A new landmark in global cybersecurity negotiations: UN Cyber OEWG in numbers

Now that everyone’s morning news frequently feature cyberattacks that cause real damage to human health, safety, economic income and threaten nations’ political stability and elections; cybersecurity is finally mainstream. This is partially due to the fact that cyberspace is increasingly used and abused for geopolitical leverage – UN Secretary General Guterres has even warned that the next international conflict may begin with a cyberattack.

But we can find some comfort in knowing that states are trying to find common rules and define what is responsible behaviour in cyberspace.

Interested in becoming actively involved in cybersecurity negotiations and processes that aim to make our global cyberspace a safer place?

Diplo’s new Cybersecurity Diplomacy online course is open for applications.

It may not have made headlines, but the third substantive session of the UN’s Open-ended Working Group (OEWG) on Developments in the Field of ICTs in the Context of International Security – or in short the UN Cyber OEWG – made multilateral history as it concluded its work on 12 March 2021. Out of 68 UN member states each and every one were in consensus to adopt the Final Report of the Cyber OEWG.

What exactly was this final report about? What does an OEWG do? What are all these terms? For answers, keep on reading.

What is an open-ended working group?

The open-ended working groups (OEWGs) are a type of format present in the UN that are typically considered the most open, as the name suggests. It means that all UN member and observer states, intergovernmental organisations, and non-governmental organisations with the UN Economic and Social Council (ECOSOC) consultative status may attend public meetings of the working group. There are various OEWGs at the UN. Yet, decisions are made by the UN Member States. Today, we address the one dealing with cybersecurity.

What does the Cyber OEWG do?

In plain language, it tries to find more common ground on what is allowed and what is not in cyberspace – and how to ensure adherence to these rules. In the UN language, the Cyber OEWG was mandated to ‘continue to develop the rules, norms, and principles of responsible behaviour of states, discuss ways for their implementation, and to study the possibility of establishing regular institutional dialogue with broad participation under the auspices of the UN.’

How was the Cyber OEWG organised?

The Cyber OEWG was organised around an organisational session that discussed procedures and modus operandi, and substantives ones dealing with the matter. The Cyber OEWG had three substantive sessions on 9-13 September 2019, 10-14 February 2020, and the final one was held between 8-12 March 2021. Each ‘session’ consists of multiple ‘meetings’, typically two a day, one in the morning and one in the afternoon. We followed and reported from each of the sessions – you can find the reports on our dedicated page on the GIP Digital Watch observatory.

What’s the Final Substantive Report?

The Cyber OEWG was mandated to submit a report on the results of its work. Having all the UN states around the table with their own interests, a very complex matter, and generally divided global community, expectations were modest. Yet, after several iterations, the final report was adopted on 12 March by consensus which means 68 UN member states agreed on the final version of the report, which is very impressive as anyone familiar with multilateral processes would tell you. The success of this OEWG is evident as this is the first report on cybersecurity adopted by consensus in the UN group in the past six years, since the report of the GGE in 2015. We’ll analyse the substance of the report in another blog post.

The sections below give a numerical snapshot of the third substantive session of the OEWG, detailing how many interventions were delivered, whom they were delivered by, and what issues they addressed. Interestingly, we can read much about rifts in positions and capacities of various states and actors just based on these numbers. So, let’s dive in.

The UN Cyber OEWG in numbers

How many interventions?

A total of 173 interventions were delivered over the course of the third susbstantive session of the Cyber OEWG. There were a total of 11 meetings that were scheduled for 2 hours each, except for the 11th meeting which was scheduled to last 1 hour. Delegations kept to the time limit in most cases, delivering 3-4 minute interventions.

The first six meetings were dedicated to comments on the First Draft report. Among 69 delegations, 59 took the opportunity to note which parts of the First Draft report aligned and which parts diverged from their stances on various parts. Delegations also requested edits of specific paragraphs of the report, in alignment with their positions. All six meetings featured discussions on all sections of the First Draft report.

Meetings 7 and 8, which were scheduled for the fourth day of the session, were cancelled to give delegates time to consult their capitals on the text of the Final Draft report.

During meetings 9 and 10, which were designated for comments on the Final Draft, 51 delegates made 51 interventions.

Meeting 11, after the Final Draft report was adopted, featured 5 delegations taking the floor to deliver one intervention each.

The graph below illustrates how many delegates spoke at each meeting between 8-12 March at the third substantive session. Delegations were equally interested in (a) commenting on the First Draft of the report, when the text could still be edited, and (b) in noting their positions towards the text that was included in the Final Draft.

There were 69 delegations that intervened during the third and last substantive session of the Cyber OEWG (March 2021); including interventions by the EU, regional organisations including CARICOM and PIF, and the International Committee of the Red Cross (ICRC). In addition to the EU statement, some EU member states delivered statements in their national capacities.

When it comes to regional distribution of statement delivery, European countries led with 25 statements, followed by Asia with 17 and South America with 15 statements. African countries delivered 6 statements, while the South American region featured 15 statements, Oceania 3 (including the PIF), and North America 2.

The delegations spoke about the following sections of the report: ‘A. Introduction’, ‘B. Agreed conclusions and recommendations’, and ‘C. Discussion.’ Section B. encompassed the following: Existing and emerging threats, international law, norms, rules and principles, confidence building measures, capacity building, and regular institutional dialogue.

The most discussed section of the session was regular institutional dialogue, which focused on where and how will the negotiations on cybersecurity happen in the future. A total of 58 delegations addressed this issue, 25 from Europe and 17 by Asia. It was expected that this topic would garner much attention, as the week of the 8-12 March marked the end of the Cyber OEWG process, and as new proposals for the next steps were introduced; in particular the so-called Programme of Action, which we will discuss more in Part 2 of our blog.

The second most discussed section was on international law, as 56 delegations addressed this section of the report. Again, almost half of the interventions were made by European countries (24), while South America followed with 13 interventions. As delegations were not in agreement about which previously adopted legal framework is applicable to cyberspace, it is expected that there would be a debate about including references to this framework in the final report. Head over to Part 2 of our blog to find out more about this debate.

Delve deeper with maps and graphs

The mini app below contains two tabs. In the ‘Map’ tab you can see which delegations took the floor. Please note that the ICRC is not depicted on the map.

In the ‘Graph’ tab, you can see the number of quotes that each delegation made on each topic. Please note that the graph shows the number of quotes that were flagged as relevant by our team of rapporteurs.