United Nations Cyber Norm Processes

UN cyber norm processes are forums in which states develop shared expectations for conduct in cyberspace. They build a framework of responsible state behaviour through expert dialogue, consensus reports, existing international law and voluntary, non-binding norms.

The two expert processes

Two complementary forums negotiate through discussion, national submissions and consensus reports.

• The Group of Governmental Experts, convened in successive groups since 2004, comprises experts from a limited, geographically representative set of states.
• The Open-ended Working Group, created in 2018, allows all UN member states to participate in intergovernmental deliberations.
• GGE expertise permits focused negotiation, while OEWG participation gives the resulting framework wider political legitimacy.

How consensus becomes a norm

States identify common threats, clarify acceptable conduct and adopt reports by consensus, making each formulation acceptable to every participant.

• The 2015 GGE report articulated eleven voluntary, non-binding norms, including protection of critical infrastructure and computer emergency response teams.
• Repeated affirmation in later reports and General Assembly processes strengthens expectations even though these norms are not treaties.
• States also agree that existing international law, especially the UN Charter, applies to state conduct involving information and communication technologies.

From principles to responsible behaviour

UN processes combine legal principles and voluntary norms with confidence-building measures and capacity-building.

• Recommended measures include information exchange, national contact points, incident cooperation and assistance to states lacking technical capacity.
• Implementation occurs through national policies, regional arrangements and continuing UN dialogue rather than a central enforcement authority.
• This iterative process enables states to clarify norms, report practices and address differing interpretations without converting every expectation into binding law.