Session 7-7 Transcript
(OEWG 2021-25)

Good morning, distinguished delegates. The seventh meeting of the seventh substantive session of the Open-Ended Working Group on security of and in the use of ICTs, established pursuant to General Assembly resolution 75/240, is now called to order. We will continue our discussion on confidence-building measures that we began yesterday, and we will continue with the list of speakers who have indicated their desire to speak on this item. If you wish to take the floor and you had pressed the button yesterday, you don’t need to do that today, but if you haven’t done so yesterday, you can press the button today, and I’ll give everyone an opportunity to speak. So we’ll start with Ghana, to be followed by the Kingdom of the Netherlands. Ghana, please, you have the floor. Microphone for Ghana. Ghana, could you press the button? Yes, okay, yes. Yes, please.

Mr. Chair, on this thematic area, Ghana supports the following additional CBMs: CSIRT to CSIRT cooperation, cooperation between states and capacity building to close the digital divide, protection of critical information infrastructure, and public-private sector cooperation. Regarding your guiding questions on how these CBMs can be universally implemented, we believe that strong political commitment and capacity building are essential factors in achieving this goal. Political commitment plays a crucial role as it influences the measures countries adopt, including policies and legislation necessary for implementing existing CBMs. Ghana’s cybersecurity development has been a result of strong political commitment, particularly demonstrated when the President of the Republic assigned the Minister for Communications to oversee cybersecurity matters and appointed a National Cybersecurity Advisor. This initiative led to the establishment of a Cybersecurity Secretariat, data involvement in the National Cybersecurity Center, and ultimately becoming a cybersecurity authority with a mandate to regulate cybersecurity matters. The CSA is able to put in place the necessary measures to address issues such as CSIRT to CSIRT cooperation and protection of critical information infrastructure, whilst also engaging in international forums, which in itself is a CBM. Regarding capacity building, we deem this equally vital, especially for countries with limited resources and technical expertise. Focusing on capacity building enhances awareness of global CBMs and boosts the technical capacity of member states, including CSIRT teams, critical information infrastructure teams, and law enforcement units. This understanding fosters active participation in the implementation and operationalization of CBMs. Capacity building efforts can take various forms, such as webinars, workshops, fellowships, and other related initiatives aimed at enhancing technical skills and knowledge. Mr. Chair, regarding the POC directory, my delegation mentioned in the sixth substantive session the importance of developing and implementing communication protocols with the directory. This can be done through developing standardized templates. To ensure utmost efficiency, it is also important to outline the extent to which the POC should be utilized and the circumstances under which member states are to reach out to their counterparts. Having such protocols in place will ensure that the benefits of the directory are efficiently utilized, and these are some of the elements that can be discussed in the future mechanism. Furthermore, having written down clear and coherent guidelines will ensure consistency and clarity in information exchange. Finally, having and implementing protocols for responding to incidences made to the various POCs can contribute to ensuring timely communication and responsiveness among states. Member states can also discuss and implement a feedback mechanism that will gather inputs from states on the directory’s functionality and user experience to ensure continuous improvement. I thank you.

Thank you very much. Ghana, Kingdom of the Netherlands, followed by Kazakhstan.

And it’s great, yes. Thank you, Chair, and good morning to you and good morning to all the delegates. The Netherlands aligns itself with a statement delivered by the European Union, and I will make some additional remarks in my national capacity. As you named yesterday, the 23 countries who have appointed their point of contact, it is great to see that this concrete initiative of the POC Directory is coming to life. We expect to appoint our POC before the deadline and look forward to the official launch of the POC Directory in May. The Netherlands considers that we should approach the POC Directory in an incremental way and learn from experiences of the ping test that’s planned in June. Following the ping test, the Open-Ended Working Group could reflect on the capacities needed to participate and possible areas of future work. The initial list of voluntary global CBMs is a reaffirmation of a commitment to enhancing transparency, trust, and cooperation between states as well as with stakeholders. To further implement and operationalize this set of CBMs, you could look at regional experiences with the implementation of certain CBMs and the associated capacity building needed to do so. Chair, in your guiding questions, you ask our views on the possible additional CBMs on the protection of critical infrastructure, the public-private sector cooperation, and coordinated vulnerability disclosure. The Netherlands believes these CBMs could be a valuable addition to the initial list. Having experience with these CBMs in the OSCE context, the Netherlands would be interested to hear from experiences of other regions to assess whether and how these CBMs can be applied in the global context. With regards to the suggestion of a CBM on shared cooperation, states should be encouraged to use existing shared channels to exchange information in addition to the POC Directory once it’s operational. It would be important to see how we could complement existing initiatives, including within the form of incident response and security teams with global CBMs. It would also be interesting to look at further examples of CBMs from other domains that may be tailored to promote transparency and prevent unintended escalation in cyberspace. The Netherlands thanks you, Chair, for having facilitated exchanges with regional organizations to enrich our work on CBMs. To this end, the informal cross-regional CBMs group co-organized a side event hosted by Germany on sharing best practices and lessons learned on the establishment, management, and use of cyber points of contact in various regional contexts. Many useful best practices transpired from the event that will hopefully help delegations in approaching our future work, including the POC roundtable on the 9th of May, an event the Netherlands very much looks forward to. I thank you very much, Chair.

Thank you very much, Netherlands, for your statement. And I take this opportunity to also thank the Netherlands and other members of the cross-regional group on confidence-building measures for having organized that side event yesterday on sharing of best practices with regional POC directories. I think that aspect of our work remains very important, and I just wanted to thank all members of the cross-regional group and, of course, all others who have been taking an active part and also for the various outreach and side events that have been organized this week. Thank you for that, Netherlands. I give the floor now to Kazakhstan, to be followed by Albania. And just to be clear, if you are taking the floor and your microphone is not lit up, you need to press the button until it turns green, which means you are requesting the floor so the audio engineer will know where you are seated. When it turns green, wait for a few seconds and then you can speak. So that’s the way the UN audio system works, and there are some engineers who are very hard-working at the back trying to give you the floor, so you will get a chance to speak. So, Kazakhstan to be followed by Albania. Thank you.

Thank you, Chair, for giving the floor, and good morning to all of the delegates. Kazakhstan fully supports the use of CBMs in the report, and regarding your question for the list of additional CBMs, facilitating a common understanding of ICT security terminology among participating states serves as the foundational step to enhance trust, communication, and cooperation in effectively addressing the complex landscape of cybersecurity challenges. So we consider it important to indicate the creation of a list of ICT terminology as one of the CBMs. Including the ICT terminology in confidence-building measures is crucial, as the terminology resource helps in understanding key concepts in the field of ICT. The glossary is needed not only for the participating states, but also for all who would like to familiarize themselves with the text of annual reports, for a more understandable text and with the content of abbreviations on it. Furthermore, we should highlight the Institute of Raising Awareness as a key component of the CBMs, prioritizing this effort. This initiative not only encourages a broad understanding of cyber threats, but also makes active participation from all stakeholders in preventive measures. On that, it would be beneficial to complete a list outlining potential approaches to raising awareness, making it from the collective experiences of all participating states willing to share their best practices. The proposed awareness-raising measures can be made as a questionnaire and posted on the POC portal, making it more informative and increasing its importance. It’s also needed to focus on highlighting capacity building as one of the CBMs by providing states with the necessary skills and knowledge to effectively counter cyber threats and manage cyber incidents. On that, we consider that participating states develop capacity-building initiatives aimed at enhancing their capabilities in ICT threats and vulnerabilities, promoting ICT security, and developing the skills necessary in effectively responding to cyber incidents. As for the points of contact, we support the work of POCs as it helps with improved coordination, quicker resolution of concerns, and overall strengthening of cybersecurity measures. Like many countries, Kazakhstan is currently in the process of appointing the point of contact. For our part, working with the CBMs, Kazakhstan is the only country in Central Asia within the framework of OSCE, co-curating one of the confidence-building measures together with Canada related to ensuring the open, interoperable, secure, and reliable Internet. So as part of the CBM work, we organized sub-regional training sessions in our state last year related to the use of CBM. Furthermore, we also actively support the OSCE’s work for the POCs, and for today, Kazakhstan is actively applying this in practice. As an example, we already had a case where through the OSCE communities portal for POC, we were able to contact representatives of another state to request information about the cyber incident. This approach contributes to quick coordination and active cooperation. Finally, we support that it’s important to highlight the role of PPP, public-private partnerships, and we also propose to reflect on the work of white hat hackers as they play an important role in this sector as a strategic mechanism for cultivating trust and enhancing communication channels, as it significantly responds to capabilities in the face of evolving threats. Thank you.

Thank you very much, Kazakhstan. Albania to be followed by the Russian Federation.

Thank you, Mr. Chair, esteemed colleagues. Albania fully aligns with the statement of the European Union. We stand resolutely in affirmation of the significance and efficiency of the confidence-building measures as instrumental in cultivating trust among nations and in diminishing the risk of conflicts within the digital domain. As underscored by OEWG in its insightful reports, CBMs are paramount in enhancing transparency, predictability, and stability across states. We acknowledge with great appreciation that CBMs are crucial in bolstering transparency, fostering confidence, and ensuring stability, both curtailing the likelihood of misinterpretations that could spiral into crisis. Albania views the OEWG as a pivotal platform for the exchange of practical tools, best practices, and illustrative examples which are essential in engaging and propelling the development and execution of the CBMs. In this spirit, we endorse the establishment of the Global POC Directory, a vital tool for building trust and facilitating information sharing among countries. We consider the Global POC Directory as a cornerstone for enhanced cooperation and the provision of expertise among states in times of cyber crisis, an initiative of immense value, particularly in the Western Balkans region. For tomorrow, Albania champions the development of a universally accessible UN platform. The development of such a platform is crucial for enabling states to share and identify cyber threats and malicious activities efficiently, ethically, and confidentially, reporting the security vulnerabilities between national and governmental CSIRTs, thereby fostering accountability and due diligence. We acknowledge the crucial role of international cooperation in the realm of cybersecurity. Recognizing our position as a smaller state with constrained resources, we wish to express our gratitude towards the United States, European Union, United Kingdom, and Israel for their substantial contributions within the region, with a special note to Albania. The borderless nature of cyberspace combined with the universal challenge of confronting malicious activities and threats underscores the indispensability of global collaboration in safeguarding critical information infrastructures. In this context, the exchange of information emerged as a fundamental aspect. We have gone through very tough times not so long ago with sophisticated threat actors targeting our critical infrastructures with the aim of disrupting everything we have built. But they say that in tough times you understand and feel the presence of real friends. This experience has illuminated the true essence of friendship, highlighting the critical need for trust, stability, and transparency among nations. Albania is profoundly thankful for its partnership with OSCE in advancing CBMs. Our dedication to contributing towards regional and international efforts remains unwavering. Through initiatives under the guidance of OSCE, we have facilitated bilateral exchange, including visits to and from European Union member states, thereby fostering a spirit of cooperation. We are convinced that the engagement of multiple stakeholders in cybersecurity is essential for an inclusive, society-wide strategy. This includes valuable input from the private sector through public-private partnerships, businesses, industry, academia, and civil society. In closing, our heartfelt appreciation goes to the United States and the Global Forum on Cyber Expertise for their role in advancing gender diversity within the field of cybersecurity, notably through the Women in Cyber Fellows, thereby enriching our team with very skilled female cyber professionals. I thank you for your support.

Thank you very much, Albania, for your contribution. I give the floor now to the Russian Federation, to be followed by Mexico.

