Session 5-6 Transcript
(OEWG 2021-25)

Distinguished delegates, good afternoon to all of you. Delighted to welcome you to the dedicated stakeholder session, and we have a list of speakers for this afternoon. I’m happy to see also that quite a number of delegations are present here, and this is going to be a productive session in my view. We have a list of speakers who have signed, and as I mentioned earlier this morning, I’d really like to appeal to stakeholders to keep their statements to three minutes. I’d like to apologize to stakeholders in advance that we’ve arranged for the Secretariat of Audiovisual People to keep your microphones to three minutes. My apologies for that in advance, but it’s in the interest of getting through the list of speakers and also giving everyone time, including myself, to spend the rest of the afternoon doing some drafted work. So, with those initial comments, I want to say that I want to first of all thank the stakeholders for their active engagement in this process. We are midway in this process of the Open-Ended Working Group (OEWG), and I think the presence and participation of the stakeholder community has been a constant, and I think that is good for the process. It enriches the discussions, it brings in different points of view, and also the interaction between the stakeholder community and the delegations here contributes to enriching the level of knowledge, the level of awareness, and also different ways of looking at the same issues. So overall, I think it’s a net positive, the presence and participation of the stakeholder community. The second point I want to say is that I have been engaging with the stakeholder community through my own informal dialogue and discussions. We have had a series of discussions in July most recently and also in March of this year, where we had very focused discussions on specific topics. So today, there’s no specific agenda item for the discussion with stakeholders, but I think a key question that’s probably in the minds of many people is how the stakeholder community can contribute to the implementation of the many concrete and action-oriented proposals that have been made by states at the OEWG meetings thus far. The third point I want to say is that stakeholders would be aware that we are in the midst of finalizing the second annual progress report. Of course, if we are able to adopt a report at the end of the week, then we will have a very focused roadmap and work program for the third cycle of the Open-Ended Working Group, and that also presents opportunities for the stakeholder community to contribute their ideas as well as their resources and expertise, I should say. So these are some preliminary comments I wanted to mention. Today, we have a list of 20 speakers who have inscribed, and my hope is that at some point, not in the too distant future, we will have more than 100 stakeholders accredited to this process. That too would be a function of our own trust and confidence with each other but also with the stakeholder community. So it’s good that we have 20 stakeholders who are accredited to this process and who are able to make their contributions today, but my wish and my hope is that one day we will have more than 100 stakeholders. I think we can get there again in an incremental way. It will require the stakeholder community to also demonstrate that they can contribute. I have met many representatives of the stakeholder community; they are very passionate, they are very committed, they have a lot of ideas, they have a lot of expertise. But you also need to not just persuade me as the chair, but you need to persuade the delegations to see how you can help them, how you can help this process. So this dialogue is also a way of enhancing the interaction between stakeholders and government delegations, and hopefully over time, we will have more and more stakeholders involved in this process. So friends, without further ado, let me start with the first speaker, representative from the Arab Association for Cybersecurity, to be followed by Wright Pilot. You have the floor, please, Arab Association for Cybersecurity.

Thank you, Mr. Chair. The Arab Association for Cybersecurity, ARCS, is glad to participate in the forum session convened today. ARCS appreciates the Rev. 1 draft’s focus on short- and long-term capacity-building measures. We note, however, the need to consider the different ways in which we can engage the various stakeholders that occupy the complex ecosystem that is the ICT environment. When considering how we can engage actors in the cyberspace, we see that capacity-building is both vertical and horizontal, both related to the depth of knowledge and the scope of interactor cooperation. Considering the types of capacity-building measures and the various ways different actors in the cyberspace can be effectively engaged is necessary to operationalize both short-term and long-term CBMs and to more effectively share knowledge and best practices between collaborating actors through engaging the capacity-building needs of each actor and the ways in which it intersects. Further emphasis on national, regional, and international conferences that provide this function is vital in effectively engaging with the diverse stakeholders in the ICT environment in order to promote collaborative solutions. Allow me, Mr. Chair, to turn to Abdelaziz Elmeri. Thank you, Mr. Chair. I would like to start with a question. States socialize with other states to facilitate change behavior. Indeed, the OEWG recognizes the importance of setting a framework for international norms of responsible state behavior. The question then becomes how do we embed these norms? How do we turn ideal to practice? Of course, forums such as the OEWG serve as a great start and a solid foundation to this end. At the same time, it’s important to note that when embedding norms for responsible state behavior, each state also operates within its own regional context. Therefore, when taking into account the practical implementation of the proposals captured in the Rev. 1 draft, we would like to draw particular attention to the significance of regional-level implementation. To more effectively share knowledge and capture synergies vis-a-vis existing ICT capacity-building efforts, providing platforms for inter-regional dialogue is an essential recommended next step. The success of inter-regional conferences, such as the inter-regional conference between OSCE and Asian partners on cyber ICT security, demonstrates how tapping into the expertise of regional organizations can play an important complementary role to this end. Here, regional orgs can serve as crucial conveyor belts that can drive implementation forward. Mr. Chair, there’s much to say about the significance of regional orgs as valuable partners throughout all stages of the norm life cycle, and the potential of leveraging the expertise of such entities facilitating institutional inter-regional dialogue to embed norms of responsible state behavior to turn ideal to practice. Thank you, Mr. Chair.

Thank you very much, Arab Association for Cyber Security, for your contribution. I give the floor next to Wright Pilot, to be followed by Youth for Privacy. Wright Pilot, please.

