Avoiding Deadlock Ahead of Future UN Cyber Security Negotiations

From 24–28 July, member states gathered in New York to discuss the future of norms for responsible state behaviour in cyberspace at the UN. The negotiations marked the end of the second year of the UN Open-Ended Working Group (OEWG) on the security of information and communications technologies – a process that is set to continue until 2025. The OEWG is the main space for discussions on cyber security, norms and international law within the UN, but growing geopolitical disputes meant the week nearly ended in deadlock and a failure to deliver a consensus report.

In a broader geopolitical context where the ongoing war in Ukraine, tensions in the South China Sea and other commercial and technological battles between the US and China persist, one could assume that negotiations on cyber norms would be equally difficult, to say the least.

However, in recent years, despite growing tensions and what might be described as a frustratingly slow pace of negotiations, UN discussions on norms for responsible state behaviour have arguably not been the most contentious area when compared to broader geopolitical disputes – until now.

For the first time since the start of the OEWG 2021–2025, member states came incredibly close to not reaching a consensus report due to at least two key points: a Russian proposal for a UN Convention on Cyber Security, and concerns from other states over supply chains and excessive mentions of human rights in the final annual report – the former being the central point of dispute. The near stalemate does not bode well for the next two years, and is indicative of the challenging road ahead for progress on the implementation of existing norms for responsible state behaviour.

As member states enter the third year of negotiations, it is crucial that both governments and stakeholders have a realistic grasp of the future bumps in the road. Negotiations will not get easier – so thinking strategically about interests, compromises and non-negotiables is key to striking a balance between advancing the debate and cautiously evaluating risks.

A Realistic Approach to UN Negotiations

One might say that progress within the UN should be interpreted according to a different timeframe. Negotiating a consensus text, agreeing on mandates, and strategising how to coordinate with counterparts is part of the careful craft of diplomacy – a craft that is sometimes at odds with the pace of technological change and developments in malicious cyber activity. Even so, it is important to recognise that member states have, for more than a decade now, agreed and restated their commitment to the fact that international law applies to cyberspace, and that they support 11 voluntary norms for responsible state behaviour – now known as the ‘acquis’ or the ‘framework for responsible state behaviour’.

Deadlocks are also not unfamiliar to multilateral negotiations – including on cyber – but having one almost occur now is an important alert. Previous iterations of UN cyber processes such as the OEWG and the UN Group of Governmental Experts (GGE) 2019–2021 – which had a similar mandate but involved a select group countries – faced growing pressures and came close to not reaching a consensus in 2021. The 2017 GGE effectively did not arrive at a consensus, but it spanned a shorter timeframe and at a certain point there were two processes with similar mandates – which made it arguably more challenging to ensure consensus and coordination.

After more than a decade of negotiations on norms for responsible state behaviour, three years of efforts under one single-track process, and 30 countries having published their views on how international law applies to cyberspace, not producing a consensus document could significantly consolidate a fracture in trust.

The OEWG is the result of a Russia-sponsored resolution that ended up facilitating greater participation of the UN’s 198 member states in this debate. However, the rift between Western democracies, some developing countries and Russia – along with other non-aligned countries and developing countries – should be a cause of concern for those involved in future rounds of negotiations, as it nearly led to a derailment during the latest substantive session of the OEWG in July.

What Happened?

At the heart of the near-deadlock of the July OEWG session stood a Russia-sponsored proposal for a legally binding instrument on international information security. In March 2023, Russia submitted a concept paper along with Belarus and Nicaragua suggesting that a future permanent UN mechanism should include the preparation of a draft of a legally binding instrument. This concept paper was followed by an updated version that was submitted in advance of the OEWG July meeting with a handful of additional co-sponsors as a draft text of the proposed Convention.

Having prepared and publicly signalled its intentions, Russia was adamant about the Convention proposal from day one of negotiations – making it the most important reference point for discussions on international law, regular institutional dialogue, and norms. Responses from other countries, however, were not welcoming. On the one hand, Western countries would not entertain the proposal and focused on advancing norms implementation as well as guidance rather than considering an expansion of the existing norms. On the other hand, many developing countries were invested in the implementation of capacity building principles previously agreed by the OEWG.

On the final day of negotiations, despite most member states having signalled their readiness to accept the final Annual Progress Report, Russia and its co-sponsors were still unsatisfied with the final text, given it had not included the commitment to discuss the Convention proposal. The remaining hours of the negotiations can be summarised as a series of bilateral discussions between the Chair, Russia and the US to arrive at a compromise.

