UN Cyber Norms and International Law
The slow, contested process of establishing rules of the road for state behavior in cyberspace.
Two Parallel Tracks
The UN has pursued cyber norms through two parallel processes. The Group of Governmental Experts (GGE), limited to about 25 states, produced landmark reports in 2013 and 2015 establishing that existing international law applies to cyberspace and proposing voluntary norms of responsible state behavior.
The Open-Ended Working Group (OEWG), open to all UN members, began in 2019 as a Russian-led alternative. After initial rivalry, both tracks have converged on similar principles: states should not attack critical infrastructure, should cooperate on cyber crime, and should not conduct operations that intentionally damage critical infrastructure of other states.
However, these norms remain voluntary. There is no cyber treaty with binding obligations, and the gap between agreed norms and actual state behavior remains enormous.