Mr. Chair, with regard to developing confidence-building measures, in 2023 we took an important step forward. We adopted the elements of a global intergovernmental points of contact directory for the purposes of exchanging information on computer attacks or incidents. In this way, the OEWG once again demonstrated its efficiency and viability as a consensus decision-making mechanism. It’s important that this directory should not remain on paper. It should be used by states in good faith to develop depoliticized cooperation with a view to reducing tensions and preventing misperception of incidents in cybersphere. This, in turn, will greatly reduce the risks of conflicts in information space. We welcome the efforts of the group’s chair to launch the POC directory as soon as possible. For our part, we have already submitted to the UN Office for Disarmament Affairs information on Russia’s points of contact at the technical and diplomatic levels. In our case, the diplomatic point of contact is the Ministry of Foreign Affairs, and the technical POC is the National Computer Incident Coordination Center, which is our national CERT, Computer Emergency Response Team, and Computer Security Incident Response Team. We urge all UN member states to promptly identify points of contact in their countries and submit them to the directory. This will enable us, in line with the chair’s intention, to move already starting in May to practical activities for the POC directory, including regular and virtual meetings, communication checks in the form of ping tests. In our view, such efforts will be more effective if already at this point we further improve the directory, primarily through developing standardized communication templates. Such templates could include the type of information requested, including technical data, and the nature of the request. As regards capacity-building measures, we believe that collating a specific list of needs for each state participating in the POC directory is a step in the right direction. It’s important to pay special attention to the needs of developing countries, many of which do not have experience of participating in other directories of narrower membership. In our further work on the initial list of CBMs, we can’t lose sight of the main objective here, to raise the overall level of trust among states, to reduce the risk of misperception and escalation, to prevent tensions from rising into a direct confrontation. In this regard, it would be useful as a priority to discuss and develop consultation mechanisms inter alia through competent agencies on activities in cyberspace that may raise the concern of states. The POC directory that we’re launching could be a basis for such mechanisms, since it enables direct communication among states’ interested authorities. A fundamental point is that any current and future CBMs should not be used as a tool for interfering in countries’ internal affairs, for making biased political assessments of states’ activities and intentions in the information sphere, or various types of punishments, such as sanctions and other measures of response. Thank you very much.

Thank you very much, Russian Federation, for your statement and suggestions. I give the floor now to Mexico, to be followed by the Republic of Korea.

Thank you, Mr. Chairman. I begin by thanking you for the notable contribution of the stakeholders whose efforts are constantly enriching our debate. We appreciate that the Chairman took into account the call by Mexico in the previous substantive meeting of the group in order to reflect the names of each organization instead of using the generic “stakeholders.” As we have said in other forums, we think it important that the work of the stakeholders be clearly identifiable as a just and necessary way of recognizing all representatives and to continue to promote the participation of the various sectors that work in cyberspace. With regard to CBMs, Mexico joins in the statement made by Chile on behalf of a group of countries since we believe that these measures have shown to be effective in other areas of international security and are a good and necessary element in cyberspace. Given increased concern over malicious uses of ICTs and geopolitical tensions, establishing and strengthening CBMs are vital contributions toward a secure, stable, and peaceful ICT domain. That is why we must speed up the universal application of CBMs and make them operational with the cooperation of interested parties. This means expanding their scope and guaranteeing capacity development as an enabler of CBMs. We are grateful to the Chair for what it has done to compile recommendations on the global POC directory. Capacity development is essential to make progress on implementing CBMs. The points of contact must have access to formal capacity-building initiatives systematically based on the principles of international cooperation contained in Annex C of the second APR. It is also desirable to have participation in tabletop exercises and simulations. Mr. Chairman, we want to emphasize that the voluntary and gradual nature of CBMs is not determined by the current capacities of each country. In fact, as a result of their participation in the POC networks of cyber incident responses, the operational entities in my country have established strategic cooperation based on management capabilities relative to security incidents, strengthening their technical and operational capacity. In this regard, and considering your guiding questions, my country is open to exploring and promoting the CERT-to-CERT cooperation as a CBM, since we have witnessed the benefits of operational cooperation as part of the CERT Americas network. We also believe that it is essential to explore strengthening public-private associations in order to understand the implications of these technologies, focusing on guidelines which would guarantee responsible uses, including ethical considerations and supervision at all times under human control. In conclusion, Mexico appeals to all countries to continue identifying and sharing best practices which at the national or regional level have come to be known as CBMs. We must continue to exchange experiences and knowledge to strengthen the capacities of our countries in the area of cyber security. Thank you.

Thank you very much. Mexico, Republic of Korea, to be followed by Thailand.

Thank you, Chair. The anonymous, transboundary, and simultaneous characteristics of cyberspace make it an environment prone to disputes caused by misunderstandings among countries. In this context, confidence-building measures are paramount in preventing the escalation of conflicts. My delegation believes that establishing points of contact can serve as the groundwork for further confidence-building measures, so we welcome the initial steps towards establishing a global intergovernmental POC directory. We will cooperate in order to facilitate the necessary process in accordance with the timeline presented by the UNODA. From the experience of CIRT-to-CIRT cooperations, participating in multilevel POCs from regional to global is beneficial in itself. ROK CIRT is a member of both the Asia-Pacific CIRT and FIRST. Participating in multiple POCs broadens the range of networking. We would like to build on these experiences and explore the possibilities of interlinking the regional POCs. Turning to the guiding questions, my delegation is of the view that capacity-building programs can be one of the incentives for states to join the POC directory. We suggest considering linking POCs with related capacity-building programs at the regional and global levels. ROK operates the Global Cybersecurity Center for Development, which delivers a series of programs mainly for policymakers and experts in the public sector. Such capacity-building programs may assist countries in interagency engagement at the national level, which we hope would conclude in joining the POC directory. Also, for the successful implementation of global POCs, promoting public-private sector cooperation at the national level may be useful. Korea’s Cyber Threat Analysis and Sharing System, CTAS, could be a reference in this regard. CTAS welcomes private entities to join and receive threat analysis information provided by government agencies. However, only those entities who agree to provide their own information can be accepted and can benefit from the shared cyber analysis data. Incorporating a mutually beneficial system, as illustrated, into information-sharing schemes can be helpful in promoting public-private sector cooperation. Thank you.

Thank you, Republic of Korea. Thailand, to be followed by Qatar.

Thank you, Mr. Chair. On CBMs, Thailand wishes to make the following points. First, Thailand sees great value in the establishment of the Global Point of Contact Directory, which could serve as a catalyst for fostering trust and confidence among states and as an effective tool in response to threats in cyberspace. Second, Thailand is of the view that capacity building and technical assistance remain crucial for the operationalization of the POC Directory, including providing necessary tools and skills and pre-operational training. Such pre-operational provisions serve to ensure that the POCs are equipped with operational readiness, particularly among developing states, hence mitigating the risks of the digital divide. In this regard, we welcome the work plan scheduled prior to the POC operationalization, including the POC meeting in May, which will be held back-to-back with a global roundtable meeting on ICT security capacity building, the POC website, and the simulation exercise. With regard to the simulation exercise, it will allow the POCs to manage and respond to simulated attacks similar to real-life cyber incidents, which will assist in evaluating the POCs’ capabilities and readiness and identifying gaps and loopholes, if any, to help them function better. Third, on additional CBMs, Thailand supports the Global CERT to CERT Cooperation as an area for further cooperation. Thai CERT has been actively monitoring, assessing risks, and providing support and guidance to address cyber threats to other agencies. We observe that over a short span of time, cyber threats have become widespread and even more sophisticated through the integration of artificial intelligence and cutting-edge technologies. Between October 2022 and September 2023, there were more than 1,800 incidents, including a number of attacks by remote access trojans and LockBit 3.0 ransomware. Thailand is convinced that fostering the Global CERT to CERT Cooperation will be key to tackling the ever-evolving threats in the cyber domain by leveraging shared information equities, facilitating collective responses, and promoting future readiness. To achieve this goal, we can build on efforts made at the regional level, as mentioned by previous delegations, including the ASEAN Regional CERT, which will deepen cooperation among ASEAN National CERTs. Moreover, we believe that it is possible to synchronize the work of National CERTs and POCs, including under the OEWG and other regional frameworks, to facilitate effective and collective responses to dealing with cyber incidents. Thank you, Mr. Chair.

Thank you very much, Thailand. Qatar, to be followed by China.

Mr. Chair, in this session we’ve discussed matters pertaining to collective responsibility for cyberspace, and in that context, talking about confidence-building measures, we want to reemphasize the importance of exchanging good practices with regard to ICT in all areas. This is essential to build confidence. We should never forget the need to face up to challenges and threats in a unified manner, present a common front, if you will. We suggest that confidence-building measures should include partnerships between the public and private sectors. And in Qatar, we have created what we call the digital ecosystem involving all participants, which is an important way to build confidence and also strengthen competencies and improve human potential. Cooperation between public and private sectors is the most effective way, in our experience, to regulate public use of ICTs and everything that occurs in cyberspace. Mr. Chair, my country wants to share this successful experience with the international community so that lessons learned could be applied internationally as well. So we suggested including this in the initial list of confidence-building measures. We want to also welcome international efforts to promote the participation of women in the digital domain at the decision-making level. My country has made a special effort to make sure women are strategic partners with men in all areas regulating cyberspace. Women in Cyber Fellows is something that has been established, and again, we wanted to share that. Thank you.

Thank you very much, Qatar. China, to be followed by Canada.

Thank you, Mr. Chair. China believes that the purpose of CBMs is to enhance mutual trust and predictability and to reduce misunderstanding and miscalculation, and that states should not contravene these objectives by using CBMs as a tool to cobble together small cliques, build cyber-military alliances, and proliferate advanced cyber weapons. China has consistently supported the development of CBMs by states on a voluntary basis, such as policy exchange, law enforcement cooperation, technical exchange, and information sharing, so as to gradually enhance mutual trust and reduce misperceptions through a step-by-step approach. At the same time, I wish to emphasize that guidelines are conducive to enhancing mutual trust among all parties and are, in essence, a confidence-building measure. CBMs and international rulemaking in cyberspace should be mutually reinforcing and complementary. China actively supports the establishment of a global POC directory and believes that the development of the POC directory should be carried out in the spirit of mutual respect, equality, and mutual benefit based on the principle of volunteerism, with each country deciding on the functions of the POCs, the types of information to be received and replied to, as well as the channels to be utilized by the POCs. China has submitted information on diplomatic and technical POCs. The diplomatic POC is undertaken by the Office for Cyber Affairs of the Ministry of Foreign Affairs, responsible for cybersecurity policy dialogues, international exchange, and cooperation, while the technical POC is jointly undertaken by the National Computer Network Emergency Response Technical Team, CN-CERT, and the Ministry of Public Security. The former is responsible for the prevention of cross-border cybersecurity incidents, emergency response, coordination, and disposal, information sharing, and other practical cooperation, while the latter is responsible for international cooperation in combating cybercrime as well as carrying out international law enforcement and cybersecurity notification and early warning. China believes that the POC directory, as an important CBM, can play a positive role in cybersecurity policy, international exchange and cooperation, and CERT-to-CERT communication and cooperation. China will continue to actively support and participate in the work in this field. I thank you, Mr. Chair.

Thank you very much, China, for your contribution. Canada, to be followed by Singapore.

