. So we should emphasize that the aim of this type of initiative, course, and workshop is to progress towards better understanding of the applicability of international law in cyberspace. As has been noted by various delegations, the last part of this paragraph, C, although the delegation of Mexico is flexible on this, we would suggest re-reading it carefully when we have the specific reference to mutual legal assistance and unlawful, I should say, and unlawful ICT activities. That’s because we also have, in the process that we are undertaking as states, we have a process in the ad hoc committee of the third committee that we are also undergoing at the same time. As has already been flagged by other delegations, we believe that the specific reference to international humanitarian law is particularly important here, and we would even suggest adding here the following: …continue discussions on international law in ICT activities, including through regional efforts and other initiatives in collaboration with the International Committee of the Red Cross. Allow me very briefly, Mr. Chairman, to explain that the Mexican government, together with the International Committee of the Red Cross, recently conducted a first exercise regionally to hold a multistakeholder discussion on international humanitarian law and how that relates to cyberspace. Along the same lines, Chairman, and also based on our recent experience from the OAS, we have conducted studies, analysis, and we’ve even seen documents put forward by various international law specialists through the appropriate bodies of the OAS. So we would reiterate that it would be helpful to maintain this reference to regional organizations in paragraph 9C. Turning now to paragraph 4 of the recommended next steps, we believe that the last part of paragraph 4, which begins: the UN Secretariat is requested to collate this information submitted by states, etc. Here, we think that we could more broadly reflect this last request to the Secretariat in the capacity building section, Chairman. While it’s important to identify the needs for capacity building in international law, it is also important to identify capacity building needs on each and every one of the sections. Therefore, we suggest that this last part of the paragraph could be better included in the capacity building section. On section E, confidence-building measures, the Mexican delegation, of course, is very pleased to see the addition of a series of suggestions that Mexico and many other countries put on the table in the last substantive sessions of our group. Chairman, we would recommend including a first paragraph, that is a new A. We understand that the current A would become B, and this new A would very specifically appeal for us to include confidence-building measures, agreed confidence-building measures in prior previous reports. There has consistently been a call for the implementation of previous agreements and prior reports. That’s why we believe that it would be helpful to begin by underscoring here the need to implement confidence-building measures that have previously been agreed. In line with this, in the next paragraph, the current paragraph A, we believe it’s important to maintain the reference to the need to consolidating rather than establishing a directory of points of contact, POCs. We think, perhaps, that the second part of this same paragraph could be considered at future stages or be discussed further later on in the same document, just to make it very clear and without trying to generate any additional expectations, that as a first step in this measure, what we are suggesting is that we consolidate a directory of points of contact without determining right here and now how those would be used or how that directory would be used. In paragraph 10B, we believe that it would be helpful to include the word programs in the fourth line when we refer to white papers, national strategies, and policies. Here, we believe it’s important to add programs because very often in developing countries, there are no national strategies, there are no national policies. So, we believe that there are no national strategies or policies, but rather specific programs geared towards ensuring security in the use of ICTs. We also believe, Chairman, that in paragraph 10C, sorry, 10D, Mr. Speaker, we should change the first line which states: cooperation between CERTs could, here we should change it to say: continue to serve as a confidence-building measure. This addition of continue to is important, Chair, because there are various efforts already being undertaken at a regional and international level on the functionality of exchanges of information and contact networks between CERTs. Also, in this