Distinguished Chair, esteemed delegates, I would like to first thank the UK Government for enabling the participation of two fellows through the Right Pilot and the UK Gulf Women in Cybersecurity Fellowship to the Open-Ended Working Group. We welcome and support the contribution made by the Arab Association for Cybersecurity on the significance of regional-level implementation to strengthen multilateral cooperation in cybersecurity capacity building. We note that drawing on the competitive technology and knowledge advantage of diverse stakeholders is essential to building workforce capability that addresses peripheral risks on a social and economic level, both horizontally and vertically. In this context, we call for fostering global cybersecurity resilience by promoting collaboration through consortium building and the establishment of twinning programs, like those pioneered by the European Union and others, to encourage knowledge transfer, knowledge exchange, resource sharing, and R&D to address the evolving cybersecurity threat landscape effectively. Drawing on examples from my region, allow me, Mr. Chair, to highlight existing regional capacity building initiatives. In 2019, the Central Bank of Kuwait, through the Institute of Banking Studies and in cooperation with the Kuwaiti banks, launched Kafa’a, an initiative which translates into competence. It entails a comprehensive vision for capacity building amongst Kuwaiti nationals in banking, financial, and economic sectors, more recently partnering with SANS to train the workforce on both cyber range and cyber leadership. Moreover, Jordan’s Design and Development Bureau, JODDB, set up the CyberShield Cybersecurity Academy with support from its commercial partner, PGI. It then developed relationships with Al-Hussein Technical University and Yarmouk University to deliver hands-on cybersecurity training that’s regularly updated by practitioners in the field to address existing and potential threats. With 30,000 Jordanian students taking STEM subjects at degree level annually and a high unemployment rate amongst graduates, such vocational cybersecurity training programs offer both practical learning experiences and job opportunities. By design, the role of POCs may be leveraged in support of capacity building development goals. By translating the information shared on cyber threats into affordable practical training programs with learning outcomes for use, we can enable them to develop the practical skills necessary to benefit from the reported 3 million cybersecurity vacancies worldwide. Mr. Chair, we welcome the opportunity to work together to bolster a holistic approach to countering cybercrime. Thank you, Mr. Chair.

Thank you very much, Right Violet, for your contribution. I should also add that your statements and contributions, please do send them to the Secretariat, and we’ll put them on the website of the Open-Ended Working Group. Youth for Privacy, you have the floor now, please.

Mr. Chairman, I’m Sam, a representative of Youth for Privacy. With over half of all internet users under the age of 30, incorporating youth voices into the discussion of ICTs is not only an act of multistakeholder diplomacy, but also a way of effective policymaking. You need youth buy-in if you want successful ICT policies. To this end, we recommend, one, the establishment of a permanent UN advisory group that incorporates youth perspectives towards ICTs. The current draft statement only mentions incorporating gender perspectives. The UN has already created a youth advisory group to fight against climate change, recognizing that youth lack the access to the political, legal, and voting clout necessary to help shape policy, and by extension, our future. Whatever UN mechanism this group recommends, a youth advisory group must be a part of it. Two, to recognize the proposed point-of-contact directory as a social enterprise and to change the point-of-contact directory to include youth experts and the end user. We must shift the discussion of ICTs from purely technical experts towards those most affected by ICTs. That is, we must include the end user in these discussions as well. Three, a robust capacity-building mechanism targeted towards youth, the elderly, and other vulnerable populations. We must educate vulnerable populations in data analysis to build resilience against threats posed by ICTs, specifically the trend of rising mistrust in governments. Ironically, ICT advancements on mass media platforms have directly contributed towards this trend, one of the largest threats to the international community as identified by the Global Sustainable Development Report. Per this report, businesses are currently the most trusted institution, followed by NGOs and governments. States must work to reverse this trend and restore trust in government. To succeed, we need targeted education, collaborative partnerships, inclusive policymaking, investment in digital literacy, and awareness campaigns. Engaging public-private partnerships and multistakeholder efforts can amplify capacity building for data integrity and cybersecurity, thereby safeguarding international security. Fourth, we’d like to push back against the inclusion of open sources in Section B, Article 11 of this working group’s current draft, which compares open sources to illegal markets and distribution of malicious ICTs. Although open source code is a security vulnerability, this phrasing vilifies the open source community, the source of much-needed innovation and capacity building. To conclude, the deliberate incorporation of youth perspectives is not a task, but an investment in better policymaking, state security, and by extension, our future. Thank you.

Thank you very much, Youth for Privacy, for your contribution. I give the floor now to the Kenya ICT Action Network, please.

Mr. Chair, I speak on behalf of the Kenya ICT Action Network, which is a multistakeholder platform and think tank based in Nairobi, Kenya. The network provides mechanisms and a framework for continuing cooperation and collaboration in ICT matters among stakeholders. It also encourages synergies for ICT policy-related activities and initiatives through advocacy, capacity building, research, and multistakeholder engagement. We’d like to congratulate you, Mr. Chair, on the production of this second annual progress report and make the following suggestions as a way of how the stakeholder community can contribute most meaningfully and effectively to the implementation of various proposals. On overview, paragraph seven, we applaud the inclusion and participation and leadership of women in decision-making processes related to the use of ICTs. As this underscores a pragmatic approach to handling the gender divide, we encourage states to integrate gendered approaches in addressing cyber threats. B, existing potential threats, we support the addition of a paradigm on states’ use of malicious ICT activities. Again, critical infrastructure and critical information infrastructure that undermine trust and confidence in political electoral processes. So far, we also note the increasing use of ICTs in the electoral processes, biometric digital identification systems, and in government services that could face new threats from developing technologies such as artificial intelligence. Paragraph 15, we welcome the proposal to develop a voluntary repository of threats to security. Such a repository, in our opinion, will serve as a one-stop shop for research and monitoring purposes and will allow for learning, avoidance of duplication of efforts, and will be useful, especially for smaller states that may want to learn what others have done and leapfrog. On rules, norms, and principles of responsible state behavior, we welcome the reforming of paragraph 22E on identifying and studying challenges associated with the implementation of rules, norms, and principles of responsible state behavior to better inform capacity building efforts. We underscore the need for explicit recognition of the efforts by non-governmental stakeholders such as CSOs that continuously provide evidence-based information to support this topic. On paragraph 6 on norm implementation guidelines, there is a need to recognize in the text the importance of collaboration with relevant stakeholder non-governmental groups such as civil society, the technical community, academia, and the private sector.

Thank you very much. Kenya ICT Action Network. I apologize that it has been cut off, but do please submit your detailed comments to the Secretariat. Thank you very much for your understanding. I give the floor now to Derecho Digital, please.