Thank you, Mr. Chair. Canada welcomes the ongoing process towards the operationalization of the Global Points of Contact Directory. Mr. Chair, Canada believes that effective implementation is key to developing trust and transparency. We support the work being conducted to help developing states to continuously implement the CBMs, including looking at capacities and onboarding activities that can help them during the process of nominating their POCs. In this way, capacity building supports CBMs and can be considered as an element relevant to the CBMs in and of itself. We have witnessed the benefits of such an approach through cyber capacity building projects that we are funding, which have implicitly supported the implementation of the agreed CBMs. Canada encourages all members to work towards the timeline encouraged by the Office of Disarmament Affairs to nominate their POCs, that is hopefully by the 15th of April 2024, and we are pleased that we have done so already. Mr. Chair, the main purpose of the POCs, as identified in Annex A of the Second Annual Progress Report, is to facilitate coordination and communication between states, including in the event of an urgent or significant ICT incident, to build confidence between states, and to reduce tensions and prevent misunderstandings that may stem from ICT incidents. In line with this main purpose, POCs facilitate secure and direct communications between states to help prevent and address serious ICT incidents, de-escalate tensions in situations of crisis. POCs can also help increase information sharing. It is for this purpose that Canada has nominated both its diplomatic and technical POCs. Canada underscores the importance of operationalizing the CBMs listed in the Second Annual Progress Report by taking inspiration from what is already done at the regional level. This is why we have agreed to share our experiences as part of the OAS and the OSCE and the ASEAN Regional Forum with regard to CBMs, and this is also why we were pleased to join the joint statement delivered by Chile earlier this session. We wish to re-emphasize here the role of the multistakeholder community in the implementation of CBMs, as highlighted in that joint statement. Canada is dedicated to strengthening the synergy between regional forums and the ongoing work at the OEWG. Indeed, Canada has significant experience in this regard. As I noted, we are party to CBMs in three regional groups, and we are honoured to have been appointed Vice-Chair of the OAS CBMs Working Group in 2024. With regard to the role of a diplomatic POC, as the diplomatic POC to three different, or now four different, organizations, I would be happy to share my experience. One regional forum of experience that we consider for the OEWG is the development of communication protocols, including for the handling of information and the creation of templates and interactive procedures. Our commitment is to foster an environment where best practices are shared and harmonized, tailoring them to fit the unique cyber landscape of all the states and regions. Mr. Chair, Canada remains engaged in the process of work on CBMs at the OEWG and looks forward to working with all other states on the development and implementation of CBMs at the global level. Thank you.

Thank you very much, Canada. I’m delighted to know that you are also the diplomatic point of contact, so you can be a very valuable point of contact to everyone else here in terms of sharing your lessons. Thank you very much for that. Singapore, to be followed by Brazil.

Thank you, Mr. Chair. Given the transboundary and rapidly evolving ICT threat landscape, cybersecurity discussions should not be viewed only from a technical or operational lens. We need to take into consideration the geopolitical dimensions and encourage dialogue in support of our efforts to enhance our collective confidence-building measures. In this regard, we welcome the option to nominate both a diplomatic POC and a technical POC in the Directory. We are pleased to update delegations that, as announced earlier, Singapore has nominated both diplomatic and technical POCs, and we look forward to participating in the initial meeting of POCs on 9th May. Given the unique systems of each State, we believe an onboarding mechanism would be useful to support States to further prepare the relevant POCs to take on this role. Regional organizations such as the OAS, OSCE, or ARF, as mentioned by several delegations, have rich experiences with their respective POC directories. States can share the best practices on how the POC directories are operationalized. The sharing of perspectives and best practices at various levels between States, Mr. Chair, can itself be a valuable CBM. In our region, the ASEAN cybersecurity leaders engage in regular dialogue at the annual ASEAN Ministerial Conference on Cybersecurity to exchange information, threats, and trends. This high-level dialogue helps our region to build a clearer idea of the cybersecurity landscape in ASEAN, allowing us to implement norms and confidence-building measures more effectively. Mr. Chair, in terms of new CBMs, we suggest that some of the prevailing regional best practices could be expanded to the intra-regional level, such as a simple intra-regional high-level dialogue or an intra-regional simulation exercise for the POCs. We also support the suggestions for additional CBMs contained in the Chair’s revised guiding questions, including third-to-third cooperation, capacity building, protection of critical infrastructure, public-private sector cooperation, and coordinated vulnerability disclosure. We further encourage further elaboration of these possible CBMs in the coming months, with a view towards including additional CBMs on these issues in our next annual progress report. Singapore stands ready to contribute to the onboarding of POCs and to share our experience in developing confidence-building measures. Thank you, Mr. Chair.

Thank you very much, Singapore, for your statement. Brazil, to be followed by Cuba.

Thank you very much, Mr. Chair. Brazil aligns itself with the statement delivered by Chile yesterday on behalf of a number of American countries and would like to also add a few remarks in its national capacity. CBMs are key to promoting an open, secure, stable, peaceful, accessible, and interoperable cyberspace. Regional organizations have played an extremely important role in advancing this issue, and Brazil has actively participated at the regional level in the OAS CBMs Working Group, which met last week, as well as in CSIRT Americas, as well as in CBMs within the context of Mercosur. It is crucial, however, to ensure that bilateral and regional CBMs continue to feed into our debates here at the UN, ensuring progress on the subject also on a global scale. You welcomed the creation last year of the Global Points of Contact Directory and the steps taken to operationalize it this year. We are currently finalizing the nomination process of our points of contact and should submit their names shortly, well ahead of the April 15th deadline. We look forward to taking part in the first meeting on May 9th. We thank you and your team for presenting substantive guiding questions on this issue for this session, including proposals for additional CBMs. Many of those appear extremely productive and are indeed already adopted by Brazil, both at national and international levels. On CIRT-to-CIRT cooperation, for instance, in addition to its participation in FIRST and CSIRT Americas internationally, Brazil has established domestically a Federal Cyber Incident Management Network, a fully collaborative and trust-based network coordinated by our national CSIRT with the purpose of improving coordination and collaboration with public and private CSOs to prevent, treat, and respond to cyber incidents and to raise the level of national resilience and maturity in cybersecurity. Other delegations have also mentioned the value of adopting a common terminology. In this regard, we take note of the ongoing work by the Mercosur Technical Group to elaborate and implement a common taxonomy of cyber incidents. Another CBM the Block has adopted is normative mapping, compiling each member’s set of regulations, laws, and decrees relating to information and cybersecurity to foster a better understanding of one another’s legal and institutional cyber architecture. Finally, Mr. Chair, Brazil also highlights the role of capacity building as a CBM and has participated in many initiatives in this regard, both as a recipient and as an implementer. We highlight, in this sense, the importance that capacity building initiatives continue to adopt a collaborative approach between recipient and donor parties in line with the agreed principles of capacity building adopted last year. I thank you.

Thank you very much, Brazil, for your statement. Cuba, to be followed by Switzerland.

Mr. Chairman, this is one of the items on which the group has reached the greatest consensus, which shows our willingness to make progress. The speed with which the global POC directory is operationalized will be important. We will not repeat our considerations on how to succeed with this initiative, but we are certain that the role of the secretariat of the group will be crucial in organizing the directory and will be an observatory, so that with the consensus of the group, we will perfect the exchange platform and add value. This will no doubt contribute to confidence building. We agree with the CBMs included in the list, and although the global directory is one which involves us all in the same way, there are regional initiatives and initiatives by groups of countries or by countries individually. There are many basic elements which have to do with confidence building, and we must make use of them to cooperate to protect cyberspace. Finally, we consider that the real confidence relationship will be achieved when every state, in addition to cooperating with one another, will act responsibly so that we avoid there being attacks of others from one’s cyberspace. Thank you.

Thank you very much, Cuba, for your statement. Switzerland, to be followed by El Salvador.

Mr. Chair, thank you for your guiding questions. But before I turn to the questions, I am pleased to inform you that Switzerland informed the Secretariat this morning about the nomination of its diplomatic and technical contacts. Switzerland is of the view that the first step to accelerate the implementation of the CBMs listed in the initial list of voluntary global CBMs is the nomination of exactly national diplomatic and technical points of contact. By participating states on a voluntary basis, the existence of a POC network and national POCs will facilitate the implementation of all further CBMs. Based on the experience of creating the POC network in the OSCE, we recommend starting out with a basic structure containing contact details of the diplomatic and technical points of contact. Overloading the elements will most probably have the result that it will take more time to establish a network and fewer states participating from the beginning. Equally, with regard to the communication protocols and templates, we would recommend that they should remain voluntary and flexible to allow for exchanges and cooperation, even if some information is unavailable. Let me add that we believe that close cooperation and regular dialogue between the operators or managers of the global POC directory and the existing regional POC directories can make an important contribution to the proper functioning of the respective directories. Mr. Chair, on the occasion of the sixth session of the Open-Ended Working Group, the cross-regional group of Open-Ended Working Group confidence builders presented a very useful working paper. The paper contains valuable examples of regional practice in the implementation of the four CBMs included in Annex B of the Second Annual Progress Report. Switzerland supports the approach of learning and benefiting from experience at the regional level. Continuous exchange between various regional organizations, but also between regional organizations and the Open-Ended Working Group, is therefore important. Promoting such exchanges is one of the aims of the OSCE CBM 12, of which Switzerland is a co-adopter together with North Macedonia, Poland, and the EU. Mr. Chair, with regard to the question of additional CBMs, Switzerland proposes to adopt a step-by-step approach. We see merit in focusing on the implementation of the first set of CBMs we have agreed on. As mentioned, the establishment of the POC network and nomination of national POCs is a first step. Such a network will help to implement the second and third CBMs on our list, exchanging good practices for responsive behavior in cyberspace, national views and practices on ICT security incidents and other related threats or vulnerabilities, ICT security advice, guidance, national strategies, or national and regional approaches to risk management and conflict prevention, including national approaches to classifying ICT incidents in terms of the scale and seriousness of the incident. Exchange on such topics will lead to better cooperation and dialogue, as well as transparency. The focus on the initial set of global CBMs does not preclude us from adding other CBMs to the initial list of voluntary global CBMs over time. While discussing such additional CBMs, states should continue to work towards the implementation of CBMs in particular at the regional level. Working at regional and bilateral levels will allow us to benefit from this experience and synergies when developing further global CBMs. In this context, and on the basis of its experience within the OSCE, Switzerland would find it useful to add the following CBMs: critical infrastructure protection, public-private partnerships, and coordinated vulnerabilities disclosures. During the discussion on threats and norms, Switzerland and many other delegations emphasized the importance of protecting critical infrastructure. A dedicated CBM on the protection of critical infrastructure could help raise awareness of the importance of critical infrastructure protection, promote information sharing among critical infrastructure stakeholders, and share good practices and guidance. Doing so will help implement norms 13F, G, and H, and underscore the interrelationship between norms and CBMs. Cooperation between states and private actors is also essential for a free, open, and secure cyberspace. States cannot achieve this on their own. Cybersecurity is a shared responsibility of all actors concerned. This brings me to the multistakeholder initiative I mentioned in our statement on rules, norms, and principles yesterday, the Geneva Manual. Among other things, it was developed with the aim of supporting the implementation of the norm on vulnerabilities disclosures. CBMs on public-private partnership and coordinated vulnerabilities disclosures would allow us to get a better understanding of the important role multistakeholders play in making cyberspace open, free, and secure, for example, by mapping existing models, practices, or lessons learned. Equally, exchange on good practices, lessons learned, or the use of an online course on coordinated vulnerability disclosures, like the one developed in the framework of the OSCE, will help implement norm 13J. Thank you, Mr. Chair.

Thank you, Mr. President, for your statement, and congratulations on submitting your nominations for the PoA directory. El Salvador, to be followed by Germany.