same paragraph, we think that it would be helpful to add after best practices on incident to add prevention before management and then after management and recovery. The idea would be including good practices not only in management but also preventing these incidents and the way in which our countries recover from such attacks or incidents. Turning now to paragraph 10E, Chairman, here we believe that it would be helpful to add after public-private on the second line to add collaborations and partnerships. The idea behind public-private partnerships is quite well developed in many contexts. However, in many countries, efforts are restricted to initial collaborations and it’s important to acknowledge those here. That’s why our country’s intention is to add collaborations and partnerships here. In this same paragraph on the last line, we believe that it would be appropriate to note that rather than considering the OEWG as a CBM in and of itself, we should rather acknowledge with the following language: the usefulness of this forum to continue to forge ahead with implementing CBMs. The specific language would be as follows: to emphasize that the open-ended working group itself serves as a forum to continue to address and implement CBMs. Turning now to the recommended next steps in this section, in paragraph 2 of the recommendations, we believe that it is important, as we’ve previously noted, that we highlight and limit the paragraph to flagging the first stage for the consolidation of the directory of points of contact. We think that this means that it would be necessary to add the word operationalization, which is currently in the fourth line. We also believe that it’s not necessary to add on a consensus basis because all of the efforts that are currently being undertaken under the auspices of the OEWG are on a consensus basis and this applies for each and every one of the initiatives that is being proposed. In this same paragraph, we think it would be helpful to add in the penultimate line after regional and sub-regional experiences. Here we would add regional, sub-regional, and other multistakeholder experiences. Moving on to paragraph 3 of recommended next steps, we’re flexible, Chairman, but we’d like to put on the table the following, that is the possibility of swapping the word report, produce a report, which is requested from the Secretariat, and we would change report for analysis. It seems that the word report refers to something that’s much more well decided and ambitious, but rather the request of the Secretariat is more for an analysis or a compendium with options rather. In paragraph 5 in this same section, Chairman, we believe that it would be very valuable and very important, as has been noted by other delegations, to group together protocols, procedures, documents, standardized templates, and to maintain an exchange of information. However, we believe that this could be, we could more than just relating it to the points of contact, this could be an additional effort, an additional directory of this type of document. This wouldn’t be exclusively related to the designation of points of contact. Rather, it would be something additional in which we could benefit from the efforts that have already been made in UNIDIR and in many other regional and stakeholder organizations. So, keeping a directory or a repository, rather, of documents that are not strictly related to the designation of points of contact. I’m now turning on to paragraph 6. We believe it’s important to add at the end.

It’s six o’clock, a little past six o’clock. The interpreters have kindly given me ten extra minutes, so I’m wondering whether you’d be in a position to maybe summarize in five minutes, and I’d like to make some announcements at the end of the meeting. My apologies. Please continue.

Don’t worry, President, I perfectly understand, and we will submit a written version of all these recommendations. Perhaps I could just summarize, subject to sending my recommendations in writing. I would like to say, Chairman, that we have heard from various countries, particularly of the African continent, and Fiji on behalf of the Pacific Islands Forum. We have heard some important ideas on the need to address connectivity and the challenges related to connectivity, as well as with natural disasters and climate change. We should look at a series of activities that could allow us to ensure greater capacity building on new CBMs. However, Chairman, I think that the great added value of these elements that have been put on the table might be that it could be part of a specific discussion in one of our forthcoming sessions, Chairman. Now, I have quite a few additional comments, Chair, and I will send those in writing. Thank you.