Thank you, Mr. Chair. My name is Grecia Macias, and I will speak to you today on behalf of R3D, Red en Defensa de los Derechos Digitales. We will focus our intervention on three main points, commenting on how civil society can be essential in implementing multiple proposals described in the Annual Progress Report. First, we celebrate the inclusion and support from different states for the Threat Repository. R3D particularly supports the Colombian and Costa Rican delegations’ proposal supporting the inclusion of stakeholders in developing the Threat Repository. NGOs, academic communities, and the technical sector have documented different manifestations of various security threats. Local civil society, like R3D, has been vital in collecting factual evidence and assessing a specific cyber incident’s risk with a human-centric approach. Thus, implementing such a repository enables stakeholders to evaluate information shared and ensure its objectivity with evidence-based practice. Secondly, we commend including relevant stakeholders in elaborating this glossary for interpreting the 11 principles of responsible state behavior and the application of international law in cyberspace. Relevant non-governmental stakeholders have helped to provide interpretations and study implications of using specific terminology essential for cybersecurity and the application of international law in cyberspace. Civil society, specifically regional civil society, will be vital for interpreting and implementing regional state responsibility principles. Each region has its unique legal framework and similarities to consider before implementing these guidelines. For example, the Inter-American System has special protections for human rights, such as freedom of expression and privacy, that should be interpreted conjointly with other international law responsibilities from the states. Academia and civil society will advance the discussion by adapting these frameworks to the regional context to avoid any conflict of norms and provide specific guidelines for its implementation on a granular level. Finally, establishing a point of contact directory will be one of the most outstanding achievements of the OEWG. R3D celebrates the strong support that this proposal is receiving from the delegations. We recommend that this proposal sets an excellent precedent for good cyber policy practices that include substantive standards, such as a specific route for the designation of national agency, human rights standards, transparency, and also conduct evidence work and engagement with regional and sub-regional organizations. Thank you, Chair.

Thank you very much, Director General, for your contribution. I give the floor now to the Association for Progressive Communications.

Thank you, Chair, distinguished Delegates. APC welcomes the opportunity to engage in this session and provide comments on the draft report. As expressed in a joint civil society input, we welcome the reference to engaging stakeholders in a systemic, sustained, and substantive manner. Such an inclusive approach is key to addressing the challenges of international cybersecurity. Furthermore, we value the emphasis on women Delegates’ active participation and the prominence given to the gender perspective during the discussions. In this regard, we support the report’s recognition of the importance of narrowing the gender-digital divide that is a factor in creating differential vulnerabilities to cyberattacks. We welcome the recognition of the need for a gender perspective in addressing threats and the specific risks faced by vulnerable groups. So we encourage the group to explore further how to integrate an intersectional gender perspective when addressing cyber threats. For this, we underline the importance of broad representation when inviting experts to discuss the impacts of new technologies in the context of international cybersecurity. It is essential that the voices and inputs of the group’s experiences, specific threats in cyberspace such as human rights defenders, journalists, and people in marginal positions are included. Civil society can play a crucial role by providing evidence and analysis based on the lived experience of those who have faced cyberattacks and can allow us to better understand the actors, the form, and also the impacts of cyberattacks to develop more targeted recommendations. Civil society can also provide guidance and evidence on how to mainstream gender perspectives across the mandate of the group. There are many organizations and academics working on gender and cybersecurity and inclusivity on the Women, Peace, and Security Agenda who can offer direction and advice on this. On international law, we welcome the references to the obligation to protect human rights online by several delegations this week, and we encourage the group to emphasize that international human rights law should be the guiding principle in maintaining a peaceful cyberspace. Future and dedicated discussions on international law should also integrate an understanding of the human rights impacts of malicious cyber operations. Finally, on regular institutional dialogue, we support the proposal of an inclusive action-oriented mechanism that could help states to implement the agreed cyber norms, also to coordinate capacity building efforts and better integrate the voices of non-governmental actors. Civil society plays a key role in cyber norms implementation in raising awareness about them and also monitoring implementation, so it’s key to include non-state actors in the design and implementation of any proposal of a future mechanism. So in conclusion, we emphasize that a human rights and a gender approach and inclusivity perspective are key to achieving a more inclusive, open, secure, stable, and peaceful ICT environment. Thank you for your attention.

Thank you very much, Association for Progressive Communications. Hitachi America, you have the floor, please.

Thank you, Mr. Chair. It is my honor to participate in this dedicated stakeholder segment. Based on the revisions of the second annual progress report, let me highlight the draft. First, Section B, Threat, Paragraph 10bis. Capacity building in critical infrastructure can also include energy and water in addition to healthcare and human life every day. Second, Section B, Paragraph 15. Since digital technology is evolving quickly, coordinated efforts among multistakeholders organizing well are essential to deal with the latest and future threats, such as AI and quantum computing. We can add the words “consolidated vulnerability” before “repository of threats.” Third, Section C, Rule, Norms, Principles, Paragraph 22e. Multistakeholders can validate the implementation of norms towards actions. The future actions could be coordinated with global digital compact ecosystems. OEWG and POA can coordinate very well with perhaps liaison with digital commons with SDG coordinated with, for instance, AI working group. Fourth, Section F, Capacity Building 40e. It is great to establish the multistakeholder information portal as expressed. Global Cyber Security Cooperation Portal under the auspices of the UN working with multistakeholders, which has already developed key components. A global roundtable to create the best practice is also a great way to go, but the mapping exercise is also needed. Fifth, Section G, Regular Institutional Dialogue. Program of Action would be a candidate for a permanent vehicle led by states. For the private sector like ourselves, jointly working with other institutional or international stakeholder groups is a starting point which is happening. For the POA, we can collaborate further in critical infrastructure and the supply chain protection and resilience, developing in the scope, resources, and purpose and goals. In conclusion, multistakeholder engagements with a more permanent shape can further keep critical infrastructure for peace, safe, and resilient for future human civilization on our planet. Thank you, Mr. Chair.

Thank you, Hitachi America. In developing capacity, you have the floor, please.

