UN Cyber Framework

The UN framework for responsible state behaviour in cyberspace is a set of cumulative consensus reports negotiated through the Group of Governmental Experts (GGE) and the Open-Ended Working Group (OEWG). It rests on four pillars: (1) the applicability of existing international law, including the UN Charter, to state conduct in cyberspace; (2) voluntary, non-binding norms of responsible state behaviour; (3) confidence-building measures (CBMs); and (4) capacity building.

Key milestones include the 2013 GGE report, which affirmed that international law applies to states' use of ICTs, and the 2015 GGE report, which set out eleven voluntary norms — for example, that states should not knowingly allow their territory to be used for internationally wrongful acts using ICTs, should not target another state's critical infrastructure, and should respond to requests for assistance from states whose critical infrastructure is under attack. The 2015 norms were endorsed by the General Assembly and remain the core normative reference point.

The 2021 OEWG final report and the 2021 GGE report reaffirmed and built on this acquis. Since 2021, negotiations have continued under a successor OEWG (2021–2025) with universal UN membership, addressing existing and potential threats, norms, international law, CBMs, capacity building, and regular institutional dialogue. A standing Programme of Action (PoA) has been proposed by a group of states to provide a permanent forum after the OEWG concludes.

The framework is non-binding — it does not create new treaty obligations — but it shapes state practice, attribution debates, and diplomatic responses to incidents. Disagreements persist on issues such as how international humanitarian law applies to cyber operations, the legality of countermeasures, and whether new legally binding instruments are needed, with Russia, China, and many Western states holding divergent views.