Eight Norms for Stability in Cyberspace

In little more than a generation, the Internet has become a vital substrate for economic, social, and political interactions, and it has unlocked enormous gains. Along with greater interdependence, however, come vulnerability and conflict. Attacks by states and non-state actors have increased, threatening the stability of cyberspace.

In November, at the Paris Peace Forum, the Global Commission on the Stability of Cyberspace issued its report on how to provide an overarching cyber stability framework. Originally convened by the Dutch government three years ago, the multi-stakeholder GCSC (of which I was a member) had co-chairs from Estonia, India, and the United States, and comprised former government officials, experts from civil society, and academics from 16 countries.

Over the years, there have been numerous calls for laws and norms to manage the new international insecurity created by information technology, starting with Russian proposals at the United Nations two decades ago calling for a binding treaty. Unfortunately, given the nature of cyber weapons and the volatility of the technology, such a treaty would not be verifiable and would quickly become obsolete.

Instead, the UN set up a Group of Governmental Experts (GGE), which produced a non-binding set of norms in 2013 and 2015. That group was unable to issue a report in 2017, but its work continues with an expanded membership, and an Open-Ended Working Group, in which some 80 states participated last September, has joined it at the UN. In addition, UN Secretary-General António Guterres established a High-Level Group, which issued a report looking forward to a broader UN discussion in 2020....