Thank you, Chairman. El Salvador joins in the statement made by Chile on behalf of a group of countries. For my country, we are pleased to see the tangible progress made on the development and operationalization of the Global POC Directory. We recognize the 23, well now 24, with the addition of Switzerland, which is nominated as POCs. El Salvador is making progress here. We believe that that directory is a significant step in increasing confidence internationally on ICTs. In terms of your guiding questions of possible new measures, we highlight the possibility of developing measures which have to do with protecting critical infrastructure, in keeping with norms F, G, and H of our framework for responsible behavior. This would be an important way in which to relate these norms to voluntary measures which include transparency and predictability in cyberspace. Interstate cooperation in the area of ICTs through technical assistance, capacity building, and technology transfers can also contribute to confidence building. Therefore, the consideration of measures in this area could be valuable and would connect this pillar with that of capacity building. The Organization of American States through SICTE recently carried out the fifth meeting of the working group on cooperation and confidence building measures in cyberspace. These practices could be replicated in other regional contexts or could be used within our own working group. We recognize that not all countries belong to these regional organizations. However, this group could provide a platform in which to articulate important efforts in these formats. While several of the confidence building measures of the OAS are included in the initial list of global measures which are part of the second APR, ADEX-B, it is possible to analyze the possibility of additional measures in areas such as capacity building, the establishment of working groups, promoting dialogue with other stakeholders in a more articulated manner, and also to deepen in practical terms promoting inclusion and full, significant, and egalitarian participation of women in all ICT processes. In this regard, the chair could submit to the consideration of member states additional measures based on these discussions, which could be included in preparing the next APR, in addition to the four CBMs which have already been developed on the basis of the group’s work. Thank you, sir.

Thank you very much, El Salvador, for your statement. Germany, please, to be followed by Ethiopia.

Thank you, Chair. Germany is fully aligned with the statement of the European Union and wishes to make the following remarks in a national capacity. After much progress, this group has achieved in advancing cyber confidence-building measures. Germany now looks forward to the year of advancing implementation. The Global Points of Contact Directory is set to take off this year and will provide the starting point for exercising a whole range of CBMs for the first time ever at the UN level. I am also happy to report that Germany has just transmitted to UNODA its national points of contact for the Global Directory, both technical and diplomatic, nominating two experts in each category. Germany encourages all UN member states who have not already done so to also nominate their national points of contact in order to establish a truly universal and inclusive network. The capacity-building and onboarding measures outlined in the Dedicated Assistance Plan, which was agreed as part of the 2023 Annual Progress Report, will be of crucial assistance to all UN member states which are not part of regional CBM arrangements so far and which will be joining such a network for the first time. To encourage the widest possible participation in the Global Directory, the open, informal, cross-regional group of the OEWG confidence builders held a side event for all OEWG members at the German House yesterday under the title “Getting Ready for the Global POC Directory and CBM Implementation.” The objective was to provide space for discussions on what is needed at the national level to engage in cyber confidence-building measures and to also learn about available assistance for all states wishing to join the Global Points of Contact Directory as a starting point for CBM implementation. We also received many valuable insights on operationalizing and encouraging the use of POC directories from the lessons learned of regional organizations, namely the OAS, ASEAN, and the OSCE. While much of our focus this year will inevitably be on CBM implementation, this group should also advance the discussion on the elaboration of further CBMs at the UN level. Chair, many states highlighted the role that capacity building can play as an enabler of CBMs. In addition to that, realizing the important link between cyber capacity and confidence building, the open, informal, cross-regional group of the OEWG confidence builders is currently discussing a possible dedicated CBM on capacity building. This CBM could join the list of four CBMs which have already been endorsed by last year’s APR and provide a platform for sharing information on available cyber capacity-building measures as well as on national capacity-building needs. Thank you.

Thank you very much, Germany, for your statement. Also, congratulations on making your nomination for the Points of Contact Directory. Second, I also want to thank Germany for its leadership within the Confidence Builders Group, for organizing the side event yesterday at German House, and for your continuing role in building the cross-regional group as a way to reach out and further understanding on the important issue of CBMs, as well as POC directory implementation. Thank you very much, once again, to the cross-regional Confidence Builders Group. I give the floor now to Ethiopia, to be followed by Ecuador.

Thank you, Chair. As I am taking the floor for the first time since the start of the session, allow me to start by thanking you for expertly steering the work of the group. We are confident, with your able leadership, that the work of the group continues to bring us together in our search for the consensual outcomes that we are after. Chair, as part of its digitalisation strategy, the Government of Ethiopia is exerting a vigorous effort to integrate the nation’s critical infrastructure with ICT services. We are working to maximise the multifaceted benefits of ICT to unlock growth potentials and propel our path towards sustainable development. At the same time, cyberattacks targeting Ethiopia’s critical infrastructure, such as energy, financial, education, and other vital services, are on the rise. Therefore, the expansion not only of ICT infrastructure but also the security of critical infrastructure continues to be a priority for the Government. The challenges of securing critical infrastructure are understandably the preoccupation of Member States, developed or developing. It should, however, be noted that investments to develop infrastructure are as expensive as investing in their security, and thus immensely challenging for developing countries such as Ethiopia. The need for capacity-building measures is just enormous. We therefore welcome the Working Group’s recommendation on the urgency of working towards narrowing the digital divide, including through universal, inclusive, and non-discriminatory access to ICT and connectivity. Additionally, we welcome the recommendation on the need to stipulate additional mechanisms for further strengthening international cooperation and capacity-building measures, as this can be instrumental in helping address gaps in policy, legislative, technical, and physical cybersecurity domains. Lastly, we believe more emphasis should be given to regional approaches to capacity-building, due to their potential to evolve into regular co-learning, knowledge exchange, and expertise-sharing mechanisms, while addressing the needs of States which are at a rather similar stage of development in cybersecurity. I thank you.

Thank you very much, Ethiopia, for your statement. I would also very much encourage Ethiopia to come on board the PoA directory. You can take this opportunity during this meeting to reach out to other friends who have already done so and see how you can come on board. On that point, I wish to also make the observation that among the 25 countries that have come on board as of today, nominations from developing countries will certainly require further outreach, assistance, and onboarding, as some of you have said. This is something that I also wish to share with all of you so that we can help countries, especially smaller countries, countries in Africa, small island states, and LDCs—a whole range of countries that would certainly need help. It’s not just about a numbers game of getting the numbers up; we also need to get a diverse group of countries on board to the PoA directory. This week could well be an opportunity for those of you who are here from capitals to reach out and talk to others if you need guidance or support in any way. This week is also a good opportunity to do that. Thank you very much, Ethiopia, for your statement. Let’s go on with the speaker’s list. I have Ecuador to be followed by Japan.

Thank you, Mr. Chairman. My delegation joins in the statement made by Chile on behalf of a group of countries of the Americas. For Ecuador, it is a particular pleasure to be able to discuss confidence-building measures, since this is one of the items where we see tangible progress in the group. On the operationalization of the Global POC Directory, and as you yourself indicated, Mr. Chairman, yesterday afternoon, Ecuador has named its points of contact, one diplomatic and one technical. And we hope that this Global CBM will be welcomed by many delegations, and that it will become a catalyst of confidence so that we may learn and communicate with each other intra- and inter-regionally through simulation exercises and other means. With regard to the proposal of a point of contact meeting, which would take place next May, my delegation favors a hybrid format available to all delegations. Ecuador would be grateful if the chair could provide information on what is expected in terms of the agenda for that meeting. Finally, Mr. Chairman, I would like to highlight and praise the programs and initiatives of regional and sub-regional organizations, which allow states like Ecuador to benefit from programs such as the OAS SICTE program on cybersecurity. And this could be of reference to other regions. Ecuador trusts in the dialogue and commitment to a secure, stable, and peaceful cyberspace for the benefit of all will be the main premise in the deliberations of this working group, so that we can continue to take positive steps with regard to our mandate and toward the next APR. Thank you, sir.

Thank you very much, Ecuador, for your statement. Japan, to be followed by South Africa.

Thank you, Mr. Chair. Japan would like to reiterate the importance of confidence-building measures, such as sharing cyber threat awareness, strategies, policies, and best practices with other states. Through dialogues at all levels, including among leaders, we aim to foster trust, reduce threats, and, most importantly, reduce miscalculations. Among initiatives related to the CBMs, the establishment of the Global POC Directory is one of the achievements of this Open-Ended Working Group to promote confidence-building among us. The initial operationalization of the Directory should be achieved as quickly as possible by nominating POCs for each country, and Japan is now working on its own nomination by the end of the deadline prepared by the Secretariat. We look forward to continuing the discussion on the Global POC Directory based on the views of member states on the capacities required to participate in the Directory, such as the capacity-building experiences and lessons learned through participating in other Directories. Mr. Chair, in addition to the operationalization of the Directory, it is indispensable to accelerate the implementation of CBMs listed in the initial list of Voluntary Global CBMs. In this regard, many countries, including Japan, conduct bilateral and regional dialogues, and we must continue such dialogues and initiatives at all levels, again to foster trust, reduce threats, and reduce miscalculations. Participation in multilateral discussions itself, including this one, would also be a CBM. Furthermore, it is important to consider adding more CBMs to the list to enhance confidence-building. The examples of additional CBMs suggested by the Chair in the guiding question can be the base of discussion for this. Among suggested examples, for instance, Japan believes that cooperation among CERTs is highly effective since a wide range of different countries participate in the C-CERT community. Thirty-three C-CERT teams from 24 economies are participating in the AP-CERT, the Asia-Pacific C-CERT community, to ensure reliable points of contact, conduct international cyber exercises, and share the threat landscape. More than 700 C-CERTs from government, private sector, and academia are members of the FIRST, the Forum of Instant Response Teams. Japan, through the activities of JP-CERT Coordination Center, contributes to maintaining the activities of these two communities. Finally, Mr. Chair, Japan believes that CBMs are ideally suited for the discussion and implementation through the future POA. The POA, as an action-oriented, inclusive, and permanent mechanism, should eventually be a good institution to serve as a platform for the implementation and further elaboration of CBMs at the UN level. Thank you very much.

Thank you. Japan, South Africa, to be followed by Czechia.

Chairperson, we recognize that participation in this OEWG is a confidence-building measure between States. As noted in both the 2021 OEWG and GGE reports, as the world’s dependence on ICTs continues to increase, the responsible behavior of States in the use of ICTs is of vital importance to the maintenance of international peace and security. South Africa is pleased that the proposal for a voluntary Global Points of Contact Directory under the UN Office for Disarmament Affairs has been adopted by the General Assembly. We regard the POC Directory as a first step to greater cooperation between States on identifying and responding to ICT security threats. We are in the process of appointing our POC representatives. It is crucial to operationalize both the diplomatic and technical levels of the Global POC Directory to facilitate secure and direct communications between States to help prevent and address serious ICT incidents expeditiously and de-escalate tensions which can potentially lead to conflict. We should ensure clarity of the expected roles and responsibilities of the POCs, coordination functions to be performed, and clear understandings of the readiness requirements. Chairperson, the support of the United Nations regional and sub-regional bodies to Member States would accelerate the universal implementation of the CBMs listed in the initial list of voluntary Global CBMs as adopted in the State of the Union and the United Nations CBMs as adopted in the second APR. This support could take the form of workshops and roundtable discussions to share experiences and expertise. Cooperation between States on capacity building is critical, provided the agreed principles of the first OEWG are considered. That is, capacity building should be evidence-based, politically neutral, transparent, accountable, and without conditions. The first OEWG noted in its final report the necessary resources, capacities, and engagement would allow CBMs to strengthen the overall security, resilience, and peaceful use of ICTs because CBMs would also support implementation of norms of responsible State behavior. In this regard, the proposals for public-private partnerships would support national implementation and development of CBMs. Cert-to-cert cooperation would also enhance confidence between States. Chairperson, we support collective effort by all Member States and relevant stakeholders to ensure an open, secure, stable, accessible, and peaceful ICT environment. Thank you.

Thank you very much, South Africa. Czechia to be followed by Australia.

