International Code of Conduct for Information Security

The International Code of Conduct for Information Security is a draft set of voluntary norms circulated at the United Nations by a group of states led by China and Russia, intended to shape state behavior in cyberspace and the broader "information space."

The original version was submitted to the UN Secretary-General in September 2011 as document A/66/359 by China, Russia, Tajikistan, and Uzbekistan — all members of the Shanghai Cooperation Organisation (SCO). A revised version was circulated in January 2015 as A/69/723, co-sponsored additionally by Kazakhstan and Kyrgyzstan.

Key provisions in the draft urge states to:

• Not use information and communications technologies (ICTs) to carry out hostile activities or acts of aggression, or to threaten international peace and security.
• Cooperate in combating criminal and terrorist activities that use ICTs.
• Respect the sovereignty, territorial integrity, and political independence of all states in cyberspace, including over "information infrastructure" within their territory.
• Refrain from using ICTs to interfere in the internal affairs of other states or undermine their political, economic, and social stability.

The Code reflects a cyber sovereignty approach that contrasts with the multi-stakeholder, openness-oriented framing generally preferred by the United States, the EU, and like-minded states. Western governments and civil society groups have criticized the draft for language that could legitimize domestic content controls and restrictions on online expression, and for ambiguity around what counts as destabilizing "information."

The Code has not been adopted as a UN instrument. However, its themes have influenced parallel UN processes on ICT security, including the Group of Governmental Experts (GGE) and the Open-Ended Working Group (OEWG), where debates over sovereignty, applicability of international law, and human rights online continue.