Mr. Chair, developing capacity welcomes the emphasis that has been placed on capacity building in the draft annual progress report and the inclusion of action-oriented recommendations. I would like to respond to your request for suggestions as to how the stakeholder community can help implement the next steps. Turning first to the mapping of activity, it has already been mentioned that the GFCE-maintained CIBL portal is an established online repository of capacity building activities. In addition, there are several regional mapping efforts underway. The United States mentioned the ITU’s plans for mapping, and organizations that deliver capacity building routinely map relevant activities before starting a new project. If the OEWG draws upon and connects these existing efforts, it can more quickly progress to making use of the mapping, for example by identifying gaps. The OEWG can also add value by encouraging members to put more information about their projects online, so it is easier for any and all mapping initiatives to find. This would be one way in which the OEWG could put the principle of transparency into practice. Turning to the recommendation on principles, I’ve been pleased to support an initiative by Chatham House that responds to the OEWG’s ambition to mainstream capacity building principles. They will speak to this in a moment. I will only add here that there are also plans to discuss mainstreaming principles at the Global Conference on Cyber Capacity Building in Ghana this November, and I anticipate that mainstreaming principles will be on the agenda of the Global Roundtable proposed for the intersessional period. There will be synergies between all these initiatives that stakeholders can help the OEWG identify and benefit from. Finally, I would like to thank you, Mr. Chair, for keeping the OEWG canoe pointed towards the substantive goals to which this process can contribute. From a capacity building perspective, the OEWG will have been a success if countries are better able to access quality principles-based capacity building by the end of the process. Action-oriented recommendations make it possible for the OEWG to reach that destination. Please be assured that there are a lot of people sitting up here at the back of the canoe who are keen to help out with the paddling. Thank you, Mr. Chair.

Thank you very much, Developing Capacity, for your contribution and also for helping to paddle the canoe. The waves are choppy, indeed, but we have to navigate. Canoes are quite resilient, and paddling with all our available hands is always welcome. I’m going to give the floor now to the Paris Peace Forum. You have the floor, please.

Distinguished Delegates, we would first like to reiterate our appreciation, Mr. Chair, for your sustained efforts to ensure the participation of all interested stakeholders, including outside of the special sessions of the OEWG. As we have offered stakeholders to share insight on how they could best contribute to the action-oriented proposals captured in the ZERO draft of the Second Annual Progress Report, allowing to first comment states for the progress made this year and for the determination they have shown since Monday to reach a second APR. The Paris Peace Forum strongly encourages states to reach a consensus which reflects the constructive work achieved by this OEWG this year. We first welcome the reference made under the existing and potential threat section to the proliferation of commercially available ICT capabilities that can be used for malicious purposes, as well as the uncontrollable growth of the access service markets, as mentioned in paragraph 11 of the first draft. Addressing this multi-layered issue will require better-coordinated efforts, especially as to articulate existing frameworks with necessary new norms where relevant, as well as the responsibility of all actors, whether public or private. In compliance with principle 5 of the Paris Cooperation Institute in cyberspace, of which the Paris Peace Forum holds a secretariat, the Paris School community is currently pursuing this endeavor in a multistakeholder format, starting by clarifying possible policy levers to tackle this issue. It’s a concrete example of how the stakeholder community can contribute to the action-oriented proposal captured in the draft of the APR in order to provide further elements. We also welcome the mention of increasing malicious activities targeting critical infrastructure and critical information infrastructures, another threat section, as well as the potential cascading domestic, regional, and global effects resulting from the disruption. On this matter, we, however, believe that better clarity and, where possible, convergence on the notion of critical infrastructure would especially contribute to the goal of this OEWG. Stakeholders can contribute to better framing this concept, especially when it comes to assessing impacts on population or identifying critical areas where further collaboration is needed at the international level. On capacity building, we align ourselves with the common letter shared by – to the chair by the International Board of Commerce that called for the APR to reflect conversation from past meetings about the value of establishing common goals to define the scope, ambition, and required capacity building support needed to implement the existing framework of responsible state behavior. Here again, stakeholders should be regarded as resources by delegations to design the most relevant framework, taking into account local specificities, as well as the evolving nature of the ICT environment. Overall, in this endeavor to implement the various action-oriented proposals in the latest revision of the draft annual progress report, we encourage states to benefit from opportunities created by the stakeholder community, especially by mobilizing existing informal diplomatic formats, such as the World Economic Forum, the Rieslinger Dialogue, or the Paris Peace Forum. These efforts enable states to benefit from informal engagement with stakeholders, even on sensitive policy issues related to national and international security. In this regard, there are critical resources to increase state cyber policy capacities and are complementary to formal negotiations and processes undertaken in the framework of the United Nations. Thank you very much, Mr. Chair.

Thank you very much, Paris Peace Forum, and do share your intervention with us. I think you get the prize for the most rapid reading. So I would like to read your statement, so do send it to us. I give the floor now to the Royal Institute of International Affairs. Chatham House, you have the floor, please.

On behalf of Chatham House, we’d like to thank you, Mr. Chair, for the opportunity to contribute our views on the implementation of the proposals in the APR before you make further divisions. I’ll focus my comments on three areas: capacity building, gender, and international law. Starting with capacity building, we commend the Chair’s focus on the importance of mainstreaming the cyber capacity building principles into capacity building efforts. We believe applying a principles-based approach to capacity building leads to more equitable, transparent, and human-centric efforts. And as the side event we held on Monday also emphasized, it can help protect against harms and risks that might emanate from capacity building, whether intentionally or unintentionally. As part of a project supported by the Netherlands, we are in the process of developing further guidance on how the principles should be applied and what value they can add. By doing so, Mr. Chair, we’ll be directly contributing to the recommendation in paragraph 47 of the APR, and we welcome suggestions or questions from states and stakeholders. On gender, we commend the Chair for not limiting gender to just having more women or better representation in the room. Gender security is an international security matter. Incorporating gender perspectives leads to a more comprehensive and disaggregated understanding of how cyberspace is weaponized, by and against whom, and this goes beyond just the impact on women. The harms that originate from or are exacerbated in cyberspace differ based on an individual’s gender identity and other intersectional identities. Not taking this into account leads to an incomplete understanding of the threat landscape, and as a result, inadequate solutions. On the tools that could assist states in incorporating a gender dimension into capacity building efforts, I’d like to draw attention to a toolkit Chatham House published earlier this month on integrating gender and cybercrime capacity building efforts. On international law, we welcome the statements of several delegations that international law applies in cyberspace, and efforts are needed to clarify how it applies. At the same time, it is important to note that efforts to clarify existing international law by no means exclude or prejudice the progressive development of future norms via new treaties and customary international law. We believe that adding such language to the APR could help garner consensus on the matter. Finally, we are pleased to see that the Chair and several delegations recognize the role that legal experts from the multistakeholder community play in advancing international law discussions and filling existing knowledge gaps in the formal and informal sessions. We continue to advocate that the APR should include explicit language to this effect. Chatham House is developing research on the application of countermeasures and necessity in cyberspace that we hope will inform the work of this group.