Thank you, Mr. Chair, for giving me the floor. Czechia aligns itself with the EU’s statement on CBMs from yesterday, and we wish to emphasize a couple of points in our national capacity. As part of my statement today, I would first like to share how Czechia approaches the nomination of POCs. Czechia decided to nominate POCs to the Global POC Directory based on its experience from regional organizations, specifically the OSCE. Our experience shows that it is appropriate to nominate two diplomatic and two technical POCs. In this way, the contacts can replace each other if one of them is not present for some reason. In addition, we believe that technical POCs do not have to be directly from CSIRTs. It is sufficient if the technical POC is in regular touch with the specific technical experts to whom the information sent through the POC’s directory concerns. In the Czech case, the technical POCs are representatives of the International Cooperation Department of the National Cyber Agency. We welcome that the first meeting of POCs will take place in May and is sensitively planned in relation to other May meetings, including the Global Roundtable on Cyber Capacity Building. Regular, once-a-year, ideally in-person meetings of POCs are important CBMs that improve mutual communication. Czechia also welcomes that the first pink test is scheduled already for this half-year. We believe that this test will show that the majority of states have already nominated their POCs and that we, as a community of states, are ready to move to the next stage and start actively using the POC directory. Czechia already indicated during the previous OEWG session that we actively contribute to the good functioning of the regional OSCE POC directory, where we share and regularly update relevant information regarding cyber security, and we are ready to do so also on the UN level. We believe that sharing practical information such as national ICT concept papers, national strategies, policies, and programs is the best way to further enhance the effective functioning of the POC directory and improve the directory’s ability to facilitate communication between states. To answer your guiding questions, Mr. Chair, I would like to respond to whether there are additional CBMs to be added to the initial list of voluntary CBMs. Czechia repeatedly mentioned that we should first focus on elaborating and implementing already agreed CBMs, so we don’t have them on paper only. However, there are definitely more CBMs that could be discussed and potentially added to the initial list. Czechia is specifically a strong supporter of measures aiming at the protection of critical infrastructure and coordinated vulnerability disclosure. In response to your next guiding question, Czechia would like to highlight the link between CBMs and capacity building. In our understanding, these issues are interconnected, and CBMs and capacity building enforce each other mutually. Another guiding question that we want to respond to is related to the communication protocols and the possible further development of interaction procedures. In this context, Czechia would like to note that at this stage, it would be counterproductive to overwhelm the initiation of the POC directory with topics concerning specific procedures, the form of protocols, development of templates, and so on. According to us, the appendix to Annex A of the 2023 APR that mentions the procedure for inquiry and the procedure for responding to an inquiry is sufficient in this regard. Finally, Czechia wishes to commend our German colleagues for initiating and leading a cross-regional group of states that Czechia is a member of and that continuously brainstorms for novel ideas and practical suggestions regarding the POC directory and other CBMs. I kindly thank you very much.

Thank you, Czechia, for your statement. Australia, to be followed by Mauritius.

Thank you, Chair. Australia would like to highlight and endorse the work that continues to be undertaken by the Open Informal Cross-Regional Group of Confidence Builders, in particular the side event that the group hosted during lunch yesterday at the German House on getting ready for the global POC directory and implementation of CBMs. The side event focused on sharing best practices on the establishment, management, and use of cyber points of contact in various regional contexts and provided information about existing support mechanisms and resources, including UNIDIR’s report on operationalising a directory of points of contact for cyber CBMs. The global points of contact directory represents a valuable signal of our joint commitment to building confidence. We thank you, Chair, and the Secretariat for your efforts to breathe life into this POC directory, including the briefing that was provided on 31 January. Australia has provided its diplomatic and technical contacts to the Secretariat for the global POC directory, and to echo the comments you made in your opening remarks, Chair, we strongly encourage all members, where they can, to nominate their points of contact as soon as practical. We recognize that not all states will be in a position to nominate their POCs immediately, so we support the Chair’s request to encourage all states to nominate what details you do have, with scope to provide updates at a later stage. The work undertaken to discover the right contact points within our own systems can be an internal confidence-building measure in and of itself, particularly as officers rotate across responsibilities and domestic government structures shift over time. Building upon a theme of our meeting this week, Australia encourages all states to continue to share concrete examples of how we implement cyber CBMs, and particularly the initial list of global CBMs elaborated in our 2023 APR. A collection of some examples is set out in a joint working paper of the Cross-Regional Group of Confidence Builders, published on the OEWG website ahead of our sixth session in December last year, which the delegate from Switzerland also highlighted. This paper strives to further advance the elaboration of the first set of CBMs at the global level by drawing on and transparently sharing best practices and implementation examples from existing regional and national contexts, including partaking in regional POC directories, of which Australia and Malaysia manage the ASEAN Regional Forum POC directory, by providing a more practical angle to our discussions and serving as encouragement for member states less familiar with CBM implementation. Australia has listened carefully to the proposals from some states to develop new CBMs in our group, and we are interested and open to building upon many of these ideas. In particular, we consider that any new CBMs should be explored and, if appropriate, elaborated in the context of our framework for responsible state behavior in cyberspace, and always with reference back to the core aim of a confidence-building measure, that is, to endeavor to build relationships and procedures in times of peace and stability that can be used for de-escalation in times of crisis. In doing so, CBMs aim to diffuse tensions and the risk of destabilizing misperceptions between states. To this effect, and in response to your guiding question, Chair, about what additional CBMs we could potentially add to the initial list, Australia continues to support further discussions on the 2021 GGE report recommendation for transparency regarding ICT security agency missions and functions, and the legal and oversight regimes under which they operate. These transparency measures can be effectively operationalized through another proposal of the 2021 GGE, which encourages states to voluntarily use UN resources, such as the UNIDIR Cyber Policy Portal, including the National Survey of Implementation of UN Recommendations on Responsible Use of ICTs, to consolidate information and good practices provided voluntarily by states on national strategies, policies, legislation, and programs that address ICT security issues relevant to international security and stability. Thank you, Chair.

Thank you very much, Australia, for your statement. Mauritius, to be followed by Colombia.

Good morning, Chair. In an increasingly interconnected world, where the threat landscape is constantly evolving, no single entity or organization can combat cyber threats alone. The interconnected nature of cyberspace necessitates collaboration and coordination among CSIRTs across national borders, sectors, and industries. It is through collective action and information sharing that we can effectively confront the challenges posed by cyber adversaries and protect our shared digital assets. In terms of confidence-building measures, let me highlight that Mauritius is working closely with the local, regional, and international communities, including government, law enforcement, academia, the research community, CSIRTs, and cyber security partners in terms of incident response, cyber threat information sharing, and capacity building. Mauritius fully supports CSIRT-to-CSIRT cooperation as such collaboration facilitates the exchange of information in a timely manner for preventing cyber incidents as well as providing support in incident response activities to enhance the cyber security posture of countries. I would also like to highlight that the National CSIRT of Mauritius is a member of various international organizations such as the Forum of Incident Response and Security Teams and Trusted Introducer (TI). Moreover, Mauritius is also a member of the SADC CSIRT task force along with six other countries. To further promote the CSIRT-to-CSIRT collaboration, Mauritius would like to extend its support and cooperation with regional and international CSIRTs through memoranda of understanding in different aspects of cyber security, including incident response, cyber threat information sharing, and capacity building. Mauritius believes that such cooperation would also help to close the digital divide. Coming up to the protection of critical infrastructures, it is crucial to note that vulnerabilities in these systems pose significant risks to national security, public safety, and economic stability. In this regard, we believe that POCs could be a concrete way to enhance the sharing of critical information, which is particularly relevant in cyber events with the risk of potential escalations. Moreover, we support the inclusion of the private sector as it is important and in line with promoting public-private partnership and practical cooperation with relevant stakeholders. With regard to a coordinated approach to vulnerability disclosure, Mauritius supports that such an approach will help to identify and remediate vulnerabilities in critical systems, such as energy, transportation, or healthcare, before they can be exploited by cyber threat actors. Many international cyber security frameworks and standards, such as ISO 29147 and ISO 30111, recommend or require the establishment of coordinated vulnerability disclosure processes as part of good cyber security practice. In this perspective, Mauritius is of the opinion that by incorporating CVD into their respective cyber security strategies, states can demonstrate their commitment to transparency, accountability, and proactive risk management in cyberspace. Thank you, Chair.

Thank you very much, Mauritius, for your contribution. Colombia, to be followed by Argentina.

Mr. Chairman, Colombia joins in the statement made by Chile on behalf of a group of countries from the Americas on CBMs. In the framework of the fifth meeting of the Working Group on SITKE in the OAS, the countries of the region were able to establish a dialogue and share up-to-date information on policies on cybersecurity at the national level. We discussed the implementation of CBMs in the hemisphere, and we learned about the experience and national positions on the application of international law to cyberspace. With regard to the question about additional measures which could be added to the initial list of voluntary global CBMs, and taking into account the work of the OEWG, we think that the initial measures are good, in particular CSIRT cooperation and interstate cooperation in building capacity to close the digital divide, critical infrastructure, and public-private partnerships. We also suggest including CBM7 of the OAS on the promotion of the inclusion, participation, and leadership of women in decision-making processes with regard to ICTs in order to approach gender equality and closing the gender divide. We are aware of the fact that to have new CBMs doesn’t necessarily mean a safer cyberspace unless they are implemented. Thus, we must understand CBMs as an enabler for things like exchanges of information, experiences, and responses from states. All of this will contribute to ensuring that all states will achieve the right levels in critical infrastructures and adequate management and incident response activities, also in cases of malicious activities in their territories or vicinity. Chairman, in response to your question on the global directory, we are convinced that its operation will be an important step in confidence-building among states globally. Thus, and in order to contribute to that purpose, Colombia already named its POC technical and diplomatic. While we understand that the initial format is to have an updated global POC directory, we think that it has the potential of being a platform to make progress on the implementation of global CBMs and to develop protocols of universal communication to facilitate information sharing and cooperation. This last point is particularly relevant for our delegation since Colombia is interested in expanding and improving mechanisms on information sharing on cyber incidents, including processing and analysis. With regard to the meeting on POCs for the month of May, we suggest that it be in hybrid format with the participation of all states, including those who have not named a POC. We think that there should be the maximum possible representation and participation so that states, especially those which are not members of regional directories, may become familiar with the format. Finally, and responding to your request about views about participation in the global POC, the conference – the CBM group led by Germany yesterday led an event in order to exchange experiences and good practices in the establishment, management, and use of POCs in regional contexts. Thank you.

Thank you very much, Colombia, for your statement. Argentina, to be followed by Malaysia.

Thank you, Mr. Chairman. My delegation joins in the statement made by the distinguished delegation of Chile yesterday on behalf of a group of 17 countries, and I would like to have the following comments in my national capacity. Argentina supports the development of CBMs at all levels, and we believe that this working group is key, and it represents in and of itself a confidence-building measure. My delegation firmly promotes the adoption of transparency measures and information sharing on cyber security. This leads – and this is in Mercosur, with Brazil, Uruguay, and Paraguay, and also in the context of the OAS. We have designated our points of contact for the global directory. We welcome the 25 delegations that have made their designations, and we encourage delegations that have not yet done so to name points of contact as priorities in their cyber security agenda. We also encourage the chair to continue its efforts to help states that have not yet done so to identify the best possible points of contact. The global POC directory will only be able to work effectively and lead to the expected results when it is truly inclusive and universal. We also recognize the potential of the directory in facilitating the adoption of other global CBM initiatives and strengthening other matters which are being discussed in this group. By way of an example, the exchange of information that will take place in the global directory could be used in a future repository on threats as proposed by the delegation of Kenya. We also believe that the directory could include spaces in which to exchange confidential information and mechanisms to interact with the private sector, academia, and civil society. We also encourage the chair to carry out activities and simulation exercises in virtual format or hybrid to guarantee that the points of contact of all the regions of the world, especially in developing countries, will become familiar and benefit from the mechanism. With regard to the POC meeting in May, we support the proposal by Ecuador and Colombia that it be carried out in hybrid format. Chairman, my delegation would also like to stress the complementarity between technical cooperation at the international level on capacity building and infrastructure, taking into account regional realities and the specific needs of each country, and confidence-building measures. As an example, a fundamental CBM, such as the designation of POCs for the global directory, could represent a considerable challenge for those countries which are beginning to build their capacities, including attention to necessary software and hardware to detect vulnerabilities. My delegation therefore supports the proposals of other delegations to create a specific CBM on capacity building to take into account the specific national and regional needs. Recognition of the common and shared responsibility for mitigating cyber threats and concrete measures being taken internationally to create a more resilient cyberspace, especially in regions which are exposed to greater vulnerabilities in their infrastructures, will greatly contribute to creating trust.