For many years, and across different processes, Russia has pushed for a Convention on cyber security and cybercrime, given that both are closely intertwined with the concept of information security. It has been seeking to push this proposal in multiple regional groupings – examples include mentions of an international convention on combatting the use of information and communication technologies for criminal purposes in the 2014 BRICS declaration and the 2022 Samarkand Declaration of the Shanghai Cooperation Organisation.

This multi-forum strategy has provided some results after a Russia-sponsored resolution established negotiations for a UN Convention on Cybercrime in 2019. But since the latter is still under discussion, uncertainty looms over whether Russia and its allies will be able to see it through as envisioned or whether a convention under the UN OEWG would be more fitting.

Previous OEWG and GGE resolutions have noted the interest of ‘some’ states in a legally binding instrument. However, the previous 2019–2021 iteration of the OEWG report recognised that ‘new ideas and important proposals were put forward even though they were not necessarily agreed by all States, including the possibility of additional legally binding obligations’ – which shows that not much has changed since 2021.

But the OEWG is far from being isolated from other processes. This became clear in the final hours of the July meeting, when Russia – in an attempt to signal wider support for the Convention – noted that a high-level Russia–Africa Declaration published on that day had reaffirmed the role of the UN in developing new norms, ‘including through an international legally binding instrument’. African negotiating teams, many of which rely on having to liaise with their respective capitals to align speaking points, did not have the opportunity to react. The move could have been perceived as undercutting their points, as they had not necessarily demonstrated support for the Convention during the meeting.

While the proposal for a Convention is not entirely new, this muscular and more energetic approach from Russia could cause more harm to the process rather than pushing Western countries to arrive at a compromise. Not reaching a consensus in future rounds of negotiations could propel a further fracturing of multilateral mechanisms and reduce their ability to facilitate dialogue. But if the OEWG was initially a Russia-sponsored resolution, why would Russia go against the credibility of this process by pushing it to its limit?

What If There is No Consensus?

The OEWG is an important space for developing countries to engage in the dialogue on cyber norms. Member states that might not have had the opportunity to participate in the GGE can now bring their proposals and cooperate with other countries on strategic agendas, such as international law and capacity building. One important achievement of the OEWG so far has been the proposal to establish a Points of Contact (PoC) Directory to enable government-to-government cooperation on cyber security. This is also a proposal that the Chair, Ambassador Burhan Gafoor from Singapore, has been actively seeking to facilitate, having proposed elements of such a directory ahead of the July meeting.

Failing to reach a consensus during this OEWG meeting would have led to a considerable pause in this discussion – and could have backfired on Russia. Negotiations focusing solely on the Convention proposal could be perceived as dismissing the interests of many developing countries engaged in the process.

Another consequence of not reaching a consensus is that it would weaken the role of the OEWG and thus potentially strengthen the Programme of Action (PoA) – a permanent, inclusive and action-oriented mechanism to support the implementation of the acquis after the end of the OEWG, the resolution for which counted 157 votes in favour. Rather than enhancing complementarity between the current (OEWG) and future (PoA) mechanism, this would increase the asymmetry between both. It would also create a vacuum of consensus text until the completion of the OEWG’s mandate in 2025, if a no-consensus situation were to be persist in the OEWG. Undercutting the progress of the OEWG would probably also weaken any future proposals from Russia for a post-2025 OEWG to discuss the Convention proposal, depending on how such moves are received by developing countries.

Looking Forward

Disagreement and contestation are a fundamental part of negotiations, and are not unexpected. The challenge for the OEWG in the years ahead is to strike a balance between what it should deliver and what it can, and whether less propensity of some countries to achieve compromise can ultimately challenge the process. Undoubtedly, the negotiations have produced some clearer achievables for the future. This is the case with the PoC Directory, which could be a useful resource for countries that are not yet integrated with a regional PoC network; the implementation of capacity building principles outlined in the 2019–2021 OEWG final report; and the expansion of the discussion on how emerging threats relate to international peace and security. The same was also true of the recognition of ransomware in the latest Annual Progress Report.

There is still a considerable amount of work to be done between now and the next meeting of the OEWG in December. The Chair has suggested a series of intersessional meetings that indicate a commitment to fostering as much dialogue as possible, and would focus on specific topics. The stakes of a five-year process and what it can deliver are higher than those of the previous OEWG, and are certainly a long-term investment for many developing countries. Avoiding deadlock is key, but the costs required to do so remain uncertain. The OEWG can either provide a positive outlook on implementation or mark a fracturing of future processes on responsible state behaviour.

The views expressed in this Commentary are the author’s, and do not represent those of RUSI or any other institution.

Have an idea for a Commentary you’d like to write for us? Send a short pitch to commentaries@rusi.org and we’ll get back to you if it fits into our research interests. Full guidelines for contributors can be found here.