Thank you, Mr. Chair. Thank you, Chatham House, for your contribution. I give the floor now to Safe PC Solutions, Safe PC Cloud. You have the floor, please. Hello. Yes, please proceed. Thank you. If you could press the microphone once and then allow it time to turn red, and then you can.

Thank you. Thank you. Thank you. Thank you so much. Dear Chairman, Safe PC Solutions would like to thank you and your team for your work on the second annual progress report of the OEWG on security and the use of ICTs. More importantly, as an African-American woman-owned cybersecurity company, we are very pleased with the commitment to diversity and inclusion. Over the past couple of years, I’ve had the honor to see firsthand your commitment to ensuring that everyone has a seat at the table, especially for people of color. When it comes to the review of the second draft on capacity building and stakeholder engagement by multiple groups, we are happy to see the framework addresses the critical challenges that are facing information and communication technology. These include things such as an increase in cyber attacks in cloud security, the transformational move to generative AI and machine learning, and an increase in quantum computing to solve critical challenges and to assist with research. We do not see a mention, and we would like to see inclusion, more amongst the emergence of security threats among 5G broadband technologies. Also, we are pleased to see that capacity building is at the forefront of negotiations among governments, private sectors, and NGOs. I definitely feel the commitment towards gender diversity, which is very important. But I want to share my experience. This past year, Safe PC Solutions were both Microsoft and Fortinet partners. We had the opportunity to focus on the technical vulnerabilities at historically black colleges and universities, community colleges, and minority-serving colleges and institutions that are based in the U.S. What we found was a lack of secure infrastructure, which we call CI here, as well as awareness and training in cybersecurity among faculty, staff, and students. I know a lot of times here at the UN, we get the discussions between the developing and the developed countries. But keep in mind that in developed countries, developed societies, particularly in the U.S., we do have a problem with the digital gap among people of color and people with low income. So I do not want underrepresented groups in cybersecurity to be forgotten in these discussions. Furthermore, your idea of a global forum for 2020 –

Thank you very much, Safe PC Solutions. Sorry that we had to cut you off, but do give us your statement, and thank you for your reminder that the digital divide is not a North-South issue; it is in all our societies and something that needs to be addressed. I give the floor now to the Centre of Excellence for National Security, S. Rajaratnam School of International Studies in Singapore. You have the floor, please. Thank you.

We thank the Chair for convening this dedicated stakeholder segment and according stakeholders an invaluable opportunity to engage in these important discussions. The Chair has sought to incorporate the full range of views and preferences expressed by delegations while working towards a balanced text in the draft second APR. The Chair has also urged delegations to exercise a spirit of cooperation, flexibility, responsibility, and respect to find the balance necessary to secure the adoption of the report. We are much encouraged by this call. In the face of increasing threats posed by the malicious use of ICTs, we join other non-government stakeholders in looking eagerly to states to reach a timely consensus on the second APR and the concrete action needed to ensure security and stability in the use of ICTs and the security of our states. In response to the Chair’s invitation, we have offered the following observations. Our resounding response is that stakeholders are ready to engage with states in regional and cross-regional formats to share best practices and unique insights on how ICT security is viewed. On the proposals relating to confidence-building measures, the establishment and operation of the Points of Contact Directory is an encouraging step forward in confidence-building for ICT security, but more should be done, especially in the current climate of mutual distrust and tension among states. Stakeholders operating in a private capacity can function as structural partners. Such informal dialogues, away from the more formal settings of the OEWG, especially where official diplomacy is inconvenient, can re-establish understanding and trust and assist states in developing and co-creating a suite of CBMs. Together with partners at the Centre for International Law at the National University of Singapore and Columbia University’s School of International and Public Affairs, we convene a regular U.S.-ASEAN Cyber and Digital Dialogue, bringing together policy, business, and academic thought leaders to discuss the future path for improving cyber cooperation and exploring opportunities for collaboration. Such a model can be replicated with a range of partners across different geographical regions to engage in views on the development and implementation of CBMs. On capacity building, stakeholders can and should continue to play an important role in this process, but in a way suitable for their national needs and circumstances. This will help them better voice their concerns, better implement existing norms and principles of responsible state behavior, and ultimately enable states to deal with ICT incidents in a more timely manner. With this in mind, we continue to support the UN Singapore Cyber Programme on developing norms implementation checklists and provide trainers for the UN Singapore Cyber Fellowship. Finally, we support the Chair’s initiative to hold a global meeting for stakeholders and states at the UN level to build networks on how to further develop cyber capacity building, confidence-building measures, implement norms, and strengthen understanding. The involvement of multiple stakeholders across disciplines in a cohesive, integrated discussion underpins a holistic appreciation of the multifaceted legal, policy, and technical considerations. In closing, we are committed to…

Thank you very much, S. Roger, Redland School of International Studies, for your contribution. I give the floor now to the Nuclear Age Peace Foundation.

Honorable Chair, distinguished delegates, ladies and gentlemen. My name is Graham Chui-Gedis, and I am a youth activist with the Nuclear Age Peace Foundation. We have delivered multiple interventions in the past to this working group, and I appreciate the opportunity to be here today. I specifically want to speak to youth views regarding emerging technologies and international humanitarian law, and the importance of youth inclusion within decision-making processes. Chair and distinguished delegates, emerging technologies within ICTs are a critical concern in light of recent developments in areas such as artificial intelligence and quantum computing. These advancements contain boundless possibilities to positively or negatively transform our world’s shared information and communications pathways, potentialities both good and bad. Avoiding negative outcomes requires active engagement and guidance. We hope that this working group will continue to proactively explore and consider these technologies in ways that will go beyond what is currently outlined within the annual progress report. Chair and distinguished delegates, the challenges ahead necessitate a comprehensive framework for the digital arena, and we believe that the UN Charter and international humanitarian law must be central to these discussions. A shared, unified understanding of how human rights law applies within the information realm will help regulate competition and ensure that safety, privacy, and security are always at the forefront of system design. We take note of points 31 and 32 in the draft APR as critical next steps in outlining a substantive framework for the application of international law to information and communications technologies. This will necessitate collective action and collaboration to ensure all benefit from these developments, and we welcome the emphasis on capacity building and greater information sharing within point 34 in sections E and F as a first step towards a safe and collaborative digital space. Honorable Chair and delegates, allow me to close my remarks by emphasizing that the OEWG should consider avenues and methodologies through which to amplify and integrate youth voices in ICT discussions, including within the text of the report this body will submit at the end of the week. Youth contributions will enhance and facilitate a broader understanding and analysis of ICT challenges as currently performed by this working group. Our inclusion will help ensure that a safer future awaits us all. Thank you.

