Practice: Write a Paper on Cybersecurity

Your Assignment

Committee: General Assembly First Committee (Disarmament and International Security) Topic: Establishing Norms for Responsible State Behavior in Cyberspace Country: Estonia

Estonia is one of the world's most digitally advanced nations — and one of the first to experience a major state-level cyberattack. In 2007, a wave of distributed denial-of-service attacks targeted Estonian government, banking, and media websites during a diplomatic dispute with Russia over the relocation of a Soviet-era monument. This event transformed Estonia's approach to cybersecurity and established the country as a global leader in cyber defense and digital governance.

This is a more challenging assignment than the climate change paper because cybersecurity norms are still being developed — there are fewer established frameworks and more fundamental disagreements between states.

Research Briefing: Estonia and Cybersecurity

Country Profile:

• Population: ~1.3 million | EU and NATO member since 2004
• Hosts the NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE) in Tallinn since 2008
• e-Estonia: 99% of government services available online, digital ID for every citizen, e-residency program
• The Tallinn Manual (2013, updated 2017): an academic study on how international law applies to cyber operations, produced at CCDCOE

Key International Frameworks:

• UN Group of Governmental Experts (GGE) reports (2010, 2013, 2015, 2021): established that international law applies to cyberspace and proposed 11 voluntary norms
• UN Open-Ended Working Group (OEWG) on ICT security: parallel track with universal membership, currently in second mandate
• Budapest Convention on Cybercrime (2001): Council of Europe treaty, 68 parties, not endorsed by Russia or China
• UN Ad Hoc Committee drafting a new cybercrime convention (Russia-initiated, A/RES/74/247)

Fault Lines:

• Western states (US, EU, Australia) favor multi-stakeholder governance and the application of existing international law to cyberspace
• Russia and China advocate for state-centric 'information security' frameworks, new binding treaty, and internet sovereignty
• Developing states are often swing votes, balancing capacity-building needs against sovereignty concerns
• Attribution problem: difficulty proving state responsibility for cyberattacks complicates accountability