Thank you very much, Mexico, for your understanding, and I thank also the interpreters for giving us an extra 10 minutes. I certainly am not going to summarize today. It has been a very intense day of listening to very, very detailed and productive comments from all delegations, and I thank all of you for having come very prepared and for being very productive. I have in my speakers list 10 remaining speakers who had inscribed this morning and another 10 who have inscribed to speak this afternoon. So we are left with 20 additional speakers, and it’s my intention to close the speakers list this evening. Second, I would like to announce some changes to the program of work given that we have additional speakers, and in my view, it is really important that we allow all delegations the opportunity to express their views on the revised draft annual progress report, given that we are in the stage of a first reading. Therefore, what I intend to do is continue with the speakers list tomorrow morning at 10 a.m., and I will take all the remaining speakers, a total of 20, and we will hear them all. It’s important that we hear them all. It’s important that you hear each other as well, and given that we do not have an infinite amount of time available, it is my intention also that for the speakers tomorrow, I will limit interventions to three minutes each. So I do urge and hope that delegations tomorrow will come prepared to make their interventions as succinctly as possible and, of course, do come prepared to give me and my team and the secretariat your very detailed written proposals. Secondly, you would have noted from the program of work that tomorrow morning I had initially scheduled, or we had agreed collectively, to have a thematic discussion on capacity building. That meeting will now be shifted to Thursday. The day after, we will begin the thematic discussion on capacity building on Thursday at 10 a.m. Now, after we exhaust the speakers list tomorrow, I would also like to invite those delegations who have said that they are coordinating consensus languages on different parts of the report. I think Australia had referred to it and also the Netherlands, as I understood it. I’m not sure whether it’s the same sections or different sections. I’d like to invite these two delegations, as well as any other delegations who are engaged in a cross-regional effort to find and build consensus on specific aspects of the draft annual progress report, and I certainly would encourage any one of you engaged in an effort to build consensus. So we will hear from delegations involved in these efforts and get an update, and I would also like tomorrow morning to get very quick reactions on these proposals because I would like to have a sense, and so do other members, as to whether the results of some of these consultations do reflect consensus. If there are any reactions, adverse reactions, or negative reactions to the proposals put forward, then we know that some of the proposals, in spite of the best efforts and diligent efforts, still may require additional work, and I want to get that sense tomorrow after we’ve exhausted the speakers list. So that’s the program for tomorrow morning. Tomorrow afternoon, we will continue with the dedicated stakeholder session, which is in accordance with the agreed modalities that we adopted right at the beginning of the session. So that part of the program will remain in the afternoon. The other important point that I wish to make is that it’s my intention to make available a revised document tomorrow evening. It is important that such a revised document be made available the latest tomorrow evening in order to give time for all delegations to look through the document and, if need be, consult capitals, taking into account the fact that there are time differences that we need to understand. Therefore, in my view, a revised draft to be circulated tomorrow is very important for our subsequent work on Thursday as well as Friday. Now, I cannot at this time or at this point say precisely at what time the revised text will be available tomorrow evening, but I do intend to hear all of you in the morning, and I intend to hear all the stakeholders tomorrow afternoon as well. I’d like to hear the others as well, and then I’d like to reflect on some of the changes that will be needed. It’s very clear from the discussions that a revision is needed to bring us closer to consensus, but I’d like to do that only after I’ve heard all of you and after I’ve heard the stakeholders. So a revised text tomorrow evening—I’m not sure whether it’ll be early evening or late evening—but that is my intention to have that made available. That will give delegations overnight the opportunity to look through the text and, if need be, on Thursday morning to also look through the text and undertake individual or group consultations, bearing in mind that on Thursday morning we will have the thematic discussion on capacity building, which has now been shifted from Wednesday to Thursday. The other point that I wish to underline is that the thematic discussion on capacity building will be shortened from three hours to 90 minutes. So on Thursday, the thematic discussion will start at 10 and finish at 11:30. After the conclusion of the thematic discussion on capacity building, we will resume discussions on the revised version or the latest revised version, which will be made on Wednesday. All of Thursday, including at lunchtime and possibly in the evening, late in the evening if need be, I have scheduled the possibility of informal meetings because it is absolutely critical that we continue our discussions on Thursday in order to reach consensus and maybe do some calibration of the text in order to get us to where we need to be on Friday, which is the consensus adoption of the text. What has encouraged me today is that everyone agrees and has accepted the idea that we need an outcome at the end of the week. Everyone has accepted the fact and has welcomed and stressed the fact that we need to adopt an annual progress report. So I think a pathway to a consensus adoption of an outcome document is possible, and I will reflect very carefully on how we get there. But of course, it is not for the chair to produce a document and drop it from the top; it is a text that has to be embraced and accepted by all of you. So we are not out of the woods yet. There’s a lot of work ahead, and I want to thank you for a very productive day. The meeting is adjourned. I’ll see you tomorrow at 10 a.m.