Thank you very much, Nuclear Age Peace Foundation. I give the floor now to the Global Partners Digital.

Chair, distinguished delegates, it is not possible to do justice in a short intervention to the contributions of the stakeholder community, which are not confined to any one area of the mandate. For this reason, we have also published on the OEWG document repository a more detailed civil society input, which has received the endorsement of 13 organizations and experts. I will focus my comments on three specific proposals in the report, with recommendations for how best to leverage the work of the stakeholder community in their operationalization. First, in relation to new and emerging threats, we note the complementary and supportive work of non-governmental actors to acquire knowledge of threats and to work directly with those disproportionately impacted by such threats, to ensure the implementation of the agreed framework on responsible state behavior in an inclusive and human-centric manner. In this regard, we signal our support for the proposal by the delegation of Colombia and others to facilitate the contributions of non-governmental stakeholders to the proposed repository of threats. Second, relating to confidence-building measures, we welcome the progress made to develop the points of contact directory. As trust is so important to an effective and practical directory, we recommend the directory benefits from the work of existing networks of CSIRTs and CERTs to establish commonly agreed principles for the exchange of information, such as FIRST’s, IEPs, and CIVICERT’s RFC 2350, and also that it adheres to human rights and data protection laws and standards. Finally, with regard to both rules, norms, and principles and international law, we note the essential role of non-governmental stakeholders in ensuring effective human-centric and rights-respecting norm implementation. After all, cyber norms are derived from and referred to international law, which includes international humanitarian and international human rights law. Stakeholders have helped to further understanding of key terms and to contextualize the norms to their local and national contexts by developing or contributing to working papers, guidance, and checklists. To share just one example, Global Partners Digital have just published the Inclusive Cyber Norms Toolkit, which provides detailed guidance to ensure a fully inclusive approach to the development and implementation of cyber norms. For these reasons, we fully endorse the proposals made this week to convene further discussion of how international law applies in cyberspace. We recommend this discussion is substantive and ongoing, rather than ad hoc, and that it leverages the expertise acquired by the stakeholder community. It could usefully focus on topics such as human rights and due diligence, as well as on expanding norm E. Thank you for your attention.

Thank you very much, Global Partners Digital. I give the floor now to the NGO, David Choros Digital. You have the floor, please.

Mr. Chair, distinguished delegates, Derechos Digitales appreciates the opportunity to participate in this meeting of the Open-Ended Working Group. Derechos Digitales is a Latin American civil society organization active in research and information sharing on threats in cyberspace and their impacts on human rights. We have participated in joint contributions with other stakeholders and wish to provide additional comments here. We appreciate the proposal to create a repository of threats to the security of information and communication technologies. We urge cooperation with non-governmental actors for the creation of and contribution to the repository. In the same sense, we support the creation of instances for information exchange and incident response exercises beyond states. We emphasize that organizations like ours are trusted intermediaries for information on incidents received from people who are common targets of malware and cyberattacks, such as human rights defenders and journalists. Also, in the interaction with experts who do not necessarily participate in instances organized by states, that experience is useful for the formation of an effective repository. We support the operationalization of the points of contact directory. As we have already expressed before this working group, we support the expansion of such a directory to include interaction with response teams and other non-governmental key stakeholders. In our case, related efforts include managing a trusted network of people outside of governments with the ability and the capacity to detect and respond to digital security incidents, advancing in the creation of an observatory of digital threats in Latin America. Finally, given the role of non-governmental actors in the interpretation of international law as it relates to cyberspace, including standards in regional systems, we urge the inclusion of these actors, including civil society, in a focused and ongoing discussion on international law. We also urge the establishment of inclusive processes for the definition and implementation of cyber norms with sensitivity to regional and local context. We remain committed to continue contributing to this process, and I thank you, Chair.

Thank you very much, dear HOS Digital, for your contribution. I give the floor now to the International Chamber of Commerce.

Thank you, Mr. Chair. My name is Marek Rasool, and I work for the International Chamber of Commerce, the institutional representative of 45 million businesses in over 100 countries. Ahead of the meeting this week, a group of 21 stakeholders sent a letter to Ambassador Gafoor underlining the importance of prioritizing capacity building in the annual progress report. I am delivering the statement on their behalf, and I encourage you to check the Open-Ended Working Group webpage to read the letter in full and the list of organizations who signed it. We welcome the clear recognition in paragraph 4D of the draft APR of the need to connect the work of the Open-Ended Working Group with wider digital development efforts. We cannot overstate the importance of mainstreaming cybersecurity into the wider UN Sustainable Development Agenda. There is currently a lack of alignment between the need to close the digital divides and the need to improve cybersecurity. We therefore recommend that the APR should contain language which explicitly states that the Open-Ended Working Group should consider how cybersecurity considerations and good practices can be integrated into future digital development projects while recognizing the unique needs, circumstances, and state of cybersecurity developments both in low- and high-income countries. We welcome the suggestion to develop a norms implementation checklist and the intention of the chair to produce an initial draft. At the same time, it is important to note that any such checklist must be developed in tandem with a comprehensive and coordinated approach to capacity building. Without the required capacity-building support, a checklist will remain aspirational, especially for low- and middle-income countries. Further to the checklist, we hope that member states will also build on paragraph 4DF and consider reflecting conversations from past meetings about the value of establishing common goals to define the scope, ambition, and required capacity-building support needed to implement the existing framework. As paragraph 40G of the APR notes, stakeholders are central to delivering capacity building, and we welcome that acknowledgment. We would also like to highlight that stakeholders contribute to a wide range of capacity-building efforts beyond training, research, and facilitating access. The proposed Global Roundtable on ICT Security Capacity Building provides an ideal opportunity to establish a mode of meaningful engagement, and we hope that there is an ambition for this to be a substantive and ongoing initiative involving stakeholders rather than a one-off meeting. Finally, Excellency, on behalf of the International Chamber of Commerce and this group of stakeholders, I would like to reiterate that we stand ready to support states in their discussions on the APR and remain committed to a successful Open-Ended Working Group process. Thank you.