You’re welcome! If you have any text that needs proofreading, please go ahead and share it. I’ll be happy to help.

Thank you, Chair, for giving me the floor. Malaysia would like to share our views on confidence-building measures. Mr. Chair, you asked how to accelerate and further operationalize the universal implementation of the CBMs listed in the Initial List of Voluntary Global CBMs. With the four agreed initial CBMs, the CBM1 UN Global POC, as agreed by others, will serve as a basis for the implementation of other CBMs, and Malaysia looks forward to the operationalization of the POC. We promise you, Chair, that we will submit the nomination accordingly. Malaysia thanks Australia for the explanation on the ASEAN Regional Forum POC. Malaysia also shares the view of many other states supporting the incremental approach to the establishment and operationalization of the POC directory. Yesterday, during the discussion on norms, Vietnam reminded us of the UN Charter’s call for us to be good neighbors. Just like Vietnam, Malaysia believes that being a good neighbor is as relevant today as it was seven decades ago. In fact, it is more important today than ever before. This is because today’s neighborhood boundaries are not confined to physical limits. Instead, they also depend on the technology platforms that we use and where our infrastructure and data reside, whether on physical premises, in a hybrid environment, or on the cloud. Although we are geographically located in different regions, if we reside on the same technology platforms, we may inherit the same vulnerabilities and threats. Mr. Chair, cyber security is also about how well the best effort that we have done to ensure our cyber hygiene and assist others in need, starting from information sharing, incident responding, awareness, exchange of experience, and many more. This is about being good neighbors. In this regard, Malaysia shares the view of the Republic of Korea on public-private partnership at the national level that will further increase national visibility to cyber threats and vulnerabilities. Increasing national threats and vulnerabilities require not only technical capabilities to detect, defend against, and respond to and recover from ICT incidents, but also a national coordination procedure in enhancing cooperation on cyber security matters at the policy and diplomatic level. In this regard, Malaysia aligns with India that CBMs are the enabler for the implementation of norms by fostering trust, predictability, and stability in ICT use. It is also demonstrating what is expected from a good neighbor. At the national level, we know that many organizations face cyber threats and although technical experts can often trace the origins of these threats, acting against the perpetrator extends beyond technical challenges and requires global collaborations. As mentioned by Malaysia during the discussions of existing and potential threats, the true test of trust is verifiability. The element of verification in this regard, technical verification, will provide a level of confidence and assurance in this trust-building exercise. On the other hand, CBMs are a tool in building trust that is verifiable to strengthen the framework of responsible state behavior. Mr. Chair, with regards to the additional CBMs that can be added, Malaysia supports others for the protection of critical infrastructure, public-private partnership, state-to-state cooperation, and coordinated vulnerability disclosure to be considered as additional CBMs. This is also aligned with the voluntary, non-binding norms of F, G, and H. Thank you, Chair.

Thank you very much, Malaysia, for your statement. You’re absolutely right that technology has made all of us neighbors. And the idea of the OEWG and the POC directory and the CBMs is for all of us to be good neighbors to each other, because everyone automatically, because of technology, ICTs, everyone is a neighbor to everyone else, almost instantaneously. Thank you for your statement. I give the floor now to the Islamic Republic of Iran, followed by France.

Mr. Chair, thank you for giving me the floor. In response to your guiding question about additional CBMs that can be added to the initial list of voluntary global CBMs, my delegation would like to propose the following measures. First, developing a consensus universal terminology on technical ICT terms. The lack of common understanding constitutes a major potential source of mistrust in the ICT environment. In paragraph 42 of the second APR, states are encouraged, on a voluntary basis, to share national views on technical ICT terms and terminologies to enhance transparency and understanding between states. While sharing national views in themselves could serve as a confidence-building measure, as the next concrete and important step forward, these national views could be the basis for further discussions by the OEWG at its upcoming sessions to develop a consensus universal terminology in the field of ICT security. Developing a consensus terminology is one of the concrete and specific CBMs that are currently adopted by some regional organizations in the ICT security domain and could be expanded to the global intergovernmental context. A step-by-step approach could be applied to the elaboration of a universal terminology in the field of ICT security. OEWG could start by preparing a list of terms that are used in consensus UN documents and then proceed to agree upon definitions of the basic terms from this list. In this regard, we share with the statement made by Kazakhstan and Brazil concerning the importance of developing terminology in technical ICT terms. Second, cooperation between states on capacity building to close the digital divide. In line with many other delegates who have taken the floor before my intervention, we also welcome this important confidence-building measure as outlined in the Chair’s guiding questions based on discussions at recent sessions of the OEWG. Since the very act of collaborating to implement joint projects could build confidence and trust, my delegation has underscored throughout previous OEWG sessions that cybersecurity capacity building could be a constructive confidence-building measure. In the second APR, the OEWG recognized that capacity building is an important confidence-building measure and is a topic that cuts across all the pillars of its work. Third, unilateral coercive measures against other states in the ICT environment pose serious threats to trust and confidence in the ICT environment. Therefore, it is an important confidence-building measure that states refrain from adopting any measures that restrict or prevent universal access to the benefits of ICT. Fourth, developing a legally binding instrument within the United Nations. This measure, which effectively promotes the exclusively peaceful use of information and communication technologies, ensures the prevention and settlement of inter-state conflicts in the global information space and provides a framework for cooperation among states, holds particularly significant potential as a confidence-building measure. Such an instrument can substantially enhance mutual trust and understanding among states, thereby contributing to a more stable and secure global information environment. Mr. Chair, during the current and previous OEWG, states concluded by consensus that the OEWG itself serves as a CBM, providing a forum for discussing issues on which there is agreement and issues on which there is not yet agreement. As a result, what other significant confidence-building measures could be recommended in addition to the evolution of the OEWG into a permanent mechanism for ensuring the security of information and communication technologies? The OEWG that has proved in practice its efficiency and relevance is the most appropriate format for future regular institutional dialogue under the auspices of the United Nations. In this regard, we would like to recall that concept paper on a permanent decision-making open-ended working group on the security of and in the use of information and communication technologies proposed by a group of countries. I thank you, Mr. Chair.

Thank you very much, Islamic Republic of Iran, for your statement. France, to be followed by Pakistan.

Thank you, Mr. Chair. My delegation aligns itself with the statement of the European Union and would like to thank the confidence builders of the Open-Ended Working Group presented by Germany in this session. I will speak about two issues, which we have shortened in the interest of time but will include in our written presentation. First, France would like to welcome the work of operationalizing the Directory of Points of Contact. This is a very valuable step for international cooperation. France has submitted its own national points of contact. We have called on OEWG to be inspired by regional experience – for example, inter alia OSCE’s experience – in improvements and in further development. I will share a recent instance where French points of contact were contacted by members of the regional organizations to which we belong. France usually has limited operational contacts with this country. It was hard to find sources to obtain information without a directory available of points of contact. This is a specific example of the operational value of the points of contact directory as a CBM that was put in place at the regional level and, of course, is valuable internationally. Secondly, I would like to dwell on the long-term plans for which we fully support this activity. The normative framework is the foundation for our work and has been implemented in the various processes that took place within the United Nations system. In the same way, structural initiatives such as the Directory of Points of Contact put in place by OEWG will also have long-term value for its activity in terms of future mechanisms. Thank you very much.

Thank you very much, France, for your statement and also for sharing your experience with the regional POC contact directory. Pakistan to be followed by Djibouti.

Thank you, Mr. Chair. Pakistan has remained supportive of the idea of confidence-building measures in cyberspace. In view of emerging threats emanating from cyberspace, Pakistan considers the establishment of a Global Directory of Points of Contact as an important CBM, which could help in averting mistrust among member states during a cyberattack or in a related situation. The Global Directory of POCs would also help in fostering trust, cooperation, and transparency among the member states. We support the operationalization of POCs and will be submitting our details of diplomatic and technical POCs soon. We are also looking forward to participating in the initial meeting of POCs in May this year. To accelerate the universal implementation of CBMs listed in the initial list of Voluntary Global CBMs, it is crucial to prioritize capacity-building efforts, including equipping the member states with the required tools, necessary technology, and expertise to make their national cyberspace secure and stable. Tabletop exercises, cyber drills, the exchange of best practices, and continued dialogue could be useful in achieving the desired result. We also support facilitating the real-time sharing of threat information through digital platforms. Chair, regarding the additional CBMs, we also support the idea of a step-by-step approach. While reaffirming the voluntary nature of CBMs, we believe the state can exchange views on side-to-side collaborations, digital divide mitigation, safeguarding critical infrastructure, and fostering public-private sector partnerships to enrich the existing framework and address emerging cyber threats effectively. We also propose discussions on the adoption of CBM areas such as research investment and cybersecurity-related projects, and countering fake news and disinformation. In conclusion, my delegation also supports the development of shared and clear definitions of various cybersecurity terminologies. I thank you, Mr. Chair.

Thank you. Pakistan, Djibouti, to be followed by Botswana.

Thank you, Mr. Chair. Chair, this is the first time that I’m taking the floor in this session, and therefore I’d like to congratulate you on your excellent leadership of our work and thank you for the document you put at our disposal to guide our discussion. I would also like to thank the Secretariat and the interpreters. With Djibouti, cyberspace and the emerging new technologies present a chance to advance in our plan for development. We’ve made it a national priority. For that reason, a special ministerial department headed by a woman was created and put in charge of digital economy and innovation in 2021. With the support and cooperation of our international partners, we’re working hard on capacity building to train young engineers so that they are up to speed on what is needed in terms of meeting our concerns, making our infrastructures secure – our critical infrastructures secure – and to constantly monitor potential malicious activity in cyberspace. Let me on this occasion dwell on the issue of applying international law to cyberspace. My delegation joins the Common African position in that regard. I would also emphasize the importance of taking into account the specificity of cyberspace. Based on our discussions, our exchanges, we would recommend that we continue this multilateral dialogue to make sure that a consensus-based approach emerges, which will make it possible for us to truly make cyberspace secure with global and consensus-based activities. Regarding confidence-building measures, my delegation believes that this platform for discussion in our working group, and particularly the development of a directory of points of contact, are effective approaches. We’d like to take this opportunity, the opportunity offered by this new platform for discussion, to better understand the concerns of everyone. And we will very shortly submit our own points of contact. Mr. Chair, in view of the current geopolitical situation, the arms race involving new technologies, the digital threat is inevitable. Therefore, we believe that peace in the world is the primary requirement to make sure that we reach our objectives, create – protect cyberspace, and strengthen confidence and trust among states. Furthermore, strengthening the capabilities of developing countries through training and funding with international cooperation would allow us to bridge existing gaps, and this would also be a contribution toward confidence-building measures. Still, we must never lose sight of the fact that developing countries need to find sustainable solutions by addressing the deep roots of the digital gap, such as insufficient electricity resources for some countries and conflicts in other countries remain a priority. Thank you very much.

Thank you very much, Djibouti, for your statement. Botswana, to be followed by Israel.