Thank you very much, International Chamber of Commerce, for your contribution as well as for your letter addressed to me. I give the floor now to the ICT for Peace Foundation.

Ambassador Gafoor and esteemed colleagues, ICT4Peace is delighted to be part of this meeting, and we appreciate the opportunity today to contribute to the discussions on the second annual progress report. Our brief remarks will focus on the application of international law to cyberspace, institutional dialogue, capacity building, and the proposed point of contact network, highlighting areas in which stakeholders can contribute to their implementation. Regarding international law, we echo the sentiments of many states and stakeholders in this meeting that the application of international law to ICTs and cyberspace, and importantly understanding how it applies, is a crucial step towards developing common understandings on this issue. The principles of the United Nations Charter are not only applicable but also essential in maintaining peace, security, and stability in the ICT environment. We support the continued discussions on how international law applies to the use of ICTs by states and the development of common understandings on this issue and are heartened by the growing number of member states and statements on this topic. In particular, we would like to draw attention to the following areas under international law that need to be further developed in terms of how they apply to ICTs and cyberspace. This includes the Charter of the United Nations, the application of international humanitarian law, peaceful settlement of disputes, protecting human rights online, including privacy, freedom of expression, and rights of gender and other marginalized groups, state responsibility for incidents, and state response options. Numerous states have spoken about the need to more effectively translate these areas of international law such that their spirit and intent can be faithfully applied to activities and incidents in cyberspace, and this is an undertaking that will hopefully be further addressed in future OEWG-related events. Turning to institutional dialogue, we reiterate our support for the establishment of a cyber Program of Action as a permanent, inclusive, consensus-based, and action-oriented international instrument to advance the implementation of responsible behavior and the use of ICTs in the context of international security. Given that cybersecurity is inherently multistakeholder and that many non-state actors have effective control over certain elements of cyberspace, any institutional dialogue platform, coordination, or other governance mechanism also needs to be multistakeholder in nature in order to effectively implement the normative framework of responsible state behavior, and this requires contributions by both state and non-state stakeholders. Turning to capacity building, capacity building in the context of cybersecurity can promote the development of skills, knowledge, and institutional structures needed to effectively address cyber threats. It is important for several reasons, many of which have been discussed over the past few days, including enhancing technical skills, strengthening policy and legal frameworks, reducing inequalities, and building trust. Finally, in terms of the point of contact, we support holding regular and voluntary tabletop exercises to increase trust in cybersecurity, and we also support the implementation of a cyber-resilience framework to address cyber threats. Thank you.

Thank you very much, ICT for Peace Foundation, for your contribution. I give the floor now to Fundación Carisma.

Thank you, Mr. Chairman. Thank you for giving us the opportunity to take part in today’s discussion. Like other delegations, we welcome the mention of the systematic and substantial participation of the many stakeholders in the second annual report. Here, I’d like to point out some specific points which we must stress regarding the participation of stakeholders. First of all, on potential and existing threats, we should take into account that cybersecurity must have, as an objective, the protection of computer systems, but also the infrastructures which make it possible to have these rights. In that respect, we must bear in mind the contributions that civil society organizations can make, and that threats affect mostly citizens. Academia and security experts have an essential role to protect us, since they could generate threats to states and persons, and they can help to define how to properly regulate the changing nature of technology. It’s crucial for all the stakeholders to have the possibility to receive information with respect to existing and potential threats to cybersecurity. In the case of the threat repository, this should be agreed to by states, and they should receive contributions from all parties. In the other item dealt with in the report, I’d like to mention the CBMs and, concretely, the proposal to develop a PLC directory. These points of contact should include CERTs, CSIRTs, and other sectors such as academics, unions, as well as civil society, so that they can also exchange information. In the same way, we cannot forget the fact that stakeholders can also play a role in developing capabilities within states, in designing or implementing cybersecurity policies, and also in training citizens when it comes to cybersecurity and in creating capability in the critical infrastructure. As Fundación Carisma has already said on other occasions, we hope that the participation of the many stakeholders will continue to be systematic and substantial. A cybersecurity policy which includes all the interested parties will be more realistic than policies that don’t, and the stakeholders are ready to participate. Thank you.

Thank you very much, Fondas and Karisma. I give the floor now to AXS Now.

Thank you, Chair. I speak on behalf of Access Now. We encourage this body to create a lasting space where all stakeholders can identify, prevent, and monitor cyber risk under UN auspices with human rights at its center. We ask now for more assertive language against specific threats impacting digital human rights and humanitarian access. We welcome the recognition of the global danger posed by the spyware industry. Paragraph 11 of this APR Zero draft identifies, quote, the growth of illegal markets offering access to, inter alia, software vulnerabilities, spyware, sophisticated high-end offensive ICT tools, and hacker-for-hire services, end quote. Spyware offends privacy and undermines trust in the internet broadly. The APR should explicitly also refer to specific language of concern around cyber mercenaries, as outlined by the 2021 report of the UN Working Group on Mercenaries on the Issue of Cyber Mercenaries and its recommendations directed at the OEWG on human rights. These tools are used to levitate particular abuses on women and all their diversity. We urgently require international leadership to leave no safe space for the spyware industry to thrive. We submit, however, that OEWG needs to be more forthright in recognizing the cyber threats and capabilities being utilized against humanitarian actors and human rights defenders as part of its reporting on existing and potential threats, including in this APR. We propose that further study of applicable humanitarian law to cyber operations extend the principle of protected assets to the internet as a whole, not just to the digital dimension of protected physical assets. Warring parties have duties to not, one, interfere with the internet outside of the traditional IHL targeting criteria, necessity, proportionality, and distinction, and, two, target or weaponize the internet protocol and the DNS, the underlying infrastructure for our digital commons. On the topic of CBMs, we note that the proposed APR notes the importance of addressing ICT vulnerabilities. Vulnerability disclosure could be further discussed. Further confidence-building via strengthening global vulnerability disclosure should also be included in the next steps for this section of the APR. Lastly, we welcome the recognition of the importance of regular institutional dialogue and the role for the Program of Action as a next step in this area. Discussions on the POA would benefit from even further openness and planning around how stakeholders can contribute, including closer to the grassroots in the planned regional meetings. We hope all stakeholders engaged in the POA discussions can help provide this crucial information and ensure effective engagement with stakeholders. We believe that regular institutional dialogue will only be effective if it is honest and ambitious. We need to be franker about the cyber threats that target civil society, and this human-centric cyber security requires a humanized, anchored approach.

Thank you very much, Alexis, for your contribution. That was the last speaker from the stakeholder community, and I’d like to ask at this point whether any of the delegations here would like to make any comments in response to the contributions from the stakeholder community. We can take a few comments, but I don’t intend to have a repeat of a general statement from delegations about their positions. We’ve already had that, but specifically in response to what has been said by the stakeholder community, are there any delegations which wish to react and respond and add their comments? The floor is open. Colombia, you have the floor, please.

Thank you, Mr. Chairman. Very briefly, my delegation would simply like to thank the stakeholders for their contributions and ideas. I would encourage them to continue this frank and continuous dialogue with us, and we are convinced that we need their support for the effective implementation of the keys to responsible state behavior. Thank you very much.

Thank you, Colombia, for your comments and for your encouragement to the stakeholder community. European Union, please.

Thank you, Chair. I just would like to echo the words of Colombia and indeed thank the stakeholders for sharing their interventions, and also to encourage everyone to read the full interventions of the colleagues on the website so that these can be taken into account in our further discussions. Thank you very much.

Thank you very much, European Union. Any other comments? Netherlands, please.

Thank you very much, Chair. First, I would like to thank you, Chair, for giving this opportunity for the stakeholders’ community to give their feedback on the APR. We believe that’s a very useful exchange that we are having today, and to hear their views is very important to us. I think it underlines the importance of having them in the room and getting their expertise. As we said before, we think it’s very important to have all stakeholders included: academia, the private sector, civil society, and the technical community, because they provide their expertise to deepen our understanding of cyber security. Thank you very much.

Thank you, Netherlands. Czechia, you have the floor, please.

Thank you, Mr. Chair. Very shortly, I would like to join others in thanking you for convening this meeting and for all participants. Those opinions are important to us, and we should take them into account in our future work.

Thank you, Chair. Chair, for your comments. Canada, please.

I will also be very brief. Thank you very much for convening this session. Thank you very much to the stakeholders. We’ve taken good note of many of your excellent suggestions. And, Chair, we very much share your hope that one day we will have many more stakeholders in this room and strongly encourage all states not to use their veto rights in this regard. Thank you.

Thank you for your comments. Canada, Poland.

Thank you, Chair. Again, thank you for convening this meeting. We think that the voices of stakeholders are very important. They share different opinions, and they also let us see the things that we are discussing here from the government’s perspective from a slightly different angle. Some of these inputs are certainly helpful to push our work forward. I think a lot of good work is being done on the analysis of how we can proceed with our work, and I believe some of the analysis available through the stakeholders’ work can be directly used in the future work of our working group. So, thank you very much, and thank you to the stakeholders for sharing with us your views.

Thank you, Poland. Mexico, you have the floor, please.

Thank you, Chairman. We would also like to thank all of the participants for all of the presentations that they have made. They were very informative, and I believe that it’s a good complement, a very appropriate complement to the work that we’re doing here, especially on the analysis that we are conducting of the text of the report and how to complement it in the best way possible. We believe that, especially in this process, the voice of the stakeholders is particularly relevant. It’s the case of many processes, but they are the ones who see this topic on a daily basis, and we think that their voice is especially important. We’d like to propose as well, well, two questions for future sessions such as this. The first, perhaps we would give them an extra minute to deliver their presentations. We are fully aware of the fact that you have to manage the time for this process and for us to be efficient, et cetera, but perhaps one more minute would allow them to give us some additional suggestions. And also, in the future, perhaps we could have their names as well. We hear the presentation, but for – in order to follow up on this, perhaps we could be able to identify them. But once again, thank you very much for giving us this dialogue, and we’d like to thank all of the presenters for having given us this information. Thank you very much.

Thank you very much, Mexico, for your comments and also for your plea to me to give the stakeholder community an extra minute next time. I’m happy to do that, but I will have to begin cutting the time allocated to delegations. And we’ll start that with Mexico. Thank you very much. But seriously, I do take the point that we do need to give more time, but we are operating under such tight constraints, especially in the July session, where we have the pressure of needing to find consensus. I see no other speakers who have requested the floor, and I want to, at this point, first of all, once again, thank the stakeholder community for having come prepared. I know you had to rush your interventions a little bit to fit the three-minute time limit, but I hope that you will share your contributions in writing. Second, I do encourage all the delegations to look through the contributions made by the stakeholder community, the written submissions that they have put forward, not only for this session but over the last two and a half years. They are all available on the website. And I think that’s one of the things that the OEWG can do: serve as a virtual platform for sharing the ideas put forward by the stakeholder community. So I do encourage delegations to look through their contributions as well. Third, I think we have to, as a process and as a community, take advantage of the expertise, network, and resources available within the stakeholder community. They bring a lot of knowledge, expertise, and network to our process, and it’s important that we leverage it to strengthen what we are trying to do here in the Open-Ended Working Group. I’m confident that we will continue to do more and more with the stakeholder community as the progress in this process also proceeds in a step-by-step way. These things are not intended to be accomplished with one or two meetings. You’re talking about a process of bringing the countries of the world together, to build confidence between them, to help provide capacity to developing countries and other countries in need of such capacity. This is going to be ongoing work because technology will evolve so rapidly, new knowledge will be needed, new capacity will be needed, and we are all working together as a community, in a sense, to address the problem because ultimately all of us want our own people, our own citizens in our own country, but also people at the global level and nations at the global level, to live in peace and security. So with those comments, friends, I’d like to adjourn this session and bring this dedicated stakeholder session to a close. Once again, my thanks to all of you for your presence and for your contribution. The meeting is adjourned. Thank you very much.