Thank you, Chair. Since this is Botswana’s first time to take the floor, we wish to thank you, Chair, and your team for steering the work of the OEWG. Botswana pledges its unwavering support to the process. Confidence-building measures are intended to improve trust and understanding between States, and the annual progress report adopted by consensus in July 2022 indicates the importance of coming up with specific confidence-building measures and calling for States to make concrete, action-oriented proposals on CBMs. The OEWG has been touted as a confidence-building measure in itself in this regard. Chair, in your guiding questions, you inquired how we can accelerate the universal implementation of the CBMs listed in the initial list of voluntary global CBMs. Our delegation is supportive of using regional organizations to accelerate universal implementations of these CBMs and to leverage their accessibility and influence over their members. The same regional organizations should be employed to further operationalize the CBMs through related capacity building and the global POC directory. The Botswana delegation supports the addition of the following CBMs: search-to-search cooperation to enhance the effectiveness of combating threats, vulnerabilities, and security incidents. Botswana also supports the inclusion of CBMs and cooperation between States on capacity building to close the digital divide, the protection of critical infrastructure to preserve essential services, as well as public-private sector cooperation, which allows the public and private sector to share resources and information so as to advance effective strategies to counter cyber threats. Chair, we have heeded your call to appoint points of contact, and Botswana is currently undertaking the national process of appointing contacts on technical and policy levels and will be submitting in the very near future. We also look forward to the initial meeting of the POCs in May. Chair, our delegation knows that capacity building efforts present an important contribution to building confidence and trust between States. Capacity building can assist States in developing their national strategies, policies, and procedures for effective cyber security and to strengthen capacities to protect critical infrastructure and, in that, building trust and confidence between States. Thank you, Chair. Thank you.

Thank you very much, Botswana, for your statement and also for your indication that you would be submitting your nomination and that you’re considering the issue very carefully. It’s very much appreciated, and I also took note of the statement by Djibouti earlier that they too are considering and looking at the question of nomination. I think these are very important. Do let your friends know if you need help. There are many in this room, and after you’ve done your nomination, please look for another friend from your region to bring on board. Thank you very much. Israel to be followed by Fiji.

Thank you, Chair, for giving us the floor to present our national perspective on the important pillar of CBMs. Israel regards the discussion on confidence-building measures as an essential and significant part of the Open-Ended Working Group work. Developing effective and sustainable international cooperation requires, in our view, a solid base of trust. In this context, exchanges of know-how, a global POC directory, the sharing of best practices, cybersecurity methodologies, risk assessment models, threat analysis, trends, patterns, et cetera, can play an important role. CBMs attempt to build relationships and procedures in times of peace and stability, elements that can be used for de-escalation in times of crisis. On the global POC directory, Israel will nominate its POCs in the very near future to meet the traditional UNODA deadline, and we look forward to working together with all the POCs to operationalize the directory and make it serve as a useful and meaningful tool, enhancing trust and international cooperation. Mr. Chair, in order to offer a concrete suggestion that can be elaborated within the Open-Ended Working Group process, and with a view to advanced CBMs that can be operationalized in a voluntary, non-binding manner at the UN level, Israel, together with an open group of cross-regional states, continues to hold joint discussions and brainstorm for ideas aiming to present some novel and practical suggestions. We wish to join others in commending our German colleagues for continuing to lead this group, as well as thanking all the group members for their very active participation and useful contributions. During recent sessions of the Open-Ended Working Group, considerable progress has been achieved on the way to operationalize CBMs at the global level. In order to use this positive momentum, the group’s work is dedicated to discussing and advancing ideas on how we can learn from national experiences and the multifold regional expertise on how CBMs can be used at the global level to build the needed trust, reduce chances of misunderstanding, and assist in making cyberspace more secure and stable. The group has been extensively working on advancing the global POC directory and operationalizing it, and also circulating other ideas that will be presented to all member states. In addition to extensive bilateral information sharing, Israel supports CBMs’ efforts on the regional and cross-regional levels. Israel supports the important work that has been carried out by the OSCE, and Israel, as a Mediterranean partner, also contributed its vast experience in that field. Furthermore, Israel is an active partner of the GFCE framework. A multistakeholder and cross-regional forum like the GFCE can contribute and assist states and all stakeholders to better share and build the needed trust. To conclude, Mr. Chair, at the heart of Israel’s international cyber strategy, we have stressed our efforts to help build and advance global cyber resilience, and we are ready to work together.

Thank you very much, Israel, for your contribution. Fiji, to be followed by the OSCE.

Chair and colleagues. Chair, in your opening remarks earlier this week, you reminded us that we need to continue to build and rebuild the baseline of confidence between delegations. Chair, this reminds me of a trust-building concept and a traditional tool that we use in Fiji known as the Spirit of Talanoa. This is also used in the Pacific, and it usually requires Tanoa and Kava or Yangona, and this can also be easily arranged, Chair, later. But I’d really like to hone in on the three core components in order for the Spirit of Talanoa to truly take place: it needs to be inclusive, it needs to be participatory, and there needs to be genuine dialogue. Chair, drawing from the Spirit of Talanoa and pursuant to the annual progress reports, in doing our part to continue to build trust, confidence, and transparency, Fiji would like to highlight a number of initiatives that we’re undertaking with great priority and urgency in implementing the global CBMs. Fiji notes with appreciation the enhanced cooperation efforts that have already been taking place within this OEWG with member states and multilateral agencies, and which continue to build common understanding and increase confidence. Like many countries, Fiji is also actively assessing the designation of a point of contact, and being part of the CBM cross-regional group has really enabled Fiji to develop our understanding of the characteristics and the purpose of such points of contact. We thank Germany for leading this group and the members of the CBM group and other states for sharing their experiences in this regard. Chair, Fiji commits to submit our points of contact details at the earliest as well, Chair. And with regards to the meeting in May, we also support the meeting to be in a hybrid format as stated by Colombia and Ecuador and request that the respective time zones also be considered. We also urge all countries to continue to progress in our collective efforts and to designate their points of contact as well within the timeline that has been set for all of us. At the international level, Fiji’s implementations of CBMs include the co-sponsoring of cross-regional proposals, invitation and participation at global cybersecurity forums, including the Singapore International Cyber Week as well, invitation to participate at side events with a number of member countries or groups of countries, and further developing our understanding during our OEWG sessions and particularly the meetings outside of our formal meetings in this room. Within the Oceania region, our cybersecurity mandate is underpinned as a region by the 2018 Boe Declaration and our 2050 Strategy for the Blue Pacific Continent and its recently launched implementation plan of last year. Cybersecurity is one of the key priorities. In September of last year, Chair, the regional ICT ministers also met and they signed the Lakatoi Declaration. And two of the key pillars are digital trust and security, and capacity building and also representation. The senior officials are currently drafting the action plan of the Lakatoi Declaration, and Fiji values drawing from the OEWG work that we’re progressing, including the POC directory, and to operationalize these CBMs in the regional context. Fiji is committed to synergizing the global and regional efforts. Now, as demonstrated in Fiji’s hosting of the regional cyber leaders at the inaugural Pacific Cyber Capacity Building and Coordination Conference that was held last October, the region really looked at better understanding and recalibrating the priorities of the Pacific Island countries and understanding what’s working, what’s not working, why isn’t it working, and to better streamline the capacity building and CBM efforts. And we look forward to further collaboration to ensure that we fast-track our collective efforts. Chair, nationally, we have a Cybercrime Act, which is aligned to the Budapest Convention on Cybercrime. We’re eagerly looking forward to the work that the UN Ad Hoc Committee is also doing and also participating in that regard. And we’re in the process of reviewing our national cybersecurity strategy due to the rapid acceleration of digital technologies and due to evolving threats. In fact, Chair, last week, we commenced our second cybersecurity maturity model assessment for states. And we convened tailored focus group sessions with over 70 stakeholder groups and entities nationwide. We’ve also started the development of our national digital strategy and national e-commerce strategy, and improving our national cyber well-being and collaborative methods are core focus areas in these strategies as well. Moreover, the forthcoming national CERT that we’re establishing underscores our commitment to enhancing incident response, coordination, and safeguarding critical infrastructure services for all Fijians. Last December, and as a domestic confidence-building measure, we commenced the process of better understanding the characteristics of critical infrastructure and critical information infrastructure, and the identification and categorization of how states have done this. We welcome further collaboration in this regard, and these efforts continue to be a priority for us. Fiji is committed to continuing to progressively implement the initial list of voluntary global CBMs, and as per your guiding question, Chair, Fiji welcomes the additional CBMs, which we see can be progressed in parallel to the existing ones. For example, the cooperation between states on capacity building to close the digital divide is of significant importance, and Fiji refers to our statement earlier this week made in that regard. With regards to a second proposed CBM, Chair, we propose to amend the additional CBM of protection of critical infrastructure to identification and protection of critical infrastructure and critical information infrastructure. Chair, equally important, given that half of the global population are women, in order for this group to continue to forge ahead sustainably, it is crucial, and as stated by other delegations, that we need to ensure that the full, equal, and meaningful leadership and participation of women continues to be championed in our work, and evident across the cumulative and evolving framework for responsible state behavior in the use of ICTs. This is fundamental. In closing, Chair, and coupled with this, and to ensure that no one is truly left behind, we strongly advocate for the meaningful participation of the multistakeholders, as they offer immense value and expertise to the work that we’re doing, and we remain committed to this global objective. Thank you, Chair.

Thank you very much, Fiji, for your statement and for sharing with us in a very detailed way your national efforts and also your regional efforts. I think your efforts are a good example of how a small country like Fiji, by participating in the process, is also able to share with all of us your own experience but at the same time use this process to hopefully get greater support and partnership for your efforts nationally. I’m also very encouraged to hear that the Pacific leaders have met and endorsed the cyber strategy. I hope that you will follow the example of the African Union. We look forward to seeing inputs from the Pacific, and I think Fiji’s role in that regard would also be very important. And lastly, I endorse certainly the Talanoa spirit. I think it’s good to have some kava around, especially on a Friday evening. Thank you very much, Fiji, for your statement. So I think it’s just as well we are hearing from OSCE as the last speaker. There’s been a lot of talk about regional organizations, and so OSCE, over to you. I look forward to hearing what you have to say.

Thank you so much, Chair, for giving me the floor and also kind of putting a little bit of pressure on me regarding my statement. Indeed, many of the OSCE participating states and other states have mentioned the OSCE, so I’m very grateful for that. The Organization for Security and Cooperation in Europe has a 10-year experience in developing and implementing regional cyber confidence-building measures. The OSCE participating states are committed to operationalizing the 16 cyber ICT security CBMs. The OSCE Secretariat supports states in these efforts, and I would like to share some examples of this experience. Chair, in your guiding questions, you mentioned the possibility of developing additional global CBMs, among others related to public-private partnership, critical infrastructure protection, and coordinated vulnerability disclosure. I would like to inform you that the OSCE participating states have adopted regional CBMs on these three topics. Implementation of the CBMs creates trust and confidence and, at the same time, builds capacities and creates national cyber resilience. The work done related to these OSCE confidence-building measures might inform the discussions here in the OEWG. I would like to share some tools the OSCE participating states have developed regarding the above-mentioned three topics. A report on emerging practices in cybersecurity-related public-private partnerships and collaboration in the OSCE participating states. This report is a result of research conducted on concrete examples of public-private partnerships for cyber ICT security. It presents emerging practices in PPPs as baseline recommendations and promotes public-private collaboration as an important element in strengthening national cyber resilience and international cyber stability. The report is publicly available on the OSCE website in English and recently also in Arabic. Related to critical infrastructure protection, we have published a report titled “Cyber Incident Classification,” a report on emerging practices within the OSCE region. The report highlights emerging practices and provides recommendations on national classification of cyber incidents by underlining commonalities in existing approaches to cyber incidents classification among OSCE participating states and identifying limitations in this process. The OSCE has also developed a publicly available e-learning course on coordinated vulnerability disclosure. It provides an overview of CVD as a tool to strengthen national, regional, and international cybersecurity. Over six modules, it gives an overview of the coordinated vulnerability disclosure process, the main stakeholders, and their roles and responsibilities, as well as looks at some of the main challenges of the process. The OSCE Secretariat follows the deliberations at the OEWG and encourages all OSCE participating states to engage in and contribute to these discussions. During our training events, we give regular updates on the developments in the OEWG. Furthermore, we conduct every year a cyber diplomacy training for OSCE participating states with the aim to create a better understanding of the framework of responsible state behavior in cyberspace and to enable them to meaningfully engage in international cyber policy deliberations both at the OSCE and the UN. In this period, we have continuously updated the OSCE cyber points of contact about the establishment of the global points of contact directory. With the aim to raise awareness and encourage nominations, we have forwarded to all the OSCE CBM points of contact UNODA’s notarial on the call for the nominations for the global points of contact directory. I hope you will receive many nominations from the OSCE participating states. At the same time, we will continue to keep OSCE participating states updated on the developments on the global POC directory. I was delighted to hear Kazakhstan and France share concrete examples of how they have used the OSCE points of contact network to reach out to another participating state. As the manager of the network, I’m usually not informed about exchanges between POCs, so it’s good to receive such feedback. To conclude, I would like to reconfirm the OSCE Secretariat’s continued support for your efforts, Chair, and our readiness to share experiences, as well as our commitment to cooperate with UNODA on these issues. Thank you.

Thank you very much, OSCE, for your statement. I think that’s a good note to, in a sense, wrap up this discussion on confidence-building measures. I have no other speakers. Once again, I’m not going to make a summary, but just share some reflections. So, if you think I omit anything important that has been said, please forgive me. It’s not meant to be a summary. But I want to once again say that this has been a very deep and productive discussion on CBMs. Many of you spoke, many of you were very concrete, and some of you spoke for the first time, at least this week. And it shows the commitment and engagement in this working group, but also specifically with regard to CBMs. Second, as many of you said, CBMs build trust, and implementing the CBMs that we have agreed to helps to build trust. And trust, in turn, allows for more dialogue to take place, and more dialogue could hopefully lead to agreement and concrete actions. So, in a sense, it’s an iterative cycle that can go on for a long time, because each time we meet and have dialogue, that leads to greater understanding and action. And when we implement what we have agreed, there’s even greater levels of trust. So I see this as an iterative process, not as a sequential process, because we need to constantly improve our dialogue, improve and build on levels of trust, and take a step-by-step approach to making decisions and taking action. So this discussion has been useful in that respect. Thank you also for responding to all the questions, the guiding questions. I think that helps not just me, but all of you get a sense of where some of the common elements are. I think there were many, many common elements under this section, and I will reflect on it carefully to see how we can structure our next discussion. Now, the first specific point that I think came across very clearly is that we definitely need to implement the POC Directory, operationalize it, and make it a success. And therefore, getting all the nominations this week and the indications that all of you are working on submitting your nominations, I think, is a very good sign. Thank you very much for that. The first meeting of the POC will be held on the 9th of May. I’ll give some careful thought about how we can structure the meeting so that it’s useful and meaningful for all of us. Now, at the same time, in addition to the POC Directory, there was also discussion about implementing the set of CBMs we have already agreed, which in some ways is related to the POC Directory as well, because that’s one of the global CBMs, Nominating Points of Contact Directory. So, implementing the CBMs, initial list of CBMs, is also an important task for us this year. And at the same time, starting a discussion on additional CBMs is something that I think we need to do as well at the same time, because it will take time to build convergence. I think there are many calls and indications of support for the new CBMs that I had identified in the questions list. Third-to-third cooperation, of course, capacity building itself as an enabler of trust and confidence. Many of you agreed that it is important to have it as a dedicated CBM, protection of critical infrastructure, public-private sector cooperation, coordinated vulnerability disclosure, as well as multistakeholder dialogue as being very important elements of possible future global CBMs. So that gives us a lot of material to continue our discussions, and I think this sets us up quite nicely for us to go deeper at the intersessional meeting in May with regard to CBMs, potentially new CBMs as well. There were many suggestions and ideas. With regard to the POC directory, I think there was also quite a number of you who spoke about templates or standardized formats to help the work of the POC, but some of you also said that it should be flexible, and some of you also said that we should not be moving too fast. But I think it’s important that we start a discussion, because starting a discussion does not mean that we will agree on everything immediately, but we need to have that discussion, especially on this question of standardized communication templates. And as part of that, there were also ideas and suggestions as to whether we should have any specific mechanisms for consultations in the context of the POC directory. I think the POC directory will bring people together, but as we heard from the OSCE, sometimes when the contact is made between two parties who perhaps do not interact very frequently, they take it offline, they continue their discussion, the manager of the POC doesn’t know what’s happening. In some ways, that’s by design a good thing, because the manager of the POC, whether regional or global, does not need to know what exactly members are discussing. But it’s also important that we share at some point how we are using the POC framework, because that’s also the question of how we improve it and how we can show that a global POC can be useful to all countries. And, of course, the POC directory in some ways can facilitate CBMs, can facilitate capacity building. If we say that capacity building is a CBM, capacity building is a cross-cutting issue, then the POC directory becomes more and more important as a framework, as a structure for dialogue and contacts between countries on a range of issues. And then there’s the whole question of capacity building for what? We are building confidence for what? Because of the emerging and evolving threat landscape. And so the POC directory could also in some ways become contact points for exchanging information on threats, and I think there was also a suggestion that perhaps it could be used as a framework or a platform to share real-time threat information. I think that was a proposal that one of you had put forward. I think it was Pakistan who mentioned that. So my point is that the POC directory is something that we need to operationalize, something that we need to make sure it becomes alive. It is something that we need to nurture in a careful way. We cannot overload it too much and too fast, but we also need to demonstrate that the structure of the POC directory can be beneficial. So that comes back to proceeding in a step-by-step, incremental way. Some of you want to do a lot. Others are saying let’s not do anything, but I think we need to find a middle path where we can continue discussions about how we can implement the POC directory, how we can encourage communication, how we can use it as a platform, not just for capacity building but exchanging information. In terms of new CBMs, I mentioned that there was a lot of support for set-to-set cooperation, private sector partnerships, coordinated vulnerability disclosures, systematic dialogue with stakeholders. Some of you had mentioned that there was also a suggestion for bringing together inter-regional arrangements because OSCE is there, ARF is there, OAS is there, but not every region is involved, but we need to find a way to make it inclusive. The idea is how can we learn from the experiences of regional organizations and then protection of critical infrastructure, of course. And capacity building as an enabler of CBMs is something that there was a very strong support. The question of ICT terminology, a few of you mentioned that. This is an issue that has been with us for some time, but again, this is something that I think is perhaps useful to continue discussing in the context of the POC directory. So there’s a lot of work to do, my friends, in the area of CBMs. That’s a good sign, but for the main session, we need to be focused again. We need to see how we can have a discussion that will allow us to build some common ground in terms of taking some next steps in July at the third annual progress report, but some of the issues may have to go beyond July to next year, maybe for the final progress report. But it’s important that when we have some common elements, it’s important that we find agreement and try and make a step forward, even if it’s half a step, it’s important, because it’s also important for the OEWG. Between now and the next session, the final session in next July, in the next 16 months, we can’t say that we are just going to be doing implementation, which is important, but we also need to continue discussions and find common ground and show that this working group is capable of delivering results, capable of building trust, and capable of continuing the discussion. So as I said, it’s a virtuous iterative cycle. So thank you very much for that discussion. It’s ten minutes to one, and we need to get to capacity building. So perhaps, given the time limit, we should start in the afternoon. But I want to say that on capacity building, in my opening remarks on Monday, I have already explained how important it is. And by now, you would have noticed that every issue we have discussed, the question of capacity building comes up. Threats, if we want to understand the evolving threats landscape, we need capacity building. Members are saying they need capacity building. Norms, implementation, it’s about capacity building. New norms, discussion, also will require a discussion on how we can facilitate experiences and how we can provide support. International law, capacity building was a big theme. And then confidence building measure, where it is very clear that capacity building itself is a confidence building measure, because capacity building is not something that you put in a box and send it across the border. It requires a partnership. It requires dialogue between two countries or more than two countries. That builds relationships, partnerships, builds trust, builds mutual respect, because capacity building has to be based on the capacity building principles, where it’s demand-driven, results-focused, people-centered, driven by governments themselves. So, capacity building is so foundational. And I want to, before we adjourn for this morning’s session, I want to share with you a concern that I have. The concern that I have is that we have talked a great deal about capacity building. The concern that I have is that we may not end up demonstrating results quickly. And that concerns me. Because in order to build trust, we have to show results. We have to start implementation. We have to deliver. And we have to show urgency with regard to capacity building. The concern I have is that if we take a wait-and-see approach, then delivery of capacity building may not begin as soon as it should. If we take the approach that let’s wait and see what happens in 2025 before we actually deliver capacity building, then we are wasting an opportunity to build trust in 2024. Now, we should use this period between now and July 2025 when we wrap up in this working group our work and pass it on to a future mechanism. We should use this opportunity to build trust, build confidence, and show results. So, that’s the concern I have, that we may end up taking a wait-and-see approach. So, I’d like to once again urge all of you, having heard everything that you’ve heard this week, it’s almost at the tail end of the meeting this week, because capacity building is so foundational, it’s really important that we show results and show urgency. Now, the good news is that a lot is happening. So, the Secretariat’s report on the mapping exercise made that clear. A lot is happening. The Secretariat will also release a report in June on capacity building needed for the POC Directory, and that report is going to be made available in June. But a report on capacity building is not in itself capacity building. It’s capacity building on paper. So, that’s good. So, that’s the good news. A lot is happening, and I know even the stakeholders are here. They have been doing a lot. They’re very active in the field. So, I just want to encourage all of you to see what we can do in a step-by-step way. What is it that we can do this year, by July? And that’s where the Global Roundtable on Capacity Building comes in. It is an opportunity to show results. It’s an opportunity to build partnerships. It’s an opportunity to build new partnerships. Because, as I said, the good news is we have a good, rich landscape where partners are doing a lot of things, where institutions are doing a lot of things, where stakeholders are being very committed. But we need to show results here at the UN. We need to reach out and build partnerships. We need to give a sense of momentum and a sense of urgency. So, I once again urge all of you to take the Global Roundtable on Capacity Building. Look at it as a very strategic opportunity to show results, but show results not for its own sake. For its own sake, show results to demonstrate urgency, to demonstrate the commitment to partnership, to build trust, and to broaden the engagement and participation in this process, and to bring people on board the framework of rules, norms, and principles. When we talk about mainstreaming the framework of rules, norms, and principles, that also begins with capacity building. So, I don’t want to belabor this point. I think I’ve been belaboring this point, but that’s my design. I have to belabor this point to some extent, because that’s my responsibility as the chair. And I wanted to share this concern that I have as well, that we should not end up waiting and seeing as to what we can do. Let’s see if we can discuss further. But let’s start looking at what we can do in a very concrete step-by-step way right now at this stage, and using the Global Roundtable on Capacity Building as an opportunity to show results, show urgency, show commitment, and maintain the momentum, help to build convergence, and take the next step forward before we wrap up this working group in 2025. I think the window is a very short one. 12:59, just in time to wrap up. So, I wish all of you a pleasant lunch. We will begin this afternoon with capacity building, with the speakers list, and I think some delegations have asked to make presentations, and as is the practice, I’ll let them start first to make presentations. So, the meeting is now adjourned. See you this afternoon. Thank you. Thank you.